Attempting more clean up

flask_security/confirmable.py

@@ -60,8 +60,7 @@ def should_confirm_email(fn):
 
 @should_confirm_email
 def requires_confirmation(user):
-    return not security.login_without_confirmation and \
-           not confirmation_token_is_expired(user)
+    return user.confirmed_at == None
 
 
 @should_confirm_email

flask_security/core.py

@@ -27,28 +27,28 @@ from werkzeug.datastructures import ImmutableList
 
 #: Default Flask-Security configuration
 _default_config = {
-    'SECURITY_URL_PREFIX': None,
-    'SECURITY_FLASH_MESSAGES': True,
-    'SECURITY_PASSWORD_HASH': 'plaintext',
-    'SECURITY_AUTH_PROVIDER': 'flask.ext.security::AuthenticationProvider',
-    'SECURITY_LOGIN_FORM': 'flask.ext.security::LoginForm',
-    'SECURITY_REGISTER_FORM': 'flask.ext.security::RegisterForm',
-    'SECURITY_AUTH_URL': '/auth',
-    'SECURITY_LOGOUT_URL': '/logout',
-    'SECURITY_REGISTER_URL': '/register',
-    'SECURITY_RESET_URL': '/reset',
-    'SECURITY_CONFIRM_URL': '/confirm',
-    'SECURITY_LOGIN_VIEW': '/login',
-    'SECURITY_POST_LOGIN_VIEW': '/',
-    'SECURITY_POST_LOGOUT_VIEW': '/',
-    'SECURITY_POST_REGISTER_VIEW': None,
-    'SECURITY_POST_CONFIRM_VIEW': None,
-    'SECURITY_RESET_PASSWORD_WITHIN': 10,
-    'SECURITY_DEFAULT_ROLES': [],
-    'SECURITY_LOGIN_WITHOUT_CONFIRMATION': True,
-    'SECURITY_CONFIRM_EMAIL': False,
-    'SECURITY_CONFIRM_EMAIL_WITHIN': '5 days',
-    'SECURITY_EMAIL_SENDER': 'no-reply@localhost'
+    'URL_PREFIX': None,
+    'FLASH_MESSAGES': True,
+    'PASSWORD_HASH': 'plaintext',
+    'AUTH_PROVIDER': 'flask.ext.security::AuthenticationProvider',
+    'LOGIN_FORM': 'flask.ext.security::LoginForm',
+    'REGISTER_FORM': 'flask.ext.security::RegisterForm',
+    'AUTH_URL': '/auth',
+    'LOGOUT_URL': '/logout',
+    'REGISTER_URL': '/register',
+    'RESET_URL': '/reset',
+    'CONFIRM_URL': '/confirm',
+    'LOGIN_VIEW': '/login',
+    'POST_LOGIN_VIEW': '/',
+    'POST_LOGOUT_VIEW': '/',
+    'POST_REGISTER_VIEW': None,
+    'POST_CONFIRM_VIEW': None,
+    'RESET_PASSWORD_WITHIN': 10,
+    'DEFAULT_ROLES': [],
+    'LOGIN_WITHOUT_CONFIRMATION': False,
+    'CONFIRM_EMAIL': False,
+    'CONFIRM_EMAIL_WITHIN': '5 days',
+    'EMAIL_SENDER': 'no-reply@localhost'
 }
 
 
@@ -209,7 +209,7 @@ class Security(object):
             return
 
         for key, value in _default_config.items():
-            app.config.setdefault(key, value)
+            app.config.setdefault('SECURITY_' + key, value)
 
         login_manager = LoginManager()
         login_manager.anonymous_user = AnonymousUser

flask_security/views.py

@@ -12,9 +12,9 @@
 from flask import current_app, redirect, request, session
 from flask.ext.login import login_user, logout_user
 from flask.ext.principal import Identity, AnonymousIdentity, identity_changed
-from flask.ext.security.confirmable import confirmation_token_is_expired, \
-     send_confirmation_instructions, generate_confirmation_token, \
-     reset_confirmation_token, requires_confirmation, confirm_by_token
+from flask.ext.security.confirmable import confirm_by_token, \
+     confirmation_token_is_expired, requires_confirmation, \
+     reset_confirmation_token, send_confirmation_instructions
 from flask.ext.security.exceptions import ConfirmationExpiredError, \
      ConfirmationError, BadCredentialsError
 from flask.ext.security.utils import get_post_login_redirect, do_flash
@@ -50,6 +50,7 @@ def authenticate():
     try:
         user = security.auth_provider.authenticate(form)
 
+        # Conveniently reset the token if necessary and expired
         if confirmation_token_is_expired(user):
             reset_confirmation_token(user)
 

tests/functional_tests.py

@@ -115,7 +115,8 @@ class DefaultSecurityTests(SecurityTest):
 
     def test_register_valid_user(self):
         data = dict(email='dude@lp.com', password='password', password_confirm='password')
-        self.client.post('/register', data=data, follow_redirects=True)
+        r = self.client.post('/register', data=data, follow_redirects=True)
+        self.assertNotIn('Hello dude@lp.com', r.data)
         r = self.authenticate('dude@lp.com', 'password')
         self.assertIn('Hello dude@lp.com', r.data)
 
@@ -147,7 +148,6 @@ class ConfiguredURLTests(SecurityTest):
     def test_register(self):
         data = dict(email='dude@lp.com', password='password', password_confirm='password')
         r = self.client.post('/register', data=data, follow_redirects=True)
-        self.assertIn('Hello dude@lp.com', r.data)
         self.assertIn('Post Register', r.data)
 
 
@@ -174,8 +174,6 @@ class ConfirmationTests(SecurityTest):
             self.register(e)
             token = users[0].confirmation_token
 
-        r = self.authenticate('dude@lp.com', 'password')
-        self.assertIn('Account requires confirmation', r.data)
         r = self.client.get('/confirm?confirmation_token=' + token, follow_redirects=True)
         self.assertIn('Your email has been confirmed. You may now log in.', r.data)