bernard/RosterChief
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Email a set-password link on claim approval, flash identically either way

Browse Source 
Two additions to the parent-claim flow: Club.contact_email (set from the
control panel, next to legal_name), and an email sent when an admin approves a
claim -- a real one-time set-password link built with allauth's own token
generator, so it lands in the same flow the login page's own reset would send
a parent to rather than a second, parallel one that could drift out of step
with it.

Never allowed to fail the approval: the family link and the guardian row are
real either way, and a mail server being briefly unreachable must not cost a
parent their place in the queue. The admin gets a distinct warning telling
them the email didn't go and to have the parent use "Forgot your password?"
instead.

The public submission flash keeps the enumeration guarantee the claim form
itself was built around: worded and timed identically whether or not a
matching child was found, sent before any lookup happens at all, mentioning
the club's contact email when the club has set one. A test compares the
rendered flash across a matching and a non-matching submission byte for byte.

One test-writing trap worth recording: assertRedirects follows the redirect
itself by default, and its own probe GET consumed the one-shot flash message
before a later explicit GET in the same test could see it --
fetch_redirect_response=False avoids the double-fetch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Bernard Siebens
2026-08-11 18:33:41 +02:00
parent ca2b1a11b5
commit cb7f56709b
12 changed files with 186 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
members/templates/members/email/claim_approved.txt Normal file
View File

@@ -0,0 +1,13 @@
{% load i18n %}{% blocktrans with name=parent_first_name %}Hello {{ name }},{% endblocktrans %}
{% blocktrans with club=club.name child=child %}{{ club }} has confirmed that you're {{ child }}'s parent or guardian, and your account is ready.{% endblocktrans %}
{% trans "Set your password here:" %}
{{ set_password_url }}
{% blocktrans %}That link is for you alone — please don't forward it.{% endblocktrans %}
{% blocktrans %}Once you're signed in you'll see the children linked to you.{% endblocktrans %}
{% if club.contact_email %}
{% blocktrans with email=club.contact_email %}Something not right? Reply to this note or write to {{ email }}.{% endblocktrans %}
{% endif %}
{% blocktrans with club=club.name %}— {{ club }}{% endblocktrans %}

1
members/templates/members/email/claim_approved_subject.txt Normal file
View File

@@ -0,0 +1 @@
{% load i18n %}{% blocktrans with club=club.name %}Your {{ club }} account is ready{% endblocktrans %}

20
members/templates/members/parent_claim_submitted.html
View File

@@ -1,20 +0,0 @@
{% extends "_club_base.html" %}
{% load i18n lucide %}
{% block head_title %}{% trans "Request sent" %}{% endblock head_title %}
{% block main %}
{% comment %}
Says the same thing whether or not the child was found: this page is public,
so confirming a match would let anyone test which children the club has.
{% endcomment %}
<div class="flex justify-center">
<div class="card w-full max-w-xl bg-base-100 shadow">
<div class="card-body">
<h1 class="card-title">{% lucide "circle-check" size=20 %} {% trans "Request sent" %}</h1>
<p>{% blocktrans with club=club.name %}Thanks — {{ club }} will check this against their records.{% endblocktrans %}</p>
<p class="text-sm opacity-70">{% blocktrans %}If it matches, you'll get an email with a link to set your password. If you don't hear anything, get in touch with the club directly.{% endblocktrans %}</p>
</div>
</div>
</div>
{% endblock main %}