datastore: prevent autoflush

* closes zenodo/zenodo-rdm#590

invenio_accounts/forms.py

@@ -13,6 +13,7 @@
 from flask import request
 from flask_security.forms import NextFormMixin
 from flask_wtf import FlaskForm, Recaptcha, RecaptchaField
+from invenio_db import db
 from invenio_i18n import gettext as _
 from wtforms import FormField, HiddenField
 
@@ -90,7 +91,8 @@ class SendConfirmationEmailView(Form):
         """
 
         def validate(self, extra_validators=None):
-            self.user = current_datastore.get_user(self.data["email"])
+            with db.session.no_autoflush:
+                self.user = current_datastore.get_user(self.data["email"])
             # Form is valid if user exists and they are not yet confirmed
             if self.user is not None and self.user.confirmed_at is None:
                 return True

invenio_accounts/views/rest.py

@@ -181,14 +181,18 @@ def handle_error(self, error, *args, **kwargs):
 #
 def user_exists(email):
     """Validate that a user exists."""
-    if not current_datastore.get_user(email):
-        raise ValidationError(get_message("USER_DOES_NOT_EXIST")[0])
+    with db.session.no_autoflush:
+        if not current_datastore.get_user(email):
+            raise ValidationError(get_message("USER_DOES_NOT_EXIST")[0])
 
 
 def unique_user_email(email):
     """Validate unique user email."""
-    if current_datastore.get_user(email) is not None:
-        raise ValidationError(get_message("EMAIL_ALREADY_ASSOCIATED", email=email)[0])
+    with db.session.no_autoflush:
+        if current_datastore.get_user(email) is not None:
+            raise ValidationError(
+                get_message("EMAIL_ALREADY_ASSOCIATED", email=email)[0]
+            )
 
 
 def default_user_payload(user):
@@ -222,7 +226,8 @@ class UserViewMixin(object):
 
     def get_user(self, email=None, **kwargs):
         """Retrieve a user by the provided arguments."""
-        return current_datastore.get_user(email)
+        with db.session.no_autoflush:
+            return current_datastore.get_user(email)
 
 
 class LoginView(MethodView, UserViewMixin):