feat: logout other sessions on email change (#33846)

* feat: logout other sessions on email change

* fix: updated the approach for session invalidation

* fix: update and add tests

* fix: update tests with descriptive comments

* feat: add integration tests

* fix: store email in session update

* fix: add setting for tests

* fix: fix tests

* feat: Upgrade Python dependency edx-drf-extensions (#34135)

Commit generated by workflow `openedx/edx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`

Co-authored-by: syedsajjadkazmii <syedsajjadkazmii@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: syedsajjadkazmii <syedsajjadkazmii@users.noreply.github.com>

common/djangoapps/student/signals/receivers.py

@@ -23,6 +23,7 @@ from common.djangoapps.student.models import (
 )
 from common.djangoapps.student.models_api import confirm_name_change
 from common.djangoapps.student.signals import USER_EMAIL_CHANGED
+from openedx.core.djangoapps.safe_sessions.middleware import EmailChangeMiddleware
 from openedx.features.name_affirmation_api.utils import is_name_affirmation_installed
 
 logger = logging.getLogger(__name__)
@@ -105,8 +106,12 @@ if is_name_affirmation_installed():
 
 
 @receiver(USER_EMAIL_CHANGED)
-def _listen_for_user_email_changed(sender, user, **kwargs):
-    """ If user has changed their email, update that in email Braze. """
+def _listen_for_user_email_changed(sender, user, request, **kwargs):
+    """ If user has changed their email, update that in session and Braze profile. """
+
+    # Store the user's email for session consistency (used by EmailChangeMiddleware)
+    EmailChangeMiddleware.register_email_change(request, user.email)
+
     email = user.email
     user_id = user.id
     attributes = [{'email': email, 'external_id': user_id}]

common/djangoapps/student/tests/test_receivers.py

@@ -9,7 +9,7 @@ from common.djangoapps.student.models import CourseEnrollmentCelebration, Pendin
 from common.djangoapps.student.signals.signals import USER_EMAIL_CHANGED
 from common.djangoapps.student.tests.factories import CourseEnrollmentFactory, UserFactory, UserProfileFactory
 from lms.djangoapps.courseware.toggles import COURSEWARE_MICROFRONTEND_PROGRESS_MILESTONES
-from openedx.core.djangolib.testing.utils import skip_unless_lms
+from openedx.core.djangolib.testing.utils import skip_unless_lms, get_mock_request
 from openedx.features.name_affirmation_api.utils import is_name_affirmation_installed
 from xmodule.modulestore.tests.django_utils import SharedModuleStoreTestCase  # lint-amnesty, pylint: disable=wrong-import-order
 
@@ -75,10 +75,18 @@ class ReceiversTest(SharedModuleStoreTestCase):
     @patch('common.djangoapps.student.signals.receivers.get_braze_client')
     def test_listen_for_user_email_changed(self, mock_get_braze_client):
         """
-        Ensure that USER_EMAIL_CHANGED signal triggers correct calls to get_braze_client.
+        Ensure that USER_EMAIL_CHANGED signal triggers correct calls to
+        get_braze_client and update email in session.
         """
         user = UserFactory(email='email@test.com', username='jdoe')
+        request = get_mock_request(user=user)
+        request.session = self.client.session
 
-        USER_EMAIL_CHANGED.send(sender=None, user=user)
+        # simulating email change
+        user.email = 'new_email@test.com'
+        user.save()
+
+        USER_EMAIL_CHANGED.send(sender=None, user=user, request=request)
 
         assert mock_get_braze_client.called
+        assert request.session.get('email', None) == user.email

common/djangoapps/student/views/management.py

@@ -910,7 +910,7 @@ def confirm_email_change(request, key):
 
         response = render_to_response("email_change_successful.html", address_context)
 
-        USER_EMAIL_CHANGED.send(sender=None, user=user)
+        USER_EMAIL_CHANGED.send(sender=None, user=user, request=request)
         return response