feat: Add email verification, owner shift deletion, Coolify Docker compose setup, and fixes

backend/apps/users/tests.py

@@ -2,7 +2,7 @@ from django.test import TestCase
 from django.contrib.auth import get_user_model
 from rest_framework.test import APIClient
 from rest_framework import status
-from .models import RegistrationDomainRule, RegistrationRestrictionSetting
+from .models import RegistrationDomainRule, RegistrationRestrictionSetting, EmailVerificationToken
 from apps.events.models import Event, TaskArea, Shift, ShiftSignup
 
 User = get_user_model()
@@ -38,7 +38,41 @@ class UserRegistrationTests(TestCase):
             'display_name': 'Allowed User'
         })
         self.assertEqual(res_ok.status_code, status.HTTP_201_CREATED)
-        self.assertIn('token', res_ok.data)
+        self.assertTrue(res_ok.data.get('requires_verification'))
+
+    def test_email_verification_flow(self):
+        # Register new user
+        res_reg = self.client.post('/api/users/register/', {
+            'username': 'verify_user',
+            'email': 'verify@example.com',
+            'password': 'password123',
+            'display_name': 'Verify User'
+        })
+        self.assertEqual(res_reg.status_code, status.HTTP_201_CREATED)
+        self.assertTrue(res_reg.data.get('requires_verification'))
+        v_token_str = res_reg.data.get('verification_token')
+
+        # Login should be blocked prior to verification or admin approval
+        res_login_blocked = self.client.post('/api/users/login/', {
+            'username': 'verify_user',
+            'password': 'password123'
+        })
+        self.assertEqual(res_login_blocked.status_code, status.HTTP_403_FORBIDDEN)
+
+        # Verify email using verification token
+        res_verify = self.client.post('/api/users/verify-email/', {
+            'token': v_token_str
+        })
+        self.assertEqual(res_verify.status_code, status.HTTP_200_OK)
+        self.assertIn('token', res_verify.data)
+
+        # Login should now succeed
+        res_login_ok = self.client.post('/api/users/login/', {
+            'username': 'verify_user',
+            'password': 'password123'
+        })
+        self.assertEqual(res_login_ok.status_code, status.HTTP_200_OK)
+        self.assertIn('token', res_login_ok.data)
 
     def test_guest_shift_claiming_on_registration(self):
         # Create event, task area, shift
@@ -73,11 +107,6 @@ class UserRegistrationTests(TestCase):
         self.assertIsNone(signup.guest_name)
 
     def test_admin_approval_workflow(self):
-        # Enable admin approval requirement
-        setting = RegistrationRestrictionSetting.get_solo()
-        setting.require_admin_approval = True
-        setting.save()
-
         # Register user
         res_reg = self.client.post('/api/users/register/', {
             'username': 'pending_user',
@@ -86,8 +115,6 @@ class UserRegistrationTests(TestCase):
             'display_name': 'Pending User'
         })
         self.assertEqual(res_reg.status_code, status.HTTP_201_CREATED)
-        self.assertTrue(res_reg.data.get('requires_approval'))
-        self.assertNotIn('token', res_reg.data)
 
         # Attempt login before approval (should be blocked)
         res_login_fail = self.client.post('/api/users/login/', {