Account Management

---

**Dokku:** https://accountmanagement.dokku.hypothes.is

- [x] No tests for accountManagement directive
- [x] No tests for backend changes _(Added 2014-08-06)_
- [x] accountManagement directive needs to be moved to a controller
- [x] ~~Password updating doesn't seem to work~~ _(Fixed 2014-08-06)_
- [x] Account sheet needs to close on logout.
- [x] Nothing happens after a user account is disabled other than a success message.
- [x] Remove email update form (pending emails)
- [ ] Disable_user endpoint needs to return a 401 when the password is invalid
- [x] Clear out password fields on successful submission
- [ ] Use appropriate http error codes in update_profile responses.
- [ ] Return `"errors"` keys in error responses.

---

I'm taking the opportunity here to open this pull request for the account management branch so that both the code and the interface can be reviewed.

It's okay for this branch to still be considered a work in progress, and this PR will remain open as a place for discussion until it it's ready to be merged.

So this branch adds three new panels to the sidebar.

Settings:

![settings](https://cloud.githubusercontent.com/assets/47144/3386301/0f5f4056-fc73-11e3-87df-e6495c1e147b.png)

Profile:

![profile](https://cloud.githubusercontent.com/assets/47144/3386302/0f631910-fc73-11e3-9eac-a26a48f640ad.png)

Account:

![account](https://cloud.githubusercontent.com/assets/47144/3386300/0f5d2aa0-fc73-11e3-8d29-dae3f5a7f523.png)

@RawKStar77 if you've any thing to add, please do :)
Aron_: Just made a commit which gives back 401 for invalid password, and
also the error field is populated:
https://github.com/hypothesis/h/commit/acee2435358492d241bcb5ed469f8c2134af0b99

Will fix the redirects for now and we can make a refactoring issue in
the future.


On 08/07/2014 11:17 AM, Aron Carroll wrote:
>
> In h/auth/local/views.py:
>
> > +        pwd = appstruct['pwd']
> > +
> > +        # Password check
> > +        user = self.User.get_user(request, username, pwd)
> > +        if user:
> > +            user.activation_id = -1
> > +            self.db.add(user)
> > +            FlashMessage(self.request,
> > +                 _('User disabled'),
> > +                 kind='success')
> > +        else:
> > +            FlashMessage(self.request,
> > +                _('Invalid password.'),
> > +                kind='error')
> > +
> > +        return httpexceptions.HTTPFound(location=request.url)
>
> Okay, @gergely-ujvari <https://github.com/gergely-ujvari> if this is
> going to be some work, can we get these endpoints to return the
> correct status codes, and then worry about the error messages in a
> later iteration?
>
> The error messages kind of work as they stand at the moment as they
> appear in the flash banner, but the redirect is just wrong.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/hypothesis/h/pull/1275/files#r15925461>.
>