Support user login and registration #495

amCap1712 · 2024-12-21T15:35:08Z

TBA

github-actions · 2024-12-21T15:36:42Z

Test Results

236 tests +37 231 ✅ +37 48s ⏱️ +21s
1 suites ± 0 5 💤 ± 0
1 files ± 0 0 ❌ ± 0

Results for commit da8e04c. ± Comparison against base commit 4003c6b.

This pull request removes 24 and adds 61 tests. Note that renamed tests count towards both.

metabrainz.admin.views_test.AdminViewsTestCase ‑ test_index
metabrainz.supporter.views_test.SupportersViewsTestCase ‑ test_login
metabrainz.supporter.views_test.SupportersViewsTestCase ‑ test_logout
metabrainz.supporter.views_test.SupportersViewsTestCase ‑ test_musicbrainz
metabrainz.supporter.views_test.SupportersViewsTestCase ‑ test_musicbrainz_post
metabrainz.supporter.views_test.SupportersViewsTestCase ‑ test_signup
metabrainz.views_test.IndexViewsTestCase ‑ test_about
metabrainz.views_test.IndexViewsTestCase ‑ test_about_customers
metabrainz.views_test.IndexViewsTestCase ‑ test_bad_customers
metabrainz.views_test.IndexViewsTestCase ‑ test_code_of_conduct
…

metabrainz.admin.views_test.AdminViewsTestCase ‑ test_supporter_admin_index
metabrainz.admin.views_test.AdminViewsTestCase ‑ test_user_admin_index
metabrainz.index.views_test.IndexViewsTestCase ‑ test_about
metabrainz.index.views_test.IndexViewsTestCase ‑ test_about_customers
metabrainz.index.views_test.IndexViewsTestCase ‑ test_bad_customers
metabrainz.index.views_test.IndexViewsTestCase ‑ test_code_of_conduct
metabrainz.index.views_test.IndexViewsTestCase ‑ test_contact
metabrainz.index.views_test.IndexViewsTestCase ‑ test_dataset_download
metabrainz.index.views_test.IndexViewsTestCase ‑ test_dataset_signup
metabrainz.index.views_test.IndexViewsTestCase ‑ test_datasets
…

♻️ This comment has been updated with latest results.

MonkeyDo · 2025-09-29T15:38:29Z

Reviewed and cleaned up the sign in and sign up pages (user and supporters, commercial and non-commercial)

Supporters

End users

Add a moderation log to keep track of decisions as well.

It was duplicated and unused on two pages

and add a button to show/hide the password

+ automatic formating

Fix form validation and UI hints, rework the UI to be more user-friendly, cleanup markup, make it more mobile friendly

same as other pages, big call-to-action button as in the design files

We don't want end-users to create accounts directly on MeB.org, but it might just happen, so adding a link to the signup page they would be looking for.

Otherwise the entire test suite fails

…rotection to admin forms, and fixed moderation commit handling

mayhem

A very cursory scan, but looks good from that distance. I think we should make a great effort testing this codebase and be really picky about ongoing PRs. We'll need lots of eyes on the new site.

mayhem · 2025-11-04T09:48:39Z

admin/sql/create_indexes.sql

@@ -1,5 +1,7 @@
 BEGIN;

 -- TODO: Add some, if needed.


mayhem · 2025-11-04T10:17:27Z

metabrainz/index/forms.py

+
+
+class MeBFlaskForm(FlaskForm):
+


docstrings.

mayhem · 2025-11-04T10:30:23Z

metabrainz/user/email.py

+from brainzutils.mail import send_mail
+from metabrainz.model.user import User
+
+VERIFY_EMAIL = "verify-email"


These are oddly named. What do they do?

mayhem · 2025-11-04T10:38:33Z

config.py.example

+EMAIL_VERIFICATION_EXPIRY = timedelta(hours=24)
+EMAIL_RESET_PASSWORD_EXPIRY = timedelta(hours=24)
+
+# Bcrypt


What are these config items? Some explanation or a link to possible values would be good.

mayhem · 2025-11-04T11:19:12Z

One request: The admin interface was always ugly and now its gotten even worse. :( No need to design a masterpiece, but it would be nice to make some improvements so we dont have giant black bars and then like. :)

julian45 · 2025-11-09T19:24:49Z

oauth/views.py

    response.headers["Pragma"] = "no-cache"
    response.headers["X-Frame-Options"] = "DENY"
    response.headers["Referrer-Policy"] = "no-referrer"
    # todo: add content-security-policy headers


Perhaps while working with this file, it may be worthwhile to resolve this todo.

For example, knowing that X-Frame-Options: DENY is in place (i.e., this is not to be displayed in a frame anywhere), and assuming that this is only meant to be shown on meb.o (or self-hosted equivalents) and possibly draw from static media, we could use:

Content-Security-Policy: frame-ancestors 'none'; frame-src 'none'; object-src 'none'; img-src 'self' https://staticbrainz.org/

...but that's an approximation. (ref: MDN Content-Security-Policy documentation)

julian45 · 2025-11-09T19:27:07Z

oauth/views.py

 def after_oauth2_request(response):
    """ Add security headers for Referrer-Policy, Content-Security-Policy, Cache-Control and X-Frame-Options """
    response.headers["Cache-Control"] = "no-store"
    response.headers["Pragma"] = "no-cache"


Do you expect relevant endpoints to be called by HTTP/1.0 clients? If not, we should consider removing this header, as it is deprecated.

Also, since Cache-Control: no-store per the preceding line, I believe this setting is also kind of ignored since no-store seems to be the most restrictive directive among possible Cache-Control values; see MDN Pragma, Cache-Control pages.

julian45 · 2025-11-10T15:11:52Z

docker/docker-compose.dev.yml

-      - "8150"
-
  meb_db:
    image: postgres:12.3


Change would be out of scope for this specific PR, but even though this Compose file is for a dev environment, I still feel obliged to point out that Postgres 12 is well past end-of-life. 13 goes EoL in a few days as well, so 14 should be the minimum at this point.

amCap1712 mentioned this pull request Dec 21, 2024

New OAuth login page #391

Closed

amCap1712 force-pushed the users branch from af9d00e to 86b465e Compare June 18, 2025 19:44

amCap1712 force-pushed the users branch from 4498801 to b86d409 Compare September 17, 2025 12:13

amCap1712 marked this pull request as ready for review September 17, 2025 13:46

amCap1712 and others added 24 commits October 16, 2025 21:51

Support user login and registration

fafb366

Fix existing tests

31ce07d

add user view tests

39c838c

Let admins block and unblock users

cb1ef8a

Add a moderation log to keep track of decisions as well.

remove ide files

84b4cef

feat: improve signup & login page

4c166c5

Refactor conditions modal

26e20ec

It was duplicated and unused on two pages

fix: forgot password page

7b1ea12

add moderation comments

9796769

add manual email verification and more standard template

5313857

supporter fix

d0b79f3

minor fixes

9719e00

Fix missing close button BS styles

51ff574

Hide password by default

11de8fd

and add a button to show/hide the password

Animate and reuse project logo pills

4a58226

+ automatic formating

Review conditions modal, add project logos

94089fd

Make password hide buttons accessible

08f3f9b

Use AuthCardPasswordInput for all password inputs

97b065a

Rework signup/login pages UI

003106d

Fix form validation and UI hints, rework the UI to be more user-friendly, cleanup markup, make it more mobile friendly

Block button on login page

f4d8f41

same as other pages, big call-to-action button as in the design files

Block button on singup page

f45d8e9

Add link to end-user singup from commercial signup pages\

e6e60f1

We don't want end-users to create accounts directly on MeB.org, but it might just happen, so adding a link to the signup page they would be looking for.

Add moderation_log to drop tables script

f0a3e14

Otherwise the entire test suite fails

add support for editing username

5d01e69

amCap1712 added 2 commits October 18, 2025 10:38

split admin sections into Supporter and User Management, added CSRF p…

a3cd03d

…rotection to admin forms, and fixed moderation commit handling

replace reCAPTCHA with MTCaptcha

a733c1c

amCap1712 force-pushed the users branch from 56e2aae to a733c1c Compare October 18, 2025 20:40

use local user table for OAuth instead of MB editors table

da8e04c

amCap1712 requested review from MonkeyDo and mayhem November 4, 2025 09:39

amCap1712 changed the base branch from master to oauth-phase-2 November 4, 2025 09:58

mayhem approved these changes Nov 4, 2025

View reviewed changes

julian45 reviewed Nov 9, 2025

View reviewed changes

julian45 reviewed Nov 10, 2025

View reviewed changes



		class MeBFlaskForm(FlaskForm):

Uh oh!

Support user login and registration #495

Are you sure you want to change the base?

Support user login and registration #495

Uh oh!

Conversation

amCap1712 commented Dec 21, 2024

Uh oh!

github-actions bot commented Dec 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

MonkeyDo commented Sep 29, 2025

Uh oh!

mayhem left a comment

Choose a reason for hiding this comment

Uh oh!

mayhem Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

mayhem Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

mayhem Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

mayhem Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

mayhem commented Nov 4, 2025

Uh oh!

julian45 Nov 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

julian45 Nov 9, 2025

Choose a reason for hiding this comment

Uh oh!

julian45 Nov 9, 2025

Choose a reason for hiding this comment

Uh oh!

julian45 Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions bot commented Dec 21, 2024 •

edited

Loading

julian45 Nov 9, 2025 •

edited

Loading