Merge lp:~maxiberta/canonical-identity-provider/revert-r1653 into lp:canonical-identity-provider/release

[Maximiliano Bertacchini]

Revert using settings.SSO_ROOT_URL as the base for all URLs in emails (r1653).

r1653 broke emails from login.launchpad.net by using settings.SSO_ROOT_URL (ie. login.ubuntu.com) unconditionally (see: https://code.launchpad.net/~maxiberta/canonical-identity-provider/canonical-email-urls/+merge/353119).

Revert procedure:
  # Make sure we're on trunk r1653
  $ bzr revno
  1653

  # Revert
  $ bzr revert -r1652
   M django_project/settings_test.py
   M po/api/api.pot
   M po/identityprovider/identityprovider.pot
   M po/ubuntu_sso_saml/ubuntu_sso_saml.pot
   M po/webui/webui.pot
   M src/api/v10/handlers.py
   M src/api/v10/tests/utils.py
   M src/api/v20/handlers.py
   M src/api/v20/registration.py
   M src/api/v20/tests/test_handlers.py
   M src/api/v20/tests/test_registration.py
   M src/identityprovider/emailutils.py
   M src/identityprovider/tests/test_emailutils.py
   M src/webui/views/account.py
   M src/webui/views/ui.py

  # Ignore changes in po/
  $ bzr revert po
   M po/api/api.pot
   M po/identityprovider/identityprovider.pot
   M po/ubuntu_sso_saml/ubuntu_sso_saml.pot
   M po/webui/webui.pot

  $ bzr commit

[Celso Providelo (cprov)]

review: Approve

=== modified file 'django_project/settings_test.py'
--- django_project/settings_test.py	2018-08-14 21:03:03 +0000
+++ django_project/settings_test.py	2018-08-17 18:50:19 +0000
@@ -2,8 +2,6 @@
 
 from settings_devel import *   # noqa
 
-SSO_ROOT_URL = 'http://testserver'
-
 # https://github.com/sunlightlabs/django-honeypot/issues/12
 # until django-honeypot provides a way of using the middleware in tests,
 # we'll remove the middleware

=== modified file 'src/api/v10/handlers.py'
--- src/api/v10/handlers.py	2018-08-14 20:27:59 +0000
+++ src/api/v10/handlers.py	2018-08-17 18:50:19 +0000
@@ -224,8 +224,9 @@
 
         account = Account.objects.create_account(
             displayname, email, password, email_validated=False)
+        root_url = request.build_absolute_uri('/')
         emailutils.send_new_user_email(
-            account=account, email=email,
+            root_url, account=account, email=email,
             redirection_url=redirection_url, platform=platform)
         account_created.send(
             sender=self, openid_identifier=account.openid_identifier)

=== modified file 'src/api/v10/tests/utils.py'
--- src/api/v10/tests/utils.py	2018-08-14 20:27:59 +0000
+++ src/api/v10/tests/utils.py	2018-08-17 18:50:19 +0000
@@ -40,8 +40,7 @@
         self.addCleanup(urllib_intercept.uninstall_opener)
         httplib2_intercept.install()
         self.addCleanup(httplib2_intercept.uninstall)
-        # This should intercept requests to http://testserver on port 80.
-        add_wsgi_intercept(parse.hostname, parse.port or 80, WSGIHandler)
+        add_wsgi_intercept(parse.hostname, parse.port, WSGIHandler)
         self.addCleanup(remove_wsgi_intercept, parse.hostname, parse.port)
         self.api = ServiceRoot(None, host_url + '/api/1.0')
 

=== modified file 'src/api/v20/handlers.py'
--- src/api/v20/handlers.py	2018-08-14 20:27:59 +0000
+++ src/api/v20/handlers.py	2018-08-17 18:50:19 +0000
@@ -215,7 +215,8 @@
         if account is None:
             # they've tried to reset with an invalid email, so send them
             # an email on how to create an account
-            emailutils.send_invitation_after_password_reset(email)
+            root_url = request.build_absolute_uri('/')
+            emailutils.send_invitation_after_password_reset(root_url, email)
 
             if invalidated_email.exists():
                 # there is no account with this email
@@ -263,8 +264,9 @@
 
         # create new token and send email to user
         redirection_url = redirection_url_for_token(token_string)
+        root_url = request.build_absolute_uri('/')
         auth_token, inv_auth_token = emailutils.send_password_reset_email(
-            account, email, redirection_url)
+            root_url, account, email, redirection_url)
 
         # return response
         data = dict(email=auth_token.email)
@@ -333,7 +335,7 @@
         root_url = request.build_absolute_uri('/')
         try:
             account = registration.register(
-                email, password, displayname, username=username,
+                root_url, email, password, displayname, username=username,
                 creation_source=data.get('creation_source'),
                 oid_token=data.get('oid_token')
             )
@@ -376,9 +378,10 @@
             missing = dict((k, [FIELD_REQUIRED]) for k in expected - set(data))
             return errors.INVALID_DATA(**missing)
 
+        root_url = request.build_absolute_uri('/')
         try:
             account = registration.register(
-                email, password=None, displayname=displayname,
+                root_url, email, password=None, displayname=displayname,
                 email_validated=True, send_email=False,
                 creation_source=data.get('creation_source'),
                 require_password=False,

=== modified file 'src/api/v20/registration.py'
--- src/api/v20/registration.py	2018-08-14 20:27:59 +0000
+++ src/api/v20/registration.py	2018-08-17 18:50:19 +0000
@@ -29,7 +29,7 @@
 
 
 def register(
-        email, password, displayname, username=None,
+        root_url, email, password, displayname, username=None,
         email_validated=False, send_email=True, creation_source=None,
         require_password=True, oid_token=None):
     """Register a new account"""
@@ -39,7 +39,7 @@
         # Only send email if the account is active; otherwise, a disabled
         # account can be spammed.
         if other_email.account.is_active and send_email:
-            send_impersonation_email(other_email.email)
+            send_impersonation_email(root_url, other_email.email)
         raise EmailAlreadyRegistered(other_email.account)
 
     data = {
@@ -81,7 +81,7 @@
     account_created.send('api', openid_identifier=account.openid_identifier)
 
     if send_email:
-        send_new_user_email(account=account, email=email,
+        send_new_user_email(root_url=root_url, account=account, email=email,
                             oid_token=oid_token)
 
     return account

=== modified file 'src/api/v20/tests/test_handlers.py'
--- src/api/v20/tests/test_handlers.py	2018-08-14 20:27:59 +0000
+++ src/api/v20/tests/test_handlers.py	2018-08-17 18:50:19 +0000
@@ -1767,7 +1767,8 @@
 
         extra = {'email': ['No account associated with [e-mail]']}
         self.assert_bad_request(data={'email': '[e-mail]'}, extra=extra)
-        mock_send_invitation.assert_called_once_with('[e-mail]')
+        mock_send_invitation.assert_called_once_with(
+            self.sso_root_url, '[e-mail]')
 
     def test_suspended_account(self):
         self.account.suspend()
@@ -1909,7 +1910,8 @@
             content = self.do_post(
                 {'email': invalidated_email.email}, status_code=403)
 
-        mock_send_invitation.assert_called_once_with(self.email.email)
+        mock_send_invitation.assert_called_once_with(self.sso_root_url,
+                                                     self.email.email)
         expected = {
             'message': ('This email address has been invalidated. '
                         'Please contact login support.'),
@@ -1928,7 +1930,7 @@
             {'email': self.email.email, 'token': token}, status_code=201)
 
         mock_send_password_reset_email.assert_called_once_with(
-            self.account, self.email.email, redirection_url)
+            self.sso_root_url, self.account, self.email.email, redirection_url)
 
     def test_invalid_email_throttle_decorator(self):
         self.assert_bad_request(

=== modified file 'src/api/v20/tests/test_registration.py'
--- src/api/v20/tests/test_registration.py	2018-08-14 20:27:59 +0000
+++ src/api/v20/tests/test_registration.py	2018-08-17 18:50:19 +0000
@@ -38,7 +38,7 @@
         super(RegistrationTestCase, self).setUp()
         self.email = self.factory.make_email_address()
         self.data = [
-            self.email, 'SecretPassword1', 'displayname']
+            self.sso_root_url, self.email, 'SecretPassword1', 'displayname']
 
         self.mock_send_impersonation_email = self.patch(
             'api.v20.registration.send_impersonation_email')
@@ -60,7 +60,8 @@
         if password is not None:
             account.user.check_password(password)
         self.mock_send_new_user_email.assert_called_once_with(
-            account=account, email=self.email, oid_token=None)
+            root_url=self.sso_root_url, account=account, email=self.email,
+            oid_token=None)
         self.assertFalse(self.mock_send_impersonation_email.called)
 
     def test_register_already_registered_and_inactive(self):
@@ -70,7 +71,8 @@
 
         with self.assertRaises(registration.EmailAlreadyRegistered):
             registration.register(
-                email=self.email, password="", displayname="")
+                self.sso_root_url, email=self.email, password="",
+                displayname="")
 
         self.assertFalse(self.mock_send_impersonation_email.called)
         self.assertFalse(self.mock_send_new_user_email.called)
@@ -81,9 +83,11 @@
 
         with self.assertRaises(registration.EmailAlreadyRegistered):
             registration.register(
-                email=self.email, password="", displayname="")
+                self.sso_root_url, email=self.email, password="",
+                displayname="")
 
-        self.mock_send_impersonation_email.assert_called_once_with(self.email)
+        self.mock_send_impersonation_email.assert_called_once_with(
+            self.sso_root_url, self.email)
         self.assertFalse(self.mock_send_new_user_email.called)
 
     def test_register_success(self):
@@ -265,7 +269,7 @@
         username = 'InvalidUsername'
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email=self.email, password=None,
+                self.sso_root_url, email=self.email, password=None,
                 displayname='displayname', username=username)
         e = ctx.exception
         self.assertEqual(e.message_dict['username'], [INVALID_NAME])
@@ -285,7 +289,7 @@
             return_value=fake_lp_response)
 
         account = registration.register(
-            email=self.email, password=None,
+            self.sso_root_url, email=self.email, password=None,
             displayname='displayname', username=username,
             require_password=False)
 
@@ -294,7 +298,7 @@
     @switches(USERNAME_UI=False)
     def test_can_create_account_without_pw_with_feature_flag_disabled(self):
         account = registration.register(
-            email=self.email, password=None,
+            self.sso_root_url, email=self.email, password=None,
             displayname='displayname', username='validusername',
             require_password=False)
 
@@ -312,7 +316,7 @@
             return_value=fake_lp_response)
 
         account = registration.register(
-            email=self.email, password='',
+            self.sso_root_url, email=self.email, password='',
             displayname='displayname', username=username,
             require_password=False)
 
@@ -321,7 +325,7 @@
     @switches(USERNAME_UI=False)
     def test_can_create_account_with_empty_pw_with_feature_flag_disabled(self):
         account = registration.register(
-            email=self.email, password='',
+            self.sso_root_url, email=self.email, password='',
             displayname='displayname', require_password=False)
 
         self.assert_correct_account_content(account)
@@ -329,7 +333,7 @@
     def test_password_required_by_default(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email=self.email, password=None,
+                self.sso_root_url, email=self.email, password=None,
                 displayname='displayname', username='validusername')
 
         e = ctx.exception
@@ -339,7 +343,7 @@
     def test_form_validation_with_valid_pw_with_feature_flag_enabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email='bad.email', password='TheSecret1',
+                self.sso_root_url, email='bad.email', password='TheSecret1',
                 displayname=None, username='InvalidUsername')
         e = ctx.exception
         self.assertEqual(e.message_dict['displayname'], [FIELD_REQUIRED])
@@ -352,7 +356,7 @@
     def test_form_validation_with_valid_pw_with_feature_flag_disabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email='bad.email', password='TheSecret1',
+                self.sso_root_url, email='bad.email', password='TheSecret1',
                 displayname=None, username='InvalidUsername')
 
         e = ctx.exception
@@ -368,7 +372,7 @@
     def test_form_validation_with_no_pw_and_with_feature_flag_enabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email='bad.email', password=None,
+                self.sso_root_url, email='bad.email', password=None,
                 displayname=None, username='InvalidUsername')
 
         e = ctx.exception
@@ -383,7 +387,7 @@
     def test_form_validation_with_no_pw_and_feature_flag_disabled(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email='bad.email', password=None,
+                self.sso_root_url, email='bad.email', password=None,
                 displayname=None, username='InvalidUsername',
                 require_password=False)
 
@@ -415,7 +419,7 @@
     def test_invalid_email_and_no_pw_with_default_require_password(self):
         with self.assertRaises(ValidationError) as ctx:
             registration.register(
-                email="", password=None,
+                self.sso_root_url, email="", password=None,
                 displayname='displayname', require_password=True)
 
         e = ctx.exception
@@ -424,8 +428,9 @@
 
     def test_invalid_email_and_password_with_no_require_password(self):
         with self.assertRaises(ValidationError) as ctx:
-            registration.register(email="", password=123,
-                                  displayname='displayname')
+            registration.register(
+                self.sso_root_url, email="", password=123,
+                displayname='displayname')
 
         e = ctx.exception
         self.assertEqual(e.message_dict['email'], [FIELD_REQUIRED])
@@ -437,7 +442,7 @@
         assert Account.objects.all().count() == 0
 
         registration.register(
-            self.email, 'SecretPassword1', 'displayname',
+            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
             oid_token="fake_oid_token")
 
         self.assertEqual(Account.objects.all().count(), 1)
@@ -450,13 +455,13 @@
             self.client.login(username=self.email, password='SecretPassword1'),
             'Password was not properly set on new account.')
         self.mock_send_new_user_email.assert_called_once_with(
-            oid_token="fake_oid_token",
+            root_url=self.sso_root_url, oid_token="fake_oid_token",
             account=account, email=self.email)
         self.assertFalse(self.mock_send_impersonation_email.called)
 
     def test_invalid_email_and_pw(self):
         with self.assertRaises(ValidationError) as ctx:
-            registration.register("", '', 'displayname')
+            registration.register(self.sso_root_url, "", '', 'displayname')
 
         e = ctx.exception
         self.assertEqual(e.message_dict['email'], [FIELD_REQUIRED])
@@ -466,7 +471,7 @@
         self.factory.make_leaked_credential(email='[e-mail]',
                                             password=DEFAULT_USER_PASSWORD)
         with self.assertRaises(PasswordPolicyError) as ctx:
-            registration.register('[e-mail]',
+            registration.register(self.sso_root_url, '[e-mail]',
                                   DEFAULT_USER_PASSWORD, 'displayname')
 
         self.assertIn('there was a security breach', str(ctx.exception))
@@ -474,26 +479,26 @@
 
     def test_email_not_validated(self):
         account = registration.register(
-            self.email, 'SecretPassword1', 'displayname',
+            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
             email_validated=False)
         self.assertFalse(account.is_verified)
 
     def test_email_validated(self):
         account = registration.register(
-            self.email, 'SecretPassword1', 'displayname',
+            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
             email_validated=True)
         self.assertTrue(account.is_verified)
 
     def test_creation_rationale_unset_source(self):
         account = registration.register(
-            self.email, 'SecretPassword1', 'displayname')
+            self.sso_root_url, self.email, 'SecretPassword1', 'displayname')
         self.assertEqual(
             account.creation_rationale, AccountCreationRationale.API_CREATED)
         self.assertIsNone(account.creation_source)
 
     def test_creation_rationale_set_source(self):
         account = registration.register(
-            self.email, 'SecretPassword1', 'displayname',
+            self.sso_root_url, self.email, 'SecretPassword1', 'displayname',
             creation_source='foo bar baz')
         self.assertEqual(
             account.creation_rationale, AccountCreationRationale.API_CREATED)

=== modified file 'src/identityprovider/emailutils.py'
--- src/identityprovider/emailutils.py	2018-08-14 20:27:59 +0000
+++ src/identityprovider/emailutils.py	2018-08-17 18:50:19 +0000
@@ -96,7 +96,7 @@
     return result
 
 
-def _context_for_email_request(account, email, token_type,
+def _context_for_email_request(root_url, account, email, token_type,
                                redirection_url, requester_email=None,
                                oid_token=None,
                                **kwargs):
@@ -117,7 +117,7 @@
     token_path = token.get_absolute_url()
     if oid_token:
         token_path = oid_token + token_path
-    token_url = urljoin(settings.SSO_ROOT_URL, token_path)
+    token_url = urljoin(root_url, token_path)
     context = {
         'requester': name,
         'requester_email': token.requester_email,
@@ -136,15 +136,15 @@
             email=email, token_type=AuthTokenType.INVALIDATEEMAIL,
             redirection_url=redirection_url)
         token_url = urljoin(
-            settings.SSO_ROOT_URL, invalidate_email_token.get_absolute_url())
+            root_url, invalidate_email_token.get_absolute_url())
         context['invalidate_email_url'] = token_url
 
     return context, token, invalidate_email_token
 
 
-def send_impersonation_email(email):
+def send_impersonation_email(root_url, email):
     """Send an email to user warning of attempted registration"""
-    url = urljoin(settings.SSO_ROOT_URL, reverse('forgot_password'))
+    url = urljoin(root_url, reverse('forgot_password'))
     context = {
         'forgotten_password_url': url, 'to_email': email,
     }
@@ -152,7 +152,7 @@
         _("Warning"), 'email/impersonate-warning.txt', context, email)
 
 
-def send_new_user_email(account, email, redirection_url=None,
+def send_new_user_email(root_url, account, email, redirection_url=None,
                         platform='all', oid_token=None):
     """
     Send an email to a new user.
@@ -165,7 +165,7 @@
     """
 
     context, token, invalidate_email_token = _context_for_email_request(
-        account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
+        root_url, account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
         oid_token=oid_token)
 
     if platform != 'desktop':
@@ -194,7 +194,7 @@
     return {'subject': subject, 'template': template}
 
 
-def send_password_reset_email(account, email, redirection_url=None,
+def send_password_reset_email(root_url, account, email, redirection_url=None,
                               reason='forgot_password'):
     """
     Send an email with password reset instructions.
@@ -213,7 +213,7 @@
     template = data['template']
 
     context, token, invalidate_email_token = _context_for_email_request(
-        account, email, AuthTokenType.PASSWORDRECOVERY,
+        root_url, account, email, AuthTokenType.PASSWORDRECOVERY,
         redirection_url, requester_email=email)
     send_fancy_email(subject, template, context, email)
     return token, invalidate_email_token
@@ -235,7 +235,7 @@
         context=context, email=email.email)
 
 
-def send_printed_codes_renewal_email(account, devices):
+def send_printed_codes_renewal_email(root_url, account, devices):
     email = account.preferredemail
     if email is None:
         logger.warning(
@@ -246,7 +246,7 @@
     device_urls = []
     for device in devices:
         device_urls.append(
-            urljoin(settings.SSO_ROOT_URL,
+            urljoin(root_url,
                     reverse('device-print', kwargs=dict(device_id=device.id))))
     context = dict(display_name=account.displayname, device_urls=device_urls)
     send_fancy_email(
@@ -255,7 +255,7 @@
         context=context, email=email)
 
 
-def send_validation_email_request(account, email,
+def send_validation_email_request(root_url, account, email,
                                   redirection_url=None, oid_token=None):
     """
     Send an email asking to validate the email account.
@@ -272,7 +272,7 @@
         preferredemail_email = account.preferredemail.email
 
     context, token, invalidate_email_token = _context_for_email_request(
-        account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
+        root_url, account, email, AuthTokenType.VALIDATEEMAIL, redirection_url,
         requester_email=preferredemail_email, oid_token=oid_token)
     send_fancy_email(
         _("Validate your email address"), 'email/validate-email.txt',
@@ -280,7 +280,7 @@
     return token, invalidate_email_token
 
 
-def send_invalidation_email_notice(account, invalidated_email):
+def send_invalidation_email_notice(root_url, account, invalidated_email):
     preferredemail = account.preferredemail
     assert preferredemail is not None
     email = preferredemail.email
@@ -289,7 +289,7 @@
         to_email=email,
     )
     if account.unverified_emails().count() > 0:
-        url = urljoin(settings.SSO_ROOT_URL, reverse('account-emails'))
+        url = urljoin(root_url, reverse('account-emails'))
         context['verify_emails_link'] = url
     send_fancy_email(
         _("The email address {email} was removed from your account").format(
@@ -297,7 +297,8 @@
         'email/email-invalidated.txt', context=context, email=email)
 
 
-def send_notification_to_invalidated_email_address(account, invalidated_email):
+def send_notification_to_invalidated_email_address(root_url, account,
+                                                   invalidated_email):
     context = dict(
         display_name=account.displayname, invalidated_email=invalidated_email,
         to_email=invalidated_email,
@@ -318,15 +319,15 @@
         {'new_preferred': new_preferred}, email)
 
 
-def send_invitation_after_password_reset(email):
-    url = urljoin(settings.SSO_ROOT_URL, reverse('new_account'))
+def send_invitation_after_password_reset(root_url, email):
+    url = urljoin(root_url, reverse('new_account'))
     send_fancy_email(
         _("Password reset request"), 'email/invitation.txt',
         {'email': email, 'signup': url}, email,
     )
 
 
-def send_action_required_warning(account, days_of_warning, action):
+def send_action_required_warning(root_url, account, days_of_warning, action):
     """
     Send an email to warn the user that an action is required.
 
@@ -342,10 +343,10 @@
     assert preferredemail is not None
     email = preferredemail.email
     context, token, invalidate_email_token = _context_for_email_request(
-        account, email, AuthTokenType.VALIDATEEMAIL,
+        root_url, account, email, AuthTokenType.VALIDATEEMAIL,
         redirection_url=None)
     context.update(dict(
-        emails_url=urljoin(settings.SSO_ROOT_URL, reverse('account-emails')),
+        emails_url=urljoin(root_url, reverse('account-emails')),
         created=account.date_created, action=action,
         days_of_warning=days_of_warning,
     ))

=== modified file 'src/identityprovider/tests/test_emailutils.py'
--- src/identityprovider/tests/test_emailutils.py	2018-08-14 20:27:59 +0000
+++ src/identityprovider/tests/test_emailutils.py	2018-08-17 18:50:19 +0000
@@ -321,7 +321,7 @@
             self.assertNotIn(invalidate_msg, email.body)
 
     def test_send_impersonation_email(self):
-        send_impersonation_email(self.email)
+        send_impersonation_email(self.sso_root_url, self.email)
 
         url = self.request.build_absolute_uri(
             reverse('forgot_password'))
@@ -338,7 +338,7 @@
 
     def test_send_new_user_email_no_platform(self):
         token, invalidate_token = send_new_user_email(
-            self.account, self.email, self.redirection_url)
+            self.sso_root_url, self.account, self.email, self.redirection_url)
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -349,7 +349,8 @@
     @patch('identityprovider.emailutils.logger')
     def test_send_new_user_email_invalid_platform(self, mock_logger):
         token, invalidate_token = send_new_user_email(
-            self.account, self.email, self.redirection_url, platform='foo')
+            self.sso_root_url, self.account, self.email,
+            self.redirection_url, platform='foo')
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -359,7 +360,8 @@
 
     def test_send_new_user_email_platform_desktop(self):
         token, invalidate_token = send_new_user_email(
-            self.account, self.email, self.redirection_url, platform='desktop')
+            self.sso_root_url, self.account, self.email, self.redirection_url,
+            platform='desktop')
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -370,7 +372,8 @@
     def test_send_new_user_email_platform_mobile(self):
         self.account = None
         token, invalidate_token = send_new_user_email(
-            self.account, self.email, self.redirection_url, platform='mobile')
+            self.sso_root_url, self.account, self.email, self.redirection_url,
+            platform='mobile')
 
         self.assert_tokens()
         self.assert_email_properly_formatted(
@@ -381,7 +384,7 @@
     def test_send_new_user_email_with_oid_token(self):
         oid_token = "iama_oid_token"
         token, invalidate_token = send_new_user_email(
-            self.account, self.email, self.redirection_url,
+            self.sso_root_url, self.account, self.email, self.redirection_url,
             oid_token=oid_token)
 
         self.assert_tokens()
@@ -393,7 +396,7 @@
 
     def test_send_password_reset_email_with_redirection_url(self):
         token, invalidate_token = send_password_reset_email(
-            self.account, self.email, self.redirection_url)
+            self.sso_root_url, self.account, self.email, self.redirection_url)
 
         self.assert_tokens(requester_email=self.email)
         self.assert_email_properly_formatted(
@@ -403,7 +406,7 @@
 
     def test_send_password_reset_email_no_redirection_url(self):
         token, invalidate_token = send_password_reset_email(
-            self.account, self.email)
+            self.sso_root_url, self.account, self.email)
 
         self.assert_tokens(requester_email=self.email, redirection_url=None)
         self.assert_email_properly_formatted(
@@ -413,7 +416,8 @@
 
     def test_send_password_reset_email_with_custom_reason(self):
         token, invalidate_token = send_password_reset_email(
-            self.account, self.email, reason='password_leak|adobe')
+            self.sso_root_url, self.account, self.email,
+            reason='password_leak|adobe')
 
         self.assert_tokens(requester_email=self.email, redirection_url=None)
         token_type = AuthTokenType.PASSWORDRECOVERY
@@ -429,7 +433,8 @@
 
     def test_send_password_reset_email_with_generic_leak_template(self):
         token, invalidate_token = send_password_reset_email(
-            self.account, self.email, reason='password_leak|foo')
+            self.sso_root_url, self.account, self.email,
+            reason='password_leak|foo')
 
         self.assert_tokens(requester_email=self.email, redirection_url=None)
         token_type = AuthTokenType.PASSWORDRECOVERY
@@ -444,14 +449,15 @@
             context=context, token_type=token_type)
 
     def test_send_password_reset_email_with_invalid_reason(self):
-        send_password_reset_email(self.account, self.email, reason='invalid')
+        send_password_reset_email(self.sso_root_url, self.account, self.email,
+                                  reason='invalid')
 
         self.assert_tokens(requester_email=self.email, redirection_url=None,
                            tokens_count=0)
         self.assertEqual(len(mail.outbox), 0)
 
     def test_leaked_password_reset_email_without_invalidation_link(self):
-        send_password_reset_email(self.account, self.email,
+        send_password_reset_email(self.sso_root_url, self.account, self.email,
                                   reason='password_leak|adobe')
 
         self.assertEqual(len(mail.outbox), 1)
@@ -463,7 +469,7 @@
         assert self.account.preferredemail is not None
 
         token, invalidate_token = send_validation_email_request(
-            self.account, self.email, self.redirection_url)
+            self.sso_root_url, self.account, self.email, self.redirection_url)
 
         email = self.account.preferredemail.email
         self.assert_tokens(requester_email=email)
@@ -478,7 +484,7 @@
         assert self.account.preferredemail is None
 
         token, invalidate_token = send_validation_email_request(
-            self.account, self.email, self.redirection_url)
+            self.sso_root_url, self.account, self.email, self.redirection_url)
 
         # two tokens are created, one for validation, and one for invalidation,
         # since the email being validated is not in the system, so the real
@@ -491,7 +497,7 @@
 
     def test_send_validation_email_request_no_redirection_url(self):
         token, invalidate_token = send_validation_email_request(
-            self.account, self.email)
+            self.sso_root_url, self.account, self.email)
 
         email = self.account.preferredemail.email
         self.assert_tokens(requester_email=email, redirection_url=None)
@@ -503,7 +509,7 @@
     def test_send_validation_email_request_with_oid_token(self):
         oid_token = 'a' * 16
         token, invalidate_token = send_validation_email_request(
-            self.account, self.email, self.redirection_url,
+            self.sso_root_url, self.account, self.email, self.redirection_url,
             oid_token=oid_token)
 
         email = self.account.preferredemail.email
@@ -516,7 +522,8 @@
 
     def _assert_send_invalidation_email_notice(self):
         invalidated_email = '[e-mail]'
-        send_invalidation_email_notice(self.account, invalidated_email)
+        send_invalidation_email_notice(self.sso_root_url, self.account,
+                                       invalidated_email)
 
         verify_emails_link = self.request.build_absolute_uri(
             reverse('account-emails'))
@@ -554,7 +561,8 @@
 
     def test_send_notification_to_invalidated_email_address(self):
         invalidated_email = '[e-mail]'
-        send_notification_to_invalidated_email_address(self.account,
+        send_notification_to_invalidated_email_address(self.sso_root_url,
+                                                       self.account,
                                                        invalidated_email)
         context = dict(
             display_name=self.account.displayname,
@@ -580,7 +588,7 @@
 
     def test_send_invitation_after_password_reset(self):
         url = self.request.build_absolute_uri(reverse('new_account'))
-        send_invitation_after_password_reset(self.email)
+        send_invitation_after_password_reset(self.sso_root_url, self.email)
 
         context = {
             'email': self.email, 'signup': url,
@@ -599,7 +607,7 @@
         url = self.request.build_absolute_uri(reverse('account-emails'))
 
         token, invalidate_token = send_action_required_warning(
-            self.account, days_of_warning=8, action=action)
+            self.sso_root_url, self.account, days_of_warning=8, action=action)
 
         # tokens will always be 2, since we need the validate email token *and*
         # the invalidate email
@@ -647,7 +655,8 @@
                    settings.TWOFACTOR_PAPER_CODES_WARN_RENEWAL + 1)
         device = self.factory.make_device(
             account=self.account, device_type='paper', counter=counter)
-        send_printed_codes_renewal_email(self.account, [device])
+        send_printed_codes_renewal_email(
+            self.sso_root_url, self.account, [device])
         url = self.request.build_absolute_uri(
             reverse('device-print', kwargs=dict(device_id=device.id)))
         context = dict(display_name=self.account.displayname,
@@ -671,7 +680,8 @@
             account=self.account, device_type='paper', counter=counter)
         device2 = self.factory.make_device(
             account=self.account, device_type='paper', counter=counter)
-        send_printed_codes_renewal_email(self.account, [device1, device2])
+        send_printed_codes_renewal_email(
+            self.sso_root_url, self.account, [device1, device2])
         url1 = self.request.build_absolute_uri(
             reverse('device-print', kwargs=dict(device_id=device1.id)))
         url2 = self.request.build_absolute_uri(
@@ -702,7 +712,8 @@
         device = self.factory.make_device(
             account=self.account, device_type='paper', counter=counter)
         with patch('identityprovider.emailutils.logger') as mock_logger:
-            send_printed_codes_renewal_email(self.account, [device])
+            send_printed_codes_renewal_email(
+                self.sso_root_url, self.account, [device])
         self.assertEqual(len(mail.outbox), 0)
         mock_logger.warning.assert_called_once_with(
             'Unable to find a suitable email address to send OTP reminder '

=== modified file 'src/webui/views/account.py'
--- src/webui/views/account.py	2018-08-14 20:27:59 +0000
+++ src/webui/views/account.py	2018-08-17 18:50:19 +0000
@@ -305,7 +305,8 @@
 
     redirection_url = redirection_url_for_token(token)
 
-    send_validation_email_request(request.user, email,
+    root_url = request.build_absolute_uri('/')
+    send_validation_email_request(root_url, request.user, email,
                                   redirection_url, oid_token=token)
     set_session_email(request.session, email)
 
@@ -415,13 +416,16 @@
         return response
 
     # notify the account of the email invalidation, prioritize validated emails
+    root_url = request.build_absolute_uri('/')
     if account.preferredemail is not None:
         send_invalidation_email_notice(
+            root_url,
             account,
             invalidated_email=email.email,
         )
     else:
         send_notification_to_invalidated_email_address(
+            root_url,
             account,
             invalidated_email=email.email,
         )

=== modified file 'src/webui/views/ui.py'
--- src/webui/views/ui.py	2018-08-14 20:27:59 +0000
+++ src/webui/views/ui.py	2018-08-17 18:50:19 +0000
@@ -360,8 +360,9 @@
                 url += "?next=" + urlquote(next_url)
             return HttpResponseRedirect(url)
         elif paper_devices_needing_renewal:
+            root_url = request.build_absolute_uri('/')
             send_printed_codes_renewal_email(
-                request.user, paper_devices_needing_renewal)
+                root_url, request.user, paper_devices_needing_renewal)
         if next_url and is_safe_redirect_url(next_url):
             return HttpResponseRedirect(next_url)
         elif token: