Form Validation & Validators

from django import forms
from django.core.exceptions import ValidationError
from django.core.validators import validate_email

trace = []  # for the demonstration only


class MultiEmailField(forms.Field):
    def to_python(self, value):
        trace.append("MultiEmailField.to_python")
        if not value:
            return []
        return [v.strip() for v in value.split(",")]

    def validate(self, value):
        trace.append("MultiEmailField.validate")
        super().validate(value)          # handles required=True
        for email in value:
            validate_email(email)

    def run_validators(self, value):
        trace.append("MultiEmailField.run_validators")
        super().run_validators(value)    # normally you never override this


class ShareBookForm(forms.Form):
    subject = forms.CharField(max_length=100)
    message = forms.CharField(widget=forms.Textarea)
    recipients = MultiEmailField()
    urgent = forms.BooleanField(required=False)

    def clean_recipients(self):
        trace.append("clean_recipients")
        data = self.cleaned_data["recipients"]
        if not all(e.endswith("@example.com") for e in data):
            raise ValidationError(
                "All recipients must be @example.com.", code="wrong_domain"
            )
        return data

    def clean(self):
        trace.append("clean")
        return super().clean()

class FormCycleTests(TestCase):
    def test_order(self):
        forms_module.trace.clear()
        f = ShareBookForm(
            {"subject": "hi", "message": "m", "recipients": "a@example.com", "urgent": ""}
        )
        self.assertTrue(f.is_valid())
        self.assertEqual(forms_module.trace, [
            "MultiEmailField.to_python", "MultiEmailField.validate",
            "MultiEmailField.run_validators", "clean_recipients", "clean"])

    def test_field_error_skips_clean_field_but_not_clean(self):
        forms_module.trace.clear()
        f = ShareBookForm({"subject": "hi", "message": "m", "recipients": "nope"})
        self.assertFalse(f.is_valid())
        self.assertNotIn("clean_recipients", forms_module.trace)
        self.assertIn("clean", forms_module.trace)

$ python manage.py check
System check identified no issues (0 silenced).
$ python manage.py test catalog
Found 25 test(s).
...
Ran 25 tests in 0.034s

OK

from django.core.exceptions import ValidationError
from django.utils.translation import gettext_lazy as _

raise ValidationError(
    _("Invalid value: %(value)s"),
    code="invalid",
    params={"value": "42"},
)

raise ValidationError(
    [
        ValidationError(_("Error 1"), code="error1"),
        ValidationError(_("Error 2"), code="error2"),
    ]
)

class ShareBookForm(forms.Form):
    ...  # fields, clean_recipients as before

    def clean(self):
        cleaned_data = super().clean()
        urgent = cleaned_data.get("urgent")
        subject = cleaned_data.get("subject")
        if urgent and subject and "help" not in subject:
            self.add_error(
                "subject",
                ValidationError(
                    "Urgent requests need %(word)r in the subject.",
                    code="needs_help_word",
                    params={"word": "help"},
                ),
            )
            self.add_error("urgent", "Do not mark it urgent without that word.")
        if len(cleaned_data.get("recipients", [])) > 5:
            self.add_error(None, "At most five recipients are allowed.")
        return cleaned_data

>>> f = ShareBookForm({"subject": "hi", "message": "m", "urgent": "on",
...     "recipients": "a@example.com,b@example.com,c@example.com,d@example.com,e@example.com,f@example.com"})
>>> f.is_valid()
False
>>> f.errors.get_json_data()
{'subject': [{'message': "Urgent requests need 'help' in the subject.", 'code': 'needs_help_word'}],
 'urgent': [{'message': 'Do not mark it urgent without that word.', 'code': ''}],
 '__all__': [{'message': 'At most five recipients are allowed.', 'code': ''}]}
>>> f.has_error("subject", code="needs_help_word")
True
>>> sorted(f.cleaned_data)       # subject and urgent were removed by add_error()
['message', 'recipients']
>>> f.non_field_errors()
<ul class="errorlist nonfield"><li>At most five recipients are allowed.</li></ul>

from datetime import date

from django.core.exceptions import ValidationError
from django.core.validators import MinValueValidator
from django.db import models
from django.db.models import F, Q
from django.db.models.functions import Lower

from .validators import MaxWordsValidator, validate_isbn13, validate_slugish_title


class Author(models.Model):
    name = models.CharField(max_length=100)


class Book(models.Model):
    title = models.CharField(max_length=200, validators=[validate_slugish_title])
    isbn = models.CharField(max_length=17, unique=True, validators=[validate_isbn13])
    summary = models.TextField(blank=True, validators=[MaxWordsValidator(50)])
    pages = models.PositiveIntegerField(validators=[MinValueValidator(1)])
    published = models.DateField(null=True, blank=True)
    discount_price = models.DecimalField(max_digits=6, decimal_places=2, null=True, blank=True)
    price = models.DecimalField(max_digits=6, decimal_places=2)
    author = models.ForeignKey(Author, on_delete=models.CASCADE)

    class Meta:
        constraints = [
            models.CheckConstraint(
                condition=Q(discount_price__isnull=True) | Q(discount_price__lt=F("price")),
                name="catalog_book_discount_below_price",
                violation_error_code="discount_too_high",
                violation_error_message="The discount price must be lower than the price.",
            ),
            models.UniqueConstraint(
                Lower("title"),
                "author",
                name="catalog_book_unique_title_per_author",
                violation_error_code="duplicate_title",
                violation_error_message="This author already has a book with that title.",
            ),
        ]

    def clean(self):
        if self.published and self.published > date.today():
            raise ValidationError({"published": "Publication date cannot be in the future."})

def test_check_constraint_validation(self):
    b = make_book(self.author, discount_price=Decimal("12.00"))
    with self.assertRaises(ValidationError) as cm:
        b.full_clean()
    err = cm.exception.error_dict["__all__"][0]
    self.assertEqual(err.code, "discount_too_high")
    self.assertEqual(err.message, "The discount price must be lower than the price.")

def test_unique_constraint_functional(self):
    make_book(self.author).save()
    dup = make_book(self.author, isbn="978-1-4028-9462-6", title="DUNE")  # different case
    with self.assertRaises(ValidationError) as cm:
        dup.full_clean()
    self.assertEqual(cm.exception.error_dict["__all__"][0].code, "duplicate_title")

def test_exclude_skips_constraint(self):
    b = make_book(self.author, discount_price=Decimal("12.00"))
    b.full_clean(exclude={"price"})        # the constraint needs price, so it is ignored

def test_validate_constraints_directly(self):
    b = make_book(self.author, discount_price=Decimal("12.00"))
    with self.assertRaises(ValidationError):
        b.validate_constraints()
    b.full_clean(validate_constraints=False)

class BookForm(forms.ModelForm):
    class Meta:
        model = Book
        fields = ["title", "isbn", "summary", "pages", "published",
                  "price", "discount_price", "author"]

    def clean(self):
        cleaned_data = super().clean()   # keep this: it enables unique and constraint validation
        price = cleaned_data.get("price")
        discount = cleaned_data.get("discount_price")
        if price is not None and discount is not None and discount >= price:
            self.add_error("discount_price", "Must be below the price.")
        return cleaned_data


class BookNoSuperForm(BookForm):
    """Pitfall: overriding clean() without calling super() skips uniqueness checks."""

    def clean(self):
        return self.cleaned_data

def test_no_super_skips_unique_checks(self):
    make_book(self.author).save()
    ok = BookNoSuperForm(self.data(title="Other"))     # the ISBN duplicates an existing book
    self.assertTrue(ok.is_valid())                      # validation did not notice...
    with self.assertRaises(IntegrityError), transaction.atomic():
        ok.save()                                       # ...the database did
    good = BookForm(self.data(title="Other"))
    self.assertFalse(good.is_valid())
    self.assertIn("isbn", good.errors)

def test_form_catches_unique_and_constraint(self):
    make_book(self.author).save()
    f = BookForm(self.data(title="dune", isbn="978-1-4028-9462-6"))
    self.assertFalse(f.is_valid())
    self.assertTrue(f.has_error("__all__", "duplicate_title"))

from django.shortcuts import redirect, render
from django.views.decorators.http import require_http_methods

from .forms import BookForm


@require_http_methods(["GET", "POST"])
def book_create(request):
    form = BookForm(request.POST or None)
    if request.method == "POST" and form.is_valid():
        form.save()
        return redirect("book-created")
    status = 422 if form.errors else 200
    return render(request, "catalog/book_form.html", {"form": form}, status=status)

$ curl -s -c jar http://127.0.0.1:8134/books/new/ -o /dev/null
$ curl -s -b jar -w 'HTTP %{http_code}\n' -X POST http://127.0.0.1:8134/books/new/ \
    -H "X-CSRFToken: $(awk '/csrftoken/ {print $7}' jar)" \
    --data "title=Dune&isbn=978-0-306-40615-8&pages=0&price=10&discount_price=12&author=1" \
  | grep -o '<li>[^<]*</li>\|HTTP.*'
<li>978-0-306-40615-8 has a wrong ISBN-13 check digit.</li>
<li>Ensure this value is greater than or equal to 1.</li>
<li>Must be below the price.</li>
HTTP 422

async def test_model_form_is_valid_needs_a_thread(self):
    from asgiref.sync import sync_to_async
    from django.core.exceptions import SynchronousOnlyOperation

    author = await Author.objects.acreate(name="Async")
    data = {"title": "Dune", "isbn": GOOD_ISBN, "summary": "", "pages": "1", "published": "",
            "price": "10.00", "discount_price": "", "author": str(author.pk)}
    with self.assertRaises(SynchronousOnlyOperation):
        BookForm(data).is_valid()
    form = BookForm(data)
    self.assertTrue(await sync_to_async(form.is_valid)())