From ff7aaa54cd2aee815f42cc13afea5a5a24bbc9df Mon Sep 17 00:00:00 2001 From: Colin Maudry Date: Wed, 24 Jun 2026 22:25:34 +0200 Subject: [PATCH] =?UTF-8?q?fix(auth):=20v=C3=A9rification=20promote=5Fpend?= =?UTF-8?q?ing=5Femail,=20purge=20tokens=20change-email,=20fallback=20logi?= =?UTF-8?q?n=20(#73)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 4.6 --- src/auth/routes.py | 7 +++++-- tests/auth/test_login.py | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/auth/routes.py b/src/auth/routes.py index ecb393e..1de1ce3 100644 --- a/src/auth/routes.py +++ b/src/auth/routes.py @@ -71,7 +71,7 @@ def verify_email(): def login(): email = (request.form.get("email") or "").strip().lower() password = request.form.get("password") or "" - next_url = safe_next(request.form.get("next"), fallback="/compte") + next_url = safe_next(request.form.get("next"), fallback="/compte/admin") row = db.get_user_by_email(email) if row is None: @@ -181,6 +181,7 @@ def change_email(): return _redirect_with_error("/compte/admin", "email_taken") db.set_pending_email(current_user.id, email) + db.delete_email_verification_tokens_for_user(current_user.id) token = tokens.create_verification_token(current_user.id) try: mailer.send_email_change_email(email, token) @@ -197,7 +198,9 @@ def confirm_email_change(): user_id = tokens.consume_verification_token(token) if user_id is None: return redirect("/compte/admin?error=invalid_token") - db.promote_pending_email(user_id) + new_email = db.promote_pending_email(user_id) + if new_email is None: + return redirect("/compte/admin?error=invalid_token") return redirect("/compte/admin?email_changed=1") diff --git a/tests/auth/test_login.py b/tests/auth/test_login.py index 9df7221..33944f5 100644 --- a/tests/auth/test_login.py +++ b/tests/auth/test_login.py @@ -17,7 +17,7 @@ def test_login_success(client, users_db_path): data={"email": "a@b.c", "password": "password12"}, ) assert resp.status_code == 302 - assert resp.headers["Location"].endswith("/compte") + assert resp.headers["Location"].endswith("/compte/admin") def test_login_wrong_password(client, users_db_path): @@ -63,7 +63,7 @@ def test_login_rejects_absolute_next(client, users_db_path): "next": "https://evil.com", }, ) - assert resp.headers["Location"].endswith("/compte") + assert resp.headers["Location"].endswith("/compte/admin") def test_logout_clears_session(client, users_db_path):