Withdrawal Confirmed
Hello {{ participant.name }},
This email confirms that you have withdrawn from the Secret Santa exchange
{{ exchange.name }}.
What happens now:
- You have been removed from the participant list
- Your profile information has been archived
- You will not receive further emails about this exchange
If you withdrew by mistake, you can re-register using a different email address
while registration is still open.
If you have any questions, please contact the exchange organizer.
This is an automated message from Sneaky Klaus.
```
**Plain Text Version**: `templates/emails/participant/withdrawal_confirmation.txt`
```
Withdrawal Confirmed
Hello {{ participant.name }},
This email confirms that you have withdrawn from the Secret Santa exchange "{{ exchange.name }}".
What happens now:
- You have been removed from the participant list
- Your profile information has been archived
- You will not receive further emails about this exchange
If you withdrew by mistake, you can re-register using a different email address while registration is still open.
If you have any questions, please contact the exchange organizer.
---
This is an automated message from Sneaky Klaus.
```
### 5.2 Email Service Update
**Location**: `src/services/email.py` (add method)
```python
def send_withdrawal_confirmation(self, participant: Participant) -> None:
"""Send withdrawal confirmation email to participant.
Args:
participant: The participant who withdrew
Raises:
EmailError: If email send fails
"""
exchange = participant.exchange
# Render email templates
html_body = render_template(
'emails/participant/withdrawal_confirmation.html',
participant=participant,
exchange=exchange
)
text_body = render_template(
'emails/participant/withdrawal_confirmation.txt',
participant=participant,
exchange=exchange
)
# Send email
try:
resend.Emails.send({
"from": self.from_email,
"to": [participant.email],
"subject": f"Withdrawal Confirmed - {exchange.name}",
"html": html_body,
"text": text_body,
})
logger.info(f"Withdrawal confirmation sent to {participant.email}")
except Exception as e:
logger.error(f"Failed to send withdrawal email: {e}")
raise EmailError(f"Failed to send withdrawal confirmation: {e}")
```
## 6. Testing Specifications
### 6.1 Unit Tests
**Location**: `tests/unit/test_participant_utils.py` (new file)
```python
"""Unit tests for participant utility functions."""
import pytest
from datetime import datetime
from src.utils.participant import can_update_profile, can_withdraw, is_withdrawn
def test_can_update_profile_allowed_states(participant_factory, exchange_factory):
"""Test profile updates allowed in pre-matching states."""
for state in ['draft', 'registration_open', 'registration_closed']:
exchange = exchange_factory(state=state)
participant = participant_factory(exchange=exchange)
assert can_update_profile(participant) is True
def test_can_update_profile_disallowed_states(participant_factory, exchange_factory):
"""Test profile updates blocked after matching."""
for state in ['matched', 'completed']:
exchange = exchange_factory(state=state)
participant = participant_factory(exchange=exchange)
assert can_update_profile(participant) is False
def test_can_withdraw_allowed_states(participant_factory, exchange_factory):
"""Test withdrawal allowed before registration closes."""
for state in ['draft', 'registration_open']:
exchange = exchange_factory(state=state)
participant = participant_factory(exchange=exchange)
assert can_withdraw(participant) is True
def test_can_withdraw_disallowed_states(participant_factory, exchange_factory):
"""Test withdrawal blocked after registration closes."""
for state in ['registration_closed', 'matched', 'completed']:
exchange = exchange_factory(state=state)
participant = participant_factory(exchange=exchange)
assert can_withdraw(participant) is False
def test_can_withdraw_already_withdrawn(participant_factory):
"""Test withdrawal blocked if already withdrawn."""
participant = participant_factory(withdrawn_at=datetime.utcnow())
assert can_withdraw(participant) is False
```
### 6.2 Integration Tests
**Location**: `tests/integration/test_participant_self_management.py` (new file)
```python
"""Integration tests for participant self-management features."""
import pytest
from flask import url_for
class TestProfileUpdate:
"""Tests for profile update functionality."""
def test_profile_update_success(self, client, participant_session, db):
"""Test successful profile update."""
response = client.post(
url_for('participant.profile_edit'),
data={
'name': 'Updated Name',
'gift_ideas': 'Updated gift ideas',
'csrf_token': get_csrf_token(client)
},
follow_redirects=True
)
assert response.status_code == 200
assert b'profile has been updated' in response.data
# Verify database updated
participant = Participant.query.get(participant_session['user_id'])
assert participant.name == 'Updated Name'
assert participant.gift_ideas == 'Updated gift ideas'
def test_profile_update_locked_after_matching(
self, client, participant_session, db, exchange_factory
):
"""Test profile update blocked after matching."""
# Set exchange to matched state
participant = Participant.query.get(participant_session['user_id'])
participant.exchange.state = 'matched'
db.session.commit()
response = client.get(url_for('participant.profile_edit'))
assert response.status_code == 302 # Redirect
# Follow redirect
response = client.get(url_for('participant.profile_edit'), follow_redirects=True)
assert b'profile is locked' in response.data
class TestWithdrawal:
"""Tests for withdrawal functionality."""
def test_withdrawal_success(self, client, participant_session, db, mock_email):
"""Test successful withdrawal."""
participant_id = participant_session['user_id']
response = client.post(
url_for('participant.withdraw'),
data={
'confirm': True,
'csrf_token': get_csrf_token(client)
},
follow_redirects=True
)
assert response.status_code == 200
assert b'withdrawn from the exchange' in response.data
# Verify database updated
participant = Participant.query.get(participant_id)
assert participant.withdrawn_at is not None
# Verify session cleared
with client.session_transaction() as session:
assert 'user_id' not in session
# Verify email sent
mock_email.send_withdrawal_confirmation.assert_called_once()
def test_withdrawal_blocked_after_close(
self, client, participant_session, db
):
"""Test withdrawal blocked after registration closes."""
participant = Participant.query.get(participant_session['user_id'])
participant.exchange.state = 'registration_closed'
db.session.commit()
response = client.get(url_for('participant.withdraw'), follow_redirects=True)
assert b'Registration has closed' in response.data
```
## 7. Security Checklist
- ✅ All routes require `@participant_required` authentication
- ✅ CSRF protection on all POST operations (WTForms)
- ✅ State validation before allowing operations
- ✅ Input sanitization (WTForms validators + Jinja2 auto-escaping)
- ✅ Session cleared on withdrawal (no orphaned sessions)
- ✅ Withdrawn participants excluded from participant list (privacy)
- ✅ No email enumeration (withdrawn status not revealed to other participants)
- ✅ Database rollback on errors (transaction safety)
## 8. Performance Checklist
- ✅ Participant list loaded with single query (no N+1)
- ✅ State checks use in-memory objects (no extra DB hits)
- ✅ Email sent asynchronously (doesn't block response)
- ✅ Form pre-population uses ORM objects (efficient)
- ✅ No caching needed (small datasets, infrequent updates)
## 9. Accessibility Checklist
- ✅ Form labels properly associated with inputs
- ✅ Error messages linked to fields (ARIA)
- ✅ Warning boxes use semantic HTML
- ✅ Buttons have descriptive text (no icon-only)
- ✅ Character counter is non-critical (progressive enhancement)
- ✅ All actions keyboard-accessible
---
**End of Component Design**