refactor: create_user에서 EmailAddress도 생성하도록 수정

Author: MU-Software

app/admin_api/test/socialaccount_test.py

@@ -22,7 +22,6 @@ def regular_user(db) -> UserExt:
     SocialAccount.objects.create(
         user=user, provider="google", uid="alice-google-1", extra_data={"email": "alice@example.com"}
     )
-    EmailAddress.objects.create(user=user, email="alice@example.com", verified=True, primary=True)
     return user
 
 
@@ -31,7 +30,6 @@ def multi_social_user(db) -> UserExt:
     user = UserExt.objects.create_user(username="bob", email="bob@example.com", password="x")  # nosec: B106
     SocialAccount.objects.create(user=user, provider="google", uid="bob-google-1", extra_data={})
     SocialAccount.objects.create(user=user, provider="kakao", uid="bob-kakao-1", extra_data={})
-    EmailAddress.objects.create(user=user, email="bob@example.com", verified=True, primary=True)
     return user
 
 
@@ -280,7 +278,7 @@ def test_email_address_list_filter_by_verified_and_primary(api_client, regular_u
     assert response.status_code == http.HTTPStatus.OK
     assert {row["email"] for row in response.json()["results"]} == {"alt@example.com"}
     # primary=true
-    response = api_client.get(reverse("v1:admin-email-address-list"), {"primary": "true"})
+    response = api_client.get(reverse("v1:admin-email-address-list"), {"primary": "true", "user": str(regular_user.id)})
     assert response.status_code == http.HTTPStatus.OK
     assert {row["email"] for row in response.json()["results"]} == {"alice@example.com"}
 

app/admin_api/test/user_merge_test.py

@@ -16,16 +16,12 @@
 
 @pytest.fixture
 def source_user(db) -> UserExt:
-    user = UserExt.objects.create_user(username="source", email="source@example.com")
-    EmailAddress.objects.create(user=user, email="source@example.com", verified=True, primary=True)
-    return user
+    return UserExt.objects.create_user(username="source", email="source@example.com")
 
 
 @pytest.fixture
 def target_user(db) -> UserExt:
-    user = UserExt.objects.create_user(username="target", email="target@example.com")
-    EmailAddress.objects.create(user=user, email="target@example.com", verified=True, primary=True)
-    return user
+    return UserExt.objects.create_user(username="target", email="target@example.com")
 
 
 # ---- Auth -------------------------------------------------------------------

app/user/migrations/0014_alter_userext_managers.py

@@ -0,0 +1,8 @@
+import user.models.user
+from django.db.migrations import AlterModelManagers
+from django.db.migrations import Migration as DjangoMigrations
+
+
+class Migration(DjangoMigrations):
+    dependencies = [("user", "0013_usermergeemailsnapshot")]
+    operations = [AlterModelManagers(name="userext", managers=[("objects", user.models.user.UserExtManager())])]

app/user/models/user.py

@@ -7,10 +7,24 @@
 from core.const.system import SYSTEM_EMAIL, SYSTEM_USERNAME
 from core.fields import EncryptedTextField
 from core.scancode_mixin import ScanCodeMixin
-from django.contrib.auth.models import AbstractUser
+from django.contrib.auth.models import AbstractUser, UserManager
 from django.db import models
 
 
+class UserExtManager(UserManager):
+    def _create_user(self, username, email, password, **extra_fields):
+        user = super()._create_user(username, email, password, **extra_fields)
+        if email:
+            from allauth.account.models import EmailAddress
+
+            EmailAddress.objects.get_or_create(
+                user=user,
+                email=email.lower(),
+                defaults={"verified": True, "primary": True},
+            )
+        return user
+
+
 class UserExt(ScanCodeMixin, AbstractUser):
     scancode_prefix = "user"
     scancode_uuid_field = "unique_id"
@@ -30,6 +44,8 @@ class UserExt(ScanCodeMixin, AbstractUser):
 
     dooray_api_key = EncryptedTextField(key_setting_name="DOORAY_CRED_ENC_KEY", null=True, blank=True, editable=False)
 
+    objects = UserExtManager()
+
     class Meta(AbstractUser.Meta):
         ordering = ["-date_joined"]
         indexes = [models.Index(fields=["unique_id"], name="userext_unique_id_idx")]

app/user/test/email_view_test.py

@@ -9,7 +9,6 @@
 @pytest.fixture
 def user(db) -> UserExt:
     u = UserExt.objects.create_user(username="u", email="u@example.com")
-    EmailAddress.objects.create(user=u, email="u@example.com", verified=True, primary=True)
     return u
 
 
@@ -139,7 +138,7 @@ def test_set_primary_unverified_rejected(client, user):
 
 def test_action_on_other_users_email_rejected(client, user):
     other_user = UserExt.objects.create_user(username="o", email="o@example.com")
-    other_email = EmailAddress.objects.create(user=other_user, email="o@example.com", verified=True)
+    other_email = EmailAddress.objects.get(user=other_user)
     client.force_login(user)
     response = client.post(reverse("account-email-delete"), {"email_id": other_email.pk})
     assert response.status_code == http.HTTPStatus.BAD_REQUEST  # request.user 로 스코프 → 못 찾음

app/user/test/merge_test.py

@@ -5,6 +5,7 @@
 from allauth.account.models import EmailAddress
 from allauth.socialaccount.models import SocialAccount
 from core.util.thread_local import thread_local
+from django.apps import apps
 from django.contrib.contenttypes.models import ContentType
 from shop.order.models import Order
 from user.models import UserExt
@@ -47,6 +48,26 @@ def _merge(source, target, actor=None) -> UserMergeHistory:
     return history
 
 
+def test_no_unhandled_user_m2m_relations(db):
+    """merge 는 M2M 를 이관하지 않는다 — user 를 건드리는 새 M2M 가 추가되면 조용히 누락되므로 여기서 잡는다."""
+    allowed = {(UserExt._meta.label, "groups"), (UserExt._meta.label, "user_permissions")}
+    found = {
+        (model._meta.label, field.name)
+        for model in apps.get_models()
+        for field in model._meta.local_many_to_many
+        if field.related_model is UserExt or model is UserExt
+    }
+    assert found <= allowed, f"merge 가 이관하지 않는 user M2M: {found - allowed}"
+
+
+def test_create_user_creates_verified_email(db):
+    user = UserExt.objects.create_user(username="u", email="U@Example.com")
+
+    ea = EmailAddress.objects.get(user=user)
+    assert ea.email == "u@example.com"
+    assert ea.verified is True and ea.primary is True
+
+
 def test_merge_repoints_owned_business_fk(source_user, target_user):
     order = Order.objects.create(user=source_user, name="src-order")
 
@@ -99,7 +120,6 @@ def test_untracked_model_is_repointed(source_user, target_user):
 
 def test_allauth_accounts_are_moved(source_user, target_user):
     SocialAccount.objects.create(user=source_user, provider="google", uid="src-google", extra_data={})
-    EmailAddress.objects.create(user=source_user, email="source@example.com", verified=True, primary=True)
 
     _merge(source_user, target_user)
 
@@ -130,9 +150,6 @@ def test_audit_fields_are_not_moved(source_user, target_user):
 def test_source_email_moves_and_demotes_when_target_has_primary(source_user, target_user):
     """target 이 이미 primary 를 가지면, source 의 (중복 아닌) 이메일은 source 에 남기지 않고 target 으로
     옮기며 primary 를 강등한다 — 죽은 계정에 주소가 갇히지 않게."""
-    EmailAddress.objects.create(user=source_user, email="source@example.com", verified=True, primary=True)
-    EmailAddress.objects.create(user=target_user, email="target@example.com", verified=True, primary=True)
-
     _merge(source_user, target_user)
 
     assert not EmailAddress.objects.filter(user=source_user).exists()
@@ -143,9 +160,8 @@ def test_source_email_moves_and_demotes_when_target_has_primary(source_user, tar
 
 def test_duplicate_email_consolidates_verification_and_demotes_source(source_user, target_user):
     """양쪽이 같은 주소를 가지면 삭제 없이: target 사본을 verified 로 승격하고 source 사본은 미검증으로 강등해 남긴다."""
-    EmailAddress.objects.create(user=source_user, email="dup@example.com", verified=True, primary=True)
+    EmailAddress.objects.filter(user=source_user).update(email="dup@example.com")  # source 의 유일 이메일을 dup 으로
     EmailAddress.objects.create(user=target_user, email="dup@example.com", verified=False, primary=False)
-    EmailAddress.objects.create(user=target_user, email="target@example.com", verified=True, primary=True)
 
     _merge(source_user, target_user)
 
@@ -156,7 +172,8 @@ def test_duplicate_email_consolidates_verification_and_demotes_source(source_use
 
 def test_target_primary_assigned_when_missing(source_user, target_user):
     """규칙3: 병합 후 target 에 primary 가 없으면 하나(verified 우선)를 지정한다."""
-    EmailAddress.objects.create(user=target_user, email="target@example.com", verified=True, primary=False)
+    EmailAddress.objects.filter(user=source_user).delete()  # source 이메일 없음
+    EmailAddress.objects.filter(user=target_user).update(primary=False)  # target 은 primary 없는 verified 이메일만
 
     _merge(source_user, target_user)
 
@@ -167,10 +184,8 @@ def test_target_primary_assigned_when_missing(source_user, target_user):
 
 def test_unmerge_restores_email_state(source_user, target_user):
     """규칙1(옮김+강등)·규칙2(검증통합) 모두 before-image replay 로 정확히 복원된다."""
-    EmailAddress.objects.create(user=source_user, email="source@example.com", verified=True, primary=True)
     EmailAddress.objects.create(user=source_user, email="dup@example.com", verified=True, primary=False)
     EmailAddress.objects.create(user=target_user, email="dup@example.com", verified=False, primary=False)
-    EmailAddress.objects.create(user=target_user, email="target@example.com", verified=True, primary=True)
 
     merge = _merge(source_user, target_user)
     merge.unmerge()
@@ -282,42 +297,32 @@ def test_double_unmerge_rejected(source_user, target_user):
 # ---- assert_self_mergeable (본인 병합 사전검증) --------------------------------
 
 
-def _verified_email(user, email):
-    return EmailAddress.objects.create(user=user, email=email, verified=True, primary=True)
-
-
 def test_self_mergeable_passes_when_both_verified(source_user, target_user):
-    _verified_email(source_user, "source@example.com")
-    _verified_email(target_user, "target@example.com")
-
-    UserMergeHistory.assert_self_mergeable(source_user, target_user)  # no raise
+    UserMergeHistory.assert_self_mergeable(source_user, target_user)  # 둘 다 fixture 로 verified 이메일 보유 → no raise
 
 
 def test_self_mergeable_allows_email_less_source(source_user, target_user):
-    _verified_email(target_user, "target@example.com")  # source 는 이메일 없음 → 허용
+    EmailAddress.objects.filter(user=source_user).delete()  # source 는 이메일 없음 → 허용
 
     UserMergeHistory.assert_self_mergeable(source_user, target_user)  # no raise
 
 
 def test_self_mergeable_rejects_email_less_target(source_user, target_user):
-    _verified_email(source_user, "source@example.com")
+    EmailAddress.objects.filter(user=target_user).delete()  # target 에 인증 이메일 없음 → 거부
 
     with pytest.raises(ValueError):
         UserMergeHistory.assert_self_mergeable(source_user, target_user)
 
 
 def test_self_mergeable_rejects_unverified_target_email(source_user, target_user):
-    _verified_email(source_user, "source@example.com")
-    _verified_email(target_user, "target@example.com")
     EmailAddress.objects.create(user=target_user, email="extra@example.com", verified=False)
 
     with pytest.raises(ValueError):
         UserMergeHistory.assert_self_mergeable(source_user, target_user)
 
 
 def test_self_mergeable_rejects_unverified_source_email(source_user, target_user):
-    _verified_email(target_user, "target@example.com")
-    EmailAddress.objects.create(user=source_user, email="source@example.com", verified=False)
+    EmailAddress.objects.create(user=source_user, email="extra@example.com", verified=False)
 
     with pytest.raises(ValueError):
         UserMergeHistory.assert_self_mergeable(source_user, target_user)

app/user/test/merge_view_test.py

@@ -13,16 +13,12 @@
 
 @pytest.fixture
 def source_user(db) -> UserExt:
-    user = UserExt.objects.create_user(username="source", email="source@example.com")
-    EmailAddress.objects.create(user=user, email="source@example.com", verified=True, primary=True)
-    return user
+    return UserExt.objects.create_user(username="source", email="source@example.com")
 
 
 @pytest.fixture
 def target_user(db) -> UserExt:
-    user = UserExt.objects.create_user(username="target", email="target@example.com")
-    EmailAddress.objects.create(user=user, email="target@example.com", verified=True, primary=True)
-    return user
+    return UserExt.objects.create_user(username="target", email="target@example.com")
 
 
 def _stash_source(client, source):
@@ -111,6 +107,24 @@ def test_start_lists_provider_forms(client, target_user):
     assert b'name="process" value="connect"' in response.content
 
 
+def test_merged_account_session_is_logged_out(client, source_user, target_user):
+    UserMergeHistory.objects.create(source=source_user, target=target_user).merge()
+    client.force_login(source_user)  # 병합된(dead) 계정으로 남은 세션
+
+    response = client.get(reverse("account-home"))
+
+    assert response.status_code == 302
+    assert "merged=1" in response["Location"]
+    assert "_auth_user_id" not in client.session
+
+
+def test_login_shows_merged_notice(client, db):
+    response = client.get(reverse("account-login") + "?merged=1")
+
+    assert response.status_code == 200
+    assert "병합".encode() in response.content
+
+
 # ---- AccountLoginView ---------------------------------------------------------
 
 
@@ -152,9 +166,7 @@ def test_home_links_to_merge(client, target_user):
 
 @pytest.fixture
 def password_user(db) -> UserExt:
-    user = UserExt.objects.create_user(username="pw", email="pw@example.com", password="s3cret-pw-123")  # nosec B106
-    EmailAddress.objects.create(user=user, email="pw@example.com", verified=True, primary=True)
-    return user
+    return UserExt.objects.create_user(username="pw", email="pw@example.com", password="s3cret-pw-123")  # nosec B106
 
 
 def test_password_login_page_renders_form(client, db):

app/user/test/password_view_test.py

@@ -3,7 +3,6 @@
 
 import pytest
 from allauth.account.forms import default_token_generator
-from allauth.account.models import EmailAddress
 from allauth.account.utils import user_pk_to_url_str
 from django.urls import reverse
 from user.models import UserExt
@@ -15,9 +14,7 @@
 
 @pytest.fixture
 def user(db) -> UserExt:
-    u = UserExt.objects.create_user(username="u", email="u@example.com", password=PASSWORD)
-    EmailAddress.objects.create(user=u, email="u@example.com", verified=True, primary=True)
-    return u
+    return UserExt.objects.create_user(username="u", email="u@example.com", password=PASSWORD)
 
 
 @pytest.fixture
@@ -26,7 +23,6 @@ def social_user(db) -> UserExt:
     u = UserExt.objects.create_user(username="s", email="s@example.com")
     u.set_unusable_password()
     u.save()
-    EmailAddress.objects.create(user=u, email="s@example.com", verified=True, primary=True)
     return u