mozilla / basket / 357

pending completion

Build # 357

Build Type

Pull #156

travis-ci

Committed by

pmclanahan

Commit Message

<a href="https://github.com/mozilla/basket/commit/<a class=hub.com/mozilla/basket/commit/a47460bb7b26d52fb3749faee70eb333fee69a2c">a47460bb7<a href="https://github.com/mozilla/basket/commit/a47460bb7b26d52fb3749faee70eb333fee69a2c">&quot;&gt;LEGACY: Fix bug 1228052: Add private newsletters.

Backport of </a><a class="double-link" href="https://github.com/mozilla/basket/commit/<a class="double-link" href="https://github.com/mozilla/basket/commit/d3a284a8f35b4ac9ed0eb3942861be38f2911aa1">d3a284a8f</a>">d3a284a8f</a><a href="https://github.com/mozilla/basket/commit/a47460bb7b26d52fb3749faee70eb333fee69a2c"> for
legacy deployments.

Pull Request Pull Request #156: LEGACY: Fix bug 1228052: Add private newsletters.

Run Details

27 of 27 new or added lines in 6 files covered. (100.0%)

1328 of 1655 relevant lines covered (80.24%)

0.8 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

88.72

/news/views.py

import json
import re

from django.conf import settings
from django.shortcuts import render
from django.utils.encoding import force_unicode
from django.views.decorators.cache import cache_control, never_cache
from django.views.decorators.csrf import csrf_exempt
from django.views.decorators.http import require_GET, require_POST

# Get error codes from basket-client so users see the same definitions
from basket import errors
from django_statsd.clients import statsd
from ratelimit.exceptions import Ratelimited
from ratelimit.utils import is_ratelimited

from news.models import Newsletter, Subscriber, Interest
from news.newsletters import get_sms_messages, newsletter_slugs
from news.tasks import (
    add_fxa_activity,
    add_sms_user,
    confirm_user,
    send_recovery_message_task,
    update_custom_unsub,
    update_fxa_info,
    update_get_involved,
    update_phonebook,
    update_student_ambassadors)
from news.utils import (
    SET,
    SUBSCRIBE,
    UNSUBSCRIBE,
    MSG_EMAIL_OR_TOKEN_REQUIRED,
    MSG_USER_NOT_FOUND,
    EmailValidationError,
    email_is_blocked,
    get_accept_languages,
    get_best_language,
    get_user_data,
    get_user,
    has_valid_api_key,
    HttpResponseJSON,
    language_code_is_valid,
    logged_in,
    NewsletterException,
    update_user_task,
    validate_email,
    newsletter_exception_response)


IP_RATE_LIMIT_EXTERNAL = getattr(settings, 'IP_RATE_LIMIT_EXTERNAL', '40/m')
IP_RATE_LIMIT_INTERNAL = getattr(settings, 'IP_RATE_LIMIT_INTERNAL', '400/m')
PHONE_NUMBER_RATE_LIMIT = getattr(settings, 'PHONE_NUMBER_RATE_LIMIT', '1/h')


def ip_rate_limit_key(group, request):
    return request.META.get('HTTP_X_CLUSTER_CLIENT_IP',
                            request.META.get('REMOTE_ADDR'))


def ip_rate_limit_rate(group, request):
    client_ip = ip_rate_limit_key(group, request)
    if client_ip and client_ip.startswith('10.'):
        # internal request, high limit.
        return IP_RATE_LIMIT_INTERNAL

    return IP_RATE_LIMIT_EXTERNAL


def source_ip_rate_limit_key(group, request):
    return request.META.get('HTTP_X_SOURCE_IP', None)


def source_ip_rate_limit_rate(group, request):
    source_ip = source_ip_rate_limit_key(group, request)
    if source_ip is None:
        # header not provided, no limit.
        return None

    return IP_RATE_LIMIT_EXTERNAL


def ratelimited(request, e):
    statsd.incr('.'.join(request.path.split('/') + ['ratelimited']))
    return HttpResponseJSON({
        'status': 'error',
        'desc': 'rate limit reached',
        'code': errors.BASKET_USAGE_ERROR,
    }, 429)


@require_POST
@logged_in
@csrf_exempt
def confirm(request, token):
    confirm_user.delay(request.subscriber.token,
                       request.subscriber_data)
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@csrf_exempt
def fxa_activity(request):
    if not request.is_secure():
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-activity requires SSL',
            'code': errors.BASKET_SSL_REQUIRED,
        }, 401)
    if not has_valid_api_key(request):
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-activity requires a valid API-key',
            'code': errors.BASKET_AUTH_ERROR,
        }, 401)

    data = json.loads(request.body)
    if 'fxa_id' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-activity requires a Firefox Account ID',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)

    add_fxa_activity.delay(data)
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@csrf_exempt
def fxa_register(request):
    if not request.is_secure():
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-register requires SSL',
            'code': errors.BASKET_SSL_REQUIRED,
        }, 401)
    if not has_valid_api_key(request):
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-register requires a valid API-key',
            'code': errors.BASKET_AUTH_ERROR,
        }, 401)

    data = request.POST.dict()
    if 'email' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-register requires an email address',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)
    if 'fxa_id' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-register requires a Firefox Account ID',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)
    if 'accept_lang' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'fxa-register requires accept_lang',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)

    lang = get_best_language(get_accept_languages(data['accept_lang']))
    if lang is None:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'invalid language',
            'code': errors.BASKET_INVALID_LANGUAGE,
        }, 400)

    args = [data['email'], lang, data['fxa_id']]
    kwargs = {}
    if 'source_url' in data:
        kwargs['source_url'] = data['source_url']

    if data.get('skip_welcome', False):
        kwargs['skip_welcome'] = True

    update_fxa_info.delay(*args, **kwargs)
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@csrf_exempt
def get_involved(request):
    data = request.POST.dict()
    if 'email' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'email is required',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)
    if email_is_blocked(data['email']):
        # don't let on there's a problem
        return HttpResponseJSON({'status': 'ok'})
    if 'interest_id' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'interest_id is required',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)

    try:
        Interest.objects.get(interest_id=data['interest_id'])
    except Interest.DoesNotExist:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'invalid interest_id',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)

    if 'lang' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'lang is required',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)
    if not language_code_is_valid(data['lang']):
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'invalid language',
            'code': errors.BASKET_INVALID_LANGUAGE,
        }, 400)
    if 'name' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'name is required',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)
    if 'country' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'country is required',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)

    try:
        validate_email(data.get('email'))
    except EmailValidationError as e:
        return invalid_email_response(e)

    update_get_involved.delay(
        data['interest_id'],
        data['lang'],
        data['name'],
        data['email'],
        data['country'],
        data.get('format', 'H'),
        data.get('subscribe', False),
        data.get('message', None),
        data.get('source_url', None),
    )
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@csrf_exempt
def subscribe(request):
    data = request.POST.dict()
    newsletters = data.get('newsletters', None)
    if not newsletters:
        # request.body causes tests to raise exceptions
        # while request.read() works.
        raw_request = request.read()
        if 'newsletters=' in raw_request:
            # malformed request from FxOS
            # Can't use QueryDict since the string is not url-encoded.
            # It will convert '+' to ' ' for example.
            data = dict(pair.split('=') for pair in raw_request.split('&'))
            email = data.get('email')
            if email:
                data['email'] = force_unicode(email)
            statsd.incr('subscribe-fxos-workaround')
        else:
            return HttpResponseJSON({
                'status': 'error',
                'desc': 'newsletters is missing',
                'code': errors.BASKET_USAGE_ERROR,
            }, 400)

    if 'email' not in data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'email is required',
            'code': errors.BASKET_USAGE_ERROR,
        }, 401)

    if email_is_blocked(data['email']):
        # don't let on there's a problem
        return HttpResponseJSON({'status': 'ok'})

    optin = data.get('optin', 'N').upper() == 'Y'
    sync = data.get('sync', 'N').upper() == 'Y'

    if optin and (not request.is_secure() or not has_valid_api_key(request)):
        # for backward compat we just ignore the optin if
        # no valid API key is sent.
        optin = False

    if sync:
        if not request.is_secure():
            return HttpResponseJSON({
                'status': 'error',
                'desc': 'subscribe with sync=Y requires SSL',
                'code': errors.BASKET_SSL_REQUIRED,
            }, 401)
        if not has_valid_api_key(request):
            return HttpResponseJSON({
                'status': 'error',
                'desc': 'Using subscribe with sync=Y, you need to pass a '
                        'valid `api-key` GET or POST parameter or X-api-key header',
                'code': errors.BASKET_AUTH_ERROR,
            }, 401)

    try:
        validate_email(data.get('email'))
    except EmailValidationError as e:
        return invalid_email_response(e)

    return update_user_task(request, SUBSCRIBE, data=data, optin=optin, sync=sync)


def invalid_email_response(e):
    resp_data = {
        'status': 'error',
        'code': errors.BASKET_INVALID_EMAIL,
        'desc': e.messages[0],
    }
    if e.suggestion:
        resp_data['suggestion'] = e.suggestion
    return HttpResponseJSON(resp_data, 400)


@require_POST
@csrf_exempt
def subscribe_sms(request):
    if 'mobile_number' not in request.POST:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'mobile_number is missing',
            'code': errors.BASKET_USAGE_ERROR,
        }, 400)

    messages = get_sms_messages()
    msg_name = request.POST.get('msg_name', 'SMS_Android')
    if msg_name not in messages:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'Invalid msg_name',
            'code': errors.BASKET_USAGE_ERROR,
        }, 400)

    mobile = request.POST['mobile_number']
    mobile = re.sub(r'\D+', '', mobile)
    if len(mobile) == 10:
        mobile = '1' + mobile
    elif len(mobile) != 11 or mobile[0] != '1':
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'mobile_number must be a US number',
            'code': errors.BASKET_USAGE_ERROR,
        }, 400)

    # only rate limit numbers here so we don't rate limit errors.
    if is_ratelimited(request, group='news.views.subscribe_sms',
                      key=lambda x, y: '%s-%s' % (msg_name, mobile),
                      rate=PHONE_NUMBER_RATE_LIMIT, increment=True):
        raise Ratelimited()

    optin = request.POST.get('optin', 'N') == 'Y'

    add_sms_user.delay(msg_name, mobile, optin)
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@logged_in
@csrf_exempt
def unsubscribe(request, token):
    data = request.POST.dict()

    if data.get('optout', 'N') == 'Y':
        data['newsletters'] = ','.join(newsletter_slugs())

    return update_user_task(request, UNSUBSCRIBE, data)


@logged_in
@csrf_exempt
@never_cache
def user(request, token):
    if request.method == 'POST':
        return update_user_task(request, SET)

    if request.subscriber_data:
        return HttpResponseJSON(request.subscriber_data)

    return get_user(request.subscriber.token)


@require_POST
@csrf_exempt
def send_recovery_message(request):
    """
    Send a recovery message to an email address.

    required form parameter: email

    If email not provided or not syntactically correct, returns 400.
    If email not known, returns 404.
    Otherwise, queues a task to send the message and returns 200.
    """
    try:
        validate_email(request.POST.get('email'))
    except EmailValidationError as e:
        return invalid_email_response(e)

    email = request.POST.get('email')
    if email_is_blocked(email):
        # don't let on there's a problem
        return HttpResponseJSON({'status': 'ok'})

    try:
        user_data = get_user_data(email=email, sync_data=True)
    except NewsletterException as e:
        return newsletter_exception_response(e)

    if not user_data:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'Email address not known',
            'code': errors.BASKET_UNKNOWN_EMAIL,
        }, 404)  # Note: Bedrock looks for this 404

    send_recovery_message_task.delay(email)
    return HttpResponseJSON({'status': 'ok'})


@never_cache
def debug_user(request):
    if 'email' not in request.GET or 'supertoken' not in request.GET:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'Using debug_user, you need to pass the '
                    '`email` and `supertoken` GET parameters',
            'code': errors.BASKET_USAGE_ERROR,
        }, 400)

    if request.GET['supertoken'] != settings.SUPERTOKEN:
        return HttpResponseJSON({'status': 'error',
                                 'desc': 'Bad supertoken',
                                 'code': errors.BASKET_AUTH_ERROR},
                                401)

    email = request.GET['email']
    try:
        user_data = get_user_data(email=email)
    except NewsletterException as e:
        return newsletter_exception_response(e)

    try:
        user = Subscriber.objects.get(email=email)
        user_data['in_basket'] = True
        user_data['basket_token'] = user.token
    except Subscriber.DoesNotExist:
        user_data['in_basket'] = False
        user_data['basket_token'] = ''

    return HttpResponseJSON(user_data, 200)


# Custom update methods

@csrf_exempt
def custom_unsub_reason(request):
    """Update the reason field for the user, which logs why the user
    unsubscribed from all newsletters."""

    if 'token' not in request.POST or 'reason' not in request.POST:
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'custom_unsub_reason requires the `token` '
                    'and `reason` POST parameters',
            'code': errors.BASKET_USAGE_ERROR,
        }, 400)

    update_custom_unsub.delay(request.POST['token'], request.POST['reason'])
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@logged_in
@csrf_exempt
def custom_update_student_ambassadors(request, token):
    sub = request.subscriber
    update_student_ambassadors.delay(request.POST.dict(), sub.email,
                                     sub.token)
    return HttpResponseJSON({'status': 'ok'})


@require_POST
@logged_in
@csrf_exempt
def custom_update_phonebook(request, token):
    sub = request.subscriber
    update_phonebook.delay(request.POST.dict(), sub.email, sub.token)
    return HttpResponseJSON({'status': 'ok'})


# Get data about current newsletters
@require_GET
@cache_control(max_age=300)
def newsletters(request):
    # Get the newsletters as a dictionary of dictionaries that are
    # easily jsonified

    result = {}
    for newsletter in Newsletter.objects.all().values():
        newsletter['languages'] = newsletter['languages'].split(",")
        result[newsletter['slug']] = newsletter
        del newsletter['id']  # caller doesn't need to know our pkey
        del newsletter['slug']  # or our slug

    return HttpResponseJSON({
        'status': 'ok',
        'newsletters': result,
    })


@never_cache
def lookup_user(request):
    """Lookup a user in Exact Target given email or token (not both).

    To look up by email, a valid API key are required.

    If email and token are both provided, an error is returned rather
    than trying to define all the possible behaviors.

    SSL is always required when using this call. If no SSL, it'll fail
    with 401 and an appropriate message in the response body.

    Response content is always JSON.

    If user is not found, returns a 404 status and json is::

        {
            'status': 'error',
            'desc': 'No such user'
        }

    (If you need to distinguish user not found from an error calling
    the API, check the response content.)

    If a required, valid API key is not provided, status is 401 Unauthorized.
    The API key can be provided either as a GET query parameter ``api-key``
    or a request header ``X-api-key``. If it's provided as a query parameter,
    any request header is ignored.

    For other errors, similarly
    response status is 4xx and the json 'desc' says what's wrong.

    Otherwise, status is 200 and json is the return value from
    `get_user_data`. See that method for details.

    Note that because this method always calls Exact Target one or
    more times, it can be slower than some other Basket APIs, and will
    fail if ET is down.
    """

    if not request.is_secure():
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'lookup_user always requires SSL',
            'code': errors.BASKET_SSL_REQUIRED,
        }, 401)

    token = request.GET.get('token', None)
    email = request.GET.get('email', None)

    if (not email and not token) or (email and token):
        return HttpResponseJSON({
            'status': 'error',
            'desc': MSG_EMAIL_OR_TOKEN_REQUIRED,
            'code': errors.BASKET_USAGE_ERROR,
        }, 400)

    if email and not has_valid_api_key(request):
        return HttpResponseJSON({
            'status': 'error',
            'desc': 'Using lookup_user with `email`, you need to pass a '
                    'valid `api-key` GET parameter or X-api-key header',
            'code': errors.BASKET_AUTH_ERROR,
        }, 401)

    try:
        user_data = get_user_data(token=token, email=email)
    except NewsletterException as e:
        return newsletter_exception_response(e)

    status_code = 200
    if not user_data:
        code = errors.BASKET_UNKNOWN_TOKEN if token else errors.BASKET_UNKNOWN_EMAIL
        user_data = {
            'status': 'error',
            'desc': MSG_USER_NOT_FOUND,
            'code': code,
        }
        status_code = 404

    return HttpResponseJSON(user_data, status_code)


@require_GET
@cache_control(max_age=300)
def list_newsletters(request):
    """
    Public web page listing currently active newsletters.
    """
    active_newsletters = Newsletter.objects.filter(active=True, private=False)
    return render(request, 'news/newsletters.html',
                  {'newsletters': active_newsletters})

1	import json	1✔
2	import re	1✔
3
4	from django.conf import settings	1✔
5	from django.shortcuts import render	1✔
6	from django.utils.encoding import force_unicode	1✔
7	from django.views.decorators.cache import cache_control, never_cache	1✔
8	from django.views.decorators.csrf import csrf_exempt	1✔
9	from django.views.decorators.http import require_GET, require_POST	1✔
10
11	# Get error codes from basket-client so users see the same definitions
12	from basket import errors	1✔
13	from django_statsd.clients import statsd	1✔
14	from ratelimit.exceptions import Ratelimited	1✔
15	from ratelimit.utils import is_ratelimited	1✔
16
17	from news.models import Newsletter, Subscriber, Interest	1✔
18	from news.newsletters import get_sms_messages, newsletter_slugs	1✔
19	from news.tasks import (	1✔
20	add_fxa_activity,
21	add_sms_user,
22	confirm_user,
23	send_recovery_message_task,
24	update_custom_unsub,
25	update_fxa_info,
26	update_get_involved,
27	update_phonebook,
28	update_student_ambassadors)
29	from news.utils import (	1✔
30	SET,
31	SUBSCRIBE,
32	UNSUBSCRIBE,
33	MSG_EMAIL_OR_TOKEN_REQUIRED,
34	MSG_USER_NOT_FOUND,
35	EmailValidationError,
36	email_is_blocked,
37	get_accept_languages,
38	get_best_language,
39	get_user_data,
40	get_user,
41	has_valid_api_key,
42	HttpResponseJSON,
43	language_code_is_valid,
44	logged_in,
45	NewsletterException,
46	update_user_task,
47	validate_email,
48	newsletter_exception_response)
49
50
51	IP_RATE_LIMIT_EXTERNAL = getattr(settings, 'IP_RATE_LIMIT_EXTERNAL', '40/m')	1✔
52	IP_RATE_LIMIT_INTERNAL = getattr(settings, 'IP_RATE_LIMIT_INTERNAL', '400/m')	1✔
53	PHONE_NUMBER_RATE_LIMIT = getattr(settings, 'PHONE_NUMBER_RATE_LIMIT', '1/h')	1✔
54
55
56	def ip_rate_limit_key(group, request):	1✔
57	return request.META.get('HTTP_X_CLUSTER_CLIENT_IP',	1✔
58	request.META.get('REMOTE_ADDR'))
59
60
61	def ip_rate_limit_rate(group, request):	1✔
62	client_ip = ip_rate_limit_key(group, request)	1✔
63	if client_ip and client_ip.startswith('10.'):	1✔
64	# internal request, high limit.
65	return IP_RATE_LIMIT_INTERNAL	1✔
66
67	return IP_RATE_LIMIT_EXTERNAL	1✔
68
69
70	def source_ip_rate_limit_key(group, request):	1✔
71	return request.META.get('HTTP_X_SOURCE_IP', None)	1✔
72
73
74	def source_ip_rate_limit_rate(group, request):	1✔
75	source_ip = source_ip_rate_limit_key(group, request)	1✔
76	if source_ip is None:	1✔
77	# header not provided, no limit.
78	return None	1✔
79
80	return IP_RATE_LIMIT_EXTERNAL	1✔
81
82
83	def ratelimited(request, e):	1✔
84	statsd.incr('.'.join(request.path.split('/') + ['ratelimited']))	1✔
85	return HttpResponseJSON({	1✔
86	'status': 'error',
87	'desc': 'rate limit reached',
88	'code': errors.BASKET_USAGE_ERROR,
89	}, 429)
90
91
92	@require_POST	1✔
93	@logged_in	1✔
94	@csrf_exempt	1✔
95	def confirm(request, token):
96	confirm_user.delay(request.subscriber.token,	×
97	request.subscriber_data)
98	return HttpResponseJSON({'status': 'ok'})	×
99
100
101	@require_POST	1✔
102	@csrf_exempt	1✔
103	def fxa_activity(request):
104	if not request.is_secure():	×
105	return HttpResponseJSON({	×
106	'status': 'error',
107	'desc': 'fxa-activity requires SSL',
108	'code': errors.BASKET_SSL_REQUIRED,
109	}, 401)
110	if not has_valid_api_key(request):	×
111	return HttpResponseJSON({	×
112	'status': 'error',
113	'desc': 'fxa-activity requires a valid API-key',
114	'code': errors.BASKET_AUTH_ERROR,
115	}, 401)
116
117	data = json.loads(request.body)	×
118	if 'fxa_id' not in data:	×
119	return HttpResponseJSON({	×
120	'status': 'error',
121	'desc': 'fxa-activity requires a Firefox Account ID',
122	'code': errors.BASKET_USAGE_ERROR,
123	}, 401)
124
125	add_fxa_activity.delay(data)	×
126	return HttpResponseJSON({'status': 'ok'})	×
127
128
129	@require_POST	1✔
130	@csrf_exempt	1✔
131	def fxa_register(request):
132	if not request.is_secure():	1✔
133	return HttpResponseJSON({	1✔
134	'status': 'error',
135	'desc': 'fxa-register requires SSL',
136	'code': errors.BASKET_SSL_REQUIRED,
137	}, 401)
138	if not has_valid_api_key(request):	1✔
139	return HttpResponseJSON({	1✔
140	'status': 'error',
141	'desc': 'fxa-register requires a valid API-key',
142	'code': errors.BASKET_AUTH_ERROR,
143	}, 401)
144
145	data = request.POST.dict()	1✔
146	if 'email' not in data:	1✔
147	return HttpResponseJSON({	1✔
148	'status': 'error',
149	'desc': 'fxa-register requires an email address',
150	'code': errors.BASKET_USAGE_ERROR,
151	}, 401)
152	if 'fxa_id' not in data:	1✔
153	return HttpResponseJSON({	1✔
154	'status': 'error',
155	'desc': 'fxa-register requires a Firefox Account ID',
156	'code': errors.BASKET_USAGE_ERROR,
157	}, 401)
158	if 'accept_lang' not in data:	1✔
159	return HttpResponseJSON({	1✔
160	'status': 'error',
161	'desc': 'fxa-register requires accept_lang',
162	'code': errors.BASKET_USAGE_ERROR,
163	}, 401)
164
165	lang = get_best_language(get_accept_languages(data['accept_lang']))	1✔
166	if lang is None:	1✔
167	return HttpResponseJSON({	1✔
168	'status': 'error',
169	'desc': 'invalid language',
170	'code': errors.BASKET_INVALID_LANGUAGE,
171	}, 400)
172
173	args = [data['email'], lang, data['fxa_id']]	1✔
174	kwargs = {}	1✔
175	if 'source_url' in data:	1✔
176	kwargs['source_url'] = data['source_url']	1✔
177
178	if data.get('skip_welcome', False):	1✔
179	kwargs['skip_welcome'] = True	1✔
180
181	update_fxa_info.delay(args, *kwargs)	1✔
182	return HttpResponseJSON({'status': 'ok'})	1✔
183
184
185	@require_POST	1✔
186	@csrf_exempt	1✔
187	def get_involved(request):
188	data = request.POST.dict()	1✔
189	if 'email' not in data:	1✔
190	return HttpResponseJSON({	1✔
191	'status': 'error',
192	'desc': 'email is required',
193	'code': errors.BASKET_USAGE_ERROR,
194	}, 401)
195	if email_is_blocked(data['email']):	1✔
196	# don't let on there's a problem
197	return HttpResponseJSON({'status': 'ok'})	1✔
198	if 'interest_id' not in data:	1✔
199	return HttpResponseJSON({	1✔
200	'status': 'error',
201	'desc': 'interest_id is required',
202	'code': errors.BASKET_USAGE_ERROR,
203	}, 401)
204
205	try:	1✔
206	Interest.objects.get(interest_id=data['interest_id'])	1✔
207	except Interest.DoesNotExist:	1✔
208	return HttpResponseJSON({	1✔
209	'status': 'error',
210	'desc': 'invalid interest_id',
211	'code': errors.BASKET_USAGE_ERROR,
212	}, 401)
213
214	if 'lang' not in data:	1✔
215	return HttpResponseJSON({	1✔
216	'status': 'error',
217	'desc': 'lang is required',
218	'code': errors.BASKET_USAGE_ERROR,
219	}, 401)
220	if not language_code_is_valid(data['lang']):	1✔
221	return HttpResponseJSON({	1✔
222	'status': 'error',
223	'desc': 'invalid language',
224	'code': errors.BASKET_INVALID_LANGUAGE,
225	}, 400)
226	if 'name' not in data:	1✔
227	return HttpResponseJSON({	1✔
228	'status': 'error',
229	'desc': 'name is required',
230	'code': errors.BASKET_USAGE_ERROR,
231	}, 401)
232	if 'country' not in data:	1✔
233	return HttpResponseJSON({	1✔
234	'status': 'error',
235	'desc': 'country is required',
236	'code': errors.BASKET_USAGE_ERROR,
237	}, 401)
238
239	try:	1✔
240	validate_email(data.get('email'))	1✔
241	except EmailValidationError as e:	1✔
242	return invalid_email_response(e)	1✔
243
244	update_get_involved.delay(	1✔
245	data['interest_id'],
246	data['lang'],
247	data['name'],
248	data['email'],
249	data['country'],
250	data.get('format', 'H'),
251	data.get('subscribe', False),
252	data.get('message', None),
253	data.get('source_url', None),
254	)
255	return HttpResponseJSON({'status': 'ok'})	1✔
256
257
258	@require_POST	1✔
259	@csrf_exempt	1✔
260	def subscribe(request):
261	data = request.POST.dict()	1✔
262	newsletters = data.get('newsletters', None)	1✔
263	if not newsletters:	1✔
264	# request.body causes tests to raise exceptions
265	# while request.read() works.
266	raw_request = request.read()	1✔
267	if 'newsletters=' in raw_request:	1✔
268	# malformed request from FxOS
269	# Can't use QueryDict since the string is not url-encoded.
270	# It will convert '+' to ' ' for example.
271	data = dict(pair.split('=') for pair in raw_request.split('&'))	1✔
272	email = data.get('email')	1✔
273	if email:	1✔
274	data['email'] = force_unicode(email)	1✔
275	statsd.incr('subscribe-fxos-workaround')	1✔
276	else:
277	return HttpResponseJSON({	1✔
278	'status': 'error',
279	'desc': 'newsletters is missing',
280	'code': errors.BASKET_USAGE_ERROR,
281	}, 400)
282
283	if 'email' not in data:	1✔
284	return HttpResponseJSON({	1✔
285	'status': 'error',
286	'desc': 'email is required',
287	'code': errors.BASKET_USAGE_ERROR,
288	}, 401)
289
290	if email_is_blocked(data['email']):	1✔
291	# don't let on there's a problem
292	return HttpResponseJSON({'status': 'ok'})	1✔
293
294	optin = data.get('optin', 'N').upper() == 'Y'	1✔
295	sync = data.get('sync', 'N').upper() == 'Y'	1✔
296
297	if optin and (not request.is_secure() or not has_valid_api_key(request)):	1✔
298	# for backward compat we just ignore the optin if
299	# no valid API key is sent.
300	optin = False	1✔
301
302	if sync:	1✔
303	if not request.is_secure():	1✔
304	return HttpResponseJSON({	1✔
305	'status': 'error',
306	'desc': 'subscribe with sync=Y requires SSL',
307	'code': errors.BASKET_SSL_REQUIRED,
308	}, 401)
309	if not has_valid_api_key(request):	1✔
310	return HttpResponseJSON({	1✔
311	'status': 'error',
312	'desc': 'Using subscribe with sync=Y, you need to pass a '
313	'valid `api-key` GET or POST parameter or X-api-key header',
314	'code': errors.BASKET_AUTH_ERROR,
315	}, 401)
316
317	try:	1✔
318	validate_email(data.get('email'))	1✔
319	except EmailValidationError as e:	1✔
320	return invalid_email_response(e)	1✔
321
322	return update_user_task(request, SUBSCRIBE, data=data, optin=optin, sync=sync)	1✔
323
324
325	def invalid_email_response(e):	1✔
326	resp_data = {	1✔
327	'status': 'error',
328	'code': errors.BASKET_INVALID_EMAIL,
329	'desc': e.messages[0],
330	}
331	if e.suggestion:	1✔
332	resp_data['suggestion'] = e.suggestion	1✔
333	return HttpResponseJSON(resp_data, 400)	1✔
334
335
336	@require_POST	1✔
337	@csrf_exempt	1✔
338	def subscribe_sms(request):
339	if 'mobile_number' not in request.POST:	1✔
340	return HttpResponseJSON({	1✔
341	'status': 'error',
342	'desc': 'mobile_number is missing',
343	'code': errors.BASKET_USAGE_ERROR,
344	}, 400)
345
346	messages = get_sms_messages()	1✔
347	msg_name = request.POST.get('msg_name', 'SMS_Android')	1✔
348	if msg_name not in messages:	1✔
349	return HttpResponseJSON({	1✔
350	'status': 'error',
351	'desc': 'Invalid msg_name',
352	'code': errors.BASKET_USAGE_ERROR,
353	}, 400)
354
355	mobile = request.POST['mobile_number']	1✔
356	mobile = re.sub(r'\D+', '', mobile)	1✔
357	if len(mobile) == 10:	1✔
358	mobile = '1' + mobile	1✔
359	elif len(mobile) != 11 or mobile[0] != '1':	1✔
360	return HttpResponseJSON({	1✔
361	'status': 'error',
362	'desc': 'mobile_number must be a US number',
363	'code': errors.BASKET_USAGE_ERROR,
364	}, 400)
365
366	# only rate limit numbers here so we don't rate limit errors.
367	if is_ratelimited(request, group='news.views.subscribe_sms',	1✔
368	key=lambda x, y: '%s-%s' % (msg_name, mobile),
369	rate=PHONE_NUMBER_RATE_LIMIT, increment=True):
370	raise Ratelimited()	1✔
371
372	optin = request.POST.get('optin', 'N') == 'Y'	1✔
373
374	add_sms_user.delay(msg_name, mobile, optin)	1✔
375	return HttpResponseJSON({'status': 'ok'})	1✔
376
377
378	@require_POST	1✔
379	@logged_in	1✔
380	@csrf_exempt	1✔
381	def unsubscribe(request, token):
382	data = request.POST.dict()	×
383
384	if data.get('optout', 'N') == 'Y':	×
385	data['newsletters'] = ','.join(newsletter_slugs())	×
386
387	return update_user_task(request, UNSUBSCRIBE, data)	×
388
389
390	@logged_in	1✔
391	@csrf_exempt	1✔
392	@never_cache	1✔
393	def user(request, token):
394	if request.method == 'POST':	1✔
395	return update_user_task(request, SET)	1✔
396
397	if request.subscriber_data:	1✔
398	return HttpResponseJSON(request.subscriber_data)	1✔
399
400	return get_user(request.subscriber.token)	1✔
401
402
403	@require_POST	1✔
404	@csrf_exempt	1✔
405	def send_recovery_message(request):
406	"""
407	Send a recovery message to an email address.
408
409	required form parameter: email
410
411	If email not provided or not syntactically correct, returns 400.
412	If email not known, returns 404.
413	Otherwise, queues a task to send the message and returns 200.
414	"""
415	try:	1✔
416	validate_email(request.POST.get('email'))	1✔
417	except EmailValidationError as e:	1✔
418	return invalid_email_response(e)	1✔
419
420	email = request.POST.get('email')	1✔
421	if email_is_blocked(email):	1✔
422	# don't let on there's a problem
423	return HttpResponseJSON({'status': 'ok'})	1✔
424
425	try:	1✔
426	user_data = get_user_data(email=email, sync_data=True)	1✔
427	except NewsletterException as e:	×
428	return newsletter_exception_response(e)	×
429
430	if not user_data:	1✔
431	return HttpResponseJSON({	1✔
432	'status': 'error',
433	'desc': 'Email address not known',
434	'code': errors.BASKET_UNKNOWN_EMAIL,
435	}, 404) # Note: Bedrock looks for this 404
436
437	send_recovery_message_task.delay(email)	1✔
438	return HttpResponseJSON({'status': 'ok'})	1✔
439
440
441	@never_cache	1✔
442	def debug_user(request):
443	if 'email' not in request.GET or 'supertoken' not in request.GET:	1✔
444	return HttpResponseJSON({	×
445	'status': 'error',
446	'desc': 'Using debug_user, you need to pass the '
447	'`email` and `supertoken` GET parameters',
448	'code': errors.BASKET_USAGE_ERROR,
449	}, 400)
450
451	if request.GET['supertoken'] != settings.SUPERTOKEN:	1✔
452	return HttpResponseJSON({'status': 'error',	×
453	'desc': 'Bad supertoken',
454	'code': errors.BASKET_AUTH_ERROR},
455	401)
456
457	email = request.GET['email']	1✔
458	try:	1✔
459	user_data = get_user_data(email=email)	1✔
460	except NewsletterException as e:	×
461	return newsletter_exception_response(e)	×
462
463	try:	1✔
464	user = Subscriber.objects.get(email=email)	1✔
465	user_data['in_basket'] = True	1✔
466	user_data['basket_token'] = user.token	1✔
467	except Subscriber.DoesNotExist:	1✔
468	user_data['in_basket'] = False	1✔
469	user_data['basket_token'] = ''	1✔
470
471	return HttpResponseJSON(user_data, 200)	1✔
472
473
474	# Custom update methods
475
476	@csrf_exempt	1✔
477	def custom_unsub_reason(request):
478	"""Update the reason field for the user, which logs why the user
479	unsubscribed from all newsletters."""
480
481	if 'token' not in request.POST or 'reason' not in request.POST:	×
482	return HttpResponseJSON({	×
483	'status': 'error',
484	'desc': 'custom_unsub_reason requires the `token` '
485	'and `reason` POST parameters',
486	'code': errors.BASKET_USAGE_ERROR,
487	}, 400)
488
489	update_custom_unsub.delay(request.POST['token'], request.POST['reason'])	×
490	return HttpResponseJSON({'status': 'ok'})	×
491
492
493	@require_POST	1✔
494	@logged_in	1✔
495	@csrf_exempt	1✔
496	def custom_update_student_ambassadors(request, token):
497	sub = request.subscriber	1✔
498	update_student_ambassadors.delay(request.POST.dict(), sub.email,	1✔
499	sub.token)
500	return HttpResponseJSON({'status': 'ok'})	1✔
501
502
503	@require_POST	1✔
504	@logged_in	1✔
505	@csrf_exempt	1✔
506	def custom_update_phonebook(request, token):
507	sub = request.subscriber	1✔
508	update_phonebook.delay(request.POST.dict(), sub.email, sub.token)	1✔
509	return HttpResponseJSON({'status': 'ok'})	1✔
510
511
512	# Get data about current newsletters
513	@require_GET	1✔
514	@cache_control(max_age=300)	1✔
515	def newsletters(request):
516	# Get the newsletters as a dictionary of dictionaries that are
517	# easily jsonified
518
519	result = {}	1✔
520	for newsletter in Newsletter.objects.all().values():	1✔
521	newsletter['languages'] = newsletter['languages'].split(",")	1✔
522	result[newsletter['slug']] = newsletter	1✔
523	del newsletter['id'] # caller doesn't need to know our pkey	1✔
524	del newsletter['slug'] # or our slug	1✔
525
526	return HttpResponseJSON({	1✔
527	'status': 'ok',
528	'newsletters': result,
529	})
530
531
532	@never_cache	1✔
533	def lookup_user(request):
534	"""Lookup a user in Exact Target given email or token (not both).
535
536	To look up by email, a valid API key are required.
537
538	If email and token are both provided, an error is returned rather
539	than trying to define all the possible behaviors.
540
541	SSL is always required when using this call. If no SSL, it'll fail
542	with 401 and an appropriate message in the response body.
543
544	Response content is always JSON.
545
546	If user is not found, returns a 404 status and json is::
547
548	{
549	'status': 'error',
550	'desc': 'No such user'
551	}
552
553	(If you need to distinguish user not found from an error calling
554	the API, check the response content.)
555
556	If a required, valid API key is not provided, status is 401 Unauthorized.
557	The API key can be provided either as a GET query parameter ``api-key``
558	or a request header ``X-api-key``. If it's provided as a query parameter,
559	any request header is ignored.
560
561	For other errors, similarly
562	response status is 4xx and the json 'desc' says what's wrong.
563
564	Otherwise, status is 200 and json is the return value from
565	`get_user_data`. See that method for details.
566
567	Note that because this method always calls Exact Target one or
568	more times, it can be slower than some other Basket APIs, and will
569	fail if ET is down.
570	"""
571
572	if not request.is_secure():	1✔
573	return HttpResponseJSON({	1✔
574	'status': 'error',
575	'desc': 'lookup_user always requires SSL',
576	'code': errors.BASKET_SSL_REQUIRED,
577	}, 401)
578
579	token = request.GET.get('token', None)	1✔
580	email = request.GET.get('email', None)	1✔
581
582	if (not email and not token) or (email and token):	1✔
583	return HttpResponseJSON({	1✔
584	'status': 'error',
585	'desc': MSG_EMAIL_OR_TOKEN_REQUIRED,
586	'code': errors.BASKET_USAGE_ERROR,
587	}, 400)
588
589	if email and not has_valid_api_key(request):	1✔
590	return HttpResponseJSON({	1✔
591	'status': 'error',
592	'desc': 'Using lookup_user with `email`, you need to pass a '
593	'valid `api-key` GET parameter or X-api-key header',
594	'code': errors.BASKET_AUTH_ERROR,
595	}, 401)
596
597	try:	1✔
598	user_data = get_user_data(token=token, email=email)	1✔
599	except NewsletterException as e:	×
600	return newsletter_exception_response(e)	×
601
602	status_code = 200	1✔
603	if not user_data:	1✔
604	code = errors.BASKET_UNKNOWN_TOKEN if token else errors.BASKET_UNKNOWN_EMAIL	1✔
605	user_data = {	1✔
606	'status': 'error',
607	'desc': MSG_USER_NOT_FOUND,
608	'code': code,
609	}
610	status_code = 404	1✔
611
612	return HttpResponseJSON(user_data, status_code)	1✔
613
614
615	@require_GET	1✔
616	@cache_control(max_age=300)	1✔
617	def list_newsletters(request):
618	"""
619	Public web page listing currently active newsletters.
620	"""
621	active_newsletters = Newsletter.objects.filter(active=True, private=False)	×
622	return render(request, 'news/newsletters.html',	×
623	{'newsletters': active_newsletters})

mozilla / basket / 357

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous