Merge lp:~maxiberta/canonical-identity-provider/canonical-email-urls into lp:canonical-identity-provider/release

[Maximiliano Bertacchini]

Use settings.SSO_ROOT_URL as the base for all URLs in emails.

Use settings.SSO_ROOT_URL as the base for all URLs in emails, instead of calculating it from the current request which might come from the internal API client via HTTP. This prevents including http:// URLS in emails.

Implementation notes: basically
- Dropped the `root_url` parameter from all functions in emailutils.py and replaced by settings.SSO_ROOT_URL.
- Dropped `root_url` from all call sites to emailutils functions.
- Set settings.SSO_ROOT_URL="http://testserver" in testing mode to match Django testing internals.

[Celso Providelo (cprov)]

Generally agree with the change to respect the settings parameter, instead of calculate it from the context request.

I wish the change was smaller by avoiding changing the implementation and methods signatures at the same time, but you already managed to do it all at once <bonus/>.

review: Approve

[Otto Co-Pilot (otto-copilot)]

Running landing tests failed
https://jenkins.ols.canonical.com/online-services/job/canonical-identity-provider/181/

=== modified file 'django_project/settings_test.py'
--- django_project/settings_test.py	2018-02-15 13:17:06 +0000
+++ django_project/settings_test.py	2018-08-15 14:28:34 +0000
@@ -2,6 +2,8 @@
 
 from settings_devel import *   # noqa
 
+SSO_ROOT_URL = 'http://testserver'
+
 # https://github.com/sunlightlabs/django-honeypot/issues/12
 # until django-honeypot provides a way of using the middleware in tests,
 # we'll remove the middleware

=== modified file 'src/api/v10/handlers.py'
--- src/api/v10/handlers.py	2018-02-21 11:59:00 +0000
+++ src/api/v10/handlers.py	2018-08-15 14:28:34 +0000
@@ -224,9 +224,8 @@
 
         account = Account.objects.create_account(
             displayname, email, password, email_validated=False)
-        root_url = request.build_absolute_uri('/')
         emailutils.send_new_user_email(
-            root_url, account=account, email=email,
+            account=account, email=email,
             redirection_url=redirection_url, platform=platform)
         account_created.send(
             sender=self, openid_identifier=account.openid_identifier)

=== modified file 'src/api/v10/tests/utils.py'
--- src/api/v10/tests/utils.py	2018-02-09 20:56:16 +0000
+++ src/api/v10/tests/utils.py	2018-08-15 14:28:34 +0000
@@ -40,7 +40,8 @@
         self.addCleanup(urllib_intercept.uninstall_opener)
         httplib2_intercept.install()
         self.addCleanup(httplib2_intercept.uninstall)
-        add_wsgi_intercept(parse.hostname, parse.port, WSGIHandler)
+        # This should intercept requests to http://testserver on port 80.
+        add_wsgi_intercept(parse.hostname, parse.port or 80, WSGIHandler)
         self.addCleanup(remove_wsgi_intercept, parse.hostname, parse.port)
         self.api = ServiceRoot(None, host_url + '/api/1.0')
 

=== modified file 'src/api/v20/handlers.py'
--- src/api/v20/handlers.py	2018-02-09 14:17:25 +0000
+++ src/api/v20/handlers.py	2018-08-15 14:28:34 +0000
@@ -215,8 +215,7 @@
         if account is None:
             # they've tried to reset with an invalid email, so send them
             # an email on how to create an account
-            root_url = request.build_absolute_uri('/')
-            emailutils.send_invitation_after_password_reset(root_url, email)
+            emailutils.send_invitation_after_password_reset(email)
 
             if invalidated_email.exists():
                 # there is no account with this email
@@ -264,9 +263,8 @@
 
         # create new token and send email to user
         redirection_url = redirection_url_for_token(token_string)
-        root_url = request.build_absolute_uri('/')
         auth_token, inv_auth_token = emailutils.send_password_reset_email(
-            root_url, account, email, redirection_url)
+            account, email, redirection_url)
 
         # return response
         data = dict(email=auth_token.email)
@@ -335,7 +333,7 @@
         root_url = request.build_absolute_uri('/')
         try:
             account = registration.register(
-                root_url, email, password, displayname, username=username,
+                email, password, displayname, username=username,
                 creation_source=data.get('creation_source'),
                 oid_token=data.get('oid_token')
             )
@@ -378,10 +376,9 @@
             missing = dict((k, [FIELD_REQUIRED]) for k in expected - set(data))
             return errors.INVALID_DATA(**missing)
 
-        root_url = request.build_absolute_uri('/')
         try:
             account = registration.register(
-                root_url, email, password=None, displayname=displayname,
+                email, password=None, displayname=displayname,
                 email_validated=True, send_email=False,
                 creation_source=data.get('creation_source'),
                 require_password=False,

=== modified file 'src/api/v20/registration.py'
--- src/api/v20/registration.py	2018-02-09 20:56:16 +0000
+++ src/api/v20/registration.py	2018-08-15 14:28:34 +0000
@@ -29,7 +29,7 @@
 
 
 def register(
-        root_url, email, password, displayname, username=None,
+        email, password, displayname, username=None,
         email_validated=False, send_email=True, creation_source=None,
         require_password=True, oid_token=None):
     """Register a new account"""
@@ -39,7 +39,7 @@
         # Only send email if the account is active; otherwise, a disabled
         # account can be spammed.
         if other_email.account.is_active and send_email:
-            send_impersonation_email(root_url, other_email.email)
+            send_impersonation_email(other_email.email)
         raise EmailAlreadyRegistered(other_email.account)
 
     data = {
@@ -81,7 +81,7 @@
     account_created.send('api', openid_identifier=account.openid_identifier)
 
     if send_email:
-        send_new_user_email(root_url=root_url, account=account, email=email,
+        send_new_user_email(account=account, email=email,
                             oid_token=oid_token)
 
     return account

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2018-05-28 17:22:45 +0000
+++ src/api/v20/tests/test_handlers.py	2018-08-15 14:28:34 +0000
@@ -1767,8 +1767,7 @@
 
         extra = {'email': ['No account associated with [e-mail]']}
         self.assert_bad_request(data={'email': '[e-mail]'}, extra=extra)
-        mock_send_invitation.assert_called_once_with(
-            self.sso_root_url, '[e-mail]')
+        mock_send_invitation.assert_called_once_with('[e-mail]')
 
     def test_suspended_account(self):
         self.account.suspend()
@@ -1910,8 +1909,7 @@
             content = self.do_post(
                 {'email': invalidated_email.email}, status_code=403)
 
-        mock_send_invitation.assert_called_once_with(self.sso_root_url,
-                                                     self.email.email)
+        mock_send_invitation.assert_called_once_with(self.email.email)
         expected = {
             'message': ('This email address has been invalidated. '
                         'Please contact login support.'),
@@ -1930,7 +1928,7 @@
             {'email': self.email.email, 'token': token}, status_code=201)
 
         mock_send_password_reset_email.assert_called_once_with(
-            self.sso_root_url, self.account, self.email.email, redirection_url)
+            self.account, self.email.email, redirection_url)
 
     def test_invalid_email_throttle_decorator(self):
         self.assert_bad_request(

=== modified file 'src/api/v20/tests/test_registration.py'
--- src/api/v20/tests/test_registration.py	2018-05-25 22:02:57 +0000
+++ src/api/v20/tests/test_registration.py	2018-08-15 14:28:34 +0000
@@ -38,7 +38,7 @@
         super(RegistrationTestCase, self).setUp()
         self.email = self.factory.make_email_address()
         self.data = [
-            self.sso_root_url, self.email, 'SecretPassword1', 'displayname']
+            self.email, 'SecretPassword1', 'displayname']
 
         self.mock_send_impersonation_email = self.patch(
             'api.v20.registration.send_impersonation_email')
@@ -60,8 +60,7 @@
         if password is not None:
             account.user.check_password(password)
         self.mock_send_new_user_email.assert_called_once_with(
-            root_url=self.sso_root_url, account=account, email=self.email,
-            oid_token=None)
+            account=account, email=self.email, oid_token=None)
         self.assertFalse(self.mock_send_impersonation_email.called)
 
     def test_register_already_registered_and_inactive(self):
@@ -71,8 +70,7 @@
 
         with self.assertRaises(registration.EmailAlreadyRegistered):
             registration.register(
-                self.sso_root_url, email=self.email, password="",
-                displayname="")
+                email=self.email, password="", displayname="")
 
         self.assertFalse(self.mock_send_impersonation_email.called)
         self.assertFalse(self.mock_send_new_user_email.called)
@@ -83,11 +81,9 @@
 
         with self.assertRaises(registration.EmailAlreadyRegistered):
             registration.register(
-                self.sso_root_url, email=self.email, password="",
-                displayname="")
+                email=self.email, password="", displayname="")
 
-        self.mock_send_impersonation_email.assert_called_once_with(
-            self.sso_root_url, self.email)
+        self.mock_send_impersonation_email.assert_called_once_with(self.email)
         self.assertFalse(self.mock_send_new_user_email.called)
 
     def test_register_success(self):
@@ -269,7 +265,7 @@
         username = 'InvalidUsername'
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email=self.email, password=None,
+                email=self.email, password=None,
                 displayname='displayname', username=username)
         e = ctx.exception
         self.assertEqual(e.message_dict['username'], [INVALID_NAME])
@@ -289,7 +285,7 @@
             return_value=fake_lp_response)
 
         account = registration.register(
-            self.sso_root_url, email=self.email, password=None,
+            email=self.email, password=None,
             displayname='displayname', username=username,
             require_password=False)
 
@@ -298,7 +294,7 @@
     @switches(USERNAME_UI=False)
     def test_can_create_account_without_pw_with_feature_flag_disabled(self):
         account = registration.register(
-            self.sso_root_url, email=self.email, password=None,
+            email=self.email, password=None,
             displayname='displayname', username='validusername',
             require_password=False)
 
@@ -316,7 +312,7 @@
             return_value=fake_lp_response)
 
         account = registration.register(
-            self.sso_root_url, email=self.email, password='',
+            email=self.email, password='',
             displayname='displayname', username=username,
             require_password=False)
 
@@ -325,7 +321,7 @@
     @switches(USERNAME_UI=False)
     def test_can_create_account_with_empty_pw_with_feature_flag_disabled(self):
         account = registration.register(
-            self.sso_root_url, email=self.email, password='',
+            email=self.email, password='',
             displayname='displayname', require_password=False)
 
         self.assert_correct_account_content(account)
@@ -333,7 +329,7 @@
     def test_password_required_by_default(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email=self.email, password=None,
+                email=self.email, password=None,
                 displayname='displayname', username='validusername')
 
         e = ctx.exception
@@ -343,7 +339,7 @@
     def test_form_validation_with_valid_pw_with_feature_flag_enabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email='bad.email', password='TheSecret1',
+                email='bad.email', password='TheSecret1',
                 displayname=None, username='InvalidUsername')
         e = ctx.exception
         self.assertEqual(e.message_dict['displayname'], [FIELD_REQUIRED])
@@ -356,7 +352,7 @@
     def test_form_validation_with_valid_pw_with_feature_flag_disabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email='bad.email', password='TheSecret1',
+                email='bad.email', password='TheSecret1',
                 displayname=None, username='InvalidUsername')
 
         e = ctx.exception
@@ -372,7 +368,7 @@
     def test_form_validation_with_no_pw_and_with_feature_flag_enabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email='bad.email', password=None,
+                email='bad.email', password=None,
                 displayname=None, username='InvalidUsername')
 
         e = ctx.exception
@@ -387,7 +383,7 @@
     def test_form_validation_with_no_pw_and_feature_flag_disabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email='bad.email', password=None,
+                email='bad.email', password=None,
                 displayname=None, username='InvalidUsername',
                 require_password=False)
 
@@ -419,7 +415,7 @@
     def test_invalid_email_and_no_pw_with_default_require_password(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                self.sso_root_url, email="", password=None,
+                email="", password=None,
                 displayname='displayname', require_password=True)
 
         e = ctx.exception
@@ -428,9 +424,8 @@
 
     def test_invalid_email_and_password_with_no_require_password(self):
         with self.assertRaises(ValidationError) as ctx:
-            registration.register(
-                self.sso_root_url, email="", password=123,
-                displayname='displayname')
+            registration.register(email="", password=123,
+                                  displayname='displayname')
 
         e = ctx.exception
         self.assertEqual(e.message_dict['email'], [FIELD_REQUIRED])
@@ -442,7 +437,7 @@
         assert Account.objects.all().count() == 0
 
         registration.register(
-            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
+            self.email, 'SecretPassword1', 'displayname',
             oid_token="fake_oid_token")
 
         self.assertEqual(Account.objects.all().count(), 1)
@@ -455,13 +450,13 @@
             self.client.login(username=self.email, password='SecretPassword1'),
             'Password was not properly set on new account.')
         self.mock_send_new_user_email.assert_called_once_with(
-            root_url=self.sso_root_url, oid_token="fake_oid_token",
+            oid_token="fake_oid_token",
             account=account, email=self.email)
         self.assertFalse(self.mock_send_impersonation_email.called)
 
     def test_invalid_email_and_pw(self):
         with self.assertRaises(ValidationError) as ctx:
-            registration.register(self.sso_root_url, "", '', 'displayname')
+            registration.register("", '', 'displayname')
 
         e = ctx.exception
         self.assertEqual(e.message_dict['email'], [FIELD_REQUIRED])
@@ -471,7 +466,7 @@
         self.factory.make_leaked_credential(email='[e-mail]',
                                             password=DEFAULT_USER_PASSWORD)
         with self.assertRaises(PasswordPolicyError) as ctx:
-            registration.register(self.sso_root_url, '[e-mail]',
+            registration.register('[e-mail]',
                                   DEFAULT_USER_PASSWORD, 'displayname')
 
         self.assertIn('there was a security breach', str(ctx.exception))
@@ -479,26 +474,26 @@
 
     def test_email_not_validated(self):
         account = registration.register(
-            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
+            self.email, 'SecretPassword1', 'displayname',
             email_validated=False)
         self.assertFalse(account.is_verified)
 
     def test_email_validated(self):
         account = registration.register(
-            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
+            self.email, 'SecretPassword1', 'displayname',
             email_validated=True)
         self.assertTrue(account.is_verified)
 
     def test_creation_rationale_unset_source(self):
         account = registration.register(
-            self.sso_root_url, self.email, 'SecretPassword1', 'displayname')
+            self.email, 'SecretPassword1', 'displayname')
         self.assertEqual(
             account.creation_rationale, AccountCreationRationale.API_CREATED)
         self.assertIsNone(account.creation_source)
 
     def test_creation_rationale_set_source(self):
         account = registration.register(
-            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
+            self.email, 'SecretPassword1', 'displayname',
             creation_source='foo bar baz')
         self.assertEqual(
             account.creation_rationale, AccountCreationRationale.API_CREATED)

=== modified file 'src/identityprovider/emailutils.py'
--- src/identityprovider/emailutils.py	2018-05-28 19:44:56 +0000
+++ src/identityprovider/emailutils.py	2018-08-15 14:28:34 +0000
@@ -96,7 +96,7 @@
     return result
 
 
-def _context_for_email_request(root_url, account, email, token_type,
+def _context_for_email_request(account, email, token_type,
                                redirection_url, requester_email=None,
                                oid_token=None,
                                **kwargs):
@@ -117,7 +117,7 @@
     token_path = token.get_absolute_url()
     if oid_token:
         token_path = oid_token + token_path
-    token_url = urljoin(root_url, token_path)
+    token_url = urljoin(settings.SSO_ROOT_URL, token_path)
     context = {
         'requester': name,
         'requester_email': token.requester_email,
@@ -136,15 +136,15 @@
             email=email, token_type=AuthTokenType.INVALIDATEEMAIL,
             redirection_url=redirection_url)
         token_url = urljoin(
-            root_url, invalidate_email_token.get_absolute_url())
+            settings.SSO_ROOT_URL, invalidate_email_token.get_absolute_url())
         context['invalidate_email_url'] = token_url
 
     return context, token, invalidate_email_token
 
 
-def send_impersonation_email(root_url, email):
+def send_impersonation_email(email):
     """Send an email to user warning of attempted registration"""
-    url = urljoin(root_url, reverse('forgot_password'))
+    url = urljoin(settings.SSO_ROOT_URL, reverse('forgot_password'))
     context = {
         'forgotten_password_url': url, 'to_email': email,
     }
@@ -152,7 +152,7 @@
         _("Warning"), 'email/impersonate-warning.txt', context, email)
 
 
-def send_new_user_email(root_url, account, email, redirection_url=None,
+def send_new_user_email(account, email, redirection_url=None,
                         platform='all', oid_token=None):
     """
     Send an email to a new user.
@@ -165,7 +165,7 @@
     """
 
     context, token, invalidate_email_token = _context_for_email_request(
-        root_url, account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
+        account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
         oid_token=oid_token)
 
     if platform != 'desktop':
@@ -194,7 +194,7 @@
     return {'subject': subject, 'template': template}
 
 
-def send_password_reset_email(root_url, account, email, redirection_url=None,
+def send_password_reset_email(account, email, redirection_url=None,
                               reason='forgot_password'):
     """
     Send an email with password reset instructions.
@@ -213,7 +213,7 @@
     template = data['template']
 
     context, token, invalidate_email_token = _context_for_email_request(
-        root_url, account, email, AuthTokenType.PASSWORDRECOVERY,
+        account, email, AuthTokenType.PASSWORDRECOVERY,
         redirection_url, requester_email=email)
     send_fancy_email(subject, template, context, email)
     return token, invalidate_email_token
@@ -235,7 +235,7 @@
         context=context, email=email.email)
 
 
-def send_printed_codes_renewal_email(root_url, account, devices):
+def send_printed_codes_renewal_email(account, devices):
     email = account.preferredemail
     if email is None:
         logger.warning(
@@ -246,7 +246,7 @@
     device_urls = []
     for device in devices:
         device_urls.append(
-            urljoin(root_url,
+            urljoin(settings.SSO_ROOT_URL,
                     reverse('device-print', kwargs=dict(device_id=device.id))))
     context = dict(display_name=account.displayname, device_urls=device_urls)
     send_fancy_email(
@@ -255,7 +255,7 @@
         context=context, email=email)
 
 
-def send_validation_email_request(root_url, account, email,
+def send_validation_email_request(account, email,
                                   redirection_url=None, oid_token=None):
     """
     Send an email asking to validate the email account.
@@ -272,7 +272,7 @@
         preferredemail_email = account.preferredemail.email
 
     context, token, invalidate_email_token = _context_for_email_request(
-        root_url, account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
+        account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
         requester_email=preferredemail_email, oid_token=oid_token)
     send_fancy_email(
         _("Validate your email address"), 'email/validate-email.txt',
@@ -280,7 +280,7 @@
     return token, invalidate_email_token
 
 
-def send_invalidation_email_notice(root_url, account, invalidated_email):
+def send_invalidation_email_notice(account, invalidated_email):
     preferredemail = account.preferredemail
     assert preferredemail is not None
     email = preferredemail.email
@@ -289,7 +289,7 @@
         to_email=email,
     )
     if account.unverified_emails().count() > 0:
-        url = urljoin(root_url, reverse('account-emails'))
+        url = urljoin(settings.SSO_ROOT_URL, reverse('account-emails'))
         context['verify_emails_link'] = url
     send_fancy_email(
         _("The email address {email} was removed from your account").format(
@@ -297,8 +297,7 @@
         'email/email-invalidated.txt', context=context, email=email)
 
 
-def send_notification_to_invalidated_email_address(root_url, account,
-                                                   invalidated_email):
+def send_notification_to_invalidated_email_address(account, invalidated_email):
     context = dict(
         display_name=account.displayname, invalidated_email=invalidated_email,
         to_email=invalidated_email,
@@ -319,15 +318,15 @@
         {'new_preferred': new_preferred}, email)
 
 
-def send_invitation_after_password_reset(root_url, email):
-    url = urljoin(root_url, reverse('new_account'))
+def send_invitation_after_password_reset(email):
+    url = urljoin(settings.SSO_ROOT_URL, reverse('new_account'))
     send_fancy_email(
         _("Password reset request"), 'email/invitation.txt',
         {'email': email, 'signup': url}, email,
     )
 
 
-def send_action_required_warning(root_url, account, days_of_warning, action):
+def send_action_required_warning(account, days_of_warning, action):
     """
     Send an email to warn the user that an action is required.
 
@@ -343,10 +342,10 @@
     assert preferredemail is not None
     email = preferredemail.email
     context, token, invalidate_email_token = _context_for_email_request(
-        root_url, account, email, AuthTokenType.VALIDATEEMAIL,
+        account, email, AuthTokenType.VALIDATEEMAIL,
         redirection_url=None)
     context.update(dict(
-        emails_url=urljoin(root_url, reverse('account-emails')),
+        emails_url=urljoin(settings.SSO_ROOT_URL, reverse('account-emails')),
         created=account.date_created, action=action,
         days_of_warning=days_of_warning,
     ))

=== modified file 'src/identityprovider/tests/test_emailutils.py'
--- src/identityprovider/tests/test_emailutils.py	2018-05-28 19:44:56 +0000
+++ src/identityprovider/tests/test_emailutils.py	2018-08-15 14:28:34 +0000
@@ -321,7 +321,7 @@
             self.assertNotIn(invalidate_msg, email.body)
 
     def test_send_impersonation_email(self):
-        send_impersonation_email(self.sso_root_url, self.email)
+        send_impersonation_email(self.email)
 
         url = self.request.build_absolute_uri(
             reverse('forgot_password'))
@@ -338,7 +338,7 @@
 
     def test_send_new_user_email_no_platform(self):
         token, invalidate_token = send_new_user_email(
-            self.sso_root_url, self.account, self.email, self.redirection_url)
+            self.account, self.email, self.redirection_url)
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -349,8 +349,7 @@
     @patch('identityprovider.emailutils.logger')
     def test_send_new_user_email_invalid_platform(self, mock_logger):
         token, invalidate_token = send_new_user_email(
-            self.sso_root_url, self.account, self.email,
-            self.redirection_url, platform='foo')
+            self.account, self.email, self.redirection_url, platform='foo')
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -360,8 +359,7 @@
 
     def test_send_new_user_email_platform_desktop(self):
         token, invalidate_token = send_new_user_email(
-            self.sso_root_url, self.account, self.email, self.redirection_url,
-            platform='desktop')
+            self.account, self.email, self.redirection_url, platform='desktop')
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -372,8 +370,7 @@
     def test_send_new_user_email_platform_mobile(self):
         self.account = None
         token, invalidate_token = send_new_user_email(
-            self.sso_root_url, self.account, self.email, self.redirection_url,
-            platform='mobile')
+            self.account, self.email, self.redirection_url, platform='mobile')
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -384,7 +381,7 @@
     def test_send_new_user_email_with_oid_token(self):
         oid_token = "iama_oid_token"
         token, invalidate_token = send_new_user_email(
-            self.sso_root_url, self.account, self.email, self.redirection_url,
+            self.account, self.email, self.redirection_url,
             oid_token=oid_token)
 
         self.assert_tokens()
@@ -396,7 +393,7 @@
 
     def test_send_password_reset_email_with_redirection_url(self):
         token, invalidate_token = send_password_reset_email(
-            self.sso_root_url, self.account, self.email, self.redirection_url)
+            self.account, self.email, self.redirection_url)
 
         self.assert_tokens(requester_email=self.email)
         self.assert_email_properly_formatted(
@@ -406,7 +403,7 @@
 
     def test_send_password_reset_email_no_redirection_url(self):
         token, invalidate_token = send_password_reset_email(
-            self.sso_root_url, self.account, self.email)
+            self.account, self.email)
 
         self.assert_tokens(requester_email=self.email, redirection_url=None)
         self.assert_email_properly_formatted(
@@ -416,8 +413,7 @@
 
     def test_send_password_reset_email_with_custom_reason(self):
         token, invalidate_token = send_password_reset_email(
-            self.sso_root_url, self.account, self.email,
-            reason='password_leak|adobe')
+            self.account, self.email, reason='password_leak|adobe')
 
         self.assert_tokens(requester_email=self.email, redirection_url=None)
         token_type = AuthTokenType.PASSWORDRECOVERY
@@ -433,8 +429,7 @@
 
     def test_send_password_reset_email_with_generic_leak_template(self):
         token, invalidate_token = send_password_reset_email(
-            self.sso_root_url, self.account, self.email,
-            reason='password_leak|foo')
+            self.account, self.email, reason='password_leak|foo')
 
         self.assert_tokens(requester_email=self.email, redirection_url=None)
         token_type = AuthTokenType.PASSWORDRECOVERY
@@ -449,15 +444,14 @@
             context=context, token_type=token_type)
 
     def test_send_password_reset_email_with_invalid_reason(self):
-        send_password_reset_email(self.sso_root_url, self.account, self.email,
-                                  reason='invalid')
+        send_password_reset_email(self.account, self.email, reason='invalid')
 
         self.assert_tokens(requester_email=self.email, redirection_url=None,
                            tokens_count=0)
         self.assertEqual(len(mail.outbox), 0)
 
     def test_leaked_password_reset_email_without_invalidation_link(self):
-        send_password_reset_email(self.sso_root_url, self.account, self.email,
+        send_password_reset_email(self.account, self.email,
                                   reason='password_leak|adobe')
 
         self.assertEqual(len(mail.outbox), 1)
@@ -469,7 +463,7 @@
         assert self.account.preferredemail is not None
 
         token, invalidate_token = send_validation_email_request(
-            self.sso_root_url, self.account, self.email, self.redirection_url)
+            self.account, self.email, self.redirection_url)
 
         email = self.account.preferredemail.email
         self.assert_tokens(requester_email=email)
@@ -484,7 +478,7 @@
         assert self.account.preferredemail is None
 
         token, invalidate_token = send_validation_email_request(
-            self.sso_root_url, self.account, self.email, self.redirection_url)
+            self.account, self.email, self.redirection_url)
 
         # two tokens are created, one for validation, and one for invalidation,
         # since the email being validated is not in the system, so the real
@@ -497,7 +491,7 @@
 
     def test_send_validation_email_request_no_redirection_url(self):
         token, invalidate_token = send_validation_email_request(
-            self.sso_root_url, self.account, self.email)
+            self.account, self.email)
 
         email = self.account.preferredemail.email
         self.assert_tokens(requester_email=email, redirection_url=None)
@@ -509,7 +503,7 @@
     def test_send_validation_email_request_with_oid_token(self):
         oid_token = 'a' * 16
         token, invalidate_token = send_validation_email_request(
-            self.sso_root_url, self.account, self.email, self.redirection_url,
+            self.account, self.email, self.redirection_url,
             oid_token=oid_token)
 
         email = self.account.preferredemail.email
@@ -522,8 +516,7 @@
 
     def _assert_send_invalidation_email_notice(self):
         invalidated_email = '[e-mail]'
-        send_invalidation_email_notice(self.sso_root_url, self.account,
-                                       invalidated_email)
+        send_invalidation_email_notice(self.account, invalidated_email)
 
         verify_emails_link = self.request.build_absolute_uri(
             reverse('account-emails'))
@@ -561,8 +554,7 @@
 
     def test_send_notification_to_invalidated_email_address(self):
         invalidated_email = '[e-mail]'
-        send_notification_to_invalidated_email_address(self.sso_root_url,
-                                                       self.account,
+        send_notification_to_invalidated_email_address(self.account,
                                                        invalidated_email)
         context = dict(
             display_name=self.account.displayname,
@@ -588,7 +580,7 @@
 
     def test_send_invitation_after_password_reset(self):
         url = self.request.build_absolute_uri(reverse('new_account'))
-        send_invitation_after_password_reset(self.sso_root_url, self.email)
+        send_invitation_after_password_reset(self.email)
 
         context = {
             'email': self.email, 'signup': url,
@@ -607,7 +599,7 @@
         url = self.request.build_absolute_uri(reverse('account-emails'))
 
         token, invalidate_token = send_action_required_warning(
-            self.sso_root_url, self.account, days_of_warning=8, action=action)
+            self.account, days_of_warning=8, action=action)
 
         # tokens will always be 2, since we need the validate email token *and*
         # the invalidate email
@@ -655,8 +647,7 @@
                    settings.TWOFACTOR_PAPER_CODES_WARN_RENEWAL + 1)
         device = self.factory.make_device(
             account=self.account, device_type='paper', counter=counter)
-        send_printed_codes_renewal_email(
-            self.sso_root_url, self.account, [device])
+        send_printed_codes_renewal_email(self.account, [device])
         url = self.request.build_absolute_uri(
             reverse('device-print', kwargs=dict(device_id=device.id)))
         context = dict(display_name=self.account.displayname,
@@ -680,8 +671,7 @@
             account=self.account, device_type='paper', counter=counter)
         device2 = self.factory.make_device(
             account=self.account, device_type='paper', counter=counter)
-        send_printed_codes_renewal_email(
-            self.sso_root_url, self.account, [device1, device2])
+        send_printed_codes_renewal_email(self.account, [device1, device2])
         url1 = self.request.build_absolute_uri(
             reverse('device-print', kwargs=dict(device_id=device1.id)))
         url2 = self.request.build_absolute_uri(
@@ -712,8 +702,7 @@
         device = self.factory.make_device(
             account=self.account, device_type='paper', counter=counter)
         with patch('identityprovider.emailutils.logger') as mock_logger:
-            send_printed_codes_renewal_email(
-                self.sso_root_url, self.account, [device])
+            send_printed_codes_renewal_email(self.account, [device])
         self.assertEqual(len(mail.outbox), 0)
         mock_logger.warning.assert_called_once_with(
             'Unable to find a suitable email address to send OTP reminder '

=== modified file 'src/webui/views/account.py'
--- src/webui/views/account.py	2018-05-28 20:15:33 +0000
+++ src/webui/views/account.py	2018-08-15 14:28:34 +0000
@@ -305,8 +305,7 @@
 
     redirection_url = redirection_url_for_token(token)
 
-    root_url = request.build_absolute_uri('/')
-    send_validation_email_request(root_url, request.user, email,
+    send_validation_email_request(request.user, email,
                                   redirection_url, oid_token=token)
     set_session_email(request.session, email)
 
@@ -416,16 +415,13 @@
         return response
 
     # notify the account of the email invalidation, prioritize validated emails
-    root_url = request.build_absolute_uri('/')
     if account.preferredemail is not None:
         send_invalidation_email_notice(
-            root_url,
             account,
             invalidated_email=email.email,
         )
     else:
         send_notification_to_invalidated_email_address(
-            root_url,
             account,
             invalidated_email=email.email,
         )

=== modified file 'src/webui/views/ui.py'
--- src/webui/views/ui.py	2018-05-28 20:15:33 +0000
+++ src/webui/views/ui.py	2018-08-15 14:28:34 +0000
@@ -360,9 +360,8 @@
                 url += "?next=" + urlquote(next_url)
             return HttpResponseRedirect(url)
         elif paper_devices_needing_renewal:
-            root_url = request.build_absolute_uri('/')
             send_printed_codes_renewal_email(
-                root_url, request.user, paper_devices_needing_renewal)
+                request.user, paper_devices_needing_renewal)
         if next_url and is_safe_redirect_url(next_url):
             return HttpResponseRedirect(next_url)
         elif token: