stkit 17.2.6__tar.gz → 17.3.0__tar.gz

{stkit-17.2.6 → stkit-17.3.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v17.3.0 (2026-10-31)
+
+Run `uv run stk db upgrade`: `stk_0007` marks every existing account confirmed. Requires quart-security 2.1.0.
+
+- Password reset by email at `/reset`, on by default once `MAIL_SERVER` and `STK_PUBLIC_URL` are both set (`SECURITY_RECOVERABLE` overrides). Links work once, for one hour, and die if the email or password changes. A reset signs out every session, revokes MCP tokens and clears a lockout (Authentication).
+- Public sign-up now requires email confirmation (`SECURITY_CONFIRMABLE`, default on). An unconfirmed account fails login exactly like a wrong password, which closes the last way to find accounts through sign-up. With `SECURITY_REGISTERABLE=true`, startup fails without `MAIL_SERVER`; set `SECURITY_CONFIRMABLE=false` to keep unconfirmed sign-up (Authentication).
+- Users created by code, the CLI, admins or OAuth start confirmed: `User()` sets `confirmed_at` unless given one.
+- A locked account now fails login with the same message as a wrong password.
+- Auth mail links come from `STK_PUBLIC_URL` (as `SECURITY_PUBLIC_URL`), never the Host header. The 17.2.7 sign-up notice now comes from quart-security.
+- The reset, resend and confirm pages use the current auth layout.
+
+## v17.2.7 (2026-10-31)
+
+No migration required. Requires quart-security 2.0.6.
+
+- Registration no longer reveals which emails have an account: an existing email gets the same answer as a new one and nothing is created. With `MAIL_SERVER` set, the owner is emailed in the background that someone tried; its link comes from `STK_PUBLIC_URL`, never the request's Host header (Authentication).
+- After login, users land back on the page that sent them to `/login`, including through 2FA and passkeys (Authentication).
+- `stk.files` refuses to start when `STK_UPLOAD_MAX_BYTES` does not fit under Quart's `MAX_CONTENT_LENGTH`. Before, any limit above about 16 MiB was silently capped with a generic 413 (Configuration).
+- `stk doctor` warns when `STK_PUBLIC_URL` is unset outside development, since any Host header is then accepted.
+
 ## v17.2.6 (2026-10-31)
 
 No migration required.

{stkit-17.2.6 → stkit-17.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.6
+Version: 17.3.0
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk
@@ -28,7 +28,7 @@ Requires-Dist: pillow>=13.0.0
 Requires-Dist: psycopg2-binary>=2.9.10
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: qrcode>=8.2
-Requires-Dist: quart-security<3,>=2.0.5
+Requires-Dist: quart-security<3,>=2.1.0
 Requires-Dist: quart-session>=3.0.0
 Requires-Dist: quart>=0.20.0
 Requires-Dist: rich>=14.0.0

{stkit-17.2.6 → stkit-17.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.6"
+version = "17.3.0"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}
@@ -30,7 +30,7 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "qrcode>=8.2",
     "quart>=0.20.0",
-    "quart-security>=2.0.5,<3",
+    "quart-security>=2.1.0,<3",
     "quart-session>=3.0.0",
     "rich>=14.0.0",
     "sqlalchemy[asyncio]>=2.0.41",

{stkit-17.2.6 → stkit-17.3.0}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.6"
+__version__ = "17.3.0"
 
 
 def __getattr__(name):

{stkit-17.2.6 → stkit-17.3.0}/stk/app.py

@@ -173,16 +173,35 @@ def register_extensions(app):
             app.logger.warning("Timed out while disposing SQLAlchemy engine")
 
     from stk.security import register_security_controls
+    from stk.utils.email import send_email
     from stk.utils.ratelimit import register_rate_limits
 
     register_rate_limits(app)
     register_security_controls(app)
 
+    config = app.config
+    # Links in auth email come from the public URL, never the Host header.
+    config.setdefault("SECURITY_PUBLIC_URL", config.get("STK_PUBLIC_URL"))
+    if config.get("SECURITY_RECOVERABLE") is None:
+        config["SECURITY_RECOVERABLE"] = bool(
+            config.get("MAIL_SERVER") and config["SECURITY_PUBLIC_URL"]
+        )
+    if (
+        config.get("SECURITY_REGISTERABLE")
+        and config.get("SECURITY_CONFIRMABLE", True)
+        and not config.get("MAIL_SERVER")
+    ):
+        raise RuntimeError(
+            "SECURITY_REGISTERABLE needs MAIL_SERVER to send confirmation links;"
+            " set it, or set SECURITY_CONFIRMABLE=false to allow unconfirmed sign-up"
+        )
+
     Security(
         app,
         user_datastore,
         register_form=ExtendedRegisterForm,
         change_password_form=OAuthAwareChangePasswordForm,
+        send_mail=send_email,
     )
     # The library resets its session before loading the user. Share that session
     # so signals and application routes participate in the same transaction.

{stkit-17.2.6 → stkit-17.3.0}/stk/cli/doctor.py

@@ -193,6 +193,18 @@ def _check_agent_login(config):
     )
 
 
+def _check_public_url(config):
+    env = config.get("STK_ENV", "production")
+    if env != "development" and not config.get("STK_PUBLIC_URL"):
+        return _finding(
+            "public url",
+            WARN,
+            f"STK_PUBLIC_URL unset with STK_ENV={env}: any Host header is accepted",
+            "set STK_PUBLIC_URL to the origin users visit, e.g. https://app.example.com",
+        )
+    return _finding("public url", OK, config.get("STK_PUBLIC_URL") or "development")
+
+
 def _check_browser():
     try:
         from playwright.sync_api import sync_playwright
@@ -244,6 +256,7 @@ def build_doctor_report():
             _check_migrations(app),
             _check_admin(),
             _check_agent_login(app.config),
+            _check_public_url(app.config),
         ]
     findings += [_check_assets(), _check_browser(), _check_repl()]
     if any(item["status"] == FAIL for item in findings):

{stkit-17.2.6 → stkit-17.3.0}/stk/files/__init__.py

@@ -8,10 +8,22 @@ from pathlib import Path
 
 
 def init_app(app):
-    from stk.files.views import SNIFFED, bp, can_read
+    from stk.files.views import MULTIPART_SLACK, SNIFFED, bp, can_read
 
     app.config.setdefault("STK_UPLOAD_DIR", str(Path(app.instance_path) / "files"))
     app.config.setdefault("STK_UPLOAD_MAX_BYTES", 10 * 1024 * 1024)
+    # Quart caps every request body at MAX_CONTENT_LENGTH before a view runs, so
+    # a larger upload limit would never take effect.
+    limit, body_max = (
+        app.config["STK_UPLOAD_MAX_BYTES"],
+        app.config["MAX_CONTENT_LENGTH"],
+    )
+    if body_max is not None and limit + MULTIPART_SLACK > body_max:
+        raise ValueError(
+            f"STK_UPLOAD_MAX_BYTES ({limit}) plus {MULTIPART_SLACK} bytes of"
+            f" multipart framing exceeds MAX_CONTENT_LENGTH ({body_max}): raise"
+            " MAX_CONTENT_LENGTH or lower STK_UPLOAD_MAX_BYTES"
+        )
     app.config.setdefault(
         "STK_UPLOAD_TYPES",
         ("image/png", "image/jpeg", "image/gif", "image/webp", "application/pdf"),

stkit-17.3.0/stk/migrations/versions/stk_0007_confirm_existing_users.py

@@ -0,0 +1,28 @@
+"""Mark every existing account confirmed.
+
+stk 17.3 turns on email confirmation, and an account with no `confirmed_at` can
+no longer sign in. No account before this revision ever had to confirm, so all
+of them count as confirmed; only sign-ups from now on wait for the email.
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "stk_0007"
+down_revision = "stk_0006"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    user = sa.table("user", sa.column("confirmed_at", sa.DateTime()))
+    op.execute(
+        user.update()
+        .where(user.c.confirmed_at.is_(None))
+        .values(confirmed_at=sa.func.current_timestamp())
+    )
+
+
+def downgrade() -> None:
+    # Which accounts were unconfirmed before is not recorded; leave them all.
+    pass

{stkit-17.2.6 → stkit-17.3.0}/stk/settings.py

@@ -36,8 +36,10 @@ class Config:
     SECURITY_REGISTERABLE = (
         os.environ.get("SECURITY_REGISTERABLE", "False").lower() == "true"
     )
-    SECURITY_RECOVERABLE = False
-    SECURITY_CONFIRMABLE = False
+    # Self-registered accounts sign in only after confirming their email.
+    SECURITY_CONFIRMABLE = (
+        os.environ.get("SECURITY_CONFIRMABLE", "True").lower() == "true"
+    )
     SECURITY_CHANGEABLE = True
     SECURITY_TRACKABLE = True
     SECURITY_PASSWORD_HASH = "argon2"
@@ -106,6 +108,12 @@ class Config:
     MAIL_USERNAME = os.environ.get("MAIL_USERNAME")
     MAIL_PASSWORD = os.environ.get("MAIL_PASSWORD")
     SECURITY_EMAIL_SENDER = os.environ.get("SECURITY_EMAIL_SENDER", "info@domain.com")
+    # Password reset by email. Unset: on once MAIL_SERVER and STK_PUBLIC_URL are.
+    SECURITY_RECOVERABLE = (
+        os.environ["SECURITY_RECOVERABLE"].lower() == "true"
+        if "SECURITY_RECOVERABLE" in os.environ
+        else None
+    )
     SECURITY_SEND_PASSWORD_CHANGE_EMAIL = False
 
     # Google OAuth Settings
@@ -142,5 +150,6 @@ class TestingConfig(Config):
     DISABLE_MULTIPLE_SESSIONS = False
     STK_ENABLE_AGENT_LOGIN = False
     MAIL_SERVER = None
+    SECURITY_RECOVERABLE = False
     GOOGLE_AUTH_ENABLED = False
     GITHUB_AUTH_ENABLED = False

stkit-17.3.0/stk/templates/security/confirm_email.html

@@ -0,0 +1,30 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Confirm your email</div>
+            <div class="text-body-medium text-medium-emphasis">Confirm only if you created this account. If you did not, close this page.</div>
+        </div>
+
+        <form action="{{ url_for_security('confirm_email', token=confirm_email_token) }}" method="POST">
+            {{ confirm_email_form.hidden_tag() }}
+            {% include "security/_messages.html" %}
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Confirm my email</v-btn>
+        </form>
+    </v-card>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

stkit-17.3.0/stk/templates/security/forgot_password.html

@@ -0,0 +1,44 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Reset password</div>
+            <div class="text-body-medium text-medium-emphasis">We will email you a link to choose a new password</div>
+        </div>
+
+        <form action="{{ url_for_security('forgot_password') }}" method="POST">
+            {{ forgot_password_form.hidden_tag() }}
+            <v-text-field name="email" type="email" label="Email" autocomplete="email" required class="mb-4"></v-text-field>
+
+            {% include "security/_messages.html" %}
+
+            {% for field, errors in forgot_password_form.errors.items() %}
+            <v-alert type="error" variant="tonal" density="compact" class="mb-4">{{ errors[0] }}</v-alert>
+            {% endfor %}
+
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Send reset link</v-btn>
+        </form>
+    </v-card>
+
+    <div class="mt-6 w-100" style="max-width: 424px;">
+        <v-btn href="{{ url_for_security('login') }}" variant="text" color="primary">
+            <i class="ti ti-chevron-left mr-1"></i>
+            Back to log in
+        </v-btn>
+    </div>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

{stkit-17.2.6 → stkit-17.3.0}/stk/templates/security/login_user.html

@@ -157,6 +157,11 @@
                                 <span class="text-medium-emphasis">New to {{ config.APP_NAME }}? </span>
                                 <a href="{{ url_for_security('register') }}" class="text-decoration-none">Sign up</a>
                             </div>
+                            {% if security.confirmable %}
+                            <div class="text-center mt-2">
+                                <a href="{{ url_for_security('send_confirmation') }}" class="text-decoration-none text-body-small">Resend confirmation link</a>
+                            </div>
+                            {% endif %}
                             {% endif %}
                         </v-card-text>
                     </v-card>

stkit-17.3.0/stk/templates/security/reset_password.html

@@ -0,0 +1,45 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Choose a new password</div>
+            <div class="text-body-medium text-medium-emphasis">Every signed-in session will be signed out</div>
+        </div>
+
+        <form action="{{ url_for_security('reset_password', token=reset_password_token) }}" method="POST">
+            {{ reset_password_form.hidden_tag() }}
+            <v-text-field name="password" type="password" label="New password" autocomplete="new-password" required class="mb-2"></v-text-field>
+            <v-text-field name="password_confirm" type="password" label="Confirm new password" autocomplete="new-password" required class="mb-4"></v-text-field>
+
+            {% include "security/_messages.html" %}
+
+            {% for field, errors in reset_password_form.errors.items() %}
+            <v-alert type="error" variant="tonal" density="compact" class="mb-4">{{ errors[0] }}</v-alert>
+            {% endfor %}
+
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Reset password</v-btn>
+        </form>
+    </v-card>
+
+    <div class="mt-6 w-100" style="max-width: 424px;">
+        <v-btn href="{{ url_for_security('login') }}" variant="text" color="primary">
+            <i class="ti ti-chevron-left mr-1"></i>
+            Back to log in
+        </v-btn>
+    </div>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

stkit-17.3.0/stk/templates/security/send_confirmation.html

@@ -0,0 +1,44 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Resend confirmation</div>
+            <div class="text-body-medium text-medium-emphasis">We will email you a new link to confirm your account</div>
+        </div>
+
+        <form action="{{ url_for_security('send_confirmation') }}" method="POST">
+            {{ send_confirmation_form.hidden_tag() }}
+            <v-text-field name="email" type="email" label="Email" autocomplete="email" required class="mb-4"></v-text-field>
+
+            {% include "security/_messages.html" %}
+
+            {% for field, errors in send_confirmation_form.errors.items() %}
+            <v-alert type="error" variant="tonal" density="compact" class="mb-4">{{ errors[0] }}</v-alert>
+            {% endfor %}
+
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Send link</v-btn>
+        </form>
+    </v-card>
+
+    <div class="mt-6 w-100" style="max-width: 424px;">
+        <v-btn href="{{ url_for_security('login') }}" variant="text" color="primary">
+            <i class="ti ti-chevron-left mr-1"></i>
+            Back to log in
+        </v-btn>
+    </div>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

{stkit-17.2.6 → stkit-17.3.0}/stk/user/models.py

@@ -69,6 +69,13 @@ class User(Base, UserMixin):
     password_set = Column(Boolean, default=True, nullable=False)
     active = Column(Boolean, default=False, nullable=True)
 
+    def __init__(self, **kwargs):
+        # Accounts made by code, the CLI, admins or OAuth start confirmed. Only
+        # self-registration sets None afterwards, until the emailed link is
+        # opened; a column default would refill that None at insert.
+        kwargs.setdefault("confirmed_at", datetime.now())
+        super().__init__(**kwargs)
+
     @validates("email")
     def _normalize_email(self, key, value):
         # Login lowercases what it is given; store the same form so one address

{stkit-17.2.6 → stkit-17.3.0}/tests/test_cli.py

@@ -55,6 +55,16 @@ if __name__ == "__main__":
     unittest.main()
 
 
+class PublicUrlDoctorTest(unittest.TestCase):
+    def test_warns_only_outside_development_without_a_public_url(self):
+        from stk.cli.doctor import _check_public_url
+
+        self.assertEqual(_check_public_url({})["status"], "warn")
+        self.assertEqual(_check_public_url({"STK_ENV": "development"})["status"], "ok")
+        set_url = {"STK_PUBLIC_URL": "https://app.example.com"}
+        self.assertEqual(_check_public_url(set_url)["status"], "ok")
+
+
 class DowngradeArgumentTest(unittest.TestCase):
     def test_relative_revision_is_accepted(self):
         with patch("stk.cli.database.run_alembic") as run:

stkit-17.3.0/tests/test_confirm_migration.py

@@ -0,0 +1,28 @@
+"""stk_0007 confirms every account that existed before email confirmation."""
+
+import sqlite3
+import tempfile
+import unittest
+from pathlib import Path
+
+from alembic import command
+
+from stk.migrations import build_alembic_config
+
+
+class ConfirmExistingUsersTest(unittest.TestCase):
+    def test_existing_accounts_count_as_confirmed(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "db.sqlite"
+            config = build_alembic_config(url=f"sqlite:///{path}", quiet=True)
+            command.upgrade(config, "stk_0006")
+            with sqlite3.connect(path) as db:
+                db.execute(
+                    "INSERT INTO user (email, password, password_set, active,"
+                    " fs_uniquifier, created_at, failed_login_count) VALUES"
+                    " ('a@example.com', 'h', 1, 1, 'u', '2026-01-01', 0)"
+                )
+            command.upgrade(config, "heads")
+            with sqlite3.connect(path) as db:
+                rows = db.execute("select confirmed_at from user").fetchall()
+            self.assertIsNotNone(rows[0][0])

{stkit-17.2.6 → stkit-17.3.0}/tests/test_files.py

@@ -82,6 +82,19 @@ class FilesTests(unittest.IsolatedAsyncioTestCase):
     def stored(self):
         return sorted(p.name for p in Path(self.dir.name).rglob("*") if p.is_file())
 
+    def test_upload_limit_above_the_body_limit_refuses_to_start(self):
+        class Config(TestingConfig):
+            STK_UPLOAD_DIR = self.dir.name
+            STK_UPLOAD_MAX_BYTES = 20 * 1024 * 1024
+
+        with self.assertRaisesRegex(ValueError, "MAX_CONTENT_LENGTH"):
+            Stk(__name__, config=Config, extensions=[stk.files])
+
+        class Raised(Config):
+            MAX_CONTENT_LENGTH = 21 * 1024 * 1024
+
+        Stk(__name__, config=Raised, extensions=[stk.files])
+
     async def test_same_bytes_are_stored_once(self):
         alice, bob = await self.client(), await self.client("bob@example.com")
         data = png()

{stkit-17.2.6 → stkit-17.3.0}/tests/test_security_compatibility.py

@@ -1,5 +1,7 @@
 """Exercise stk's authentication integration with quart-security 2."""
 
+import asyncio
+import re
 import unittest
 
 import pyotp
@@ -146,5 +148,105 @@ class SecurityCompatibilityTests(unittest.IsolatedAsyncioTestCase):
         )
         self.assertNotEqual((await second.get("/dashboard/")).status_code, 200)
 
+    def mailbox(self):
+        """Turn on sign-up and reset with mail; collect what would be sent."""
+        self.app.config.update(
+            SECURITY_REGISTERABLE=True,
+            SECURITY_RECOVERABLE=True,
+            MAIL_SERVER="smtp.example.com",
+            SECURITY_PUBLIC_URL="http://localhost",
+        )
+        sent = []
+
+        async def send_mail(subject, recipient, body):
+            sent.append((subject, recipient, body))
+
+        self.app.extensions["security"].send_mail = send_mail
+        return sent
+
+    async def post(self, client, path, **form):
+        await client.get("/login")
+        async with client.session_transaction() as cookie:
+            form["csrf_token"] = cookie["_csrf_token"]
+        response = await client.post(path, form=form)
+        # Auth mail and account lookups run after the response; wait for them.
+        while self.app.background_tasks:
+            await asyncio.gather(*list(self.app.background_tasks))
+        return response
+
+    @staticmethod
+    def link(message):
+        return re.search(r"http://localhost(/\S+)", message[2]).group(1)
+
+    async def test_sign_up_waits_for_the_email_and_hides_existing_accounts(self):
+        sent = self.mailbox()
+        client = self.app.test_client()
+        password = "AnotherPassword123!"
+        for email in ("new@example.com", "USER@example.com"):
+            response = await self.post(
+                client,
+                "/register",
+                email=email,
+                password=password,
+                password_confirm=password,
+            )
+            self.assertEqual(response.status_code, 302)
+        self.assertEqual([m[1] for m in sent], ["new@example.com", "user@example.com"])
+
+        login = {"email": "new@example.com", "password": password}
+        self.assertNotIn("_user_id", await self.login_as(login))
+        # Opening the link confirms nothing; the button on that page does.
+        self.assertEqual((await client.get(self.link(sent[0]))).status_code, 200)
+        self.assertNotIn("_user_id", await self.login_as(login))
+        await self.post(client, self.link(sent[0]))
+        self.assertIn("_user_id", await self.login_as(login))
+
+        # A forged Host header never reaches the links in the mail.
+        await self.post(
+            client,
+            "/register",
+            email="user@example.com",
+            password=password,
+            password_confirm=password,
+        )
+        self.assertNotIn("evil.example", sent[-1][2])
+
+    async def login_as(self, form):
+        client = self.app.test_client()
+        await self.post(client, "/login", **form)
+        async with client.session_transaction() as cookie:
+            return dict(cookie)
+
+    async def test_password_reset_replaces_the_password_and_logs_activity(self):
+        sent = self.mailbox()
+        signed_in = self.app.test_client()
+        await self.login(signed_in)
+        client = self.app.test_client()
+        page = await client.get("/reset")
+        self.assertEqual(page.status_code, 200)
+        await self.post(client, "/reset", email="user@example.com")
+        path = self.link(sent[0])
+        self.assertEqual((await client.get(path)).status_code, 200)
+        new = "ReplacementPass123!"
+        response = await self.post(client, path, password=new, password_confirm=new)
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(
+            "_user_id",
+            await self.login_as({"email": "user@example.com", "password": new}),
+        )
+        self.assertNotEqual((await signed_in.get("/dashboard/")).status_code, 200)
+
+    def test_sign_up_without_mail_refuses_to_start(self):
+        class Config(SecurityConfig):
+            SECURITY_REGISTERABLE = True
+
+        with self.assertRaisesRegex(RuntimeError, "MAIL_SERVER"):
+            Stk(__name__, config=Config)
+
+        class Unconfirmed(Config):
+            SECURITY_CONFIRMABLE = False
+
+        Stk(__name__, config=Unconfirmed)
+
     def test_cookie_setting_preserves_local_http_support(self):
         self.assertFalse(self.app.config["SESSION_COOKIE_SECURE"])

stkit-17.2.6/stk/templates/security/confirm_email.html

@@ -1,44 +0,0 @@
-{% extends 'layout.html' %}
-
-{% block content %}
-    <v-app id="app" class="justify-center align-center min-vh-100 d-flex">
-        <v-container class="d-flex align-center justify-center">
-            <div class="main">
-                <h2>Thank for your registration</h2>
-                <p>
-                    Please confirm your Email to continue.
-                </p>
-            </div>
-        </v-container>
-        <v-snackbar absolute button v-model="snackBar">
-            ${snackMessage}
-            <v-btn text color="primary" @click.native="value = false">Close</v-btn>
-        </v-snackbar>
-    </v-app>
-{% endblock %}
-
-{% block js %}
-    <script>
-        const {createApp} = Vue;
-        const {createVuetify} = Vuetify;
-        const vuetify = createVuetify(config.vuetifyConfig);
-
-        const app = createApp({
-            data() {
-                return {
-                    snackBar: false,
-                    snackMessage: '',
-                };
-            },
-            methods: {
-                showSnack(message) {
-                    this.snackMessage = message;
-                    this.snackBar = true;
-                },
-            },
-            delimiters: ['${', '}']
-        });
-
-        app.use(vuetify).mount('#app');
-    </script>
-{% endblock %}