0513e67838
Adds Microsoft 365 + Google OAuth providers (separate from the existing generic OIDC SSO at src/auth/sso.py) and a passwordless magic-link login flow. New OAuth signups capture Loi 25 art. 14 consents (4 granular checkboxes) BEFORE creating the User row via /auth/oauth/finish-signup. Per compatibility-audit.md C2: - No src/auth_extended/ directory — extends src/auth/ in place - No new User columns — reuses sso_provider/sso_subject + email_verified - Magic-link tokens via itsdangerous URLSafeTimedSerializer (15-min, no DB) - All routes added to existing auth_bp; templates extend marketing/base.html - Anti-enumeration on /auth/magic-link (generic flash for unknown OR unverified emails) and /auth/magic-link/<token> (same flash for invalid/expired/unverified-user) Files added: - src/auth/oauth_providers.py — Microsoft + Google OAuth registration, is_oauth_provider_enabled(), find_user_by_oauth(), create_oauth_user_with_consent() - src/auth/magic_link.py — generate/consume magic-link tokens - templates/auth/magic_link_request.html, templates/auth/oauth_finish_signup.html - tests/test_oauth_magic_link.py + tests/_run_oauth_magic_link_windows.py (16 tests) - config/env.oauth.example Files modified: - src/api/auth.py — 5 new routes (oauth_provider_login/callback, oauth_finish_signup, magic_link_request/consume); login flashes translated FR; oauth_*_enabled flags passed to login template - src/app.py — wires init_oauth_providers(app) after blueprint registration - src/services/email.py — adds send_magic_link_email() (FR + DictIA brand) - templates/login.html — refondu IN PLACE (was 178 lines legacy Vue/TW3) to extend marketing/base.html with OAuth buttons, password form, magic-link CTA, signup link - templates/auth/check_email.html — adds action='magic_link' branch - static/css/tailwind.config.js — adds templates/login.html to content - static/css/marketing.css — rebuilt Tests: 16/16 PASS via Windows manual driver. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
3.6 KiB
HTML
65 lines
3.6 KiB
HTML
{% extends 'marketing/base.html' %}
|
|
|
|
{% block title %}{% if action == 'password_reset' %}Vérifiez votre courriel — DictIA{% elif action == 'magic_link' %}Lien de connexion envoyé — DictIA{% else %}Confirmez votre courriel — DictIA{% endif %}{% endblock %}
|
|
{% block description %}Un courriel vous a été envoyé. Suivez le lien pour activer votre compte DictIA.{% endblock %}
|
|
|
|
{% block content %}
|
|
<section class="min-h-[calc(100vh-62px)] bg-brand-bg py-16 px-4" aria-labelledby="check-email-title">
|
|
<div class="max-w-md mx-auto bg-white p-8 rounded-[18px] border border-brand-border shadow-cta text-center">
|
|
<div class="mx-auto mb-6 w-16 h-16 rounded-full grad-bg flex items-center justify-center text-white text-2xl" aria-hidden="true">✉</div>
|
|
|
|
<h1 id="check-email-title" class="text-2xl font-black text-brand-navy mb-2">
|
|
{% if action == 'password_reset' %}Vérifiez votre courriel
|
|
{% elif action == 'verification_required' %}Vérification requise
|
|
{% elif action == 'magic_link' %}Lien de connexion envoyé
|
|
{% else %}Confirmez votre courriel{% endif %}
|
|
</h1>
|
|
|
|
<p class="text-sm text-brand-navy/70 mb-6">
|
|
{% if action == 'password_reset' %}
|
|
Si un compte DictIA existe pour <strong>{{ email }}</strong>, vous recevrez un courriel avec un lien pour réinitialiser votre mot de passe. Le lien expire dans 1 heure.
|
|
{% elif action == 'verification_required' %}
|
|
Vérifiez votre boîte de réception à <strong>{{ email }}</strong>. Si vous ne recevez rien, demandez un nouveau courriel ci-dessous.
|
|
{% elif action == 'magic_link' %}
|
|
Si un compte vérifié existe pour <strong>{{ email }}</strong>, vous recevrez un courriel avec un lien de connexion. Le lien expire dans {{ "15 minutes" | safe }}.
|
|
{% else %}
|
|
Nous avons envoyé un lien de vérification à <strong>{{ email }}</strong>. Cliquez dessus pour activer votre compte. Le lien expire dans 24 heures.
|
|
{% endif %}
|
|
</p>
|
|
|
|
{% with messages = get_flashed_messages(with_categories=true) %}
|
|
{% if messages %}
|
|
{% for category, message in messages %}
|
|
<div role="alert" class="mb-3 p-3 rounded-lg text-sm
|
|
{% if category == 'danger' %}bg-red-50 text-red-900 border border-red-200
|
|
{% elif category == 'warning' %}bg-amber-50 text-amber-900 border border-amber-200
|
|
{% elif category == 'success' %}bg-green-50 text-green-900 border border-green-200
|
|
{% else %}bg-blue-50 text-blue-900 border border-blue-200{% endif %}">
|
|
{{ message }}
|
|
</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endwith %}
|
|
|
|
{% if show_resend and action != 'password_reset' %}
|
|
<form method="POST" action="{{ url_for('auth.resend_verification') }}" class="mb-4">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
|
|
<input type="hidden" name="email" value="{{ email }}">
|
|
<button type="submit" class="w-full grad-bg text-white font-semibold py-3 rounded-[0.75rem] shadow-cta hover:shadow-cta-hover transition focus-visible:outline-2 focus-visible:outline-brand-b1 focus-visible:outline-offset-2">
|
|
Renvoyer le lien de vérification
|
|
</button>
|
|
</form>
|
|
{% endif %}
|
|
|
|
<p class="text-xs text-brand-navy/70 mt-4">
|
|
Vous ne recevez rien ? Vérifiez vos pourriels (spam) ou
|
|
<a href="mailto:info@dictia.ca" class="grad-text font-semibold">contactez le support</a>.
|
|
</p>
|
|
|
|
<p class="mt-6 text-sm">
|
|
<a href="{{ url_for('auth.login') }}" class="grad-text font-semibold">← Retour à la connexion</a>
|
|
</p>
|
|
</div>
|
|
</section>
|
|
{% endblock %}
|