Repository: cdriehuys/django-simple-email-auth

Issue:
Authentication fails for invalid email/password combo
Attempting to authenticate with an invalid email/password combo causes a server error.

Discussion:

Patch:
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 36b195d..02e278d 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -2,6 +2,16 @@
 Changelog
 #########
 
+******
+v0.3.1
+******
+
+Bug Fixes
+=========
+
+* :issue:`30`: Fix error when attempting to authenticate an invalid
+  email/password combination.
+
 ******
 v0.3.0
 ******
diff --git a/email_auth/authentication.py b/email_auth/authentication.py
index f226ea0..6207354 100644
--- a/email_auth/authentication.py
+++ b/email_auth/authentication.py
@@ -38,7 +38,7 @@ class VerifiedEmailBackend:
         except models.EmailAddress.DoesNotExist:
             # Do a password comparison anyway to mitigate timing
             # attacks.
-            dummy_user = get_user_model()
+            dummy_user = get_user_model()()
             dummy_user.set_password("jekyll")
             dummy_user.check_password("hyde")
 


Test patch:
diff --git a/email_auth/test/authentication/test_verified_email_backend.py b/email_auth/test/authentication/test_verified_email_backend.py
index f97cc48..bea1f08 100644
--- a/email_auth/test/authentication/test_verified_email_backend.py
+++ b/email_auth/test/authentication/test_verified_email_backend.py
@@ -46,8 +46,10 @@ def test_authenticate_with_verified_email_correct_password(
     assert mock_email_address_qs.get.call_args[1]["address"] == email.address
 
 
-@mock.patch("email_auth.authentication.get_user_model")
-def test_authenticate_with_missing_email(mock_get_user, mock_email_address_qs):
+@mock.patch("django.contrib.auth.models.User.check_password", autospec=True)
+def test_authenticate_with_missing_email(
+    mock_check_password, mock_email_address_qs
+):
     """
     If no verified email with the given address exists, authentication
     should fail.
@@ -63,7 +65,7 @@ def test_authenticate_with_missing_email(mock_get_user, mock_email_address_qs):
     assert mock_email_address_qs.get.call_args[1]["is_verified"]
 
     # There should still be a password check even if no user is found.
-    assert mock_get_user.return_value.check_password.call_count == 1
+    assert mock_check_password.call_count == 1
 
 
 def test_authenticate_with_verified_email_incorrect_password(