List pending users

apps/member/forms.py

@@ -26,7 +26,7 @@ class ProfileForm(forms.ModelForm):
     class Meta:
         model = Profile
         fields = '__all__'
-        exclude = ('user', 'email_confirmed', )
+        exclude = ('user', 'email_confirmed', 'registration_valid', )
 
 
 class ClubForm(forms.ModelForm):

apps/member/models.py

@@ -12,7 +12,7 @@ from django.urls import reverse, reverse_lazy
 from django.utils.encoding import force_bytes
 from django.utils.http import urlsafe_base64_encode
 from django.utils.translation import gettext_lazy as _
-from member.tokens import account_activation_token
+from registration.tokens import account_activation_token
 from note.models import MembershipTransaction
 
 
@@ -53,6 +53,11 @@ class Profile(models.Model):
         default=False,
     )
 
+    registration_valid = models.BooleanField(
+        verbose_name=_("registration valid"),
+        default=False,
+    )
+
     email_confirmed = models.BooleanField(
         verbose_name=_("email confirmed"),
         default=False,

apps/member/tokens.py

@@ -1,30 +0,0 @@
-# Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
-# SPDX-License-Identifier: GPL-3.0-or-later
-# Copied from https://gitlab.crans.org/bombar/codeflix/-/blob/master/codeflix/codeflix/tokens.py
-
-from django.contrib.auth.tokens import PasswordResetTokenGenerator
-
-
-class AccountActivationTokenGenerator(PasswordResetTokenGenerator):
-    """
-    Create a unique token generator to confirm email addresses.
-    """
-    def _make_hash_value(self, user, timestamp):
-        """
-        Hash the user's primary key and some user state that's sure to change
-        after an account validation to produce a token that invalidated when
-        it's used:
-        1. The user.profile.email_confirmed field will change upon an account
-        validation.
-        2. The last_login field will usually be updated very shortly after
-           an account validation.
-        Failing those things, settings.PASSWORD_RESET_TIMEOUT_DAYS eventually
-        invalidates the token.
-        """
-        # Truncate microseconds so that tokens are consistent even if the
-        # database doesn't support microseconds.
-        login_timestamp = '' if user.last_login is None else user.last_login.replace(microsecond=0, tzinfo=None)
-        return str(user.pk) + str(user.profile.email_confirmed) + str(login_timestamp) + str(timestamp)
-
-
-account_activation_token = AccountActivationTokenGenerator()

apps/member/views.py

@@ -139,7 +139,7 @@ class UserListView(ProtectQuerysetMixin, LoginRequiredMixin, SingleTableView):
     template_name = 'member/user_list.html'
 
     def get_queryset(self, **kwargs):
-        qs = super().get_queryset()
+        qs = super().get_queryset().filter(profile__registration_valid=True)
         if "search" in self.request.GET:
             pattern = self.request.GET["search"]