Repository: akvo/akvo-rsr

Issue:
Remove 'end date' check for user invitations
Currently, when a user gets an invite we check whether the invite was sent within the last week. However, there have been multiple occasions in which the user clicks the activation link after one week and then it's not easily possible to re-send an invitation.

As a simple solution, we will remove the check on the date so that users can accept the invitation at any time.



Discussion:

Resolving patch:
diff --git a/akvo/rest/views/user_management.py b/akvo/rest/views/user_management.py
--- a/akvo/rest/views/user_management.py
+++ b/akvo/rest/views/user_management.py
@@ -123,7 +123,6 @@ def valid_email(email_address):
         employment.group = group
         employment.save()
 
-        expiration_days = getattr(settings, 'ACCOUNT_ACTIVATION_DAYS', 7)
         token_value = TimestampSigner().sign(email)
         token = token_value.split(':')[2]
         token_date = token_value.split(':')[1]
@@ -139,7 +138,6 @@ def valid_email(email_address):
                 'employment': employment,
                 'token': token,
                 'token_date': token_date,
-                'expiration_days': expiration_days
             }
         )
 
diff --git a/akvo/rsr/views/account.py b/akvo/rsr/views/account.py
--- a/akvo/rsr/views/account.py
+++ b/akvo/rsr/views/account.py
@@ -21,7 +21,7 @@
 from django.contrib.auth import login, logout, authenticate, get_user_model
 from django.contrib.auth.forms import AuthenticationForm, PasswordResetForm
 from django.core.exceptions import ObjectDoesNotExist
-from django.core.signing import TimestampSigner, BadSignature, SignatureExpired
+from django.core.signing import TimestampSigner, BadSignature
 from django.http import (HttpResponse, HttpResponseRedirect,
                          HttpResponseForbidden)
 from django.shortcuts import redirect, render, render_to_response
@@ -85,9 +85,6 @@ def activate(request, activation_key, extra_context=None):
         context[key] = callable(value) and value() or value
     return render_to_response(
         'registration/activate.html',
-        {
-            'expiration_days': getattr(settings, 'ACCOUNT_ACTIVATION_DAYS', 7)
-        },
         context_instance=context
     )
 
@@ -142,7 +139,7 @@ def login_and_redirect(req, invited):
         login(request, invited)
         return redirect('my_details')
 
-    bad_link, signature_expired, user, inviting_user, employment = False, False, None, None, None
+    bad_link, user, inviting_user, employment = False, None, None, None
 
     try:
         user = get_user_model().objects.get(pk=user_pk)
@@ -151,13 +148,8 @@ def login_and_redirect(req, invited):
     except ObjectDoesNotExist:
         bad_link = True
 
-    expiration_days = getattr(settings, 'ACCOUNT_ACTIVATION_DAYS', 7)
-
     try:
-        TimestampSigner().unsign(':'.join([user.email, token_date, token]),
-                                 max_age=expiration_days * 24 * 60 * 60)
-    except SignatureExpired:
-        signature_expired = True
+        TimestampSigner().unsign(':'.join([user.email, token_date, token]))
     except BadSignature:
         bad_link = True
 
@@ -165,7 +157,7 @@ def login_and_redirect(req, invited):
         if employment and employment.is_approved:
             # User is active and employment is approved, so nothing to do here
             return login_and_redirect(request, user)
-        elif employment and not (signature_expired or bad_link):
+        elif employment and not bad_link:
             # Employment is not yet approved, and link is ok.
             # Approve employment and log user in.
             approve_employment(inviting_user, user, employment)
@@ -183,9 +175,7 @@ def login_and_redirect(req, invited):
 
     context = {
         'form': form,
-        'expiration_days': expiration_days,
         'bad_link': bad_link,
-        'signature_expired': signature_expired
     }
     return render(request, 'registration/invite_activate.html', context)
 


Test patch: