Merge lp:~salgado/launchpad/bug-415977-2 into lp:launchpad

[Guilherme Salgado]

[Guilherme Salgado (salgado)]

= Summary =

As reported on bug 415977, personless accounts can't use the
+forgottenpassword form on Launchpad because it doesn't know how to deal
with these accounts.

== Proposed fix ==

In the mailing list we discussed getting rid of LP's +forgottenpassword
and change all links to point to the same page on SSO, but that's not
possible because that page doesn't exist on SSO anymore -- they use the
login form with some javascript and a regular link to request a password
reset and we're not doing that in LP.

For that reason we had to resort to the other alternative, which is to
change the +forgottenpassword page to generate AuthTokens when the email
address is associated with a personless account.

== Pre-implementation notes ==

== Implementation details ==

== Tests ==

./bin/test -vvt resetpassword-of-sso-account.txt

== Demo and Q/A ==

= Launchpad lint =

Checking for conflicts. and issues in doctests and templates.
Running jslint, xmllint, pyflakes, and pylint.
Using normal rules.

Linting changed files:
  database/schema/security.cfg
  lib/canonical/launchpad/webapp/login.py
  lib/lp/registry/stories/foaf/xx-resetpassword-of-sso-account.txt

[Gary Poster (gary)]

Very nicely done. Reviewing this patch introduced me to a number of valuable pieces of our testing infrastructure. :-)

Thank you!

Gary

review: Approve

=== modified file 'database/schema/security.cfg'
--- database/schema/security.cfg	2009-10-29 05:50:08 +0000
+++ database/schema/security.cfg	2009-10-29 19:50:24 +0000
@@ -98,6 +98,7 @@
 type=user
 public.account                          = SELECT, INSERT, UPDATE, DELETE
 public.accountpassword                  = SELECT, INSERT, UPDATE, DELETE
+public.authtoken                        = SELECT, INSERT, UPDATE
 public.emailaddress                     = SELECT, INSERT, UPDATE, DELETE
 public.language                         = SELECT
 public.openidrpconfig                   = SELECT

=== modified file 'lib/canonical/launchpad/webapp/login.py'
--- lib/canonical/launchpad/webapp/login.py	2009-10-16 16:13:00 +0000
+++ lib/canonical/launchpad/webapp/login.py	2009-10-29 19:50:24 +0000
@@ -24,7 +24,8 @@
 from canonical.config import config
 from canonical.launchpad import _
 from canonical.launchpad.interfaces.account import AccountStatus
-from canonical.launchpad.interfaces.authtoken import LoginTokenType
+from canonical.launchpad.interfaces.authtoken import (
+    IAuthTokenSet, LoginTokenType)
 from canonical.launchpad.interfaces.emailaddress import IEmailAddressSet
 from canonical.launchpad.interfaces.logintoken import ILoginTokenSet
 from lp.registry.interfaces.person import (
@@ -563,22 +564,30 @@
             return
 
         email = request.form.get("email").strip()
-        person = getUtility(IPersonSet).getByEmail(email)
-        if person is None:
+        email_address = getUtility(IEmailAddressSet).getByEmail(email)
+        if email_address is None:
             self.errortext = ("Your account details have not been found. "
                               "Please check your subscription email "
                               "address and try again.")
             return
 
-        if person.isTeam():
+        person = email_address.person
+        if person is not None and person.isTeam():
             self.errortext = ("The email address <strong>%s</strong> "
                               "belongs to a team, and teams cannot log in to "
                               "Launchpad." % email)
             return
 
-        logintokenset = getUtility(ILoginTokenSet)
-        token = logintokenset.new(
-            person, email, email, LoginTokenType.PASSWORDRECOVERY)
+        if person is None:
+            account = email_address.account
+            redirection_url = urlappend(
+                self.request.getApplicationURL(), '+login')
+            token = getUtility(IAuthTokenSet).new(
+                account, email, email, LoginTokenType.PASSWORDRECOVERY,
+                redirection_url=redirection_url)
+        else:
+            token = getUtility(ILoginTokenSet).new(
+                person, email, email, LoginTokenType.PASSWORDRECOVERY)
         token.sendPasswordResetEmail()
         self.submitted = True
         return

=== added file 'lib/lp/registry/stories/foaf/xx-resetpassword-of-sso-account.txt'
--- lib/lp/registry/stories/foaf/xx-resetpassword-of-sso-account.txt	1970-01-01 00:00:00 +0000
+++ lib/lp/registry/stories/foaf/xx-resetpassword-of-sso-account.txt	2009-10-29 19:50:24 +0000
@@ -0,0 +1,83 @@
+= Resetting the password of SSO-only accounts =
+
+Every once in a while people come to register Launchpad accounts using email
+addresses that belong to SSO-only accounts.  In these cases we explain to them
+that they should use the SSO credentials to log into Launchpad, but it's
+possible that they've forgotten their password so they'll try to use the
+'Forgotten your password?' link to reset it.
+
+Since their account is SSO-only (i.e. it has no Person record associated
+with), we can't use Launchpad's workflow for resetting the password -- it
+expects a Person entry to be associated with the given email addres. Because
+of that we'll allow the user to initiate the password-reset workflow on
+Launchpad but we'll force the use of SSO's password-reset workflow to complete
+it.
+
+    # Create a personless account to demostrate what we want.
+    >>> login(ANONYMOUS)
+    >>> account = factory.makeAccount('Test', email='[e-mail]')
+    >>> logout()
+
+Trying to register will give an error, telling the user to use the SSO
+credentials to login.
+
+    >>> from lp.testing.registration import set_captcha_answer
+    >>> browser.open('http://launchpad.dev/+login')
+    >>> browser.getControl(name='loginpage_email', index=1).value = (
+    ...     '[e-mail]')
+    >>> set_captcha_answer(browser, prefix='loginpage_')
+    >>> browser.getControl('Register').click()
+    >>> print_feedback_messages(browser.contents)
+    The email address [e-mail] is already registered in the Launchpad
+    Login Service... Please use the same email and password to log into
+    Launchpad.
+
+But the user has forgotten their credentials, so they'll have to reset the
+password.
+
+    >>> browser.getLink('Forgotten your password?').click()
+    >>> browser.url
+    'http://launchpad.dev/+forgottenpassword'
+    >>> browser.getControl(name='email').value = '[e-mail]'
+    >>> set_captcha_answer(browser)
+    >>> browser.getControl('Request Reset').click()
+    >>> print extract_text(find_main_content(browser.contents))
+    Need a new Launchpad password?
+    We have sent you an email with instructions to reset your password.
+
+    # Get the link from the email.
+    >>> from lp.services.mail import stub
+    >>> from canonical.launchpad.ftests.logintoken import (
+    ...     get_token_url_from_email)
+    >>> len(stub.test_emails)
+    1
+    >>> from_addr, to_addrs, raw_msg = stub.test_emails.pop()
+    >>> link = get_token_url_from_email(raw_msg)
+    >>> to_addrs
+    ['[e-mail]']
+
+Following the link sent by email will take the user to the SSO site to
+complete the password reset.
+
+    >>> browser.open(link)
+    >>> browser.url
+    'http://openid.launchpad.dev/token/.../+resetpassword'
+    >>> browser.getControl(name='field.email').value = '[e-mail]'
+    >>> browser.getControl(name='field.password').value = 'test'
+    >>> browser.getControl(name='field.password_dupe').value = 'test'
+    >>> browser.getControl('Continue').click()
+    >>> print_feedback_messages(browser.contents)
+    Your password has been reset successfully.
+
+Since the password reset was done on SSO, the user won't be logged into
+Launchpad, so we redirect the user back to Launchpad's +login page for them to
+login.
+
+    >>> browser.url
+    'http://launchpad.dev/+login'
+    >>> browser.getControl(
+    ...     'E-mail address:', index=0).value = '[e-mail]'
+    >>> browser.getControl('Password').value = 'test'
+    >>> browser.getControl('Log In').click()
+    >>> print extract_text(find_tag_by_id(browser.contents, 'logincontrol'))
+    Test...