Move some auth functions to their own controllers.

Move the social auth functions to Auth::Social, and the
change email/password functions to Auth::Profile. There
are no actual code changes.

11 files changed, 435 insertions, 379 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Auth.pm b/perllib/FixMyStreet/App/Controller/Auth.pm
index 825066026..3e90fb7ca 100644
--- a/perllib/FixMyStreet/App/Controller/Auth.pm
+++ b/perllib/FixMyStreet/App/Controller/Auth.pm
@@ -5,12 +5,9 @@ use namespace::autoclean;
 BEGIN { extends 'Catalyst::Controller'; }
 
 use Email::Valid;
-use Net::Domain::TLD;
 use Digest::HMAC_SHA1 qw(hmac_sha1);
 use JSON::MaybeXS;
 use MIME::Base64;
-use Net::Facebook::Oauth2;
-use Net::Twitter::Lite::WithAPIv1_1;
 
 =head1 NAME
 
@@ -46,8 +43,8 @@ sub general : Path : Args(0) {
     # decide which action to take
     $c->detach('email_sign_in') if $clicked_email || ($data_email && !$data_password);
     if (!$data_address && !$data_password && !$data_email) {
-        $c->detach('facebook_sign_in') if $c->get_param('facebook_sign_in');
-        $c->detach('twitter_sign_in') if $c->get_param('twitter_sign_in');
+        $c->detach('social/facebook_sign_in') if $c->get_param('facebook_sign_in');
+        $c->detach('social/twitter_sign_in') if $c->get_param('twitter_sign_in');
     }
 
        $c->forward( 'sign_in' )
@@ -242,187 +239,6 @@ sub token : Path('/M') : Args(1) {
     $c->detach( 'redirect_on_signin', [ $data->{r}, $data->{p} ] );
 }
 
-=head2 facebook_sign_in
-
-Starts the Facebook authentication sequence.
-
-=cut
-
-sub fb : Private {
-    my ($self, $c) = @_;
-    Net::Facebook::Oauth2->new(
-        application_id => $c->config->{FACEBOOK_APP_ID},
-        application_secret => $c->config->{FACEBOOK_APP_SECRET},
-        callback => $c->uri_for('/auth/Facebook'),
-    );
-}
-
-sub facebook_sign_in : Private {
-    my ( $self, $c ) = @_;
-
-    $c->detach( '/page_error_403_access_denied', [] ) if FixMyStreet->config('SIGNUPS_DISABLED');
-
-    my $fb = $c->forward('/auth/fb');
-    my $url = $fb->get_authorization_url(scope => ['email']);
-
-    my %oauth;
-    $oauth{return_url} = $c->get_param('r');
-    $oauth{detach_to} = $c->stash->{detach_to};
-    $oauth{detach_args} = $c->stash->{detach_args};
-    $c->session->{oauth} = \%oauth;
-    $c->res->redirect($url);
-}
-
-=head2 facebook_callback
-
-Handles the Facebook callback request and completes the authentication sequence.
-
-=cut
-
-sub facebook_callback: Path('/auth/Facebook') : Args(0) {
-    my ( $self, $c ) = @_;
-
-    $c->detach('oauth_failure') if $c->get_param('error_code');
-
-    my $fb = $c->forward('/auth/fb');
-    my $access_token;
-    eval {
-        $access_token = $fb->get_access_token(code => $c->get_param('code'));
-    };
-    if ($@) {
-        (my $message = $@) =~ s/at [^ ]*Auth.pm.*//;
-        $c->detach('/page_error_500_internal_error', [ $message ]);
-    }
-
-    # save this token in session
-    $c->session->{oauth}{token} = $access_token;
-
-    my $info = $fb->get('https://graph.facebook.com/me?fields=name,email')->as_hash();
-    my $email = lc ($info->{email} || "");
-    $c->forward('oauth_success', [ 'facebook', $info->{id}, $info->{name}, $email ]);
-}
-
-=head2 twitter_sign_in
-
-Starts the Twitter authentication sequence.
-
-=cut
-
-sub tw : Private {
-    my ($self, $c) = @_;
-    Net::Twitter::Lite::WithAPIv1_1->new(
-        ssl => 1,
-        consumer_key => $c->config->{TWITTER_KEY},
-        consumer_secret => $c->config->{TWITTER_SECRET},
-    );
-}
-
-sub twitter_sign_in : Private {
-    my ( $self, $c ) = @_;
-
-    $c->detach( '/page_error_403_access_denied', [] ) if FixMyStreet->config('SIGNUPS_DISABLED');
-
-    my $twitter = $c->forward('/auth/tw');
-    my $url = $twitter->get_authentication_url(callback => $c->uri_for('/auth/Twitter'));
-
-    my %oauth;
-    $oauth{return_url} = $c->get_param('r');
-    $oauth{detach_to} = $c->stash->{detach_to};
-    $oauth{detach_args} = $c->stash->{detach_args};
-    $oauth{token} = $twitter->request_token;
-    $oauth{token_secret} = $twitter->request_token_secret;
-    $c->session->{oauth} = \%oauth;
-    $c->res->redirect($url);
-}
-
-=head2 twitter_callback
-
-Handles the Twitter callback request and completes the authentication sequence.
-
-=cut
-
-sub twitter_callback: Path('/auth/Twitter') : Args(0) {
-    my ( $self, $c ) = @_;
-
-    my $request_token = $c->req->param('oauth_token');
-    my $verifier = $c->req->param('oauth_verifier');
-    my $oauth = $c->session->{oauth};
-
-    $c->detach('oauth_failure') if $c->get_param('denied') || $request_token ne $oauth->{token};
-
-    my $twitter = $c->forward('/auth/tw');
-    $twitter->request_token($oauth->{token});
-    $twitter->request_token_secret($oauth->{token_secret});
-
-    eval {
-        # request_access_token no longer returns UID or name
-        $twitter->request_access_token(verifier => $verifier);
-    };
-    if ($@) {
-        (my $message = $@) =~ s/at [^ ]*Auth.pm.*//;
-        $c->detach('/page_error_500_internal_error', [ $message ]);
-    }
-
-    my $info = $twitter->verify_credentials();
-    $c->forward('oauth_success', [ 'twitter', $info->{id}, $info->{name} ]);
-}
-
-sub oauth_failure : Private {
-    my ( $self, $c ) = @_;
-
-    $c->stash->{oauth_failure} = 1;
-    if ($c->session->{oauth}{detach_to}) {
-        $c->detach($c->session->{oauth}{detach_to}, $c->session->{oauth}{detach_args});
-    } else {
-        $c->stash->{template} = 'auth/general.html';
-        $c->detach;
-    }
-}
-
-sub oauth_success : Private {
-    my ($self, $c, $type, $uid, $name, $email) = @_;
-
-    my $user;
-    if ($email) {
-        # Only Facebook gets here
-        # We've got an ID and an email address
-        # Remove any existing mention of this ID
-        my $existing = $c->model('DB::User')->find( { facebook_id => $uid } );
-        $existing->update( { facebook_id => undef } ) if $existing;
-        # Get or create a user, give it this Facebook ID
-        $user = $c->model('DB::User')->find_or_new( { email => $email } );
-        $user->facebook_id($uid);
-        $user->name($name);
-        $user->in_storage() ? $user->update : $user->insert;
-    } else {
-        # We've got an ID, but no email
-        $user = $c->model('DB::User')->find( { $type . '_id' => $uid } );
-        if ($user) {
-            # Matching ID in our database
-            $user->name($name);
-            $user->update;
-        } else {
-            # No matching ID, store ID for use later
-            $c->session->{oauth}{$type . '_id'} = $uid;
-            $c->stash->{oauth_need_email} = 1;
-        }
-    }
-
-    # If we've got here with a full user, log in
-    if ($user) {
-        $c->authenticate( { email => $user->email }, 'no_password' );
-        $c->stash->{login_success} = 1;
-    }
-
-    if ($c->session->{oauth}{detach_to}) {
-        $c->detach($c->session->{oauth}{detach_to}, $c->session->{oauth}{detach_args});
-    } elsif ($c->stash->{oauth_need_email}) {
-        $c->stash->{template} = 'auth/general.html';
-    } else {
-        $c->detach( 'redirect_on_signin', [ $c->session->{oauth}{return_url} ] );
-    }
-}
-
 =head2 redirect_on_signin
 
 Used after signing in to take the person back to where they were.
@@ -478,69 +294,6 @@ sub redirect : Private {
 
 }
 
-=head2 change_password
-
-Let the user change their password.
-
-=cut
-
-sub change_password : Local {
-    my ( $self, $c ) = @_;
-
-    $c->detach( 'redirect' ) unless $c->user;
-
-    $c->forward('get_csrf_token');
-
-    # If not a post then no submission
-    return unless $c->req->method eq 'POST';
-
-    $c->forward('check_csrf_token');
-
-    # get the passwords
-    my $new = $c->get_param('new_password') // '';
-    my $confirm = $c->get_param('confirm') // '';
-
-    # check for errors
-    my $password_error =
-       !$new && !$confirm ? 'missing'
-      : $new ne $confirm ? 'mismatch'
-      :                    '';
-
-    if ($password_error) {
-        $c->stash->{password_error} = $password_error;
-        $c->stash->{new_password}   = $new;
-        $c->stash->{confirm}        = $confirm;
-        return;
-    }
-
-    # we should have a usable password - save it to the user
-    $c->user->obj->update( { password => $new } );
-    $c->stash->{password_changed} = 1;
-
-}
-
-=head2 change_email
-
-Let the user change their email.
-
-=cut
-
-sub change_email : Local {
-    my ( $self, $c ) = @_;
-
-    $c->detach( 'redirect' ) unless $c->user;
-
-    $c->forward('get_csrf_token');
-
-    # If not a post then no submission
-    return unless $c->req->method eq 'POST';
-
-    $c->forward('check_csrf_token');
-    $c->stash->{current_user} = $c->user;
-    $c->stash->{email_template} = 'change_email.txt';
-    $c->forward('email_sign_in');
-}
-
 sub get_csrf_token : Private {
     my ( $self, $c ) = @_;
 
diff --git a/perllib/FixMyStreet/App/Controller/Auth/Profile.pm b/perllib/FixMyStreet/App/Controller/Auth/Profile.pm
new file mode 100644
index 000000000..68c40f9dc
--- /dev/null
+++ b/perllib/FixMyStreet/App/Controller/Auth/Profile.pm
@@ -0,0 +1,93 @@
+package FixMyStreet::App::Controller::Auth::Profile;
+use Moose;
+use namespace::autoclean;
+
+BEGIN { extends 'Catalyst::Controller'; }
+
+=head1 NAME
+
+FixMyStreet::App::Controller::Auth::Profile - Catalyst Controller
+
+=head1 DESCRIPTION
+
+Controller for all the authentication profile related pages - changing email,
+password.
+
+=head1 METHODS
+
+=cut
+
+sub auto {
+    my ( $self, $c ) = @_;
+
+    $c->detach( '/auth/redirect' ) unless $c->user;
+
+    return 1;
+}
+
+=head2 change_password
+
+Let the user change their password.
+
+=cut
+
+sub change_password : Path('/auth/change_password') {
+    my ( $self, $c ) = @_;
+
+    $c->stash->{template} = 'auth/change_password.html';
+
+    $c->forward('/auth/get_csrf_token');
+
+    # If not a post then no submission
+    return unless $c->req->method eq 'POST';
+
+    $c->forward('/auth/check_csrf_token');
+
+    # get the passwords
+    my $new = $c->get_param('new_password') // '';
+    my $confirm = $c->get_param('confirm') // '';
+
+    # check for errors
+    my $password_error =
+       !$new && !$confirm ? 'missing'
+      : $new ne $confirm ? 'mismatch'
+      :                    '';
+
+    if ($password_error) {
+        $c->stash->{password_error} = $password_error;
+        $c->stash->{new_password}   = $new;
+        $c->stash->{confirm}        = $confirm;
+        return;
+    }
+
+    # we should have a usable password - save it to the user
+    $c->user->obj->update( { password => $new } );
+    $c->stash->{password_changed} = 1;
+
+}
+
+=head2 change_email
+
+Let the user change their email.
+
+=cut
+
+sub change_email : Path('/auth/change_email') {
+    my ( $self, $c ) = @_;
+
+    $c->stash->{template} = 'auth/change_email.html';
+
+    $c->forward('/auth/get_csrf_token');
+
+    # If not a post then no submission
+    return unless $c->req->method eq 'POST';
+
+    $c->forward('/auth/check_csrf_token');
+    $c->stash->{current_user} = $c->user;
+    $c->stash->{email_template} = 'change_email.txt';
+    $c->forward('/auth/email_sign_in');
+}
+
+__PACKAGE__->meta->make_immutable;
+
+1;
diff --git a/perllib/FixMyStreet/App/Controller/Auth/Social.pm b/perllib/FixMyStreet/App/Controller/Auth/Social.pm
new file mode 100644
index 000000000..17ace0205
--- /dev/null
+++ b/perllib/FixMyStreet/App/Controller/Auth/Social.pm
@@ -0,0 +1,203 @@
+package FixMyStreet::App::Controller::Auth::Social;
+use Moose;
+use namespace::autoclean;
+
+BEGIN { extends 'Catalyst::Controller'; }
+
+use Net::Facebook::Oauth2;
+use Net::Twitter::Lite::WithAPIv1_1;
+
+=head1 NAME
+
+FixMyStreet::App::Controller::Auth::Social - Catalyst Controller
+
+=head1 DESCRIPTION
+
+Controller for the Facebook/Twitter authentication.
+
+=head1 METHODS
+
+=head2 facebook_sign_in
+
+Starts the Facebook authentication sequence.
+
+=cut
+
+sub fb : Private {
+    my ($self, $c) = @_;
+    Net::Facebook::Oauth2->new(
+        application_id => $c->config->{FACEBOOK_APP_ID},
+        application_secret => $c->config->{FACEBOOK_APP_SECRET},
+        callback => $c->uri_for('/auth/Facebook'),
+    );
+}
+
+sub facebook_sign_in : Private {
+    my ( $self, $c ) = @_;
+
+    $c->detach( '/page_error_403_access_denied', [] ) if FixMyStreet->config('SIGNUPS_DISABLED');
+
+    my $fb = $c->forward('fb');
+    my $url = $fb->get_authorization_url(scope => ['email']);
+
+    my %oauth;
+    $oauth{return_url} = $c->get_param('r');
+    $oauth{detach_to} = $c->stash->{detach_to};
+    $oauth{detach_args} = $c->stash->{detach_args};
+    $c->session->{oauth} = \%oauth;
+    $c->res->redirect($url);
+}
+
+=head2 facebook_callback
+
+Handles the Facebook callback request and completes the authentication sequence.
+
+=cut
+
+sub facebook_callback: Path('/auth/Facebook') : Args(0) {
+    my ( $self, $c ) = @_;
+
+    $c->detach('oauth_failure') if $c->get_param('error_code');
+
+    my $fb = $c->forward('fb');
+    my $access_token;
+    eval {
+        $access_token = $fb->get_access_token(code => $c->get_param('code'));
+    };
+    if ($@) {
+        (my $message = $@) =~ s/at [^ ]*Auth.pm.*//;
+        $c->detach('/page_error_500_internal_error', [ $message ]);
+    }
+
+    # save this token in session
+    $c->session->{oauth}{token} = $access_token;
+
+    my $info = $fb->get('https://graph.facebook.com/me?fields=name,email')->as_hash();
+    my $email = lc ($info->{email} || "");
+    $c->forward('oauth_success', [ 'facebook', $info->{id}, $info->{name}, $email ]);
+}
+
+=head2 twitter_sign_in
+
+Starts the Twitter authentication sequence.
+
+=cut
+
+sub tw : Private {
+    my ($self, $c) = @_;
+    Net::Twitter::Lite::WithAPIv1_1->new(
+        ssl => 1,
+        consumer_key => $c->config->{TWITTER_KEY},
+        consumer_secret => $c->config->{TWITTER_SECRET},
+    );
+}
+
+sub twitter_sign_in : Private {
+    my ( $self, $c ) = @_;
+
+    $c->detach( '/page_error_403_access_denied', [] ) if FixMyStreet->config('SIGNUPS_DISABLED');
+
+    my $twitter = $c->forward('tw');
+    my $url = $twitter->get_authentication_url(callback => $c->uri_for('/auth/Twitter'));
+
+    my %oauth;
+    $oauth{return_url} = $c->get_param('r');
+    $oauth{detach_to} = $c->stash->{detach_to};
+    $oauth{detach_args} = $c->stash->{detach_args};
+    $oauth{token} = $twitter->request_token;
+    $oauth{token_secret} = $twitter->request_token_secret;
+    $c->session->{oauth} = \%oauth;
+    $c->res->redirect($url);
+}
+
+=head2 twitter_callback
+
+Handles the Twitter callback request and completes the authentication sequence.
+
+=cut
+
+sub twitter_callback: Path('/auth/Twitter') : Args(0) {
+    my ( $self, $c ) = @_;
+
+    my $request_token = $c->req->param('oauth_token');
+    my $verifier = $c->req->param('oauth_verifier');
+    my $oauth = $c->session->{oauth};
+
+    $c->detach('oauth_failure') if $c->get_param('denied') || $request_token ne $oauth->{token};
+
+    my $twitter = $c->forward('tw');
+    $twitter->request_token($oauth->{token});
+    $twitter->request_token_secret($oauth->{token_secret});
+
+    eval {
+        # request_access_token no longer returns UID or name
+        $twitter->request_access_token(verifier => $verifier);
+    };
+    if ($@) {
+        (my $message = $@) =~ s/at [^ ]*Auth.pm.*//;
+        $c->detach('/page_error_500_internal_error', [ $message ]);
+    }
+
+    my $info = $twitter->verify_credentials();
+    $c->forward('oauth_success', [ 'twitter', $info->{id}, $info->{name} ]);
+}
+
+sub oauth_failure : Private {
+    my ( $self, $c ) = @_;
+
+    $c->stash->{oauth_failure} = 1;
+    if ($c->session->{oauth}{detach_to}) {
+        $c->detach($c->session->{oauth}{detach_to}, $c->session->{oauth}{detach_args});
+    } else {
+        $c->stash->{template} = 'auth/general.html';
+        $c->detach;
+    }
+}
+
+sub oauth_success : Private {
+    my ($self, $c, $type, $uid, $name, $email) = @_;
+
+    my $user;
+    if ($email) {
+        # Only Facebook gets here
+        # We've got an ID and an email address
+        # Remove any existing mention of this ID
+        my $existing = $c->model('DB::User')->find( { facebook_id => $uid } );
+        $existing->update( { facebook_id => undef } ) if $existing;
+        # Get or create a user, give it this Facebook ID
+        $user = $c->model('DB::User')->find_or_new( { email => $email } );
+        $user->facebook_id($uid);
+        $user->name($name);
+        $user->in_storage() ? $user->update : $user->insert;
+    } else {
+        # We've got an ID, but no email
+        $user = $c->model('DB::User')->find( { $type . '_id' => $uid } );
+        if ($user) {
+            # Matching ID in our database
+            $user->name($name);
+            $user->update;
+        } else {
+            # No matching ID, store ID for use later
+            $c->session->{oauth}{$type . '_id'} = $uid;
+            $c->stash->{oauth_need_email} = 1;
+        }
+    }
+
+    # If we've got here with a full user, log in
+    if ($user) {
+        $c->authenticate( { email => $user->email }, 'no_password' );
+        $c->stash->{login_success} = 1;
+    }
+
+    if ($c->session->{oauth}{detach_to}) {
+        $c->detach($c->session->{oauth}{detach_to}, $c->session->{oauth}{detach_args});
+    } elsif ($c->stash->{oauth_need_email}) {
+        $c->stash->{template} = 'auth/general.html';
+    } else {
+        $c->detach( '/auth/redirect_on_signin', [ $c->session->{oauth}{return_url} ] );
+    }
+}
+
+__PACKAGE__->meta->make_immutable;
+
+1;
diff --git a/perllib/FixMyStreet/App/Controller/Report/New.pm b/perllib/FixMyStreet/App/Controller/Report/New.pm
index f92a5cb22..562f9445a 100644
--- a/perllib/FixMyStreet/App/Controller/Report/New.pm
+++ b/perllib/FixMyStreet/App/Controller/Report/New.pm
@@ -1131,9 +1131,9 @@ sub save_user_and_report : Private {
         $c->stash->{detach_args} = [$token->token];
 
         if ( $c->get_param('facebook_sign_in') ) {
-            $c->detach('/auth/facebook_sign_in');
+            $c->detach('/auth/social/facebook_sign_in');
         } elsif ( $c->get_param('twitter_sign_in') ) {
-            $c->detach('/auth/twitter_sign_in');
+            $c->detach('/auth/social/twitter_sign_in');
         }
     }
 
diff --git a/perllib/FixMyStreet/App/Controller/Report/Update.pm b/perllib/FixMyStreet/App/Controller/Report/Update.pm
index 033f5c017..36c45e621 100644
--- a/perllib/FixMyStreet/App/Controller/Report/Update.pm
+++ b/perllib/FixMyStreet/App/Controller/Report/Update.pm
@@ -438,9 +438,9 @@ sub save_update : Private {
         $c->stash->{detach_args} = [$token->token];
 
         if ( $c->get_param('facebook_sign_in') ) {
-            $c->detach('/auth/facebook_sign_in');
+            $c->detach('/auth/social/facebook_sign_in');
         } elsif ( $c->get_param('twitter_sign_in') ) {
-            $c->detach('/auth/twitter_sign_in');
+            $c->detach('/auth/social/twitter_sign_in');
         }
     }
 
diff --git a/t/app/controller/auth.t b/t/app/controller/auth.t
index cb7d16969..8cdf93227 100644
--- a/t/app/controller/auth.t
+++ b/t/app/controller/auth.t
@@ -4,7 +4,6 @@ use FixMyStreet::TestMech;
 my $mech = FixMyStreet::TestMech->new;
 
 my $test_email    = 'test@example.com';
-my $test_email2   = 'test@example.net';
 my $test_email3   = 'newuser@example.org';
 my $test_password = 'foobar';
 
@@ -60,7 +59,7 @@ $mech->get_ok('/auth');
 $mech->submit_form_ok(
     {
         form_name => 'general_auth',
-        fields    => { email => $test_email, },
+        fields => { email => $test_email, password_register => $test_password },
         button    => 'email_sign_in',
     },
     "create an account for '$test_email'"
@@ -101,125 +100,6 @@ $mech->not_logged_in_ok;
     $mech->log_out_ok;
 }
 
-# get a sign in email and change password
-{
-    $mech->clear_emails_ok;
-    $mech->get_ok('/auth');
-    $mech->submit_form_ok(
-        {
-            form_name => 'general_auth',
-            fields    => {
-                email => "$test_email",
-                r     => 'faq', # Just as a test
-            },
-            button    => 'email_sign_in',
-        },
-        "email_sign_in with '$test_email'"
-    );
-
-    # rest is as before so no need to test
-
-    # follow link and change password - check not prompted for old password
-    $mech->not_logged_in_ok;
-
-    my $link = $mech->get_link_from_email;
-    $mech->get_ok($link);
-    is $mech->uri->path, '/faq', "redirected to the Help page";
-
-    $mech->get_ok('/auth/change_password');
-
-    ok my $form = $mech->form_name('change_password'),
-      "found change password form";
-    is_deeply [ sort grep { $_ } map { $_->name } $form->inputs ],    #
-      [ 'confirm', 'new_password', 'token' ],
-      "check we got expected fields (ie not old_password)";
-
-    # check the various ways the form can be wrong
-    for my $test (
-        { new => '',       conf => '',           err => 'enter a password', },
-        { new => 'secret', conf => '',           err => 'do not match', },
-        { new => '',       conf => 'secret',     err => 'do not match', },
-        { new => 'secret', conf => 'not_secret', err => 'do not match', },
-      )
-    {
-        $mech->get_ok('/auth/change_password');
-        $mech->content_lacks( $test->{err}, "did not find expected error" );
-        $mech->submit_form_ok(
-            {
-                form_name => 'change_password',
-                fields =>
-                  { new_password => $test->{new}, confirm => $test->{conf}, },
-            },
-            "change_password with '$test->{new}' and '$test->{conf}'"
-        );
-        $mech->content_contains( $test->{err}, "found expected error" );
-    }
-
-    my $user =
-      FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
-    ok $user, "got a user";
-    ok !$user->password, "user has no password";
-
-    $mech->get_ok('/auth/change_password');
-    $mech->submit_form_ok(
-        {
-            form_name => 'change_password',
-            fields =>
-              { new_password => $test_password, confirm => $test_password, },
-        },
-        "change_password with '$test_password' and '$test_password'"
-    );
-    is $mech->uri->path, '/auth/change_password',
-      "still on change password page";
-    $mech->content_contains( 'password has been changed',
-        "found password changed" );
-
-    $user->discard_changes();
-    ok $user->password, "user now has a password";
-}
-
-subtest "Test change email page" => sub {
-    # Still signed in from the above test
-    $mech->get_ok('/my');
-    $mech->follow_link_ok({url => '/auth/change_email'});
-    $mech->submit_form_ok(
-        { with_fields => { email => "" } },
-        "submit blank change email form"
-    );
-    $mech->content_contains( 'Please enter your email', "found expected error" );
-    $mech->submit_form_ok({ with_fields => { email => $test_email2 } }, "change_email to $test_email2");
-    is $mech->uri->path, '/auth/change_email', "still on change email page";
-    $mech->content_contains( 'Now check your email', "found check your email" );
-    my $link = $mech->get_link_from_email;
-    $mech->get_ok($link);
-    is $mech->uri->path, '/auth/change_email/success', "redirected to the change_email page";
-    $mech->content_contains('successfully confirmed');
-    ok(FixMyStreet::App->model('DB::User')->find( { email => $test_email2 } ), "got a user");
-
-    ok(FixMyStreet::App->model('DB::User')->create( { email => $test_email } ), "created old user");
-    $mech->submit_form_ok({ with_fields => { email => $test_email } },
-        "change_email back to $test_email"
-    );
-    is $mech->uri->path, '/auth/change_email', "still on change email page";
-    $mech->content_contains( 'Now check your email', "found check your email" );
-    $link = $mech->get_link_from_email;
-    $mech->get_ok($link);
-    is $mech->uri->path, '/auth/change_email/success', "redirected to the change_email page";
-    $mech->content_contains('successfully confirmed');
-
-    # Test you can't click the link if logged out
-    $mech->submit_form_ok({ with_fields => { email => $test_email } },
-        "change_email back to $test_email"
-    );
-    is $mech->uri->path, '/auth/change_email', "still on change email page";
-    $mech->content_contains( 'Now check your email', "found check your email" );
-    $link = $mech->get_link_from_email;
-    $mech->log_out_ok;
-    $mech->get_ok($link);
-    isnt $mech->uri->path, '/auth/change_email/success', "not redirected to the change_email page";
-    $mech->content_contains('Sorry');
-};
-
 foreach my $remember_me ( '1', '0' ) {
     subtest "sign in using valid details (remember_me => '$remember_me')" => sub {
         $mech->get_ok('/auth');
diff --git a/t/app/controller/auth_profile.t b/t/app/controller/auth_profile.t
new file mode 100644
index 000000000..1122518ca
--- /dev/null
+++ b/t/app/controller/auth_profile.t
@@ -0,0 +1,127 @@
+use FixMyStreet::TestMech;
+my $mech = FixMyStreet::TestMech->new;
+
+my $test_email    = 'test@example.com';
+my $test_email2   = 'test@example.net';
+my $test_password = 'foobar';
+
+END {
+    done_testing();
+}
+
+# get a sign in email and change password
+{
+    $mech->clear_emails_ok;
+    $mech->get_ok('/auth');
+    $mech->submit_form_ok(
+        {
+            form_name => 'general_auth',
+            fields    => {
+                email => "$test_email",
+                r     => 'faq', # Just as a test
+            },
+            button => 'email_sign_in',
+        },
+        "email_sign_in with '$test_email'"
+    );
+
+    # follow link and change password - check not prompted for old password
+    $mech->not_logged_in_ok;
+
+    my $link = $mech->get_link_from_email;
+    $mech->get_ok($link);
+    is $mech->uri->path, '/faq', "redirected to the Help page";
+
+    $mech->get_ok('/auth/change_password');
+
+    ok my $form = $mech->form_name('change_password'),
+      "found change password form";
+    is_deeply [ sort grep { $_ } map { $_->name } $form->inputs ],    #
+      [ 'confirm', 'new_password', 'token' ],
+      "check we got expected fields (ie not old_password)";
+
+    # check the various ways the form can be wrong
+    for my $test (
+        { new => '',       conf => '',           err => 'enter a password', },
+        { new => 'secret', conf => '',           err => 'do not match', },
+        { new => '',       conf => 'secret',     err => 'do not match', },
+        { new => 'secret', conf => 'not_secret', err => 'do not match', },
+      )
+    {
+        $mech->get_ok('/auth/change_password');
+        $mech->content_lacks( $test->{err}, "did not find expected error" );
+        $mech->submit_form_ok(
+            {
+                form_name => 'change_password',
+                fields =>
+                  { new_password => $test->{new}, confirm => $test->{conf}, },
+            },
+            "change_password with '$test->{new}' and '$test->{conf}'"
+        );
+        $mech->content_contains( $test->{err}, "found expected error" );
+    }
+
+    my $user =
+      FixMyStreet::App->model('DB::User')->find( { email => $test_email } );
+    ok $user, "got a user";
+    ok !$user->password, "user has no password";
+
+    $mech->get_ok('/auth/change_password');
+    $mech->submit_form_ok(
+        {
+            form_name => 'change_password',
+            fields =>
+              { new_password => $test_password, confirm => $test_password, },
+        },
+        "change_password with '$test_password' and '$test_password'"
+    );
+    is $mech->uri->path, '/auth/change_password',
+      "still on change password page";
+    $mech->content_contains( 'password has been changed',
+        "found password changed" );
+
+    $user->discard_changes();
+    ok $user->password, "user now has a password";
+}
+
+subtest "Test change email page" => sub {
+    # Still signed in from the above test
+    $mech->get_ok('/my');
+    $mech->follow_link_ok({url => '/auth/change_email'});
+    $mech->submit_form_ok(
+        { with_fields => { email => "" } },
+        "submit blank change email form"
+    );
+    $mech->content_contains( 'Please enter your email', "found expected error" );
+    $mech->submit_form_ok({ with_fields => { email => $test_email2 } }, "change_email to $test_email2");
+    is $mech->uri->path, '/auth/change_email', "still on change email page";
+    $mech->content_contains( 'Now check your email', "found check your email" );
+    my $link = $mech->get_link_from_email;
+    $mech->get_ok($link);
+    is $mech->uri->path, '/auth/change_email/success', "redirected to the change_email page";
+    $mech->content_contains('successfully confirmed');
+    ok(FixMyStreet::App->model('DB::User')->find( { email => $test_email2 } ), "got a user");
+
+    ok(FixMyStreet::App->model('DB::User')->create( { email => $test_email } ), "created old user");
+    $mech->submit_form_ok({ with_fields => { email => $test_email } },
+        "change_email back to $test_email"
+    );
+    is $mech->uri->path, '/auth/change_email', "still on change email page";
+    $mech->content_contains( 'Now check your email', "found check your email" );
+    $link = $mech->get_link_from_email;
+    $mech->get_ok($link);
+    is $mech->uri->path, '/auth/change_email/success', "redirected to the change_email page";
+    $mech->content_contains('successfully confirmed');
+
+    # Test you can't click the link if logged out
+    $mech->submit_form_ok({ with_fields => { email => $test_email } },
+        "change_email back to $test_email"
+    );
+    is $mech->uri->path, '/auth/change_email', "still on change email page";
+    $mech->content_contains( 'Now check your email', "found check your email" );
+    $link = $mech->get_link_from_email;
+    $mech->log_out_ok;
+    $mech->get_ok($link);
+    isnt $mech->uri->path, '/auth/change_email/success', "not redirected to the change_email page";
+    $mech->content_contains('Sorry');
+};
diff --git a/templates/web/base/auth/change_email.html b/templates/web/base/auth/change_email.html
index a444b8c31..0f0e0a3bb 100644
--- a/templates/web/base/auth/change_email.html
+++ b/templates/web/base/auth/change_email.html
@@ -8,7 +8,7 @@
 
 [% loc('Your email address') %]: [% c.user.email %]
 
-<form action="[% c.uri_for('change_email') %]" method="post" name="change_email">
+<form action="[% c.uri_for_action('/auth/profile/change_email') %]" method="post" name="change_email">
     <input type="hidden" name="token" value="[% csrf_token %]">
 
     <fieldset>
diff --git a/templates/web/base/auth/change_password.html b/templates/web/base/auth/change_password.html
index 094d131eb..a32dbaf9c 100644
--- a/templates/web/base/auth/change_password.html
+++ b/templates/web/base/auth/change_password.html
@@ -15,7 +15,7 @@ INCLUDE 'header.html', title = loc('Change password'), bodyclass = bclass
 
 <h1>[% loc('Change password') %]</h1>
 
-<form action="[% c.uri_for('change_password') %]" method="post" name="change_password" class="fieldset">
+<form action="[% c.uri_for_action('/auth/profile/change_password') %]" method="post" name="change_password" class="fieldset">
     <input type="hidden" name="token" value="[% csrf_token %]">
 
     <fieldset>
diff --git a/templates/web/base/auth/general.html b/templates/web/base/auth/general.html
index 2a8bea402..aa8c6a871 100644
--- a/templates/web/base/auth/general.html
+++ b/templates/web/base/auth/general.html
@@ -11,7 +11,7 @@
     <p class="form-error">[% loc('Sorry, we could not log you in. Please fill in the form below.') %]</p>
 [% END %]
 
-<form action="[% c.uri_for() %]" method="post" name="general_auth" class="validate">
+<form action="/auth" method="post" name="general_auth" class="validate">
     <fieldset>
 
         <input type="hidden" name="r" value="[% c.req.params.r | html %]">
diff --git a/templates/web/zurich/auth/general.html b/templates/web/zurich/auth/general.html
index fd34b79f8..000cf3349 100644
--- a/templates/web/zurich/auth/general.html
+++ b/templates/web/zurich/auth/general.html
@@ -12,7 +12,7 @@
     loc_email_error = errors.$email_error || errors.other;
 END %]
 
-<form action="[% c.uri_for() %]" method="post" name="general_auth_login" class="validate">
+<form action="/auth" method="post" name="general_auth_login" class="validate">
     <fieldset>
 
         <h1>[% loc('Sign in') %]</h1>
@@ -44,7 +44,7 @@ END %]
     </fieldset>
 </form>
 
-<form action="[% c.uri_for() %]" method="post" name="general_auth_register" class="validate">
+<form action="/auth" method="post" name="general_auth_register" class="validate">
     <fieldset>
         <input type="hidden" name="r" value="[% c.req.params.r | html %]">