website/views/user.py (1)

147-147: Optional: Silence the unused variable warning.

The created variable from get_or_create is never used. Consider using _ to indicate it's intentionally ignored.

-    user_profile, created = UserProfile.objects.get_or_create(user=request.user)
+    user_profile, _ = UserProfile.objects.get_or_create(user=request.user)

Based on static analysis hints.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/user.py (2)

163-165: Consider checking if the email already exists for the current user.

The uniqueness check excludes all EmailAddress entries for request.user, but this could miss edge cases:

• If the user has this email as an existing unverified secondary email from a previous attempt, the check passes.
• Then line 175 deletes it, which is fine.
• But if the user has this email as a verified secondary (non-primary) EmailAddress, the check passes, but line 175 won't delete it (only deletes unverified), and then line 178's get_or_create will find the existing verified entry without updating it properly.

Consider refining the check:

+            # Check if email already exists for current user
+            existing_user_email = EmailAddress.objects.filter(user=request.user, email=new_email).first()
+            if existing_user_email:
+                if existing_user_email.verified and existing_user_email.primary:
+                    # This is their current primary email, will be caught by email_changed check
+                    pass
+                else:
+                    form.add_error("email", "This email is already associated with your account")
+                    return render(request, "profile_edit.html", {"form": form})
+
-            if EmailAddress.objects.exclude(user=request.user).filter(email=new_email).exists():
+            # Check if email exists for other users
+            if EmailAddress.objects.exclude(user=request.user).filter(email=new_email).exists():
                 form.add_error("email", "This email is already registered or pending verification")
                 return render(request, "profile_edit.html", {"form": form})

---

173-192: Consider guarding against race conditions in email creation.

Between the uniqueness check (line 163-165) and the EmailAddress creation (line 178-182), another concurrent request could create an EmailAddress with the same email, potentially causing an IntegrityError depending on database constraints.

Consider wrapping the email change logic in a try-except block:

if email_changed:
    try:
        # Remove any pending unverified emails
        EmailAddress.objects.filter(user=request.user, verified=False).delete()
        
        # Create new unverified email entry
        EmailAddress.objects.create(
            user=request.user,
            email=new_email,
            verified=False,
            primary=False,
        )
        
        # Send verification email
        send_email_confirmation(request, request.user, email=new_email)
        
        messages.info(
            request,
            "A verification link has been sent to your new email. "
            "Please verify to complete the update."
        )
    except IntegrityError:
        messages.error(request, "This email is already in use. Please try a different email.")
    except Exception as e:
        logger.error(f"Error during email change: {e}")
        messages.error(request, "An error occurred. Please try again.")
    
    return redirect("profile", slug=request.user.username)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/user.py (2)

147-147: Tidy up unused created from get_or_create

created is never used; to satisfy Ruff and reduce noise, consider:

-    user_profile, created = UserProfile.objects.get_or_create(user=request.user)
+    user_profile, _ = UserProfile.objects.get_or_create(user=request.user)

Based on static analysis hints.

---

173-205: EmailAddress flow is solid; refine exception handling & logging

Deleting any unverified EmailAddress rows, creating a fresh unverified entry for new_email, and only then sending send_email_confirmation correctly keeps request.user.email unchanged until verification, while preserving profile-field updates.

To improve robustness and satisfy Ruff:

1. Prefer more specific exceptions for the email send failure if feasible (e.g., SMTP/email‑backend exceptions) instead of a blind except Exception.
2. Use logger.exception so the stack trace is recorded:

-            try:
-                send_email_confirmation(request, request.user, email=new_email)
-            except Exception as e:
-                logger.error(f"Failed to send email confirmation to {new_email}: {e}")
+            try:
+                send_email_confirmation(request, request.user, email=new_email)
+            except Exception:
+                logger.exception("Failed to send email confirmation to %s", new_email)
                 messages.error(
                     request,
                     "Failed to send verification email. Please try again later."
                 )
                 return redirect("profile", slug=request.user.username)

Based on static analysis hints.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/tests/test_user_profile.py (2)

107-109: Update the comment to reflect the new verification flow.

The comment describes the old behavior focusing on uniqueness validation. It should now explain that the implementation creates an unverified EmailAddress entry and sends a verification link, keeping the User.email unchanged until verification completes.

Apply this diff to clarify the comment:

-        # The current implementation doesn't update the User model's email
-        # It only validates that the email is unique
-        # So we just verify that the form was submitted successfully
+        # The implementation triggers email verification flow when email changes
+        # It validates uniqueness, creates an unverified EmailAddress entry,
+        # and sends a verification link while keeping User.email unchanged

---

110-112: Consider verifying EmailAddress creation and email sending.

The test correctly validates the user-facing message, but it doesn't verify that the underlying verification infrastructure was set up. Consider adding assertions to check:

1. An unverified EmailAddress object was created for the new email
2. A verification email was sent (using django.core.mail.outbox)

Example additions to enhance test coverage:

from allauth.account.models import EmailAddress
from django.core import mail

# After line 111, add:
# Verify EmailAddress object was created as unverified
email_address = EmailAddress.objects.get(user=self.user, email=new_email)
self.assertFalse(email_address.verified)
self.assertTrue(email_address.primary)  # or False depending on implementation

# Verify verification email was sent
self.assertEqual(len(mail.outbox), 1)
self.assertIn(new_email, mail.outbox[0].to)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/user.py (3)

145-145: Consider prefixing unused variable with underscore.

The created variable from get_or_create() is never used. While this is a common pattern, prefixing it with an underscore makes the intent explicit.

Apply this diff:

-    user_profile, created = UserProfile.objects.get_or_create(user=request.user)
+    user_profile, _created = UserProfile.objects.get_or_create(user=request.user)

---

161-163: Consider checking if the user already has this email verified.

The uniqueness check on line 161 excludes the current user's EmailAddress entries, which means if the user already has new_email as a verified secondary email, this check won't catch it. They would then create a duplicate unverified entry for an email they've already verified.

Consider adding an additional check:

             if EmailAddress.objects.exclude(user=request.user).filter(email=new_email).exists():
                 form.add_error("email", "This email is already registered or pending verification")
                 return render(request, "profile_edit.html", {"form": form})
+            
+            # Check if user already has this email verified
+            if EmailAddress.objects.filter(user=request.user, email=new_email, verified=True).exists():
+                form.add_error("email", "You already have this email verified. Use email management to set it as primary.")
+                return render(request, "profile_edit.html", {"form": form})

---

168-168: Remove unnecessary quotation marks in comment.

The quotation marks around "not" are unnecessary and make the comment look odd.

Apply this diff:

-            # Save profile form (does "not" touch email in user model)
+            # Save profile form (does not touch email in user model)

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/user.py (2)

184-189: Remove redundant exception object from logging message.

When using logger.exception(), the exception information is automatically captured and logged with the full traceback. Including {e} in the message is redundant.

Apply this diff:

             try:
                 send_email_confirmation(request, request.user, email=new_email)
             except Exception as e:
-                logger.exception(f"Failed to send email confirmation to {new_email}: {e}")
+                logger.exception(f"Failed to send email confirmation to {new_email}")
                 messages.error(request, "Failed to send verification email. Please try again later.")
                 return redirect("profile", slug=request.user.username)

Based on static analysis hints.

---

145-145: Consider using underscore prefix for unused variable.

The created variable is unpacked but never used. Consider prefixing with underscore to indicate it's intentionally unused.

Apply this diff:

-    user_profile, created = UserProfile.objects.get_or_create(user=request.user)
+    user_profile, _ = UserProfile.objects.get_or_create(user=request.user)

Based on static analysis hints.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/user.py (4)

144-145: Prefix unused variable with underscore.

The created return value from get_or_create is unpacked but never used. Prefix it with an underscore to indicate it's intentionally unused.

Apply this diff:

 Tag.objects.get_or_create(name="GSOC")
-user_profile, created = UserProfile.objects.get_or_create(user=request.user)
+user_profile, _ = UserProfile.objects.get_or_create(user=request.user)

---

162-166: Clarify how to set email as primary.

The error message tells users to "set it as primary instead" but doesn't indicate where or how to do this. Consider either:

1. Providing a link or instructions on how to set an email as primary
2. Automatically setting it as primary if it's already verified
3. Removing this suggestion if the functionality isn't available to users

Example improvement:

 if existing_email.verified:
-    form.add_error("email", "You already have this email verified. Please set it as primary instead.")
+    form.add_error("email", "This email is already verified for your account.")
     return render(request, "profile_edit.html", {"form": form})

---

192-197: Remove redundant exception object from log message.

When using logger.exception(), the exception and stack trace are automatically appended to the log output. Including the exception object in the message string is redundant.

Apply this diff:

 try:
     send_email_confirmation(request, request.user, email=new_email)
 except Exception as e:
-    logger.exception(f"Failed to send email confirmation to {new_email}: {e}")
+    logger.exception(f"Failed to send email confirmation to {new_email}")
     messages.error(request, "Failed to send verification email. Please try again later.")
     return redirect("profile", slug=request.user.username)

---

199-207: Consider consolidating the message string.

The success message on lines 200-201 uses string concatenation. For better readability, consider using a single string or parentheses for implicit concatenation.

Apply this diff:

-messages.info(
-    request,
-    "A verification link has been sent to your new email. " "Please verify to complete the update.",
-)
+messages.info(
+    request,
+    "A verification link has been sent to your new email. Please verify to complete the update.",
+)

Otherwise, the flow correctly handles both email-changed and email-unchanged cases with appropriate messages.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

website/views/user.py (2)

145-145: Prefix unused variable with underscore.

The created variable is unpacked but never used. Follow Python conventions by prefixing it with an underscore to indicate it's intentionally unused.

Apply this diff:

-    user_profile, created = UserProfile.objects.get_or_create(user=request.user)
+    user_profile, _created = UserProfile.objects.get_or_create(user=request.user)

---

194-194: Remove redundant exception object from log message.

logging.exception() automatically includes the exception and stack trace, so including {e} in the formatted string is redundant.

Apply this diff:

-                    logger.exception(f"Failed to send email confirmation to {new_email}: {e}")
+                    logger.exception(f"Failed to send email confirmation to {new_email}")

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting