Authentication

import os

SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]

INSTALLED_APPS = [
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "django.contrib.staticfiles",
    "accounts",
    "catalog",
]

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",   # needs SessionMiddleware before it
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

LOGIN_URL = "login"                       # a URL or a URL name: where anonymous visitors are sent
LOGIN_REDIRECT_URL = "catalog:shelf"      # where to go after a login that had no ?next=
LOGOUT_REDIRECT_URL = "login"             # where to go after a logout (None renders logged_out.html)
PASSWORD_RESET_TIMEOUT = 60 * 60          # reset links live one hour instead of the 3-day default

from django.contrib.auth import authenticate, login
from django.shortcuts import redirect, render


def manual_login_raw(request):
    """authenticate() + login() without a form."""
    user = authenticate(
        request,
        username=request.POST.get("username", ""),
        password=request.POST.get("password", ""),
    )
    if user is None:
        return render(request, "registration/login.html", {"error": True}, status=400)
    login(request, user)
    return redirect("catalog:shelf")

from django.contrib.auth import login
from django.contrib.auth.forms import AuthenticationForm
from django.shortcuts import redirect, render
from django.utils.http import url_has_allowed_host_and_scheme


def _safe_next(request, default):
    target = request.POST.get("next") or request.GET.get("next") or ""
    allowed = url_has_allowed_host_and_scheme(
        target, allowed_hosts={request.get_host()}, require_https=request.is_secure()
    )
    return target if allowed else default


def manual_login(request):
    """The hand-written equivalent of LoginView (shown for teaching)."""
    if request.method == "POST":
        form = AuthenticationForm(request, data=request.POST)
        if form.is_valid():
            login(request, form.get_user())
            return redirect(_safe_next(request, "catalog:shelf"))
    else:
        form = AuthenticationForm(request)
    return render(request, "registration/login.html", {"form": form, "next": request.GET.get("next", "")})

{% extends "base.html" %}
{% block title %}Sign in{% endblock %}
{% block content %}
<h1>Sign in</h1>
{% if next %}
  {% if user.is_authenticated %}
    <p>Your account does not have access to that page. Sign in with another account.</p>
  {% else %}
    <p>Please sign in to continue.</p>
  {% endif %}
{% endif %}
<form method="post">
  {% csrf_token %}
  {{ form.as_div }}
  <input type="hidden" name="next" value="{{ next }}">
  <button type="submit">Sign in</button>
</form>
<p><a href="{% url 'password_reset' %}">Forgot your password?</a></p>
{% endblock %}

import secrets

from django.contrib.auth import SESSION_KEY, get_user_model
from django.contrib.auth.signals import user_login_failed
from django.test import TestCase
from django.urls import reverse

User = get_user_model()
PW = secrets.token_urlsafe(16)  # generated at runtime, never a literal
WRONG_PW = secrets.token_urlsafe(16)


class ManualLoginTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        cls.user = User.objects.create_user("reader", "reader@example.com", PW)

    def test_login_rotates_session_key_and_keeps_anonymous_data(self):
        session = self.client.session
        session["cart"] = {"1": 2}
        session.save()
        before = self.client.cookies["sessionid"].value
        r = self.client.post(reverse("manual_login"), {"username": "reader", "password": PW})
        self.assertRedirects(r, reverse("catalog:shelf"), fetch_redirect_response=False)
        after = self.client.cookies["sessionid"].value
        self.assertNotEqual(before, after)                          # cycle_key() on login
        self.assertEqual(self.client.session["cart"], {"1": 2})     # anonymous data survives login
        self.assertEqual(self.client.session[SESSION_KEY], str(self.user.pk))

    def test_bad_password_redisplays_the_form(self):
        failures = []
        user_login_failed.connect(lambda sender, credentials, **kw: failures.append(sorted(credentials)), weak=False)
        r = self.client.post(reverse("manual_login"), {"username": "reader", "password": "wrong"})
        self.assertEqual(r.status_code, 200)
        self.assertContains(r, "Please enter a correct username and password")
        self.assertNotIn(SESSION_KEY, self.client.session)
        self.assertEqual(failures, [["password", "username"]])

    def test_next_is_honoured_only_for_this_host(self):
        ok = self.client.post(reverse("manual_login") + "?next=/reviews/", {"username": "reader", "password": PW})
        self.assertEqual(ok["Location"], "/reviews/")
        self.client.logout()
        evil = self.client.post(
            reverse("manual_login") + "?next=https://evil.example/", {"username": "reader", "password": PW}
        )
        self.assertEqual(evil["Location"], reverse("catalog:shelf"))

from django.contrib import messages
from django.contrib.auth import logout
from django.shortcuts import redirect
from django.views.decorators.http import require_POST


@require_POST
def manual_logout(request):
    logout(request)
    messages.info(request, "You have been signed out.")   # after logout(), so the new session keeps it
    return redirect("login")

<form method="post" action="{% url 'logout' %}" style="display:inline">
  {% csrf_token %}
  <button type="submit">Sign out</button>
</form>

from django.contrib import admin
from django.contrib.auth import views as auth_views
from django.urls import include, path

urlpatterns = [
    path("admin/", admin.site.urls),
    path("accounts/", include("accounts.urls")),                 # signup and the teaching views
    path("members/login/", auth_views.LoginView.as_view(
        redirect_authenticated_user=True, extra_context={"site_title": "Members"}), name="members_login"),
    path("accounts/", include("django.contrib.auth.urls")),      # the eight built-in routes
    path("", include("catalog.urls")),
]

MIDDLEWARE = [
    # ...
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.auth.middleware.LoginRequiredMiddleware",
    # ...
]
LOGIN_URL = "login"

from django.contrib.auth.decorators import login_not_required
from django.urls import path

from accounts import views as account_views
from catalog import views

urlpatterns = [
    path("", login_not_required(views.book_list)),
    path("accounts/signup/", login_not_required(account_views.signup)),
]

from django.contrib.auth.middleware import LoginRequiredMiddleware


class BookshelfLoginRequiredMiddleware(LoginRequiredMiddleware):
    """Send anonymous visitors of catalog views to a dedicated page, and never add ?next=."""

    def get_login_url(self, view_func):
        return "/welcome/" if view_func.__module__.startswith("catalog") else super().get_login_url(view_func)

    def get_redirect_field_name(self, view_func):
        return None

from django.test import TestCase, override_settings

BASE_MW = [
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
]


@override_settings(MIDDLEWARE=BASE_MW + ["django.contrib.auth.middleware.LoginRequiredMiddleware"])
class MiddlewareTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        cls.user = User.objects.create_user("reader", "reader@example.com", PW)

    def test_everything_needs_login_except_marked_views(self):
        self.assertEqual(self.client.get("/").status_code, 200)               # @login_not_required
        for url in ("/reviews/", "/staff-report/", "/accounts/signup/", "/accounts/password_change/"):
            with self.subTest(url=url):
                self.assertEqual(self.client.get(url).status_code, 302)
        for name in ("login", "password_reset", "password_reset_done", "password_reset_complete"):
            with self.subTest(name=name):
                self.assertEqual(self.client.get(reverse(name)).status_code, 200)

    def test_mixin_attributes_are_ignored_by_the_middleware(self):
        r = self.client.get("/reviews/")
        self.assertEqual(r["Location"], "/accounts/login/?next=/reviews/")

    def test_authenticated_users_pass(self):
        self.client.force_login(self.user)
        self.assertEqual(self.client.get("/reviews/").status_code, 200)


@override_settings(MIDDLEWARE=BASE_MW + ["catalog.middleware.BookshelfLoginRequiredMiddleware"])
class CustomMiddlewareTests(TestCase):
    def test_custom_login_url_without_next(self):
        r = self.client.get("/shelf/")
        self.assertEqual((r.status_code, r["Location"]), (302, "/welcome/"))
        r = self.client.get("/accounts/password_change/")   # not a catalog view: default LOGIN_URL, still no ?next=
        self.assertEqual(r["Location"], "/accounts/login/")

from django import forms
from django.contrib.auth import get_user_model
from django.contrib.auth.forms import UserCreationForm


class SignUpForm(UserCreationForm):
    email = forms.EmailField(required=True)

    class Meta(UserCreationForm.Meta):
        model = get_user_model()
        fields = ("username", "email")

    def clean_email(self):
        email = self.cleaned_data["email"].strip()
        if get_user_model().objects.filter(email__iexact=email).exists():
            raise forms.ValidationError("An account with this address already exists.", code="duplicate_email")
        return email

from django.contrib import messages
from django.contrib.auth import login
from django.shortcuts import redirect, render

from .forms import SignUpForm


def signup(request):
    if request.user.is_authenticated:
        return redirect("catalog:shelf")
    if request.method == "POST":
        form = SignUpForm(request.POST)
        if form.is_valid():
            user = form.save()
            login(request, user, backend="django.contrib.auth.backends.ModelBackend")
            messages.success(request, f"Welcome, {user.get_username()}!")
            return redirect("catalog:shelf")
    else:
        form = SignUpForm()
    return render(request, "accounts/signup.html", {"form": form})

{% extends "base.html" %}
{% block title %}Sign up{% endblock %}
{% block content %}
<h1>Create your account</h1>
<form method="post">
  {% csrf_token %}
  {{ form.as_div }}
  <button type="submit">Sign up</button>
</form>
{% endblock %}

NUMERIC_PW = "".join(secrets.choice("0123456789") for _ in range(12))   # fails the "entirely numeric" validator


class SignUpTests(TestCase):
    def test_signup_creates_user_hashes_password_and_logs_in(self):
        r = self.client.post(reverse("signup"), {
            "username": "newreader", "email": "new@example.com", "password1": PW, "password2": PW})
        self.assertRedirects(r, reverse("catalog:shelf"), fetch_redirect_response=False)
        user = User.objects.get(username="newreader")
        self.assertTrue(user.check_password(PW))
        self.assertNotEqual(user.password, PW)
        self.assertTrue(user.password.startswith("pbkdf2_sha256$1500000$"))
        self.assertEqual(self.client.session[SESSION_KEY], str(user.pk))

    def test_case_insensitive_duplicate_usernames_are_rejected(self):
        User.objects.create_user("Reader", "a@example.com", PW)
        r = self.client.post(reverse("signup"), {
            "username": "reader", "email": "b@example.com", "password1": PW, "password2": PW})
        self.assertContains(r, "A user with that username already exists.")

    def test_numeric_password_rejected_by_validators(self):
        r = self.client.post(reverse("signup"), {
            "username": "x1", "email": "x@example.com", "password1": NUMERIC_PW, "password2": NUMERIC_PW})
        self.assertContains(r, "This password is entirely numeric.")
        self.assertFalse(User.objects.filter(username="x1").exists())

    def test_duplicate_email_rejected(self):
        User.objects.create_user("a", "dup@example.com", PW)
        r = self.client.post(reverse("signup"), {
            "username": "b", "email": "DUP@example.com", "password1": PW, "password2": PW})
        self.assertContains(r, "already exists")

<nav>
  <a href="{% url 'catalog:book_list' %}">Books</a>
  {% if user.is_authenticated %}
    <span>Signed in as {{ user.get_username }}</span>
    <form method="post" action="{% url 'logout' %}" style="display:inline">
      {% csrf_token %}
      <button type="submit">Sign out</button>
    </form>
  {% else %}
    <a href="{% url 'login' %}">Sign in</a>
    <a href="{% url 'signup' %}">Sign up</a>
  {% endif %}
</nav>

from asgiref.sync import sync_to_async
from django.contrib.auth import aauthenticate, alogin, aupdate_session_auth_hash
from django.contrib.auth.password_validation import validate_password
from django.core.exceptions import ValidationError
from django.http import JsonResponse
from django.views.decorators.http import require_POST


@require_POST
async def async_login(request):
    user = await aauthenticate(
        request,
        username=request.POST.get("username", ""),
        password=request.POST.get("password", ""),
    )
    if user is None:
        return JsonResponse({"detail": "invalid credentials"}, status=400)
    await alogin(request, user)
    return JsonResponse({"username": user.get_username()})


async def async_whoami(request):
    user = await request.auser()
    if not user.is_authenticated:
        return JsonResponse({"detail": "not signed in"}, status=401)
    return JsonResponse({"username": user.get_username(), "staff": user.is_staff})


@require_POST
async def async_change_password(request):
    user = await request.auser()
    if not user.is_authenticated:
        return JsonResponse({"detail": "not signed in"}, status=401)
    if not await user.acheck_password(request.POST.get("old_password", "")):
        return JsonResponse({"detail": "wrong password"}, status=400)
    new_password = request.POST.get("new_password", "")
    try:
        await sync_to_async(validate_password)(new_password, user)
    except ValidationError as exc:
        return JsonResponse({"detail": exc.messages}, status=400)
    user.set_password(new_password)  # CPU-bound hashing: it blocks the event loop for a moment
    await user.asave(update_fields=["password"])
    await aupdate_session_auth_hash(request, user)  # keep this session, rotate its key
    return JsonResponse({"detail": "changed"})

from django.test import AsyncClient


class AsyncAuthTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        cls.user = User.objects.create_user("reader", "reader@example.com", PW)

    async def test_async_login_whoami_and_shelf(self):
        c = AsyncClient()
        r = await c.get(reverse("async_whoami"))
        self.assertEqual(r.status_code, 401)
        r = await c.post(reverse("async_login"), {"username": "reader", "password": WRONG_PW})
        self.assertEqual(r.status_code, 400)
        r = await c.post(reverse("async_login"), {"username": "reader", "password": PW})
        self.assertEqual(r.json(), {"username": "reader"})
        r = await c.get(reverse("async_whoami"))
        self.assertEqual(r.json(), {"username": "reader", "staff": False})
        r = await c.get(reverse("catalog:async_shelf"))
        self.assertEqual(r.json(), {"shelf_of": "reader"})

    async def test_async_login_required_redirects(self):
        r = await AsyncClient().get(reverse("catalog:async_shelf"))
        self.assertEqual((r.status_code, r["Location"]), (302, "/accounts/login/?next=/async-shelf/"))

    async def test_async_password_change_keeps_this_session(self):
        c = AsyncClient()
        await c.alogin(username="reader", password=PW)
        other = AsyncClient()
        await other.alogin(username="reader", password=PW)
        new_pw = secrets.token_urlsafe(16)
        r = await c.post(reverse("async_change_password"), {"old_password": PW, "new_password": new_pw})
        self.assertEqual(r.json(), {"detail": "changed"})
        self.assertEqual((await c.get(reverse("async_whoami"))).status_code, 200)
        self.assertEqual((await other.get(reverse("async_whoami"))).status_code, 401)
        bad = await c.post(reverse("async_change_password"), {"old_password": new_pw, "new_password": "12345678"})
        self.assertEqual(bad.status_code, 400)

from django.test import override_settings


class InactiveUserTests(TestCase):
    @classmethod
    def setUpTestData(cls):
        cls.user = User.objects.create_user("reader", "reader@example.com", PW)

    def test_inactive_user_cannot_log_in(self):
        User.objects.filter(pk=self.user.pk).update(is_active=False)
        r = self.client.post(reverse("manual_login"), {"username": "reader", "password": PW})
        self.assertContains(r, "Please enter a correct username and password")   # ModelBackend returns None

    @override_settings(AUTHENTICATION_BACKENDS=["django.contrib.auth.backends.AllowAllUsersModelBackend"])
    def test_allow_all_users_backend_reaches_the_form_check(self):
        User.objects.filter(pk=self.user.pk).update(is_active=False)
        r = self.client.post(reverse("manual_login"), {"username": "reader", "password": PW})
        self.assertContains(r, "This account is inactive.")