Package: mezzanine-invites
AMezzanineapplication that allows site registration via alphanumeric
invite codes. It is designed to enable a quick sign up process for invited
potential site users.Development -https://github.com/averagehuman/mezzanine-invitesRequirementsHas been tested withDjango 1.7and the latestMezzanine 3.1.*
development branch (master)using bothPython 2.7andPython 3.3.Mezzanine versions3.1.10and earlier may also work if you can ignore or
workaroundIssue 1114.UsageA site admin creates an Invite Code linked with at least the invitee’s email
address and possibly also their full name and phone number. This code’s key (a
short alphanumeric token) is sent to the invitee and, if they choose to use
it, the first login with the code will create a new site user.An Invite Code must be used to register within the number of days given by
theINVITE_CODE_USAGE_WINDOWsetting (default 14 days), and once
registered, the code is valid for the number of days given byINVITE_CODE_EXPIRY_DAYS(default 30 days).The code is always of the form:<Three or more uppercase letters><three digits>For example,ABCXYZ123. The default code length is 9 but this is
configurable via theINVITE_CODE_LENGTHsetting.Thesend_inviteviewIncludeinvites.urlsin yourURL_CONFto get a staff-only view calledsend-invitewhich will display a form with email, name and phone fields.
ClickSend Inviteto send an email with the unique code to the recipient.Theinvitemanagement commandCreate a code with the Django management commandinvite:./bin/django invitewhich will prompt for an email address for the invitee.You can also specify the email as a paramter:./bin/django invite --email=joe.soap@lux.comInvitation Codes are associated with a givenSite, so if there are multiple
sites,then you need to specify which by domain name:./bin/django invite --domain=example.comOnce created you will be asked if you want to send the invitation right away.
If you decline then the code will simply be printed out.Email BackendTo send emails, an appropriate email backend must be configured. See theDjango email docsfor more information.SettingsTheINVITE_CODE_LENGTHsetting determines the length of the invite code.
It ought to be an integer greater than or equal to 6 and less than or equal
to 30.TheINVITE_CODE_USAGE_WINDOWsetting determines how many days before an
Invite Token must be used.Once used to register with a site theINVITE_CODE_EXPIRY_DAYSsetting
determines how many days before the Invite Token becomes invalid as a login
token.In order for the invite code to be acceptable as a login token, add theInviteAuthBackendto the list ofAUTHENTICATION_BACKENDSin settings:AUTHENTICATION_BACKENDS = (
    "mezzanine.core.auth_backends.MezzanineBackend",
    "invites.auth.InviteAuthBackend",
)You can in fact just haveInviteAuthBackendas the sole backend since it
is a subclass of theMezzanineBackendand will fall back to the latter’s
authentication:AUTHENTICATION_BACKENDS = (
    "invites.auth.InviteAuthBackend",
)The difference between the two setups is that ifMezzanineBackendis
picking up the standard username/password login then it won’t authenticate thefirstuse of an Invite Code or, obviously, create the newly-registered user,
whereasInviteAuthBackendwill do both of those things.Note, however, that if you havemezzanine.accountsin yourINSTALLED_APPSsetting, thenMezzanineBackendwill be added to the
list of backends anyway by theset_dynamic_settingscall in your settings
module.TemplatesThe following templates are required.invites/send_invite.htmlinvites/send_invite_email.txtinvites/send_invite_email.htmlThere are further templates to handle the default login scenario - a login
page that has two forms, one a standardusername/password/captchaform,
and the other aquick loginform requiring only the invite code.accounts/account_form.htmlaccounts/account_login.htmlDemoTo create a demo project with a sqlite backend run:$ make demoThen create an invite code with an associated (not necessary valid) email:$ make invite email=luke@force.comCopy the six character Invite Code that is printed out.Next run a test server with:$ make serveand navigate to the login page. You should see two login forms - a standard
username/password/captcha form and another “Quick” form requiring only an
Invite Code.You should be able to login with either form.CautionThis is an inherently less secure means of authentication compared to
the regular username/password flow. The Invite Code Token gives immediate
site access and yet:may have been sent in a plain text emailexists in the database in plain text formdoes not require knowledge of the associated usernamemay not be very strong cryptographicallyThis inherent risk is mitigated by theINVITE_CODE_EXPIRY_DAYSsetting.
In strict environments, both theINVITE_CODE_EXPIRY_DAYSandINVITE_CODE_USAGE_WINDOWsettings should be low numbers. Once expired, a
user will still be registered and active but will not be able to login until
they have set up their own password by the standard means, eg. via aForgotten Passwordform.SettingINVITE_CODE_EXPIRY_DAYSto0will cause Invite Codes to be
effectively “one-shot” tokens.To expire a code that becomes invalid while that code’s user is logged-in and
has an active session, a middleware component might be implemented to check
code expiry on each request and logout the user if necessary.Source and IssuesSource is ongithub.Testing with tox/pytestRun tests with:make testwhich is just an alias for:python setup.py test