use MAILBOX_SECRET instead of FLASK_SECRET

app/config.py

@@ -108,6 +108,7 @@ DB_URI = os.environ["DB_URI"]
 
 # Flask secret
 FLASK_SECRET = os.environ["FLASK_SECRET"]
+MAILBOX_SECRET = FLASK_SECRET + "mailbox"
 
 # AWS
 AWS_REGION = "eu-west-3"

app/dashboard/views/mailbox.py

@@ -5,7 +5,7 @@ from itsdangerous import Signer, BadSignature
 from wtforms import validators
 from wtforms.fields.html5 import EmailField
 
-from app.config import EMAIL_DOMAIN, ALIAS_DOMAINS, FLASK_SECRET, URL
+from app.config import EMAIL_DOMAIN, ALIAS_DOMAINS, MAILBOX_SECRET, URL
 from app.dashboard.base import dashboard_bp
 from app.email_utils import (
     send_email,
@@ -92,7 +92,7 @@ def mailbox_route():
                     )
                     db.session.commit()
 
-                    s = Signer(FLASK_SECRET)
+                    s = Signer(MAILBOX_SECRET)
                     mailbox_id_signed = s.sign(str(new_mailbox.id)).decode()
                     verification_url = (
                         URL
@@ -134,7 +134,7 @@ def mailbox_route():
 
 @dashboard_bp.route("/mailbox_verify")
 def mailbox_verify():
-    s = Signer(FLASK_SECRET)
+    s = Signer(MAILBOX_SECRET)
     mailbox_id = request.args.get("mailbox_id")
 
     try:

app/dashboard/views/mailbox_detail.py

@@ -5,7 +5,7 @@ from itsdangerous import Signer, BadSignature
 from wtforms import validators
 from wtforms.fields.html5 import EmailField
 
-from app.config import FLASK_SECRET
+from app.config import MAILBOX_SECRET
 from app.config import URL
 from app.dashboard.base import dashboard_bp
 from app.email_utils import can_be_used_as_personal_email, email_already_used
@@ -61,7 +61,7 @@ def mailbox_detail_route(mailbox_id):
                 mailbox.new_email = new_email
                 db.session.commit()
 
-                s = Signer(FLASK_SECRET)
+                s = Signer(MAILBOX_SECRET)
                 mailbox_id_signed = s.sign(str(mailbox.id)).decode()
                 verification_url = (
                     URL
@@ -125,7 +125,7 @@ def cancel_mailbox_change_route(mailbox_id):
 
 @dashboard_bp.route("/mailbox/confirm_change")
 def mailbox_confirm_change_route():
-    s = Signer(FLASK_SECRET)
+    s = Signer(MAILBOX_SECRET)
     mailbox_id = request.args.get("mailbox_id")
 
     try:

server.py

@@ -156,14 +156,11 @@ def fake_data():
     api_key.code = "codeFF"
 
     m1 = Mailbox.create(user_id=user.id, email="m1@cd.ef", verified=True)
-    m2 = Mailbox.create(user_id=user.id, email="m2@zt.com", verified=False)
-    m3 = Mailbox.create(user_id=user.id, email="m3@cd.ef", verified=True)
     db.session.commit()
 
     user.default_mailbox_id = m1.id
 
     GenEmail.create_new(user.id, "e1@", mailbox_id=m1.id)
-    GenEmail.create_new(user.id, "e2@", mailbox_id=m3.id)
 
     CustomDomain.create(user_id=user.id, domain="ab.cd", verified=True)
     CustomDomain.create(