 }})
 }})
+
{{ i }}
·
{{ icons.STATUS_ICONS[icons.REVIEW_MAP[project.status]]|safe }}{{ i18ned_statuses[project.status] }}
{% if project.status == 'approved' %}
diff --git a/templates/sign-in-using.html b/templates/sign-in-using.html
index 11478fd5e2..be0e3fbacd 100644
--- a/templates/sign-in-using.html
+++ b/templates/sign-in-using.html
@@ -1,8 +1,11 @@
{% from 'templates/auth.html' import auth_button with context %}
+{% macro sign_in_using(button_class='') %}
+{% endmacro %}
diff --git a/templates/team-base.html b/templates/team-base.html
index 387015839c..d27fbd0d38 100644
--- a/templates/team-base.html
+++ b/templates/team-base.html
@@ -3,6 +3,9 @@
{% block banner %}
 }})
+ {% if team.package %}
+
+ {% endif %}
-
+
+ {% endif %}
diff --git a/templates/your-payment.html b/templates/your-payment.html
index 64cf2e5a80..e0a4408bca 100644
--- a/templates/your-payment.html
+++ b/templates/your-payment.html
@@ -1,6 +1,7 @@
+{% from "templates/sign-in-using.html" import sign_in_using with context %}
{% if user.ANON %}
- {% include "templates/project-listing.html" %}
-
{% include "templates/connected-accounts.html" %}
{% else %}
{% if statement %}
diff --git a/www/~/%username/receipts/%exchange_id.int.html.spt b/www/~/%username/receipts/%exchange_id.html.spt
similarity index 95%
rename from www/~/%username/receipts/%exchange_id.int.html.spt
rename to www/~/%username/receipts/%exchange_id.html.spt
index 92b0b2617d..55eb6c7521 100644
--- a/www/~/%username/receipts/%exchange_id.int.html.spt
+++ b/www/~/%username/receipts/%exchange_id.html.spt
@@ -9,13 +9,18 @@ from gratipay.billing.instruments import CreditCard
participant = get_participant(state, restrict=True)
+try:
+ exchange_id = int(request.path['exchange_id'])
+except ValueError:
+ raise Response(400)
+
exchange = website.db.one("""
SELECT *
FROM exchanges
WHERE id = %s
AND participant = %s
AND amount > 0
-""", (request.path['exchange_id'], participant.username))
+""", (exchange_id, participant.username))
if exchange is None:
raise Response(404)
diff --git a/www/~/%username/routes/credit-card.spt b/www/~/%username/routes/credit-card.spt
index 0627848de1..dc0ea1bd5a 100644
--- a/www/~/%username/routes/credit-card.spt
+++ b/www/~/%username/routes/credit-card.spt
@@ -22,25 +22,16 @@ else:
{% extends "templates/profile-routes.html" %}
{% block scripts %}
-
-{% if not user.ANON %}
-{% endif %}
-
{{ super() }}
{% endblock %}
{% block content %}
- {% if user.ANON %}
- {% include "templates/sign-in-using.html" %}
- {{ _("and then you'll be able to add or change your credit card.") }}
- {% else %}
-
- {% include "templates/sign-in-using.html" %}
+ {{ sign_in_using() }}
{{ _("{sign_in}{br}to give to{br}{team}").format(sign_in="", team=team.name, br='
'|safe) }}
{% else %}
diff --git a/tests/py/test_close.py b/tests/py/test_close.py
index b05e765358..43c68698b6 100644
--- a/tests/py/test_close.py
+++ b/tests/py/test_close.py
@@ -208,7 +208,7 @@ def test_clears_personal_information(self):
, taking=40
)
alice.upsert_statement('en', 'not forgetting to be awesome!')
- alice.add_email('alice@example.net')
+ alice.start_email_verification('alice@example.net')
with self.db.get_cursor() as cursor:
alice.clear_personal_information(cursor)
diff --git a/tests/py/test_email.py b/tests/py/test_email.py
index a6c7f64049..b686ccf5b1 100644
--- a/tests/py/test_email.py
+++ b/tests/py/test_email.py
@@ -1,14 +1,20 @@
from __future__ import absolute_import, division, print_function, unicode_literals
import json
+import Queue
import sys
+import threading
+import urllib
+import mock
from pytest import raises
from gratipay.exceptions import CannotRemovePrimaryEmail, EmailTaken, EmailNotVerified
-from gratipay.exceptions import TooManyEmailAddresses, Throttled
-from gratipay.testing import P
+from gratipay.exceptions import TooManyEmailAddresses, Throttled, EmailAlreadyVerified
+from gratipay.exceptions import EmailNotOnFile, ProblemChangingEmail
+from gratipay.testing import P, Harness
from gratipay.testing.email import QueuedEmailHarness, SentEmailHarness
+from gratipay.models.package import Package
from gratipay.models.participant import email as _email
from gratipay.utils import encode_for_querystring
from gratipay.cli import queue_branch_email as _queue_branch_email
@@ -20,16 +26,42 @@ def setUp(self):
QueuedEmailHarness.setUp(self)
self.alice = self.make_participant('alice', claimed_time='now')
+ def add(self, participant, address, _flush=False):
+ participant.start_email_verification(address)
+ nonce = participant.get_email(address).nonce
+ r = participant.finish_email_verification(address, nonce)
+ assert r == _email.VERIFICATION_SUCCEEDED
+ if _flush:
+ self.app.email_queue.flush()
+
class TestEndpoints(Alice):
- def hit_email_spt(self, action, address, user='alice', should_fail=False):
+ def hit_email_spt(self, action, address, user='alice', package_ids=[], should_fail=False):
f = self.client.PxST if should_fail else self.client.POST
- data = {'action': action, 'address': address}
- headers = {b'HTTP_ACCEPT_LANGUAGE': b'en'}
- return f('/~alice/emails/modify.json', data, auth_as=user, **headers)
- def verify_email(self, email, nonce, username='alice', should_fail=False):
+ # Aspen's test client should really support URL-encoding POST data for
+ # us, but it doesn't (it only supports multipart, which I think maybe
+ # doesn't work because of other Aspen bugs around multiple package_id
+ # values in the same POST body in that case?), so let's do that
+ # ourselves.
+
+ data = [ ('action', action)
+ , ('address', address)
+ ] + [('package_id', str(p)) for p in package_ids]
+ body = urllib.urlencode(data)
+
+ response = f( '/~alice/emails/modify.json'
+ , body=body
+ , content_type=b'application/x-www-form-urlencoded'
+ , auth_as=user
+ , HTTP_ACCEPT_LANGUAGE=b'en'
+ )
+ if issubclass(response.__class__, (Throttled, ProblemChangingEmail)):
+ response.render_body({'_': lambda a: a})
+ return response
+
+ def finish_email_verification(self, email, nonce, username='alice', should_fail=False):
# Email address is encoded in url.
url = '/~%s/emails/verify.html?email2=%s&nonce=%s'
url %= (username, encode_for_querystring(email), nonce)
@@ -39,17 +71,16 @@ def verify_email(self, email, nonce, username='alice', should_fail=False):
def verify_and_change_email(self, old_email, new_email, username='alice', _flush=True):
self.hit_email_spt('add-email', old_email)
nonce = P(username).get_email(old_email).nonce
- self.verify_email(old_email, nonce)
+ self.finish_email_verification(old_email, nonce)
self.hit_email_spt('add-email', new_email)
if _flush:
self.app.email_queue.flush()
- def test_participant_can_add_email(self):
+ def test_participant_can_start_email_verification(self):
response = self.hit_email_spt('add-email', 'alice@gratipay.com')
- actual = json.loads(response.body)
- assert actual
+ assert json.loads(response.body) == 'Check your inbox for a verification link.'
- def test_adding_email_sends_verification_email(self):
+ def test_starting_email_verification_triggers_verification_email(self):
self.hit_email_spt('add-email', 'alice@gratipay.com')
assert self.count_email_messages() == 1
last_email = self.get_last_email()
@@ -69,7 +100,7 @@ def test_verification_email_doesnt_contain_unsubscribe(self):
last_email = self.get_last_email()
assert "To stop receiving" not in last_email['body_text']
- def test_adding_second_email_sends_verification_notice(self):
+ def test_verifying_second_email_sends_verification_notice(self):
self.verify_and_change_email('alice1@example.com', 'alice2@example.com', _flush=False)
assert self.count_email_messages() == 3
last_email = self.get_last_email()
@@ -107,15 +138,15 @@ def test_post_too_quickly_is_400(self):
assert 'too quickly' in response.body
def test_verify_email_without_adding_email(self):
- response = self.verify_email('', 'sample-nonce')
+ response = self.finish_email_verification('', 'sample-nonce')
assert 'Bad Info' in response.body
def test_verify_email_wrong_nonce(self):
self.hit_email_spt('add-email', 'alice@example.com')
nonce = 'fake-nonce'
- r = self.alice.verify_email('alice@gratipay.com', nonce)
+ r = self.alice.finish_email_verification('alice@gratipay.com', nonce)
assert r == _email.VERIFICATION_FAILED
- self.verify_email('alice@example.com', nonce)
+ self.finish_email_verification('alice@example.com', nonce)
expected = None
actual = P('alice').email_address
assert expected == actual
@@ -124,8 +155,8 @@ def test_verify_email_a_second_time_returns_redundant(self):
address = 'alice@example.com'
self.hit_email_spt('add-email', address)
nonce = self.alice.get_email(address).nonce
- r = self.alice.verify_email(address, nonce)
- r = self.alice.verify_email(address, nonce)
+ r = self.alice.finish_email_verification(address, nonce)
+ r = self.alice.finish_email_verification(address, nonce)
assert r == _email.VERIFICATION_REDUNDANT
def test_verify_email_expired_nonce(self):
@@ -137,18 +168,26 @@ def test_verify_email_expired_nonce(self):
WHERE participant_id = %s;
""", (self.alice.id,))
nonce = self.alice.get_email(address).nonce
- r = self.alice.verify_email(address, nonce)
+ r = self.alice.finish_email_verification(address, nonce)
assert r == _email.VERIFICATION_EXPIRED
actual = P('alice').email_address
assert actual == None
- def test_verify_email(self):
+ def test_finish_email_verification(self):
self.hit_email_spt('add-email', 'alice@example.com')
nonce = self.alice.get_email('alice@example.com').nonce
- self.verify_email('alice@example.com', nonce)
- expected = 'alice@example.com'
- actual = P('alice').email_address
- assert expected == actual
+ assert self.finish_email_verification('alice@example.com', nonce).code == 200
+ assert P('alice').email_address == 'alice@example.com'
+
+ def test_empty_email_results_in_missing(self):
+ for empty in ('', ' '):
+ result = self.alice.finish_email_verification(empty, 'foobar')
+ assert result == _email.VERIFICATION_MISSING
+
+ def test_empty_nonce_results_in_missing(self):
+ for empty in ('', ' '):
+ result = self.alice.finish_email_verification('foobar', empty)
+ assert result == _email.VERIFICATION_MISSING
def test_email_verification_is_backwards_compatible(self):
"""Test email verification still works with unencoded email in verification link.
@@ -175,17 +214,17 @@ def test_get_emails(self):
def test_verify_email_after_update(self):
self.verify_and_change_email('alice@example.com', 'alice@example.net')
nonce = self.alice.get_email('alice@example.net').nonce
- self.verify_email('alice@example.net', nonce)
+ self.finish_email_verification('alice@example.net', nonce)
expected = 'alice@example.com'
actual = P('alice').email_address
assert expected == actual
- def test_nonce_is_reused_when_resending_email(self):
+ def test_nonce_is_not_reused_when_resending_email(self):
self.hit_email_spt('add-email', 'alice@example.com')
nonce1 = self.alice.get_email('alice@example.com').nonce
self.hit_email_spt('resend', 'alice@example.com')
nonce2 = self.alice.get_email('alice@example.com').nonce
- assert nonce1 == nonce2
+ assert nonce1 != nonce2
def test_emails_page_shows_emails(self):
self.verify_and_change_email('alice@example.com', 'alice@example.net')
@@ -217,96 +256,128 @@ def test_remove_email(self):
self.hit_email_spt('remove', 'alice@example.com')
-class TestFunctions(Alice):
+ def test_participant_can_verify_a_package_along_with_email(self):
+ foo = self.make_package(name='foo', emails=['alice@gratipay.com'])
+ response = self.hit_email_spt( 'start-verification'
+ , 'alice@gratipay.com'
+ , package_ids=[foo.id]
+ )
+ assert json.loads(response.body) == 'Check your inbox for a verification link.'
+ assert self.db.all('select package_id from claims order by package_id') == [foo.id]
+
+ def test_participant_cant_verify_packages_with_add_email_or_resend(self):
+ foo = self.make_package(name='foo', emails=['alice@gratipay.com'])
+ for action in ('add-email', 'resend'):
+ assert self.hit_email_spt( action
+ , 'alice@gratipay.com'
+ , package_ids=[foo.id]
+ , should_fail=True
+ ).code == 400
+
+ def test_participant_can_verify_multiple_packages_along_with_email(self):
+ package_ids = [self.make_package(name=name, emails=['alice@gratipay.com']).id
+ for name in ('foo', 'bar', 'baz', 'buz')]
+ response = self.hit_email_spt( 'start-verification'
+ , 'alice@gratipay.com'
+ , package_ids=package_ids
+ )
+ assert json.loads(response.body) == 'Check your inbox for a verification link.'
+ assert self.db.all('select package_id from claims order by package_id') == package_ids
+
+ def test_package_verification_fails_if_email_not_listed(self):
+ foo = self.make_package()
+ response = self.hit_email_spt( 'start-verification'
+ , 'bob@gratipay.com'
+ , package_ids=[foo.id]
+ , should_fail=True
+ )
+ assert response.code == 400
+ assert self.db.all('select package_id from claims order by package_id') == []
+
+ def test_package_verification_fails_package_id_is_garbage(self):
+ response = self.hit_email_spt( 'start-verification'
+ , 'bob@gratipay.com'
+ , package_ids=['cheese monkey']
+ , should_fail=True
+ )
+ assert response.code == 400
+ assert self.db.all('select package_id from claims order by package_id') == []
- def add_and_verify(self, participant, address):
- participant.add_email('alice@gratipay.com')
- nonce = participant.get_email('alice@gratipay.com').nonce
- r = participant.verify_email('alice@gratipay.com', nonce)
- assert r == _email.VERIFICATION_SUCCEEDED
+
+class TestFunctions(Alice):
def test_cannot_update_email_to_already_verified(self):
bob = self.make_participant('bob', claimed_time='now')
- self.add_and_verify(self.alice, 'alice@gratipay.com')
+ self.add(self.alice, 'alice@gratipay.com')
with self.assertRaises(EmailTaken):
- bob.add_email('alice@gratipay.com')
+ bob.start_email_verification('alice@gratipay.com')
nonce = bob.get_email('alice@gratipay.com').nonce
- bob.verify_email('alice@gratipay.com', nonce)
+ bob.finish_email_verification('alice@gratipay.com', nonce)
email_alice = P('alice').email_address
assert email_alice == 'alice@gratipay.com'
- def test_cannot_add_too_many_emails(self):
- self.alice.add_email('alice@gratipay.com')
- self.alice.add_email('alice@gratipay.net')
- self.alice.add_email('alice@gratipay.org')
- self.app.email_queue.flush()
- self.alice.add_email('alice@gratipay.co.uk')
- self.alice.add_email('alice@gratipay.io')
- self.alice.add_email('alice@gratipay.co')
- self.app.email_queue.flush()
- self.alice.add_email('alice@gratipay.eu')
- self.alice.add_email('alice@gratipay.asia')
- self.alice.add_email('alice@gratipay.museum')
- self.app.email_queue.flush()
- self.alice.add_email('alice@gratipay.py')
- with self.assertRaises(TooManyEmailAddresses):
- self.alice.add_email('alice@gratipay.coop')
-
def test_html_escaping(self):
- self.alice.add_email("foo'bar@example.com")
+ self.alice.start_email_verification("foo'bar@example.com")
last_email = self.get_last_email()
assert 'foo'bar' in last_email['body_html']
assert ''' not in last_email['body_text']
+ def test_npm_package_name_is_handled_safely(self):
+ foo = self.make_package(name='
{{ super() }}
{% endblock %}
{% block content %}
-'|safe) }}
{{ _( '{npm_package} has not been claimed on Gratipay.' - , npm_package=('' + 'npm/' + package_name + '')|safe - ) }}
-{% if user.ANON %} -{{ _('Is this yours? You can claim it on Gratipay with a couple clicks:') }}
- {% include "templates/sign-in-using.html" %} -{{ _('What is Gratipay?') }}
-{{ _('Gratipay helps companies and others pay for open source.') }} - {{ _("Learn more") }}
+{% if package.description %} +{{ package.description }}
+{% else %} +{{ _("No description available.") }}
+{% endif %} + ++ {{ _( 'Apply to accept payments for the {package_link} npm package:' + , package_link=('' + package_name + '')|safe + ) }} +
+ +{% if user.ANON %} + {% else %} -{{ _( 'Is this yours? You can claim it on Gratipay using any email address {a}on file{_a} in the maintainers field in the npm registry.' - , a=('')|safe - , _a=''|safe - ) }} - {% if len(package.emails) == 0 %} -
{{ _("Sorry, we didn't find any email addresses on file.") }}
+ {% if len(emails) == 0 %} +{{ _("No email addresses on file.") }}
{% else %} --
- {% for i, email in enumerate(package.emails) %}
-
- - +
-
+
+
+ + ++ + ++ {{ i }} + · + {% if group == OTHER %} + + {{ _('Linked to a different account') }} + {% else %} + {{ _('Ready to use') }} + {% if group == PRIMARY %} + · + {{ _('Your primary email address') }} + {% elif group == VERIFIED %} + · + {{ _('Linked to your account') }} + {% elif group == UNVERIFIED %} + · + {{ _('Half-linked to your account') }} + {% endif %} + {% endif %} ++
{% endfor %}
-
+
+
+
{% endif %}
+ -
+ {% for i, (email, group) in enumerate(emails, start=1) %}
+
{{ _( 'Addresses are from {a}{code}maintainers{_code}{_a}.'
+ , a=('')|safe
+ , _a=''|safe
+ , code=''|safe
+ , _code=''|safe
+ ) }}
{{ _( 'Out of date? Update {a}at npm{_a} and refresh.' + , a=('')|safe + , _a=''|safe + ) }}
{% endif %} {% endblock %} diff --git a/www/search.spt b/www/search.spt index 7e6ed84b6b..4890736a7d 100644 --- a/www/search.spt +++ b/www/search.spt @@ -149,7 +149,7 @@ zip = zip {% from 'templates/list-participants.html' import list_participants with context %} {% block content %} -{% if last_bill_result %}
@@ -115,5 +106,4 @@ else:
- {% endif %}
{% endblock %}
{{ _("Failure") }}
{{ last_bill_result }}