Flip USE_REGISTER_V2 to true.

jwag956 · jwag956 · commit 6bd16c1ac63e · 2025-08-04T08:05:55.000-07:00
This continues the registration form migration to the new RegistrationV2 and deprecating the old RegisterForm and ConfirmRegisterForm.

Fix codecov.yml - they are validating it now and our ignore: line was in wrong place. Lets just allow templates - I don't think they actually get counted anyway.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -13,8 +13,14 @@ Fixes
 
 Docs and Chores
 +++++++++++++++
- - (:pr:`xx`) Drop support for Python 3.9. This removes the dependency on importlib_resources,
+- (:pr:`1106`) Drop support for Python 3.9. This removes the dependency on importlib_resources,
    updates pypy to 3.10, and uses 3.12 as base python for tests/tox.
+- (:pr:`xx`) Flip :py:data:`SECURITY_USE_REGISTER_V2` default to ``True``.
+
+Backwards Compatibility Concerns
++++++++++++++++++++++++++++++++++
+As mentioned above - the default RegisterForm is now the new RegisterFormV2 - Please read :ref:`register_form_migration`.
+Flask-Security will emit a DeprecationWarning if the :py:data:`SECURITY_USE_REGISTER_V2` is set to False.
 
 Version 5.6.2
 -------------
diff --git a/codecov.yml b/codecov.yml
@@ -10,5 +10,3 @@ coverage:
         if_ci_failed: error #success, failure, error, ignore
         informational: false
         only_pulls: false
-        ignore:
-          - "flask_security/flask_security/templates"
diff --git a/docs/configuration.rst b/docs/configuration.rst
@@ -958,12 +958,15 @@ Registerable
 
     The :py:class:`flask_security.RegisterFormV2` is a single form used for registration. This is replacing the
     RegisterForm and ConfirmRegisterForm (over a few releases). Setting this option
-    to ``True`` will set both registration forms to RegisterFormV2. Note that this
+    to ``False`` will revert behavior to prior releases with register_form=RegisterForm and
+    confirm_register_form=ConfirmRegisterForm. Note that this
     option is ignored if the application has sub-classed the registration form.
 
-    Default: ``False``
+    Default: ``True``
 
     .. versionadded:: 5.6.0
+    .. versionchanged:: 5.7.0
+      Default set to ``True``
 
 
 
diff --git a/docs/customizing.rst b/docs/customizing.rst
@@ -104,11 +104,11 @@ replacement class. This allows you to add extra fields to any
 form or override validators. For example it is often desired to add additional
 personal information fields to the registration form::
 
-    from flask_security import RegisterForm
+    from flask_security import RegisterFormV2
     from wtforms import StringField
     from wtforms.validators import DataRequired
 
-    class ExtendedRegisterForm(RegisterForm):
+    class ExtendedRegisterForm(RegisterFormV2):
         first_name = StringField('First Name', [DataRequired()])
         last_name = StringField('Last Name', [DataRequired()])
 
@@ -200,7 +200,7 @@ The following is a list of all the available form overrides:
 Register Form Migration
 ++++++++++++++++++++++++
 Since early in Flask Security releases, there have been 2 different forms used for
-registration: RegisterForm and ConfirmRegisterForm. The difference between them is only
+registration: RegisterForm and ConfirmRegisterForm. The only difference between them is
 that the ConfirmRegisterForm doesn't require password confirmation (i.e. asking the user to
 re-type their password). This wasn't a config option but rather based on whether :py:data:`SECURITY_CONFIRMABLE` was
 set or whether the request was form-based or JSON. This has always been a huge source of
@@ -219,6 +219,8 @@ The new RegisterFormV2 will add a ``password_confirm`` field if :py:data:`SECURI
 is set to ``True`` (the default). Additionally, JSON requests will need to provide a value for ``password_confirm``
 if configured.
 
+In release 5.7 the default is flipped - :py:data:`SECURITY_USE_REGISTER_V2` is ``True`` and RegisterFormV2 is the default form.
+
 .. _form_instantiation:
 
 Controlling Form Instantiation
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
@@ -2298,7 +2298,7 @@ components:
         password_confirm:
           type: string
           description: >
-            If present, must re-type in password. This will not be present if the __SECURITY_CONFIRM__ configuration is true.
+            If present, must re-type in password. This will not be present if the __SECURITY_PASSWORD_CONFIRM_REQUIRED__ configuration is False.
         next:
           type: string
           description: >
diff --git a/flask_security/cli.py b/flask_security/cli.py
@@ -5,7 +5,7 @@
 Command Line Interface for managing accounts and roles.
 
 :copyright: (c) 2016 by CERN.
-:copyright: (c) 2019-2024 by J. Christopher Wagner
+:copyright: (c) 2019-2025 by J. Christopher Wagner
 :license: MIT, see LICENSE for more details.
 """
 
@@ -153,8 +153,12 @@ def users_create(attributes, password, active, username):
     # it already asked for confirmation.
     # if they used inline keywords, there really isn't any reason to make them type
     # it in twice.
+    if _security.forms["confirm_register_form"].cls:
+        form_name = "confirm_register_form"
+    else:
+        form_name = "register_form"
     form = build_form(
-        "confirm_register_form" if _security._use_confirm_form else "register_form",
+        form_name,
         meta={"csrf": False},
         **kwargs,
         password_confirm=password,
diff --git a/flask_security/core.py b/flask_security/core.py
@@ -137,7 +137,7 @@
     "SUBDOMAIN": None,
     "FLASH_MESSAGES": True,
     "RETURN_GENERIC_RESPONSES": False,
-    "USE_REGISTER_V2": False,
+    "USE_REGISTER_V2": True,
     "I18N_DOMAIN": "flask_security",
     "I18N_DIRNAME": "builtin",
     "EMAIL_VALIDATOR_ARGS": None,
@@ -1239,6 +1239,10 @@ class Security:
     .. versionadded:: 5.6.0
         ``username_recovery_form``, ``change_username_form``,
 
+    .. versionchanged:: 5.7.0
+        ``register_form`` default value is RegisterFormV2 and
+        ``confirm_register_form`` default is now ``None``.
+
     .. deprecated:: 4.0.0
         ``send_mail`` and ``send_mail_task``. Replaced with ``mail_util_cls``.
         ``two_factor_verify_password_form`` removed.
@@ -1263,8 +1267,8 @@ def __init__(
         verify_form: t.Type[VerifyForm] = VerifyForm,
         change_email_form: t.Type[ChangeEmailForm] = ChangeEmailForm,
         change_username_form: t.Type[ChangeUsernameForm] = ChangeUsernameForm,
-        confirm_register_form: t.Type[ConfirmRegisterForm] = ConfirmRegisterForm,
-        register_form: t.Type[RegisterForm] | t.Type[RegisterFormV2] = RegisterForm,
+        confirm_register_form: t.Type[ConfirmRegisterForm] | None = None,
+        register_form: t.Type[RegisterForm] | t.Type[RegisterFormV2] = RegisterFormV2,
         forgot_password_form: t.Type[ForgotPasswordForm] = ForgotPasswordForm,
         reset_password_form: t.Type[ResetPasswordForm] = ResetPasswordForm,
         change_password_form: t.Type[ChangePasswordForm] = ChangePasswordForm,
@@ -1511,9 +1515,8 @@ def init_app(
             ):
                 self.forms[form_name].cls = form_cls
 
-        self._use_confirm_form = True
         # deprecate confirm_register_form, ConfirmRegisterForm and RegisterForm
-        if self.forms["confirm_register_form"].cls != ConfirmRegisterForm:
+        if self.forms["confirm_register_form"].cls:
             warnings.warn(
                 "The ConfirmRegisterForm and the confirm_register_form"
                 " option are"
@@ -1522,10 +1525,8 @@ def init_app(
                 DeprecationWarning,
                 stacklevel=2,
             )
-        if (
-            self.forms["register_form"].cls
-            and self.forms["register_form"].cls != RegisterForm
-            and issubclass(self.forms["register_form"].cls, RegisterForm)
+        if self.forms["register_form"].cls and issubclass(
+            self.forms["register_form"].cls, RegisterForm
         ):
             warnings.warn(
                 "The RegisterForm is"
@@ -1534,15 +1535,20 @@ def init_app(
                 DeprecationWarning,
                 stacklevel=2,
             )
-        if cv("USE_REGISTER_V2", app=app):
+        if not cv("USE_REGISTER_V2", app=app):
+            warnings.warn(
+                "The SECURITY_USE_REGISTER_V2 configuration option is"
+                " deprecated as of version 5.7.0 and will be removed in a future"
+                " release.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            # Switch back to old register and confirm_register forms
             # Only do this is they haven't subclassed
-            if self.forms["register_form"].cls == RegisterForm:
-                self.forms["register_form"].cls = RegisterFormV2
-                self.forms["confirm_register_form"].cls = None
-        if self.forms["register_form"].cls and issubclass(
-            self.forms["register_form"].cls, RegisterFormV2
-        ):
-            self._use_confirm_form = False
+            if self.forms["register_form"].cls == RegisterFormV2:
+                self.forms["register_form"].cls = RegisterForm
+            if not self.forms["confirm_register_form"].cls:
+                self.forms["confirm_register_form"].cls = ConfirmRegisterForm
 
         # The following will be set as attributes and initialized from constructor or
         # kwargs or config.
diff --git a/flask_security/forms.py b/flask_security/forms.py
@@ -675,6 +675,9 @@ class ConfirmRegisterForm(Form, RegisterFormMixin, UniqueEmailFormMixin):
     to still return important bad-password messages.
     In the case of an existing email or username - we set form.existing_xx so that
     the view can decide how to match responses (e.g. json responses always return 200).
+
+    .. deprecated:: 5.6.0
+        Replaced with RegisterFormV2
     """
 
     # Password optional when Unified Signin enabled.
@@ -723,6 +726,12 @@ def validate(self, **kwargs: t.Any) -> bool:
 
 
 class RegisterForm(ConfirmRegisterForm, NextFormMixin):
+    """Register Form
+
+    .. deprecated:: 5.6.0
+        Replaced with RegisterFormV2
+    """
+
     # Password optional when Unified Signin enabled.
     password_confirm = PasswordField(
         get_form_field_label("retype_password"),
diff --git a/flask_security/views.py b/flask_security/views.py
@@ -290,11 +290,9 @@ def logout():
 def register() -> ResponseValue:
     """View function which handles a registration request."""
 
-    # For some unknown historic reason - if you don't require confirmation
-    # (via email) then you need to type in your password twice. That might
-    # make sense if you can't reset your password but in modern (2020) UX models
-    # don't ask twice.
-    if (_security.confirmable or request.is_json) and _security._use_confirm_form:
+    if (_security.confirmable or request.is_json) and _security.forms[
+        "confirm_register_form"
+    ].cls:
         form_name = "confirm_register_form"
     else:
         form_name = "register_form"
diff --git a/pytest.ini b/pytest.ini
@@ -35,3 +35,4 @@ filterwarnings =
     ignore::DeprecationWarning:pony:0
     ignore:.*'sms' was enabled in SECURITY_US_ENABLED_METHODS;.*:UserWarning:flask_security:0
     ignore:.*'get_token_status' is deprecated.*:DeprecationWarning:flask_security:0
+    ignore:.*The SECURITY_USE_REGISTER_V2 configuration option is deprecated.*:DeprecationWarning:flask_security:0
diff --git a/tests/conftest.py b/tests/conftest.py
@@ -11,6 +11,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 import sqlite3
 import gc
 import os
@@ -65,6 +66,12 @@
 except ImportError:
     NO_BABEL = True
 
+# enable testing both register form options
+v2_param = [
+    pytest.param(dict(use_register_v2=True), id="use_register_v2-True"),
+    pytest.param(dict(use_register_v2=False), id="use_register_v2-False"),
+]
+
 
 class FastHash(PasswordHash):
     """Our own 'hasher'. For testing
@@ -172,6 +179,11 @@ def app(request):
     if flask_async_test is not None:
         pytest.importorskip("asgiref")  # from flask[async]
 
+    # allow parameterized tests to set security config variables
+    if hasattr(request, "param") and isinstance(request.param, Mapping):
+        for key, value in request.param.items():
+            app.config["SECURITY_" + key.upper()] = value
+
     # Override config settings as requested for this test
     settings = marker_getter("settings")
     if settings is not None:
diff --git a/tests/test_basic.py b/tests/test_basic.py
@@ -21,6 +21,7 @@
 from flask_principal import identity_loaded
 from freezegun import freeze_time
 
+from tests.conftest import v2_param
 from tests.test_utils import (
     authenticate,
     capture_flashes,
@@ -337,21 +338,28 @@ def test_generic_response(app, client, get_message):
     assert len(flashes) == 0
 
 
+@pytest.mark.parametrize("app", v2_param, indirect=True)
 @pytest.mark.registerable()
 @pytest.mark.settings(username_enable=True, return_generic_responses=True)
 def test_generic_response_username(app, client, get_message):
     data = dict(
         email="dude@lp.com",
         username="dude",
         password="awesome sunset",
+        password_confirm="awesome sunset",
     )
     response = client.post("/register", json=data)
     assert response.headers["Content-Type"] == "application/json"
     assert response.status_code == 200
     logout(client)
 
     response = client.post(
-        "/login", data=dict(username="dude2", password="awesome sunset")
+        "/login",
+        data=dict(
+            username="dude2",
+            password="awesome sunset",
+            password_confirm="awesome sunset",
+        ),
     )
     assert get_message("GENERIC_AUTHN_FAILED") in response.data
 
diff --git a/tests/test_cli.py b/tests/test_cli.py
@@ -385,8 +385,8 @@ def test_cli_change_password(script_info):
     assert "User not found" in result.output
 
 
-@pytest.mark.settings(use_register_v2=True)
-def test_cli_createuserV2(script_info):
+@pytest.mark.settings(use_register_v2=False)
+def test_cli_createuser_old(script_info):
     """Test create user CLI."""
     runner = CliRunner()
 
@@ -399,8 +399,8 @@ def test_cli_createuserV2(script_info):
     assert result.exit_code == 0
 
 
-@pytest.mark.settings(use_register_v2=True)
-def test_cli_createuserV2attr(script_info):
+@pytest.mark.settings(use_register_v2=False)
+def test_cli_createuserold_attr(script_info):
     """Test create user CLI passing attr that is in User but not in form."""
     runner = CliRunner()
 
diff --git a/tests/test_confirmable.py b/tests/test_confirmable.py
diff --git a/tests/test_csrf.py b/tests/test_csrf.py
diff --git a/tests/test_misc.py b/tests/test_misc.py
diff --git a/tests/test_recoverable.py b/tests/test_recoverable.py
diff --git a/tests/test_registerable.py b/tests/test_registerable.py
diff --git a/tests/test_unified_signin.py b/tests/test_unified_signin.py
