kobotoolbox / kpi / 37778043158

86%

master: 76%

Build Type

push

github

Committed by web-flow

Commit Message

feat(auth): allow switching accounts via headless login DEV-3065 (#7682)

### 📣 Summary
Logging in through the headless API while already signed in now switches
to the new account, instead of being rejected. A failed attempt keeps
the current user signed in.

### 📖 Description
allauth's headless `auth/login` answers `409` whenever a session already
exists. The SPA would have had to log out first, which signs the user
out even when the new credentials turn out to be wrong. The templated
`/accounts/login/` page already lets you switch accounts, and product
asked to keep that behaviour.

`HeadlessLoginView` replaces allauth's login endpoint for each
configured headless client (`browser` and `app`). allauth checks the
credentials before `post()` runs, so:

| Already signed in, then… | Response | Current session |
|---|---|---|
| valid credentials for another user | 200, new user | logged out |
| wrong password | 400 | kept |
| own credentials again | 200 | kept |
| valid credentials for a user with 2FA | 401, pending
`mfa_authenticate` | logged out |

### 💭 Notes
- The view subclasses allauth's `LoginView` and only overrides `post()`.
Input validation, rate limiting, login stages and the response format
still come from allauth. It's mounted ahead of `allauth.headless.urls`,
the same way `MfaLoginView` is mounted for `/accounts/login/`.
- The session is dropped before the login runs because allauth's MFA and
email-verification stages refuse authenticated requests. As on the
templated page, if the user abandons the 2FA step after a valid
password, they end up signed out.
- The OpenAPI schema is taken from allauth's spec, so it still lists 409
for `auth/login`.
- Frontend: no logout call is needed before login. Refetch `/me` after a
200.

Coverage Stats

10501 of 13862 branches covered (75.75%)

8 of 14 new or added lines in 2 files covered. (57.14%)

6533 existing lines in 175 files now uncovered.

33485 of 40277 relevant lines covered (83.14%)

5.49 hits per line