mbox series

[layerindex-web,0/2] Let maintainers change their email address safely

Message ID 20261114055216.2636-1-tim.orling@konsulko.com
Headers show
Series Let maintainers change their email address safely | expand

Message

Tim Orling Nov. 14, 2026, 5:52 a.m. UTC 
Bug 11195: a maintainer who changes the email address on their profile
loses access to their layers, because edit rights come from matching
the user's address against the layers' maintainer records.

Moving the maintainer records to the new address moves edit rights, so
this is done carefully. Changing the email already logs the user out
and needs the new address to be confirmed. On top of that:
- changing the email now needs the current password, so a logged-in
  session alone is not enough, and the old address is told about it;
- the maintainer records only move after an admin approves it, with the
  "Approve moving maintainer records" action on the user's profile; the
  admins are emailed when a confirmed change is waiting.
Users who don't maintain layers are not held up.

1: The profile page had no login check, so a visitor who was not
   logged in got an Internal Server Error instead of the login page.
2: The maintainer email change itself (bug 11195). It adds migration
   0057, so it applies on top of "[PATCH 0/2] Remove dependencies
   dropped from conf/layer.conf" (bug 14348), which adds 0056.

The test suite passes in the Docker image at each patch (83 passed,
1 skipped at the end); the tests go through the profile form, the
activation link and the admin action.

Tim Orling (2):
  layerindex/views: require login for the profile page
  layerindex: let a maintainer keep their layers when they change email

 layerindex/admin.py                           | 26 ++++-
 layerindex/forms.py                           |  8 ++
 .../0057_userprofile_previous_email.py        | 16 ++++
 layerindex/models.py                          | 20 ++++
 layerindex/views.py                           | 45 ++++++++-
 tests/test_profile_email.py                   | 94 +++++++++++++++++--
 6 files changed, 200 insertions(+), 9 deletions(-)
 create mode 100644 layerindex/migrations/0057_userprofile_previous_email.py


base-commit: 08e58cdece30019a6f9e5d14af16ebe20afa6177
prerequisite-patch-id: 6c677e4190187d389840d2a94b4d857a69c0d647
prerequisite-patch-id: 282bc018dfe6528deb8363d3cbd1b31671c4b606