def test_api_user_change_email_under_whitelist():
    """Test that users can only change emails to ones in the whitelist"""
    app = create_ctfd()
    with app.app_context():
        register_user(app)
        set_config(
            "domain_whitelist", "whitelisted.com, whitelisted.org, whitelisted.net"
        )
        with login_as_user(app) as client:
            r = client.patch(
                "/api/v1/users/me",
                json={"email": "new_email@email.com", "confirm": "password"},
            )
            assert r.status_code == 400
            resp = r.get_json()
            assert resp["errors"]["email"]
            assert resp["success"] is False

            r = client.patch(
                "/api/v1/users/me",
                json={"email": "new_email@whitelisted.com", "confirm": "password"},
            )
            assert r.status_code == 200
            resp = r.get_json()
            assert resp["data"]["email"] == "new_email@whitelisted.com"
            assert resp["success"] is True
    destroy_ctfd(app)
Test that users can only change emails to ones in the whitelist
tests/api/v1/test_users.py