Handle the confirmation codes to validate user emails.

data/database.py

@@ -18,9 +18,7 @@ class User(BaseModel):
   username = CharField(unique=True)
   password_hash = CharField()
   email = CharField(unique=True)
-
-  # TODO move this to False and require email verification
-  verified = BooleanField(default=True)
+  verified = BooleanField(default=False)
 
 
 class Visibility(BaseModel):
@@ -67,7 +65,7 @@ class AccessToken(BaseModel):
 
 
 class EmailConfirmation(BaseModel):
-  code = CharField(default=random_string_generator())
+  code = CharField(default=random_string_generator(), unique=True)
   user = ForeignKeyField(User)
   pw_reset = BooleanField(default=False)
   email_confirm = BooleanField(default=False)
@@ -101,7 +99,8 @@ class RepositoryTag(BaseModel):
 
 def initialize_db():
   create_model_tables([User, Repository, Image, AccessToken, Role,
-                       RepositoryPermission, Visibility, RepositoryTag])
+                       RepositoryPermission, Visibility, RepositoryTag,
+                       EmailConfirmation])
   Role.create(name='admin')
   Role.create(name='write')
   Role.create(name='read')

data/model.py

@@ -34,10 +34,23 @@ def create_user(username, password, email):
 
 
 def create_confirm_email_code(user):
-  code = EmailConfirmation(user=user, email_confirm=True)
+  code = EmailConfirmation.create(user=user, email_confirm=True)
   return code
 
 
+def confirm_user_email(code):
+  code = EmailConfirmation.get(EmailConfirmation.code == code,
+                               EmailConfirmation.email_confirm == True)
+
+  user = code.user
+  user.verified = True
+  user.save()
+
+  code.delete_instance()
+
+  return user
+
+
 def get_user(username):
   try:
     return User.get(User.username == username)