Restrict org admin invitation actions to users with confirmed emails

Author: allanlasser

frontend/css/gps.css

@@ -442,6 +442,7 @@ strong {
 
 .empty {
   display: flex;
+  margin: 0 auto;
   width: 16.5rem;
   padding: 1.5rem;
   flex-direction: column;
@@ -453,12 +454,18 @@ strong {
   border: 1.282px solid var(--Gray-2, #d8dee2);
 }
 
+.empty--no-border {
+  border: none;
+}
+
 .empty p {
   align-self: stretch;
-  margin: 0;
+  font-family: "Source Sans Pro";
+  line-height: 1.4;
   color: var(--gray-4);
+  margin: 0 auto;
   text-align: center;
-  font-family: "Source Sans Pro";
+  max-width: 60ch;
 }
 
 .card {

squarelet/organizations/models/invitation.py

@@ -103,6 +103,10 @@ class Meta:
     def __str__(self):
         return f"Invitation: {self.uuid}"
 
+    @property
+    def is_admin_role(self):
+        return self.role == InvitationRole.admin
+
     def send(self):
 
         if self.request:

squarelet/organizations/tests/test_views.py

@@ -1641,6 +1641,13 @@ class TestInvitationAccept(ViewTestMixin):
     view = views.InvitationAccept
     url = "/organizations/{uuid}/invitation/"
 
+    def _create_verified_email(self, user):
+        EmailAddress.objects.update_or_create(
+            user=user,
+            email=user.email,
+            defaults={"verified": True, "primary": True},
+        )
+
     def test_accept(self, rf, invitation_factory, user_factory):
         invitation = invitation_factory()
         user = user_factory()
@@ -1649,6 +1656,30 @@ def test_accept(self, rf, invitation_factory, user_factory):
         assert invitation.accepted_at is not None
         assert invitation.organization.has_member(user)
 
+    def test_accept_admin_requires_verified_email(
+        self, rf, invitation_factory, user_factory
+    ):
+        """Users without a verified email cannot accept admin invitations"""
+        invitation = invitation_factory(role=InvitationRole.admin)
+        user = user_factory()
+        response = self.call_view(rf, user, {"action": "accept"}, uuid=invitation.uuid)
+        invitation.refresh_from_db()
+        assert invitation.accepted_at is None
+        assert not invitation.organization.has_member(user)
+        assert response.status_code == 302
+
+    def test_accept_admin_with_verified_email(
+        self, rf, invitation_factory, user_factory
+    ):
+        """Users with a verified email can accept admin invitations"""
+        invitation = invitation_factory(role=InvitationRole.admin)
+        user = user_factory()
+        self._create_verified_email(user)
+        self.call_view(rf, user, {"action": "accept"}, uuid=invitation.uuid)
+        invitation.refresh_from_db()
+        assert invitation.accepted_at is not None
+        assert invitation.organization.has_member(user)
+
     def test_reject(self, rf, invitation_factory, user_factory):
         invitation = invitation_factory()
         user = user_factory()

squarelet/organizations/views/members.py

@@ -280,6 +280,16 @@ def post(self, request, *args, **kwargs):
         invitation = self.get_object()
         action = request.POST.get("action")
         if action == "accept":
+            if (
+                invitation.role == InvitationRole.admin
+                and not request.user.emailaddress_set.filter(verified=True).exists()
+            ):
+                messages.error(
+                    request,
+                    "You must verify your email address before accepting "
+                    "an admin invitation.",
+                )
+                return redirect("organizations:invitation", uuid=invitation.uuid)
             invitation.accept(request.user)
             messages.success(request, "Invitation accepted")
 

squarelet/templates/organizations/invitation_detail.html

@@ -2,6 +2,7 @@
 {% load static %}
 {% load thumbnail %}
 {% load i18n %}
+{% load email_verification %}
 
 {% block title %}Organization: {{ invitation.organization.name }}{% endblock %}
 
@@ -52,6 +53,13 @@ <h2>
           out and sign back in with the account you'd like to use.
         {% endblocktrans %}
       </p>
+      {% if invitation.is_admin_role and not request.user|has_verified_email %}
+      <p>
+        {% blocktrans %}
+          You must verify your email address before you can accept an admin invitation.
+        {% endblocktrans %}
+      </p>
+      {% endif %}
       {% else %}
       <p>
         {% blocktrans %}
@@ -75,6 +83,17 @@ <h2>
       {% endif %}
 
       {% if request.user.is_authenticated %}
+        {% if invitation.is_admin_role and not request.user|has_verified_email %}
+        <div class="control-group">
+          <form class="email-actions" action="{% url "account_email" %}" method="post">
+            {% csrf_token %}
+            <input type="hidden" name="email" value="{{request.user.email}}" />
+            <button class="button primary" type="submit" name="action_send">
+              {% trans "Verify your email address" %}
+            </button>
+          </form>
+        </div>
+        {% else %}
         <div class="control-group">
             <button class="button primary" type="submit" name="action" value="accept">
               {% trans "Accept" %}
@@ -84,6 +103,7 @@ <h2>
             </button>
           </div>
         </div>
+        {% endif %}
       {% else %}
         <div class="control-group">
             <a href="{% url "account_signup" %}?next={{request.path}}" class="button primary">

squarelet/templates/organizations/organization_list.html

@@ -1,5 +1,5 @@
 {% extends "base.html" %}
-{% load static i18n avatar django_vite email_verification %}
+{% load static i18n avatar django_vite %}
 
 {% block title %}Organizations{% endblock %}
 
@@ -102,23 +102,6 @@ <h2>{% trans "Your organizations" %}</h2>
     </section>
 
     <section class="invites">
-      {% if not request.user|has_verified_email %}
-      <div class="empty">
-        <p>
-          {% blocktrans %}
-          You must verify your email address before you can send requests
-          or receive invitations to join an organization.
-          {% endblocktrans %}
-        </p>
-        <form class="email-actions" action="{% url "account_email" %}" method="post">
-          {% csrf_token %}
-          <input type="hidden" name="email" value="{{user.email}}" />
-          <button class="btn primary small" type="submit" name="action_send">
-            {% trans "Confirm your email address" %}
-          </button>
-        </form>
-      </div>
-      {% else %}
         {% if potential_orgs %}
         <div id="pre-approved" class="pre-approved">
           <header>
@@ -213,7 +196,6 @@ <h2>{% trans "Pending requests" %}</h2>
           </div>
           {% endif %}
         </div>
-      {% endif %}
     </section>
   </main>
 </article>

squarelet/templates/organizations/organization_managemembers.html

@@ -144,8 +144,8 @@ <h2>
         </form>
       </div>
       {% empty %}
-      <div class="empty">
-        <h3>No pending requests</h3>
+      <div class="empty empty--no-border">
+        <p>No pending requests</p>
       </div>
       {% endfor %}
     </div>
@@ -207,8 +207,8 @@ <h2>
           </div>
         </div>
       {% empty %}
-        <div class="empty">
-          <h3>No pending invitations</h3>
+        <div class="empty empty--no-border">
+          <p>No pending invitations</p>
         </div>
       {% endfor %}
       </div>