Show warning in Contact Support form (/contact) when user is not on allow list (#835)

Author: davinotdavid

assets/app/vue/locales/en.json

@@ -473,6 +473,8 @@
       "requiredFieldsText": "Fields marked with an asterisk (*) are required.",
       "errorFetchingFields": "Failed to fetch ticket fields. Please reload the page and try again.",
       "errorSubmittingForm": "Failed to submit contact form. Please try again.",
+      "emailNotOnAllowList": "You don't have an account with us yet. Want to create one? {joinWaitlist}.",
+      "joinWaitlist": "Join the waitlist",
       "success": "Your support request has been submitted successfully",
       "emailAddressLabel": "Your email address",
       "nameLabel": "Preferred name",

assets/app/vue/views/ContactView/api.ts

@@ -0,0 +1,14 @@
+export const isEmailInAllowList = async (email: string) => {
+  const response = await fetch('/api/v1/contact/check-email-is-on-allow-list/', {
+    method: 'POST',
+    body: JSON.stringify({
+      email,
+    }),
+    headers: {
+      'Content-Type': 'application/json',
+      'X-CSRFToken': window._page?.csrfToken,
+    },
+  });
+  
+  return await response.json();
+}

assets/app/vue/views/ContactView/components/ContactSupportForm.vue

@@ -1,9 +1,11 @@
 <script setup lang="ts">
-import { ref, onMounted, useTemplateRef } from 'vue';
+import { ref, onMounted, useTemplateRef, nextTick } from 'vue';
 import { useI18n } from 'vue-i18n';
+import { useDebounceFn } from '@vueuse/core';
 import { NoticeBar, TextInput, TextArea, SelectInput, PrimaryButton, NoticeBarTypes, CheckboxInput, LoadingSkeleton } from '@thunderbirdops/services-ui';
 import CsrfToken from '@/components/forms/CsrfToken.vue';
 import NativeInputWrapper from './NativeInputWrapper.vue';
+import { isEmailInAllowList } from '../api';
 
 // Types
 import { ContactFieldsAPIResponse, TicketField } from '../types';
@@ -30,14 +32,16 @@ const { t } = useI18n();
 
 const csrfTokenVal = ref(window._page.csrfToken);
 const errorText = ref(window._page.formError);
+const userEmailInAllowList = ref(true);
 const successText = ref('');
 const isSubmitting = ref(false);
+const tbProWaitListUrl = window._page?.tbProWaitListUrl;
 const form = ref({
   email: window._page?.userEmail || '',
   name: window._page?.userFullName || '',
   attachments: [],
 });
-const formRef = ref(null);
+const formRef = ref<HTMLFormElement | null>(null);
 const fileInput = ref(null);
 const isLoadingFormFields = ref(true);
 
@@ -144,9 +148,26 @@ const resetForm = () => {
   formRef.value.reset();
 };
 
+const checkEmailInAllowList = useDebounceFn(async () => {
+  await nextTick();
+
+  const emailField = formRef.value?.elements.namedItem('email') as HTMLInputElement | null;
+
+  if (emailField?.checkValidity()) {
+    const { is_on_allow_list } = await isEmailInAllowList(emailField.value.trim());
+    userEmailInAllowList.value = is_on_allow_list;
+  }
+}, 250);
+
 const handleSubmit = async () => {
   if (isSubmitting.value) return;
 
+  await checkEmailInAllowList();
+
+  if (!userEmailInAllowList.value) {
+    return;
+  }
+
   errorText.value = '';
   successText.value = '';
 
@@ -224,11 +245,27 @@ onMounted(() => {
 <template>
   <notice-bar :type="NoticeBarTypes.Critical" v-if="errorText" class="notice">{{ errorText }}</notice-bar>
   <notice-bar :type="NoticeBarTypes.Success" v-if="successText" class="notice">{{ successText }}</notice-bar>
+  <notice-bar :type="NoticeBarTypes.Warning" v-if="!userEmailInAllowList" class="notice">
+    <i18n-t keypath="views.contact.emailNotOnAllowList" tag="span">
+      <template #joinWaitlist>
+        <a :href="tbProWaitListUrl" target="_blank">
+          {{ t('views.contact.joinWaitlist') }}
+        </a>
+      </template>
+    </i18n-t>
+  </notice-bar>
 
   <form @submit.prevent="handleSubmit" method="post" action="/contact/submit" ref="formRef">
     <!-- Email (always present) -->
-    <text-input ref="emailInput" name="email" type="email" v-model="form.email" :required="true"
-      data-testid="contact-email-input">
+    <text-input
+      ref="emailInput"
+      name="email"
+      type="email"
+      v-model="form.email"
+      :required="true"
+      data-testid="contact-email-input"
+      @input="checkEmailInAllowList"
+    >
       {{ t('views.contact.emailAddressLabel') }}
     </text-input>
 
@@ -287,7 +324,11 @@ onMounted(() => {
     </ul>
 
     <div class="form-group">
-      <primary-button @click.capture="handleSubmit" data-testid="contact-submit-btn" :disabled="isSubmitting">
+      <primary-button
+        @click.capture="handleSubmit"
+        data-testid="contact-submit-btn"
+        :disabled="isSubmitting"
+      >
         {{ isSubmitting ? t('views.contact.submitting') : t('views.contact.submit') }}
       </primary-button>
     </div>
@@ -385,6 +426,10 @@ form {
 
 .notice {
   margin-block: 1rem;
+
+  a {
+    color: var(--colour-ti-highlight);
+  }
 }
 
 .attachment-list {

env.d.ts

@@ -36,6 +36,7 @@ declare global {
       maxEmailAliases?: number;
       tbProAppointmentUrl?: string;
       tbProSendUrl?: string;
+      tbProWaitListUrl?: string;
       tbProPrimaryDomain?: string;
       currentView?: Record<string, any>;
       serverMessages: ServerMessage[];

src/thunderbird_accounts/authentication/tests/test_utils.py

@@ -1,8 +1,9 @@
 
-from django.test import TestCase
-
+from django.test import TestCase, override_settings
 
+from thunderbird_accounts.authentication.models import AllowListEntry, User
 from thunderbird_accounts.authentication.reserved import is_reserved, servers, support
+from thunderbird_accounts.authentication.utils import is_email_in_allow_list
 
 class IsReservedUnitTests(TestCase):
     def test_brand_names(self):
@@ -93,3 +94,48 @@ def test_partial_matches_should_pass(self):
         # Anchors ^...$ mean full-string match only
         for name in ['user123', 'myusernamex', 'rooted', 'teamwork', 'contacting']:
             self.assertFalse(is_reserved(name))
+
+
+@override_settings(USE_ALLOW_LIST=True)
+class IsEmailInAllowListUnitTests(TestCase):
+    def test_returns_true_for_active_user_email(self):
+        User.objects.create(
+            username='active-user@example.com',
+            email='active-user@example.com',
+            recovery_email='recovery@example.com',
+            is_active=True,
+        )
+
+        self.assertTrue(is_email_in_allow_list('active-user@example.com'))
+
+    def test_returns_true_for_active_user_recovery_email(self):
+        User.objects.create(
+            username='active-recovery@example.com',
+            email='active-recovery@example.com',
+            recovery_email='active-recovery-contact@example.com',
+            is_active=True,
+        )
+
+        self.assertTrue(is_email_in_allow_list('active-recovery-contact@example.com'))
+
+    def test_returns_true_for_allow_list_entry(self):
+        AllowListEntry.objects.create(email='allow-listed@example.com')
+
+        self.assertTrue(is_email_in_allow_list('allow-listed@example.com'))
+
+    def test_returns_false_for_inactive_user_without_allow_list_entry(self):
+        User.objects.create(
+            username='inactive-user@example.com',
+            email='inactive-user@example.com',
+            recovery_email='inactive-recovery@example.com',
+            is_active=False,
+        )
+
+        self.assertFalse(is_email_in_allow_list('inactive-user@example.com'))
+
+    def test_returns_false_when_email_is_missing_from_user_and_allow_list(self):
+        self.assertFalse(is_email_in_allow_list('missing@example.com'))
+
+    @override_settings(USE_ALLOW_LIST=False)
+    def test_returns_true_when_allow_list_is_disabled(self):
+        self.assertTrue(is_email_in_allow_list('not-listed@example.com'))

src/thunderbird_accounts/authentication/utils.py

@@ -4,6 +4,7 @@
 
 import sentry_sdk
 from django.conf import settings
+from django.db.models import Q
 from django.urls import reverse
 
 from thunderbird_accounts.core.utils import get_absolute_url
@@ -53,7 +54,12 @@ def is_email_in_allow_list(email: str):
         return True
 
     # Are they an existing active user?
-    user = User.objects.filter(email=email).filter(is_active=True).first()
+    # Matching by email which is the thundermail address or the recovery email
+    user = User.objects.filter(
+        Q(email=email) | Q(recovery_email=email),
+        is_active=True,
+    ).first()
+
     if not user:
         try:
             # Make sure they're on the allow list

src/thunderbird_accounts/core/templates/index.html

@@ -42,6 +42,7 @@
     maxEmailAliases: {{ max_email_aliases|to_json|safe }},
     tbProAppointmentUrl: {{ tb_pro_appointment_url|to_json|safe }},
     tbProSendUrl: {{ tb_pro_send_url|to_json|safe }},
+    tbProWaitListUrl: {{ tb_pro_wait_list_url|to_json|safe }},
     tbProPrimaryDomain: {{ tb_pro_primary_domain|to_json|safe }},
     serverMessages: {{ server_messages|default:None|to_json|safe }},
     features: {{ features|safe|default:'{}' }},

src/thunderbird_accounts/core/views.py

@@ -143,6 +143,7 @@ def home(request: HttpRequest):
             'max_email_aliases': max_email_aliases,
             'tb_pro_appointment_url': settings.TB_PRO_APPOINTMENT_URL,
             'tb_pro_send_url': settings.TB_PRO_SEND_URL,
+            'tb_pro_wait_list_url': settings.TB_PRO_WAIT_LIST_URL,
             'tb_pro_primary_domain': settings.PRIMARY_EMAIL_DOMAIN,
             'server_messages': [
                 {'level': message.level, 'message': str(message.message)} for message in get_messages(request)

src/thunderbird_accounts/mail/api.py

@@ -1,4 +1,4 @@
-from thunderbird_accounts.authentication.utils import is_email_reserved
+from thunderbird_accounts.authentication.utils import is_email_reserved, is_email_in_allow_list
 from thunderbird_accounts.mail.exceptions import EmailNotValidError
 from thunderbird_accounts.mail.utils import validate_email
 from rest_framework.permissions import AllowAny
@@ -18,6 +18,10 @@ class UsernameAvailableThrottle(UserRateThrottle):
     scope = 'is_username_available'
 
 
+class CheckEmailIsOnAllowListThrottle(UserRateThrottle):
+    scope = 'check_email_is_on_allow_list'
+
+
 @api_view(['POST'])
 @permission_classes([AllowAny])
 @throttle_classes([UsernameAvailableThrottle])
@@ -43,3 +47,21 @@ def is_username_available(request: Request):
         raise ValidationError(_('This username is already taken. Try another one.'))
 
     return Response(status=200)
+
+
+@api_view(['POST'])
+@permission_classes([AllowAny])
+@throttle_classes([CheckEmailIsOnAllowListThrottle])
+def check_email_is_on_allow_list(request: Request):
+    if not settings.CONTACT_SUPPORT_ONLY_FOR_ALLOW_LISTED_USERS:
+        return Response({
+            'is_on_allow_list': True,
+        }, status=200)
+
+    email = request.data.get('email')
+    if not email:
+        raise ValidationError(_('You need to enter an email address.'))
+
+    return Response({
+        'is_on_allow_list': is_email_in_allow_list(email),
+    }, status=200)

src/thunderbird_accounts/mail/tests/test_api.py

@@ -0,0 +1,51 @@
+from unittest.mock import patch
+
+from django.test import override_settings, Client as RequestClient
+from rest_framework.test import APITestCase
+
+
+@override_settings(CONTACT_SUPPORT_ONLY_FOR_ALLOW_LISTED_USERS=True)
+class CheckEmailIsOnAllowListApiTestCase(APITestCase):
+    def setUp(self):
+        self.client = RequestClient()
+        self.url = '/api/v1/contact/check-email-is-on-allow-list/'
+
+    def test_missing_email_returns_validation_error(self):
+        response = self.client.post(self.url, {})
+
+        self.assertEqual(response.status_code, 400)
+        self.assertIn('You need to enter an email address.', str(response.json()))
+
+    @patch('thunderbird_accounts.mail.api.is_email_in_allow_list')
+    def test_returns_true_when_email_is_on_allow_list(self, mock_is_email_in_allow_list):
+        mock_is_email_in_allow_list.return_value = True
+        email = 'allowed@example.com'
+
+        response = self.client.post(self.url, {'email': email})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {'is_on_allow_list': True})
+        mock_is_email_in_allow_list.assert_called_once_with(email)
+
+    @patch('thunderbird_accounts.mail.api.is_email_in_allow_list')
+    def test_returns_false_when_email_is_not_on_allow_list(self, mock_is_email_in_allow_list):
+        mock_is_email_in_allow_list.return_value = False
+        email = 'not-allowed@example.com'
+
+        response = self.client.post(self.url, {'email': email})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {'is_on_allow_list': False})
+        mock_is_email_in_allow_list.assert_called_once_with(email)
+
+    @override_settings(CONTACT_SUPPORT_ONLY_FOR_ALLOW_LISTED_USERS=False)
+    @patch('thunderbird_accounts.mail.api.is_email_in_allow_list')
+    def test_returns_true_without_checking_allow_list_when_restriction_is_disabled(
+        self,
+        mock_is_email_in_allow_list,
+    ):
+        response = self.client.post(self.url, {})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {'is_on_allow_list': True})
+        mock_is_email_in_allow_list.assert_not_called()