Ensure username recovery endpoint is consistent with others. (#1201)

- Test for user not active
- Test for user requiring confirmation
- Support the confirmation_required redirect
- Create utility to unify confirm_redirect code.

closes #1200

Author: jwag956

CHANGES.rst

@@ -21,13 +21,15 @@ Features & Improvements
 Fixes
 +++++
 - (:issue:`1179`) Fix verify_password for bcrypt 5.0 (mephi42)
+- (:issue:`1200`) Fix username_recovery w.r.t. inactive and non-confirmed users
 
 Docs and Chores
 +++++++++++++++
 - (:pr:`1150`) Update de_DE translations (swaeberle)
 - (:pr:`1151`) Update ca_ES translations (arielvb)
 - (:pr:`1152`) Update es_ES translations (arielvb)
 - (:pr:`1196`) Update arabic translations (samialfattani)
+- (:pr:`1199`) Update it_IT translations (gissimo)
 
 Version 5.7.1
 -------------

docs/configuration.rst

@@ -1952,7 +1952,7 @@ Social Login (OAuth)
 
 .. py:data:: SECURITY_OAUTH_ENABLE
 
-    To enable using external Oauth providers - set this to ``True``.
+    To enable using external OAuth providers - set this to ``True``.
 
 .. py:data:: SECURITY_OAUTH_BUILTIN_PROVIDERS
 
@@ -1962,13 +1962,13 @@ Social Login (OAuth)
 
 .. py:data:: SECURITY_OAUTH_START_URL
 
-    Endpoint for starting an Oauth authentication operation.
+    Endpoint for starting an OAuth authentication operation.
 
     Default: ``"/login/oauthstart"``
 
 .. py:data:: SECURITY_OAUTH_RESPONSE_URL
 
-    Endpoint used as Oauth redirect.
+    Endpoint used as OAuth redirect.
 
     Default: ``"/login/oauthresponse"``
 
@@ -1985,15 +1985,15 @@ Social Login (OAuth)
 
 .. py:data:: SECURITY_OAUTH_VERIFY_START_URL
 
-    Endpoint for starting an Oauth reauthentication/verify operation.
+    Endpoint for starting an OAuth reauthentication/verify operation.
 
     Default: ``"/login/oauth-verify-start"``
 
     .. versionadded:: 5.8.0
 
 .. py:data:: SECURITY_OAUTH_VERIFY_RESPONSE_URL
 
-    Endpoint used as the Oauth verify redirect.
+    Endpoint used as the OAuth verify redirect.
 
     Default: ``"/login/oauth-verify-response"``
 

flask_security/core.py

@@ -1176,6 +1176,7 @@ def track_failed_authn(
 
         The default implementation sends the user_failed_authn signal.
 
+        .. versionadded:: 5.8.0
         """
         user_failed_authn.send(
             current_app._get_current_object(),  # type: ignore[attr-defined]

flask_security/forms.py

@@ -1069,7 +1069,7 @@ class TwoFactorRescueForm(Form):
     submit = SubmitField(get_form_field_label("submit"), id="rescue")
 
 
-class UsernameRecoveryForm(Form, UserEmailFormMixin):
+class UsernameRecoveryForm(ForgotPasswordForm):
     """The username recovery form"""
 
     submit = SubmitField(get_form_field_label("recover_username"))

flask_security/unified_signin.py

@@ -72,6 +72,7 @@
     base_render_json,
     check_and_get_token_status,
     config_value as cv,
+    confirm_redirect,
     do_flash,
     get_identity_attributes,
     get_post_login_redirect,
@@ -486,13 +487,8 @@ def us_signin_send_code() -> ResponseValue:
         }
         return base_render_json(form, include_user=False, additional=payload)
 
-    if (
-        form.requires_confirmation
-        and cv("REQUIRES_CONFIRMATION_ERROR_VIEW")
-        and not cv("RETURN_GENERIC_RESPONSES")
-    ):
-        do_flash(*get_message("CONFIRMATION_REQUIRED"))
-        return redirect(get_url(cv("REQUIRES_CONFIRMATION_ERROR_VIEW")))
+    if rurl := confirm_redirect(form, "email"):
+        return rurl
 
     return _security.render_template(
         cv("US_SIGNIN_TEMPLATE"),
@@ -618,13 +614,8 @@ def us_signin() -> ResponseValue:
     # On error - wipe code
     form.passcode.data = None
 
-    if (
-        form.requires_confirmation
-        and cv("REQUIRES_CONFIRMATION_ERROR_VIEW")
-        and not cv("RETURN_GENERIC_RESPONSES")
-    ):
-        do_flash(*get_message("CONFIRMATION_REQUIRED"))
-        return redirect(get_url(cv("REQUIRES_CONFIRMATION_ERROR_VIEW")))
+    if rurl := confirm_redirect(form, "email"):
+        return rurl
 
     return _security.render_template(
         cv("US_SIGNIN_TEMPLATE"),

flask_security/utils.py

@@ -524,6 +524,25 @@ def suppress_form_csrf():
     return {}
 
 
+def confirm_redirect(form, identity_attribute):
+    """This is a very specific utility that all open endpoints call
+    to implement the confirm redirect feature.
+    """
+    if (
+        form.requires_confirmation
+        and config_value("REQUIRES_CONFIRMATION_ERROR_VIEW")
+        and not config_value("RETURN_GENERIC_RESPONSES")
+    ):
+        do_flash(*get_message("CONFIRMATION_REQUIRED"))
+        return redirect(
+            get_url(
+                config_value("REQUIRES_CONFIRMATION_ERROR_VIEW"),
+                qparams={identity_attribute: getattr(form.user, identity_attribute)},
+            )
+        )
+    return None
+
+
 def do_flash(message: str, category: str) -> None:
     """Flash a message depending on if the `FLASH_MESSAGES` configuration
     value is set.

flask_security/views.py

@@ -5,7 +5,7 @@
 Flask-Security views module
 
 :copyright: (c) 2012 by Matt Wright.
-:copyright: (c) 2019-2025 by J. Christopher Wagner (jwag).
+:copyright: (c) 2019-2026 by J. Christopher Wagner (jwag).
 :license: MIT, see LICENSE for more details.
 
 CSRF is tricky. By default all our forms have CSRF protection built in via
@@ -105,6 +105,7 @@
     check_and_update_authn_fresh,
     check_and_get_token_status,
     config_value as cv,
+    confirm_redirect,
     do_flash,
     get_identity_attributes,
     get_message,
@@ -217,21 +218,9 @@ def login() -> ResponseValue:
         }
         return base_render_json(form, additional=payload)
 
-    if (
-        form.requires_confirmation
-        and cv("REQUIRES_CONFIRMATION_ERROR_VIEW")
-        and not cv("RETURN_GENERIC_RESPONSES")
-    ):
-        # Validation failed BECAUSE user needs to confirm
-        assert form.user_authenticated
-        assert form.email.data  # email_required validator
-        do_flash(*get_message("CONFIRMATION_REQUIRED"))
-        return redirect(
-            get_url(
-                cv("REQUIRES_CONFIRMATION_ERROR_VIEW"),
-                qparams={"email": form.email.data},
-            )
-        )
+    if rurl := confirm_redirect(form, "email"):
+        return rurl
+
     return _security.render_template(
         cv("LOGIN_USER_TEMPLATE"),
         login_user_form=form,
@@ -552,18 +541,8 @@ def forgot_password():
         # Never include user info since this is an anonymous endpoint.
         return base_render_json(form, include_user=False)
 
-    if (
-        form.requires_confirmation
-        and cv("REQUIRES_CONFIRMATION_ERROR_VIEW")
-        and not cv("RETURN_GENERIC_RESPONSES")
-    ):
-        do_flash(*get_message("CONFIRMATION_REQUIRED"))
-        return redirect(
-            get_url(
-                cv("REQUIRES_CONFIRMATION_ERROR_VIEW"),
-                qparams={"email": form.email.data},
-            )
-        )
+    if rurl := confirm_redirect(form, "email"):
+        return rurl
 
     if is_user_authenticated(current_user):
         form.email.data = current_user.email
@@ -1198,6 +1177,9 @@ def recover_username():
     if _security._want_json(request):
         return base_render_json(form, include_user=False)
 
+    if rurl := confirm_redirect(form, "email"):
+        return rurl
+
     return _security.render_template(
         cv("USERNAME_RECOVERY_TEMPLATE"),
         username_recovery_form=form,