⚙️ Enable allauth enumeration prevention

[jefftriplett]

Fixes #3043.

Flips ACCOUNT_PREVENT_ENUMERATION to True, which is also the allauth default. ACCOUNT_EMAIL_VERIFICATION is already "mandatory", the precondition allauth needs — signing up with an existing address now sends mail instead of showing an error.

This closes the email vector, not the username one. Signup still has to reject a taken username, and UserDetail serves public profiles at /users//, so usernames stay confirmable. #2680 is the other half.

Two existing tests asserted the disclosure this removes, so they now assert its absence. Added a password reset test.

[Copilot]

Pull request overview

This PR enables django-allauth’s enumeration-prevention behavior by turning on ACCOUNT_PREVENT_ENUMERATION, aiming to reduce account-disclosure via signup and password reset flows.

Changes:

• Set ACCOUNT_PREVENT_ENUMERATION = True in base settings.
• Updated signup-related tests to assert that “email already registered” is no longer disclosed.
• Added a password reset test to ensure unknown emails do not produce a distinguishable response.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pydotorg/settings/base.py	Enables allauth enumeration prevention globally via settings.
apps/users/tests/test_views.py	Updates signup duplication assertions and adds a password reset non-enumeration test.
apps/users/tests/test_forms.py	Adjusts duplicate-email signup form expectations to avoid revealing a taken email.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

apps/users/tests/test_views.py:253

• This test intends to compare the password reset flow for a known vs unknown email, but self.user is created via UserFactory and does not create an allauth EmailAddress record. Depending on django-allauth internals/version, the reset view may only consider EmailAddress rows, which would make the “known” case effectively unknown and reduce the value of this assertion. Creating a verified/primary EmailAddress for self.user here makes the test deterministic and aligned with real allauth accounts.

        url = reverse("account_reset_password")

        known = self.client.post(url, {"email": self.user.email}, follow=True)
        unknown = self.client.post(url, {"email": "nobody@example.com"}, follow=True)