kobotoolbox / kpi / 36737726384

83%

master: 76%

push

github

feat(accounts): expose `validated_password` on the session endpoint DEV-2948 (#7649)

### 📣 Summary
Adds `has_validated_password` to the allauth session endpoint so the
frontend can read the invalidated-password signal there instead of
`/me`.

### 📖 Description
An administrator can invalidate a user's password from the admin, which
locks them out of KPI until they reset it. The SPA shows a blocker for
this, and today it reads the flag from `/me`, which is why `/me` is
exempt from the permission
class that enforces it.

We settled that `/me` is a profile endpoint and the session endpoint
owns authentication state. This flag was the one thing still breaking
that rule.

This PR adds `data.user.has_validated_password` to `GET
/api/v2/allauth/browser/v1/auth/session`, via a `HeadlessAdapter` wired
up through allauth's documented `HEADLESS_ADAPTER` setting. Declaring it
on the
user dataclass (rather than overriding `serialize_user()`) is what
allauth's docs prescribe, and it means the field lands in the OpenAPI
schema and the generated orval types automatically.

Nothing about how the flag is set or enforced changes. `/me` keeps
returning `validated_password` for API back-compat.

### 💭 Notes
- The value comes from `ExtraUserDetail.validated_password`, which is
what KPI's permission class reads, so the flag can never disagree with
the 403s a user actually gets. The KoboCAT copy on `UserProfile` is
synced from it.
- It is a separate field from allauth's `has_usable_password`, which is
`false` for every SSO account and means something unrelated.

10446 of 13813 branches covered (75.62%)

9 of 21 new or added lines in 2 files covered. (42.86%)

33346 of 40147 relevant lines covered (83.06%)

4.92 hits per line