python - 验证用户帐户在 Django Rest Framework 中是否处于事件状态

Question

我正在尝试通过电子邮件链接实现帐户激活。我的 User 模型非常简单，继承自 django.contrib.auth.models.AbstractUser，因此它默认具有 is_active 字段。注册后，使用 is_active=False 参数创建新用户，我想处理以下情况:当用户尝试登录时，即使凭据正常，也不应登录，因为帐户未激活。我正在使用诺克斯 token 身份验证。我的序列化器:

from django.contrib.auth import authenticate
from rest_framework import serializers, exceptions


class LoginUserSerializer(serializers.ModelSerializer):
    class Meta:
        model = UserModel
        fields = ('username', 'password')

    def validate(self, data):
        user = authenticate(**data)
        if user:
            if user.is_active:
                return user
            raise exceptions.AuthenticationFailed('Account is not activated')
        raise exceptions.AuthenticationFailed()

并查看:

from django.contrib.auth import login
from rest_framework.permissions import AllowAny
from rest_framework.authtoken.serializers import AuthTokenSerializer
from knox.views import LoginView
from .serializers import LoginUserSerializer


class LoginUserView(LoginView):
    serializer_class = LoginUserSerializer
    permission_classes = [AllowAny]

    def post(self, request, *args, **kwargs):
        serializer = AuthTokenSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        user = serializer.validated_data['user']
        login(request, user)
        return super(LoginUserView, self).post(request)

使用该代码，我偶然发现了问题:当我尝试使用已激活的帐户登录时，一切看起来都很好，但是当我尝试未激活的帐户时，我不是帐户未激活，而是得到:

{
    "non_field_errors": [
        "Unable to log in with provided credentials."
    ]
}

我认为，这来自 View 而不是序列化器。

Answer 1

好的，感谢 Shafikur Ra​​hman 的建议，我才得以成功。当我尝试使用 pdb 调试它并在 LoginUserSerializer 中设置跟踪但没有发生任何事情后，我意识到在我看来我不是指向我编写的序列化器，而是指向AuthTokenSerializer。即使在那之后它仍然不起作用，因为我对 django login() 和 DRF validate() 的工作原理缺乏了解。以下固定代码供引用:

查看:

class LoginUserView(LoginView):
    serializer_class = LoginUserSerializer
    permission_classes = [AllowAny]

    def post(self, request, *args, **kwargs):
        serializer = LoginUserSerializer(data=request.data)  # changed  to desired serializer
        serializer.is_valid(raise_exception=True)
        user = serializer.validated_data['user']
        login(request, user)
        return super(LoginUserView, self).post(request)

和序列化器:

class LoginUserSerializer(serializers.ModelSerializer):
    username = serializers.CharField()  # added missing fields for serializer
    password = serializers.CharField()

    class Meta:
        model = UserModel
        fields = ('username', 'password')

    def validate(self, data):
        user = authenticate(**data)
        if user:
            if user.is_active:
                data['user'] = user  # added user model to OrderedDict that serializer is validating
                return data  # and in sunny day scenario, return this dict, as everything is fine
            raise exceptions.AuthenticationFailed('Account is not activated')
        raise exceptions.AuthenticationFailed()

此外，为了能够authenticate()非活跃用户，我必须添加

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.AllowAllUsersModelBackend'
]

在项目设置中。