Change EmailDevice default to unconfirmed until verified #752
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MAkcanca
commented
Mar 25, 2025
| if not user or user.is_anonymous: | ||
| return | ||
| if hasattr(user, USER_DEFAULT_DEVICE_ATTR_NAME): | ||
| return getattr(user, USER_DEFAULT_DEVICE_ATTR_NAME) | ||
| for device in devices_for_user(user): | ||
| for device in devices_for_user(user, confirmed=confirmed): |
There was a problem hiding this comment.
As per django-otp docstring for this function, it already defaults to True
|
Tests are failing due to #754 |
|
@MAkcanca can up update your branch with the latest from |
moggers87
requested changes
Apr 2, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
We change EmailDevice default to unconfirmed (confirmed False) because until the email is actually verified with OTP, we should not assume that flow is finished and user properly setup the OTP. This changes the default property confirmed to False, and adds a test to ensure we get a device created in a confirmed False state.
Motivation and Context
#751
#562
How Has This Been Tested?
Ran existing tests + added a new single test to confirm it creates an unconfirmed device if code is not validated. I also tested with the provided example app, starting the setup flow with email, then cancelling it without entering the code, checking from the shell/admin that email device is created with first unconfirmed, then confirmed state.
Types of changes
Checklist: