|
| 1 | +# SPDX-FileCopyrightText: 2026 OPTIMETA and KOMET projects <https://projects.tib.eu/komet> |
| 2 | +# SPDX-License-Identifier: GPL-3.0-or-later |
| 3 | + |
| 4 | +"""Content assertions for auth-flow emails (magic link, email change, account deletion). |
| 5 | +
|
| 6 | +These emails had no body-content assertions before the template migration — |
| 7 | +only redirect/status checks existed. The tests here ensure that moving the |
| 8 | +text to template files doesn't silently break the email content. |
| 9 | +""" |
| 10 | + |
| 11 | +from django.contrib.auth import get_user_model |
| 12 | +from django.core import mail |
| 13 | +from django.core.cache import cache |
| 14 | +from django.test import Client, TestCase, override_settings |
| 15 | +from django.urls import reverse |
| 16 | + |
| 17 | +User = get_user_model() |
| 18 | + |
| 19 | +EMAIL_BACKEND = "django.core.mail.backends.locmem.EmailBackend" |
| 20 | + |
| 21 | + |
| 22 | +@override_settings(EMAIL_BACKEND=EMAIL_BACKEND, EMAIL_HOST_USER="noreply@optimap.test") |
| 23 | +class MagicLinkEmailContentTests(TestCase): |
| 24 | + def setUp(self): |
| 25 | + self.client = Client(SERVER_NAME="testserver") |
| 26 | + |
| 27 | + def test_magic_link_email_contains_link_and_validity(self): |
| 28 | + """Magic-link email body contains the token URL and the validity period.""" |
| 29 | + mail.outbox = [] |
| 30 | + response = self.client.post(reverse("optimap:login_response"), {"email": "user@example.com"}) # noqa: F841 |
| 31 | + # The view redirects on success (may render error.html if SMTP fails — we use locmem). |
| 32 | + self.assertEqual(len(mail.outbox), 1) |
| 33 | + email = mail.outbox[0] |
| 34 | + self.assertIn("user@example.com", email.to) |
| 35 | + self.assertIn("/login/", email.body) # token URL |
| 36 | + self.assertIn("10", email.body) # validity period in minutes |
| 37 | + self.assertIn("user@example.com", email.body) |
| 38 | + |
| 39 | + |
| 40 | +@override_settings( |
| 41 | + EMAIL_BACKEND=EMAIL_BACKEND, |
| 42 | + EMAIL_HOST_USER="noreply@optimap.test", |
| 43 | + BASE_URL="http://testserver", |
| 44 | +) |
| 45 | +class EmailChangeEmailContentTests(TestCase): |
| 46 | + def setUp(self): |
| 47 | + self.client = Client() |
| 48 | + self.user = User.objects.create_user( |
| 49 | + username="old@example.com", email="old@example.com", password="pass" |
| 50 | + ) |
| 51 | + self.client.force_login(self.user) |
| 52 | + |
| 53 | + def test_confirmation_email_contains_old_and_new_address_and_link(self): |
| 54 | + """Email-change confirmation email contains both addresses and the confirm URL.""" |
| 55 | + mail.outbox = [] |
| 56 | + self.client.post( |
| 57 | + reverse("optimap:changeuser"), |
| 58 | + {"form": "email", "email_new": "new@example.com"}, |
| 59 | + ) |
| 60 | + # One email sent to the new address. |
| 61 | + self.assertEqual(len(mail.outbox), 1) |
| 62 | + email = mail.outbox[0] |
| 63 | + self.assertEqual(email.to, ["new@example.com"]) |
| 64 | + self.assertIn("old@example.com", email.body) |
| 65 | + self.assertIn("new@example.com", email.body) |
| 66 | + self.assertIn("/confirm-email/", email.body) |
| 67 | + self.assertIn("10", email.body) # expiry in minutes |
| 68 | + |
| 69 | + def test_notification_email_sent_to_old_address_after_confirmation(self): |
| 70 | + """After confirming an email change, the old address receives a security notice.""" |
| 71 | + # Key format: EMAIL_CONFIRMATION_TOKEN_PREFIX + "_" + email_new = "email_confirmation__new@..." |
| 72 | + cache.set("email_confirmation__new@example.com", { |
| 73 | + "token": "testtoken123", |
| 74 | + "old_email": "old@example.com", |
| 75 | + }, timeout=600) |
| 76 | + mail.outbox = [] |
| 77 | + self.client.get( |
| 78 | + reverse("optimap:confirm_email_change", args=["testtoken123", "new@example.com"]) |
| 79 | + ) |
| 80 | + # Exactly one email is expected — the security notice to the old address. |
| 81 | + self.assertEqual(len(mail.outbox), 1, "Expected one security-notice email") |
| 82 | + notify = mail.outbox[0] |
| 83 | + self.assertIn("old@example.com", notify.to) |
| 84 | + self.assertIn("old@example.com", notify.body) |
| 85 | + self.assertIn("new@example.com", notify.body) |
| 86 | + self.assertIn("contact", notify.body.lower()) |
0 commit comments