Merge pull request 'Replace Drone with Gitea Actions' (#1) from gitea-actions into main

Reviewed-on: #1

.gitea/workflows/build-release-image.yaml

@@ -5,7 +5,7 @@ on:
       - '*'
 
 env:
-  CONTAINER_NAME: git.mrmeeb.stream/mrmeeb/simple-login
+  CONTAINER_NAME: git.mrmeeb.stream/mrmeeb/simple-login-dev
   TEA_VERSION: 0.9.2
 
 jobs:

app/.github/workflows/main.yml

@@ -1,6 +1,7 @@
 name: Test and lint
 
-on: [push, pull_request]
+on:
+  push:
 
 jobs:
   lint:
@@ -138,12 +139,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
       - name: Create Sentry release
         uses: getsentry/action-release@v1
         env:
@@ -163,7 +158,6 @@ jobs:
         uses: docker/build-push-action@v3
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
 

app/CONTRIBUTING.md

@@ -151,10 +151,10 @@ Here are the small sum-ups of the directory structures and their roles:
 
 ## Pull request
 
-The code is formatted using [ruff](https://github.com/astral-sh/ruff), to format the code, simply run
+The code is formatted using https://github.com/psf/black, to format the code, simply run
 
 ```
-poetry run ruff format .
+poetry run black .
 ```
 
 The code is also checked with `flake8`, make sure to run `flake8` before creating the pull request by

app/app/api/views/auth.py

@@ -11,7 +11,7 @@ from itsdangerous import Signer
 from app import email_utils
 from app.api.base import api_bp
 from app.config import FLASK_SECRET, DISABLE_REGISTRATION
-from app.dashboard.views.account_setting import send_reset_password_email
+from app.dashboard.views.setting import send_reset_password_email
 from app.db import Session
 from app.email_utils import (
     email_can_be_used_as_mailbox,

app/app/auth/__init__.py

@@ -16,7 +16,6 @@ from .views import (
     social,
     recovery,
     api_to_cookie,
-    oidc,
 )
 
 __all__ = [
@@ -37,5 +36,4 @@ __all__ = [
     "social",
     "recovery",
     "api_to_cookie",
-    "oidc",
 ]

app/app/auth/views/change_email.py

@@ -3,7 +3,6 @@ from flask_login import login_user
 
 from app.auth.base import auth_bp
 from app.db import Session
-from app.log import LOG
 from app.models import EmailChange, ResetPasswordCode
 
 
@@ -23,14 +22,12 @@ def change_email():
         return render_template("auth/change_email.html")
 
     user = email_change.user
-    old_email = user.email
     user.email = email_change.new_email
 
     EmailChange.delete(email_change.id)
     ResetPasswordCode.filter_by(user_id=user.id).delete()
     Session.commit()
 
-    LOG.i(f"User {user} has changed their email from {old_email} to {user.email}")
     flash("Your new email has been updated", "success")
 
     login_user(user)

app/app/auth/views/forgot_password.py

@@ -3,7 +3,7 @@ from flask_wtf import FlaskForm
 from wtforms import StringField, validators
 
 from app.auth.base import auth_bp
-from app.dashboard.views.account_setting import send_reset_password_email
+from app.dashboard.views.setting import send_reset_password_email
 from app.extensions import limiter
 from app.log import LOG
 from app.models import User

app/app/auth/views/login.py

@@ -5,7 +5,7 @@ from wtforms import StringField, validators
 
 from app.auth.base import auth_bp
 from app.auth.views.login_utils import after_login
-from app.config import CONNECT_WITH_PROTON, CONNECT_WITH_OIDC_ICON, OIDC_CLIENT_ID
+from app.config import CONNECT_WITH_PROTON
 from app.events.auth_event import LoginEvent
 from app.extensions import limiter
 from app.log import LOG
@@ -77,6 +77,4 @@ def login():
         next_url=next_url,
         show_resend_activation=show_resend_activation,
         connect_with_proton=CONNECT_WITH_PROTON,
-        connect_with_oidc=OIDC_CLIENT_ID is not None,
-        connect_with_oidc_icon=CONNECT_WITH_OIDC_ICON,
     )

app/app/auth/views/oidc.py

@@ -1,131 +0,0 @@
-from flask import request, session, redirect, flash, url_for
-from requests_oauthlib import OAuth2Session
-
-from app import config
-from app.auth.base import auth_bp
-from app.auth.views.login_utils import after_login
-from app.config import (
-    URL,
-    OIDC_AUTHORIZATION_URL,
-    OIDC_USER_INFO_URL,
-    OIDC_TOKEN_URL,
-    OIDC_SCOPES,
-    OIDC_NAME_FIELD,
-)
-from app.db import Session
-from app.email_utils import send_welcome_email
-from app.log import LOG
-from app.models import User, SocialAuth
-from app.utils import encode_url, sanitize_email, sanitize_next_url
-
-
-# need to set explicitly redirect_uri instead of leaving the lib to pre-fill redirect_uri
-# when served behind nginx, the redirect_uri is localhost... and not the real url
-_redirect_uri = URL + "/auth/oidc/callback"
-
-SESSION_STATE_KEY = "oauth_state"
-
-
-@auth_bp.route("/oidc/login")
-def oidc_login():
-    if config.OIDC_CLIENT_ID is None or config.OIDC_CLIENT_SECRET is None:
-        return redirect(url_for("auth.login"))
-
-    next_url = sanitize_next_url(request.args.get("next"))
-    if next_url:
-        redirect_uri = _redirect_uri + "?next=" + encode_url(next_url)
-    else:
-        redirect_uri = _redirect_uri
-
-    oidc = OAuth2Session(
-        config.OIDC_CLIENT_ID, scope=[OIDC_SCOPES], redirect_uri=redirect_uri
-    )
-    authorization_url, state = oidc.authorization_url(OIDC_AUTHORIZATION_URL)
-
-    # State is used to prevent CSRF, keep this for later.
-    session[SESSION_STATE_KEY] = state
-    return redirect(authorization_url)
-
-
-@auth_bp.route("/oidc/callback")
-def oidc_callback():
-    if SESSION_STATE_KEY not in session:
-        flash("Invalid state, please retry", "error")
-        return redirect(url_for("auth.login"))
-    if config.OIDC_CLIENT_ID is None or config.OIDC_CLIENT_SECRET is None:
-        return redirect(url_for("auth.login"))
-
-    # user clicks on cancel
-    if "error" in request.args:
-        flash("Please use another sign in method then", "warning")
-        return redirect("/")
-
-    oidc = OAuth2Session(
-        config.OIDC_CLIENT_ID,
-        state=session[SESSION_STATE_KEY],
-        scope=[OIDC_SCOPES],
-        redirect_uri=_redirect_uri,
-    )
-    oidc.fetch_token(
-        OIDC_TOKEN_URL,
-        client_secret=config.OIDC_CLIENT_SECRET,
-        authorization_response=request.url,
-    )
-
-    oidc_user_data = oidc.get(OIDC_USER_INFO_URL)
-    if oidc_user_data.status_code != 200:
-        LOG.e(
-            f"cannot get oidc user data {oidc_user_data.status_code} {oidc_user_data.text}"
-        )
-        flash(
-            "Cannot get user data from OIDC, please use another way to login/sign up",
-            "error",
-        )
-        return redirect(url_for("auth.login"))
-    oidc_user_data = oidc_user_data.json()
-
-    email = oidc_user_data.get("email")
-
-    if not email:
-        LOG.e(f"cannot get email for OIDC user {oidc_user_data} {email}")
-        flash(
-            "Cannot get a valid email from OIDC, please another way to login/sign up",
-            "error",
-        )
-        return redirect(url_for("auth.login"))
-
-    email = sanitize_email(email)
-    user = User.get_by(email=email)
-
-    if not user and config.DISABLE_REGISTRATION:
-        flash(
-            "Sorry you cannot sign up via the OIDC provider. Please sign-up first with your email.",
-            "error",
-        )
-        return redirect(url_for("auth.register"))
-    elif not user:
-        user = create_user(email, oidc_user_data)
-
-    if not SocialAuth.get_by(user_id=user.id, social="oidc"):
-        SocialAuth.create(user_id=user.id, social="oidc")
-        Session.commit()
-
-    # The activation link contains the original page, for ex authorize page
-    next_url = sanitize_next_url(request.args.get("next")) if request.args else None
-
-    return after_login(user, next_url)
-
-
-def create_user(email, oidc_user_data):
-    new_user = User.create(
-        email=email,
-        name=oidc_user_data.get(OIDC_NAME_FIELD),
-        password="",
-        activated=True,
-    )
-    LOG.i(f"Created new user for login request from OIDC. New user {new_user.id}")
-    Session.commit()
-
-    send_welcome_email(new_user)
-
-    return new_user

app/app/auth/views/register.py

@@ -6,7 +6,7 @@ from wtforms import StringField, validators
 
 from app import email_utils, config
 from app.auth.base import auth_bp
-from app.config import CONNECT_WITH_PROTON, CONNECT_WITH_OIDC_ICON
+from app.config import CONNECT_WITH_PROTON
 from app.auth.views.login_utils import get_referral
 from app.config import URL, HCAPTCHA_SECRET, HCAPTCHA_SITEKEY
 from app.db import Session
@@ -109,8 +109,6 @@ def register():
         next_url=next_url,
         HCAPTCHA_SITEKEY=HCAPTCHA_SITEKEY,
         connect_with_proton=CONNECT_WITH_PROTON,
-        connect_with_oidc=config.OIDC_CLIENT_ID is not None,
-        connect_with_oidc_icon=CONNECT_WITH_OIDC_ICON,
     )
 
 

app/app/config.py

@@ -234,7 +234,7 @@ else:
 
     print("WARNING: Use a temp directory for GNUPGHOME", GNUPGHOME)
 
-# Github, Google, Facebook, OIDC client id and secrets
+# Github, Google, Facebook client id and secrets
 GITHUB_CLIENT_ID = os.environ.get("GITHUB_CLIENT_ID")
 GITHUB_CLIENT_SECRET = os.environ.get("GITHUB_CLIENT_SECRET")
 
@@ -244,15 +244,6 @@ GOOGLE_CLIENT_SECRET = os.environ.get("GOOGLE_CLIENT_SECRET")
 FACEBOOK_CLIENT_ID = os.environ.get("FACEBOOK_CLIENT_ID")
 FACEBOOK_CLIENT_SECRET = os.environ.get("FACEBOOK_CLIENT_SECRET")
 
-CONNECT_WITH_OIDC_ICON = os.environ.get("CONNECT_WITH_OIDC_ICON")
-OIDC_AUTHORIZATION_URL = os.environ.get("OIDC_AUTHORIZATION_URL")
-OIDC_USER_INFO_URL = os.environ.get("OIDC_USER_INFO_URL")
-OIDC_TOKEN_URL = os.environ.get("OIDC_TOKEN_URL")
-OIDC_CLIENT_ID = os.environ.get("OIDC_CLIENT_ID")
-OIDC_CLIENT_SECRET = os.environ.get("OIDC_CLIENT_SECRET")
-OIDC_SCOPES = os.environ.get("OIDC_SCOPES")
-OIDC_NAME_FIELD = os.environ.get("OIDC_NAME_FIELD", "name")
-
 PROTON_CLIENT_ID = os.environ.get("PROTON_CLIENT_ID")
 PROTON_CLIENT_SECRET = os.environ.get("PROTON_CLIENT_SECRET")
 PROTON_BASE_URL = os.environ.get(
@@ -430,9 +421,6 @@ try:
 except Exception:
     HIBP_SCAN_INTERVAL_DAYS = 7
 HIBP_API_KEYS = sl_getenv("HIBP_API_KEYS", list) or []
-HIBP_MAX_ALIAS_CHECK = 10_000
-HIBP_RPM = 100
-HIBP_SKIP_PARTNER_ALIAS = os.environ.get("HIBP_SKIP_PARTNER_ALIAS")
 
 POSTMASTER = os.environ.get("POSTMASTER")
 
@@ -579,5 +567,3 @@ MAX_API_KEYS = int(os.environ.get("MAX_API_KEYS", 30))
 UPCLOUD_USERNAME = os.environ.get("UPCLOUD_USERNAME", None)
 UPCLOUD_PASSWORD = os.environ.get("UPCLOUD_PASSWORD", None)
 UPCLOUD_DB_ID = os.environ.get("UPCLOUD_DB_ID", None)
-
-STORE_TRANSACTIONAL_EMAILS = "STORE_TRANSACTIONAL_EMAILS" in os.environ

app/app/dashboard/__init__.py

@@ -32,7 +32,6 @@ from .views import (
     delete_account,
     notification,
     support,
-    account_setting,
 )
 
 __all__ = [
@@ -69,5 +68,4 @@ __all__ = [
     "delete_account",
     "notification",
     "support",
-    "account_setting",
 ]

app/app/dashboard/views/account_setting.py

@@ -1,242 +0,0 @@
-import arrow
-from flask import (
-    render_template,
-    request,
-    redirect,
-    url_for,
-    flash,
-)
-from flask_login import login_required, current_user
-
-from app import email_utils
-from app.config import (
-    URL,
-    FIRST_ALIAS_DOMAIN,
-    ALIAS_RANDOM_SUFFIX_LENGTH,
-    CONNECT_WITH_PROTON,
-)
-from app.dashboard.base import dashboard_bp
-from app.dashboard.views.enter_sudo import sudo_required
-from app.dashboard.views.mailbox_detail import ChangeEmailForm
-from app.db import Session
-from app.email_utils import (
-    email_can_be_used_as_mailbox,
-    personal_email_already_used,
-)
-from app.extensions import limiter
-from app.jobs.export_user_data_job import ExportUserDataJob
-from app.log import LOG
-from app.models import (
-    BlockBehaviourEnum,
-    PlanEnum,
-    ResetPasswordCode,
-    EmailChange,
-    User,
-    Alias,
-    AliasGeneratorEnum,
-    SenderFormatEnum,
-    UnsubscribeBehaviourEnum,
-)
-from app.proton.utils import perform_proton_account_unlink
-from app.utils import (
-    random_string,
-    CSRFValidationForm,
-    canonicalize_email,
-)
-
-
-@dashboard_bp.route("/account_setting", methods=["GET", "POST"])
-@login_required
-@sudo_required
-@limiter.limit("5/minute", methods=["POST"])
-def account_setting():
-    change_email_form = ChangeEmailForm()
-    csrf_form = CSRFValidationForm()
-
-    email_change = EmailChange.get_by(user_id=current_user.id)
-    if email_change:
-        pending_email = email_change.new_email
-    else:
-        pending_email = None
-
-    if request.method == "POST":
-        if not csrf_form.validate():
-            flash("Invalid request", "warning")
-            return redirect(url_for("dashboard.setting"))
-        if request.form.get("form-name") == "update-email":
-            if change_email_form.validate():
-                # whether user can proceed with the email update
-                new_email_valid = True
-                new_email = canonicalize_email(change_email_form.email.data)
-                if new_email != current_user.email and not pending_email:
-                    # check if this email is not already used
-                    if personal_email_already_used(new_email) or Alias.get_by(
-                        email=new_email
-                    ):
-                        flash(f"Email {new_email} already used", "error")
-                        new_email_valid = False
-                    elif not email_can_be_used_as_mailbox(new_email):
-                        flash(
-                            "You cannot use this email address as your personal inbox.",
-                            "error",
-                        )
-                        new_email_valid = False
-                    # a pending email change with the same email exists from another user
-                    elif EmailChange.get_by(new_email=new_email):
-                        other_email_change: EmailChange = EmailChange.get_by(
-                            new_email=new_email
-                        )
-                        LOG.w(
-                            "Another user has a pending %s with the same email address. Current user:%s",
-                            other_email_change,
-                            current_user,
-                        )
-
-                        if other_email_change.is_expired():
-                            LOG.d(
-                                "delete the expired email change %s", other_email_change
-                            )
-                            EmailChange.delete(other_email_change.id)
-                            Session.commit()
-                        else:
-                            flash(
-                                "You cannot use this email address as your personal inbox.",
-                                "error",
-                            )
-                            new_email_valid = False
-
-                    if new_email_valid:
-                        email_change = EmailChange.create(
-                            user_id=current_user.id,
-                            code=random_string(
-                                60
-                            ),  # todo: make sure the code is unique
-                            new_email=new_email,
-                        )
-                        Session.commit()
-                        send_change_email_confirmation(current_user, email_change)
-                        flash(
-                            "A confirmation email is on the way, please check your inbox",
-                            "success",
-                        )
-                        return redirect(url_for("dashboard.account_setting"))
-        elif request.form.get("form-name") == "change-password":
-            flash(
-                "You are going to receive an email containing instructions to change your password",
-                "success",
-            )
-            send_reset_password_email(current_user)
-            return redirect(url_for("dashboard.account_setting"))
-        elif request.form.get("form-name") == "send-full-user-report":
-            if ExportUserDataJob(current_user).store_job_in_db():
-                flash(
-                    "You will receive your SimpleLogin data via email shortly",
-                    "success",
-                )
-            else:
-                flash("An export of your data is currently in progress", "error")
-
-    partner_sub = None
-    partner_name = None
-
-    return render_template(
-        "dashboard/account_setting.html",
-        csrf_form=csrf_form,
-        PlanEnum=PlanEnum,
-        SenderFormatEnum=SenderFormatEnum,
-        BlockBehaviourEnum=BlockBehaviourEnum,
-        change_email_form=change_email_form,
-        pending_email=pending_email,
-        AliasGeneratorEnum=AliasGeneratorEnum,
-        UnsubscribeBehaviourEnum=UnsubscribeBehaviourEnum,
-        partner_sub=partner_sub,
-        partner_name=partner_name,
-        FIRST_ALIAS_DOMAIN=FIRST_ALIAS_DOMAIN,
-        ALIAS_RAND_SUFFIX_LENGTH=ALIAS_RANDOM_SUFFIX_LENGTH,
-        connect_with_proton=CONNECT_WITH_PROTON,
-    )
-
-
-def send_reset_password_email(user):
-    """
-    generate a new ResetPasswordCode and send it over email to user
-    """
-    # the activation code is valid for 1h
-    reset_password_code = ResetPasswordCode.create(
-        user_id=user.id, code=random_string(60)
-    )
-    Session.commit()
-
-    reset_password_link = f"{URL}/auth/reset_password?code={reset_password_code.code}"
-
-    email_utils.send_reset_password_email(user.email, reset_password_link)
-
-
-def send_change_email_confirmation(user: User, email_change: EmailChange):
-    """
-    send confirmation email to the new email address
-    """
-
-    link = f"{URL}/auth/change_email?code={email_change.code}"
-
-    email_utils.send_change_email(email_change.new_email, user.email, link)
-
-
-@dashboard_bp.route("/resend_email_change", methods=["GET", "POST"])
-@limiter.limit("5/hour")
-@login_required
-@sudo_required
-def resend_email_change():
-    form = CSRFValidationForm()
-    if not form.validate():
-        flash("Invalid request. Please try again", "warning")
-        return redirect(url_for("dashboard.setting"))
-    email_change = EmailChange.get_by(user_id=current_user.id)
-    if email_change:
-        # extend email change expiration
-        email_change.expired = arrow.now().shift(hours=12)
-        Session.commit()
-
-        send_change_email_confirmation(current_user, email_change)
-        flash("A confirmation email is on the way, please check your inbox", "success")
-        return redirect(url_for("dashboard.setting"))
-    else:
-        flash(
-            "You have no pending email change. Redirect back to Setting page", "warning"
-        )
-        return redirect(url_for("dashboard.setting"))
-
-
-@dashboard_bp.route("/cancel_email_change", methods=["GET", "POST"])
-@login_required
-@sudo_required
-def cancel_email_change():
-    form = CSRFValidationForm()
-    if not form.validate():
-        flash("Invalid request. Please try again", "warning")
-        return redirect(url_for("dashboard.setting"))
-    email_change = EmailChange.get_by(user_id=current_user.id)
-    if email_change:
-        EmailChange.delete(email_change.id)
-        Session.commit()
-        flash("Your email change is cancelled", "success")
-        return redirect(url_for("dashboard.setting"))
-    else:
-        flash(
-            "You have no pending email change. Redirect back to Setting page", "warning"
-        )
-        return redirect(url_for("dashboard.setting"))
-
-
-@dashboard_bp.route("/unlink_proton_account", methods=["POST"])
-@login_required
-@sudo_required
-def unlink_proton_account():
-    csrf_form = CSRFValidationForm()
-    if not csrf_form.validate():
-        flash("Invalid request", "warning")
-        return redirect(url_for("dashboard.setting"))
-
-    perform_proton_account_unlink(current_user)
-    flash("Your Proton account has been unlinked", "success")
-    return redirect(url_for("dashboard.setting"))

app/app/dashboard/views/alias_export.py

@@ -1,13 +1,9 @@
 from app.dashboard.base import dashboard_bp
 from flask_login import login_required, current_user
 from app.alias_utils import alias_export_csv
-from app.dashboard.views.enter_sudo import sudo_required
-from app.extensions import limiter
 
 
 @dashboard_bp.route("/alias_export", methods=["GET"])
 @login_required
-@sudo_required
-@limiter.limit("2/minute")
 def alias_export_route():
     return alias_export_csv(current_user)

app/app/dashboard/views/batch_import.py

@@ -5,9 +5,7 @@ from flask_login import login_required, current_user
 from app import s3
 from app.config import JOB_BATCH_IMPORT
 from app.dashboard.base import dashboard_bp
-from app.dashboard.views.enter_sudo import sudo_required
 from app.db import Session
-from app.extensions import limiter
 from app.log import LOG
 from app.models import File, BatchImport, Job
 from app.utils import random_string, CSRFValidationForm
@@ -15,8 +13,6 @@ from app.utils import random_string, CSRFValidationForm
 
 @dashboard_bp.route("/batch_import", methods=["GET", "POST"])
 @login_required
-@sudo_required
-@limiter.limit("10/minute", methods=["POST"])
 def batch_import_route():
     # only for users who have custom domains
     if not current_user.verified_custom_domains():
@@ -41,7 +37,7 @@ def batch_import_route():
             return redirect(request.url)
         if len(batch_imports) > 10:
             flash(
-                "You have too many imports already. Please wait until some get cleaned up",
+                "You have too many imports already. Wait until some get cleaned up",
                 "error",
             )
             return render_template(

app/app/dashboard/views/enter_sudo.py

@@ -6,11 +6,11 @@ from flask_login import login_required, current_user
 from flask_wtf import FlaskForm
 from wtforms import PasswordField, validators
 
-from app.config import CONNECT_WITH_PROTON, OIDC_CLIENT_ID, CONNECT_WITH_OIDC_ICON
+from app.config import CONNECT_WITH_PROTON
 from app.dashboard.base import dashboard_bp
 from app.extensions import limiter
 from app.log import LOG
-from app.models import PartnerUser, SocialAuth
+from app.models import PartnerUser
 from app.proton.utils import get_proton_partner
 from app.utils import sanitize_next_url
 
@@ -51,19 +51,11 @@ def enter_sudo():
         if not partner_user or partner_user.partner_id != get_proton_partner().id:
             proton_enabled = False
 
-    oidc_enabled = OIDC_CLIENT_ID is not None
-    if oidc_enabled:
-        oidc_enabled = (
-            SocialAuth.get_by(user_id=current_user.id, social="oidc") is not None
-        )
-
     return render_template(
         "dashboard/enter_sudo.html",
         password_check_form=password_check_form,
         next=request.args.get("next"),
         connect_with_proton=proton_enabled,
-        connect_with_oidc=oidc_enabled,
-        connect_with_oidc_icon=CONNECT_WITH_OIDC_ICON,
     )
 
 

app/app/dashboard/views/setting.py

@@ -13,24 +13,34 @@ from flask_login import login_required, current_user
 from flask_wtf import FlaskForm
 from flask_wtf.file import FileField
 from wtforms import StringField, validators
+from wtforms.fields.html5 import EmailField
 
-from app import s3
+from app import s3, email_utils
 from app.config import (
+    URL,
     FIRST_ALIAS_DOMAIN,
     ALIAS_RANDOM_SUFFIX_LENGTH,
     CONNECT_WITH_PROTON,
 )
 from app.dashboard.base import dashboard_bp
 from app.db import Session
+from app.email_utils import (
+    email_can_be_used_as_mailbox,
+    personal_email_already_used,
+)
 from app.errors import ProtonPartnerNotSetUp
 from app.extensions import limiter
 from app.image_validation import detect_image_format, ImageFormat
+from app.jobs.export_user_data_job import ExportUserDataJob
 from app.log import LOG
 from app.models import (
     BlockBehaviourEnum,
     PlanEnum,
     File,
+    ResetPasswordCode,
     EmailChange,
+    User,
+    Alias,
     CustomDomain,
     AliasGeneratorEnum,
     AliasSuffixEnum,
@@ -43,10 +53,11 @@ from app.models import (
     PartnerSubscription,
     UnsubscribeBehaviourEnum,
 )
-from app.proton.utils import get_proton_partner
+from app.proton.utils import get_proton_partner, perform_proton_account_unlink
 from app.utils import (
     random_string,
     CSRFValidationForm,
+    canonicalize_email,
 )
 
 
@@ -55,6 +66,12 @@ class SettingForm(FlaskForm):
     profile_picture = FileField("Profile Picture")
 
 
+class ChangeEmailForm(FlaskForm):
+    email = EmailField(
+        "email", validators=[validators.DataRequired(), validators.Email()]
+    )
+
+
 class PromoCodeForm(FlaskForm):
     code = StringField("Name", validators=[validators.DataRequired()])
 
@@ -92,6 +109,7 @@ def get_partner_subscription_and_name(
 def setting():
     form = SettingForm()
     promo_form = PromoCodeForm()
+    change_email_form = ChangeEmailForm()
     csrf_form = CSRFValidationForm()
 
     email_change = EmailChange.get_by(user_id=current_user.id)
@@ -104,7 +122,63 @@ def setting():
         if not csrf_form.validate():
             flash("Invalid request", "warning")
             return redirect(url_for("dashboard.setting"))
+        if request.form.get("form-name") == "update-email":
+            if change_email_form.validate():
+                # whether user can proceed with the email update
+                new_email_valid = True
+                new_email = canonicalize_email(change_email_form.email.data)
+                if new_email != current_user.email and not pending_email:
+                    # check if this email is not already used
+                    if personal_email_already_used(new_email) or Alias.get_by(
+                        email=new_email
+                    ):
+                        flash(f"Email {new_email} already used", "error")
+                        new_email_valid = False
+                    elif not email_can_be_used_as_mailbox(new_email):
+                        flash(
+                            "You cannot use this email address as your personal inbox.",
+                            "error",
+                        )
+                        new_email_valid = False
+                    # a pending email change with the same email exists from another user
+                    elif EmailChange.get_by(new_email=new_email):
+                        other_email_change: EmailChange = EmailChange.get_by(
+                            new_email=new_email
+                        )
+                        LOG.w(
+                            "Another user has a pending %s with the same email address. Current user:%s",
+                            other_email_change,
+                            current_user,
+                        )
 
+                        if other_email_change.is_expired():
+                            LOG.d(
+                                "delete the expired email change %s", other_email_change
+                            )
+                            EmailChange.delete(other_email_change.id)
+                            Session.commit()
+                        else:
+                            flash(
+                                "You cannot use this email address as your personal inbox.",
+                                "error",
+                            )
+                            new_email_valid = False
+
+                    if new_email_valid:
+                        email_change = EmailChange.create(
+                            user_id=current_user.id,
+                            code=random_string(
+                                60
+                            ),  # todo: make sure the code is unique
+                            new_email=new_email,
+                        )
+                        Session.commit()
+                        send_change_email_confirmation(current_user, email_change)
+                        flash(
+                            "A confirmation email is on the way, please check your inbox",
+                            "success",
+                        )
+                        return redirect(url_for("dashboard.setting"))
         if request.form.get("form-name") == "update-profile":
             if form.validate():
                 profile_updated = False
@@ -148,6 +222,15 @@ def setting():
                 if profile_updated:
                     flash("Your profile has been updated", "success")
                     return redirect(url_for("dashboard.setting"))
+
+        elif request.form.get("form-name") == "change-password":
+            flash(
+                "You are going to receive an email containing instructions to change your password",
+                "success",
+            )
+            send_reset_password_email(current_user)
+            return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "notification-preference":
             choose = request.form.get("notification")
             if choose == "on":
@@ -157,6 +240,7 @@ def setting():
             Session.commit()
             flash("Your notification preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "change-alias-generator":
             scheme = int(request.form.get("alias-generator-scheme"))
             if AliasGeneratorEnum.has_value(scheme):
@@ -164,6 +248,7 @@ def setting():
                 Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "change-random-alias-default-domain":
             default_domain = request.form.get("random-alias-default-domain")
 
@@ -202,6 +287,7 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "random-alias-suffix":
             scheme = int(request.form.get("random-alias-suffix-generator"))
             if AliasSuffixEnum.has_value(scheme):
@@ -209,6 +295,7 @@ def setting():
                 Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "change-sender-format":
             sender_format = int(request.form.get("sender-format"))
             if SenderFormatEnum.has_value(sender_format):
@@ -218,6 +305,7 @@ def setting():
                 flash("Your sender format preference has been updated", "success")
             Session.commit()
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "replace-ra":
             choose = request.form.get("replace-ra")
             if choose == "on":
@@ -227,6 +315,7 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "sender-in-ra":
             choose = request.form.get("enable")
             if choose == "on":
@@ -236,6 +325,7 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+
         elif request.form.get("form-name") == "expand-alias-info":
             choose = request.form.get("enable")
             if choose == "on":
@@ -297,6 +387,14 @@ def setting():
             Session.commit()
             flash("Your preference has been updated", "success")
             return redirect(url_for("dashboard.setting"))
+        elif request.form.get("form-name") == "send-full-user-report":
+            if ExportUserDataJob(current_user).store_job_in_db():
+                flash(
+                    "You will receive your SimpleLogin data via email shortly",
+                    "success",
+                )
+            else:
+                flash("An export of your data is currently in progress", "error")
 
     manual_sub = ManualSubscription.get_by(user_id=current_user.id)
     apple_sub = AppleSubscription.get_by(user_id=current_user.id)
@@ -319,6 +417,7 @@ def setting():
         SenderFormatEnum=SenderFormatEnum,
         BlockBehaviourEnum=BlockBehaviourEnum,
         promo_form=promo_form,
+        change_email_form=change_email_form,
         pending_email=pending_email,
         AliasGeneratorEnum=AliasGeneratorEnum,
         UnsubscribeBehaviourEnum=UnsubscribeBehaviourEnum,
@@ -333,3 +432,85 @@ def setting():
         connect_with_proton=CONNECT_WITH_PROTON,
         proton_linked_account=proton_linked_account,
     )
+
+
+def send_reset_password_email(user):
+    """
+    generate a new ResetPasswordCode and send it over email to user
+    """
+    # the activation code is valid for 1h
+    reset_password_code = ResetPasswordCode.create(
+        user_id=user.id, code=random_string(60)
+    )
+    Session.commit()
+
+    reset_password_link = f"{URL}/auth/reset_password?code={reset_password_code.code}"
+
+    email_utils.send_reset_password_email(user.email, reset_password_link)
+
+
+def send_change_email_confirmation(user: User, email_change: EmailChange):
+    """
+    send confirmation email to the new email address
+    """
+
+    link = f"{URL}/auth/change_email?code={email_change.code}"
+
+    email_utils.send_change_email(email_change.new_email, user.email, link)
+
+
+@dashboard_bp.route("/resend_email_change", methods=["GET", "POST"])
+@limiter.limit("5/hour")
+@login_required
+def resend_email_change():
+    form = CSRFValidationForm()
+    if not form.validate():
+        flash("Invalid request. Please try again", "warning")
+        return redirect(url_for("dashboard.setting"))
+    email_change = EmailChange.get_by(user_id=current_user.id)
+    if email_change:
+        # extend email change expiration
+        email_change.expired = arrow.now().shift(hours=12)
+        Session.commit()
+
+        send_change_email_confirmation(current_user, email_change)
+        flash("A confirmation email is on the way, please check your inbox", "success")
+        return redirect(url_for("dashboard.setting"))
+    else:
+        flash(
+            "You have no pending email change. Redirect back to Setting page", "warning"
+        )
+        return redirect(url_for("dashboard.setting"))
+
+
+@dashboard_bp.route("/cancel_email_change", methods=["GET", "POST"])
+@login_required
+def cancel_email_change():
+    form = CSRFValidationForm()
+    if not form.validate():
+        flash("Invalid request. Please try again", "warning")
+        return redirect(url_for("dashboard.setting"))
+    email_change = EmailChange.get_by(user_id=current_user.id)
+    if email_change:
+        EmailChange.delete(email_change.id)
+        Session.commit()
+        flash("Your email change is cancelled", "success")
+        return redirect(url_for("dashboard.setting"))
+    else:
+        flash(
+            "You have no pending email change. Redirect back to Setting page", "warning"
+        )
+        return redirect(url_for("dashboard.setting"))
+
+
+@dashboard_bp.route("/unlink_proton_account", methods=["POST"])
+@login_required
+def unlink_proton_account():
+    csrf_form = CSRFValidationForm()
+    if not csrf_form.validate():
+        flash("Invalid request", "warning")
+        return redirect(url_for("dashboard.setting"))
+
+    perform_proton_account_unlink(current_user)
+    flash("Your Proton account has been unlinked", "success")
+    return redirect(url_for("dashboard.setting"))

app/app/email_utils.py

@@ -1403,7 +1403,7 @@ def generate_verp_email(
     # Time is in minutes granularity and start counting on 2022-01-01 to reduce bytes to represent time
     data = [
         verp_type.value,
-        object_id or 0,
+        object_id,
         int((time.time() - VERP_TIME_START) / 60),
     ]
     json_payload = json.dumps(data).encode("utf-8")

app/app/handler/unsubscribe_generator.py

@@ -3,7 +3,6 @@ from email.header import Header
 from email.message import Message
 
 from app.email import headers
-from app import config
 from app.email_utils import add_or_replace_header, delete_header
 from app.handler.unsubscribe_encoder import (
     UnsubscribeEncoder,
@@ -48,11 +47,6 @@ class UnsubscribeGenerator:
             method = raw_method[start + 1 : end]
             url_data = urllib.parse.urlparse(method)
             if url_data.scheme == "mailto":
-                if url_data.path == config.UNSUBSCRIBER:
-                    LOG.debug(
-                        f"Skipping replacing unsubscribe since the original email already points to {config.UNSUBSCRIBER}"
-                    )
-                    return message
                 query_data = urllib.parse.parse_qs(url_data.query)
                 mailto_unsubs = (url_data.path, query_data.get("subject", [""])[0])
                 LOG.debug(f"Unsub is mailto to {mailto_unsubs}")

app/app/models.py

@@ -1422,9 +1422,6 @@ def generate_random_alias_email(
 
 class Alias(Base, ModelMixin):
     __tablename__ = "alias"
-
-    FLAG_PARTNER_CREATED = 1 << 0
-
     user_id = sa.Column(
         sa.ForeignKey(User.id, ondelete="cascade"), nullable=False, index=True
     )
@@ -1434,9 +1431,6 @@ class Alias(Base, ModelMixin):
     name = sa.Column(sa.String(128), nullable=True, default=None)
 
     enabled = sa.Column(sa.Boolean(), default=True, nullable=False)
-    flags = sa.Column(
-        sa.BigInteger(), default=0, server_default="0", nullable=False, index=True
-    )
 
     custom_domain_id = sa.Column(
         sa.ForeignKey("custom_domain.id", ondelete="cascade"), nullable=True, index=True
@@ -2592,13 +2586,10 @@ class Job(Base, ModelMixin):
         nullable=False,
         server_default=str(JobState.ready.value),
         default=JobState.ready.value,
-        index=True,
     )
     attempts = sa.Column(sa.Integer, nullable=False, server_default="0", default=0)
     taken_at = sa.Column(ArrowType, nullable=True)
 
-    __table_args__ = (Index("ix_state_run_at_taken_at", state, run_at, taken_at),)
-
     def __repr__(self):
         return f"<Job {self.id} {self.name} {self.payload}>"
 
@@ -2946,9 +2937,7 @@ class RecoveryCode(Base, ModelMixin):
 
 class Notification(Base, ModelMixin):
     __tablename__ = "notification"
-    user_id = sa.Column(
-        sa.ForeignKey(User.id, ondelete="cascade"), nullable=False, index=True
-    )
+    user_id = sa.Column(sa.ForeignKey(User.id, ondelete="cascade"), nullable=False)
     message = sa.Column(sa.Text, nullable=False)
     title = sa.Column(sa.String(512))
 
@@ -3189,20 +3178,6 @@ class TransactionalEmail(Base, ModelMixin):
 
     __table_args__ = (sa.Index("ix_transactional_email_created_at", "created_at"),)
 
-    @classmethod
-    def create(cls, **kw):
-        # whether to call Session.commit
-        commit = kw.pop("commit", False)
-
-        r = cls(**kw)
-        if not config.STORE_TRANSACTIONAL_EMAILS:
-            return r
-
-        Session.add(r)
-        if commit:
-            Session.commit()
-        return r
-
 
 class Payout(Base, ModelMixin):
     """Referral payouts"""

app/cron.py

@@ -962,9 +962,6 @@ async def _hibp_check(api_key, queue):
 
     This function to be ran simultaneously (multiple _hibp_check functions with different keys on the same queue) to make maximum use of multiple API keys.
     """
-    default_rate_sleep = (60.0 / config.HIBP_RPM) + 0.1
-    rate_sleep = default_rate_sleep
-    rate_hit_counter = 0
     while True:
         try:
             alias_id = queue.get_nowait()
@@ -972,14 +969,9 @@ async def _hibp_check(api_key, queue):
             return
 
         alias = Alias.get(alias_id)
+        # an alias can be deleted in the meantime
         if not alias:
-            continue
-        user = alias.user
-        if user.disabled or not user.is_paid():
-            # Mark it as hibp done to skip it as if it had been checked
-            alias.hibp_last_check = arrow.utcnow()
-            Session.commit()
-            continue
+            return
 
         LOG.d("Checking HIBP for %s", alias)
 
@@ -991,6 +983,7 @@ async def _hibp_check(api_key, queue):
             f"https://haveibeenpwned.com/api/v3/breachedaccount/{urllib.parse.quote(alias.email)}",
             headers=request_headers,
         )
+
         if r.status_code == 200:
             # Breaches found
             alias.hibp_breaches = [
@@ -998,27 +991,20 @@ async def _hibp_check(api_key, queue):
             ]
             if len(alias.hibp_breaches) > 0:
                 LOG.w("%s appears in HIBP breaches %s", alias, alias.hibp_breaches)
-            if rate_hit_counter > 0:
-                rate_hit_counter -= 1
         elif r.status_code == 404:
             # No breaches found
             alias.hibp_breaches = []
         elif r.status_code == 429:
             # rate limited
             LOG.w("HIBP rate limited, check alias %s in the next run", alias)
-            rate_hit_counter += 1
-            rate_sleep = default_rate_sleep + (0.2 * rate_hit_counter)
-            if rate_hit_counter > 10:
-                LOG.w(f"HIBP rate limited too many times stopping with alias {alias}")
-                return
-            # Just sleep for a while
-            asyncio.sleep(5)
+            await asyncio.sleep(1.6)
+            return
         elif r.status_code > 500:
             LOG.w("HIBP server 5** error %s", r.status_code)
             return
         else:
             LOG.error(
-                "An error occurred while checking alias %s: %s - %s",
+                "An error occured while checking alias %s: %s - %s",
                 alias,
                 r.status_code,
                 r.text,
@@ -1029,62 +1015,9 @@ async def _hibp_check(api_key, queue):
         Session.add(alias)
         Session.commit()
 
-        LOG.d("Updated breach info for %s", alias)
-        await asyncio.sleep(rate_sleep)
+        LOG.d("Updated breaches info for %s", alias)
 
-
-def get_alias_to_check_hibp(
-    oldest_hibp_allowed: arrow.Arrow,
-    user_ids_to_skip: list[int],
-    min_alias_id: int,
-    max_alias_id: int,
-):
-    now = arrow.now()
-    alias_query = (
-        Session.query(Alias)
-        .join(User, User.id == Alias.user_id)
-        .join(Subscription, User.id == Subscription.user_id, isouter=True)
-        .join(ManualSubscription, User.id == ManualSubscription.user_id, isouter=True)
-        .join(AppleSubscription, User.id == AppleSubscription.user_id, isouter=True)
-        .join(
-            CoinbaseSubscription,
-            User.id == CoinbaseSubscription.user_id,
-            isouter=True,
-        )
-        .join(PartnerUser, User.id == PartnerUser.user_id, isouter=True)
-        .join(
-            PartnerSubscription,
-            PartnerSubscription.partner_user_id == PartnerUser.id,
-            isouter=True,
-        )
-        .filter(
-            or_(
-                Alias.hibp_last_check.is_(None),
-                Alias.hibp_last_check < oldest_hibp_allowed,
-            ),
-            Alias.user_id.notin_(user_ids_to_skip),
-            Alias.enabled,
-            Alias.id >= min_alias_id,
-            Alias.id < max_alias_id,
-            User.disabled == False,  # noqa: E712
-            or_(
-                User.lifetime,
-                ManualSubscription.end_at > now,
-                Subscription.next_bill_date > now.date(),
-                AppleSubscription.expires_date > now,
-                CoinbaseSubscription.end_at > now,
-                PartnerSubscription.end_at > now,
-            ),
-        )
-    )
-    if config.HIBP_SKIP_PARTNER_ALIAS:
-        alias_query = alias_query.filter(
-            Alias.flags.op("&")(Alias.FLAG_PARTNER_CREATED) == 0
-        )
-    for alias in (
-        alias_query.order_by(Alias.id.asc()).enable_eagerloads(False).yield_per(500)
-    ):
-        yield alias
+        await asyncio.sleep(1.6)
 
 
 async def check_hibp():
@@ -1107,49 +1040,40 @@ async def check_hibp():
     Session.commit()
     LOG.d("Updated list of known breaches")
 
-    LOG.d("Getting the list of users to skip")
-    query = "select u.id, count(a.id) from users u, alias a where a.user_id=u.id group by u.id having count(a.id) > :max_alias"
-    rows = Session.execute(query, {"max_alias": config.HIBP_MAX_ALIAS_CHECK})
-    user_ids = [row[0] for row in rows]
-    LOG.d("Got %d users to skip" % len(user_ids))
-
-    LOG.d("Checking aliases")
+    LOG.d("Preparing list of aliases to check")
     queue = asyncio.Queue()
-    min_alias_id = 0
-    max_alias_id = Session.query(func.max(Alias.id)).scalar()
-    step = 10000
-    now = arrow.now()
-    oldest_hibp_allowed = now.shift(days=-config.HIBP_SCAN_INTERVAL_DAYS)
-    alias_checked = 0
-    for alias_batch_id in range(min_alias_id, max_alias_id, step):
-        for alias in get_alias_to_check_hibp(
-            oldest_hibp_allowed, user_ids, alias_batch_id, alias_batch_id + step
-        ):
-            await queue.put(alias.id)
-
-        alias_checked += queue.qsize()
-        LOG.d(
-            f"Need to check about {queue.qsize()} aliases in this loop {alias_batch_id}/{max_alias_id}"
+    max_date = arrow.now().shift(days=-config.HIBP_SCAN_INTERVAL_DAYS)
+    for alias in (
+        Alias.filter(
+            or_(Alias.hibp_last_check.is_(None), Alias.hibp_last_check < max_date)
         )
+        .filter(Alias.enabled)
+        .order_by(Alias.hibp_last_check.asc())
+        .yield_per(500)
+        .enable_eagerloads(False)
+    ):
+        await queue.put(alias.id)
 
-        # Start one checking process per API key
-        # Each checking process will take one alias from the queue, get the info
-        # and then sleep for 1.5 seconds (due to HIBP API request limits)
-        checkers = []
-        for i in range(len(config.HIBP_API_KEYS)):
-            checker = asyncio.create_task(
-                _hibp_check(
-                    config.HIBP_API_KEYS[i],
-                    queue,
-                )
+    LOG.d("Need to check about %s aliases", queue.qsize())
+
+    # Start one checking process per API key
+    # Each checking process will take one alias from the queue, get the info
+    # and then sleep for 1.5 seconds (due to HIBP API request limits)
+    checkers = []
+    for i in range(len(config.HIBP_API_KEYS)):
+        checker = asyncio.create_task(
+            _hibp_check(
+                config.HIBP_API_KEYS[i],
+                queue,
             )
-            checkers.append(checker)
+        )
+        checkers.append(checker)
 
-        # Wait until all checking processes are done
-        for checker in checkers:
-            await checker
+    # Wait until all checking processes are done
+    for checker in checkers:
+        await checker
 
-    LOG.d(f"Done checking {alias_checked} HIBP API for aliases in breaches")
+    LOG.d("Done checking HIBP API for aliases in breaches")
 
 
 def notify_hibp():

app/email_handler.py

@@ -1891,30 +1891,24 @@ def handle_transactional_bounce(
     envelope: Envelope, msg, rcpt_to, transactional_id=None
 ):
     LOG.d("handle transactional bounce sent to %s", rcpt_to)
-    if transactional_id is None:
-        LOG.i(
-            f"No transactional record for {envelope.mail_from} -> {envelope.rcpt_tos}"
-        )
-        return
 
+    # parse the TransactionalEmail
+    transactional_id = transactional_id or parse_id_from_bounce(rcpt_to)
     transactional = TransactionalEmail.get(transactional_id)
+
     # a transaction might have been deleted in delete_logs()
-    if not transactional:
-        LOG.i(
-            f"No transactional record for {envelope.mail_from} -> {envelope.rcpt_tos}"
-        )
-        return
-    LOG.i("Create bounce for %s", transactional.email)
-    bounce_info = get_mailbox_bounce_info(msg)
-    if bounce_info:
-        Bounce.create(
-            email=transactional.email,
-            info=bounce_info.as_bytes().decode(),
-            commit=True,
-        )
-    else:
-        LOG.w("cannot get bounce info, debug at %s", save_email_for_debugging(msg))
-        Bounce.create(email=transactional.email, commit=True)
+    if transactional:
+        LOG.i("Create bounce for %s", transactional.email)
+        bounce_info = get_mailbox_bounce_info(msg)
+        if bounce_info:
+            Bounce.create(
+                email=transactional.email,
+                info=bounce_info.as_bytes().decode(),
+                commit=True,
+            )
+        else:
+            LOG.w("cannot get bounce info, debug at %s", save_email_for_debugging(msg))
+            Bounce.create(email=transactional.email, commit=True)
 
 
 def handle_bounce(envelope, email_log: EmailLog, msg: Message) -> str:

app/example.env

@@ -116,16 +116,6 @@ WORDS_FILE_PATH=local_data/test_words.txt
 # CONNECT_WITH_PROTON=true
 # CONNECT_WITH_PROTON_COOKIE_NAME=to_fill
 
-# Login with OIDC
-# CONNECT_WITH_OIDC_ICON=fa-github
-# OIDC_AUTHORIZATION_URL=to_fill
-# OIDC_USER_INFO_URL=to_fill
-# OIDC_TOKEN_URL=to_fill
-# OIDC_SCOPES=openid email profile
-# OIDC_NAME_FIELD=name
-# OIDC_CLIENT_ID=to_fill
-# OIDC_CLIENT_SECRET=to_fill
-
 # Flask profiler
 # FLASK_PROFILER_PATH=/tmp/flask-profiler.sql
 # FLASK_PROFILER_PASSWORD=password

app/migrations/versions/2024_031212_52510a633d6f_.py

@@ -1,48 +0,0 @@
-"""empty message
-
-Revision ID: 52510a633d6f
-Revises: 818b0a956205
-Create Date: 2024-03-12 12:46:24.161644
-
-"""
-import sqlalchemy_utils
-from alembic import op
-import sqlalchemy as sa
-
-
-# revision identifiers, used by Alembic.
-revision = "52510a633d6f"
-down_revision = "818b0a956205"
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    op.add_column(
-        "alias", sa.Column("flags", sa.BigInteger(), server_default="0", nullable=False)
-    )
-    with op.get_context().autocommit_block():
-        op.create_index(op.f("ix_alias_flags"), "alias", ["flags"], unique=False)
-        op.create_index(op.f("ix_job_state"), "job", ["state"], unique=False)
-        op.create_index(
-            "ix_state_run_at_taken_at",
-            "job",
-            ["state", "run_at", "taken_at"],
-            unique=False,
-        )
-        op.create_index(
-            op.f("ix_notification_user_id"), "notification", ["user_id"], unique=False
-        )
-    # ### end Alembic commands ###
-
-
-def downgrade():
-    # ### commands auto generated by Alembic - please adjust! ###
-    with op.get_context().autocommit_block():
-        op.drop_index(op.f("ix_notification_user_id"), table_name="notification")
-        op.drop_index("ix_state_run_at_taken_at", table_name="job")
-        op.drop_index(op.f("ix_job_state"), table_name="job")
-        op.drop_index(op.f("ix_alias_flags"), table_name="alias")
-    op.drop_column("alias", "flags")
-    # ### end Alembic commands ###

app/oneshot/emulate_dummy_load.py

@@ -1,37 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import random
-import time
-
-from sqlalchemy import func
-
-from app import config
-from app.models import Alias, Contact
-from app.db import Session
-
-parser = argparse.ArgumentParser(
-    prog=f"Replace {config.NOREPLY}",
-    description=f"Replace {config.NOREPLY} from contacts reply email",
-)
-args = parser.parse_args()
-
-max_alias_id: int = Session.query(func.max(Alias.id)).scalar()
-
-start = time.time()
-tests = 1000
-for i in range(tests):
-    alias = (
-        Alias.filter(Alias.id > int(random.random() * max_alias_id))
-        .order_by(Alias.id.asc())
-        .limit(1)
-        .first()
-    )
-    contact = Contact.filter_by(alias_id=alias.id).order_by(Contact.id.asc()).first()
-    mailboxes = alias.mailboxes
-    user = alias.user
-    if i % 10:
-        print("{i} -> {alias.id}")
-
-end = time.time()
-time_taken = end - start
-print(f"Took {time_taken} -> {time_taken/tests} per test")

app/oneshot/mark_aliases_as_partner_created.py

@@ -1,56 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-import time
-
-from sqlalchemy import func
-
-from app.models import Alias, SLDomain
-from app.db import Session
-
-parser = argparse.ArgumentParser(
-    prog="Mark partner created aliases with the PARTNER_CREATED flag",
-)
-parser.add_argument(
-    "-s", "--start_alias_id", default=0, type=int, help="Initial alias_id"
-)
-parser.add_argument("-e", "--end_alias_id", default=0, type=int, help="Last alias_id")
-
-args = parser.parse_args()
-alias_id_start = args.start_alias_id
-max_alias_id = args.end_alias_id
-if max_alias_id == 0:
-    max_alias_id = Session.query(func.max(Alias.id)).scalar()
-
-print(f"Updating aliases from {alias_id_start} to {max_alias_id}")
-
-domains = SLDomain.filter(SLDomain.partner_id.isnot(None)).all()
-cond = [f"email like '%{domain.domain}'" for domain in domains]
-sql_or_cond = " OR ".join(cond)
-sql = f"UPDATE alias set flags = (flags | :flag) WHERE id >= :start and id<:end and flags & :flag = 0 and ({sql_or_cond})"
-print(sql)
-
-step = 1000
-updated = 0
-start_time = time.time()
-for batch_start in range(alias_id_start, max_alias_id, step):
-    updated += Session.execute(
-        sql,
-        {
-            "start": batch_start,
-            "end": batch_start + step,
-            "flag": Alias.FLAG_PARTNER_CREATED,
-        },
-    ).rowcount
-    elapsed = time.time() - start_time
-    time_per_alias = elapsed / (batch_start - alias_id_start + step)
-    last_batch_id = batch_start + step
-    remaining = max_alias_id - last_batch_id
-    time_remaining = (max_alias_id - last_batch_id) * time_per_alias
-    hours_remaining = time_remaining / 3600.0
-    percent = int(
-        ((batch_start - alias_id_start) * 100) / (max_alias_id - alias_id_start)
-    )
-    print(
-        f"\rAlias {batch_start}/{max_alias_id} {percent}% {updated} updated {hours_remaining:.2f}hrs remaining"
-    )
-print(f"Updated aliases up to {max_alias_id}")

app/templates/auth/login.html

@@ -38,21 +38,11 @@
           <span>or</span>
         </div>
         <a class="btn btn-primary btn-block mt-2 proton-button"
-           href="{{ url_for('auth.proton_login', next=next_url) }}">
+           href="{{ url_for("auth.proton_login", next=next_url) }}">
           <img class="mr-2" src="/static/images/proton.svg" />
           Log in with Proton
         </a>
       {% endif %}
-      {% if connect_with_oidc %}
-
-        <div class="text-center my-2 text-gray">
-          <span>or</span>
-        </div>
-        <a class="btn btn-primary btn-block mt-2 btn-social"
-           href="{{ url_for('auth.oidc_login', next=next_url) }}">
-          <i class="fa {{ connect_with_oidc_icon }}"></i> Log in with SSO
-        </a>
-      {% endif %}
     </div>
   </div>
   <div class="text-center text-muted mt-2">

app/templates/auth/register.html

@@ -50,21 +50,11 @@
           <span>or</span>
         </div>
         <a class="btn btn-primary btn-block mt-2 proton-button"
-           href="{{ url_for('auth.proton_login', next=next_url) }}">
+           href="{{ url_for("auth.proton_login", next=next_url) }}">
           <img class="mr-2" src="/static/images/proton.svg" />
           Sign up with Proton
         </a>
       {% endif %}
-      {% if connect_with_oidc %}
-
-        <div class="text-center my-2 text-gray">
-          <span>or</span>
-        </div>
-        <a class="btn btn-primary btn-block mt-2 btn-social"
-           href="{{ url_for('auth.oidc_login', next=next_url) }}">
-          <i class="fa {{ connect_with_oidc_icon }}"></i> Sign up with SSO
-        </a>
-      {% endif %}
     </div>
   </form>
   <div class="text-center text-muted mb-6">

app/templates/dashboard/account_setting.html

@@ -1,164 +0,0 @@
-{% extends "default.html" %}
-
-{% set active_page = "setting" %}
-{% block title %}Settings{% endblock %}
-{% block head %}
-
-  <style>
-        .card-title {
-            font-size: 22px;
-            font-weight: 600;
-            margin-bottom: 3px;
-        }
-        .highlighted{
-            border: solid 2px #5675E2;
-        }
-        li {
-            margin-top: 8px;
-        }
-
-  </style>
-{% endblock %}
-{% block default_content %}
-
-  <div class="col pb-3">
-    <!-- Change email -->
-    <div class="card">
-      <div class="card-body">
-        <form method="post" enctype="multipart/form-data">
-          <input type="hidden" name="form-name" value="update-email">
-          {{ change_email_form.csrf_token }}
-          <div class="card-title">Account Email</div>
-          <div class="mb-3">
-            This email address is used to log in to SimpleLogin.
-            <br />
-            If you want to change the mailbox that emails are forwarded to, use the
-            <a href="{{ url_for('dashboard.mailbox_route') }}">
-              <i class="fe fe-inbox"></i> Mailboxes page
-            </a>
-            instead.
-          </div>
-          <div class="form-group mt-2">
-            <!-- Not allow user to change email if there's a pending change -->
-            {{ change_email_form.email(class="form-control", value=current_user.email, readonly=pending_email != None) }}
-            {{ render_field_errors(change_email_form.email) }}
-          </div>
-          <button class="btn btn-outline-primary">Change Email</button>
-        </form>
-        {% if pending_email %}
-
-          <div class="mt-2">
-            <span class="text-danger float-left">Pending email change: {{ pending_email }}</span>
-            <form method="POST"
-                  action="{{ url_for('dashboard.resend_email_change') }}"
-                  class="float-left ml-2">
-              {{ change_email_form.csrf_token }}
-              <a onclick="this.closest('form').submit()"
-                 class="btn btn-secondary btn-sm">Resend confirmation email</a>
-            </form>
-            <form method="POST"
-                  action="{{ url_for('dashboard.cancel_email_change') }}"
-                  class="float-left ml-2">
-              {{ change_email_form.csrf_token }}
-              <a onclick="this.closest('form').submit()"
-                 class="btn btn-secondary btn-sm">Cancel email change</a>
-            </form>
-          </div>
-        {% endif %}
-      </div>
-    </div>
-    <!-- END Change email -->
-    <!-- Change password -->
-    <div class="card" id="change_password">
-      <div class="card-body">
-        <div class="card-title">Password</div>
-        <div class="mb-3">You will receive an email containing instructions on how to change your password.</div>
-        <form method="post">
-          {{ csrf_form.csrf_token }}
-          <input type="hidden" name="form-name" value="change-password">
-          <button class="btn btn-outline-primary">Change password</button>
-        </form>
-      </div>
-    </div>
-    <!-- END Change password -->
-    <!-- TOTP -->
-    <div class="card" id="totp">
-      <div class="card-body">
-        <div class="card-title">Two Factor Authentication</div>
-        <div class="mb-3">
-          Secure your account with 2FA, you'll be asked for a code generated through an app when you login.
-          <br />
-        </div>
-        {% if not current_user.enable_otp %}
-
-          <a href="{{ url_for('dashboard.mfa_setup') }}"
-             class="btn btn-outline-primary">Setup TOTP</a>
-        {% else %}
-          <a href="{{ url_for('dashboard.mfa_cancel') }}"
-             class="btn btn-outline-danger">Disable TOTP</a>
-        {% endif %}
-      </div>
-    </div>
-    <!-- END TOTP -->
-    <!-- WebAuthn -->
-    <div class="card">
-      <div class="card-body">
-        <div class="card-title">Security Key (WebAuthn)</div>
-        <div class="mb-3">
-          You can secure your account by linking either your FIDO-supported physical key such as Yubikey, Google
-          Titan,
-          or a device with appropriate hardware to your account.
-        </div>
-        {% if current_user.fido_uuid is none %}
-
-          <a href="{{ url_for('dashboard.fido_setup') }}"
-             class="btn btn-outline-primary">Setup WebAuthn</a>
-        {% else %}
-          <a href="{{ url_for('dashboard.fido_manage') }}"
-             class="btn btn-outline-info">Manage WebAuthn</a>
-        {% endif %}
-      </div>
-    </div>
-    <!-- END WebAuthn -->
-    <!-- data export -->
-    <div class="card">
-      <div class="card-body">
-        <div class="card-title">SimpleLogin data export</div>
-        <div class="mb-3">
-          As per GDPR (General Data Protection Regulation) law, you can request a copy of your data which are stored on
-          SimpleLogin.
-          A zip file that contains all information will be sent to your SimpleLogin account address.
-        </div>
-        <div class="d-flex">
-          <div>
-            <form method="post">
-              {{ csrf_form.csrf_token }}
-              <input type="hidden" name="form-name" value="send-full-user-report">
-              <button class="btn btn-outline-info">Request your data</button>
-            </form>
-          </div>
-        </div>
-      </div>
-    </div>
-    <!-- END data export -->
-    <!-- Delete account -->
-    <div class="card">
-      <div class="card-body">
-        <div class="card-title">Account Deletion</div>
-        <div class="mb-3">If SimpleLogin isn't the right fit for you, you can simply delete your account.</div>
-        <a href="{{ url_for('dashboard.delete_account') }}"
-           class="btn btn-outline-danger">Delete account</a>
-      </div>
-    </div>
-    <!-- END Delete account -->
-  </div>
-{% endblock %}
-{% block script %}
-
-  <script>
-        let anchor = window.location.hash;
-        $(anchor).addClass("highlighted")
-
-
-  </script>
-{% endblock %}

app/templates/dashboard/enter_sudo.html

@@ -22,20 +22,11 @@
           <p>Alternatively you can use your Proton credentials to ensure it's you.</p>
         </div>
         <a class="btn btn-primary btn-block mt-2 proton-button w-25"
-           href="{{ url_for('auth.proton_login', next=next) }}">
+           href="{{ url_for("auth.proton_login", next=next) }}">
           <img class="mr-2" src="/static/images/proton.svg" />
           Authenticate with Proton
         </a>
       {% endif %}
-      {% if connect_with_oidc %}
-
-        <div class="my-3">
-          <p>Alternatively you can use your SSO credentials to ensure it's you.</p>
-          <a class="btn btn-primary btn-block mt-2 btn-social w-25"
-             href="{{ url_for('auth.oidc_login', next=next) }}">
-            <i class="fa {{ connect_with_oidc_icon }}"></i> Authenticate with SSO
-          </a>
-        {% endif %}
-      </div>
     </div>
-  {% endblock %}
+  </div>
+{% endblock %}

app/templates/dashboard/setting.html

@@ -88,6 +88,45 @@
       </div>
     </div>
     <!-- END Current plan -->
+    <!-- TOTP -->
+    <div class="card" id="totp">
+      <div class="card-body">
+        <div class="card-title">Two Factor Authentication</div>
+        <div class="mb-3">
+          Secure your account with 2FA, you'll be asked for a code generated through an app when you login.
+          <br />
+        </div>
+        {% if not current_user.enable_otp %}
+
+          <a href="{{ url_for('dashboard.mfa_setup') }}"
+             class="btn btn-outline-primary">Setup TOTP</a>
+        {% else %}
+          <a href="{{ url_for('dashboard.mfa_cancel') }}"
+             class="btn btn-outline-danger">Disable TOTP</a>
+        {% endif %}
+      </div>
+    </div>
+    <!-- END TOTP -->
+    <!-- WebAuthn -->
+    <div class="card">
+      <div class="card-body">
+        <div class="card-title">Security Key (WebAuthn)</div>
+        <div class="mb-3">
+          You can secure your account by linking either your FIDO-supported physical key such as Yubikey, Google
+          Titan,
+          or a device with appropriate hardware to your account.
+        </div>
+        {% if current_user.fido_uuid is none %}
+
+          <a href="{{ url_for('dashboard.fido_setup') }}"
+             class="btn btn-outline-primary">Setup WebAuthn</a>
+        {% else %}
+          <a href="{{ url_for('dashboard.fido_manage') }}"
+             class="btn btn-outline-info">Manage WebAuthn</a>
+        {% endif %}
+      </div>
+    </div>
+    <!-- END WebAuthn -->
     <!-- Newsletter -->
     <div class="card" id="notification">
       <div class="card-body">
@@ -140,6 +179,52 @@
       </form>
     </div>
     <!-- END change name & profile picture -->
+    <!-- Change email -->
+    <div class="card">
+      <div class="card-body">
+        <form method="post" enctype="multipart/form-data">
+          <input type="hidden" name="form-name" value="update-email">
+          {{ change_email_form.csrf_token }}
+          <div class="card-title">Account Email</div>
+          <div class="mb-3">
+            This email address is used to log in to SimpleLogin.
+            <br />
+            If you want to change the mailbox that emails are forwarded to, use the
+            <a href="{{ url_for('dashboard.mailbox_route') }}">
+              <i class="fe fe-inbox"></i> Mailboxes page
+            </a>
+            instead.
+          </div>
+          <div class="form-group mt-2">
+            <!-- Not allow user to change email if there's a pending change -->
+            {{ change_email_form.email(class="form-control", value=current_user.email, readonly=pending_email != None) }}
+            {{ render_field_errors(change_email_form.email) }}
+          </div>
+          <button class="btn btn-outline-primary">Change Email</button>
+        </form>
+        {% if pending_email %}
+
+          <div class="mt-2">
+            <span class="text-danger float-left">Pending email change: {{ pending_email }}</span>
+            <form method="POST"
+                  action="{{ url_for('dashboard.resend_email_change') }}"
+                  class="float-left ml-2">
+              {{ change_email_form.csrf_token }}
+              <a onclick="this.closest('form').submit()"
+                 class="btn btn-secondary btn-sm">Resend confirmation email</a>
+            </form>
+            <form method="POST"
+                  action="{{ url_for('dashboard.cancel_email_change') }}"
+                  class="float-left ml-2">
+              {{ change_email_form.csrf_token }}
+              <a onclick="this.closest('form').submit()"
+                 class="btn btn-secondary btn-sm">Cancel email change</a>
+            </form>
+          </div>
+        {% endif %}
+      </div>
+    </div>
+    <!-- END Change email -->
     <!-- Connect with Proton -->
     {% if connect_with_proton %}
 
@@ -180,11 +265,32 @@
       </div>
     {% endif %}
     <!-- END Connect with Proton -->
+    <!-- Change password -->
+    <div class="card" id="change_password">
+      <div class="card-body">
+        <div class="card-title">Password</div>
+        <div class="mb-3">
+          You will receive an email containing instructions on how to change your password.
+        </div>
+        <form method="post">
+          {{ csrf_form.csrf_token }}
+          <input type="hidden" name="form-name" value="change-password">
+          <button class="btn btn-outline-primary">
+            Change password
+          </button>
+        </form>
+      </div>
+    </div>
+    <!-- END Change password -->
     <!-- Random alias -->
     <div id="random-alias" class="card">
       <div class="card-body">
-        <div class="card-title">Aliases</div>
-        <div class="mt-3 mb-1">Change the way random aliases are generated by default.</div>
+        <div class="card-title">
+          Aliases
+        </div>
+        <div class="mt-3 mb-1">
+          Change the way random aliases are generated by default.
+        </div>
         <form method="post" action="#random-alias" class="form-inline">
           {{ csrf_form.csrf_token }}
           <input type="hidden" name="form-name" value="change-alias-generator">
@@ -200,9 +306,13 @@
               on {{ AliasGeneratorEnum.uuid.name.upper() }}
             </option>
           </select>
-          <button class="btn btn-outline-primary">Update</button>
+          <button class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
-        <div class="mt-3 mb-1">Select the default domain for aliases.</div>
+        <div class="mt-3 mb-1">
+          Select the default domain for aliases.
+        </div>
         <form method="post" action="#random-alias" class="form-inline">
           {{ csrf_form.csrf_token }}
           <input type="hidden"
@@ -228,9 +338,13 @@
               </option>
             {% endfor %}
           </select>
-          <button class="btn btn-outline-primary">Update</button>
+          <button class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
-        <div id="random-alias-suffix" class="mt-3 mb-1">Select the default suffix generator for aliases.</div>
+        <div id="random-alias-suffix" class="mt-3 mb-1">
+          Select the default suffix generator for aliases.
+        </div>
         <form method="post" action="#random-alias-suffix" class="form-inline">
           {{ csrf_form.csrf_token }}
           <input type="hidden" name="form-name" value="random-alias-suffix">
@@ -244,7 +358,9 @@
               Random combination of {{ ALIAS_RAND_SUFFIX_LENGTH }} letter and digits
             </option>
           </select>
-          <button class="btn btn-outline-primary">Update</button>
+          <button class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
       </div>
     </div>
@@ -252,7 +368,9 @@
     <!-- Sender Format -->
     <div class="card" id="sender-format">
       <div class="card-body">
-        <div class="card-title">Sender Address Format</div>
+        <div class="card-title">
+          Sender Address Format
+        </div>
         <div class="mt-1 mb-3">
           When your alias receives an email, say from: <b>John Wick &lt;john@wick.com&gt;</b>,
           SimpleLogin forwards it to your mailbox.
@@ -285,7 +403,9 @@
               No Name (i.e. only reverse-alias)
             </option>
           </select>
-          <button class="btn btn-outline-primary mt-3">Update</button>
+          <button class="btn btn-outline-primary mt-3">
+            Update
+          </button>
         </form>
       </div>
     </div>
@@ -295,7 +415,9 @@
       <div class="card-body">
         <div class="card-title">
           Reverse Alias Replacement
-          <div class="badge badge-warning">Experimental</div>
+          <div class="badge badge-warning">
+            Experimental
+          </div>
         </div>
         <div class="mb-3">
           When replying to a forwarded email, the <b>reverse-alias</b> can be automatically included
@@ -312,9 +434,13 @@
                    name="replace-ra"
                    {% if current_user.replace_reverse_alias %} checked{% endif %}
                    class="form-check-input">
-            <label for="replace-ra">Enable replacing reverse alias</label>
+            <label for="replace-ra">
+              Enable replacing reverse alias
+            </label>
           </div>
-          <button type="submit" class="btn btn-outline-primary">Update</button>
+          <button type="submit" class="btn btn-outline-primary">
+            Update
+          </button>
         </form>
       </div>
     </div>
@@ -559,7 +685,7 @@
               sender address.
               <br />
               If this option is enabled, the original sender addresses is stored in the email header <b>X-SimpleLogin-Envelope-From</b>
-              and the original From header is stored in <b>X-SimpleLogin-Original-From</b>.
+              and the original From header is stored in <b>X-SimpleLogin-Original-From<b>.
               You can choose to display this header in your email client.
               <br />
               As email headers aren't encrypted, your mailbox service can know the sender address via this header.
@@ -583,7 +709,6 @@
             </form>
           </div>
         </div>
-        <!-- Alias import/export -->
         <div class="card">
           <div class="card-body">
             <div class="card-title">
@@ -594,12 +719,52 @@
               You can also export your aliases to a readable csv format for a future batch import.
             </div>
             <a href="{{ url_for('dashboard.batch_import_route') }}"
-               class="btn btn-outline-primary">Batch Import</a>
+               class="btn btn-outline-primary">
+              Batch Import
+            </a>
             <a href="{{ url_for('dashboard.alias_export_route') }}"
-               class="btn btn-outline-secondary">Export Aliases</a>
+               class="btn btn-outline-secondary">
+              Export Aliases
+            </a>
+          </div>
+        </div>
+        <div class="card">
+          <div class="card-body">
+            <div class="card-title">
+              SimpleLogin data export
+            </div>
+            <div class="mb-3">
+              As per GDPR (General Data Protection Regulation) law, you can request a copy of your data which are stored on
+              SimpleLogin.
+              A zip file that contains all information will be sent to your SimpleLogin account address.
+            </div>
+            <div class="d-flex">
+              <div>
+                <form method="post">
+                  {{ csrf_form.csrf_token }}
+                  <input type="hidden" name="form-name" value="send-full-user-report">
+                  <button class="btn btn-outline-info">
+                    Request your data
+                  </button>
+                </form>
+              </div>
+            </div>
+          </div>
+        </div>
+        <div class="card">
+          <div class="card-body">
+            <div class="card-title">
+              Account Deletion
+            </div>
+            <div class="mb-3">
+              If SimpleLogin isn't the right fit for you, you can simply delete your account.
+            </div>
+            <a href="{{ url_for('dashboard.delete_account') }}"
+               class="btn btn-outline-danger">
+              Delete account
+            </a>
           </div>
         </div>
-        <!-- END Alias import/export -->
       </div>
     {% endblock %}
     {% block script %}

app/templates/emails/com/newsletter/safari-extension.html

@@ -28,7 +28,7 @@
   {{ render_text("Hi") }}
   {{ render_text("If you use Safari on a MacBook or iMac, you should check out our new Safari extension.") }}
   {{ render_text('It can be installed on
-  <a href="https://apps.apple.com/app/id6475835429">App Store</a>
+  <a href="https://apps.apple.com/app/id1494051017">App Store</a>
   . Its code is available on
   <a href="https://github.com/simple-login/mac-app">GitHub</a>
   .') }}

app/templates/emails/com/newsletter/safari-extension.txt

@@ -8,7 +8,7 @@ If you use Safari on a MacBook or iMac, you should check out our new Safari exte
 
 It can be installed on:
 
-https://apps.apple.com/app/id6475835429
+https://apps.apple.com/app/id1494051017
 
 As usual, let me know if you have any question by replying to this email.
 

app/templates/emails/com/onboarding/browser-extension.html

@@ -12,7 +12,7 @@ If you want to quickly create aliases <b>without</b> going to SimpleLogin websit
 (or other Chromium-based browsers like Brave or Vivaldi),
 <a href="https://addons.mozilla.org/firefox/addon/simplelogin/">Firefox</a>
 and
-<a href="https://apps.apple.com/app/id6475835429 ">Safari</a>
+<a href="https://apps.apple.com/app/id1494051017 ">Safari</a>
 extension.
 {% endcall %}
 

app/templates/emails/com/onboarding/browser-extension.txt

@@ -11,7 +11,7 @@ Chrome: https://chrome.google.com/webstore/detail/dphilobhebphkdjbpfohgikllaljmg
 
 Firefox: https://addons.mozilla.org/firefox/addon/simplelogin/
 
-Safari: https://apps.apple.com/app/id6475835429
+Safari: https://apps.apple.com/app/id1494051017
 
 You can also manage your aliases using SimpleLogin mobile apps, available at
 - Play Store https://play.google.com/store/apps/details?id=io.simplelogin.android

app/templates/footer.html

@@ -124,7 +124,7 @@
           <li>
             <a class="list-group-item text-white footer-item "
                rel="noopener noreferrer"
-               href="https://apps.apple.com/app/id6475835429">
+               href="https://apps.apple.com/app/id1494051017">
               Safari
               Extension
             </a>

app/templates/header.html

@@ -148,10 +148,6 @@
             <a class="dropdown-item mb-3" href="{{ url_for('dashboard.api_key') }}">
               <i class="dropdown-icon fa fa-key"></i> API Keys
             </a>
-            <a class="dropdown-item mb-3"
-               href="{{ url_for('dashboard.account_setting') }}">
-              <i class="dropdown-icon fa fa-user"></i> Account settings
-            </a>
             <a class="dropdown-item" href="{{ url_for('auth.logout') }}">
               <i class="dropdown-icon fe fe-log-out"></i> Sign out
             </a>

app/tests/auth/test_oidc.py

@@ -1,304 +0,0 @@
-from app import config
-from flask import url_for
-from urllib.parse import parse_qs
-from urllib3.util import parse_url
-from app.auth.views.oidc import create_user
-from app.utils import random_string
-from unittest.mock import patch
-from app.models import User
-
-from app.config import URL, OIDC_CLIENT_ID
-
-
-def test_oidc_login(flask_client):
-    r = flask_client.get(
-        url_for("auth.oidc_login"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-    query = parse_qs(parsed.query)
-
-    expected_redirect_url = f"{URL}/auth/oidc/callback"
-
-    assert "code" == query["response_type"][0]
-    assert OIDC_CLIENT_ID == query["client_id"][0]
-    assert expected_redirect_url == query["redirect_uri"][0]
-
-
-def test_oidc_login_no_client_id(flask_client):
-    config.OIDC_CLIENT_ID = None
-
-    r = flask_client.get(
-        url_for("auth.oidc_login"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/login"
-
-    assert expected_redirect_url == parsed.path
-
-    config.OIDC_CLIENT_ID = "to_fill"
-
-
-def test_oidc_login_no_client_secret(flask_client):
-    config.OIDC_CLIENT_SECRET = None
-
-    r = flask_client.get(
-        url_for("auth.oidc_login"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/login"
-
-    assert expected_redirect_url == parsed.path
-
-    config.OIDC_CLIENT_SECRET = "to_fill"
-
-
-def test_oidc_callback_no_oauth_state(flask_client):
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is None
-
-
-def test_oidc_callback_no_client_id(flask_client):
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-    config.OIDC_CLIENT_ID = None
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/login"
-
-    assert expected_redirect_url == parsed.path
-
-    config.OIDC_CLIENT_ID = "to_fill"
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-def test_oidc_callback_no_client_secret(flask_client):
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-    config.OIDC_CLIENT_SECRET = None
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/login"
-
-    assert expected_redirect_url == parsed.path
-
-    config.OIDC_CLIENT_SECRET = "to_fill"
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-@patch("requests_oauthlib.OAuth2Session.fetch_token")
-@patch("requests_oauthlib.OAuth2Session.get")
-def test_oidc_callback_invalid_user(mock_get, mock_fetch_token, flask_client):
-    mock_get.return_value = MockResponse(400, {})
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/login"
-
-    assert expected_redirect_url == parsed.path
-    assert mock_get.called
-
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-@patch("requests_oauthlib.OAuth2Session.fetch_token")
-@patch("requests_oauthlib.OAuth2Session.get")
-def test_oidc_callback_no_email(mock_get, mock_fetch_token, flask_client):
-    mock_get.return_value = MockResponse(200, {})
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/login"
-
-    assert expected_redirect_url == parsed.path
-    assert mock_get.called
-
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-@patch("requests_oauthlib.OAuth2Session.fetch_token")
-@patch("requests_oauthlib.OAuth2Session.get")
-def test_oidc_callback_disabled_registration(mock_get, mock_fetch_token, flask_client):
-    config.DISABLE_REGISTRATION = True
-    email = random_string()
-    mock_get.return_value = MockResponse(200, {"email": email})
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/auth/register"
-
-    assert expected_redirect_url == parsed.path
-    assert mock_get.called
-
-    config.DISABLE_REGISTRATION = False
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-@patch("requests_oauthlib.OAuth2Session.fetch_token")
-@patch("requests_oauthlib.OAuth2Session.get")
-def test_oidc_callback_registration(mock_get, mock_fetch_token, flask_client):
-    email = random_string()
-    mock_get.return_value = MockResponse(
-        200,
-        {
-            "email": email,
-            config.OIDC_NAME_FIELD: "name",
-        },
-    )
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-
-    user = User.get_by(email=email)
-    assert user is None
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/dashboard/"
-
-    assert expected_redirect_url == parsed.path
-    assert mock_get.called
-
-    user = User.get_by(email=email)
-    assert user is not None
-    assert user.email == email
-
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-@patch("requests_oauthlib.OAuth2Session.fetch_token")
-@patch("requests_oauthlib.OAuth2Session.get")
-def test_oidc_callback_login(mock_get, mock_fetch_token, flask_client):
-    email = random_string()
-    mock_get.return_value = MockResponse(
-        200,
-        {
-            "email": email,
-        },
-    )
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = "state"
-
-    user = User.create(
-        email=email,
-        name="name",
-        password="",
-        activated=True,
-    )
-    user = User.get_by(email=email)
-    assert user is not None
-
-    r = flask_client.get(
-        url_for("auth.oidc_callback"),
-        follow_redirects=False,
-    )
-    location = r.headers.get("Location")
-    assert location is not None
-
-    parsed = parse_url(location)
-
-    expected_redirect_url = "/dashboard/"
-
-    assert expected_redirect_url == parsed.path
-    assert mock_get.called
-
-    with flask_client.session_transaction() as session:
-        session["oauth_state"] = None
-
-
-def test_create_user():
-    email = random_string()
-    user = create_user(
-        email,
-        {
-            config.OIDC_NAME_FIELD: "name",
-        },
-    )
-    assert user.email == email
-    assert user.name == "name"
-    assert user.activated
-
-
-class MockResponse:
-    def __init__(self, status_code, json_data):
-        self.status_code = status_code
-        self.json_data = json_data
-        self.text = "error"
-
-    def json(self):
-        return self.json_data

app/tests/cron/test_get_alias_for_hibp.py

@@ -1,116 +0,0 @@
-import arrow
-import pytest
-
-import cron
-from app.db import Session
-from app.models import (
-    Alias,
-    AppleSubscription,
-    PlanEnum,
-    CoinbaseSubscription,
-    ManualSubscription,
-    Subscription,
-    PartnerUser,
-    PartnerSubscription,
-    User,
-)
-from app.proton.utils import get_proton_partner
-from tests.utils import create_new_user, random_token
-
-
-def test_get_alias_for_free_user_has_no_alias():
-    user = create_new_user()
-    alias_id = Alias.create_new_random(user).id
-    Session.commit()
-    aliases = list(
-        cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
-    )
-    assert len(aliases) == 0
-
-
-def test_get_alias_for_lifetime():
-    user = create_new_user()
-    user.lifetime = True
-    alias_id = Alias.create_new_random(user).id
-    Session.commit()
-    aliases = list(
-        cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
-    )
-    assert alias_id == aliases[0].id
-
-
-def create_partner_sub(user: User):
-    pu = PartnerUser.create(
-        partner_id=get_proton_partner().id,
-        partner_email=user.email,
-        external_user_id=random_token(10),
-        user_id=user.id,
-        flush=True,
-    )
-    PartnerSubscription.create(
-        partner_user_id=pu.id, end_at=arrow.utcnow().shift(days=15)
-    )
-
-
-sub_generator_list = [
-    lambda u: AppleSubscription.create(
-        user_id=u.id,
-        expires_date=arrow.now().shift(days=15),
-        original_transaction_id=random_token(10),
-        receipt_data=random_token(10),
-        plan=PlanEnum.monthly,
-    ),
-    lambda u: CoinbaseSubscription.create(
-        user_id=u.id,
-        end_at=arrow.now().shift(days=15),
-    ),
-    lambda u: ManualSubscription.create(
-        user_id=u.id,
-        end_at=arrow.now().shift(days=15),
-    ),
-    lambda u: Subscription.create(
-        user_id=u.id,
-        cancel_url="",
-        update_url="",
-        subscription_id=random_token(10),
-        event_time=arrow.now(),
-        next_bill_date=arrow.now().shift(days=15).date(),
-        plan=PlanEnum.monthly,
-    ),
-    create_partner_sub,
-]
-
-
-@pytest.mark.parametrize("sub_generator", sub_generator_list)
-def test_get_alias_for_sub(sub_generator):
-    user = create_new_user()
-    sub_generator(user)
-    alias_id = Alias.create_new_random(user).id
-    Session.commit()
-    aliases = list(
-        cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
-    )
-    assert alias_id == aliases[0].id
-
-
-def test_disabled_user_is_not_checked():
-    user = create_new_user()
-    user.lifetime = True
-    user.disabled = True
-    alias_id = Alias.create_new_random(user).id
-    Session.commit()
-    aliases = list(
-        cron.get_alias_to_check_hibp(arrow.now(), [], alias_id, alias_id + 1)
-    )
-    assert len(aliases) == 0
-
-
-def test_skipped_user_is_not_checked():
-    user = create_new_user()
-    user.lifetime = True
-    alias_id = Alias.create_new_random(user).id
-    Session.commit()
-    aliases = list(
-        cron.get_alias_to_check_hibp(arrow.now(), [user.id], alias_id, alias_id + 1)
-    )
-    assert len(aliases) == 0

app/tests/dashboard/test_setting.py

@@ -13,7 +13,7 @@ def test_setup_done(flask_client):
     noncanonical_email = f"nonca.{random_email()}"
 
     r = flask_client.post(
-        url_for("dashboard.account_setting"),
+        url_for("dashboard.setting"),
         data={
             "form-name": "update-email",
             "email": noncanonical_email,

app/tests/dashboard/test_sudo_setting.py

@@ -1,28 +0,0 @@
-from flask import url_for
-
-from app import config
-from app.models import EmailChange
-from app.utils import canonicalize_email
-from tests.utils import login, random_email, create_new_user
-
-
-def test_setup_done(flask_client):
-    config.SKIP_MX_LOOKUP_ON_CHECK = True
-    user = create_new_user()
-    login(flask_client, user)
-    noncanonical_email = f"nonca.{random_email()}"
-
-    r = flask_client.post(
-        url_for("dashboard.account_setting"),
-        data={
-            "form-name": "update-email",
-            "email": noncanonical_email,
-        },
-        follow_redirects=True,
-    )
-
-    assert r.status_code == 200
-    email_change = EmailChange.get_by(user_id=user.id)
-    assert email_change is not None
-    assert email_change.new_email == canonicalize_email(noncanonical_email)
-    config.SKIP_MX_LOOKUP_ON_CHECK = False

app/tests/handler/test_unsubscribe_generator.py

@@ -13,7 +13,8 @@ from app.handler.unsubscribe_encoder import (
 )
 from app.handler.unsubscribe_generator import UnsubscribeGenerator
 from app.models import Alias, Contact, UnsubscribeBehaviourEnum
-from tests.utils import create_new_user, random_email
+from tests.utils import create_new_user
+
 
 TEST_UNSUB_EMAIL = "unsub@sl.com"
 
@@ -203,23 +204,3 @@ def test_unsub_preserve_original(
         assert message[headers.LIST_UNSUBSCRIBE_POST] is None
     else:
         assert "List-Unsubscribe=One-Click" == message[headers.LIST_UNSUBSCRIBE_POST]
-
-
-def test_unsub_preserves_sl_unsubscriber():
-    user = create_new_user()
-    user.unsub_behaviour = UnsubscribeBehaviourEnum.PreserveOriginal
-    alias = Alias.create_new_random(user)
-    Session.commit()
-    config.UNSUBSCRIBER = random_email()
-    contact = Contact.create(
-        user_id=user.id,
-        alias_id=alias.id,
-        website_email="contact@example.com",
-        reply_email="rep@sl.local",
-        commit=True,
-    )
-    message = Message()
-    original_header = f"<mailto:{config.UNSUBSCRIBER}?subject=dummysubject>"
-    message[headers.LIST_UNSUBSCRIBE] = original_header
-    message = UnsubscribeGenerator().add_header_to_message(alias, contact, message)
-    assert original_header == message[headers.LIST_UNSUBSCRIBE]

app/tests/test.env

@@ -49,16 +49,6 @@ GOOGLE_CLIENT_SECRET=to_fill
 FACEBOOK_CLIENT_ID=to_fill
 FACEBOOK_CLIENT_SECRET=to_fill
 
-# Login with OIDC
-CONNECT_WITH_OIDC_ICON=fa-github
-OIDC_AUTHORIZATION_URL=to_fill
-OIDC_USER_INFO_URL=to_fill
-OIDC_TOKEN_URL=to_fill
-OIDC_SCOPES=openid email profile
-OIDC_NAME_FIELD=name
-OIDC_CLIENT_ID=to_fill
-OIDC_CLIENT_SECRET=to_fill
-
 PGP_SENDER_PRIVATE_KEY_PATH=local_data/private-pgp.asc
 
 ALIAS_AUTOMATIC_DISABLE=true