Bump version number to 1.7.1

Fix attempts to log in without a password, or without confirming your email

.gitignore

@@ -25,3 +25,11 @@ pip-log.txt
 
 #Mr Developer
 .mr.developer.cfg
+
+#Virtualenv
+env/
+
+#Editor temporaries
+*~
+
+*.db

.travis.yml

@@ -3,14 +3,13 @@ language: python
 python:
   - "2.6"
   - "2.7"
+  - "3.3"
+  - "pypy"
 
 install:
-  - pip install . --quiet --use-mirrors
+  - pip install . --quiet
-  - "if [[ $TRAVIS_PYTHON_VERSION != '2.7' ]]; then pip install importlib --quiet --use-mirrors; fi"
+  - "if [[ $TRAVIS_PYTHON_VERSION == '2.6' ]]; then pip install importlib --quiet --use-mirrors; fi"
-  - pip install nose simplejson Flask-SQLAlchemy Flask-MongoEngine Flask-Mail py-bcrypt MySQL-python --quiet --use-mirrors
+  - pip install nose simplejson Flask-SQLAlchemy Flask-MongoEngine Flask-Peewee bcrypt --quiet
-
-before_script:
-  - mysql -e 'create database flask_security_test;'
 
 services:
   - mongodb

AUTHORS

@@ -0,0 +1,38 @@
+Flask-Security is written and maintained by Matt Wright and
+various contributors:
+
+Development Lead
+````````````````
+
+- Matt Wright <matt+github@nobien.net>
+
+Patches and Suggestions
+```````````````````````
+
+Alexander Sukharev
+Alexey Poryadin
+Andrew J. Camenga
+Anthony Plunkett
+Artem Andreev
+Catherine Wise
+Chris Haines
+Christophe Simonis
+David Ignacio
+Eric Butler
+Eskil Heyn Olsen
+Iuri de Silvio
+Jay Goel
+Joe Esposito
+Joe Hand
+Josh Purvis
+Kostyantyn Leschenko
+Luca Invernizzi
+Manuel Ebert
+Martin Maillard
+Paweł Krześniak
+Robert Clark
+Rodrigue Cloutier
+Rotem Yaari
+Srijan Choudhary
+Tristan Escalada
+Vadim Kotov

CHANGES

@@ -3,6 +3,163 @@ Flask-Security Changelog
 
 Here you can see the full list of changes between each Flask-Security release.
 
+Version 1.7.1
+-------------
+
+Released January 14th 2014
+
+- Fixed a bug where passwords would fail to verify when specifying a password hash algorithm
+
+
+Version 1.7.0
+-------------
+
+Released January 10th 2014
+
+- Python 3.3 support!
+- Dependency updates
+- Fixed a bug when `SECURITY_LOGIN_WITHOUT_CONFIRMATION = True` did not allow users to log in
+- Added `SECURITY_SEND_PASSWORD_RESET_NOTICE_EMAIL` configuraiton option to optionally send password reset notice emails
+- Add documentation for `@security.send_mail_task`
+- Move to `request.get_json` as `request.json` is now deprecated in Flask
+- Fixed a bug when using AJAX to change a user's password
+- Added documentation for select functions in the `flask_security.utils` module
+- Fixed a bug in `flask_security.forms.NextFormMixin`
+- Added `CHANGE_PASSWORD_TEMPLATE` configuration option to optionally specify a different change password template
+- Added the ability to specify addtional fields on the user model to be used for identifying the user via the `USER_IDENTITY_ATTRIBUTES` configuration option
+- An error is now shown if a user tries to change their password and the password is the same as before. The message can be customed with the `SECURITY_MSG_PASSWORD_IS_SAME` configuration option
+- Fixed a bug in `MongoEngineUserDatastore` where user model would not be updated when using the `add_role_to_user` method
+- Added `SECURITY_SEND_PASSWORD_CHANGE_EMAIL` configuration option to optionally disable password change email from being sent
+- Fixed a bug in the `find_or_create_role` method of the PeeWee datastore
+- Removed pypy tests
+- Fixed some tests
+- Include CHANGES and LICENSE in MANIFEST.in
+- A bit of documentation cleanup
+- A bit of code cleanup including removal of unnecessary utcnow call and simplification of get_max_age method
+
+
+Version 1.6.9
+-------------
+
+Released August 20th 2013
+
+- Fix bug in SQLAlchemy datastore's `get_user` function
+- Fix bug in PeeWee datastore's `remove_role_from_user` function
+- Fixed import error caused by new Flask-WTF release
+
+
+Version 1.6.8
+-------------
+
+Released August 1st 2013
+
+- Fixed bug with case sensitivity of email address during login
+- Code cleanup regarding token_callback
+- Ignore validation errors in find_user function for MongoEngineUserDatastore
+
+
+Version 1.6.7
+-------------
+
+Released July 11th 2013
+
+- Made password length form error message configurable
+- Fixed email confirmation bug that prevented logged in users from confirming their email
+
+
+Version 1.6.6
+-------------
+
+Released June 28th 2013
+
+- Fixed dependency versions
+
+
+Version 1.6.5
+-------------
+
+Released June 20th 2013
+
+- Fixed bug in `flask.ext.security.confirmable.generate_confirmation_link`
+
+
+Version 1.6.4
+-------------
+
+Released June 18th 2013
+
+- Added `SECURITY_DEFAULT_REMEMBER_ME` configuration value to unify behavior between endpoints
+- Fixed Flask-Login dependency problem
+- Added optional `next` parameter to registration endpoint, similar to that of login
+
+
+Version 1.6.3
+-------------
+
+Released May 8th 2013
+
+- Fixed bug in regards to imports with latest version of MongoEngine
+
+
+Version 1.6.2
+-------------
+
+Released April 4th 2013
+
+- Fixed bug with http basic auth
+
+
+Version 1.6.1
+-------------
+
+Released April 3rd 2013
+
+- Fixed bug with signals
+
+
+Version 1.6.0
+-------------
+
+Released March 13th 2013
+
+- Added Flask-Pewee support
+- Password hashing is now more flexible and can be changed to a different type at will
+- Flask-Login messages are configurable
+- AJAX requests must now send a CSRF token for security reasons
+- Form messages are now configurable
+- Forms can now be extended with more fields
+- Added change password endpoint
+- Added the user to the request context when successfully authenticated via http basic and token auth
+- The Flask-Security blueprint subdomain is now configurable
+- Redirects to other domains are now not allowed during requests that may redirect
+- Template paths can be configured
+- The welcome/register email can now optionally be sent to the user
+- Passwords can now contain non-latin characters
+- Fixed a bug when confirming an account but the account has been deleted
+
+
+Version 1.5.4
+-------------
+
+Released January 6th 2013
+
+- Fix bug in forms with `csrf_enabled` parameter not accounting attempts to login using JSON data
+
+
+Version 1.5.3
+-------------
+
+Released December 23rd 2012
+
+- Change dependency requirement
+
+Version 1.5.2
+-------------
+
+Released December 11th 2012
+
+- Fix a small bug in `flask_security.utils.login_user` method
+
 Version 1.5.1
 -------------
 

MANIFEST.in

@@ -1,2 +1,3 @@
+include CHANGES LICENSE
 recursive-include tests *.py
 recursive-include flask_security/templates *.*

docs/_templates/sidebarintro.html

@@ -9,7 +9,7 @@
 <ul>
   <li><a href="http://pypi.python.org/pypi/Flask-Security">Flask-Security @ PyPI</a></li>
   <li><a href="http://github.com/mattupstate/flask-security">Flask-Security @ github</a></li>
-  <li><a href="http://github.com/jfinkels/flask-security/issues">Issue Tracker</a></li>
+  <li><a href="http://github.com/mattupstate/flask-security/issues">Issue Tracker</a></li>
 </ul>
 <ul>
   <li><a href="http://pypi.python.org/pypi/Flask-Social">Flask-Social</a></li>

docs/api.rst

@@ -49,9 +49,81 @@ Datastores
     :members:
     :inherited-members:
 
+.. autoclass:: flask_security.datastore.PeeweeUserDatastore
+    :members:
+    :inherited-members:
+
+
+Utils
+-----
+.. autofunction:: flask_security.utils.login_user
+
+.. autofunction:: flask_security.utils.logout_user
+
+.. autofunction:: flask_security.utils.get_hmac
+
+.. autofunction:: flask_security.utils.verify_password
+
+.. autofunction:: flask_security.utils.verify_and_update_password
+
+.. autofunction:: flask_security.utils.encrypt_password
+
+.. autofunction:: flask_security.utils.url_for_security
+
+.. autofunction:: flask_security.utils.get_within_delta
+
+.. autofunction:: flask_security.utils.send_mail
+
+.. autofunction:: flask_security.utils.get_token_status
 
 Signals
 -------
+See the `Flask documentation on signals`_ for information on how to use these
+signals in your code.
+
 See the documentation for the signals provided by the Flask-Login and
-Flask-Principal extensions. Flask-Security does not provide any additional
+Flask-Principal extensions. In addition to those signals, Flask-Security
-signals.
+sends the following signals.
+
+.. data:: user_registered
+
+   Sent when a user registers on the site. It is passed a dict with
+   the `user` and `confirm_token`, the user being logged in and the
+   (if so configured) the confirmation token issued.
+
+.. data:: user_confirmed
+
+   Sent when a user is confirmed. It is passed `user`, which is the
+   user being confirmed.
+
+.. data:: confirm_instructions_sent
+
+   Sent when a user requests confirmation instructions. It is passed
+   the `user`.
+
+.. data:: login_instructions_sent
+
+   Sent when passwordless login is used and user logs in. It is passed
+   a dict with the `user` and `login_token`, the user being logged in
+   and the (if so configured) the login token issued.
+
+.. data:: password_reset
+
+   Sent when a user completes a password reset. It is passed the
+   `user`.
+
+.. data:: password_changed
+
+   Sent when a user completes a password change. It is passed the
+   `user`.
+
+.. data:: reset_password_instructions_sent
+
+   Sent when a user requests a password reset. It is passed a dict
+   with the `user` and `token`, the user being logged in and
+   the (if so configured) the reset token issued.
+
+All signals are also passed a `app` keyword argument, which is the
+current application.
+
+.. _Flask documentation on signals: http://flask.pocoo.org/docs/signals/

docs/authors.rst

@@ -0,0 +1 @@
+.. include:: ../AUTHORS

docs/conf.py

@@ -49,7 +49,7 @@ copyright = u'2012, Matt Wright'
 # built documents.
 #
 # The short X.Y version.
-version = '1.5.1'
+version = '1.7.1'
 # The full version, including alpha/beta/rc tags.
 release = version
 

docs/configuration.rst

@@ -18,7 +18,7 @@ Core
 ``SECURITY_FLASH_MESSAGES``              Specifies wether or not to flash
                                          messages during security procedures.
                                          Defaults to ``True``.
-``SECURITY_PASSWORD_HASH``               Specifies the password hash algorith to
+``SECURITY_PASSWORD_HASH``               Specifies the password hash algorithm to
                                          use when encrypting and decrypting
                                          passwords. Recommended values for
                                          production systems are ``bcrypt``,
@@ -56,6 +56,8 @@ URLs and Views
                                 ``/register``.
 ``SECURITY_RESET_URL``          Specifies the password reset URL. Defaults to
                                 ``/reset``.
+``SECURITY_CHANGE_URL``         Specifies the password change URL. Defaults to
+                                ``/change``.
 ``SECURITY_CONFIRM_URL``        Specifies the email confirmation URL. Defaults
                                 to ``/confirm``.
 ``SECURITY_POST_LOGIN_VIEW``    Specifies the default view to redirect to after
@@ -86,8 +88,14 @@ URLs and Views
                                 successfully resets their password. This value
                                 can be set to a URL or an endpoint name. If this
                                 value is ``None`` the user is redirected  to the
-                                value of ``SECURITY_POST_LOGIN_VIEW``. Defaults to
+                                value of ``SECURITY_POST_LOGIN_VIEW``. Defaults
-                                ``None``.
+                                to ``None``.
+``SECURITY_POST_CHANGE_VIEW``   Specifies the view to redirect to after a user
+                                successfully changes their password. This value
+                                can be set to a URL or an endpoint name. If this
+                                value is ``None`` the user is redirected  to the
+                                value of ``SECURITY_POST_LOGIN_VIEW``. Defaults
+                                to ``None``.
 ``SECURITY_UNAUTHORIZED_VIEW``  Specifies the view to redirect to if a user
                                 attempts to access a URL/endpoint that they do
                                 not have permission to access. If this value is
@@ -96,6 +104,38 @@ URLs and Views
 =============================== ================================================
 
 
+Template Paths
+--------------
+
+.. tabularcolumns:: |p{6.5cm}|p{8.5cm}|
+
+======================================== =======================================
+``SECURITY_FORGOT_PASSWORD_TEMPLATE``    Specifies the path to the template for
+                                         the forgot password page. Defaults to
+                                         ``security/forgot_password.html``.
+``SECURITY_LOGIN_USER_TEMPLATE``         Specifies the path to the template for
+                                         the user login page. Defaults to
+                                         ``security/login_user.html``.
+``SECURITY_REGISTER_USER_TEMPLATE``      Specifies the path to the template for
+                                         the user registration page. Defaults to
+                                         ``security/register_user.html``.
+``SECURITY_RESET_PASSWORD_TEMPLATE``     Specifies the path to the template for
+                                         the reset password page. Defaults to
+                                         ``security/reset_password.html``.
+``SECURITY_CHANGE_PASSWORD_TEMPLATE``    Specifies the path to the template for
+                                         the change password page. Defaults to
+                                         ``security/change_password.html``.
+``SECURITY_SEND_CONFIRMATION_TEMPLATE``  Specifies the path to the template for
+                                         the resend confirmation instructions
+                                         page. Defaults to
+                                         ``security/send_confirmation.html``.
+``SECURITY_SEND_LOGIN_TEMPLATE``         Specifies the path to the template for
+                                         the send login instructions page for
+                                         passwordless logins. Defaults to
+                                         ``security/send_login.html``.
+======================================== =======================================
+
+
 Feature Flags
 -------------
 
@@ -127,6 +167,10 @@ Feature Flags
                           sent an email with a login link. This feature is
                           experimental and should be used with caution. Defaults
                           to ``False``.
+``SECURITY_CHANGEABLE``   Specifies if Flask-Security should enable the
+                          change password endpoint. The URL for this endpoint is
+                          specified by the ``SECURITY_CHANGE_URL`` configuration
+                          option. Defaults to ``False``.
 ========================= ======================================================
 
 Email
@@ -134,58 +178,86 @@ Email
 
 .. tabularcolumns:: |p{6.5cm}|p{8.5cm}|
 
-=========================================== ====================================
+================================================= ==============================
-``SECURITY_EMAIL_SUBJECT_REGISTER``         Sets the subject for the
+``SECURITY_EMAIL_SUBJECT_REGISTER``               Sets the subject for the
-                                            confirmation email. Defaults to
+                                                  confirmation email. Defaults
-                                            ``Welcome``
+                                                  to ``Welcome``
-``SECURITY_EMAIL_SUBJECT_PASSWORDLESS``     Sets the subject for the
+``SECURITY_EMAIL_SUBJECT_PASSWORDLESS``           Sets the subject for the
-                                            passwordless feature. Defaults to
+                                                  passwordless feature. Defaults
-                                            ``Login instructions``
+                                                  to ``Login instructions``
-``SECURITY_EMAIL_SUBJECT_PASSWORD_NOTICE``  Sets subject for the password
+``SECURITY_EMAIL_SUBJECT_PASSWORD_NOTICE``        Sets subject for the password
-                                            notice. Defaults to
+                                                  notice. Defaults to ``Your
-                                            ``Your password has been reset``
+                                                  password has been reset``
-``SECURITY_EMAIL_SUBJECT_PASSWORD_RESET``   Sets the subject for the password
+``SECURITY_EMAIL_SUBJECT_PASSWORD_RESET``         Sets the subject for the
-                                            reset. Defaults to
+                                                  password reset email. Defaults
-                                            ``Password reset instructions``
+                                                  to ``Password reset
-``SECURITY_EMAIL_SUBJECT_CONFIRM``          Sets the subject for the email
+                                                  instructions``
-                                            confirmation message. Defaults to
+``SECURITY_EMAIL_SUBJECT_PASSWORD_CHANGE_NOTICE`` Sets the subject for the
-                                            ``Please confirm your email``
+                                                  password change notice.
+                                                  Defaults to ``Your password
+                                                  has been changed``
+``SECURITY_EMAIL_SUBJECT_CONFIRM``                Sets the subject for the email
+                                                  confirmation message. Defaults
+                                                  to ``Please confirm your
+                                                  email``
+================================================= ==============================
 
 Miscellaneous
 -------------
 
 .. tabularcolumns:: |p{6.5cm}|p{8.5cm}|
 
-======================================= ========================================
+============================================= ==================================
-``SECURITY_CONFIRM_EMAIL_WITHIN``       Specifies the amount of time a user has
+``SECURITY_SEND_REGISTER_EMAIL``              Specifies whether registration
-                                        before their confirmation link expires.
+                                              email is sent. Defaults to
-                                        Always pluralized the time unit for this
+                                              ``True``.
-                                        value. Defaults to ``5 days``.
+``SECURITY_SEND_PASSWORD_CHANGE_EMAIL``       Specifies whether password change
-``SECURITY_RESET_PASSWORD_WITHIN``      Specifies the amount of time a user has
+                                              email is sent. Defaults to
-                                        before their password reset link
+                                              ``True``.
-                                        expires. Always pluralized the time unit
+``SECURITY_SEND_PASSWORD_RESET_NOTICE_EMAIL`` Specifies whether password reset
-                                        for this value. Defaults to ``5 days``.
+                                              notice email is sent. Defaults to
-``SECURITY_LOGIN_WITHIN``               Specifies the amount of time a user has
+                                              ``True``.
-                                        before a login link expires. This is
+
-                                        only used when the passwordless login
+``SECURITY_CONFIRM_EMAIL_WITHIN``             Specifies the amount of time a
-                                        feature is enabled. Always pluralized
+                                              user has before their confirmation
-                                        the time unit for this value. Defaults
+                                              link expires. Always pluralized
-                                        to ``1 days``.
+                                              the time unit for this value.
-``SECURITY_LOGIN_WITHOUT_CONFIRMATION`` Specifies if a user may login before
+                                              Defaults to ``5 days``.
-                                        confirming their email when the value
+``SECURITY_RESET_PASSWORD_WITHIN``            Specifies the amount of time a
-                                        of ``SECURITY_CONFIRMABLE`` is set to
+                                              user has before their password
-                                        ``True``. Defaults to ``False``.
+                                              reset link expires. Always
-``SECURITY_CONFIRM_SALT``               Specifies the salt value when generating
+                                              pluralized the time unit for this
-                                        confirmation links/tokens. Defaults to
+                                              value. Defaults to ``5 days``.
-                                        ``confirm-salt``.
+``SECURITY_LOGIN_WITHIN``                     Specifies the amount of time a
-``SECURITY_RESET_SALT``                 Specifies the salt value when generating
+                                              user has before a login link
-                                        password reset links/tokens. Defaults to
+                                              expires. This is only used when
-                                        ``reset-salt``.
+                                              the passwordless login feature is
-``SECURITY_LOGIN_SALT``                 Specifies the salt value when generating
+                                              enabled. Always pluralized the
-                                        login links/tokens. Defaults to
+                                              time unit for this value.
-                                        ``login-salt``.
+                                              Defaults to ``1 days``.
-``SECURITY_REMEMBER_SALT``              Specifies the salt value when generating
+``SECURITY_LOGIN_WITHOUT_CONFIRMATION``       Specifies if a user may login
-                                        remember tokens. Remember tokens are
+                                              before confirming their email when
-                                        used instead of user ID's as it is more
+                                              the value of
-                                        secure. Defaults to ``remember-salt``.
+                                              ``SECURITY_CONFIRMABLE`` is set to
-======================================= ========================================
+                                              ``True``. Defaults to ``False``.
+``SECURITY_CONFIRM_SALT``                     Specifies the salt value when
+                                              generating confirmation
+                                              links/tokens. Defaults to
+                                              ``confirm-salt``.
+``SECURITY_RESET_SALT``                       Specifies the salt value when
+                                              generating password reset
+                                              links/tokens. Defaults to
+                                              ``reset-salt``.
+``SECURITY_LOGIN_SALT``                       Specifies the salt value when
+                                              generating login links/tokens.
+                                              Defaults to ``login-salt``.
+``SECURITY_REMEMBER_SALT``                    Specifies the salt value when
+                                              generating remember tokens.
+                                              Remember tokens are used instead
+                                              of user ID's as it is more
+                                              secure. Defaults to
+                                              ``remember-salt``.
+``SECURITY_DEFAULT_REMEMBER_ME``              Specifies the default "remember
+                                              me" value used when logging in
+                                              a user. Defaults to ``False``.
+============================================= ==================================

docs/contents.rst.inc

@@ -11,3 +11,4 @@ Contents
    customizing
    api
    changelog
+   authors

docs/customizing.rst

@@ -18,6 +18,7 @@ following is a list of view templates:
 * `security/login_user.html`
 * `security/register_user.html`
 * `security/reset_password.html`
+* `security/change_password.html`
 * `security/send_confirmation.html`
 * `security/send_login.html`
 
@@ -26,9 +27,11 @@ Overriding these templates is simple:
 1. Create a folder named ``security`` within your application's templates folder
 2. Create a template with the same name for the template you wish to override
 
+You can also specify custom template file paths in the :doc:`configuration <configuration>`.
+
 Each template is passed a template context object that includes the following,
 including the objects/values that are passed to the template by the main
-Flask application context processory:
+Flask application context processor:
 
 * ``<template_name>_form``: A form object for the view
 * ``security``: The Flask-Security extension object
@@ -55,27 +58,70 @@ The following is a list of all the available context processor decorators:
 * ``login_context_processor``: Login view
 * ``register_context_processor``: Register view
 * ``reset_password_context_processor``: Reset password view
+* ``change_password_context_processor``: Reset password view
 * ``send_confirmation_context_processor``: Send confirmation view
 * ``send_login_context_processor``: Send login view
 
 
+Forms
+-----
+
+All forms can be overridden. For each form used, you can specify a
+replacement class. This allows you to add extra fields to the
+register form or override validators::
+
+    from flask_security.forms import RegisterForm
+
+    class ExtendedRegisterForm(RegisterForm):
+        first_name = TextField('First Name', [Required()])
+        last_name = TextField('Last Name', [Required()])
+
+    security = Security(app, user_datastore,
+             register_form=ExtendedRegisterForm)
+
+For the ``register_form`` and ``confirm_register_form``, each field is
+passed to the user model (as kwargs) when a user is created. In the
+above case, the ``first_name`` and ``last_name`` fields are passed
+directly to the model, so the model should look like::
+
+    class User(db.Model, UserMixin):
+        id = db.Column(db.Integer, primary_key=True)
+        email = db.Column(db.String(255), unique=True)
+        password = db.Column(db.String(255))
+        first_name = db.Column(db.String(255))
+        last_name = db.Column(db.String(255))
+
+The following is a list of all the available form overrides:
+
+* ``login_form``: Login form
+* ``confirm_register_form``: Confirmable register form
+* ``register_form``: Register form
+* ``forgot_password_form``: Forgot password form
+* ``reset_password_form``: Reset password form
+* ``change_password_form``: Reset password form
+* ``send_confirmation_form``: Send confirmation form
+* ``passwordless_login_form``: Passwordless login form
+
+
 Emails
 ------
 
 Flask-Security is also packaged with a default tempalte for each email that it
-may send. Templates are located within the subfolder named ``security/mail``.
+may send. Templates are located within the subfolder named ``security/email``.
 The following is a list of email templates:
 
-* `security/mail/confirmation_instructions.html`
+* `security/email/confirmation_instructions.html`
-* `security/mail/confirmation_instructions.txt`
+* `security/email/confirmation_instructions.txt`
-* `security/mail/login_instructions.html`
+* `security/email/login_instructions.html`
-* `security/mail/login_instructions.txt`
+* `security/email/login_instructions.txt`
-* `security/mail/reset_instructions.html`
+* `security/email/reset_instructions.html`
-* `security/mail/reset_instructions.txt`
+* `security/email/reset_instructions.txt`
-* `security/mail/reset_notice.html`
+* `security/email/reset_notice.html`
-* `security/mail/reset_notice.txt`
+* `security/email/change_notice.txt`
-* `security/mail/welcome.html`
+* `security/email/change_notice.html`
-* `security/mail/welcome.txt`
+* `security/email/reset_notice.txt`
+* `security/email/welcome.html`
+* `security/email/welcome.txt`
 
 Overriding these templates is simple:
 
@@ -86,11 +132,31 @@ Overriding these templates is simple:
 Each template is passed a template context object that includes values for any
 links that are required in the email. If you require more values in the
 templates you can specify an email context processor with the
-``email_context_processor`` decorator. For example::
+``mail_context_processor`` decorator. For example::
 
     security = Security(app, user_datastore)
 
     # This processor is added to all emails
-    @security.email_context_processor
+    @security.mail_context_processor
     def security_mail_processor():
         return dict(hello="world")
+
+
+Emails with Celery
+------------------
+
+Sometimes it makes sense to send emails via a task queue, such as
+`Celery<http://www.celeryproject.org/>`_. To delay the sending of emails you can
+use the ``@security.send_mail_task`` decorator like so::
+
+    # Setup the task
+    @celery.task
+    def send_security_email(msg):
+        # Use the Flask-Mail extension instance to send the incoming ``msg`` parameter
+        # which is an instance of `flask_mail.Message`
+        mail.send(msg)
+
+    @security.send_mail_task
+    def delay_security_email(msg):
+        send_security_email.delay(msg)
+

docs/features.rst

@@ -34,7 +34,8 @@ Password encryption is enabled with `passlib`_. Passwords are stored in plain
 text by default but you can easily configure the encryption algorithm. You
 should **always use an encryption algorithm** in your production environment.
 You may also specify to use HMAC with a configured salt value in addition to the
-algorithm chosen. Bear in mind passlib does not assume which algorithm you will choose and may require additional libraries to be installed.
+algorithm chosen. Bear in mind passlib does not assume which algorithm you will
+choose and may require additional libraries to be installed.
 
 
 Basic HTTP Authentication
@@ -54,7 +55,7 @@ authentication endpoint. A successful call to this endpoint will return the
 user's ID and their authentication token. This token can be used in subsequent
 requests to protected resources. The auth token is supplied in the request
 through an HTTP header or query string parameter. By default the HTTP header
-name is `X-Auth-Token` and the default query string parameter name is
+name is `Authentication-Token` and the default query string parameter name is
 `auth_token`. Authentication tokens are generated using the user's password.
 Thus if the user changes his or her password their existing authentication token
 will become invalid. A new token will need to be retrieved using the user's new
@@ -104,6 +105,20 @@ statistics. They include:
 * Total login count
 
 
+JSON/Ajax Support
+-----------------
+
+Flask-Security supports JSON/Ajax requests where appropriate. Just remember that
+all endpoints require a CSRF token just like HTML views. More specifically
+JSON is supported for the following operations:
+
+* Login requests
+* Registration requests
+* Change password requests
+* Confirmation requests
+* Forgot password requests
+* Passwordless login requests
+
 
 .. _Flask-Login: http://packages.python.org/Flask-Login/
 .. _alternative token: http://packages.python.org/Flask-Login/#alternative-tokens

docs/index.rst

@@ -10,9 +10,10 @@ Flask application. They include:
 4. Basic HTTP authentication
 5. Token based authentication
 6. Token based account activation (optional)
-7. Token based password recovery/resetting (optional)
+7. Token based password recovery / resetting (optional)
 8. User registration (optional)
 9. Login tracking (optional)
+10. JSON/Ajax Support
 
 Many of these features are made possible by integrating various Flask extensions
 and libraries. They include:
@@ -21,16 +22,17 @@ and libraries. They include:
 2. `Flask-Mail <http://packages.python.org/Flask-Mail/>`_
 3. `Flask-Principal <http://packages.python.org/Flask-Principal/>`_
 4. `Flask-Script <http://packages.python.org/Flask-Script/>`_
-5. `Flask-WTF <http://packages.python.org/Flask-Mail/>`_
+5. `Flask-WTF <http://packages.python.org/Flask-WTF/>`_
 6. `itsdangerous <http://packages.python.org/itsdangerous/>`_
 7. `passlib <http://packages.python.org/passlib/>`_
 
 Additionally, it assumes you'll be using a common library for your database
 connections and model definitions. Flask-Security supports the following Flask
-extensions out of the box for data persistance:
+extensions out of the box for data persistence:
 
-1. `Flask-SQLAlchemy <http://packages.python.org/Flask-SQLAlchemy/>`_
+1. `Flask-SQLAlchemy <http://pypi.python.org/pypi/flask-sqlalchemy/>`_
-2. `Flask-MongoEngine <http://packages.python.org/Flask-MongoEngine/>`_
+2. `Flask-MongoEngine <http://pypi.python.org/pypi/flask-mongoengine/>`_
+3. `Flask-Peewee <http://pypi.python.org/pypi/flask-peewee/>`_
 
 
 .. include:: contents.rst.inc

docs/models.rst

@@ -1,12 +1,12 @@
 Models
 ======
 
-Flask-Security assumes you'll be using libraries such as SQLAlchemy or
+Flask-Security assumes you'll be using libraries such as SQLAlchemy,
-MongoEngine to define a data model that includes a `User` and `Role` model. The
+MongoEngine or Peewee to define a data model that includes a `User` and
-fields on your models must follow a particular convention depending on the
+`Role` model. The fields on your models must follow a particular convention
-functionality your app requires. Aside from this, you're free to add any
+depending on the functionality your app requires. Aside from this, you're
-additional fields to your model(s) if you want. At the bear minimum your `User`
+free to add any additional fields to your model(s) if you want. At the bear
-and `Role` model should include the following fields:
+minimum your `User` and `Role` model should include the following fields:
 
 **User**
 

docs/quickstart.rst

@@ -1,26 +1,35 @@
 Quick Start
 ===========
 
+-  `Basic SQLAlchemy Application <#basic-sqlalchemy-application>`_
+-  `Basic MongoEngine Application <#basic-mongoengine-application>`_
+-  `Basic Peewee Application <#basic-peewee-application>`_
+-  `Mail Configuration <#mail-configuration>`_
 
-Installation
+Basic SQLAlchemy Application
-------------
+=============================
 
-Install requirements:
+SQLAlchemy Install requirements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-    $ mkvirtualenv <your-app-name>
+::
-    $ pip install flask-security, flask-sqlalchemy
+
+     $ mkvirtualenv <your-app-name>
+     $ pip install flask-security flask-sqlalchemy
 
 
-Basic Application
+SQLAlchemy Application
------------------
+~~~~~~~~~~~~~~~~~~~~~~
 
-The following code sample illustrates how to get started as quickly as possible
+The following code sample illustrates how to get started as quickly as
-using SQLAlchemy.::
+possible using SQLAlchemy:
+
+::
 
     from flask import Flask, render_template
     from flask.ext.sqlalchemy import SQLAlchemy
     from flask.ext.security import Security, SQLAlchemyUserDatastore, \
-         UserMixin, RoleMixin
+        UserMixin, RoleMixin, login_required
 
     # Create app
     app = Flask(__name__)
@@ -63,21 +72,169 @@ using SQLAlchemy.::
 
     # Views
     @app.route('/')
+    @login_required
     def home():
         return render_template('index.html')
 
     if __name__ == '__main__':
         app.run()
 
+
+Basic MongoEngine Application
+==============================
+
+MongoEngine Install requirements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+    $ mkvirtualenv <your-app-name>
+    $ pip install flask-security flask-mongoengine
+
+MongoEngine Application
+~~~~~~~~~~~~~~~~~~~~~~~
+
+The following code sample illustrates how to get started as quickly as
+possible using MongoEngine:
+
+::
+
+    from flask import Flask, render_template
+    from flask.ext.mongoengine import MongoEngine
+    from flask.ext.security import Security, MongoEngineUserDatastore, \
+        UserMixin, RoleMixin, login_required
+
+    # Create app
+    app = Flask(__name__)
+    app.config['DEBUG'] = True
+    app.config['SECRET_KEY'] = 'super-secret'
+
+    # MongoDB Config
+    app.config['MONGODB_DB'] = 'mydatabase'
+    app.config['MONGODB_HOST'] = 'localhost'
+    app.config['MONGODB_PORT'] = 27017
+
+    # Create database connection object
+    db = MongoEngine(app)
+
+    class Role(db.Document, RoleMixin):
+        name = db.StringField(max_length=80, unique=True)
+        description = db.StringField(max_length=255)
+
+    class User(db.Document, UserMixin):
+        email = db.StringField(max_length=255)
+        password = db.StringField(max_length=255)
+        active = db.BooleanField(default=True)
+        confirmed_at = db.DateTimeField()
+        roles = db.ListField(db.ReferenceField(Role), default=[])
+
+    # Setup Flask-Security
+    user_datastore = MongoEngineUserDatastore(db, User, Role)
+    security = Security(app, user_datastore)
+
+    # Create a user to test with
+    @app.before_first_request
+    def create_user():
+        user_datastore.create_user(email='matt@nobien.net', password='password')
+
+    # Views
+    @app.route('/')
+    @login_required
+    def home():
+        return render_template('index.html')
+
+    if __name__ == '__main__':
+        app.run()
+
+
+Basic Peewee Application
+========================
+
+Peewee Install requirements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+::
+
+    $ mkvirtualenv <your-app-name>
+    $ pip install flask-security flask-peewee
+
+Peewee Application
+~~~~~~~~~~~~~~~~~~
+
+The following code sample illustrates how to get started as quickly as
+possible using Peewee:
+
+::
+
+    from flask import Flask, render_template
+    from flask_peewee.db import Database
+    from peewee import *
+    from flask.ext.security import Security, PeeweeUserDatastore, \
+        UserMixin, RoleMixin, login_required
+
+    # Create app
+    app = Flask(__name__)
+    app.config['DEBUG'] = True
+    app.config['SECRET_KEY'] = 'super-secret'
+    app.config['DATABASE'] = {
+        'name': 'example.db',
+        'engine': 'peewee.SqliteDatabase',
+    }
+
+    # Create database connection object
+    db = Database(app)
+
+    class Role(db.Model, RoleMixin):
+        name = CharField(unique=True)
+        description = TextField(null=True)
+
+    class User(db.Model, UserMixin):
+        email = TextField()
+        password = TextField()
+        active = BooleanField(default=True)
+        confirmed_at = DateTimeField(null=True)
+
+    class UserRoles(db.Model):
+        # Because peewee does not come with built-in many-to-many
+        # relationships, we need this intermediary class to link
+        # user to roles.
+        user = ForeignKeyField(User, related_name='roles')
+        role = ForeignKeyField(Role, related_name='users')
+        name = property(lambda self: self.role.name)
+        description = property(lambda self: self.role.description)
+
+    # Setup Flask-Security
+    user_datastore = PeeweeUserDatastore(db, User, Role, UserRoles)
+    security = Security(app, user_datastore)
+
+    # Create a user to test with
+    @app.before_first_request
+    def create_user():
+        for Model in (Role, User, UserRoles):
+            Model.drop_table(fail_silently=True)
+            Model.create_table(fail_silently=True)
+        user_datastore.create_user(email='matt@nobien.net', password='password')
+
+    # Views
+    @app.route('/')
+    @login_required
+    def home():
+        return render_template('index.html')
+
+    if __name__ == '__main__':
+        app.run()
+
+
 Mail Configuration
-------------------
+===================
 
-Flask-Security integrates with Flask-Mail to handle all email communications
+Flask-Security integrates with Flask-Mail to handle all email
-between user and site, so it's important to configure Flask-Mail with your
+communications between user and site, so it's important to configure
-email server details so Flask-Security can talk with Flask-Mail correctly.
+Flask-Mail with your email server details so Flask-Security can talk
+with Flask-Mail correctly.
 
-The following code illustrates a basic setup, which could be added to the
+The following code illustrates a basic setup, which could be added to
-basic application code in the previous section::
+the basic application code in the previous section::
 
     # At top of file
     from flask_mail import Mail
@@ -90,11 +247,6 @@ basic application code in the previous section::
     app.config['MAIL_PASSWORD'] = 'password'
     mail = Mail(app)
 
-To learn more about the various Flask-Mail settings to configure it to work
+To learn more about the various Flask-Mail settings to configure it to
-with your particular email server configuration, please see the
+work with your particular email server configuration, please see the
-`Flask-Mail documentation <http://packages.python.org/Flask-Mail/>`_
+`Flask-Mail documentation <http://packages.python.org/Flask-Mail/>`_.
-
-
-
-
-

flask_security/__init__.py

@@ -10,12 +10,12 @@
     :license: MIT, see LICENSE for more details.
 """
 
-__version__ = '1.5.1'
+__version__ = '1.7.1'
 
 from .core import Security, RoleMixin, UserMixin, AnonymousUser, current_user
-from .datastore import SQLAlchemyUserDatastore, MongoEngineUserDatastore
+from .datastore import SQLAlchemyUserDatastore, MongoEngineUserDatastore, PeeweeUserDatastore
 from .decorators import auth_token_required, http_auth_required, \
-     login_required, roles_accepted, roles_required
+     login_required, roles_accepted, roles_required, auth_required
 from .forms import ForgotPasswordForm, LoginForm, RegisterForm, \
      ResetPasswordForm, PasswordlessLoginForm, ConfirmRegisterForm
 from .signals import confirm_instructions_sent, password_reset, \

flask_security/changeable.py

@@ -0,0 +1,45 @@
+# -*- coding: utf-8 -*-
+"""
+    flask.ext.security.changeable
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    Flask-Security recoverable module
+
+    :copyright: (c) 2012 by Matt Wright.
+    :author: Eskil Heyn Olsen
+    :license: MIT, see LICENSE for more details.
+"""
+
+from flask import current_app as app
+from werkzeug.local import LocalProxy
+
+from .signals import password_changed
+from .utils import send_mail, encrypt_password, config_value
+
+
+# Convenient references
+_security = LocalProxy(lambda: app.extensions['security'])
+
+_datastore = LocalProxy(lambda: _security.datastore)
+
+
+def send_password_changed_notice(user):
+    """Sends the password changed notice email for the specified user.
+
+    :param user: The user to send the notice to
+    """
+    if config_value('SEND_PASSWORD_CHANGE_EMAIL'):
+        send_mail(config_value('EMAIL_SUBJECT_PASSWORD_CHANGE_NOTICE'), user.email,
+              'change_notice', user=user)
+
+
+def change_user_password(user, password):
+    """Change the specified user's password
+
+    :param user: The user to change_password
+    :param password: The unencrypted new password
+    """
+    user.password = encrypt_password(password)
+    _datastore.put(user)
+    send_password_changed_notice(user)
+    password_changed.send(user, app=app._get_current_object())

flask_security/confirmable.py

@@ -11,11 +11,11 @@
 
 from datetime import datetime
 
-from flask import current_app as app, request
+from flask import current_app as app
 from werkzeug.local import LocalProxy
 
 from .utils import send_mail, md5, url_for_security, get_token_status,\
-     config_value
+    config_value
 from .signals import user_confirmed, confirm_instructions_sent
 
 
@@ -27,8 +27,7 @@ _datastore = LocalProxy(lambda: _security.datastore)
 
 def generate_confirmation_link(user):
     token = generate_confirmation_token(user)
-    url = url_for_security('confirm_email', token=token)
+    return url_for_security('confirm_email', token=token, _external=True), token
-    return request.url_root[:-1] + url, token
 
 
 def send_confirmation_instructions(user):
@@ -44,7 +43,7 @@ def send_confirmation_instructions(user):
               'confirmation_instructions', user=user,
               confirmation_link=confirmation_link)
 
-    confirm_instructions_sent.send(user, app=app._get_current_object())
+    confirm_instructions_sent.send(app._get_current_object(), user=user)
     return token
 
 
@@ -53,13 +52,13 @@ def generate_confirmation_token(user):
 
     :param user: The user to work with
     """
-    data = [user.id, md5(user.email)]
+    data = [str(user.id), md5(user.email)]
     return _security.confirm_serializer.dumps(data)
 
 
 def requires_confirmation(user):
     """Returns `True` if the user requires confirmation."""
-    return _security.confirmable and user.confirmed_at == None
+    return _security.confirmable and not _security.login_without_confirmation and user.confirmed_at == None
 
 
 def confirm_email_token_status(token):
@@ -80,4 +79,4 @@ def confirm_user(user):
     """
     user.confirmed_at = datetime.utcnow()
     _datastore.put(user)
-    user_confirmed.send(user, app=app._get_current_object())
+    user_confirmed.send(app._get_current_object(), user=user)

flask_security/core.py

@@ -10,17 +10,20 @@
 """
 
 from flask import current_app
-from flask.ext.login import AnonymousUser as AnonymousUserBase, \
+from flask.ext.login import AnonymousUserMixin, UserMixin as BaseUserMixin, \
-     UserMixin as BaseUserMixin, LoginManager, current_user
+    LoginManager, current_user
 from flask.ext.principal import Principal, RoleNeed, UserNeed, Identity, \
-     identity_loaded
+    identity_loaded
 from itsdangerous import URLSafeTimedSerializer
 from passlib.context import CryptContext
 from werkzeug.datastructures import ImmutableList
 from werkzeug.local import LocalProxy
 
-from .utils import config_value as cv, get_config, md5, url_for_security
+from .utils import config_value as cv, get_config, md5, url_for_security, string_types
 from .views import create_blueprint
+from .forms import LoginForm, ConfirmRegisterForm, RegisterForm, \
+    ForgotPasswordForm, ChangePasswordForm, ResetPasswordForm, \
+    SendConfirmationForm, PasswordlessLoginForm
 
 # Convenient references
 _security = LocalProxy(lambda: current_app.extensions['security'])
@@ -30,6 +33,7 @@ _security = LocalProxy(lambda: current_app.extensions['security'])
 _default_config = {
     'BLUEPRINT_NAME': 'security',
     'URL_PREFIX': None,
+    'SUBDOMAIN': None,
     'FLASH_MESSAGES': True,
     'PASSWORD_HASH': 'plaintext',
     'PASSWORD_SALT': None,
@@ -37,6 +41,7 @@ _default_config = {
     'LOGOUT_URL': '/logout',
     'REGISTER_URL': '/register',
     'RESET_URL': '/reset',
+    'CHANGE_URL': '/change',
     'CONFIRM_URL': '/confirm',
     'POST_LOGIN_VIEW': '/',
     'POST_LOGOUT_VIEW': '/',
@@ -44,12 +49,24 @@ _default_config = {
     'POST_REGISTER_VIEW': None,
     'POST_CONFIRM_VIEW': None,
     'POST_RESET_VIEW': None,
+    'POST_CHANGE_VIEW': None,
     'UNAUTHORIZED_VIEW': None,
+    'FORGOT_PASSWORD_TEMPLATE': 'security/forgot_password.html',
+    'LOGIN_USER_TEMPLATE': 'security/login_user.html',
+    'REGISTER_USER_TEMPLATE': 'security/register_user.html',
+    'RESET_PASSWORD_TEMPLATE': 'security/reset_password.html',
+    'CHANGE_PASSWORD_TEMPLATE': 'security/change_password.html',
+    'SEND_CONFIRMATION_TEMPLATE': 'security/send_confirmation.html',
+    'SEND_LOGIN_TEMPLATE': 'security/send_login.html',
     'CONFIRMABLE': False,
     'REGISTERABLE': False,
     'RECOVERABLE': False,
     'TRACKABLE': False,
     'PASSWORDLESS': False,
+    'CHANGEABLE': False,
+    'SEND_REGISTER_EMAIL': True,
+    'SEND_PASSWORD_CHANGE_EMAIL': True,
+    'SEND_PASSWORD_RESET_NOTICE_EMAIL': True,
     'LOGIN_WITHIN': '1 days',
     'CONFIRM_EMAIL_WITHIN': '5 days',
     'RESET_PASSWORD_WITHIN': '5 days',
@@ -60,13 +77,17 @@ _default_config = {
     'CONFIRM_SALT': 'confirm-salt',
     'RESET_SALT': 'reset-salt',
     'LOGIN_SALT': 'login-salt',
+    'CHANGE_SALT': 'change-salt',
     'REMEMBER_SALT': 'remember-salt',
+    'DEFAULT_REMEMBER_ME': False,
     'DEFAULT_HTTP_AUTH_REALM': 'Login Required',
     'EMAIL_SUBJECT_REGISTER': 'Welcome',
     'EMAIL_SUBJECT_CONFIRM': 'Please confirm your email',
     'EMAIL_SUBJECT_PASSWORDLESS': 'Login instructions',
     'EMAIL_SUBJECT_PASSWORD_NOTICE': 'Your password has been reset',
-    'EMAIL_SUBJECT_PASSWORD_RESET': 'Password reset instructions'
+    'EMAIL_SUBJECT_PASSWORD_CHANGE_NOTICE': 'Your password has been changed',
+    'EMAIL_SUBJECT_PASSWORD_RESET': 'Password reset instructions',
+    'USER_IDENTITY_ATTRIBUTES': ['email']
 }
 
 #: Default Flask-Security messages
@@ -76,8 +97,10 @@ _default_messages = {
     'EMAIL_CONFIRMED': ('Thank you. Your email has been confirmed.', 'success'),
     'ALREADY_CONFIRMED': ('Your email has already been confirmed.', 'info'),
     'INVALID_CONFIRMATION_TOKEN': ('Invalid confirmation token.', 'error'),
-    'ALREADY_CONFIRMED': ('This email has already been confirmed', 'info'),
+    'EMAIL_ALREADY_ASSOCIATED': ('%(email)s is already associated with an account.', 'error'),
     'PASSWORD_MISMATCH': ('Password does not match', 'error'),
+    'RETYPE_PASSWORD_MISMATCH': ('Passwords do not match', 'error'),
+    'INVALID_REDIRECT': ('Redirections outside the domain are forbidden', 'error'),
     'PASSWORD_RESET_REQUEST': ('Instructions to reset your password have been sent to %(email)s.', 'info'),
     'PASSWORD_RESET_EXPIRED': ('You did not reset your password within %(within)s. New instructions have been sent to %(email)s.', 'error'),
     'INVALID_RESET_PASSWORD_TOKEN': ('Invalid reset password token.', 'error'),
@@ -88,8 +111,41 @@ _default_messages = {
     'LOGIN_EMAIL_SENT': ('Instructions to login have been sent to %(email)s.', 'success'),
     'INVALID_LOGIN_TOKEN': ('Invalid login token.', 'error'),
     'DISABLED_ACCOUNT': ('Account is disabled.', 'error'),
+    'EMAIL_NOT_PROVIDED': ('Email not provided', 'error'),
+    'INVALID_EMAIL_ADDRESS': ('Invalid email address', 'error'),
+    'PASSWORD_NOT_PROVIDED': ('Password not provided', 'error'),
+    'PASSWORD_NOT_SET': ('No password is set for this user', 'error'),
+    'PASSWORD_INVALID_LENGTH': ('Password must be at least 6 characters', 'error'),
+    'USER_DOES_NOT_EXIST': ('Specified user does not exist', 'error'),
+    'INVALID_PASSWORD': ('Invalid password', 'error'),
     'PASSWORDLESS_LOGIN_SUCCESSFUL': ('You have successfuly logged in.', 'success'),
-    'PASSWORD_RESET': ('You successfully reset your password and you have been logged in automatically.', 'success')
+    'PASSWORD_RESET': ('You successfully reset your password and you have been logged in automatically.', 'success'),
+    'PASSWORD_IS_THE_SAME': ('Your new password must be different than your previous password.', 'error'),
+    'PASSWORD_CHANGE': ('You successfully changed your password.', 'success'),
+    'LOGIN': ('Please log in to access this page.', 'info'),
+    'REFRESH': ('Please reauthenticate to access this page.', 'info'),
+}
+
+_allowed_password_hash_schemes = [
+    'bcrypt',
+    'des_crypt',
+    'pbkdf2_sha256',
+    'pbkdf2_sha512',
+    'sha256_crypt',
+    'sha512_crypt',
+    # And always last one...
+    'plaintext'
+]
+
+_default_forms = {
+    'login_form': LoginForm,
+    'confirm_register_form': ConfirmRegisterForm,
+    'register_form': RegisterForm,
+    'forgot_password_form': ForgotPasswordForm,
+    'reset_password_form': ResetPasswordForm,
+    'change_password_form': ChangePasswordForm,
+    'send_confirmation_form': SendConfirmationForm,
+    'passwordless_login_form': PasswordlessLoginForm,
 }
 
 
@@ -105,8 +161,7 @@ def _token_loader(token):
             return user
     except:
         pass
-
+    return AnonymousUser()
-    return None
 
 
 def _identity_loader():
@@ -131,6 +186,14 @@ def _get_login_manager(app):
     lm.login_view = '%s.login' % cv('BLUEPRINT_NAME', app=app)
     lm.user_loader(_user_loader)
     lm.token_loader(_token_loader)
+
+    if cv('FLASH_MESSAGES', app=app):
+        lm.login_message, lm.login_message_category = cv('MSG_LOGIN', app=app)
+        lm.needs_refresh_message, lm.needs_refresh_message_category = cv('MSG_REFRESH', app=app)
+    else:
+        lm.login_message = None
+        lm.needs_refresh_message = None
+
     lm.init_app(app)
     return lm
 
@@ -143,7 +206,10 @@ def _get_principal(app):
 
 def _get_pwd_context(app):
     pw_hash = cv('PASSWORD_HASH', app=app)
-    return CryptContext(schemes=[pw_hash], default=pw_hash)
+    if pw_hash not in _allowed_password_hash_schemes:
+        allowed = ', '.join(_allowed_password_hash_schemes[:-1]) + ' and ' + _allowed_password_hash_schemes[-1]
+        raise ValueError("Invalid hash scheme %r. Allowed values are %s" % (pw_hash, allowed))
+    return CryptContext(schemes=_allowed_password_hash_schemes, default=pw_hash)
 
 
 def _get_serializer(app, name):
@@ -170,6 +236,10 @@ def _get_state(app, datastore, **kwargs):
         _send_mail_task=None
     ))
 
+    for key, value in _default_forms.items():
+        if key not in kwargs or not kwargs[key]:
+            kwargs[key] = value
+
     return _SecurityState(**kwargs)
 
 
@@ -179,13 +249,13 @@ def _context_processor():
 
 class RoleMixin(object):
     """Mixin for `Role` model definitions"""
+
     def __eq__(self, other):
-        return (self.name == other or \
+        return (self.name == other or
                 self.name == getattr(other, 'name', None))
 
     def __ne__(self, other):
-        return (self.name != other and
+        return not self.__eq__(other)
-                self.name != getattr(other, 'name', None))
 
 
 class UserMixin(BaseUserMixin):
@@ -204,14 +274,16 @@ class UserMixin(BaseUserMixin):
         """Returns `True` if the user identifies with the specified role.
 
         :param role: A role name or `Role` instance"""
-        return role in self.roles
+        if isinstance(role, string_types):
+            return role in (role.name for role in self.roles)
+        else:
+            return role in self.roles
 
 
-class AnonymousUser(AnonymousUserBase):
+class AnonymousUser(AnonymousUserMixin):
     """AnonymousUser definition"""
 
     def __init__(self):
-        super(AnonymousUser, self).__init__()
         self.roles = ImmutableList()
 
     def has_role(self, *args):
@@ -251,6 +323,9 @@ class _SecurityState(object):
     def reset_password_context_processor(self, fn):
         self._add_ctx_processor('reset_password', fn)
 
+    def change_password_context_processor(self, fn):
+        self._add_ctx_processor('change_password', fn)
+
     def send_confirmation_context_processor(self, fn):
         self._add_ctx_processor('send_confirmation', fn)
 
@@ -277,12 +352,17 @@ class Security(object):
         if app is not None and datastore is not None:
             self._state = self.init_app(app, datastore, **kwargs)
 
-    def init_app(self, app, datastore=None, register_blueprint=True):
+    def init_app(self, app, datastore=None, register_blueprint=True,
+                 login_form=None, confirm_register_form=None,
+                 register_form=None, forgot_password_form=None,
+                 reset_password_form=None, change_password_form=None,
+                 send_confirmation_form=None, passwordless_login_form=None):
         """Initializes the Flask-Security extension for the specified
         application and datastore implentation.
 
         :param app: The application.
         :param datastore: An instance of a user datastore.
+        :param register_blueprint: to register the Security blueprint or not.
         """
         datastore = datastore or self.datastore
 
@@ -294,7 +374,15 @@ class Security(object):
 
         identity_loaded.connect_via(app)(_on_identity_loaded)
 
-        state = _get_state(app, datastore)
+        state = _get_state(app, datastore,
+                           login_form=login_form,
+                           confirm_register_form=confirm_register_form,
+                           register_form=register_form,
+                           forgot_password_form=forgot_password_form,
+                           reset_password_form=reset_password_form,
+                           change_password_form=change_password_form,
+                           send_confirmation_form=send_confirmation_form,
+                           passwordless_login_form=passwordless_login_form)
 
         if register_blueprint:
             app.register_blueprint(create_blueprint(state, __name__))

flask_security/datastore.py

@@ -9,6 +9,9 @@
     :license: MIT, see LICENSE for more details.
 """
 
+from .utils import get_identity_attributes, string_types
+
+
 class Datastore(object):
     def __init__(self, db):
         self.db = db
@@ -44,6 +47,15 @@ class MongoEngineDatastore(Datastore):
         model.delete()
 
 
+class PeeweeDatastore(Datastore):
+    def put(self, model):
+        model.save()
+        return model
+
+    def delete(self, model):
+        model.delete_instance()
+
+
 class UserDatastore(object):
     """Abstracted user datastore.
 
@@ -56,9 +68,9 @@ class UserDatastore(object):
         self.role_model = role_model
 
     def _prepare_role_modify_args(self, user, role):
-        if isinstance(user, basestring):
+        if isinstance(user, string_types):
-            user = self.find_user(email=user.email)
+            user = self.find_user(email=user)
-        if isinstance(role, basestring):
+        if isinstance(role, string_types):
             role = self.find_role(role)
         return user, role
 
@@ -72,12 +84,16 @@ class UserDatastore(object):
         kwargs['roles'] = roles
         return kwargs
 
-    def find_user(self, **kwargs):
+    def get_user(self, id_or_email):
-        """Returns a user matching the provided paramters."""
+        """Returns a user matching the specified ID or email address"""
         raise NotImplementedError
 
-    def find_role(self, **kwargs):
+    def find_user(self, *args, **kwargs):
-        """Returns a role matching the provided paramters."""
+        """Returns a user matching the provided parameters."""
+        raise NotImplementedError
+
+    def find_role(self, *args, **kwargs):
+        """Returns a role matching the provided name."""
         raise NotImplementedError
 
     def add_role_to_user(self, user, role):
@@ -86,12 +102,12 @@ class UserDatastore(object):
         :param user: The user to manipulate
         :param role: The role to add to the user
         """
-        rv = False
         user, role = self._prepare_role_modify_args(user, role)
         if role not in user.roles:
-            rv = True
             user.roles.append(role)
-        return rv
+            self.put(user)
+            return True
+        return False
 
     def remove_role_from_user(self, user, role):
         """Removes a role from a user
@@ -137,10 +153,17 @@ class UserDatastore(object):
         role = self.role_model(**kwargs)
         return self.put(role)
 
+    def find_or_create_role(self, name, **kwargs):
+        """Returns a role matching the given name or creates it with any
+        additionally provided parameters
+        """
+        kwargs["name"] = name
+        return self.find_role(name) or self.create_role(**kwargs)
+
     def create_user(self, **kwargs):
         """Creates and returns a new user from the given parameters."""
-
+        kwargs = self._prepare_create_user_args(**kwargs)
-        user = self.user_model(**self._prepare_create_user_args(**kwargs))
+        user = self.user_model(**kwargs)
         return self.put(user)
 
     def delete_user(self, user):
@@ -159,6 +182,22 @@ class SQLAlchemyUserDatastore(SQLAlchemyDatastore, UserDatastore):
         SQLAlchemyDatastore.__init__(self, db)
         UserDatastore.__init__(self, user_model, role_model)
 
+    def get_user(self, identifier):
+        if self._is_numeric(identifier):
+            return self.user_model.query.get(identifier)
+        for attr in get_identity_attributes():
+            query = getattr(self.user_model, attr).ilike(identifier)
+            rv = self.user_model.query.filter(query).first()
+            if rv is not None:
+                return rv
+
+    def _is_numeric(self, value):
+        try:
+            int(value)
+        except ValueError:
+            return False
+        return True
+
     def find_user(self, **kwargs):
         return self.user_model.query.filter_by(**kwargs).first()
 
@@ -174,8 +213,118 @@ class MongoEngineUserDatastore(MongoEngineDatastore, UserDatastore):
         MongoEngineDatastore.__init__(self, db)
         UserDatastore.__init__(self, user_model, role_model)
 
+    def get_user(self, identifier):
+        from mongoengine import ValidationError
+        try:
+            return self.user_model.objects(id=identifier).first()
+        except ValidationError:
+            pass
+        for attr in get_identity_attributes():
+            query_key = '%s__iexact' % attr
+            query = {query_key: identifier}
+            rv = self.user_model.objects(**query).first()
+            if rv is not None:
+                return rv
+
     def find_user(self, **kwargs):
-        return self.user_model.objects(**kwargs).first()
+        try:
+            from mongoengine.queryset import Q, QCombination
+        except ImportError:
+            from mongoengine.queryset.visitor import Q, QCombination
+        from mongoengine.errors import ValidationError
+
+        queries = map(lambda i: Q(**{i[0]: i[1]}), kwargs.items())
+        query = QCombination(QCombination.AND, queries)
+        try:
+            return self.user_model.objects(query).first()
+        except ValidationError:
+            return None
 
     def find_role(self, role):
         return self.role_model.objects(name=role).first()
+
+    def add_role_to_user(self, user, role):
+        rv = super(MongoEngineUserDatastore, self).add_role_to_user(user, role)
+        if rv:
+            self.put(user)
+        return rv
+
+
+class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
+    """A PeeweeD datastore implementation for Flask-Security that assumes
+    the use of the Flask-Peewee extension.
+
+    :param user_model: A user model class definition
+    :param role_model: A role model class definition
+    :param role_link: A model implementing the many-to-many user-role relation
+    """
+    def __init__(self, db, user_model, role_model, role_link):
+        PeeweeDatastore.__init__(self, db)
+        UserDatastore.__init__(self, user_model, role_model)
+        self.UserRole = role_link
+
+    def get_user(self, identifier):
+        try:
+            return self.user_model.get(self.user_model.id == identifier)
+        except ValueError:
+            pass
+
+        for attr in get_identity_attributes():
+            column = getattr(self.user_model, attr)
+            try:
+                return self.user_model.get(column ** identifier)
+            except self.user_model.DoesNotExist:
+                pass
+
+    def find_user(self, **kwargs):
+        try:
+            return self.user_model.filter(**kwargs).get()
+        except self.user_model.DoesNotExist:
+            return None
+
+    def find_role(self, role):
+        try:
+            return self.role_model.filter(name=role).get()
+        except self.role_model.DoesNotExist:
+            return None
+
+    def create_user(self, **kwargs):
+        """Creates and returns a new user from the given parameters."""
+        roles = kwargs.pop('roles', [])
+        user = self.user_model(**self._prepare_create_user_args(**kwargs))
+        user = self.put(user)
+        for role in roles:
+            self.add_role_to_user(user, role)
+        return user
+
+    def add_role_to_user(self, user, role):
+        """Adds a role tp a user
+
+        :param user: The user to manipulate
+        :param role: The role to add to the user
+        """
+        user, role = self._prepare_role_modify_args(user, role)
+        result = self.UserRole.select() \
+            .where(self.UserRole.user == user.id, self.UserRole.role == role.id)
+        if result.count():
+            return False
+        else:
+            self.UserRole.create(user=user.id, role=role.id)
+            return True
+
+    def remove_role_from_user(self, user, role):
+        """Removes a role from a user
+
+        :param user: The user to manipulate
+        :param role: The role to remove from the user
+        """
+        user, role = self._prepare_role_modify_args(user, role)
+        result = self.UserRole.select() \
+            .where(self.UserRole.user == user, self.UserRole.role == role)
+        if result.count():
+            query = self.UserRole.delete().where(
+                self.UserRole.user == user, self.UserRole.role == role)
+            query.execute()
+            return True
+        else:
+            return False

flask_security/decorators.py

@@ -9,9 +9,10 @@
     :license: MIT, see LICENSE for more details.
 """
 
+from collections import namedtuple
 from functools import wraps
 
-from flask import current_app, Response, request, redirect
+from flask import current_app, Response, request, redirect, _request_ctx_stack
 from flask.ext.login import current_user, login_required
 from flask.ext.principal import RoleNeed, Permission, Identity, identity_changed
 from werkzeug.local import LocalProxy
@@ -30,6 +31,8 @@ _default_unauthorized_html = """
     or your browser doesn't understand how to supply the credentials required.</p>
     """
 
+BasicAuth = namedtuple('BasicAuth', 'username, password')
+
 
 def _get_unauthorized_response(text=None, headers=None):
     text = text or _default_unauthorized_html
@@ -48,27 +51,28 @@ def _check_token():
     args_key = _security.token_authentication_key
     header_token = request.headers.get(header_key, None)
     token = request.args.get(args_key, header_token)
-    serializer = _security.remember_token_serializer
+    if request.get_json(silent=True):
+        token = request.json.get(args_key, token)
 
-    try:
+    user = _security.login_manager.token_callback(token)
-        data = serializer.loads(token)
-    except:
-        return False
 
-    user = _security.datastore.find_user(id=data[0])
+    if user and user.is_authenticated():
-
-    if utils.md5(user.password) == data[1]:
         app = current_app._get_current_object()
+        _request_ctx_stack.top.user = user
         identity_changed.send(app, identity=Identity(user.id))
         return True
 
+    return False
+
 
 def _check_http_auth():
-    auth = request.authorization or dict(username=None, password=None)
+    auth = request.authorization or BasicAuth(username=None, password=None)
     user = _security.datastore.find_user(email=auth.username)
 
-    if user and utils.verify_password(auth.password, user.password):
+    if user and utils.verify_and_update_password(auth.password, user):
+        _security.datastore.commit()
         app = current_app._get_current_object()
+        _request_ctx_stack.top.user = user
         identity_changed.send(app, identity=Identity(user.id))
         return True
 
@@ -112,6 +116,36 @@ def auth_token_required(fn):
     return decorated
 
 
+def auth_required(*auth_methods):
+    """
+    Decorator that protects enpoints through multiple mechanisms
+    Example::
+
+        @app.route('/dashboard')
+        @auth_required('token', 'session')
+        def dashboard():
+            return 'Dashboard'
+
+    :param auth_methods: Specified mechanisms.
+    """
+    login_mechanisms = {
+        'token': lambda: _check_token(),
+        'basic': lambda: _check_http_auth(),
+        'session': lambda: current_user.is_authenticated()
+    }
+
+    def wrapper(fn):
+        @wraps(fn)
+        def decorated_view(*args, **kwargs):
+            mechanisms = [login_mechanisms.get(method) for method in auth_methods]
+            for mechanism in mechanisms:
+                if mechanism and mechanism():
+                    return fn(*args, **kwargs)
+            return _get_unauthorized_response()
+        return decorated_view
+    return wrapper
+
+
 def roles_required(*roles):
     """Decorator which specifies that a user must have all the specified roles.
     Example::

flask_security/forms.py

@@ -9,91 +9,158 @@
     :license: MIT, see LICENSE for more details.
 """
 
+import inspect
+try:
+    from urlparse import urlsplit
+except ImportError:
+    from urllib.parse import urlsplit
+
 from flask import request, current_app
-from flask.ext.wtf import Form as BaseForm, TextField, PasswordField, \
+from flask_wtf import Form as BaseForm
-     SubmitField, HiddenField, Required, BooleanField, EqualTo, Email, \
+from wtforms import TextField, PasswordField, validators, \
-     ValidationError, Length
+    SubmitField, HiddenField, BooleanField, ValidationError, Field
+from flask_login import current_user
 from werkzeug.local import LocalProxy
 
 from .confirmable import requires_confirmation
-from .utils import verify_password, get_message
+from .utils import verify_and_update_password, get_message, config_value
 
 # Convenient reference
 _datastore = LocalProxy(lambda: current_app.extensions['security'].datastore)
 
-email_required = Required(message='Email not provided')
+_default_field_labels = {
+    'email': 'Email Address',
+    'password': 'Password',
+    'remember_me': 'Remember Me',
+    'login': 'Login',
+    'retype_password': 'Retype Password',
+    'register': 'Register',
+    'send_confirmation': 'Resend Confirmation Instructions',
+    'recover_password': 'Recover Password',
+    'reset_password': 'Reset Password',
+    'retype_password': 'Retype Password',
+    'new_password': 'New Password',
+    'change_password': 'Change Password',
+    'send_login_link': 'Send Login Link'
+}
 
-email_validator = Email(message='Invalid email address')
 
-password_required = Required(message="Password not provided")
+class ValidatorMixin(object):
+    def __call__(self, form, field):
+        if self.message and self.message.isupper():
+            self.message = get_message(self.message)[0]
+        return super(ValidatorMixin, self).__call__(form, field)
+
+
+class EqualTo(ValidatorMixin, validators.EqualTo):
+    pass
+
+
+class Required(ValidatorMixin, validators.Required):
+    pass
+
+
+class Email(ValidatorMixin, validators.Email):
+    pass
+
+
+class Length(ValidatorMixin, validators.Length):
+    pass
+
+
+email_required = Required(message='EMAIL_NOT_PROVIDED')
+email_validator = Email(message='INVALID_EMAIL_ADDRESS')
+password_required = Required(message='PASSWORD_NOT_PROVIDED')
+password_length = Length(min=6, max=128, message='PASSWORD_INVALID_LENGTH')
+
+
+def get_form_field_label(key):
+    return _default_field_labels.get(key, '')
 
 
 def unique_user_email(form, field):
     if _datastore.find_user(email=field.data) is not None:
-        raise ValidationError(field.data +
+        msg = get_message('EMAIL_ALREADY_ASSOCIATED', email=field.data)[0]
-                              ' is already associated with an account')
+        raise ValidationError(msg)
 
 
 def valid_user_email(form, field):
     form.user = _datastore.find_user(email=field.data)
     if form.user is None:
-        raise ValidationError('Specified user does not exist')
+        raise ValidationError(get_message('USER_DOES_NOT_EXIST')[0])
 
 
 class Form(BaseForm):
     def __init__(self, *args, **kwargs):
-        kwargs.setdefault('csrf_enabled', not current_app.testing)
+        if current_app.testing:
+            self.TIME_LIMIT = None
         super(Form, self).__init__(*args, **kwargs)
 
 
 class EmailFormMixin():
-    email = TextField("Email Address",
+    email = TextField(
-        validators=[email_required,
+        get_form_field_label('email'),
-                    email_validator])
+        validators=[email_required, email_validator])
 
 
 class UserEmailFormMixin():
     user = None
-    email = TextField("Email Address",
+    email = TextField(
-        validators=[email_required,
+        get_form_field_label('email'),
-                    email_validator,
+        validators=[email_required, email_validator, valid_user_email])
-                    valid_user_email])
 
 
 class UniqueEmailFormMixin():
-    email = TextField("Email Address",
+    email = TextField(
-        validators=[email_required,
+        get_form_field_label('email'),
-                    email_validator,
+        validators=[email_required, email_validator, unique_user_email])
-                    unique_user_email])
 
 
 class PasswordFormMixin():
-    password = PasswordField("Password",
+    password = PasswordField(
-        validators=[password_required])
+        get_form_field_label('password'), validators=[password_required])
 
 
 class NewPasswordFormMixin():
-    password = PasswordField("Password",
+    password = PasswordField(
-        validators=[password_required,
+        get_form_field_label('password'),
-                    Length(min=6, max=128)])
+        validators=[password_required, password_length])
+
 
 class PasswordConfirmFormMixin():
-    password_confirm = PasswordField("Retype Password",
+    password_confirm = PasswordField(
-        validators=[EqualTo('password', message="Passwords do not match")])
+        get_form_field_label('retype_password'),
+        validators=[EqualTo('password', message='RETYPE_PASSWORD_MISMATCH')])
 
 
 class NextFormMixin():
     next = HiddenField()
 
+    def validate_next(self, field):
+        if field.data:
+            url_next = urlsplit(field.data)
+            url_base = urlsplit(request.host_url)
+            if url_next.netloc and url_next.netloc != url_base.netloc:
+                field.data = ''
+                raise ValidationError(get_message('INVALID_REDIRECT')[0])
+
 
 class RegisterFormMixin():
-    submit = SubmitField("Register")
+    submit = SubmitField(get_form_field_label('register'))
+
+    def to_dict(form):
+        def is_field_and_user_attr(member):
+            return isinstance(member, Field) and \
+                hasattr(_datastore.user_model, member.name)
+
+        fields = inspect.getmembers(form, is_field_and_user_attr)
+        return dict((key, value.data) for key, value in fields)
 
 
 class SendConfirmationForm(Form, UserEmailFormMixin):
     """The default forgot password form"""
 
-    submit = SubmitField("Resend Confirmation Instructions")
+    submit = SubmitField(get_form_field_label('send_confirmation'))
 
     def __init__(self, *args, **kwargs):
         super(SendConfirmationForm, self).__init__(*args, **kwargs)
@@ -112,13 +179,13 @@ class SendConfirmationForm(Form, UserEmailFormMixin):
 class ForgotPasswordForm(Form, UserEmailFormMixin):
     """The default forgot password form"""
 
-    submit = SubmitField("Recover Password")
+    submit = SubmitField(get_form_field_label('recover_password'))
 
 
 class PasswordlessLoginForm(Form, UserEmailFormMixin):
     """The passwordless login form"""
 
-    submit = SubmitField("Send Login Link")
+    submit = SubmitField(get_form_field_label('send_login_link'))
 
     def __init__(self, *args, **kwargs):
         super(PasswordlessLoginForm, self).__init__(*args, **kwargs)
@@ -134,32 +201,39 @@ class PasswordlessLoginForm(Form, UserEmailFormMixin):
 
 class LoginForm(Form, NextFormMixin):
     """The default login form"""
-    email = TextField('Email Address')
+
-    password = PasswordField('Password')
+    email = TextField(get_form_field_label('email'))
-    remember = BooleanField("Remember Me")
+    password = PasswordField(get_form_field_label('password'))
-    submit = SubmitField("Login")
+    remember = BooleanField(get_form_field_label('remember_me'))
+    submit = SubmitField(get_form_field_label('login'))
 
     def __init__(self, *args, **kwargs):
         super(LoginForm, self).__init__(*args, **kwargs)
+        self.remember.default = config_value('DEFAULT_REMEMBER_ME')
 
     def validate(self):
-        super(LoginForm, self).validate()
+        if not super(LoginForm, self).validate():
+            return False
 
         if self.email.data.strip() == '':
-            self.email.errors.append('Email not provided')
+            self.email.errors.append(get_message('EMAIL_NOT_PROVIDED')[0])
             return False
 
         if self.password.data.strip() == '':
-            self.password.errors.append('Password not provided')
+            self.password.errors.append(get_message('PASSWORD_NOT_PROVIDED')[0])
             return False
 
-        self.user = _datastore.find_user(email=self.email.data)
+
+        self.user = _datastore.get_user(self.email.data)
 
         if self.user is None:
-            self.email.errors.append('Specified user does not exist')
+            self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0])
             return False
-        if not verify_password(self.password.data, self.user.password):
+        if not self.user.password:
-            self.password.errors.append('Invalid password')
+            self.password.errors.append(get_message('PASSWORD_NOT_SET')[0])
+            return False
+        if not verify_and_update_password(self.password.data, self.user):
+            self.password.errors.append(get_message('INVALID_PASSWORD')[0])
             return False
         if requires_confirmation(self.user):
             self.email.errors.append(get_message('CONFIRMATION_REQUIRED')[0])
@@ -172,9 +246,7 @@ class LoginForm(Form, NextFormMixin):
 
 class ConfirmRegisterForm(Form, RegisterFormMixin,
                           UniqueEmailFormMixin, NewPasswordFormMixin):
-    def to_dict(self):
+    pass
-        return dict(email=self.email.data,
-                    password=self.password.data)
 
 
 class RegisterForm(ConfirmRegisterForm, PasswordConfirmFormMixin):
@@ -184,4 +256,33 @@ class RegisterForm(ConfirmRegisterForm, PasswordConfirmFormMixin):
 class ResetPasswordForm(Form, NewPasswordFormMixin, PasswordConfirmFormMixin):
     """The default reset password form"""
 
-    submit = SubmitField("Reset Password")
+    submit = SubmitField(get_form_field_label('reset_password'))
+
+
+class ChangePasswordForm(Form, PasswordFormMixin):
+    """The default change password form"""
+
+    new_password = PasswordField(
+        get_form_field_label('new_password'),
+        validators=[password_required, password_length])
+
+    new_password_confirm = PasswordField(
+        get_form_field_label('retype_password'),
+        validators=[EqualTo('new_password', message='RETYPE_PASSWORD_MISMATCH')])
+
+    submit = SubmitField(get_form_field_label('change_password'))
+
+    def validate(self):
+        if not super(ChangePasswordForm, self).validate():
+            return False
+
+        if self.password.data.strip() == '':
+            self.password.errors.append(get_message('PASSWORD_NOT_PROVIDED')[0])
+            return False
+        if not verify_and_update_password(self.password.data, current_user):
+            self.password.errors.append(get_message('INVALID_PASSWORD')[0])
+            return False
+        if self.password.data.strip() == self.new_password.data.strip():
+            self.password.errors.append(get_message('PASSWORD_IS_THE_SAME')[0])
+            return False
+        return True

flask_security/passwordless.py

@@ -9,12 +9,12 @@
     :license: MIT, see LICENSE for more details.
 """
 
-from flask import request, current_app as app
+from flask import current_app as app
 from werkzeug.local import LocalProxy
 
 from .signals import login_instructions_sent
 from .utils import send_mail, url_for_security, get_token_status, \
-     config_value
+    config_value
 
 
 # Convenient references
@@ -30,14 +30,13 @@ def send_login_instructions(user):
     :param token: The login token
     """
     token = generate_login_token(user)
-    url = url_for_security('token_login', token=token)
+    login_link = url_for_security('token_login', token=token, _external=True)
-    login_link = request.url_root[:-1] + url
 
     send_mail(config_value('EMAIL_SUBJECT_PASSWORDLESS'), user.email,
               'login_instructions', user=user, login_link=login_link)
 
-    login_instructions_sent.send(dict(user=user, login_token=token),
+    login_instructions_sent.send(app._get_current_object(),
-                                 app=app._get_current_object())
+                                 user=user, login_token=token)
 
 
 def generate_login_token(user):
@@ -45,7 +44,7 @@ def generate_login_token(user):
 
     :param user: The user the token belongs to
     """
-    return _security.login_serializer.dumps([user.id])
+    return _security.login_serializer.dumps([str(user.id)])
 
 
 def login_token_status(token):

flask_security/recoverable.py

@@ -9,12 +9,12 @@
     :license: MIT, see LICENSE for more details.
 """
 
-from flask import current_app as app, request
+from flask import current_app as app
 from werkzeug.local import LocalProxy
 
 from .signals import password_reset, reset_password_instructions_sent
 from .utils import send_mail, md5, encrypt_password, url_for_security, \
-     get_token_status, config_value
+    get_token_status, config_value
 
 
 # Convenient references
@@ -29,15 +29,14 @@ def send_reset_password_instructions(user):
     :param user: The user to send the instructions to
     """
     token = generate_reset_password_token(user)
-    url = url_for_security('reset_password', token=token)
+    reset_link = url_for_security('reset_password', token=token, _external=True)
-    reset_link = request.url_root[:-1] + url
 
     send_mail(config_value('EMAIL_SUBJECT_PASSWORD_RESET'), user.email,
               'reset_instructions',
               user=user, reset_link=reset_link)
 
-    reset_password_instructions_sent.send(dict(user=user, token=token),
+    reset_password_instructions_sent.send(app._get_current_object(),
-                                          app=app._get_current_object())
+                                          user=user, token=token)
 
 
 def send_password_reset_notice(user):
@@ -45,8 +44,9 @@ def send_password_reset_notice(user):
 
     :param user: The user to send the notice to
     """
-    send_mail(config_value('EMAIL_SUBJECT_PASSWORD_NOTICE'), user.email,
+    if config_value('SEND_PASSWORD_RESET_NOTICE_EMAIL'):
-              'reset_notice', user=user)
+        send_mail(config_value('EMAIL_SUBJECT_PASSWORD_NOTICE'), user.email,
+                  'reset_notice', user=user)
 
 
 def generate_reset_password_token(user):
@@ -54,7 +54,7 @@ def generate_reset_password_token(user):
 
     :param user: The user to work with
     """
-    data = [user.id, md5(user.password)]
+    data = [str(user.id), md5(user.password)]
     return _security.reset_serializer.dumps(data)
 
 
@@ -68,6 +68,7 @@ def reset_password_token_status(token):
     """
     return get_token_status(token, 'reset', 'RESET_PASSWORD')
 
+
 def update_password(user, password):
     """Update the specified user's password
 
@@ -77,4 +78,4 @@ def update_password(user, password):
     user.password = encrypt_password(password)
     _datastore.put(user)
     send_password_reset_notice(user)
-    password_reset.send(user, app=app._get_current_object())
+    password_reset.send(app._get_current_object(), user=user)

flask_security/registerable.py

@@ -15,7 +15,7 @@ from werkzeug.local import LocalProxy
 from .confirmable import generate_confirmation_link
 from .signals import user_registered
 from .utils import do_flash, get_message, send_mail, encrypt_password, \
-     config_value
+    config_value
 
 # Convenient references
 _security = LocalProxy(lambda: app.extensions['security'])
@@ -33,10 +33,11 @@ def register_user(**kwargs):
         confirmation_link, token = generate_confirmation_link(user)
         do_flash(*get_message('CONFIRM_REGISTRATION', email=user.email))
 
-    user_registered.send(dict(user=user, confirm_token=token),
+    user_registered.send(app._get_current_object(),
-                         app=app._get_current_object())
+                         user=user, confirm_token=token)
 
-    send_mail(config_value('EMAIL_SUBJECT_REGISTER'), user.email, 'welcome',
+    if config_value('SEND_REGISTER_EMAIL'):
-              user=user, confirmation_link=confirmation_link)
+        send_mail(config_value('EMAIL_SUBJECT_REGISTER'), user.email, 'welcome',
+                  user=user, confirmation_link=confirmation_link)
 
     return user

flask_security/signals.py

@@ -11,7 +11,6 @@
 
 import blinker
 
-
 signals = blinker.Namespace()
 
 user_registered = signals.signal("user-registered")
@@ -24,4 +23,6 @@ login_instructions_sent = signals.signal("login-instructions-sent")
 
 password_reset = signals.signal("password-reset")
 
+password_changed = signals.signal("password-changed")
+
 reset_password_instructions_sent = signals.signal("password-reset-instructions-sent")

flask_security/templates/security/change_password.html

@@ -0,0 +1,11 @@
+{% from "security/_macros.html" import render_field_with_errors, render_field %}
+{% include "security/_messages.html" %}
+<h1>Change password</h1>
+<form action="{{ url_for_security('change_password') }}" method="POST" name="change_password_form">
+  {{ change_password_form.hidden_tag() }}
+  {{ render_field_with_errors(change_password_form.password) }}
+  {{ render_field_with_errors(change_password_form.new_password) }}
+  {{ render_field_with_errors(change_password_form.new_password_confirm) }}
+  {{ render_field(change_password_form.submit) }}
+</form>
+

flask_security/templates/security/email/change_notice.html

@@ -0,0 +1,4 @@
+<p>Your password has been changed.</p>
+{% if security.recoverable %}
+<p>If you did not change your password, <a href="{{ url_for_security('forgot_password', _external=True) }}">click here to reset it</a>.</p>
+{% endif %}

flask_security/templates/security/email/change_notice.txt

@@ -0,0 +1,5 @@
+Your password has been changed
+{% if security.recoverable %}
+If you did not change your password, click the link below to reset it.
+{{ url_for_security('forgot_password', _external=True) }}
+{% endif %}

flask_security/utils.py

@@ -10,22 +10,26 @@
 """
 
 import base64
+import blinker
+import functools
 import hashlib
 import hmac
+import sys
+
 from contextlib import contextmanager
 from datetime import datetime, timedelta
 
 from flask import url_for, flash, current_app, request, session, render_template
 from flask.ext.login import login_user as _login_user, \
-     logout_user as _logout_user
+    logout_user as _logout_user
 from flask.ext.mail import Message
 from flask.ext.principal import Identity, AnonymousIdentity, identity_changed
 from itsdangerous import BadSignature, SignatureExpired
 from werkzeug.local import LocalProxy
 
-from .signals import user_registered, reset_password_instructions_sent, \
+from .signals import user_registered, user_confirmed, \
-     login_instructions_sent
+    confirm_instructions_sent, login_instructions_sent, \
-
+    password_reset, password_changed, reset_password_instructions_sent
 
 # Convenient references
 _security = LocalProxy(lambda: current_app.extensions['security'])
@@ -34,30 +38,50 @@ _datastore = LocalProxy(lambda: _security.datastore)
 
 _pwd_context = LocalProxy(lambda: _security.pwd_context)
 
+PY3 = sys.version_info[0] == 3
 
-def login_user(user, remember=True):
+if PY3:
-    """Performs the login and sends the appropriate signal."""
+    string_types = str,
+    text_type = str
+else:
+    string_types = basestring,
+    text_type = unicode
 
-    _login_user(user, remember)
+
+def login_user(user, remember=None):
+    """Performs the login routine.
+
+    :param user: The user to login
+    :param remember: Flag specifying if the remember cookie should be set. Defaults to ``False``
+    """
+
+    if remember is None:
+        remember = config_value('DEFAULT_REMEMBER_ME')
+
+    if not _login_user(user, remember):
+        return False
 
     if _security.trackable:
-        old_current, new_current = user.current_login_at, datetime.utcnow()
+        old_current_login, new_current_login = user.current_login_at, datetime.utcnow()
-        user.last_login_at = old_current or new_current
-        user.current_login_at = new_current
-
         remote_addr = request.remote_addr or 'untrackable'
-        old_current, new_current = user.current_login_ip, remote_addr
+        old_current_ip, new_current_ip = user.current_login_ip, remote_addr
-        user.last_login_ip = old_current or new_current
-        user.current_login_ip = new_current
 
+        user.last_login_at = old_current_login or new_current_login
+        user.current_login_at = new_current_login
+        user.last_login_ip = old_current_ip or new_current_ip
+        user.current_login_ip = new_current_ip
         user.login_count = user.login_count + 1 if user.login_count else 1
 
-    _datastore.put(user)
+        _datastore.put(user)
+
     identity_changed.send(current_app._get_current_object(),
                           identity=Identity(user.id))
+    return True
 
 
 def logout_user():
+    """Logs out the current. This will also clean up the remember me cookie if it exists."""
+
     for key in ('identity.name', 'identity.auth_type'):
         session.pop(key, None)
     identity_changed.send(current_app._get_current_object(),
@@ -66,28 +90,60 @@ def logout_user():
 
 
 def get_hmac(password):
-    if _security.password_hash == 'plaintext':
+    """Returns a Base64 encoded HMAC+SHA512 of the password signed with the salt specified
-        return password
+    by ``SECURITY_PASSWORD_SALT``.
 
+    :param password: The password to sign
+    """
     if _security.password_salt is None:
-        raise RuntimeError('The configuration value `SECURITY_PASSWORD_SALT` '
+        raise RuntimeError(
-            'must not be None when the value of `SECURITY_PASSWORD_HASH` is '
+            'The configuration value `SECURITY_PASSWORD_SALT` must '
+            'not be None when the value of `SECURITY_PASSWORD_HASH` is '
             'set to "%s"' % _security.password_hash)
 
-    h = hmac.new(_security.password_salt, password, hashlib.sha512)
+    h = hmac.new(_security.password_salt.encode('utf-8'), password.encode('utf-8'), hashlib.sha512)
     return base64.b64encode(h.digest())
 
 
 def verify_password(password, password_hash):
-    return _pwd_context.verify(get_hmac(password), password_hash)
+    """Returns ``True`` if the password matches the supplied hash.
+
+    :param password: A plaintext password to verify
+    :param password_hash: The expected hash value of the password (usually form your database)
+    """
+    return _pwd_context.verify(encrypt_password(password), password_hash)
+
+
+def verify_and_update_password(password, user):
+    """Returns ``True`` if the password is valid for the specified user. Additionally, the hashed
+    password in the database is updated if the hashing algorithm happens to have changed.
+
+    :param password: A plaintext password to verify
+    :param user: The user to verify against
+    """
+
+    if _security.password_hash != 'plaintext':
+        password = get_hmac(password)
+    verified, new_password = _pwd_context.verify_and_update(password, user.password)
+    if verified and new_password:
+        user.password = new_password
+        _datastore.put(user)
+    return verified
 
 
 def encrypt_password(password):
-    return _pwd_context.encrypt(get_hmac(password))
+    """Encrypts the specified plaintext password using the configured encryption options.
+
+    :param password: The plaintext passwrod to encrypt
+    """
+    if _security.password_hash == 'plaintext':
+        return password
+    signed = get_hmac(password).decode('ascii')
+    return _pwd_context.encrypt(signed)
 
 
 def md5(data):
-    return hashlib.md5(data).hexdigest()
+    return hashlib.md5(data.encode('ascii')).hexdigest()
 
 
 def do_flash(message, category=None):
@@ -132,11 +188,18 @@ def url_for_security(endpoint, **values):
     return url_for(endpoint, **values)
 
 
-def get_post_login_redirect():
+def get_post_action_redirect(config_key):
-    """Returns the URL to redirect to after a user logs in successfully."""
     return (get_url(request.args.get('next')) or
             get_url(request.form.get('next')) or
-            find_redirect('SECURITY_POST_LOGIN_VIEW'))
+            find_redirect(config_key))
+
+
+def get_post_login_redirect():
+    return get_post_action_redirect('SECURITY_POST_LOGIN_VIEW')
+
+
+def get_post_register_redirect():
+    return get_post_action_redirect('SECURITY_POST_REGISTER_VIEW')
 
 
 def find_redirect(key):
@@ -182,9 +245,8 @@ def config_value(key, app=None, default=None):
 
 
 def get_max_age(key, app=None):
-    now = datetime.utcnow()
+    td = get_within_delta(key + '_WITHIN', app)
-    expires = now + get_within_delta(key + '_WITHIN', app)
+    return td.seconds + td.days * 24 * 3600
-    return int(expires.strftime('%s')) - int(now.strftime('%s'))
 
 
 def get_within_delta(key, app=None):
@@ -236,6 +298,14 @@ def send_mail(subject, recipient, template, **context):
 
 
 def get_token_status(token, serializer, max_age=None):
+    """Get the status of a token.
+
+    :param token: The token to check
+    :param serializer: The name of the seriailzer. Can be one of the
+                       following: ``confirm``, ``login``, ``reset``
+    :param max_age: The name of the max age config option. Can be on of
+                    the following: ``CONFIRM_EMAIL``, ``LOGIN``, ``RESET_PASSWORD``
+    """
     serializer = getattr(_security, serializer + '_serializer')
     max_age = get_max_age(max_age)
     user, data = None, None
@@ -256,11 +326,21 @@ def get_token_status(token, serializer, max_age=None):
     return expired, invalid, user
 
 
+def get_identity_attributes(app=None):
+    app = app or current_app
+    attrs = app.config['SECURITY_USER_IDENTITY_ATTRIBUTES']
+    try:
+        attrs = [f.strip() for f in attrs.split(',')]
+    except AttributeError:
+        pass
+    return attrs
+
+
 @contextmanager
 def capture_passwordless_login_requests():
     login_requests = []
 
-    def _on(data, app):
+    def _on(app, **data):
         login_requests.append(data)
 
     login_instructions_sent.connect(_on)
@@ -280,7 +360,7 @@ def capture_registrations():
     """
     registrations = []
 
-    def _on(data, app):
+    def _on(app, **data):
         registrations.append(data)
 
     user_registered.connect(_on)
@@ -300,8 +380,8 @@ def capture_reset_password_requests(reset_password_sent_at=None):
     """
     reset_requests = []
 
-    def _on(request, app):
+    def _on(app, **data):
-        reset_requests.append(request)
+        reset_requests.append(data)
 
     reset_password_instructions_sent.connect(_on)
 
@@ -309,3 +389,56 @@ def capture_reset_password_requests(reset_password_sent_at=None):
         yield reset_requests
     finally:
         reset_password_instructions_sent.disconnect(_on)
+
+
+class CaptureSignals(object):
+    """Testing utility for capturing blinker signals.
+
+    Context manager which mocks out selected signals and registers which are `sent` on and what
+    arguments were sent. Instantiate with a list of blinker `NamedSignals` to patch. Each signal
+    has it's `send` mocked out.
+    """
+    def __init__(self, signals):
+        """Patch all given signals and make them available as attributes.
+
+        :param signals: list of signals
+        """
+        self._records = {}
+        self._receivers = {}
+        for signal in signals:
+            self._records[signal] = []
+            self._receivers[signal] = functools.partial(self._record, signal)
+
+    def __getitem__(self, signal):
+        """All captured signals are available via `ctxt[signal]`.
+        """
+        if isinstance(signal, blinker.base.NamedSignal):
+            return self._records[signal]
+        else:
+            super(CaptureSignals, self).__setitem__(signal)
+
+    def _record(self, signal, *args, **kwargs):
+        self._records[signal].append((args, kwargs))
+
+    def __enter__(self):
+        for signal, receiver in self._receivers.items():
+            signal.connect(receiver)
+        return self
+
+    def __exit__(self, type, value, traceback):
+        for signal, receiver in self._receivers.items():
+            signal.disconnect(receiver)
+
+    def signals_sent(self):
+        """Return a set of the signals sent.
+        :rtype: list of blinker `NamedSignals`.
+        """
+        return set([signal for signal, _ in self._records.items() if self._records[signal]])
+
+
+def capture_signals():
+    """Factory method that creates a `CaptureSignals` with all the flask_security signals."""
+    return CaptureSignals([user_registered, user_confirmed,
+                           confirm_instructions_sent, login_instructions_sent,
+                           password_reset, password_changed,
+                           reset_password_instructions_sent])

flask_security/views.py

@@ -10,24 +10,23 @@
 """
 
 from flask import current_app, redirect, request, render_template, jsonify, \
-     after_this_request, Blueprint
+    after_this_request, Blueprint
+from flask_login import current_user
 from werkzeug.datastructures import MultiDict
 from werkzeug.local import LocalProxy
 
 from .confirmable import send_confirmation_instructions, \
-     confirm_user, confirm_email_token_status
+    confirm_user, confirm_email_token_status
 from .decorators import login_required, anonymous_user_required
-from .forms import LoginForm, ConfirmRegisterForm, RegisterForm, \
-     ForgotPasswordForm, ResetPasswordForm, SendConfirmationForm, \
-     PasswordlessLoginForm
 from .passwordless import send_login_instructions, \
-     login_token_status
+    login_token_status
 from .recoverable import reset_password_token_status, \
-     send_reset_password_instructions, update_password
+    send_reset_password_instructions, update_password
+from .changeable import change_user_password
 from .registerable import register_user
-from .utils import get_url, get_post_login_redirect, do_flash, \
+from .utils import config_value, do_flash, get_url, get_post_login_redirect, \
-     get_message, login_user, logout_user, url_for_security as url_for
+    get_post_register_redirect, get_message, login_user, logout_user, \
-
+    url_for_security as url_for
 
 # Convenient references
 _security = LocalProxy(lambda: current_app.extensions['security'])
@@ -64,10 +63,12 @@ def _ctx(endpoint):
 def login():
     """View function for login view"""
 
+    form_class = _security.login_form
+
     if request.json:
-        form = LoginForm(MultiDict(request.json))
+        form = form_class(MultiDict(request.json))
     else:
-        form = LoginForm()
+        form = form_class()
 
     if form.validate_on_submit():
         login_user(form.user, remember=form.remember.data)
@@ -82,7 +83,7 @@ def login():
     if request.json:
         return _render_json(form, True)
 
-    return render_template('security/login_user.html',
+    return render_template(config_value('LOGIN_USER_TEMPLATE'),
                            login_user_form=form,
                            **_ctx('login'))
 
@@ -101,9 +102,9 @@ def register():
     """View function which handles a registration request."""
 
     if _security.confirmable or request.json:
-        form_class = ConfirmRegisterForm
+        form_class = _security.confirm_register_form
     else:
-        form_class = RegisterForm
+        form_class = _security.register_form
 
     if request.json:
         form_data = MultiDict(request.json)
@@ -121,14 +122,13 @@ def register():
             login_user(user)
 
         if not request.json:
-            post_register_url = get_url(_security.post_register_view)
+            return redirect(get_post_register_redirect())
-            post_login_url = get_url(_security.post_login_view)
+        return _render_json(form, True)
-            return redirect(post_register_url or post_login_url)
 
     if request.json:
         return _render_json(form)
 
-    return render_template('security/register_user.html',
+    return render_template(config_value('REGISTER_USER_TEMPLATE'),
                            register_user_form=form,
                            **_ctx('register'))
 
@@ -136,10 +136,12 @@ def register():
 def send_login():
     """View function that sends login instructions for passwordless login"""
 
+    form_class = _security.passwordless_login_form
+
     if request.json:
-        form = PasswordlessLoginForm(MultiDict(request.json))
+        form = form_class(MultiDict(request.json))
     else:
-        form = PasswordlessLoginForm()
+        form = form_class()
 
     if form.validate_on_submit():
         send_login_instructions(form.user)
@@ -149,7 +151,7 @@ def send_login():
     if request.json:
         return _render_json(form)
 
-    return render_template('security/send_login.html',
+    return render_template(config_value('SEND_LOGIN_TEMPLATE'),
                            send_login_form=form,
                            **_ctx('send_login'))
 
@@ -169,7 +171,7 @@ def token_login(token):
     if invalid or expired:
         return redirect(url_for('login'))
 
-    login_user(user, True)
+    login_user(user)
     after_this_request(_commit)
     do_flash(*get_message('PASSWORDLESS_LOGIN_SUCCESSFUL'))
 
@@ -179,10 +181,12 @@ def token_login(token):
 def send_confirmation():
     """View function which sends confirmation instructions."""
 
+    form_class = _security.send_confirmation_form
+
     if request.json:
-        form = SendConfirmationForm(MultiDict(request.json))
+        form = form_class(MultiDict(request.json))
     else:
-        form = SendConfirmationForm()
+        form = form_class()
 
     if form.validate_on_submit():
         send_confirmation_instructions(form.user)
@@ -192,18 +196,18 @@ def send_confirmation():
     if request.json:
         return _render_json(form)
 
-    return render_template('security/send_confirmation.html',
+    return render_template(config_value('SEND_CONFIRMATION_TEMPLATE'),
                            send_confirmation_form=form,
                            **_ctx('send_confirmation'))
 
 
-@anonymous_user_required
 def confirm_email(token):
     """View function which handles a email confirmation request."""
 
     expired, invalid, user = confirm_email_token_status(token)
 
-    if invalid:
+    if not user or invalid:
+        invalid = True
         do_flash(*get_message('INVALID_CONFIRMATION_TOKEN'))
     if expired:
         send_confirmation_instructions(user)
@@ -213,8 +217,11 @@ def confirm_email(token):
         return redirect(get_url(_security.confirm_error_view) or
                         url_for('send_confirmation'))
 
+    if user != current_user:
+        logout_user()
+        login_user(user)
+
     confirm_user(user)
-    login_user(user, True)
     after_this_request(_commit)
     do_flash(*get_message('EMAIL_CONFIRMED'))
 
@@ -225,10 +232,12 @@ def confirm_email(token):
 def forgot_password():
     """View function that handles a forgotten password request."""
 
+    form_class = _security.forgot_password_form
+
     if request.json:
-        form = ForgotPasswordForm(MultiDict(request.json))
+        form = form_class(MultiDict(request.json))
     else:
-        form = ForgotPasswordForm()
+        form = form_class()
 
     if form.validate_on_submit():
         send_reset_password_instructions(form.user)
@@ -238,7 +247,7 @@ def forgot_password():
     if request.json:
         return _render_json(form)
 
-    return render_template('security/forgot_password.html',
+    return render_template(config_value('FORGOT_PASSWORD_TEMPLATE'),
                            forgot_password_form=form,
                            **_ctx('forgot_password'))
 
@@ -257,27 +266,56 @@ def reset_password(token):
     if invalid or expired:
         return redirect(url_for('forgot_password'))
 
-    form = ResetPasswordForm()
+    form = _security.reset_password_form()
 
     if form.validate_on_submit():
         after_this_request(_commit)
         update_password(user, form.password.data)
         do_flash(*get_message('PASSWORD_RESET'))
-        login_user(user, True)
+        login_user(user)
         return redirect(get_url(_security.post_reset_view) or
                         get_url(_security.post_login_view))
 
-    return render_template('security/reset_password.html',
+    return render_template(config_value('RESET_PASSWORD_TEMPLATE'),
                            reset_password_form=form,
                            reset_password_token=token,
                            **_ctx('reset_password'))
 
 
+@login_required
+def change_password():
+    """View function which handles a change password request."""
+
+    form_class = _security.change_password_form
+
+    if request.json:
+        form = form_class(MultiDict(request.json))
+    else:
+        form = form_class()
+
+    if form.validate_on_submit():
+        after_this_request(_commit)
+        change_user_password(current_user, form.new_password.data)
+        if request.json is None:
+            do_flash(*get_message('PASSWORD_CHANGE'))
+            return redirect(get_url(_security.post_change_view) or
+                            get_url(_security.post_login_view))
+
+    if request.json:
+        form.user = current_user
+        return _render_json(form)
+
+    return render_template(config_value('CHANGE_PASSWORD_TEMPLATE'),
+                           change_password_form=form,
+                           **_ctx('change_password'))
+
+
 def create_blueprint(state, import_name):
     """Creates the security extension blueprint"""
 
     bp = Blueprint(state.blueprint_name, import_name,
                    url_prefix=state.url_prefix,
+                   subdomain=state.subdomain,
                    template_folder='templates')
 
     bp.route(state.logout_url, endpoint='logout')(logout)
@@ -306,6 +344,11 @@ def create_blueprint(state, import_name):
                  methods=['GET', 'POST'],
                  endpoint='reset_password')(reset_password)
 
+    if state.changeable:
+        bp.route(state.change_url,
+                 methods=['GET', 'POST'],
+                 endpoint='change_password')(change_password)
+
     if state.confirmable:
         bp.route(state.confirm_url,
                  methods=['GET', 'POST'],

requirements.txt

@@ -1,6 +1,7 @@
-Flask==0.8
+Flask>=0.9
-Flask-Login==0.1
+Flask-Login>=0.1.3
-Flask-Principal==0.2
+Flask-Mail>=0.7.3
-Flask-Script==0.3.2
+Flask-Principal>=0.3.3
-Flask-WTF==0.5.4
+Flask-WTF>=0.8
-passlib=1.5.3
+itsdangerous>=0.17
+passlib>=1.6.1

setup.py

@@ -20,7 +20,7 @@ from setuptools import setup
 
 setup(
     name='Flask-Security',
-    version='1.5.1',
+    version='1.7.1',
     url='https://github.com/mattupstate/flask-security',
     license='MIT',
     author='Matt Wright',
@@ -34,20 +34,20 @@ setup(
     include_package_data=True,
     platforms='any',
     install_requires=[
-        'Flask>=0.8',
+        'Flask>=0.10.1',
-        'Flask-Login==0.1.3',
+        'Flask-Login>=0.2.9',
-        'Flask-Mail==0.7.3',
+        'Flask-Mail>=0.9.0',
-        'Flask-Principal==0.3.3',
+        'Flask-Principal>=0.4.0',
-        'Flask-WTF==0.8',
+        'Flask-WTF>=0.9.3',
-        'itsdangerous==0.17',
+        'passlib>=1.6.2',
-        'passlib==1.6.1',
     ],
     test_suite='nose.collector',
     tests_require=[
         'nose',
         'Flask-SQLAlchemy',
         'Flask-MongoEngine',
-        'py-bcrypt',
+        'Flask-Peewee',
+        'bcrypt',
         'simplejson'
     ],
     classifiers=[

tests/__init__.py

@@ -1,35 +1,45 @@
 # -*- coding: utf-8 -*-
 
+import hmac
+
+from hashlib import sha1
 from unittest import TestCase
+
 from tests.test_app.sqlalchemy import create_app
 
+
 class SecurityTest(TestCase):
 
+    APP_KWARGS = {
+        'register_blueprint': True,
+    }
     AUTH_CONFIG = None
 
     def setUp(self):
         super(SecurityTest, self).setUp()
 
-        app = self._create_app(self.AUTH_CONFIG or {})
+        app_kwargs = self.APP_KWARGS
+        app = self._create_app(self.AUTH_CONFIG or {}, **app_kwargs)
         app.debug = False
         app.config['TESTING'] = True
+        app.config['WTF_CSRF_ENABLED'] = False
 
         self.app = app
         self.client = app.test_client()
 
-    def _create_app(self, auth_config, register_blueprint=True):
+    def _create_app(self, auth_config, **kwargs):
-        return create_app(auth_config, register_blueprint)
+        return create_app(auth_config, **kwargs)
 
     def _get(self, route, content_type=None, follow_redirects=None, headers=None):
         return self.client.get(route, follow_redirects=follow_redirects,
-                content_type=content_type or 'text/html',
+                               content_type=content_type or 'text/html',
-                headers=headers)
+                               headers=headers)
 
     def _post(self, route, data=None, content_type=None, follow_redirects=True, headers=None):
+        content_type = content_type or 'application/x-www-form-urlencoded'
         return self.client.post(route, data=data,
-                follow_redirects=follow_redirects,
+                                follow_redirects=follow_redirects,
-                content_type=content_type or 'application/x-www-form-urlencoded',
+                                content_type=content_type, headers=headers)
-                headers=headers)
 
     def register(self, email, password='password'):
         data = dict(email=email, password=password)
@@ -37,25 +47,21 @@ class SecurityTest(TestCase):
 
     def authenticate(self, email="matt@lp.com", password="password", endpoint=None, **kwargs):
         data = dict(email=email, password=password, remember='y')
-        r = self._post(endpoint or '/login', data=data, **kwargs)
+        return self._post(endpoint or '/login', data=data, **kwargs)
-        return r
 
     def json_authenticate(self, email="matt@lp.com", password="password", endpoint=None):
-        data = """
+        data = """{
-{
+            "email": "%s",
-    "email": "%s",
+            "password": "%s"
-    "password": "%s"
+        }"""
-}
+        return self._post(endpoint or '/login', content_type="application/json",
-"""
-        return self._post(endpoint or '/login',
-                          content_type="application/json",
                           data=data % (email, password))
 
     def logout(self, endpoint=None):
         return self._get(endpoint or '/logout', follow_redirects=True)
 
     def assertIsHomePage(self, data):
-        self.assertIn('Home Page', data)
+        self.assertIn(b'Home Page', data)
 
     def assertIn(self, member, container, msg=None):
         if hasattr(TestCase, 'assertIn'):

tests/configured_tests.py

@@ -1,11 +1,21 @@
-from __future__ import with_statement
+# -*- coding: utf-8 -*-
+
+# from __future__ import with_statement
 
 import base64
 import time
 import simplejson as json
+import flask
+
+from flask_security.utils import capture_registrations, \
+    capture_reset_password_requests, capture_passwordless_login_requests
+from flask_security.forms import LoginForm, ConfirmRegisterForm, RegisterForm, \
+    ForgotPasswordForm, ResetPasswordForm, SendConfirmationForm, \
+    PasswordlessLoginForm
+from flask_security.forms import TextField, SubmitField, valid_user_email
+
+from flask_security.signals import user_registered
 
-from flask.ext.security.utils import capture_registrations, \
-     capture_reset_password_requests, capture_passwordless_login_requests
 
 from tests import SecurityTest
 
@@ -20,7 +30,7 @@ class ConfiguredPasswordHashSecurityTests(SecurityTest):
 
     def test_authenticate(self):
         r = self.authenticate(endpoint="/login")
-        self.assertIn('Home Page', r.data)
+        self.assertIn(b'Home Page', r.data)
 
 
 class ConfiguredSecurityTests(SecurityTest):
@@ -38,20 +48,20 @@ class ConfiguredSecurityTests(SecurityTest):
 
     def test_login_view(self):
         r = self._get('/custom_login')
-        self.assertIn("<h1>Login</h1>", r.data)
+        self.assertIn(b"<h1>Login</h1>", r.data)
 
     def test_authenticate(self):
         r = self.authenticate(endpoint="/custom_login")
-        self.assertIn('Post Login', r.data)
+        self.assertIn(b'Post Login', r.data)
 
     def test_logout(self):
         self.authenticate(endpoint="/custom_login")
         r = self.logout(endpoint="/custom_logout")
-        self.assertIn('Post Logout', r.data)
+        self.assertIn(b'Post Logout', r.data)
 
     def test_register_view(self):
         r = self._get('/register')
-        self.assertIn('<h1>Register</h1>', r.data)
+        self.assertIn(b'<h1>Register</h1>', r.data)
 
     def test_register(self):
         data = dict(email='dude@lp.com',
@@ -59,10 +69,18 @@ class ConfiguredSecurityTests(SecurityTest):
                     password_confirm='password')
 
         r = self._post('/register', data=data, follow_redirects=True)
-        self.assertIn('Post Register', r.data)
+        self.assertIn(b'Post Register', r.data)
+
+    def test_register_with_next_querystring_argument(self):
+        data = dict(email='dude@lp.com',
+                    password='password',
+                    password_confirm='password')
+
+        r = self._post('/register?next=/page1', data=data, follow_redirects=True)
+        self.assertIn(b'Page 1', r.data)
 
     def test_register_json(self):
-        data = '{ "email": "dude@lp.com", "password": "password" }'
+        data = '{ "email": "dude@lp.com", "password": "password"}'
         r = self._post('/register', data=data, content_type='application/json')
         data = json.loads(r.data)
         self.assertEquals(data['meta']['code'], 200)
@@ -72,20 +90,20 @@ class ConfiguredSecurityTests(SecurityTest):
                     password='password',
                     password_confirm='password')
         r = self._post('/register', data=data, follow_redirects=True)
-        msg = 'matt@lp.com is already associated with an account'
+        msg = b'matt@lp.com is already associated with an account'
         self.assertIn(msg, r.data)
 
     def test_unauthorized(self):
         self.authenticate("joe@lp.com", endpoint="/custom_auth")
         r = self._get("/admin", follow_redirects=True)
-        msg = 'You are not allowed to access the requested resouce'
+        msg = b'You are not allowed to access the requested resouce'
         self.assertIn(msg, r.data)
 
     def test_default_http_auth_realm(self):
         r = self._get('/http', headers={
-            'Authorization': 'Basic ' + base64.b64encode("joe@lp.com:bogus")
+            'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus")
         })
-        self.assertIn('<h1>Unauthorized</h1>', r.data)
+        self.assertIn(b'<h1>Unauthorized</h1>', r.data)
         self.assertIn('WWW-Authenticate', r.headers)
         self.assertEquals('Basic realm="Custom Realm"',
                           r.headers['WWW-Authenticate'])
@@ -102,6 +120,77 @@ class BadConfiguredSecurityTests(SecurityTest):
         self.assertRaises(RuntimeError, self.authenticate)
 
 
+class DefaultTemplatePathTests(SecurityTest):
+    AUTH_CONFIG = {
+        'SECURITY_LOGIN_USER_TEMPLATE': 'custom_security/login_user.html',
+    }
+
+    def test_login_user_template(self):
+        r = self._get('/login')
+
+        self.assertIn(b'CUSTOM LOGIN USER', r.data)
+
+
+class RegisterableTemplatePathTests(SecurityTest):
+    AUTH_CONFIG = {
+        'SECURITY_REGISTERABLE': True,
+        'SECURITY_REGISTER_USER_TEMPLATE': 'custom_security/register_user.html'
+    }
+
+    def test_register_user_template(self):
+        r = self._get('/register')
+
+        self.assertIn(b'CUSTOM REGISTER USER', r.data)
+
+
+class RecoverableTemplatePathTests(SecurityTest):
+    AUTH_CONFIG = {
+        'SECURITY_RECOVERABLE': True,
+        'SECURITY_FORGOT_PASSWORD_TEMPLATE': 'custom_security/forgot_password.html',
+        'SECURITY_RESET_PASSWORD_TEMPLATE': 'custom_security/reset_password.html',
+    }
+
+    def test_forgot_password_template(self):
+        r = self._get('/reset')
+
+        self.assertIn(b'CUSTOM FORGOT PASSWORD', r.data)
+
+    def test_reset_password_template(self):
+        with capture_reset_password_requests() as requests:
+            r = self._post('/reset', data=dict(email='joe@lp.com'),
+                           follow_redirects=True)
+
+            t = requests[0]['token']
+
+        r = self._get('/reset/' + t)
+
+        self.assertIn(b'CUSTOM RESET PASSWORD', r.data)
+
+
+class ConfirmableTemplatePathTests(SecurityTest):
+    AUTH_CONFIG = {
+        'SECURITY_CONFIRMABLE': True,
+        'SECURITY_SEND_CONFIRMATION_TEMPLATE': 'custom_security/send_confirmation.html'
+    }
+
+    def test_send_confirmation_template(self):
+        r = self._get('/confirm')
+
+        self.assertIn(b'CUSTOM SEND CONFIRMATION', r.data)
+
+
+class PasswordlessTemplatePathTests(SecurityTest):
+    AUTH_CONFIG = {
+        'SECURITY_PASSWORDLESS': True,
+        'SECURITY_SEND_LOGIN_TEMPLATE': 'custom_security/send_login.html'
+    }
+
+    def test_send_login_template(self):
+        r = self._get('/login')
+
+        self.assertIn(b'CUSTOM SEND LOGIN', r.data)
+
+
 class RegisterableTests(SecurityTest):
     AUTH_CONFIG = {
         'SECURITY_REGISTERABLE': True,
@@ -112,9 +201,9 @@ class RegisterableTests(SecurityTest):
         data = dict(email='dude@lp.com',
                     password='password',
                     password_confirm='password')
-        self.client.post('/register', data=data, follow_redirects=True)
+        self._post('/register', data=data, follow_redirects=True)
         r = self.authenticate('dude@lp.com')
-        self.assertIn('Hello dude@lp.com', r.data)
+        self.assertIn(b'Hello dude@lp.com', r.data)
 
 
 class ConfirmableTests(SecurityTest):
@@ -129,19 +218,20 @@ class ConfirmableTests(SecurityTest):
         e = 'dude@lp.com'
         self.register(e)
         r = self.authenticate(email=e)
-        self.assertIn(self.get_message('CONFIRMATION_REQUIRED'), r.data)
+        self.assertIn(self.get_message('CONFIRMATION_REQUIRED').encode('utf-8'), r.data)
 
     def test_send_confirmation_of_already_confirmed_account(self):
         e = 'dude@lp.com'
 
         with capture_registrations() as registrations:
-            self.register(e)
+            r = self.register(e)
             token = registrations[0]['confirm_token']
 
         self.client.get('/confirm/' + token, follow_redirects=True)
         self.logout()
-        r = self.client.post('/confirm', data=dict(email=e))
+        r = self._post('/confirm', data=dict(email=e))
-        self.assertIn(self.get_message('ALREADY_CONFIRMED'), r.data)
+        m = self.get_message('ALREADY_CONFIRMED')
+        self.assertIn(m.encode('utf-8'), r.data)
 
     def test_register_sends_confirmation_email(self):
         e = 'dude@lp.com'
@@ -154,18 +244,22 @@ class ConfirmableTests(SecurityTest):
     def test_confirm_email(self):
         e = 'dude@lp.com'
 
-        with capture_registrations() as registrations:
+        tokens = []
-            self.register(e)
+        def on_registered(sender, **kwargs):
-            token = registrations[0]['confirm_token']
+            tokens.append(kwargs['confirm_token'])
 
-        r = self.client.get('/confirm/' + token, follow_redirects=True)
+        user_registered.connect(on_registered, self.app)
 
+        r = self.register(e)
+        self.assertEqual(len(tokens), 1)
+        r = self.client.get('/confirm/' + tokens[0], follow_redirects=True)
         msg = self.app.config['SECURITY_MSG_EMAIL_CONFIRMED'][0]
-        self.assertIn(msg, r.data)
+        self.assertIn(msg.encode('utf-8'), r.data)
 
     def test_invalid_token_when_confirming_email(self):
         r = self.client.get('/confirm/bogus', follow_redirects=True)
-        self.assertIn('Invalid confirmation token', r.data)
+        msg = self.app.config['SECURITY_MSG_INVALID_CONFIRMATION_TOKEN'][0]
+        self.assertIn(msg.encode('utf-8'), r.data)
 
     def test_send_confirmation_json(self):
         r = self._post('/confirm', data='{"email": "matt@lp.com"}',
@@ -174,16 +268,34 @@ class ConfirmableTests(SecurityTest):
 
     def test_send_confirmation_with_invalid_email(self):
         r = self._post('/confirm', data=dict(email='bogus@bogus.com'))
-        self.assertIn('Specified user does not exist', r.data)
+        msg = self.app.config['SECURITY_MSG_USER_DOES_NOT_EXIST'][0]
+        self.assertIn(msg.encode('utf-8'), r.data)
 
     def test_resend_confirmation(self):
         e = 'dude@lp.com'
         self.register(e)
         r = self._post('/confirm', data={'email': e})
 
-        msg = self.get_message('CONFIRMATION_REQUEST', email=e)
+        msg = self.get_message('CONFIRMATION_REQUEST', email=e).encode('utf-8')
         self.assertIn(msg, r.data)
 
+    def test_user_deleted_before_confirmation(self):
+        e = 'dude@lp.com'
+
+        with capture_registrations() as registrations:
+            self.register(e)
+            user = registrations[0]['user']
+            token = registrations[0]['confirm_token']
+
+        with self.app.app_context():
+            from flask_security.core import _security
+            _security.datastore.delete(user)
+            _security.datastore.commit()
+
+        r = self.client.get('/confirm/' + token, follow_redirects=True)
+        msg = self.app.config['SECURITY_MSG_INVALID_CONFIRMATION_TOKEN'][0]
+        self.assertIn(msg.encode('utf-8'), r.data)
+
 
 class ExpiredConfirmationTest(SecurityTest):
     AUTH_CONFIG = {
@@ -211,7 +323,7 @@ class ExpiredConfirmationTest(SecurityTest):
             expire_text = self.AUTH_CONFIG['SECURITY_CONFIRM_EMAIL_WITHIN']
             msg = self.app.config['SECURITY_MSG_CONFIRMATION_EXPIRED'][0]
             msg = msg % dict(within=expire_text, email=e)
-            self.assertIn(msg, r.data)
+            self.assertIn(msg.encode('utf-8'), r.data)
 
 
 class LoginWithoutImmediateConfirmTests(SecurityTest):
@@ -226,8 +338,36 @@ class LoginWithoutImmediateConfirmTests(SecurityTest):
         e = 'dude@lp.com'
         p = 'password'
         data = dict(email=e, password=p, password_confirm=p)
-        r = self.client.post('/register', data=data, follow_redirects=True)
+        r = self._post('/register', data=data, follow_redirects=True)
-        self.assertIn(e, r.data)
+        self.assertIn(e.encode('utf-8'), r.data)
+
+    def test_confirm_email_of_user_different_than_current_user(self):
+        e1 = 'dude@lp.com'
+        e2 = 'lady@lp.com'
+
+        with capture_registrations() as registrations:
+            self.register(e1)
+            self.register(e2)
+            token1 = registrations[0]['confirm_token']
+            token2 = registrations[1]['confirm_token']
+
+        self.client.get('/confirm/' + token1, follow_redirects=True)
+        self.client.get('/logout')
+        self.authenticate(email=e1)
+        r = self.client.get('/confirm/' + token2, follow_redirects=True)
+        m = self.app.config['SECURITY_MSG_EMAIL_CONFIRMED'][0]
+        self.assertIn(m.encode('utf-8'), r.data)
+        self.assertIn(b'Hello lady@lp.com', r.data)
+
+    def test_login_unconfirmed_user_when_login_without_confirmation_is_true(self):
+        e = 'dude@lp.com'
+        p = 'password'
+        data = dict(email=e, password=p, password_confirm=p)
+        r = self._post('/register', data=data, follow_redirects=True)
+        self.assertIn(e.encode('utf-8'), r.data)
+        self.client.get('/logout')
+        r = self.authenticate(email=e)
+        self.assertIn(e.encode('utf-8'), r.data)
 
 
 class RecoverableTests(SecurityTest):
@@ -240,35 +380,32 @@ class RecoverableTests(SecurityTest):
 
     def test_reset_view(self):
         with capture_reset_password_requests() as requests:
-            r = self.client.post('/reset',
+            r = self._post('/reset', data=dict(email='joe@lp.com'),
-                                 data=dict(email='joe@lp.com'),
+                           follow_redirects=True)
-                                 follow_redirects=True)
             t = requests[0]['token']
         r = self._get('/reset/' + t)
-        self.assertIn('<h1>Reset password</h1>', r.data)
+        self.assertIn(b'<h1>Reset password</h1>', r.data)
 
     def test_forgot_post_sends_email(self):
         with capture_reset_password_requests():
             with self.app.extensions['mail'].record_messages() as outbox:
-                self.client.post('/reset', data=dict(email='joe@lp.com'))
+                self._post('/reset', data=dict(email='joe@lp.com'))
                 self.assertEqual(len(outbox), 1)
 
     def test_forgot_password_json(self):
-        r = self.client.post('/reset', data='{"email": "matt@lp.com"}',
+        r = self._post('/reset', data='{"email": "matt@lp.com"}',
-                             content_type="application/json")
+                       content_type="application/json")
         self.assertEquals(r.status_code, 200)
 
     def test_forgot_password_invalid_email(self):
-        r = self.client.post('/reset',
+        r = self._post('/reset', data=dict(email='larry@lp.com'),
-                             data=dict(email='larry@lp.com'),
+                       follow_redirects=True)
-                             follow_redirects=True)
+        self.assertIn(b"Specified user does not exist", r.data)
-        self.assertIn("Specified user does not exist", r.data)
 
     def test_reset_password_with_valid_token(self):
         with capture_reset_password_requests() as requests:
-            r = self.client.post('/reset',
+            r = self._post('/reset', data=dict(email='joe@lp.com'),
-                                 data=dict(email='joe@lp.com'),
+                           follow_redirects=True)
-                                 follow_redirects=True)
             t = requests[0]['token']
 
         r = self._post('/reset/' + t, data={
@@ -278,15 +415,15 @@ class RecoverableTests(SecurityTest):
 
         r = self.logout()
         r = self.authenticate('joe@lp.com', 'newpassword')
-        self.assertIn('Hello joe@lp.com', r.data)
+        self.assertIn(b'Hello joe@lp.com', r.data)
 
     def test_reset_password_with_invalid_token(self):
         r = self._post('/reset/bogus', data={
             'password': 'newpassword',
             'password_confirm': 'newpassword'
         }, follow_redirects=True)
-
+        m = self.get_message('INVALID_RESET_PASSWORD_TOKEN')
-        self.assertIn(self.get_message('INVALID_RESET_PASSWORD_TOKEN'), r.data)
+        self.assertIn(m.encode('utf-8'), r.data)
 
 
 class ExpiredResetPasswordTest(SecurityTest):
@@ -298,19 +435,142 @@ class ExpiredResetPasswordTest(SecurityTest):
 
     def test_reset_password_with_expired_token(self):
         with capture_reset_password_requests() as requests:
-            r = self.client.post('/reset',
+            r = self._post('/reset', data=dict(email='joe@lp.com'),
-                                 data=dict(email='joe@lp.com'),
+                           follow_redirects=True)
-                                 follow_redirects=True)
             t = requests[0]['token']
 
         time.sleep(1)
 
-        r = self.client.post('/reset/' + t, data={
+        r = self._post('/reset/' + t, data={
             'password': 'newpassword',
             'password_confirm': 'newpassword'
         }, follow_redirects=True)
 
-        self.assertIn('You did not reset your password within', r.data)
+        self.assertIn(b'You did not reset your password within', r.data)
+
+
+class ChangePasswordTest(SecurityTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_RECOVERABLE': True,
+        'SECURITY_CHANGEABLE': True,
+    }
+
+    def test_change_password(self):
+        self.authenticate()
+        r = self.client.get('/change', follow_redirects=True)
+        self.assertIn(b'Change password', r.data)
+
+    def test_change_password_invalid(self):
+        self.authenticate()
+        r = self._post('/change', data={
+            'password': 'notpassword',
+            'new_password': 'newpassword',
+            'new_password_confirm': 'newpassword'
+        }, follow_redirects=True)
+        self.assertNotIn(b'You successfully changed your password', r.data)
+        self.assertIn(b'Invalid password', r.data)
+
+    def test_change_password_mismatch(self):
+        self.authenticate()
+        r = self._post('/change', data={
+            'password': 'password',
+            'new_password': 'newpassword',
+            'new_password_confirm': 'notnewpassword'
+        }, follow_redirects=True)
+        self.assertNotIn(b'You successfully changed your password', r.data)
+        self.assertIn(b'Passwords do not match', r.data)
+
+    def test_change_password_bad_password(self):
+        self.authenticate()
+        r = self._post('/change', data={
+            'password': 'password',
+            'new_password': 'a',
+            'new_password_confirm': 'a'
+        }, follow_redirects=True)
+        self.assertNotIn(b'You successfully changed your password', r.data)
+        self.assertIn(b'Password must be at least 6 characters', r.data)
+
+    def test_change_password_same_as_previous(self):
+        self.authenticate()
+        r = self._post('/change', data={
+            'password': 'password',
+            'new_password': 'password',
+            'new_password_confirm': 'password'
+        }, follow_redirects=True)
+        self.assertNotIn(b'You successfully changed your password', r.data)
+        self.assertIn(b'Your new password must be different than your previous password.', r.data)
+
+    def test_change_password_success(self):
+        data = {
+            'password': 'password',
+            'new_password': 'newpassword',
+            'new_password_confirm': 'newpassword'
+        }
+
+        self.authenticate()
+        with self.app.extensions['mail'].record_messages() as outbox:
+            r = self._post('/change', data=data, follow_redirects=True)
+
+        self.assertIn(b'You successfully changed your password', r.data)
+        self.assertIn(b'Home Page', r.data)
+
+        self.assertEqual(len(outbox), 1)
+        self.assertIn("Your password has been changed", outbox[0].html)
+        self.assertIn("/reset", outbox[0].html)
+
+
+class EmailConfigTest(SecurityTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_SEND_REGISTER_EMAIL': False,
+        'SECURITY_SEND_PASSWORD_CHANGE_EMAIL': False,
+    }
+
+    def test_change_password_success_email_option(self):
+        """Test the change password email can be turned off w/ configuration."""
+
+        data = {
+            'password': 'password',
+            'new_password': 'newpassword',
+            'new_password_confirm': 'newpassword'
+        }
+
+        self.authenticate()
+        with self.app.extensions['mail'].record_messages() as outbox:
+            self._post('/change', data=data, follow_redirects=True)
+        self.assertEqual(len(outbox), 0)
+
+
+class ChangePasswordPostViewTest(SecurityTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_CHANGEABLE': True,
+        'SECURITY_POST_CHANGE_VIEW': '/profile',
+    }
+
+    def test_change_password_success(self):
+        data = {
+            'password': 'password',
+            'new_password': 'newpassword',
+            'new_password_confirm': 'newpassword'
+        }
+        self.authenticate()
+        r = self._post('/change', data=data, follow_redirects=True)
+
+        self.assertIn(b'Profile Page', r.data)
+
+
+class ChangePasswordDisabledTest(SecurityTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_CHANGEABLE': False,
+    }
+
+    def test_change_password_endpoint_is_404(self):
+        self.authenticate()
+        r = self.client.get('/change', follow_redirects=True)
+        self.assertEqual(404, r.status_code)
 
 
 class TrackableTests(SecurityTest):
@@ -343,21 +603,20 @@ class PasswordlessTests(SecurityTest):
 
     def test_login_request_for_inactive_user(self):
         msg = self.app.config['SECURITY_MSG_DISABLED_ACCOUNT'][0]
-        r = self.client.post('/login',
+        r = self._post('/login', data=dict(email='tiya@lp.com'),
-                             data=dict(email='tiya@lp.com'),
+                       follow_redirects=True)
-                             follow_redirects=True)
+        self.assertIn(msg.encode('utf-8'), r.data)
-        self.assertIn(msg, r.data)
 
     def test_request_login_token_with_json_and_valid_email(self):
         data = '{"email": "matt@lp.com", "password": "password"}'
-        r = self.client.post('/login', data=data, content_type='application/json')
+        r = self._post('/login', data=data, content_type='application/json')
         self.assertEquals(r.status_code, 200)
-        self.assertNotIn('error', r.data)
+        self.assertNotIn(b'error', r.data)
 
     def test_request_login_token_with_json_and_invalid_email(self):
         data = '{"email": "nobody@lp.com", "password": "password"}'
-        r = self.client.post('/login', data=data, content_type='application/json')
+        r = self._post('/login', data=data, content_type='application/json')
-        self.assertIn('errors', r.data)
+        self.assertIn(b'errors', r.data)
 
     def test_request_login_token_sends_email_and_can_login(self):
         e = 'matt@lp.com'
@@ -365,9 +624,8 @@ class PasswordlessTests(SecurityTest):
 
         with capture_passwordless_login_requests() as requests:
             with self.app.extensions['mail'].record_messages() as outbox:
-                r = self.client.post('/login',
+                r = self._post('/login', data=dict(email=e),
-                                     data=dict(email=e),
+                               follow_redirects=True)
-                                     follow_redirects=True)
 
                 self.assertEqual(len(outbox), 1)
 
@@ -380,38 +638,37 @@ class PasswordlessTests(SecurityTest):
 
         msg = self.app.config['SECURITY_MSG_LOGIN_EMAIL_SENT'][0]
         msg = msg % dict(email=user.email)
-        self.assertIn(msg, r.data)
+        self.assertIn(msg.encode('utf-8'), r.data)
 
         r = self.client.get('/login/' + token, follow_redirects=True)
-        msg = self.get_message('PASSWORDLESS_LOGIN_SUCCESSFUL')
+        msg = self.get_message('PASSWORDLESS_LOGIN_SUCCESSFUL').encode('utf-8')
         self.assertIn(msg, r.data)
 
         r = self.client.get('/profile')
-        self.assertIn('Profile Page', r.data)
+        self.assertIn(b'Profile Page', r.data)
 
     def test_invalid_login_token(self):
-        msg = self.app.config['SECURITY_MSG_INVALID_LOGIN_TOKEN'][0]
+        m = self.app.config['SECURITY_MSG_INVALID_LOGIN_TOKEN'][0]
         r = self._get('/login/bogus', follow_redirects=True)
-        self.assertIn(msg, r.data)
+        self.assertIn(m.encode('utf-8'), r.data)
 
     def test_token_login_when_already_authenticated(self):
         with capture_passwordless_login_requests() as requests:
-            self.client.post('/login',
+            self._post('/login', data=dict(email='matt@lp.com'),
-                             data=dict(email='matt@lp.com'),
+                       follow_redirects=True)
-                             follow_redirects=True)
             token = requests[0]['login_token']
 
         r = self.client.get('/login/' + token, follow_redirects=True)
         msg = self.get_message('PASSWORDLESS_LOGIN_SUCCESSFUL')
-        self.assertIn(msg, r.data)
+        self.assertIn(msg.encode('utf-8'), r.data)
 
         r = self.client.get('/login/' + token, follow_redirects=True)
         msg = self.get_message('PASSWORDLESS_LOGIN_SUCCESSFUL')
-        self.assertNotIn(msg, r.data)
+        self.assertNotIn(msg.encode('utf-8'), r.data)
 
     def test_send_login_with_invalid_email(self):
         r = self._post('/login', data=dict(email='bogus@bogus.com'))
-        self.assertIn('Specified user does not exist', r.data)
+        self.assertIn(b'Specified user does not exist', r.data)
 
 
 class ExpiredLoginTokenTests(SecurityTest):
@@ -426,9 +683,7 @@ class ExpiredLoginTokenTests(SecurityTest):
         e = 'matt@lp.com'
 
         with capture_passwordless_login_requests() as requests:
-            self.client.post('/login',
+            self._post('/login', data=dict(email=e), follow_redirects=True)
-                             data=dict(email=e),
-                             follow_redirects=True)
             token = requests[0]['login_token']
 
         time.sleep(1.25)
@@ -439,8 +694,7 @@ class ExpiredLoginTokenTests(SecurityTest):
             expire_text = self.AUTH_CONFIG['SECURITY_LOGIN_WITHIN']
             msg = self.app.config['SECURITY_MSG_LOGIN_EXPIRED'][0]
             msg = msg % dict(within=expire_text, email=e)
-            self.assertIn(msg, r.data)
+            self.assertIn(msg.encode('utf-8'), r.data)
-
             self.assertEqual(len(outbox), 1)
             self.assertIn(e, outbox[0].html)
             self.assertNotIn(token, outbox[0].html)
@@ -462,24 +716,139 @@ class AsyncMailTaskTests(SecurityTest):
         def send_email(msg):
             self.mail_sent = True
 
-        self.client.post('/reset', data=dict(email='matt@lp.com'))
+        self._post('/reset', data=dict(email='matt@lp.com'))
         self.assertTrue(self.mail_sent)
 
 
 class NoBlueprintTests(SecurityTest):
 
+    APP_KWARGS = {
+        'register_blueprint': False,
+    }
+
     AUTH_CONFIG = {
         'USER_COUNT': 1
     }
 
-    def _create_app(self, auth_config):
-        return super(NoBlueprintTests, self)._create_app(auth_config, False)
-
     def test_login_endpoint_is_404(self):
         r = self._get('/login')
         self.assertEqual(404, r.status_code)
 
     def test_http_auth_without_blueprint(self):
-        auth = 'Basic ' + base64.b64encode("matt@lp.com:password")
+        auth = base64.b64encode(b"matt@lp.com:password").decode('utf-8')
-        r = self._get('/http', headers={'Authorization': auth})
+        r = self._get('/http', headers={'Authorization': 'basic %s' % auth})
-        self.assertIn('HTTP Authentication', r.data)
+        self.assertIn(b'HTTP Authentication', r.data)
+
+
+class ExtendFormsTest(SecurityTest):
+
+    class MyLoginForm(LoginForm):
+        email = TextField('My Login Email Address Field')
+
+    class MyRegisterForm(RegisterForm):
+        email = TextField('My Register Email Address Field')
+
+    APP_KWARGS = {
+        'login_form': MyLoginForm,
+        'register_form': MyRegisterForm,
+    }
+
+    AUTH_CONFIG = {
+        'SECURITY_CONFIRMABLE': False,
+        'SECURITY_REGISTERABLE': True,
+    }
+
+    def test_login_view(self):
+        r = self._get('/login', follow_redirects=True)
+        self.assertIn(b"My Login Email Address Field", r.data)
+
+    def test_register(self):
+        r = self._get('/register', follow_redirects=True)
+        self.assertIn(b"My Register Email Address Field", r.data)
+
+
+class RecoverableExtendFormsTest(SecurityTest):
+
+    class MyForgotPasswordForm(ForgotPasswordForm):
+        email = TextField('My Forgot Password Email Address Field',
+                          validators=[valid_user_email])
+
+    class MyResetPasswordForm(ResetPasswordForm):
+        submit = SubmitField("My Reset Password Submit Field")
+
+    APP_KWARGS = {
+        'forgot_password_form': MyForgotPasswordForm,
+        'reset_password_form': MyResetPasswordForm,
+    }
+
+    AUTH_CONFIG = {
+        'SECURITY_RECOVERABLE': True,
+    }
+
+    def test_forgot_password(self):
+        r = self._get('/reset', follow_redirects=True)
+        self.assertIn(b"My Forgot Password Email Address Field", r.data)
+
+    def test_reset_password(self):
+        with capture_reset_password_requests() as requests:
+            self._post('/reset', data=dict(email='joe@lp.com'),
+                       follow_redirects=True)
+            token = requests[0]['token']
+        r = self._get('/reset/' + token)
+        self.assertIn(b"My Reset Password Submit Field", r.data)
+
+
+class PasswordlessExtendFormsTest(SecurityTest):
+
+    class MyPasswordlessLoginForm(PasswordlessLoginForm):
+        email = TextField('My Passwordless Login Email Address Field')
+
+    APP_KWARGS = {
+        'passwordless_login_form': MyPasswordlessLoginForm,
+    }
+
+    AUTH_CONFIG = {
+        'SECURITY_PASSWORDLESS': True,
+    }
+
+    def test_passwordless_login(self):
+        r = self._get('/login', follow_redirects=True)
+        self.assertIn(b"My Passwordless Login Email Address Field", r.data)
+
+
+class ConfirmableExtendFormsTest(SecurityTest):
+
+    class MyConfirmRegisterForm(ConfirmRegisterForm):
+        email = TextField('My Confirm Register Email Address Field')
+
+    class MySendConfirmationForm(SendConfirmationForm):
+        email = TextField('My Send Confirmation Email Address Field')
+
+    APP_KWARGS = {
+        'confirm_register_form': MyConfirmRegisterForm,
+        'send_confirmation_form': MySendConfirmationForm,
+    }
+
+    AUTH_CONFIG = {
+        'SECURITY_CONFIRMABLE': True,
+        'SECURITY_REGISTERABLE': True,
+    }
+
+    def test_register(self):
+        r = self._get('/register', follow_redirects=True)
+        self.assertIn(b"My Confirm Register Email Address Field", r.data)
+
+    def test_send_confirmation(self):
+        r = self._get('/confirm', follow_redirects=True)
+        self.assertIn(b"My Send Confirmation Email Address Field", r.data)
+
+
+class AdditionalUserIdentityAttributes(SecurityTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_USER_IDENTITY_ATTRIBUTES': ('email', 'username')
+    }
+
+    def test_authenticate(self):
+        r = self.authenticate(email='matt')
+        self.assertIn(b'Hello matt@lp.com', r.data)

tests/functional_tests.py

@@ -4,7 +4,11 @@ from __future__ import with_statement
 
 import base64
 import simplejson as json
-from cookielib import Cookie
+
+try:
+    from cookielib import Cookie
+except ImportError:
+    from http.cookiejar import Cookie
 
 from werkzeug.utils import parse_cookie
 
@@ -27,31 +31,35 @@ class DefaultSecurityTests(SecurityTest):
 
     def test_login_view(self):
         r = self._get('/login')
-        self.assertIn('<h1>Login</h1>', r.data)
+        self.assertIn(b'<h1>Login</h1>', r.data)
 
     def test_authenticate(self):
         r = self.authenticate()
-        self.assertIn('Hello matt@lp.com', r.data)
+        self.assertIn(b'Hello matt@lp.com', r.data)
+
+    def test_authenticate_case_insensitive_email(self):
+        r = self.authenticate(email='MATT@lp.com')
+        self.assertIn(b'Hello matt@lp.com', r.data)
 
     def test_unprovided_username(self):
         r = self.authenticate("")
-        self.assertIn("Email not provided", r.data)
+        self.assertIn(self.get_message('EMAIL_NOT_PROVIDED').encode('utf-8'), r.data)
 
     def test_unprovided_password(self):
         r = self.authenticate(password="")
-        self.assertIn("Password not provided", r.data)
+        self.assertIn(self.get_message('PASSWORD_NOT_PROVIDED').encode('utf-8'), r.data)
 
     def test_invalid_user(self):
         r = self.authenticate(email="bogus@bogus.com")
-        self.assertIn("Specified user does not exist", r.data)
+        self.assertIn(self.get_message('USER_DOES_NOT_EXIST').encode('utf-8'), r.data)
 
     def test_bad_password(self):
         r = self.authenticate(password="bogus")
-        self.assertIn("Invalid password", r.data)
+        self.assertIn(self.get_message('INVALID_PASSWORD').encode('utf-8'), r.data)
 
     def test_inactive_user(self):
         r = self.authenticate("tiya@lp.com", "password")
-        self.assertIn("Account is disabled", r.data)
+        self.assertIn(self.get_message('DISABLED_ACCOUNT').encode('utf-8'), r.data)
 
     def test_logout(self):
         self.authenticate()
@@ -59,18 +67,19 @@ class DefaultSecurityTests(SecurityTest):
         self.assertIsHomePage(r.data)
 
     def test_unauthorized_access(self):
+        self.logout()
         r = self._get('/profile', follow_redirects=True)
-        self.assertIn('Please log in to access this page', r.data)
+        self.assertIn(b'<li class="info">Please log in to access this page.</li>', r.data)
 
     def test_authorized_access(self):
         self.authenticate()
         r = self._get("/profile")
-        self.assertIn('profile', r.data)
+        self.assertIn(b'profile', r.data)
 
     def test_valid_admin_role(self):
         self.authenticate()
         r = self._get("/admin")
-        self.assertIn('Admin Page', r.data)
+        self.assertIn(b'Admin Page', r.data)
 
     def test_invalid_admin_role(self):
         self.authenticate("joe@lp.com")
@@ -81,7 +90,7 @@ class DefaultSecurityTests(SecurityTest):
         for user in ("matt@lp.com", "joe@lp.com"):
             self.authenticate(user)
             r = self._get("/admin_or_editor")
-            self.assertIn('Admin or Editor Page', r.data)
+            self.assertIn(b'Admin or Editor Page', r.data)
             self.logout()
 
         self.authenticate("jill@lp.com")
@@ -90,7 +99,7 @@ class DefaultSecurityTests(SecurityTest):
 
     def test_unauthenticated_role_required(self):
         r = self._get('/admin', follow_redirects=True)
-        self.assertIn(self.get_message('UNAUTHORIZED'), r.data)
+        self.assertIn(self.get_message('UNAUTHORIZED').encode('utf-8'), r.data)
 
     def test_multiple_role_required(self):
         for user in ("matt@lp.com", "joe@lp.com"):
@@ -101,7 +110,7 @@ class DefaultSecurityTests(SecurityTest):
 
         self.authenticate('dave@lp.com')
         r = self._get("/admin_and_editor", follow_redirects=True)
-        self.assertIn('Admin and Editor Page', r.data)
+        self.assertIn(b'Admin and Editor Page', r.data)
 
     def test_ok_json_auth(self):
         r = self.json_authenticate()
@@ -111,14 +120,14 @@ class DefaultSecurityTests(SecurityTest):
 
     def test_invalid_json_auth(self):
         r = self.json_authenticate(password='junk')
-        self.assertIn('"code": 400', r.data)
+        self.assertIn(b'"code": 400', r.data)
 
     def test_token_auth_via_querystring_valid_token(self):
         r = self.json_authenticate()
         data = json.loads(r.data)
         token = data['response']['user']['authentication_token']
         r = self._get('/token?auth_token=' + token)
-        self.assertIn('Token Authentication', r.data)
+        self.assertIn(b'Token Authentication', r.data)
 
     def test_token_auth_via_header_valid_token(self):
         r = self.json_authenticate()
@@ -126,7 +135,7 @@ class DefaultSecurityTests(SecurityTest):
         token = data['response']['user']['authentication_token']
         headers = {"Authentication-Token": token}
         r = self._get('/token', headers=headers)
-        self.assertIn('Token Authentication', r.data)
+        self.assertIn(b'Token Authentication', r.data)
 
     def test_token_auth_via_querystring_invalid_token(self):
         r = self._get('/token?auth_token=X')
@@ -138,37 +147,62 @@ class DefaultSecurityTests(SecurityTest):
 
     def test_http_auth(self):
         r = self._get('/http', headers={
-            'Authorization': 'Basic ' + base64.b64encode("joe@lp.com:password")
+            'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:password").decode('utf-8')
         })
-        self.assertIn('HTTP Authentication', r.data)
+        self.assertIn(b'HTTP Authentication', r.data)
+
+    def test_http_auth_no_authorization(self):
+        r = self._get('/http', headers={})
+        self.assertIn(b'<h1>Unauthorized</h1>', r.data)
+        self.assertIn('WWW-Authenticate', r.headers)
+        self.assertEquals('Basic realm="Login Required"',
+                          r.headers['WWW-Authenticate'])
 
     def test_invalid_http_auth_invalid_username(self):
         r = self._get('/http', headers={
-            'Authorization': 'Basic ' + base64.b64encode("bogus:bogus")
+            'Authorization': 'Basic %s' % base64.b64encode(b"bogus:bogus").decode('utf-8')
         })
-        self.assertIn('<h1>Unauthorized</h1>', r.data)
+        self.assertIn(b'<h1>Unauthorized</h1>', r.data)
         self.assertIn('WWW-Authenticate', r.headers)
         self.assertEquals('Basic realm="Login Required"',
                           r.headers['WWW-Authenticate'])
 
     def test_invalid_http_auth_bad_password(self):
         r = self._get('/http', headers={
-            'Authorization': 'Basic ' + base64.b64encode("joe@lp.com:bogus")
+            'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus").decode('utf-8')
         })
-        self.assertIn('<h1>Unauthorized</h1>', r.data)
+        self.assertIn(b'<h1>Unauthorized</h1>', r.data)
         self.assertIn('WWW-Authenticate', r.headers)
         self.assertEquals('Basic realm="Login Required"',
                           r.headers['WWW-Authenticate'])
 
     def test_custom_http_auth_realm(self):
         r = self._get('/http_custom_realm', headers={
-            'Authorization': 'Basic ' + base64.b64encode("joe@lp.com:bogus")
+            'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus").decode('utf-8')
         })
-        self.assertIn('<h1>Unauthorized</h1>', r.data)
+        self.assertIn(b'<h1>Unauthorized</h1>', r.data)
         self.assertIn('WWW-Authenticate', r.headers)
         self.assertEquals('Basic realm="My Realm"',
                           r.headers['WWW-Authenticate'])
 
+    def test_multi_auth_basic(self):
+        r = self._get('/multi_auth', headers={
+            'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:password").decode('utf-8')
+        })
+        self.assertIn(b'Basic', r.data)
+
+    def test_multi_auth_token(self):
+        r = self.json_authenticate()
+        data = json.loads(r.data)
+        token = data['response']['user']['authentication_token']
+        r = self._get('/multi_auth?auth_token=' + token)
+        self.assertIn(b'Token', r.data)
+
+    def test_multi_auth_session(self):
+        self.authenticate()
+        r = self._get('/multi_auth')
+        self.assertIn(b'Session', r.data)
+
     def test_user_deleted_during_session_reverts_to_anonymous_user(self):
         self.authenticate()
 
@@ -178,13 +212,13 @@ class DefaultSecurityTests(SecurityTest):
             self.app.security.datastore.commit()
 
         r = self._get('/')
-        self.assertNotIn('Hello matt@lp.com', r.data)
+        self.assertNotIn(b'Hello matt@lp.com', r.data)
 
     def test_remember_token(self):
         r = self.authenticate(follow_redirects=False)
         self.client.cookie_jar.clear_session_cookies()
         r = self._get('/profile')
-        self.assertIn('profile', r.data)
+        self.assertIn(b'profile', r.data)
 
     def test_token_loader_does_not_fail_with_invalid_token(self):
         c = Cookie(version=0, name='remember_token', value='None', port=None,
@@ -196,41 +230,48 @@ class DefaultSecurityTests(SecurityTest):
 
         self.client.cookie_jar.set_cookie(c)
         r = self._get('/')
-        self.assertNotIn('BadSignature', r.data)
+        self.assertNotIn(b'BadSignature', r.data)
 
 
 class MongoEngineSecurityTests(DefaultSecurityTests):
 
-    def _create_app(self, auth_config):
+    def _create_app(self, auth_config, **kwargs):
         from tests.test_app.mongoengine import create_app
-        return create_app(auth_config)
+        return create_app(auth_config, **kwargs)
+
+
+class PeeweeSecurityTests(DefaultSecurityTests):
+
+    def _create_app(self, auth_config, **kwargs):
+        from tests.test_app.peewee_app import create_app
+        return create_app(auth_config, **kwargs)
 
 
 class DefaultDatastoreTests(SecurityTest):
 
     def test_add_role_to_user(self):
         r = self._get('/coverage/add_role_to_user')
-        self.assertIn('success', r.data)
+        self.assertIn(b'success', r.data)
 
     def test_remove_role_from_user(self):
         r = self._get('/coverage/remove_role_from_user')
-        self.assertIn('success', r.data)
+        self.assertIn(b'success', r.data)
 
     def test_activate_user(self):
         r = self._get('/coverage/activate_user')
-        self.assertIn('success', r.data)
+        self.assertIn(b'success', r.data)
 
     def test_deactivate_user(self):
         r = self._get('/coverage/deactivate_user')
-        self.assertIn('success', r.data)
+        self.assertIn(b'success', r.data)
 
     def test_invalid_role(self):
         r = self._get('/coverage/invalid_role')
-        self.assertIn('success', r.data)
+        self.assertIn(b'success', r.data)
 
 
 class MongoEngineDatastoreTests(DefaultDatastoreTests):
 
-    def _create_app(self, auth_config):
+    def _create_app(self, auth_config, **kwargs):
         from tests.test_app.mongoengine import create_app
-        return create_app(auth_config)
+        return create_app(auth_config, **kwargs)

tests/signals_tests.py

@@ -0,0 +1,244 @@
+# -*- coding: utf-8 -*-
+
+from __future__ import with_statement
+
+from flask_security.utils import capture_registrations, \
+    capture_reset_password_requests, capture_signals
+from flask_security.signals import user_registered, user_confirmed, \
+    confirm_instructions_sent, login_instructions_sent, \
+    password_reset, password_changed, reset_password_instructions_sent
+from tests import SecurityTest
+
+
+def compare_user(a, b):
+    """Helper to compare two users."""
+    return a.id == b.id and a.email == b.email and a.password == b.password
+
+
+class SignalTest(SecurityTest):
+
+    def _create_app(self, auth_config, **kwargs):
+        from tests.test_app.mongoengine import create_app
+        return create_app(auth_config, **kwargs)
+
+
+class RegisterableSignalsTests(SignalTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_CONFIRMABLE': True,
+        'SECURITY_REGISTERABLE': True,
+    }
+
+    def test_register(self):
+        e = 'dude@lp.com'
+        with capture_signals() as mocks:
+            self.register(e)
+        user = self.app.security.datastore.find_user(email='dude@lp.com')
+        self.assertEqual(mocks.signals_sent(), set([user_registered]))
+        calls = mocks[user_registered]
+        self.assertEqual(len(calls), 1)
+        args, kwargs = calls[0]
+        self.assertTrue(compare_user(kwargs['user'], user))
+        self.assertIn('confirm_token', kwargs)
+        self.assertEqual(args[0], self.app)
+
+    def test_register_without_password(self):
+        e = 'dude@lp.com'
+        with capture_signals() as mocks:
+            self.register(e, password='')
+        self.assertEqual(mocks.signals_sent(), set())
+
+
+class ConfirmableSignalsTests(SignalTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_CONFIRMABLE': True,
+        'SECURITY_REGISTERABLE': True,
+    }
+
+    def test_confirm(self):
+        e = 'dude@lp.com'
+        with capture_registrations() as registrations:
+            self.register(e)
+            token = registrations[0]['confirm_token']
+        with capture_signals() as mocks:
+            self.client.get('/confirm/' + token, follow_redirects=True)
+        user = self.app.security.datastore.find_user(email='dude@lp.com')
+        self.assertTrue(mocks.signals_sent(), set([user_confirmed]))
+        calls = mocks[user_confirmed]
+        self.assertEqual(len(calls), 1)
+        args, kwargs = calls[0]
+        self.assertEqual(args[0], self.app)
+        self.assertTrue(compare_user(kwargs['user'], user))
+
+    def test_confirm_bad_token(self):
+        e = 'dude@lp.com'
+        with capture_registrations():
+            self.register(e)
+        with capture_signals() as mocks:
+            self.client.get('/confirm/bogus', follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+    def test_confirm_twice(self):
+        e = 'dude@lp.com'
+        with capture_registrations() as registrations:
+            self.register(e)
+            token = registrations[0]['confirm_token']
+        self.client.get('/confirm/' + token, follow_redirects=True)
+        self.logout()
+        with capture_signals() as mocks:
+            self.client.get('/confirm/' + token, follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set([user_confirmed]))
+        # TODO: is that the desired behaviour?
+
+    def test_resend_confirmation(self):
+        e = 'dude@lp.com'
+        self.register(e)
+        with capture_signals() as mocks:
+            self._post('/confirm', data={'email': e})
+        user = self.app.security.datastore.find_user(email='dude@lp.com')
+        self.assertEqual(mocks.signals_sent(), set([confirm_instructions_sent]))
+        calls = mocks[confirm_instructions_sent]
+        self.assertEqual(len(calls), 1)
+        args, kwargs = calls[0]
+        self.assertTrue(compare_user(kwargs['user'], user))
+        self.assertEqual(args[0], self.app)
+
+    def test_send_confirmation_bad_email(self):
+        with capture_signals() as mocks:
+            self._post('/confirm', data=dict(email='bogus@bogus.com'))
+        self.assertEqual(mocks.signals_sent(), set())
+
+
+class RecoverableSignalsTests(SignalTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_RECOVERABLE': True,
+        'SECURITY_RESET_PASSWORD_ERROR_VIEW': '/',
+        'SECURITY_POST_FORGOT_VIEW': '/'
+    }
+
+    def test_reset_password_request(self):
+        with capture_signals() as mocks:
+            self._post('/reset', data=dict(email='joe@lp.com'),
+                       follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set([reset_password_instructions_sent]))
+        user = self.app.security.datastore.find_user(email='joe@lp.com')
+        calls = mocks[reset_password_instructions_sent]
+        self.assertEqual(len(calls), 1)
+        args, kwargs = calls[0]
+        self.assertTrue(compare_user(kwargs['user'], user))
+        self.assertIn('token', kwargs)
+        self.assertEqual(args[0], self.app)
+
+    def test_reset_password(self):
+        with capture_reset_password_requests() as requests:
+            self._post('/reset', data=dict(email='joe@lp.com'),
+                       follow_redirects=True)
+            token = requests[0]['token']
+        with capture_signals() as mocks:
+            data = dict(password='newpassword', password_confirm='newpassword')
+            self._post('/reset/' + token, data, follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set([password_reset]))
+        user = self.app.security.datastore.find_user(email='joe@lp.com')
+        calls = mocks[password_reset]
+        self.assertEqual(len(calls), 1)
+        args, kwargs = calls[0]
+        self.assertTrue(compare_user(kwargs['user'], user))
+        self.assertEqual(args[0], self.app)
+
+    def test_reset_password_invalid_emails(self):
+        with capture_signals() as mocks:
+            self._post('/reset', data=dict(email='nobody@lp.com'),
+                       follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+    def test_reset_password_invalid_token(self):
+        with capture_signals() as mocks:
+            data = dict(password='newpassword', password_confirm='newpassword')
+            self._post('/reset/bogus', data, follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+
+class ChangeableSignalsTests(SignalTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_CHANGEABLE': True,
+    }
+
+    def test_change_password(self):
+        self.authenticate('joe@lp.com')
+        with capture_signals() as mocks:
+            with self.client as client:
+                client.post('/change',
+                            data=dict(password='password',
+                                      new_password='newpassword',
+                                      new_password_confirm='newpassword'))
+                self.assertEqual(mocks.signals_sent(), set([password_changed]))
+                user = self.app.security.datastore.find_user(email='joe@lp.com')
+                calls = mocks[password_changed]
+                self.assertEqual(len(calls), 1)
+                args, kwargs = calls[0]
+                self.assertTrue(compare_user(args[0], user))
+                self.assertEqual(kwargs['app'], self.app)
+
+    def test_change_password_invalid_password(self):
+        with capture_signals() as mocks:
+            self.client.post('/change',
+                             data=dict(password='notpassword',
+                                       new_password='newpassword',
+                                       new_password_confirm='newpassword'),
+                             follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+    def test_change_password_bad_password(self):
+        with capture_signals() as mocks:
+            self.client.post('/change',
+                             data=dict(password='notpassword',
+                                       new_password='a',
+                                       new_password_confirm='a'),
+                             follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+    def test_change_password_mismatch_password(self):
+        with capture_signals() as mocks:
+            self.client.post('/change',
+                             data=dict(password='password',
+                                       new_password='newpassword',
+                                       new_password_confirm='notnewpassword'),
+                             follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+
+class PasswordlessTests(SignalTest):
+
+    AUTH_CONFIG = {
+        'SECURITY_PASSWORDLESS': True
+    }
+
+    def test_login_request_for_inactive_user(self):
+        with capture_signals() as mocks:
+            self._post('/login', data=dict(email='tiya@lp.com'),
+                       follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+    def test_login_request_for_invalid_email(self):
+        with capture_signals() as mocks:
+            self._post('/login', data=dict(email='nobody@lp.com'),
+                       follow_redirects=True)
+        self.assertEqual(mocks.signals_sent(), set())
+
+    def test_request_login_token_sends_email_and_can_login(self):
+        e = 'matt@lp.com'
+
+        with capture_signals() as mocks:
+            self._post('/login', data=dict(email=e), follow_redirects=True)
+
+        self.assertEqual(mocks.signals_sent(), set([login_instructions_sent]))
+        user = self.app.security.datastore.find_user(email='matt@lp.com')
+        calls = mocks[login_instructions_sent]
+        self.assertEqual(len(calls), 1)
+        args, kwargs = calls[0]
+        self.assertTrue(compare_user(kwargs['user'], user))
+        self.assertIn('login_token', kwargs)
+        self.assertEqual(args[0], self.app)

tests/test_app/__init__.py

@@ -4,16 +4,19 @@ from flask import Flask, render_template, current_app
 from flask.ext.mail import Mail
 from flask.ext.security import login_required, roles_required, roles_accepted
 from flask.ext.security.decorators import http_auth_required, \
-     auth_token_required
+     auth_token_required, auth_required
 from flask.ext.security.utils import encrypt_password
 from werkzeug.local import LocalProxy
 
 ds = LocalProxy(lambda: current_app.extensions['security'].datastore)
 
+
 def create_app(config):
     app = Flask(__name__)
     app.debug = True
     app.config['SECRET_KEY'] = 'secret'
+    app.config['TESTING'] = True
+    app.config['LOGIN_DISABLED'] = False
 
     for key, value in config.items():
         app.config[key] = value
@@ -50,6 +53,11 @@ def create_app(config):
     def token():
         return render_template('index.html', content='Token Authentication')
 
+    @app.route('/multi_auth')
+    @auth_required('session', 'token', 'basic')
+    def multi_auth():
+        return render_template('index.html', content='Session, Token, Basic auth')
+
     @app.route('/post_logout')
     def post_logout():
         return render_template('index.html', content='Post Logout')
@@ -106,31 +114,43 @@ def create_app(config):
     def invalid_role():
         return 'success' if ds.find_role('bogus') is None else 'failure'
 
+    @app.route('/page1')
+    def page_1():
+        return 'Page 1'
+
     return app
 
+
 def create_roles():
     for role in ('admin', 'editor', 'author'):
         ds.create_role(name=role)
     ds.commit()
 
+
 def create_users(count=None):
-    users = [('matt@lp.com', 'password', ['admin'], True),
+    users = [('matt@lp.com', 'matt', 'password', ['admin'], True),
-             ('joe@lp.com', 'password', ['editor'], True),
+             ('joe@lp.com', 'joe', 'password', ['editor'], True),
-             ('dave@lp.com', 'password', ['admin', 'editor'], True),
+             ('dave@lp.com', 'dave', 'password', ['admin', 'editor'], True),
-             ('jill@lp.com', 'password', ['author'], True),
+             ('jill@lp.com', 'jill', 'password', ['author'], True),
-             ('tiya@lp.com', 'password', [], False)]
+             ('tiya@lp.com', 'tiya', 'password', [], False)]
     count = count or len(users)
 
     for u in users[:count]:
-        pw = encrypt_password(u[1])
+        pw = encrypt_password(u[2])
-        ds.create_user(email=u[0], password=pw,
+        roles = [ds.find_or_create_role(rn) for rn in u[3]]
-                       roles=u[2], active=u[3])
+        ds.commit()
-    ds.commit()
+        user = ds.create_user(email=u[0], username=u[1], password=pw, active=u[4])
+        ds.commit()
+        for role in roles:
+            ds.add_role_to_user(user, role)
+        ds.commit()
+
 
 def populate_data(user_count=None):
     create_roles()
     create_users(user_count)
 
+
 def add_context_processors(s):
     @s.context_processor
     def for_all():

tests/test_app/mongoengine.py

@@ -13,7 +13,7 @@ from flask.ext.security import Security, UserMixin, RoleMixin, \
 from tests.test_app import create_app as create_base_app, populate_data, \
      add_context_processors
 
-def create_app(config):
+def create_app(config, **kwargs):
     app = create_base_app(config)
 
     app.config['MONGODB_SETTINGS'] = dict(
@@ -30,6 +30,7 @@ def create_app(config):
 
     class User(db.Document, UserMixin):
         email = db.StringField(unique=True, max_length=255)
+        username = db.StringField(max_length=255)
         password = db.StringField(required=True, max_length=255)
         last_login_at = db.DateTimeField()
         current_login_at = db.DateTimeField()
@@ -46,7 +47,7 @@ def create_app(config):
         Role.drop_collection()
         populate_data(app.config.get('USER_COUNT', None))
 
-    app.security = Security(app, MongoEngineUserDatastore(db, User, Role))
+    app.security = Security(app, datastore=MongoEngineUserDatastore(db, User, Role), **kwargs)
 
     add_context_processors(app.security)
 

tests/test_app/peewee_app.py

@@ -0,0 +1,64 @@
+# -*- coding: utf-8 -*-
+
+import sys
+import os
+
+sys.path.pop(0)
+sys.path.insert(0, os.getcwd())
+
+from flask_peewee.db import Database
+from peewee import *
+from flask.ext.security import Security, UserMixin, RoleMixin, \
+     PeeweeUserDatastore
+
+from tests.test_app import create_app as create_base_app, populate_data, \
+     add_context_processors
+
+
+def create_app(config, **kwargs):
+    app = create_base_app(config)
+    app.config['DATABASE'] = {
+        'name': 'peewee.db',
+        'engine': 'peewee.SqliteDatabase'
+    }
+    db = Database(app)
+
+    class Role(db.Model, RoleMixin):
+        name = TextField(unique=True)
+        description = TextField(null=True)
+
+    class User(db.Model, UserMixin):
+        email = TextField()
+        username = TextField()
+        password = TextField()
+        last_login_at = DateTimeField(null=True)
+        current_login_at = DateTimeField(null=True)
+        last_login_ip = TextField(null=True)
+        current_login_ip = TextField(null=True)
+        login_count = IntegerField(null=True)
+        active = BooleanField(default=True)
+        confirmed_at = DateTimeField(null=True)
+
+    class UserRoles(db.Model):
+        """ Peewee does not have built-in many-to-many support, so we have to
+        create this mapping class to link users to roles."""
+        user = ForeignKeyField(User, related_name='roles')
+        role = ForeignKeyField(Role, related_name='users')
+        name = property(lambda self: self.role.name)
+        description = property(lambda self: self.role.description)
+
+    @app.before_first_request
+    def before_first_request():
+        for Model in (Role, User, UserRoles):
+            Model.drop_table(fail_silently=True)
+            Model.create_table()
+        populate_data(app.config.get('USER_COUNT', None))
+
+    app.security = Security(app, datastore=PeeweeUserDatastore(db, User, Role, UserRoles), **kwargs)
+
+    add_context_processors(app.security)
+
+    return app
+
+if __name__ == '__main__':
+    create_app({}).run()

tests/test_app/sqlalchemy.py

@@ -14,10 +14,9 @@ from flask.ext.security import Security, UserMixin, RoleMixin, \
 from tests.test_app import create_app as create_base_app, populate_data, \
      add_context_processors
 
-def create_app(config, register_blueprint=True):
+def create_app(config, **kwargs):
     app = create_base_app(config)
-
+    app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite://'
-    app.config['SQLALCHEMY_DATABASE_URI'] = 'mysql://root@localhost/flask_security_test'
 
     db = SQLAlchemy(app)
 
@@ -33,6 +32,7 @@ def create_app(config, register_blueprint=True):
     class User(db.Model, UserMixin):
         id = db.Column(db.Integer, primary_key=True)
         email = db.Column(db.String(255), unique=True)
+        username = db.Column(db.String(255))
         password = db.Column(db.String(255))
         last_login_at = db.Column(db.DateTime())
         current_login_at = db.Column(db.DateTime())
@@ -50,8 +50,7 @@ def create_app(config, register_blueprint=True):
         db.create_all()
         populate_data(app.config.get('USER_COUNT', None))
 
-    app.security = Security(app, SQLAlchemyUserDatastore(db, User, Role),
+    app.security = Security(app, datastore=SQLAlchemyUserDatastore(db, User, Role), **kwargs)
-                            register_blueprint=register_blueprint)
 
     add_context_processors(app.security)
 

tests/test_app/templates/custom_security/forgot_password.html

@@ -0,0 +1 @@
+CUSTOM FORGOT PASSWORD

tests/test_app/templates/custom_security/login_user.html

@@ -0,0 +1 @@
+CUSTOM LOGIN USER

tests/test_app/templates/custom_security/register_user.html

@@ -0,0 +1 @@
+CUSTOM REGISTER USER

tests/test_app/templates/custom_security/reset_password.html

@@ -0,0 +1 @@
+CUSTOM RESET PASSWORD

tests/test_app/templates/custom_security/send_confirmation.html

@@ -0,0 +1 @@
+CUSTOM SEND CONFIRMATION

tests/test_app/templates/custom_security/send_login.html

@@ -0,0 +1 @@
+CUSTOM SEND LOGIN

tests/unit_tests.py

@@ -55,8 +55,8 @@ class DatastoreTests(unittest.TestCase):
         self.assertRaises(NotImplementedError, ds.delete, None)
 
     def test_unimplemented_user_datastore_methods(self):
-        self.assertRaises(NotImplementedError, self.ds.find_user)
+        self.assertRaises(NotImplementedError, self.ds.find_user, None)
-        self.assertRaises(NotImplementedError, self.ds.find_role)
+        self.assertRaises(NotImplementedError, self.ds.find_role, None)
 
     def test_toggle_active(self):
         user.active = True

tox.ini

@@ -0,0 +1,13 @@
+[tox]
+envlist = py26, py27, py33, pypy
+
+[testenv]
+deps =
+    nose
+    simplejson
+    Flask-SQLAlchemy
+    Flask-MongoEngine
+    Flask-Peewee
+    bcrypt
+
+commands = nosetests -xs []