Let a teacher's invitation code stand in for email verification - #752
Merged
Merged
Conversation
A student signing up with a cohort's invitation code has already been vouched for by the teacher who handed that code out, and the cohort's capacity bounds what the shortcut opens up. Making a class of thirty each go and find a code in their mail costs a lesson, and the teacher's word is the better signal anyway. So a signup that resolves to a cohort is created verified, and gets no confirmation mail — telling someone who is already verified to "please confirm your email" only sends them looking for a step that isn't there. Keyed on the resolved cohort rather than on invite_code being non-empty: valid_invite_code also accepts the global INVITATION_CODES from config, which belong to no class and carry nobody's vouching, so those still verify by email. The avatar needs its own commit now. It had been riding along on the verification code's commit, which is the one that just became conditional; without this it would be discarded at teardown for exactly the cohort signups this change is meant to help. Note this is a convenience, not a fix for the recent lockout — the confirmation mails were being delivered fine (zeeguu/web#1247 is where that bug actually was). It just spares a class the detour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
ArchLens - No architecturally relevant changes to the existing views |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A signup whose invitation code resolves to a cohort is created with
email_verified = Trueand is not sent a confirmation code. Signups without a code, or with a code that resolves to no cohort, are unchanged.Why
The teacher who issued the code has already vouched for the student, and
cohort_still_has_capacity()bounds the class size. Set against that, asking a class of thirty to each find a code in their mail costs a lesson — on school devices where some of them cannot reach their mail at all, and where a code may expire before they get home.Sending "please confirm your email" to an account that is already verified would only send the student looking for a step that does not exist, so the mail is skipped for them too.
This is a convenience change. It is not a fix for the recent lockout at Cygnus Gymnasium — that was a web bug (zeeguu/web#1247), and the confirmation mails themselves were being delivered correctly throughout.
Design note
The flag is set from the resolved
cohortobject, not frominvite_codebeing non-empty.valid_invite_code()accepts more than cohort codes, and only a resolved cohort carries a teacher's vouching. Both creation paths already look the cohort up, with a capacity check, before building the user.The avatar's commit
db_session.commit()afterdb_session.add(user_avatar)is load-bearing. The avatar had been committed by the verification code's commit — the one that just became conditional — so without it the avatar is discarded at teardown for precisely the signups this change affects.Tests
zeeguu/core/test/test_account_creation_verification.py, 5 cases: a cohort signup is verified and issues no code; the cohort match is case-insensitive; no invite code still verifies by email; a code resolving to no cohort still verifies by email; the avatar survives a cohort signup.The avatar case rolls the session back before asserting — querying directly would autoflush and pass either way. Confirmed it fails when the commit is removed; the first version of it did not, and was worthless.
Full suite: 551 passed, 2 failed. Both failures are in
test_scheduling.py(test_level_doesnt_go_back_to_lower_level,test_level_full_cycle) and reproduce on cleanorigin/master— pre-existing and unrelated.Related
Class-code lifecycle (expiry / teacher-controlled enrolment) is being looked at separately and should land before or with this.
🤖 Generated with Claude Code