--- a/src/ltpdarepo/tests/manage-users.txt	Sun Aug 21 18:17:27 2011 +0200
+++ b/src/ltpdarepo/tests/manage-users.txt	Sun Aug 21 18:17:27 2011 +0200
@@ -34,7 +34,7 @@
     >>> browser.url
     'http://localhost/manage/users/'
     >>> browser.contents
-    '...<div class="flash message">User "user1" created.</div>...'
+    '...<div class="flash message">User created. Activation token: <a href="...">...</a></div>...'
 
 View user::
 

--- a/src/ltpdarepo/tests/test_users.py	Sun Aug 21 18:17:27 2011 +0200
+++ b/src/ltpdarepo/tests/test_users.py	Sun Aug 21 18:17:27 2011 +0200
@@ -1,34 +1,25 @@
 import unittest
 import MySQLdb as mysql
 
+from flask import g
+
 from ltpdarepo.tests.utils import RequestContextTestCase
-from ltpdarepo.user import User, _generate_password
+from ltpdarepo.user import User, INVALIDPASSWORD
 
 
 class TestCase(unittest.TestCase):
 
-    def test_generate_password(self):
-        p1 = _generate_password()
-        self.assertEqual(len(p1), 8)
-        p2 = _generate_password()
-        self.assertEqual(len(p2), 8)
-        self.assertNotEqual(p1, p2)
-
     def test_users(self):
         u = User()
         self.assertEqual(u.username, '')
-        self.assertEqual(u.password, '')
         self.assertEqual(u.name, '')
         self.assertEqual(u['username'], '')
-        self.assertEqual(u['password'], '')
         self.assertEqual(u['name'], '')
 
         u = User(username='foo', name='Foo')
         self.assertEqual(u.username, 'foo')
-        self.assertEqual(u.password, '')
         self.assertEqual(u.name, 'Foo')
         self.assertEqual(u['username'], 'foo')
-        self.assertEqual(u['password'], '')
         self.assertEqual(u['name'], 'Foo')
 
 
@@ -47,32 +38,36 @@
         wipe()
 
     def test_user_load(self):
-        u1 = User().load('u1')
+        u1 = User.load('u1')
         self.assertEqual(u1.username, 'u1')
 
     def test_user_create(self):
-        u2 = User(username='u2', password='u2')
+        u2 = User(username='u2')
         u2.create()
-        u3 = User().load('u2')
+        u3 = User.load('u2')
         self.assertEqual(u2.username, u3.username)
 
-    def test_user_create_password(self):
+    def test_new_user_has_invalid_password(self):
         u2 = User(username='u2')
         u2.create()
-        self.assertEqual(len(u2.password), 8)
+        curs = g.db.cursor()
+        curs.execute("""SELECT Password FROM mysql.user WHERE User=%s""", u2.username)
+        self.assertEqual(curs.fetchone()[0], INVALIDPASSWORD)
+
+    def test_new_user_cannot_login(self):
+        u2 = User(username='u2')
+        u2.create()
+        # test that the user cannot connect to the database
+        self.assertRaises(mysql.OperationalError,
+                          lambda: mysql.connect(
+                              host=self.app.config['HOSTNAME'],
+                              user=u2.username, charset='utf8'))
 
     def test_user_login(self):
-        u2 = User(username='u2', password='u2')
-        u2.create()
-        # test that the user can connect to the database
-        conn = mysql.connect(host=self.app.config['HOSTNAME'],
-                             user=u2.username, passwd=u2.password,
-                             charset='utf8')
-
-    def test_user_login_generated_password(self):
         u2 = User(username='u2')
         u2.create()
+        u2.passwd('u2')
         # test that the user can connect to the database
-        conn = mysql.connect(host=self.app.config['HOSTNAME'],
-                             user=u2.username, passwd=u2.password,
-                             charset='utf8')
+        mysql.connect(host=self.app.config['HOSTNAME'],
+                      user=u2.username, passwd='u2',
+                      charset='utf8')