From c459f4eb78bc54bcd94ea9d4a60e3f8a89b75181 Mon Sep 17 00:00:00 2001
From: Sajeyks <sajeyksmwangi@gmail.com>
Date: Fri, 6 Nov 2026 15:52:21 +0300
Subject: [PATCH] Don't report a failed signup when only the OTP seed failed

Activation created the LDAP account and then requested an OTP seed in
the same try block. If the OTP server was unreachable, the user got an
error page although their account existed, and their next attempt
failed with "username taken". OTP errors are now logged, as non-201
responses already were, and activation still succeeds.
---
 dal/tests/test_flows.py | 11 +++++++++++
 dal/views.py            | 15 +++++++++------
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/dal/tests/test_flows.py b/dal/tests/test_flows.py
index 601c396..be4da9e 100644
--- a/dal/tests/test_flows.py
+++ b/dal/tests/test_flows.py
@@ -135,6 +135,17 @@ class RegisterTests(LdapTestCase):
         # Activation link is single use
         self.assertEqual(self.client.get(link).status_code, 404)
 
+    def test_otp_server_down_does_not_fail_activation(self):
+        import requests
+        self.otp_post.side_effect = requests.ConnectionError("otp down")
+        data = self.form()
+        self.track(data["username"])
+        self.client.post(REGISTER, data)
+        with self.assertLogs("dal.views", "ERROR"):
+            resp = self.client.get(self.last_mail_link())
+        self.assertTemplateUsed(resp, "usercreated.html")
+        self.assertTrue(self.can_bind(data["username"], "reg-pass-12345"))
+
     def test_tampered_activation_token_is_rejected(self):
         data = self.form()
         self.track(data["username"])
diff --git a/dal/views.py b/dal/views.py
index 089bd55..9f3a20a 100644
--- a/dal/views.py
+++ b/dal/views.py
@@ -539,6 +539,13 @@ class ActivateAccount(View):
                 pending.username, pending.password_hash,
                 pending.firstname, pending.lastname, pending.email
             )
+        except Exception as e:
+            return render(request, 'error.html', {'urlname': 'register',
+                                                  'service': 'register an user',
+                                                  'error': e})
+        # The account exists from here on. An OTP seed failure is logged but
+        # must not tell the user that registration failed.
+        try:
             req = requests.post(settings.OTP_SERVER, data=json.dumps(
                 {
                     'auth_token': TOTP(settings.OTP_ADMIN_SEED).now(),
@@ -550,12 +557,8 @@ class ActivateAccount(View):
                 timeout=settings.OTP_TIMEOUT)
             if req.status_code != 201:
                 logger.error("User {} failed to create its otp seed".format(pending.username))
-
-            #Send welcome email
-        except Exception as e:
-            return render(request, 'error.html', {'urlname': 'register',
-                                                  'service': 'register an user',
-                                                  'error': e})
+        except requests.RequestException as e:
+            logger.error("User {} failed to create its otp seed: {}".format(pending.username, e))
         return render(request, 'usercreated.html', { 'user': pending.username } )