Merge branch 'issue-41-email-verification' into 'main'

email verification

Closes #41

See merge request yaal/canaille!147

canaille/__init__.py

@@ -120,6 +120,8 @@ def global_processor():
             "user": current_user(),
             "menu": True,
             "is_boosted": request.headers.get("HX-Boosted", False),
+            "has_email_confirmation": app.config.get("EMAIL_CONFIRMATION") is True
+            or (app.config.get("EMAIL_CONFIRMATION") is None and "SMTP" in app.config),
         }
 
     @app.errorhandler(400)

canaille/app/__init__.py

@@ -15,7 +15,7 @@ def b64_to_obj(string):
     return json.loads(base64.b64decode(string.encode("utf-8")).decode("utf-8"))
 
 
-def profile_hash(*args):
+def build_hash(*args):
     return hashlib.sha256(
         current_app.config["SECRET_KEY"].encode("utf-8")
         + obj_to_b64(args).encode("utf-8")

canaille/config.sample.toml

@@ -38,6 +38,13 @@ SECRET_KEY = "change me before you go in production"
 # Accelerates webpages with async requests
 # HTMX = true
 
+# If EMAIL_CONFIRMATION is set to true, users will need to click on a
+# confirmation link sent by email when they want to add a new email.
+# By default, this is true if SMTP is configured, else this is false.
+# If explicitely set to true and SMTP is disabled, the email field
+# will be read-only.
+# EMAIL_CONFIRMATION =
+
 # If HIDE_INVALID_LOGINS is set to true (the default), when a user
 # tries to sign in with an invalid login, a message is shown indicating
 # that the password is wrong, but does not give a clue wether the login