fix(auth): vérification promote_pending_email, purge tokens change-email, fallback login (#73)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/auth/routes.py

@@ -71,7 +71,7 @@ def verify_email():
 def login():
     email = (request.form.get("email") or "").strip().lower()
     password = request.form.get("password") or ""
-    next_url = safe_next(request.form.get("next"), fallback="/compte")
+    next_url = safe_next(request.form.get("next"), fallback="/compte/admin")
 
     row = db.get_user_by_email(email)
     if row is None:
@@ -181,6 +181,7 @@ def change_email():
         return _redirect_with_error("/compte/admin", "email_taken")
 
     db.set_pending_email(current_user.id, email)
+    db.delete_email_verification_tokens_for_user(current_user.id)
     token = tokens.create_verification_token(current_user.id)
     try:
         mailer.send_email_change_email(email, token)
@@ -197,7 +198,9 @@ def confirm_email_change():
     user_id = tokens.consume_verification_token(token)
     if user_id is None:
         return redirect("/compte/admin?error=invalid_token")
-    db.promote_pending_email(user_id)
+    new_email = db.promote_pending_email(user_id)
+    if new_email is None:
+        return redirect("/compte/admin?error=invalid_token")
     return redirect("/compte/admin?email_changed=1")
 
 

tests/auth/test_login.py

@@ -17,7 +17,7 @@ def test_login_success(client, users_db_path):
         data={"email": "a@b.c", "password": "password12"},
     )
     assert resp.status_code == 302
-    assert resp.headers["Location"].endswith("/compte")
+    assert resp.headers["Location"].endswith("/compte/admin")
 
 
 def test_login_wrong_password(client, users_db_path):
@@ -63,7 +63,7 @@ def test_login_rejects_absolute_next(client, users_db_path):
             "next": "https://evil.com",
         },
     )
-    assert resp.headers["Location"].endswith("/compte")
+    assert resp.headers["Location"].endswith("/compte/admin")
 
 
 def test_logout_clears_session(client, users_db_path):