-
-
Notifications
You must be signed in to change notification settings - Fork 7k
Modify ObtainAuthToken to use the User model's USERNAME_FIELD and password for authentication instead of assuming username and password. #9674
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,50 @@ | ||
| from django.contrib.auth import authenticate | ||
| from django.contrib.auth import authenticate, get_user_model | ||
| from django.utils.translation import gettext_lazy as _ | ||
|
|
||
| from rest_framework import serializers | ||
|
|
||
| USER_MODEL = get_user_model() | ||
|
|
||
|
|
||
| class AuthTokenSerializer(serializers.Serializer): | ||
| username = serializers.CharField( | ||
| label=_("Username"), | ||
| write_only=True | ||
| ) | ||
| password = serializers.CharField( | ||
| label=_("Password"), | ||
| style={'input_type': 'password'}, | ||
| trim_whitespace=False, | ||
| write_only=True | ||
| ) | ||
| def __init__(self, instance=None, data=None, **kwargs): | ||
| super().__init__(instance, data=data, **kwargs) | ||
| self.identifier_fiend_name = USER_MODEL.USERNAME_FIELD | ||
|
||
| if USER_MODEL.get_email_field_name() == self.identifier_fiend_name: | ||
| self.fields[self.identifier_fiend_name] = serializers.EmailField( | ||
|
Comment on lines
+13
to
+14
|
||
| label=_(self.identifier_fiend_name.title()), | ||
| write_only=True | ||
| ) | ||
| else: | ||
| self.fields[self.identifier_fiend_name] = serializers.CharField( | ||
|
||
| label=_(self.identifier_fiend_name.title()), | ||
| write_only=True | ||
| ) | ||
| self.fields["password"] = serializers.CharField( | ||
| label=_("Password"), | ||
| style={'input_type': 'password'}, | ||
| trim_whitespace=False, | ||
| write_only=True | ||
| ) | ||
|
Comment on lines
+10
to
+28
|
||
|
|
||
| token = serializers.CharField( | ||
| label=_("Token"), | ||
| read_only=True | ||
| ) | ||
|
|
||
| def validate(self, attrs): | ||
| username = attrs.get('username') | ||
| identifier_value = attrs.get(self.identifier_fiend_name) | ||
|
||
| password = attrs.get('password') | ||
|
|
||
| if username and password: | ||
| user = authenticate(request=self.context.get('request'), | ||
| username=username, password=password) | ||
| if identifier_value and password: | ||
| credentials = { | ||
| self.identifier_fiend_name: identifier_value, | ||
|
||
| "password": password, | ||
| } | ||
| user = authenticate( | ||
| request=self.context.get('request'), | ||
| **credentials, | ||
| ) | ||
|
|
||
| # The authenticate call simply returns None for is_active=False | ||
| # users. (Assuming the default ModelBackend authentication | ||
|
|
@@ -35,7 +53,7 @@ def validate(self, attrs): | |
| msg = _('Unable to log in with provided credentials.') | ||
| raise serializers.ValidationError(msg, code='authorization') | ||
| else: | ||
| msg = _('Must include "username" and "password".') | ||
| msg = _(f'Must include "{self.identifier_fiend_name}" and "password".') | ||
|
||
| raise serializers.ValidationError(msg, code='authorization') | ||
|
|
||
| attrs['user'] = user | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,5 @@ | ||
| from django.contrib.auth import get_user_model | ||
|
|
||
| from rest_framework import parsers, renderers | ||
| from rest_framework.authtoken.models import Token | ||
| from rest_framework.authtoken.serializers import AuthTokenSerializer | ||
|
|
@@ -16,15 +18,17 @@ class ObtainAuthToken(APIView): | |
| serializer_class = AuthTokenSerializer | ||
|
|
||
| if coreapi_schema.is_enabled(): | ||
| USER_MODEL = get_user_model() | ||
| identifier_field_name = USER_MODEL.USERNAME_FIELD | ||
|
Comment on lines
+21
to
+22
|
||
| schema = ManualSchema( | ||
| fields=[ | ||
| coreapi.Field( | ||
| name="username", | ||
| name=identifier_field_name, | ||
| required=True, | ||
| location='form', | ||
| schema=coreschema.String( | ||
| title="Username", | ||
| description="Valid username for authentication", | ||
| title=identifier_field_name.title(), | ||
| description=f"Valid {identifier_field_name} for authentication", | ||
| ), | ||
|
Comment on lines
23
to
32
|
||
| ), | ||
| coreapi.Field( | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The USER_MODEL is evaluated at module import time, which means if the user model changes dynamically or if this module is imported before Django apps are ready, it could reference the wrong model. Consider moving this inside the init method where it's actually used, similar to how it's done in the views.py file.