invitations: Revoke remaining invitations after user registers.

If a user receives more than one invite to join a
realm, after that user registers, all the remaining
invitations should be revoked, preventing them to be
listed in active invitations on admin panel.
To do this, we added a new prereg_user status,
STATUS_REVOKED.

We also added a confirmation_link_expired_error page
in case the user tries click on a revoked invitaion.
This page has a link to login page.

Fixes: #12629

Co-authored-by: Arunika <arunikayadav42@gmail.com>
This commit is contained in:
clarammdantas
2020-04-30 20:52:45 -03:00
committed by Tim Abbott
parent 923c5e3063
commit edcf4f0ea2
5 changed files with 73 additions and 12 deletions

View File

@@ -401,12 +401,15 @@ def process_new_human_user(user_profile: UserProfile,
# inactive so we can keep track of the PreregistrationUser we
# actually used for analytics
if prereg_user is not None:
PreregistrationUser.objects.filter(email__iexact=user_profile.delivery_email).exclude(
id=prereg_user.id).update(status=0)
PreregistrationUser.objects.filter(
email__iexact=user_profile.delivery_email).exclude(id=prereg_user.id)\
.update(status=confirmation_settings.STATUS_REVOKED)
if prereg_user.referred_by is not None:
notify_invites_changed(user_profile)
else:
PreregistrationUser.objects.filter(email__iexact=user_profile.delivery_email).update(status=0)
PreregistrationUser.objects.filter(email__iexact=user_profile.delivery_email)\
.update(status=confirmation_settings.STATUS_REVOKED)
notify_new_user(user_profile)
# Clear any scheduled invitation emails to prevent them
@@ -5072,9 +5075,10 @@ def do_invite_users(user_profile: UserProfile,
def do_get_user_invites(user_profile: UserProfile) -> List[Dict[str, Any]]:
days_to_activate = settings.INVITATION_LINK_VALIDITY_DAYS
active_value = getattr(confirmation_settings, 'STATUS_ACTIVE', 1)
active_value = confirmation_settings.STATUS_ACTIVE
revoked_value = confirmation_settings.STATUS_REVOKED
lowest_datetime = timezone_now() - datetime.timedelta(days=days_to_activate)
base_query = PreregistrationUser.objects.exclude(status=active_value).filter(
base_query = PreregistrationUser.objects.exclude(status__in=[active_value, revoked_value]).filter(
invited_at__gte=lowest_datetime)
if user_profile.is_realm_admin: