diff --git a/api/v1alpha/views.py b/api/v1alpha/views.py index ff4ed62565e8a1a771567cf3cc0497993fa539cb..2817d29169f2a76a0a368fb07c957853731740c2 100644 --- a/api/v1alpha/views.py +++ b/api/v1alpha/views.py @@ -10,7 +10,11 @@ from django.conf import settings from drf_spectacular.utils import OpenApiResponse, extend_schema from rest_framework import exceptions, generics, status -from activate_account.reset_tokens import PasswordAppNotFound, get_reset_token +from activate_account.reset_tokens import ( + PasswordAppNotFound, + PasswordAppTokenResponse, + get_reset_token, +) from api.v1alpha.serializers import ( AccountSerializer, MethodNotAllowedErrorSerializer, @@ -82,13 +86,14 @@ class ResetTokenView(generics.RetrieveAPIView): # To aid demo/testing purposes, we can fake a reset token if the Password App can't # find the user if settings.FAKE_RESET_TOKEN_IF_MISSING: - return "-".join( + fake_token = "-".join( [ "".join([random.choice(digits + ascii_uppercase) for _ in range(4)]) for _ in range(3) ] + ["FAKE"] # Help developers identify fake tokens ) + return PasswordAppTokenResponse(token=fake_token) # Raising a validation error here rather than a 404 which could be misunderstand as # the endpoint not existing raise exceptions.ValidationError({"crsid": "Password App was unable to find the user"})