Use realm from current membership for emails

pkg/controller/email.go

@@ -24,13 +24,8 @@ import (
 )
 
 // SendInviteEmailFunc returns a function capable of sending a new user invitation.
-func SendInviteEmailFunc(ctx context.Context, db *database.Database, h render.Renderer, email string) (auth.InviteUserEmailFunc, error) {
-	// Lookup the realm to get the email provider
-	realm := RealmFromContext(ctx)
-	if realm == nil {
-		return nil, nil
-	}
-
+func SendInviteEmailFunc(ctx context.Context, db *database.Database, h render.Renderer, email string,
+	realm *database.Realm) (auth.InviteUserEmailFunc, error) {
 	// Lookup the email provider
 	emailer, err := realm.EmailProvider(db)
 	if err != nil {
@@ -77,13 +72,8 @@ func SendInviteEmailFunc(ctx context.Context, db *database.Database, h render.Re
 
 // SendPasswordResetEmailFunc returns a function capable of sending a password
 // reset for the given user.
-func SendPasswordResetEmailFunc(ctx context.Context, db *database.Database, h render.Renderer, email string) (auth.ResetPasswordEmailFunc, error) {
-	// Lookup the realm to get the email provider
-	realm := RealmFromContext(ctx)
-	if realm == nil {
-		return nil, nil
-	}
-
+func SendPasswordResetEmailFunc(ctx context.Context, db *database.Database, h render.Renderer, email string,
+	realm *database.Realm) (auth.ResetPasswordEmailFunc, error) {
 	// Lookup the email provider
 	emailer, err := realm.EmailProvider(db)
 	if err != nil {
@@ -129,13 +119,8 @@ func SendPasswordResetEmailFunc(ctx context.Context, db *database.Database, h re
 
 // SendEmailVerificationEmailFunc returns a function capable of sending an email
 // verification email.
-func SendEmailVerificationEmailFunc(ctx context.Context, db *database.Database, h render.Renderer, email string) (auth.EmailVerificationEmailFunc, error) {
-	// Lookup the realm to get the email provider
-	realm := RealmFromContext(ctx)
-	if realm == nil {
-		return nil, nil
-	}
-
+func SendEmailVerificationEmailFunc(ctx context.Context, db *database.Database, h render.Renderer, email string,
+	realm *database.Realm) (auth.EmailVerificationEmailFunc, error) {
 	// Lookup the email provider
 	emailer, err := realm.EmailProvider(db)
 	if err != nil {

pkg/controller/login/reset_password.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/google/exposure-notifications-verification-server/pkg/controller"
 	"github.com/google/exposure-notifications-verification-server/pkg/database"
+	"github.com/google/exposure-notifications-verification-server/pkg/rbac"
 )
 
 func (c *Controller) HandleShowResetPassword() http.Handler {
@@ -59,6 +60,11 @@ func (c *Controller) HandleSubmitResetPassword() http.Handler {
 			return
 		}
 
+		membership := controller.MembershipFromContext(ctx)
+		if !membership.Can(rbac.UserWrite) {
+			controller.Unauthorized(w, r, c.h)
+			return
+		}
 		// Does the user exist?
 		user, err := c.db.FindUserByEmail(form.Email)
 		if err != nil {
@@ -75,7 +81,7 @@ func (c *Controller) HandleSubmitResetPassword() http.Handler {
 		}
 
 		// Build the emailer.
-		resetComposer, err := controller.SendPasswordResetEmailFunc(ctx, c.db, c.h, user.Email)
+		resetComposer, err := controller.SendPasswordResetEmailFunc(ctx, c.db, c.h, user.Email, membership.Realm)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return

pkg/controller/login/verify_email_send.go

@@ -54,11 +54,8 @@ func (c *Controller) HandleSubmitVerifyEmail() http.Handler {
 		}
 		flash := controller.Flash(session)
 
-		currentUser := controller.UserFromContext(ctx)
-		if currentUser == nil {
-			controller.MissingUser(w, r, c.h)
-			return
-		}
+		membership := controller.MembershipFromContext(ctx)
+		currentUser := membership.User
 
 		var form FormData
 		if err := controller.BindForm(w, r, &form); err != nil {
@@ -68,7 +65,7 @@ func (c *Controller) HandleSubmitVerifyEmail() http.Handler {
 		}
 
 		// Build the email template.
-		verifyComposer, err := controller.SendEmailVerificationEmailFunc(ctx, c.db, c.h, currentUser.Email)
+		verifyComposer, err := controller.SendEmailVerificationEmailFunc(ctx, c.db, c.h, currentUser.Email, membership.Realm)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return

pkg/controller/user/create.go

@@ -99,7 +99,7 @@ func (c *Controller) HandleCreate() http.Handler {
 			return
 		}
 
-		inviteComposer, err := controller.SendInviteEmailFunc(ctx, c.db, c.h, user.Email)
+		inviteComposer, err := controller.SendInviteEmailFunc(ctx, c.db, c.h, user.Email, currentRealm)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return

pkg/controller/user/importbatch.go

@@ -121,7 +121,7 @@ func (c *Controller) importUsers(ctx context.Context,
 		}
 
 		// Create the invitation email composer.
-		inviteComposer, err := controller.SendInviteEmailFunc(ctx, c.db, c.h, user.Email)
+		inviteComposer, err := controller.SendInviteEmailFunc(ctx, c.db, c.h, user.Email, realm)
 		if err != nil {
 			batchErr = multierror.Append(batchErr, err)
 			continue

pkg/controller/user/reset_password.go

@@ -60,7 +60,7 @@ func (c *Controller) HandleResetPassword() http.Handler {
 		}
 
 		// Build the emailer.
-		resetComposer, err := controller.SendPasswordResetEmailFunc(ctx, c.db, c.h, user.Email)
+		resetComposer, err := controller.SendPasswordResetEmailFunc(ctx, c.db, c.h, user.Email, currentRealm)
 		if err != nil {
 			controller.InternalError(w, r, c.h, err)
 			return