make sure mailbox email is valid

app/api/views/mailbox.py

@@ -10,6 +10,7 @@ from app.dashboard.views.mailbox_detail import verify_mailbox_change
 from app.email_utils import (
     mailbox_already_used,
     email_can_be_used_as_mailbox,
+    is_valid_email,
 )
 from app.extensions import db
 from app.models import Mailbox
@@ -39,7 +40,9 @@ def create_mailbox():
     user = g.user
     mailbox_email = request.get_json().get("email").lower().strip().replace(" ", "")
 
-    if mailbox_already_used(mailbox_email, user):
+    if not is_valid_email(mailbox_email):
+        return jsonify(error=f"{mailbox_email} invalid"), 400
+    elif mailbox_already_used(mailbox_email, user):
         return jsonify(error=f"{mailbox_email} already used"), 400
     elif not email_can_be_used_as_mailbox(mailbox_email):
         return (

app/dashboard/views/mailbox.py

@@ -12,6 +12,7 @@ from app.email_utils import (
     mailbox_already_used,
     render,
     send_email,
+    is_valid_email,
 )
 from app.extensions import db
 from app.log import LOG
@@ -86,7 +87,9 @@ def mailbox_route():
                     new_mailbox_form.email.data.lower().strip().replace(" ", "")
                 )
 
-                if mailbox_already_used(mailbox_email, current_user):
+                if not is_valid_email(mailbox_email):
+                    flash(f"{mailbox_email} invalid", "error")
+                elif mailbox_already_used(mailbox_email, current_user):
                     flash(f"{mailbox_email} already used", "error")
                 elif not email_can_be_used_as_mailbox(mailbox_email):
                     flash(f"You cannot use {mailbox_email}.", "error")

tests/api/test_mailbox.py

@@ -15,13 +15,21 @@ def test_create_mailbox(flask_client):
 
     assert r.status_code == 201
 
-    # {'creation_timestamp': 1604398668, 'default': False, 'email': 'mailbox@gmail.com', 'id': 2, 'nb_alias': 0, 'verified': False}
     assert r.json["email"] == "mailbox@gmail.com"
     assert r.json["verified"] is False
     assert r.json["id"] > 0
     assert r.json["default"] is False
     assert r.json["nb_alias"] == 0
 
+    # invalid email address
+    r = flask_client.post(
+        "/api/mailboxes",
+        json={"email": "gmail.com"},
+    )
+
+    assert r.status_code == 400
+    assert r.json == {"error": "gmail.com invalid"}
+
 
 def test_delete_mailbox(flask_client):
     user = login(flask_client)