From 3620a6889d7aebfb400cce4f7ca5630bb91c9d44 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 16 Apr 2024 12:58:57 +0100
Subject: [PATCH 1/9] fix(deps): bump sqlparse from 0.4.4 to 0.5.0 (#2284)

* fix(deps): bump sqlparse from 0.4.4 to 0.5.0

Bumps [sqlparse](https://github.com/andialbrecht/sqlparse) from 0.4.4 to 0.5.0.
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](https://github.com/andialbrecht/sqlparse/compare/0.4.4...0.5.0)

---
updated-dependencies:
- dependency-name: sqlparse
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Upgrade libsass too

Co-Authored-By: faucomte97 <f.aucomte@hotmail.co.uk>
---
 setup.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/setup.py b/setup.py
index b58cb4542..8223adf1b 100644
--- a/setup.py
+++ b/setup.py
@@ -36,8 +36,7 @@
         "django-treebeard==4.3.1",
         "django-sekizai==2.0.0",
         "django-classy-tags==2.0.0",
-        "sqlparse==0.4.4",
-        "libsass==0.22.0",
+        "libsass==0.23.0",
         "phonenumbers==8.12.12",
         "more-itertools==8.7.0",
         f"cfl-common=={version}",

From da57d44ecad1fac4e851f8a639240fa373a06666 Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Tue, 16 Apr 2024 12:00:35 +0000
Subject: [PATCH 2/9] 6.41.11

Automatically generated by python-semantic-release
---
 portal/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/portal/__init__.py b/portal/__init__.py
index 443f078d6..2b15d32a8 100644
--- a/portal/__init__.py
+++ b/portal/__init__.py
@@ -1 +1 @@
-__version__ = "6.41.10"
+__version__ = "6.41.11"

From 07da96d5b5b2140aad6b771962d0740af60a4620 Mon Sep 17 00:00:00 2001
From: faucomte97 <f.aucomte@hotmail.co.uk>
Date: Tue, 16 Apr 2024 17:41:52 +0100
Subject: [PATCH 3/9] build: Relock Pipfile

---
 Pipfile.lock | 96 ++++++++++++++++++++++++++--------------------------
 1 file changed, 48 insertions(+), 48 deletions(-)

diff --git a/Pipfile.lock b/Pipfile.lock
index af4e0e241..847519248 100644
--- a/Pipfile.lock
+++ b/Pipfile.lock
@@ -401,11 +401,11 @@
         },
         "idna": {
             "hashes": [
-                "sha256:9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca",
-                "sha256:c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+                "sha256:028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc",
+                "sha256:82fee1fc78add43492d3a1898bfa6d8a904cc97d8427f683ed8e798d07761aa0"
             ],
             "markers": "python_version >= '3.5'",
-            "version": "==3.6"
+            "version": "==3.7"
         },
         "importlib-metadata": {
             "hashes": [
@@ -425,15 +425,15 @@
         },
         "libsass": {
             "hashes": [
-                "sha256:081e256ab3c5f3f09c7b8dea3bf3bf5e64a97c6995fd9eea880639b3f93a9f9a",
-                "sha256:3ab5ad18e47db560f4f0c09e3d28cf3bb1a44711257488ac2adad69f4f7f8425",
-                "sha256:5fb2297a4754a6c8e25cfe5c015a3b51a2b6b9021b333f989bb8ce9d60eb5828",
-                "sha256:65455a2728b696b62100eb5932604aa13a29f4ac9a305d95773c14aaa7200aaf",
-                "sha256:89c5ce497fcf3aba1dd1b19aae93b99f68257e5f2026b731b00a872f13324c7f",
-                "sha256:f1efc1b612299c88aec9e39d6ca0c266d360daa5b19d9430bdeaffffa86993f9"
+                "sha256:31e86d92a5c7a551df844b72d83fc2b5e50abc6fbbb31e296f7bebd6489ed1b4",
+                "sha256:34cae047cbbfc4ffa832a61cbb110f3c95f5471c6170c842d3fed161e40814dc",
+                "sha256:4a218406d605f325d234e4678bd57126a66a88841cb95bee2caeafdc6f138306",
+                "sha256:6f209955ede26684e76912caf329f4ccb57e4a043fd77fe0e7348dd9574f1880",
+                "sha256:a2ec85d819f353cbe807432d7275d653710d12b08ec7ef61c124a580a8352f3c",
+                "sha256:ea97d1b45cdc2fc3590cb9d7b60f1d8915d3ce17a98c1f2d4dd47ee0d9c68ce6"
             ],
-            "markers": "python_version >= '3.6'",
-            "version": "==0.22.0"
+            "markers": "python_version >= '3.8'",
+            "version": "==0.23.0"
         },
         "markuppy": {
             "hashes": [
@@ -725,10 +725,10 @@
         },
         "rapid-router": {
             "hashes": [
-                "sha256:0beb0b7892f1b3955ed550290f6e8f4de46ea309d015696b699ffafced6180df",
-                "sha256:71aa0681cb293002bbd214c5bc3b24ef44f55e85e629a6fa9022e4aefbbfb094"
+                "sha256:5c1ddef2abc6dce795b48baa9eb73ba46bfc21f6d99e635ded23633bc6a2ec11",
+                "sha256:64f8a71b4bf2fe8b47b248935f04ac242e012954bcf243dcd2321c76e988b479"
             ],
-            "version": "==5.16.21"
+            "version": "==5.16.22"
         },
         "reportlab": {
             "hashes": [
@@ -830,11 +830,11 @@
         },
         "sqlparse": {
             "hashes": [
-                "sha256:5430a4fe2ac7d0f93e66f1efc6e1338a41884b7ddf2a350cedd20ccc4d9d28f3",
-                "sha256:d446183e84b8349fa3061f0fe7f06ca94ba65b426946ffebe6e3e8295332420c"
+                "sha256:714d0a4932c059d16189f58ef5411ec2287a4360f17cdd0edd2d09d4c5087c93",
+                "sha256:c204494cd97479d0e39f28c93d46c0b2d5959c7b9ab904762ea6c7af211c8663"
             ],
-            "markers": "python_version >= '3.5'",
-            "version": "==0.4.4"
+            "markers": "python_version >= '3.8'",
+            "version": "==0.5.0"
         },
         "tablib": {
             "extras": [
@@ -925,32 +925,32 @@
         },
         "black": {
             "hashes": [
-                "sha256:2818cf72dfd5d289e48f37ccfa08b460bf469e67fb7c4abb07edc2e9f16fb63f",
-                "sha256:41622020d7120e01d377f74249e677039d20e6344ff5851de8a10f11f513bf93",
-                "sha256:4acf672def7eb1725f41f38bf6bf425c8237248bb0804faa3965c036f7672d11",
-                "sha256:4be5bb28e090456adfc1255e03967fb67ca846a03be7aadf6249096100ee32d0",
-                "sha256:4f1373a7808a8f135b774039f61d59e4be7eb56b2513d3d2f02a8b9365b8a8a9",
-                "sha256:56f52cfbd3dabe2798d76dbdd299faa046a901041faf2cf33288bc4e6dae57b5",
-                "sha256:65b76c275e4c1c5ce6e9870911384bff5ca31ab63d19c76811cb1fb162678213",
-                "sha256:65c02e4ea2ae09d16314d30912a58ada9a5c4fdfedf9512d23326128ac08ac3d",
-                "sha256:6905238a754ceb7788a73f02b45637d820b2f5478b20fec82ea865e4f5d4d9f7",
-                "sha256:79dcf34b33e38ed1b17434693763301d7ccbd1c5860674a8f871bd15139e7837",
-                "sha256:7bb041dca0d784697af4646d3b62ba4a6b028276ae878e53f6b4f74ddd6db99f",
-                "sha256:7d5e026f8da0322b5662fa7a8e752b3fa2dac1c1cbc213c3d7ff9bdd0ab12395",
-                "sha256:9f50ea1132e2189d8dff0115ab75b65590a3e97de1e143795adb4ce317934995",
-                "sha256:a0c9c4a0771afc6919578cec71ce82a3e31e054904e7197deacbc9382671c41f",
-                "sha256:aadf7a02d947936ee418777e0247ea114f78aff0d0959461057cae8a04f20597",
-                "sha256:b5991d523eee14756f3c8d5df5231550ae8993e2286b8014e2fdea7156ed0959",
-                "sha256:bf21b7b230718a5f08bd32d5e4f1db7fc8788345c8aea1d155fc17852b3410f5",
-                "sha256:c45f8dff244b3c431b36e3224b6be4a127c6aca780853574c00faf99258041eb",
-                "sha256:c7ed6668cbbfcd231fa0dc1b137d3e40c04c7f786e626b405c62bcd5db5857e4",
-                "sha256:d7de8d330763c66663661a1ffd432274a2f92f07feeddd89ffd085b5744f85e7",
-                "sha256:e19cb1c6365fd6dc38a6eae2dcb691d7d83935c10215aef8e6c38edee3f77abd",
-                "sha256:e2af80566f43c85f5797365077fb64a393861a3730bd110971ab7a0c94e873e7"
+                "sha256:1bb9ca06e556a09f7f7177bc7cb604e5ed2d2df1e9119e4f7d2f1f7071c32e5d",
+                "sha256:21f9407063ec71c5580b8ad975653c66508d6a9f57bd008bb8691d273705adcd",
+                "sha256:4396ca365a4310beef84d446ca5016f671b10f07abdba3e4e4304218d2c71d33",
+                "sha256:44d99dfdf37a2a00a6f7a8dcbd19edf361d056ee51093b2445de7ca09adac965",
+                "sha256:5cd5b4f76056cecce3e69b0d4c228326d2595f506797f40b9233424e2524c070",
+                "sha256:64578cf99b6b46a6301bc28bdb89f9d6f9b592b1c5837818a177c98525dbe397",
+                "sha256:64e60a7edd71fd542a10a9643bf369bfd2644de95ec71e86790b063aa02ff745",
+                "sha256:652e55bb722ca026299eb74e53880ee2315b181dfdd44dca98e43448620ddec1",
+                "sha256:6644f97a7ef6f401a150cca551a1ff97e03c25d8519ee0bbc9b0058772882665",
+                "sha256:6ad001a9ddd9b8dfd1b434d566be39b1cd502802c8d38bbb1ba612afda2ef436",
+                "sha256:71d998b73c957444fb7c52096c3843875f4b6b47a54972598741fe9a7f737fcb",
+                "sha256:74eb9b5420e26b42c00a3ff470dc0cd144b80a766128b1771d07643165e08d0e",
+                "sha256:75a2d0b4f5eb81f7eebc31f788f9830a6ce10a68c91fbe0fade34fff7a2836e6",
+                "sha256:7852b05d02b5b9a8c893ab95863ef8986e4dda29af80bbbda94d7aee1abf8702",
+                "sha256:7f2966b9b2b3b7104fca9d75b2ee856fe3fdd7ed9e47c753a4bb1a675f2caab8",
+                "sha256:8e5537f456a22cf5cfcb2707803431d2feeb82ab3748ade280d6ccd0b40ed2e8",
+                "sha256:d4e71cdebdc8efeb6deaf5f2deb28325f8614d48426bed118ecc2dcaefb9ebf3",
+                "sha256:dae79397f367ac8d7adb6c779813328f6d690943f64b32983e896bcccd18cbad",
+                "sha256:e3a3a092b8b756c643fe45f4624dbd5a389f770a4ac294cf4d0fce6af86addaf",
+                "sha256:eb949f56a63c5e134dfdca12091e98ffb5fd446293ebae123d10fc1abad00b9e",
+                "sha256:f07b69fda20578367eaebbd670ff8fc653ab181e1ff95d84497f9fa20e7d0641",
+                "sha256:f95cece33329dc4aa3b0e1a771c41075812e46cf3d6e3f1dfe3d91ff09826ed2"
             ],
             "index": "pypi",
             "markers": "python_version >= '3.8'",
-            "version": "==24.3.0"
+            "version": "==24.4.0"
         },
         "certifi": {
             "hashes": [
@@ -1215,11 +1215,11 @@
         },
         "idna": {
             "hashes": [
-                "sha256:9ecdbbd083b06798ae1e86adcbfe8ab1479cf864e4ee30fe4e46a003d12491ca",
-                "sha256:c05567e9c24a6b9faaa835c4821bad0590fbb9d5779e7caa6e1cc4978e7eb24f"
+                "sha256:028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc",
+                "sha256:82fee1fc78add43492d3a1898bfa6d8a904cc97d8427f683ed8e798d07761aa0"
             ],
             "markers": "python_version >= '3.5'",
-            "version": "==3.6"
+            "version": "==3.7"
         },
         "iniconfig": {
             "hashes": [
@@ -1485,11 +1485,11 @@
         },
         "sqlparse": {
             "hashes": [
-                "sha256:5430a4fe2ac7d0f93e66f1efc6e1338a41884b7ddf2a350cedd20ccc4d9d28f3",
-                "sha256:d446183e84b8349fa3061f0fe7f06ca94ba65b426946ffebe6e3e8295332420c"
+                "sha256:714d0a4932c059d16189f58ef5411ec2287a4360f17cdd0edd2d09d4c5087c93",
+                "sha256:c204494cd97479d0e39f28c93d46c0b2d5959c7b9ab904762ea6c7af211c8663"
             ],
-            "markers": "python_version >= '3.5'",
-            "version": "==0.4.4"
+            "markers": "python_version >= '3.8'",
+            "version": "==0.5.0"
         },
         "tablib": {
             "extras": [

From 5fed9b21c3b359ff0aac4d53c56f85a3ed20e13f Mon Sep 17 00:00:00 2001
From: Florian Aucomte <f.aucomte@hotmail.co.uk>
Date: Tue, 23 Apr 2024 13:48:08 +0100
Subject: [PATCH 4/9] fix: Move jQuery load earlier (#2287)

---
 portal/templates/portal/base.html | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/portal/templates/portal/base.html b/portal/templates/portal/base.html
index e8fba462d..e9e795dbc 100644
--- a/portal/templates/portal/base.html
+++ b/portal/templates/portal/base.html
@@ -10,6 +10,7 @@
         </title>
         <meta name="msapplication-config" content="none"/>
         <meta name="viewport" content="width=device-width, initial-scale=1"/>
+        <script type="text/javascript" src="{% static 'portal/js/lib/jquery.min.js' %}"></script>
         {% include "common/onetrust_cookies_consent_notice.html" %}
         {% block head %}
         {% endblock head %}
@@ -31,21 +32,14 @@
                   type="image/x-icon">
         {% endblock css %}
         {% include "portal/tag_manager/tag_manager_head.html" %}
-        <script type="text/javascript"
-                src="{% static 'portal/js/lib/jquery.min.js' %}"></script>
-        <script type="text/javascript"
-                src="{% static 'portal/js/lib/modernizr-build.js' %}"></script>
+
+        <script type="text/javascript" src="{% static 'portal/js/lib/modernizr-build.js' %}"></script>
         <script type="text/javascript" src="{% static 'portal/js/common.js' %}"></script>
-        <script type="text/javascript"
-                src="{% static 'portal/js/jquery.placeholder.js' %}"></script>
-        <script type="text/javascript"
-                src="{% static 'portal/js/lib/jquery.colorbox.js' %}"></script>
-        <script type="text/javascript"
-                src="{% static 'portal/js/lib/papaparse.min.js' %}"></script>
-        <script type="text/javascript"
-                src="{% static 'portal/js/sticky_subnav.js' %}"></script>
-        <script type="text/javascript"
-                src="{% static 'portal/js/bootstrap.min.js' %}"></script>
+        <script type="text/javascript" src="{% static 'portal/js/jquery.placeholder.js' %}"></script>
+        <script type="text/javascript" src="{% static 'portal/js/lib/jquery.colorbox.js' %}"></script>
+        <script type="text/javascript" src="{% static 'portal/js/lib/papaparse.min.js' %}"></script>
+        <script type="text/javascript" src="{% static 'portal/js/sticky_subnav.js' %}"></script>
+        <script type="text/javascript" src="{% static 'portal/js/bootstrap.min.js' %}"></script>
         <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>
         <script src="https://code.iconify.design/2/2.0.3/iconify.min.js"
                 integrity="sha256-pRhh6noOilGT8GyGitRuoRwdp5k1p8QJW2lvyGz4B9M="

From 854e47b13bce500e36eb943f114cff9c0b48f34c Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Tue, 23 Apr 2024 12:49:53 +0000
Subject: [PATCH 5/9] 6.41.12

Automatically generated by python-semantic-release
---
 portal/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/portal/__init__.py b/portal/__init__.py
index 2b15d32a8..714aef5a7 100644
--- a/portal/__init__.py
+++ b/portal/__init__.py
@@ -1 +1 @@
-__version__ = "6.41.11"
+__version__ = "6.41.12"

From 00fe5cd19e761086798dae0f9a83cd318764f9f1 Mon Sep 17 00:00:00 2001
From: Florian Aucomte <f.aucomte@hotmail.co.uk>
Date: Mon, 29 Apr 2024 17:41:57 +0100
Subject: [PATCH 6/9] feat: Enable atomic transactions (#2288)

---
 example_project/portal_test_settings.py | 1 +
 example_project/settings.py             | 1 +
 portal/tests/test_emails.py             | 1 +
 3 files changed, 3 insertions(+)

diff --git a/example_project/portal_test_settings.py b/example_project/portal_test_settings.py
index 9694f2036..38e232184 100644
--- a/example_project/portal_test_settings.py
+++ b/example_project/portal_test_settings.py
@@ -60,6 +60,7 @@
         "NAME": os.path.join(
             os.path.abspath(os.path.dirname(__file__)), "db.sqlite3"
         ),  # Or path to database file if using sqlite3.
+        "ATOMIC_REQUESTS": True,
     }
 }
 
diff --git a/example_project/settings.py b/example_project/settings.py
index 1b037b461..a088cc625 100644
--- a/example_project/settings.py
+++ b/example_project/settings.py
@@ -11,6 +11,7 @@
         "NAME": os.path.join(
             os.path.abspath(os.path.dirname(__file__)), "db.sqlite3"
         ),  # Or path to database file if using sqlite3.
+        "ATOMIC_REQUESTS": True,
     }
 }
 
diff --git a/portal/tests/test_emails.py b/portal/tests/test_emails.py
index 2ae890366..b48f5f2a9 100644
--- a/portal/tests/test_emails.py
+++ b/portal/tests/test_emails.py
@@ -59,6 +59,7 @@ def test_newsletter_calls_correct_requests(mocker, monkeypatch):
     mocked_add_to_address_book.assert_called_once()
 
 
+@pytest.mark.django_db
 def test_newsletter_get_not_allowed():
     c = Client()
 

From 46dffa17cfc9c79c4aae6ccc6dffe1d0116966ce Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Mon, 29 Apr 2024 16:43:33 +0000
Subject: [PATCH 7/9] 6.42.0

Automatically generated by python-semantic-release
---
 portal/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/portal/__init__.py b/portal/__init__.py
index 714aef5a7..3d0e834b2 100644
--- a/portal/__init__.py
+++ b/portal/__init__.py
@@ -1 +1 @@
-__version__ = "6.41.12"
+__version__ = "6.42.0"

From 831200fb60836ca12db9ad3cff4605a62b7c9baa Mon Sep 17 00:00:00 2001
From: Florian Aucomte <f.aucomte@hotmail.co.uk>
Date: Thu, 2 May 2024 12:01:04 +0100
Subject: [PATCH 8/9] feat: Clean illogical data (#2290)

---
 .../migrations/0049_anonymise_orphan_users.py |  29 +++++
 .../0050_anonymise_orphan_schools.py          |  30 +++++
 .../migrations/0051_verify_returning_users.py |  30 +++++
 cfl_common/common/models.py                   |   1 -
 ...test_migration_anonymise_orphan_schools.py |  30 +++++
 .../test_migration_anonymise_orphan_users.py  |  30 +++++
 ... => test_migration_unique_school_names.py} |  10 +-
 .../test_migration_verify_returning_users.py  |  59 +++++++++
 portal/tests/test_api.py                      | 119 ++++++++++++++----
 portal/views/login/student.py                 |  43 +++++--
 10 files changed, 340 insertions(+), 41 deletions(-)
 create mode 100644 cfl_common/common/migrations/0049_anonymise_orphan_users.py
 create mode 100644 cfl_common/common/migrations/0050_anonymise_orphan_schools.py
 create mode 100644 cfl_common/common/migrations/0051_verify_returning_users.py
 create mode 100644 cfl_common/common/tests/test_migration_anonymise_orphan_schools.py
 create mode 100644 cfl_common/common/tests/test_migration_anonymise_orphan_users.py
 rename cfl_common/common/tests/{test_0048_unique_school_names.py => test_migration_unique_school_names.py} (74%)
 create mode 100644 cfl_common/common/tests/test_migration_verify_returning_users.py

diff --git a/cfl_common/common/migrations/0049_anonymise_orphan_users.py b/cfl_common/common/migrations/0049_anonymise_orphan_users.py
new file mode 100644
index 000000000..e2435d0db
--- /dev/null
+++ b/cfl_common/common/migrations/0049_anonymise_orphan_users.py
@@ -0,0 +1,29 @@
+from django.apps.registry import Apps
+from django.db import migrations
+
+from portal.views.api import __anonymise_user
+
+
+def anonymise_orphan_users(apps: Apps, *args):
+    """
+    Users should never exist without a user-type linked to them. Anonymise all
+    instances of User objects without a Teacher or Student instance.
+    """
+    User = apps.get_model("auth", "User")
+
+    active_orphan_users = User.objects.filter(
+        new_teacher__isnull=True, new_student__isnull=True, is_active=True
+    )
+
+    for active_orphan_user in active_orphan_users:
+        __anonymise_user(active_orphan_user)
+
+
+class Migration(migrations.Migration):
+    dependencies = [("common", "0048_unique_school_names")]
+
+    operations = [
+        migrations.RunPython(
+            code=anonymise_orphan_users, reverse_code=migrations.RunPython.noop
+        ),
+    ]
diff --git a/cfl_common/common/migrations/0050_anonymise_orphan_schools.py b/cfl_common/common/migrations/0050_anonymise_orphan_schools.py
new file mode 100644
index 000000000..d677cf5ea
--- /dev/null
+++ b/cfl_common/common/migrations/0050_anonymise_orphan_schools.py
@@ -0,0 +1,30 @@
+from uuid import uuid4
+
+from django.apps.registry import Apps
+from django.db import migrations
+
+
+def anonymise_orphan_schools(apps: Apps, *args):
+    """
+    Schools without any teachers or students should be anonymised (inactive).
+    Mark all active orphan schools as inactive.
+    """
+    School = apps.get_model("common", "School")
+
+    active_orphan_schools = School.objects.filter(teacher_school__isnull=True)
+
+    for active_orphan_school in active_orphan_schools:
+        active_orphan_school.name = uuid4().hex
+        active_orphan_school.is_active = False
+        active_orphan_school.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [("common", "0049_anonymise_orphan_users")]
+
+    operations = [
+        migrations.RunPython(
+            code=anonymise_orphan_schools,
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]
diff --git a/cfl_common/common/migrations/0051_verify_returning_users.py b/cfl_common/common/migrations/0051_verify_returning_users.py
new file mode 100644
index 000000000..4944ae50c
--- /dev/null
+++ b/cfl_common/common/migrations/0051_verify_returning_users.py
@@ -0,0 +1,30 @@
+from django.apps.registry import Apps
+from django.db import migrations
+
+
+def verify_returning_users(apps: Apps, *args):
+    """
+    Users cannot be unverified after having logged in at least once. Grab all
+    instances of unverified UserProfile where the User has logged in and mark it
+    as verified.
+    """
+    UserProfile = apps.get_model("common", "UserProfile")
+
+    unverified_returning_userprofiles = UserProfile.objects.filter(
+        user__last_login__isnull=False, is_verified=False
+    )
+
+    for unverified_returning_userprofile in unverified_returning_userprofiles:
+        unverified_returning_userprofile.is_verified = True
+        unverified_returning_userprofile.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [("common", "0050_anonymise_orphan_schools")]
+
+    operations = [
+        migrations.RunPython(
+            code=verify_returning_users,
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]
diff --git a/cfl_common/common/models.py b/cfl_common/common/models.py
index 9bd198f90..871fac32b 100644
--- a/cfl_common/common/models.py
+++ b/cfl_common/common/models.py
@@ -2,7 +2,6 @@
 from datetime import timedelta
 from uuid import uuid4
 
-import pgeocode
 from django.contrib.auth.models import User
 from django.db import models
 from django.utils import timezone
diff --git a/cfl_common/common/tests/test_migration_anonymise_orphan_schools.py b/cfl_common/common/tests/test_migration_anonymise_orphan_schools.py
new file mode 100644
index 000000000..f30d354c8
--- /dev/null
+++ b/cfl_common/common/tests/test_migration_anonymise_orphan_schools.py
@@ -0,0 +1,30 @@
+import pytest
+from django_test_migrations.migrator import Migrator
+
+
+@pytest.mark.django_db
+def test_migration_anonymise_orphan_schools(migrator: Migrator):
+    state = migrator.apply_initial_migration(
+        ("common", "0049_anonymise_orphan_users")
+    )
+    User = state.apps.get_model("auth", "User")
+    UserProfile = state.apps.get_model("common", "UserProfile")
+    Teacher = state.apps.get_model("common", "Teacher")
+    School = state.apps.get_model("common", "School")
+
+    orphan_school = School.objects.create(name="OrphanSchool")
+    teacher_school = School.objects.create(name="TeacherSchool")
+
+    teacher_user = User.objects.create_user("TeacherUser", password="password")
+    teacher_userprofile = UserProfile.objects.create(user=teacher_user)
+    Teacher.objects.create(
+        user=teacher_userprofile, new_user=teacher_user, school=teacher_school
+    )
+
+    migrator.apply_tested_migration(("common", "0050_anonymise_orphan_schools"))
+
+    def assert_school_anonymised(pk: int, anonymised: bool):
+        assert School.objects.get(pk=pk).is_active != anonymised
+
+    assert_school_anonymised(orphan_school.pk, True)
+    assert_school_anonymised(teacher_school.pk, False)
diff --git a/cfl_common/common/tests/test_migration_anonymise_orphan_users.py b/cfl_common/common/tests/test_migration_anonymise_orphan_users.py
new file mode 100644
index 000000000..4c52c4065
--- /dev/null
+++ b/cfl_common/common/tests/test_migration_anonymise_orphan_users.py
@@ -0,0 +1,30 @@
+import pytest
+from django_test_migrations.migrator import Migrator
+
+
+@pytest.mark.django_db
+def test_migration_anonymise_orphan_users(migrator: Migrator):
+    state = migrator.apply_initial_migration(
+        ("common", "0048_unique_school_names")
+    )
+    User = state.apps.get_model("auth", "User")
+    UserProfile = state.apps.get_model("common", "UserProfile")
+    Teacher = state.apps.get_model("common", "Teacher")
+    Student = state.apps.get_model("common", "Student")
+
+    orphan_user = User.objects.create_user("OrphanUser", password="password")
+    teacher_user = User.objects.create_user("TeacherUser", password="password")
+    student_user = User.objects.create_user("StudentUser", password="password")
+    teacher_userprofile = UserProfile.objects.create(user=teacher_user)
+    student_userprofile = UserProfile.objects.create(user=student_user)
+    Teacher.objects.create(user=teacher_userprofile, new_user=teacher_user)
+    Student.objects.create(user=student_userprofile, new_user=student_user)
+
+    migrator.apply_tested_migration(("common", "0049_anonymise_orphan_users"))
+
+    def assert_user_anonymised(pk: int, anonymised: bool):
+        assert User.objects.get(pk=pk).is_active != anonymised
+
+    assert_user_anonymised(orphan_user.pk, True)
+    assert_user_anonymised(teacher_user.pk, False)
+    assert_user_anonymised(student_user.pk, False)
diff --git a/cfl_common/common/tests/test_0048_unique_school_names.py b/cfl_common/common/tests/test_migration_unique_school_names.py
similarity index 74%
rename from cfl_common/common/tests/test_0048_unique_school_names.py
rename to cfl_common/common/tests/test_migration_unique_school_names.py
index 1ad02f502..2e5ee144c 100644
--- a/cfl_common/common/tests/test_0048_unique_school_names.py
+++ b/cfl_common/common/tests/test_migration_unique_school_names.py
@@ -3,8 +3,10 @@
 
 
 @pytest.mark.django_db
-def test_0048_unique_school_names(migrator: Migrator):
-    state = migrator.apply_initial_migration(("common", "0047_delete_school_postcode"))
+def test_migration_unique_school_names(migrator: Migrator):
+    state = migrator.apply_initial_migration(
+        ("common", "0047_delete_school_postcode")
+    )
     School = state.apps.get_model("common", "School")
 
     school_name = "ExampleSchool"
@@ -15,7 +17,9 @@ def test_0048_unique_school_names(migrator: Migrator):
             School(name=f"{school_name} 1"),
         ]
     )
-    school_ids = list(School.objects.order_by("-id")[:3].values_list("id", flat=True))
+    school_ids = list(
+        School.objects.order_by("-id")[:3].values_list("id", flat=True)
+    )
     school_ids.reverse()
 
     migrator.apply_tested_migration(("common", "0048_unique_school_names"))
diff --git a/cfl_common/common/tests/test_migration_verify_returning_users.py b/cfl_common/common/tests/test_migration_verify_returning_users.py
new file mode 100644
index 000000000..f10919228
--- /dev/null
+++ b/cfl_common/common/tests/test_migration_verify_returning_users.py
@@ -0,0 +1,59 @@
+from datetime import datetime, timezone
+
+import pytest
+from django_test_migrations.migrator import Migrator
+
+from portal.views.api import __anonymise_user
+
+
+@pytest.mark.django_db
+def test_migration_verify_returning_users(migrator: Migrator):
+    state = migrator.apply_initial_migration(
+        ("common", "0050_anonymise_orphan_schools")
+    )
+    User = state.apps.get_model("auth", "User")
+    UserProfile = state.apps.get_model("common", "UserProfile")
+
+    returning_user = User.objects.create_user(
+        "ReturningUser",
+        password="password",
+        last_login=datetime.now(tz=timezone.utc),
+    )
+    returning_userprofile = UserProfile.objects.create(user=returning_user)
+
+    non_returning_user = User.objects.create_user(
+        "NonReturningUser", password="password"
+    )
+    non_returning_userprofile = UserProfile.objects.create(
+        user=non_returning_user
+    )
+
+    anonymised_returning_user = User.objects.create_user(
+        "AnonReturningUser",
+        password="password",
+        last_login=datetime.now(tz=timezone.utc),
+    )
+    anonymised_returning_userprofile = UserProfile.objects.create(
+        user=anonymised_returning_user
+    )
+    __anonymise_user(anonymised_returning_user)
+
+    anonymised_non_returning_user = User.objects.create_user(
+        "AnonNonReturningUser", password="password"
+    )
+    anonymised_non_returning_userprofile = UserProfile.objects.create(
+        user=anonymised_non_returning_user
+    )
+    __anonymise_user(anonymised_non_returning_user)
+
+    migrator.apply_tested_migration(("common", "0051_verify_returning_users"))
+
+    def assert_userprofile_is_verified(pk: int, verified: bool):
+        assert UserProfile.objects.get(pk=pk).is_verified == verified
+
+    assert_userprofile_is_verified(returning_userprofile.pk, True)
+    assert_userprofile_is_verified(non_returning_userprofile.pk, False)
+    assert_userprofile_is_verified(anonymised_returning_userprofile.pk, True)
+    assert_userprofile_is_verified(
+        anonymised_non_returning_userprofile.pk, False
+    )
diff --git a/portal/tests/test_api.py b/portal/tests/test_api.py
index 88ebf0af7..902cae354 100644
--- a/portal/tests/test_api.py
+++ b/portal/tests/test_api.py
@@ -5,7 +5,10 @@
 import pytest
 from common.models import Class, School, Student, Teacher
 from common.tests.utils.classes import create_class_directly
-from common.tests.utils.organisation import create_organisation_directly, join_teacher_to_organisation
+from common.tests.utils.organisation import (
+    create_organisation_directly,
+    join_teacher_to_organisation,
+)
 from common.tests.utils.student import create_school_student_directly
 from common.tests.utils.teacher import signup_teacher_directly
 from common.tests.utils.user import create_user_directly, get_superuser
@@ -19,7 +22,10 @@
 
 class APITests(APITestCase):
     def test_valid_date_registered(self):
-        url = reverse("registered-users", kwargs={"year": "2016", "month": "04", "day": "01"})
+        url = reverse(
+            "registered-users",
+            kwargs={"year": "2016", "month": "04", "day": "01"},
+        )
         superuser = get_superuser()
         self.client.force_authenticate(user=superuser)
         response = self.client.get(url)
@@ -27,14 +33,20 @@ def test_valid_date_registered(self):
         assert_that(isinstance(response.data, int))
 
     def test_invalid_date_registered(self):
-        url = reverse("registered-users", kwargs={"year": "2016", "month": "05", "day": "35"})
+        url = reverse(
+            "registered-users",
+            kwargs={"year": "2016", "month": "05", "day": "35"},
+        )
         superuser = get_superuser()
         self.client.force_authenticate(user=superuser)
         response = self.client.get(url)
         assert_that(response, has_status_code(status.HTTP_404_NOT_FOUND))
 
     def test_valid_date_lastconnectedsince(self):
-        url = reverse("last-connected-since", kwargs={"year": "2016", "month": "04", "day": "01"})
+        url = reverse(
+            "last-connected-since",
+            kwargs={"year": "2016", "month": "04", "day": "01"},
+        )
         superuser = get_superuser()
         self.client.force_authenticate(user=superuser)
         response = self.client.get(url)
@@ -42,7 +54,10 @@ def test_valid_date_lastconnectedsince(self):
         assert_that(isinstance(response.data, int))
 
     def test_invalid_date_lastconnectedsince(self):
-        url = reverse("last-connected-since", kwargs={"year": "2016", "month": "05", "day": "35"})
+        url = reverse(
+            "last-connected-since",
+            kwargs={"year": "2016", "month": "05", "day": "35"},
+        )
         superuser = get_superuser()
         self.client.force_authenticate(user=superuser)
         response = self.client.get(url)
@@ -67,7 +82,9 @@ def test_get_inactive_users_if_admin(self):
         assert len(response.data) == 1
 
     @patch("portal.views.api.IS_CLOUD_SCHEDULER_FUNCTION", return_value=True)
-    def test_get_inactive_users_if_appengine(self, mock_is_cloud_scheduler_function):
+    def test_get_inactive_users_if_appengine(
+        self, mock_is_cloud_scheduler_function
+    ):
         client = APIClient()
         create_user_directly(active=False)
         create_user_directly(active=True)
@@ -86,7 +103,9 @@ def test_get_inactive_users_if_unauthorised(self):
         assert response.status_code == status.HTTP_403_FORBIDDEN
 
     @patch("portal.views.api.IS_CLOUD_SCHEDULER_FUNCTION", return_value=True)
-    def test_delete_inactive_users_if_appengine(self, mock_is_cloud_scheduler_function):
+    def test_delete_inactive_users_if_appengine(
+        self, mock_is_cloud_scheduler_function
+    ):
         client = APIClient()
         create_user_directly(active=False)
         create_user_directly(active=False)
@@ -94,14 +113,25 @@ def test_delete_inactive_users_if_appengine(self, mock_is_cloud_scheduler_functi
         response = client.get(url)
         users = response.data
         assert len(users) == 2
+
+        # NOTE: Migration 0049 causes user 34 (created via migration 0001) to
+        # be marked as inactive. Slightly tweaked this test so it still
+        # passes but takes into account this new anonymisation.
+        old_deleted_users = list(User.objects.filter(is_active=False))
+        assert len(old_deleted_users) == 1
+
         response = client.delete(url)
         assert mock_is_cloud_scheduler_function.called
         assert response.status_code == status.HTTP_204_NO_CONTENT
+
         for user in users:
             with pytest.raises(User.DoesNotExist):
                 User.objects.get(username=user["username"])
+
         deleted_users = list(User.objects.filter(is_active=False))
-        assert len(deleted_users) == 2
+        new_deleted_users_count = len(deleted_users) - len(old_deleted_users)
+        assert new_deleted_users_count == 2
+
         for user in deleted_users:
             assert user.first_name == "Deleted"
             assert user.last_name == "User"
@@ -112,27 +142,41 @@ def test_delete_inactive_users_if_appengine(self, mock_is_cloud_scheduler_functi
         assert len(response.data) == 0
 
     @patch("portal.views.api.IS_CLOUD_SCHEDULER_FUNCTION", return_value=True)
-    def test_orphan_schools_and_classes_are_anonymised(self, mock_is_cloud_scheduler_function):
+    def test_orphan_schools_and_classes_are_anonymised(
+        self, mock_is_cloud_scheduler_function
+    ):
         client = APIClient()
         # Create a school with an active teacher
         school1_teacher1_email, _ = signup_teacher_directly()
         school1 = create_organisation_directly(school1_teacher1_email)
-        klass11, _, access_code11 = create_class_directly(school1_teacher1_email)
+        klass11, _, access_code11 = create_class_directly(
+            school1_teacher1_email
+        )
         _, _, student11 = create_school_student_directly(access_code11)
 
         # Create a school with one active non-admin teacher and one inactive admin teacher
         school2_teacher1_email, _ = signup_teacher_directly()
         school2_teacher2_email, _ = signup_teacher_directly()
         school2 = create_organisation_directly(school2_teacher1_email)
-        join_teacher_to_organisation(school2_teacher2_email, school2.name, is_admin=True)
-        klass21, _, access_code21 = create_class_directly(school2_teacher1_email)
+        join_teacher_to_organisation(
+            school2_teacher2_email, school2.name, is_admin=True
+        )
+        klass21, _, access_code21 = create_class_directly(
+            school2_teacher1_email
+        )
         _, _, student21 = create_school_student_directly(access_code21)
-        klass22, _, access_code22 = create_class_directly(school2_teacher2_email)
+        klass22, _, access_code22 = create_class_directly(
+            school2_teacher2_email
+        )
         _, _, student22 = create_school_student_directly(access_code22)
-        school2_teacher1 = Teacher.objects.get(new_user__email=school2_teacher1_email)
+        school2_teacher1 = Teacher.objects.get(
+            new_user__email=school2_teacher1_email
+        )
         school2_teacher1.is_admin = False
         school2_teacher1.save()
-        school2_teacher2 = Teacher.objects.get(new_user__email=school2_teacher2_email)
+        school2_teacher2 = Teacher.objects.get(
+            new_user__email=school2_teacher2_email
+        )
         school2_teacher2.new_user.is_active = False
         school2_teacher2.new_user.save()
 
@@ -141,28 +185,40 @@ def test_orphan_schools_and_classes_are_anonymised(self, mock_is_cloud_scheduler
         school3_teacher2_email, _ = signup_teacher_directly()
         school3 = create_organisation_directly(school3_teacher1_email)
         join_teacher_to_organisation(school3_teacher2_email, school3.name)
-        klass31, _, access_code31 = create_class_directly(school3_teacher1_email)
+        klass31, _, access_code31 = create_class_directly(
+            school3_teacher1_email
+        )
         _, _, student31 = create_school_student_directly(access_code31)
-        klass32, _, access_code32 = create_class_directly(school3_teacher2_email)
+        klass32, _, access_code32 = create_class_directly(
+            school3_teacher2_email
+        )
         _, _, student32 = create_school_student_directly(access_code32)
-        school3_teacher1 = Teacher.objects.get(new_user__email=school3_teacher1_email)
+        school3_teacher1 = Teacher.objects.get(
+            new_user__email=school3_teacher1_email
+        )
         school3_teacher1.new_user.is_active = False
         school3_teacher1.new_user.save()
-        school3_teacher2 = Teacher.objects.get(new_user__email=school3_teacher2_email)
+        school3_teacher2 = Teacher.objects.get(
+            new_user__email=school3_teacher2_email
+        )
         school3_teacher2.new_user.is_active = False
         school3_teacher2.new_user.save()
 
         # Create a school with no active teachers
         school4_teacher1_email, _ = signup_teacher_directly()
         school4 = create_organisation_directly(school4_teacher1_email)
-        school4_teacher1 = Teacher.objects.get(new_user__email=school4_teacher1_email)
+        school4_teacher1 = Teacher.objects.get(
+            new_user__email=school4_teacher1_email
+        )
         school4_teacher1.new_user.is_active = False
         school4_teacher1.new_user.save()
 
         # Create a school with no teachers
         school5_teacher1_email, _ = signup_teacher_directly()
         school5 = create_organisation_directly(school5_teacher1_email)
-        school5_teacher1 = Teacher.objects.get(new_user__email=school5_teacher1_email)
+        school5_teacher1 = Teacher.objects.get(
+            new_user__email=school5_teacher1_email
+        )
         school5_teacher1.delete()
 
         # Call the API
@@ -182,7 +238,9 @@ def test_orphan_schools_and_classes_are_anonymised(self, mock_is_cloud_scheduler
         assert Student.objects.filter(pk=student21.pk).exists()
         assert not Student.objects.get(pk=student22.pk).new_user.is_active
         # Also check the first teacher is now an admin
-        assert Teacher.objects.get(new_user__email=school2_teacher1_email).is_admin
+        assert Teacher.objects.get(
+            new_user__email=school2_teacher1_email
+        ).is_admin
 
         # Check the third school is anonymised together with its classes and students
         assert not School.objects.filter(name=school3.name).exists()
@@ -250,14 +308,19 @@ def test_remove_fake_accounts(self):
                 last_name=random_account["last_name"],
             )
 
-        assert len(User.objects.all()) == len(random_accounts) + initial_users_length
+        assert (
+            len(User.objects.all())
+            == len(random_accounts) + initial_users_length
+        )
 
         client.login(username=admin_username, password=admin_password)
         response = client.get(reverse("remove_fake_accounts"))
         assert response.status_code == 204
 
         # check if after deletion all the users are still there
-        assert len(User.objects.all()) == initial_users_length + 2  # mentioned in the fake_accounts description
+        assert (
+            len(User.objects.all()) == initial_users_length + 2
+        )  # mentioned in the fake_accounts description
 
 
 def has_status_code(status_code):
@@ -272,7 +335,11 @@ def _matches(self, response):
         return response.status_code == self.status_code
 
     def describe_to(self, description):
-        description.append_text("has status code ").append_text(self.status_code)
+        description.append_text("has status code ").append_text(
+            self.status_code
+        )
 
     def describe_mismatch(self, response, mismatch_description):
-        mismatch_description.append_text("had status code ").append_text(response.status_code)
+        mismatch_description.append_text("had status code ").append_text(
+            response.status_code
+        )
diff --git a/portal/views/login/student.py b/portal/views/login/student.py
index 02d582af6..92fda8829 100644
--- a/portal/views/login/student.py
+++ b/portal/views/login/student.py
@@ -51,7 +51,8 @@ def _add_logged_in_as_message(self, request):
         class_name = self.kwargs["access_code"].upper()
         messages.info(
             request,
-            f"<strong>You are logged in to class: " f"{escape(class_name)}</strong>",
+            f"<strong>You are logged in to class: "
+            f"{escape(class_name)}</strong>",
             extra_tags="safe message--student",
         )
 
@@ -72,7 +73,9 @@ def _add_login_data(self, form, login_type):
         klass = classes[0]
 
         name = form.cleaned_data.get("username")
-        students = Student.objects.filter(new_user__first_name__iexact=name, class_field=klass)
+        students = Student.objects.filter(
+            new_user__first_name__iexact=name, class_field=klass
+        )
         try:
             student = students[0]
         except IndexError:
@@ -81,32 +84,44 @@ def _add_login_data(self, form, login_type):
             raise Exception(msg)
 
         # Log the login time, class, and login type
-        session = UserSession(user=student.new_user, class_field=klass, login_type=login_type)
+        session = UserSession(
+            user=student.new_user, class_field=klass, login_type=login_type
+        )
         session.save()
 
+        student.user.is_verified = True
+        student.user.save()
+
     def form_valid(self, form):
         """Security check complete. Log the user in."""
-
         # Reset ratelimit cache upon successful login
         clear_ratelimit_cache_for_user(form.cleaned_data["username"])
 
-        login_type = self.kwargs.get("login_type", "classlink")  # default to "classlink" if not specified
+        login_type = self.kwargs.get(
+            "login_type", "classlink"
+        )  # default to "classlink" if not specified
 
         self._add_login_data(form, login_type)
         return super(StudentLoginView, self).form_valid(form)
 
     def post(self, request, *args, **kwargs):
         """
-        If the first name and access code found under the url inputted in the form corresponds to that of a blocked
-        account, this redirects the user to the locked out page. However, if the lockout
-        time is more than 24 hours before this is executed, the account is unlocked.
+        If the first name and access code found under the url inputted in the
+        form corresponds to that of a blocked account, this redirects the user
+        to the locked out page. However, if the lockout time is more than 24
+        hours before this is executed, the account is unlocked.
         """
         username = request.POST.get("username")
 
         # get access code from the current url
         access_code = get_access_code_from_request(request)
-        if Student.objects.filter(new_user__first_name=username, class_field__access_code=access_code).exists():
-            student = Student.objects.get(new_user__first_name=username, class_field__access_code=access_code)
+        if Student.objects.filter(
+            new_user__first_name=username, class_field__access_code=access_code
+        ).exists():
+            student = Student.objects.get(
+                new_user__first_name=username,
+                class_field__access_code=access_code,
+            )
 
             if student.blocked_time is not None:
                 if has_user_lockout_expired(student):
@@ -129,9 +144,15 @@ def student_direct_login(request, user_id, login_id):
     if user:
         # Log the login time and class
         student = Student.objects.get(new_user=user)
-        session = UserSession(user=user, class_field=student.class_field, login_type="direct")
+        session = UserSession(
+            user=user, class_field=student.class_field, login_type="direct"
+        )
         session.save()
 
         login(request, user)
+
+        student.user.is_verified = True
+        student.user.save()
+
         return HttpResponseRedirect(reverse_lazy("student_details"))
     return HttpResponseRedirect(reverse_lazy("home"))

From dcbaa2f17382a6edd61870a057f7c008bcd0af44 Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Thu, 2 May 2024 11:03:01 +0000
Subject: [PATCH 9/9] 6.43.0

Automatically generated by python-semantic-release
---
 portal/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/portal/__init__.py b/portal/__init__.py
index 3d0e834b2..8fef5c28a 100644
--- a/portal/__init__.py
+++ b/portal/__init__.py
@@ -1 +1 @@
-__version__ = "6.42.0"
+__version__ = "6.43.0"