Tests

alembic/versions/cac1f275a725_add_emailhostban_table.py

@@ -0,0 +1,37 @@
+"""Add EmailBan table.
+
+Revision ID: cac1f275a725
+Revises: 231e2c1e26da
+Create Date: 2016-12-12 23:41:56.438144
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = 'cac1f275a725'
+down_revision = '231e2c1e26da'
+branch_labels = None
+depends_on = None
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+    ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('email_bans',
+    sa.Column('id', sa.Integer(), nullable=False),
+    sa.Column('pattern', sa.Unicode(length=255), nullable=False),
+    sa.Column('date', sa.DateTime(), nullable=False),
+    sa.Column('creator_id', sa.Integer(), nullable=False),
+    sa.Column('reason', sa.Unicode(length=255), nullable=False),
+    sa.ForeignKeyConstraint(['creator_id'], ['users.id'], ),
+    sa.PrimaryKeyConstraint('id'),
+    sa.UniqueConstraint('pattern')
+    )
+    ### end Alembic commands ###
+
+
+def downgrade():
+    ### commands auto generated by Alembic - please adjust! ###
+    op.drop_table('email_host_bans')
+    ### end Alembic commands ###

alembic/versions/ea30a8851312_add_new_user_group.py

@@ -0,0 +1,31 @@
+"""Add new user group.
+
+Revision ID: ea30a8851312
+Revises: cac1f275a725
+Create Date: 2016-12-13 23:10:06.709741
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = 'ea30a8851312'
+down_revision = 'cac1f275a725'
+branch_labels = None
+depends_on = None
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+    ### commands auto generated by Alembic - please adjust! ###
+    op.execute("COMMIT;")
+    op.execute("ALTER TYPE users_group ADD VALUE 'new';")
+    op.execute("ALTER TYPE users_group ADD VALUE 'deactivated';")
+    op.execute("""UPDATE users SET "group"='deactivated' WHERE "group"='guest';""")
+    ### end Alembic commands ###
+
+
+def downgrade():
+    ### commands auto generated by Alembic - please adjust! ###
+    pass
+    ### end Alembic commands ###

extras/ensure_database.py

@@ -64,4 +64,5 @@ def init_db(redis: StrictRedis):
     del db
     del redis
 
-subprocess.call(sys.argv[1:])
+status = subprocess.call(sys.argv[1:])
+sys.exit(status)

newparp/__init__.py

@@ -2,6 +2,7 @@
 import logging
 
 from flask import Flask, abort, redirect, request, send_from_directory
+from flask_mail import Mail
 from werkzeug.routing import BaseConverter
 
 from newparp.helpers import check_csrf_token
@@ -12,17 +13,12 @@
     redis_disconnect,
     set_cookie,
 )
-from newparp import views
-from newparp.views import (
-    account, admin, characters, chat, chat_api, chat_list, errors, guides,
-    roulette, search, search_characters, settings,
-)
-from newparp.views.admin import spamless, spamless2
 
 
 app = Flask(__name__)
 app.url_map.strict_slashes = False
 
+
 # Config
 
 app.config["SERVER_NAME"] = os.environ["BASE_DOMAIN"]
@@ -52,6 +48,25 @@
 app.teardown_request(redis_disconnect)
 
 
+app.config["MAIL_SERVER"] = os.environ.get("MAIL_SERVER", "localhost")
+app.config["MAIL_PORT"] = int(os.environ.get("MAIL_PORT", 25))
+app.config["MAIL_USE_TLS"] = "MAIL_USE_TLS" in os.environ
+app.config["MAIL_USERNAME"] = os.environ.get("MAIL_USERNAME")
+app.config["MAIL_PASSWORD"] = os.environ.get("MAIL_PASSWORD")
+app.config["MAIL_SUPPRESS_SEND"] = app.testing or bool(os.environ.get("NOMAIL"))
+mail = Mail(app)
+
+
+# Views/routes
+
+from newparp import views
+from newparp.views import (
+    account, admin, characters, chat, chat_api, chat_list, errors, guides,
+    search, search_characters, settings,
+)
+from newparp.views.admin import spamless, spamless2
+
+
 class RegexConverter(BaseConverter):
     def __init__(self, url_map, *items):
         super(RegexConverter, self).__init__(url_map)
@@ -94,6 +109,7 @@ def make_rules(subdomain, path, func, formats=False, paging=False):
 app.add_url_rule("/settings/theme", "settings_theme", settings.theme, methods=("POST",))
 app.add_url_rule("/settings/log_in_details", "settings_log_in_details", settings.log_in_details, methods=("GET",))
 app.add_url_rule("/settings/change_email", "settings_change_email", settings.change_email, methods=("POST",))
+app.add_url_rule("/settings/verify_email", "settings_verify_email", settings.verify_email, methods=("GET",))
 app.add_url_rule("/settings/change_password", "settings_change_password", settings.change_password, methods=("POST",))
 make_rules("settings", "/settings/blocks", settings.blocks, formats=True)
 app.add_url_rule("/settings/unblock", "settings_unblock", settings.unblock, methods=("POST",))
@@ -136,14 +152,6 @@ def make_rules(subdomain, path, func, formats=False, paging=False):
 app.add_url_rule("/search/save", "rp_search_save", search.search_save, methods=("POST",))
 app.add_url_rule("/search", "rp_search", search.search_get, methods=("GET",))
 app.add_url_rule("/search", "rp_search_post", search.search_post, methods=("POST",))
-app.add_url_rule("/search/continue", "rp_search_continue", search.search_continue, methods=("POST",))
-app.add_url_rule("/search/stop", "rp_search_stop", search.search_stop, methods=("POST",))
-
-app.add_url_rule("/roulette/save", "rp_roulette_save", roulette.roulette_save, methods=("POST",))
-app.add_url_rule("/roulette", "rp_roulette", roulette.roulette_get, methods=("GET",))
-app.add_url_rule("/roulette", "rp_roulette_post", roulette.roulette_post, methods=("POST",))
-app.add_url_rule("/roulette/continue", "rp_roulette_continue", roulette.roulette_continue, methods=("POST",))
-app.add_url_rule("/roulette/stop", "rp_roulette_stop", roulette.roulette_stop, methods=("POST",))
 
 # 6. Groups
 
@@ -162,6 +170,7 @@ def make_rules(subdomain, path, func, formats=False, paging=False):
 make_rules("rp", "/<path:url>/log/<regex(\"20[0-9]{2}\"):year>-<regex(\"0[1-9]|1[0-2]\"):month>-<regex(\"0[1-9]|[1-2][0-9]|3[0-1]\"):day>", chat.log_day, formats=True)
 
 make_rules("rp", "/<path:url>/users", chat.users, formats=True, paging=True)
+app.add_url_rule("/<path:url>/users/reset_regexes", "rp_chat_reset_regexes", chat.reset_regexes, methods=("POST",))
 make_rules("rp", "/<path:url>/invites", chat.invites, formats=True, paging=True)
 
 app.add_url_rule("/<path:url>/uninvite", "rp_chat_uninvite", chat.uninvite, methods=("POST",))
@@ -170,11 +179,10 @@ def make_rules(subdomain, path, func, formats=False, paging=False):
 app.add_url_rule("/<path:url>/subscribe", "rp_chat_subscribe", chat.subscribe, methods=("POST",))
 app.add_url_rule("/<path:url>/unsubscribe", "rp_chat_unsubscribe", chat.unsubscribe, methods=("POST",))
 
-app.add_url_rule("/redirect", "redirect", views.redirect, methods=("GET",))
+app.add_url_rule("/redirect", "redirect", views.redirect_view, methods=("GET",))
 
 # 8. Chat API
 
-app.add_url_rule("/chat_api/messages", "messages", chat_api.messages, methods=("POST",))
 app.add_url_rule("/chat_api/send", "send", chat_api.send, methods=("POST",))
 app.add_url_rule("/chat_api/draft", "draft", chat_api.draft, methods=("POST",))
 app.add_url_rule("/chat_api/block", "block", chat_api.block, methods=("POST",))
@@ -190,8 +198,6 @@ def make_rules(subdomain, path, func, formats=False, paging=False):
 app.add_url_rule("/chat_api/request_username", "request_username", chat_api.request_username, methods=("POST",))
 app.add_url_rule("/chat_api/exchange_usernames", "exchange_usernames", chat_api.exchange_usernames, methods=("POST",))
 app.add_url_rule("/chat_api/look_up_user", "look_up_user", chat_api.look_up_user, methods=("POST",))
-app.add_url_rule("/chat_api/ping", "ping", chat_api.ping, methods=("POST",))
-app.add_url_rule("/chat_api/quit", "quit", chat_api.quit, methods=("POST",))
 
 # 9. Admin
 
@@ -237,6 +243,10 @@ def make_rules(subdomain, path, func, formats=False, paging=False):
 app.add_url_rule("/admin/ip_bans/new", "admin_new_ip_ban", admin.new_ip_ban, methods=("POST",))
 app.add_url_rule("/admin/ip_bans/delete", "admin_delete_ip_ban", admin.delete_ip_ban, methods=("POST",))
 
+make_rules("admin", "/admin/email_bans", admin.email_bans, formats=True)
+app.add_url_rule("/admin/email_bans/new", "admin_new_email_ban", admin.new_email_ban, methods=("POST",))
+app.add_url_rule("/admin/email_bans/delete", "admin_delete_email_ban", admin.delete_email_ban, methods=("POST",))
+
 app.add_url_rule("/admin/worker_status", "admin_worker_status", admin.worker_status, methods=("GET",))
 
 # 10. Guides

newparp/helpers/auth.py

@@ -16,13 +16,24 @@ def decorated_function(*args, **kwargs):
     return decorated_function
 
 
+def activation_required(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        if g.user is None:
+            return render_template("account/log_in_required.html")
+        elif g.user.group == "new":
+            return render_template("account/user_new.html")
+        elif g.user.group == "deactivated":
+            return render_template("account/user_deactivated.html")
+        return f(*args, **kwargs)
+    return decorated_function
+
+
 def log_in_required(f):
     @wraps(f)
     def decorated_function(*args, **kwargs):
         if g.user is None:
             return render_template("account/log_in_required.html")
-        elif g.user.group == "guest":
-            return render_template("account/activation_required.html")
         return f(*args, **kwargs)
     return decorated_function
 

newparp/helpers/chat.py

@@ -27,46 +27,22 @@ class KickedException(Exception):
     pass
 
 
-def group_chat_only(f):
+def require_socket(f):
+    """Only allow this request if the user has a socket open."""
     @wraps(f)
     def decorated_function(*args, **kwargs):
-        if g.chat.type != "group":
-            abort(404)
+        g.chat_id = int(request.form["chat_id"])
+        if g.redis.scard("chat:%s:sockets:%s" % (g.chat_id, g.session_id)) == 0:
+            abort(403)
         return f(*args, **kwargs)
     return decorated_function
 
 
-def mark_alive(f):
+def group_chat_only(f):
     @wraps(f)
     def decorated_function(*args, **kwargs):
-        g.joining = False
-        g.chat_id = int(request.form["chat_id"])
-        # Don't bother with any of this if we have a socket open, because the
-        # request is probably from that window.
-        if g.redis.scard("chat:%s:sockets:%s" % (g.chat_id, g.session_id)) != 0:
-            return f(*args, **kwargs)
-        session_online = g.redis.hexists("chat:%s:online" % g.chat_id, g.session_id)
-        if not session_online:
-            g.joining = True
-            # Make sure we're connected to the database.
-            db_connect()
-            # Get ChatUser if we haven't got it already.
-            if not hasattr(g, "chat_user"):
-                get_chat_user()
-            try:
-                authorize_joining(g.redis, g.db, g)
-            except (UnauthorizedException, BannedException, TooManyPeopleException):
-                abort(403)
-            try:
-                kick_check(g.redis, g)
-            except KickedException:
-                return jsonify({"exit": "kick"})
-            join(g.redis, g.db, g)
-        g.redis.zadd(
-            "chats_alive",
-            time.time() + 60,
-            "%s/%s" % (g.chat_id, g.session_id),
-        )
+        if g.chat.type != "group":
+            abort(404)
         return f(*args, **kwargs)
     return decorated_function
 

newparp/helpers/email.py

@@ -0,0 +1,42 @@
+from flask import g, render_template, url_for
+from flask_mail import Message as EmailMessage
+from uuid import uuid4
+
+from newparp import mail
+
+
+expiry_times = {
+    "welcome": 86400,
+    "verify": 86400,
+    "reset": 600,
+}
+
+subjects = {
+    "welcome": "Welcome to MSPARP",
+    "verify": "Verify your e-mail address",
+    "reset": "Reset your password",
+}
+
+keys = {
+    "welcome": "verify",
+    "verify": "verify",
+    "reset": "reset",
+}
+
+
+def send_email(action, email_address):
+    email_token = str(uuid4())
+    g.redis.setex(
+        ":".join([keys[action], str(g.user.id), email_address]),
+        expiry_times[action],
+        email_token,
+    )
+    message = EmailMessage(
+        subject=subjects[action],
+        sender="admin@msparp.com",
+        recipients=[email_address],
+        body=render_template("email/%s_plain.html" % action, user=g.user, email_address=email_address, email_token=email_token),
+        html=render_template("email/%s.html" % action, user=g.user, email_address=email_address, email_token=email_token),
+    )
+    mail.send(message)
+