Redesign of email settings (#2426)

Co-authored-by: Felix Rindt <felix@rindt.me>

src/tests/control/test_events.py

@@ -36,8 +36,11 @@
 import datetime
 import time
 from decimal import Decimal
+from smtplib import SMTPResponseException
 
+import pytest
 import pytz
+from django.test.utils import override_settings
 from django.utils.timezone import now
 from django_scopes import scopes_disabled
 from i18nfield.strings import LazyI18nString
@@ -48,6 +51,12 @@ from pretix.base.models import Event, LogEntry, Order, Organizer, Team, User
 from pretix.testutils.mock import mocker_context
 
 
+@pytest.fixture
+def class_monkeypatch(request, monkeypatch):
+    request.cls.monkeypatch = monkeypatch
+
+
+@pytest.mark.usefixtures("class_monkeypatch")
 class EventsTest(SoupTest):
     @scopes_disabled()
     def setUp(self):
@@ -506,25 +515,204 @@ class EventsTest(SoupTest):
         assert self.event1.settings.primary_color == self.orga1.settings.primary_color
 
     def test_email_settings(self):
-        with mocker_context() as mocker:
-            mocked = mocker.patch('pretix.control.views.event.test_custom_smtp_backend')
-            doc = self.get_doc('/control/event/%s/%s/settings/email' % (self.orga1.slug, self.event1.slug))
-            data = extract_form_fields(doc.select("form")[0])
-            data['test'] = '1'
-            doc = self.post_doc('/control/event/%s/%s/settings/email' % (self.orga1.slug, self.event1.slug),
-                                data, follow=True)
-            print(doc)
-            assert doc.select('.alert-success')
-            self.event1.settings.flush()
-            assert mocked.called
+        doc = self.get_doc('/control/event/%s/%s/settings/email' % (self.orga1.slug, self.event1.slug))
+        data = extract_form_fields(doc.select("form")[0])
+        data['mail_from_name'] = 'test'
+        doc = self.post_doc('/control/event/%s/%s/settings/email' % (self.orga1.slug, self.event1.slug),
+                            data, follow=True)
+        assert doc.select('.alert-success')
+        self.event1.settings.flush()
+        assert self.event1.settings.mail_from_name == "test"
+
+    def test_email_setup_system(self):
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'system'
+            },
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.event1.settings.flush()
+        assert "mail_from" not in self.orga1.settings._cache()
+        assert not self.event1.settings.smtp_use_custom
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=True, MAIL_CUSTOM_SENDER_SPF_STRING=False)
+    def test_email_setup_simple_with_verification(self):
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        self.event1.settings.flush()
+        assert "mail_from" not in self.event1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        data['verification'] = self.client.session[
+            f'sender_mail_verification_code_/control/event/{self.orga1.slug}/{self.event1.slug}/settings/email/setup_test@test.pretix.dev'
+        ]
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.event1.settings.flush()
+        assert self.event1.settings.mail_from == 'test@test.pretix.dev'
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=True, MAIL_CUSTOM_SENDER_SPF_STRING=False)
+    def test_email_setup_simple_with_verification_wrong_code(self):
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        self.event1.settings.flush()
+        assert "mail_from" not in self.event1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        data['verification'] = 'AAAA'
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-danger')
+        self.event1.settings.flush()
+        assert "mail_from" not in self.event1.settings._cache()
+
+    @staticmethod
+    def _fake_spf_record(hostname):
+        return {
+            'test.pretix.dev': 'v=spf1 a mx include:level2.pretix.dev ~all',
+            'level2.pretix.dev': 'v=spf1 a mx +include:level3.pretix.dev include:spftest.pretix.dev '
+                                 '-include:level4.pretix.dev ~all',
+            'level3.pretix.dev': 'v=spf1 a mx include:test2.pretix.dev ~all',
+            'level4.pretix.dev': 'v=spf1 a mx include:test3.pretix.dev ~all',
+            'test2.pretix.dev': None,
+            'test3.pretix.dev': None,
+            'spftest.pretix.dev': None,
+        }[hostname]
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=False, MAIL_CUSTOM_SENDER_SPF_STRING="include:spftest.pretix.dev include:test2.pretix.dev")
+    def test_email_setup_no_verification_spf_success(self):
+        self.monkeypatch.setattr("pretix.control.views.mailsetup.get_spf_record", EventsTest._fake_spf_record)
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.event1.settings.flush()
+        # not yet saved
+        assert "mail_from" not in self.event1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.event1.settings.flush()
+        assert self.event1.settings.mail_from == 'test@test.pretix.dev'
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=False, MAIL_CUSTOM_SENDER_SPF_STRING="include:spftest.pretix.dev include:test3.pretix.dev")
+    def test_email_setup_no_verification_spf_warning(self):
+        self.monkeypatch.setattr("pretix.control.views.mailsetup.get_spf_record", EventsTest._fake_spf_record)
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        assert doc.select('.alert-warning')
+        self.event1.settings.flush()
+        # not yet saved
+        assert "mail_from" not in self.event1.settings._cache()
+
+    def test_email_setup_smtp(self):
+        self.monkeypatch.setattr("pretix.base.email.test_custom_smtp_backend", lambda b, a: None)
+        self.monkeypatch.setattr("socket.gethostbyname", lambda h: "8.8.8.8")
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'smtp',
+                'smtp-mail_from': 'test@test.pretix.dev',
+                'smtp-smtp_host': 'test.pretix.dev',
+                'smtp-smtp_port': '587',
+            },
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        # not yet saved
+        self.event1.settings.flush()
+        assert "smtp_use_custom" not in self.event1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.event1.settings.flush()
+        assert self.event1.settings.mail_from == 'test@test.pretix.dev'
+        assert self.event1.settings.smtp_host == 'test.pretix.dev'
+        assert self.event1.settings.smtp_port == 587
+        assert self.event1.settings.smtp_use_custom
+
+    def test_email_setup_smtp_failure(self):
+        def fail(a, b):
+            raise SMTPResponseException(400, 'Auth denied')
+        self.monkeypatch.setattr("pretix.base.email.test_custom_smtp_backend", fail)
+        self.monkeypatch.setattr("socket.gethostbyname", lambda h: "8.8.8.8")
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'smtp',
+                'smtp-mail_from': 'test@test.pretix.dev',
+                'smtp-smtp_host': 'test.pretix.dev',
+                'smtp-smtp_port': '587',
+            },
+            follow=True
+        )
+        assert 'Auth denied' in doc.select('.alert-danger')[0].text
+        # not yet saved
+        self.event1.settings.flush()
+        assert "smtp_use_custom" not in self.event1.settings._cache()
+        assert "mail_from" not in self.event1.settings._cache()
+
+    def test_email_setup_do_not_allow_private_ip_by_default(self):
+        doc = self.post_doc(
+            '/control/event/%s/%s/settings/email/setup' % (self.orga1.slug, self.event1.slug),
+            {
+                'mode': 'simple',
+                'smtp-mail_from': 'test@test.pretix.dev',
+                'smtp-smtp_host': '10.0.1.1',
+                'smtp-smtp_port': '587',
+            },
+            follow=True
+        )
+        assert doc.select('.has-error')
+        # not yet saved
+        self.event1.settings.flush()
+        assert "smtp_use_custom" not in self.event1.settings._cache()
+        assert "mail_from" not in self.event1.settings._cache()
 
     def test_ticket_settings(self):
         doc = self.get_doc('/control/event/%s/%s/settings/tickets' % (self.orga1.slug, self.event1.slug))
         data = extract_form_fields(doc.select("form")[0])
         data['ticket_download'] = 'on'
         data['ticketoutput_testdummy__enabled'] = 'on'
-        doc = self.post_doc('/control/event/%s/%s/settings/tickets' % (self.orga1.slug, self.event1.slug),
-                            data, follow=True)
+        self.post_doc('/control/event/%s/%s/settings/tickets' % (self.orga1.slug, self.event1.slug), data, follow=True)
         self.event1.settings.flush()
         assert self.event1.settings.get('ticket_download', as_type=bool)
 

src/tests/control/test_organizer.py

@@ -20,14 +20,15 @@
 # <https://www.gnu.org/licenses/>.
 #
 import datetime
+from smtplib import SMTPResponseException
 
 import pytest
 from django.db import transaction
+from django.test.utils import override_settings
 from django_scopes import scopes_disabled
 from tests.base import SoupTest, extract_form_fields
 
 from pretix.base.models import Event, Organizer, Team, User
-from pretix.testutils.mock import mocker_context
 
 
 @pytest.fixture
@@ -100,13 +101,194 @@ class OrganizerTest(SoupTest):
         assert called
 
     def test_email_settings(self):
-        with mocker_context() as mocker:
-            mocked = mocker.patch('pretix.control.views.organizer.test_custom_smtp_backend')
-            doc = self.get_doc('/control/organizer/%s/settings/email' % self.orga1.slug)
-            data = extract_form_fields(doc.select("form")[0])
-            data['test'] = '1'
-            doc = self.post_doc('/control/organizer/%s/settings/email' % self.orga1.slug,
-                                data, follow=True)
-            assert doc.select('.alert-success')
-            self.event1.settings.flush()
-            assert mocked.called
+        doc = self.get_doc('/control/organizer/%s/settings/email' % self.orga1.slug)
+        data = extract_form_fields(doc.select("form")[0])
+        data['mail_from_name'] = 'test'
+        doc = self.post_doc('/control/organizer/%s/settings/email' % self.orga1.slug,
+                            data, follow=True)
+        assert doc.select('.alert-success')
+        self.orga1.settings.flush()
+        assert self.orga1.settings.mail_from_name == "test"
+
+    def test_email_setup_system(self):
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'system'
+            },
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.orga1.settings.flush()
+        assert "mail_from" not in self.orga1.settings._cache()
+        assert not self.orga1.settings.smtp_use_custom
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=True, MAIL_CUSTOM_SENDER_SPF_STRING=False)
+    def test_email_setup_simple_with_verification(self):
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        self.orga1.settings.flush()
+        assert "mail_from" not in self.orga1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        data['verification'] = self.client.session[
+            f'sender_mail_verification_code_/control/organizer/{self.orga1.slug}/settings/email/setup_test@test.pretix.dev'
+        ]
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.orga1.settings.flush()
+        assert self.orga1.settings.mail_from == 'test@test.pretix.dev'
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=True, MAIL_CUSTOM_SENDER_SPF_STRING=False)
+    def test_email_setup_simple_with_verification_wrong_code(self):
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        self.orga1.settings.flush()
+        assert "mail_from" not in self.orga1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        data['verification'] = 'AAAA'
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-danger')
+        self.orga1.settings.flush()
+        assert "mail_from" not in self.orga1.settings._cache()
+
+    @staticmethod
+    def _fake_spf_record(hostname):
+        return {
+            'test.pretix.dev': 'v=spf1 a mx include:level2.pretix.dev ~all',
+            'level2.pretix.dev': 'v=spf1 a mx +include:level3.pretix.dev include:spftest.pretix.dev '
+                                 '-include:level4.pretix.dev ~all',
+            'level3.pretix.dev': 'v=spf1 a mx include:test2.pretix.dev ~all',
+            'level4.pretix.dev': 'v=spf1 a mx include:test3.pretix.dev ~all',
+            'test2.pretix.dev': None,
+            'test3.pretix.dev': None,
+            'spftest.pretix.dev': None,
+        }[hostname]
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=False, MAIL_CUSTOM_SENDER_SPF_STRING="include:spftest.pretix.dev include:test2.pretix.dev")
+    def test_email_setup_no_verification_spf_success(self):
+        self.monkeypatch.setattr("pretix.control.views.mailsetup.get_spf_record", OrganizerTest._fake_spf_record)
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.orga1.settings.flush()
+        # not yet saved
+        assert "mail_from" not in self.orga1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.orga1.settings.flush()
+        assert self.orga1.settings.mail_from == 'test@test.pretix.dev'
+
+    @override_settings(MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED=False, MAIL_CUSTOM_SENDER_SPF_STRING="include:spftest.pretix.dev include:test3.pretix.dev")
+    def test_email_setup_no_verification_spf_warning(self):
+        self.monkeypatch.setattr("pretix.control.views.mailsetup.get_spf_record", OrganizerTest._fake_spf_record)
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'simple',
+                'simple-mail_from': 'test@test.pretix.dev',
+            },
+            follow=True
+        )
+        assert doc.select('.alert-warning')
+        self.orga1.settings.flush()
+        # not yet saved
+        assert "mail_from" not in self.orga1.settings._cache()
+
+    def test_email_setup_smtp(self):
+        self.monkeypatch.setattr("pretix.base.email.test_custom_smtp_backend", lambda b, a: None)
+        self.monkeypatch.setattr("socket.gethostbyname", lambda h: "8.8.8.8")
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'smtp',
+                'smtp-mail_from': 'test@test.pretix.dev',
+                'smtp-smtp_host': 'test.pretix.dev',
+                'smtp-smtp_port': '587',
+            },
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        # not yet saved
+        self.orga1.settings.flush()
+        assert "smtp_use_custom" not in self.orga1.settings._cache()
+        data = extract_form_fields(doc.select("form")[0])
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            data,
+            follow=True
+        )
+        assert doc.select('.alert-success')
+        self.orga1.settings.flush()
+        assert self.orga1.settings.mail_from == 'test@test.pretix.dev'
+        assert self.orga1.settings.smtp_host == 'test.pretix.dev'
+        assert self.orga1.settings.smtp_port == 587
+        assert self.orga1.settings.smtp_use_custom
+
+    def test_email_setup_smtp_failure(self):
+        def fail(a, b):
+            raise SMTPResponseException(400, 'Auth denied')
+        self.monkeypatch.setattr("pretix.base.email.test_custom_smtp_backend", fail)
+        self.monkeypatch.setattr("socket.gethostbyname", lambda h: "8.8.8.8")
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'smtp',
+                'smtp-mail_from': 'test@test.pretix.dev',
+                'smtp-smtp_host': 'test.pretix.dev',
+                'smtp-smtp_port': '587',
+            },
+            follow=True
+        )
+        assert 'Auth denied' in doc.select('.alert-danger')[0].text
+        # not yet saved
+        self.orga1.settings.flush()
+        assert "smtp_use_custom" not in self.orga1.settings._cache()
+        assert "mail_from" not in self.orga1.settings._cache()
+
+    def test_email_setup_do_not_allow_private_ip_by_default(self):
+        doc = self.post_doc(
+            '/control/organizer/%s/settings/email/setup' % self.orga1.slug,
+            {
+                'mode': 'simple',
+                'smtp-mail_from': 'test@test.pretix.dev',
+                'smtp-smtp_host': '10.0.1.1',
+                'smtp-smtp_port': '587',
+            },
+            follow=True
+        )
+        assert doc.select('.has-error')
+        # not yet saved
+        self.orga1.settings.flush()
+        assert "smtp_use_custom" not in self.orga1.settings._cache()
+        assert "mail_from" not in self.orga1.settings._cache()

src/tests/control/test_permissions.py

@@ -92,6 +92,7 @@ event_urls = [
     "settings/payment",
     "settings/tickets",
     "settings/email",
+    "settings/email/setup",
     "settings/cancel",
     "settings/invoice",
     "settings/invoice/preview",
@@ -171,6 +172,8 @@ event_urls = [
 organizer_urls = [
     'organizer/abc/edit',
     'organizer/abc/',
+    'organizer/abc/settings/email',
+    'organizer/abc/settings/email/setup',
     'organizer/abc/teams',
     'organizer/abc/team/1/',
     'organizer/abc/team/1/edit',
@@ -285,6 +288,7 @@ event_permission_urls = [
     ("can_change_event_settings", "settings/payment", 200, HTTP_GET),
     ("can_change_event_settings", "settings/tickets", 200, HTTP_GET),
     ("can_change_event_settings", "settings/email", 200, HTTP_GET),
+    ("can_change_event_settings", "settings/email/setup", 200, HTTP_GET),
     ("can_change_event_settings", "settings/cancel", 200, HTTP_GET),
     ("can_change_event_settings", "settings/invoice", 200, HTTP_GET),
     ("can_change_event_settings", "settings/widget", 200, HTTP_GET),
@@ -481,6 +485,8 @@ organizer_permission_urls = [
     ("can_change_teams", "organizer/dummy/team/1/edit", 200),
     ("can_change_teams", "organizer/dummy/team/1/delete", 200),
     ("can_change_organizer_settings", "organizer/dummy/edit", 200),
+    ("can_change_organizer_settings", "organizer/dummy/settings/email", 200),
+    ("can_change_organizer_settings", "organizer/dummy/settings/email/setup", 200),
     ("can_change_organizer_settings", "organizer/dummy/devices", 200),
     ("can_change_organizer_settings", "organizer/dummy/device/add", 200),
     ("can_change_organizer_settings", "organizer/dummy/device/1/edit", 404),