create_preregistration_user: Add additional hardening assertion.

TestMaybeSendToRegistration needs tweaking here, because it wasn't
setting the subdomain for the dummy request, so
maybe_send_to_registration was actually running with realm=None, which
is not right for these tests.

Also, test_sso_only_when_preregistration_user_exists was creating
PreregistrationUser without setting the realm, which was also incorrect.

zerver/tests/test_auth_backends.py

@@ -6599,7 +6599,7 @@ class TestRequireEmailFormatUsernames(ZulipTestCase):
 
 class TestMaybeSendToRegistration(ZulipTestCase):
     def test_sso_only_when_preregistration_user_does_not_exist(self) -> None:
-        rf = RequestFactory()
+        rf = RequestFactory(HTTP_HOST=Realm.host_for_subdomain("zulip"))
         request = rf.get("/")
         request.session = {}
         request.user = None
@@ -6629,11 +6629,13 @@ class TestMaybeSendToRegistration(ZulipTestCase):
         self.assert_in_response(f'value="{confirmation_key}" name="key"', result)
 
     def test_sso_only_when_preregistration_user_exists(self) -> None:
-        rf = RequestFactory()
+        rf = RequestFactory(HTTP_HOST=Realm.host_for_subdomain("zulip"))
         request = rf.get("/")
         request.session = {}
         request.user = None
 
+        realm = get_realm("zulip")
+
         # Creating a mock Django form in order to keep the test simple.
         # This form will be returned by the create_homepage_form function
         # and will always be valid so that the code that we want to test
@@ -6643,7 +6645,7 @@ class TestMaybeSendToRegistration(ZulipTestCase):
                 return True
 
         email = self.example_email("hamlet")
-        user = PreregistrationUser(email=email)
+        user = PreregistrationUser(email=email, realm=realm)
         user.save()
         create_confirmation_link(user, Confirmation.USER_REGISTRATION)
 

zerver/views/auth.py

@@ -121,6 +121,7 @@ def create_preregistration_user(
     full_name_validated: bool = False,
 ) -> PreregistrationUser:
     assert not (realm_creation and realm is not None)
+    assert not (realm is None and not realm_creation)
 
     return PreregistrationUser.objects.create(
         email=email,