def test_reset_password_links_single_use():
    """Test that reset password links are single use"""
    app = create_ctfd()
    with app.app_context():
        register_user(app)

        set_config("mail_server", "localhost")
        set_config("mail_port", 25)
        set_config("mail_useauth", True)
        set_config("mail_username", "username")
        set_config("mail_password", "password")

        with app.test_client() as client:
            client.get("/reset_password")

            # Build reset password data
            with client.session_transaction() as sess:
                data = {"nonce": sess.get("nonce"), "email": "user@examplectf.com"}

            # Issue the password reset request
            urandom_value = b"\xff" * 32
            with patch("os.urandom", return_value=urandom_value):
                client.post("/reset_password", data=data)

            # Get user's original password
            user = Users.query.filter_by(email="user@examplectf.com").first()

            # Build the POST data
            with client.session_transaction() as sess:
                data = {"nonce": sess.get("nonce"), "password": "passwordtwo"}

            # Do the password reset
            r = client.get(
                "/reset_password/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
            )
            assert r.status_code == 200
            r = client.post(
                "/reset_password/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                data=data,
            )
            assert r.status_code == 302

            # Make sure that the user's password changed
            user = Users.query.filter_by(email="user@examplectf.com").first()
            assert verify_password("passwordtwo", user.password)

            # Attempt to re-use the password reset link
            r = client.get(
                "/reset_password/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
            )
            assert (
                "Your reset link is invalid, please generate a new one"
                in r.get_data(as_text=True)
            )
            assert r.status_code == 200
            with client.session_transaction() as sess:
                data = {"nonce": sess.get("nonce"), "password": "passwordthree"}
            r = client.post(
                "/reset_password/ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
                data=data,
            )
            assert r.status_code == 200
            # Password should not have been changed
            user = Users.query.filter_by(email="user@examplectf.com").first()
            assert verify_password("passwordthree", user.password) is False
    destroy_ctfd(app)
Test that reset password links are single use
tests/utils/test_email.py