Disallow blocking oauth on oauth logins

When a user logs in with oauth, we should not allow them to disable
their own ability to log in.

Author: mhagander

pgweb/account/admin.py

@@ -10,9 +10,9 @@
 
 from pgweb.util.widgets import TemplateRenderWidget
 from pgweb.util.db import exec_to_dict
-from pgweb.account.views import OAUTH_PASSWORD_STORE
 
 from .models import CommunityAuthSite, CommunityAuthOrg, SecondaryEmail
+from .models import OAUTH_PASSWORD_STORE
 
 
 class CommunityAuthSiteAdminForm(forms.ModelForm):

pgweb/account/forms.py

@@ -1,4 +1,5 @@
 from django import forms
+from django.core.validators import ValidationError
 from django.contrib.auth.forms import AuthenticationForm
 
 import re
@@ -7,6 +8,7 @@
 from pgweb.core.models import UserProfile
 from pgweb.contributors.models import Contributor
 from .models import SecondaryEmail
+from .models import OAUTH_PASSWORD_STORE
 
 from .recaptcha import ReCaptchaField
 
@@ -134,6 +136,17 @@ class Meta:
         model = UserProfile
         exclude = ('user',)
 
+    def __init__(self, user, *args, **kwargs):
+        self.user = user
+        super().__init__(*args, **kwargs)
+
+    def clean_block_oauth(self):
+        if self.cleaned_data.get('block_oauth', False):
+            if self.user.password == OAUTH_PASSWORD_STORE:
+                raise ValidationError("Your account used OAuth to log in, you cannot block the use of it")
+
+        return self.cleaned_data['block_oauth']
+
 
 class UserForm(forms.ModelForm):
     primaryemail = forms.ChoiceField(choices=[], required=True, label='Primary email address')

pgweb/account/models.py

@@ -2,6 +2,11 @@
 from django.contrib.auth.models import User, Group
 
 
+# The value we store in user.password for oauth logins. This is
+# a value that must not match any hashers.
+OAUTH_PASSWORD_STORE = 'oauth_signin_account_no_password'
+
+
 class CommunityAuthOrg(models.Model):
     orgname = models.CharField(max_length=100, null=False, blank=False, unique=True,
                                help_text="Name of the organisation")

pgweb/account/views.py

@@ -40,6 +40,7 @@
 from pgweb.profserv.models import ProfessionalService
 
 from .models import CommunityAuthSite, CommunityAuthConsent, SecondaryEmail
+from .models import OAUTH_PASSWORD_STORE
 from .forms import PgwebAuthenticationForm, ConfirmSubmitForm
 from .forms import CommunityAuthConsentForm
 from .forms import SignupForm, SignupOauthForm
@@ -55,10 +56,6 @@
 
 log = logging.getLogger(__name__)
 
-# The value we store in user.password for oauth logins. This is
-# a value that must not match any hashers.
-OAUTH_PASSWORD_STORE = 'oauth_signin_account_no_password'
-
 
 def _modobjs(qs):
     l = list(qs)
@@ -157,7 +154,7 @@ def profile(request):
     if request.method == 'POST':
         # Process this form
         userform = UserForm(can_change_email, secondaryaddresses, data=request.POST, instance=request.user)
-        profileform = UserProfileForm(data=request.POST, instance=profile)
+        profileform = UserProfileForm(request.user, data=request.POST, instance=profile)
         secondaryemailform = AddEmailForm(request.user, data=request.POST)
         if contrib:
             contribform = ContributorForm(data=request.POST, instance=contrib)
@@ -202,7 +199,7 @@ def profile(request):
     else:
         # Generate form
         userform = UserForm(can_change_email, secondaryaddresses, instance=request.user)
-        profileform = UserProfileForm(instance=profile)
+        profileform = UserProfileForm(request.user, instance=profile)
         secondaryemailform = AddEmailForm(request.user)
         if contrib:
             contribform = ContributorForm(instance=contrib)

pgweb/core/views.py

@@ -31,7 +31,7 @@
 from pgweb.util.misc import send_template_mail
 from pgweb.util.sitestruct import get_all_pages_struct
 from pgweb.mailqueue.util import send_simple_mail
-from pgweb.account.views import OAUTH_PASSWORD_STORE
+from pgweb.account.models import OAUTH_PASSWORD_STORE
 from pgweb.release.util import CurrentRelease
 
 # models needed for the pieces on the frontpage