From f860a2dd98c3fa737094b58e79a6361cd1c10bb7 Mon Sep 17 00:00:00 2001 From: Timur Enikeev Date: Mon, 14 Oct 2024 01:45:03 -0400 Subject: [PATCH 1/2] Fix double email auth --- auth_backend/auth_plugins/email.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/auth_backend/auth_plugins/email.py b/auth_backend/auth_plugins/email.py index 330867dd..a9a66c09 100644 --- a/auth_backend/auth_plugins/email.py +++ b/auth_backend/auth_plugins/email.py @@ -229,6 +229,13 @@ async def _register( user = await cls._get_user(user_session=user_session, db_session=txn) if not user: raise SessionExpired(user_session.token) + auth_method: AuthMethod | None = ( + AuthMethod.query(session=txn) + .filter(AuthMethod.auth_method == Email.get_name(), AuthMethod.user_id == user.id) + .first() + ) + if auth_method: + raise AlreadyExists(User, user.id) else: user = await cls._create_user(db_session=txn) method_params = await Email._add_to_db(user_inp, confirmation_token, user) From da66873ecb097684ba394caa846e0774ecd18f9b Mon Sep 17 00:00:00 2001 From: Timur Enikeev Date: Mon, 14 Oct 2024 02:12:02 -0400 Subject: [PATCH 2/2] Add test for double email reg --- tests/test_routes/test_registration.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/test_routes/test_registration.py b/tests/test_routes/test_registration.py index 5eb74b63..b7465464 100644 --- a/tests/test_routes/test_registration.py +++ b/tests/test_routes/test_registration.py @@ -140,3 +140,22 @@ def test_user_exists(client_auth: TestClient, dbsession: Session): dbsession.delete(row) dbsession.delete(dbsession.query(User).filter(User.id == db_user.user_id).one()) dbsession.commit() + + +def test_double_email_registration(client_auth: TestClient, dbsession: Session, user): + user_id, body, response = user["user_id"], user["body"], user["login_json"] + time = datetime.datetime.utcnow() + body1 = { + "email": body["email"], + "password": "string", + "scopes": [], + "session_name": "name", + } + response = client_auth.post("/email/login", json=body1) + token_ = response.json()['token'] + body2 = {"email": f"new{time}@email.com", "password": "random pwd"} + body3 = {"email": body["email"], "password": "string"} + response = client_auth.post(url, headers={"Authorization": token_}, json=body2) + assert response.status_code == status.HTTP_409_CONFLICT + response = client_auth.post(url, headers={"Authorization": token_}, json=body3) + assert response.status_code == status.HTTP_409_CONFLICT