I'm trying to integrate django validators 1.9 with django rest framework serializers. But the serialized 'user' (of django rest framework) is not compatible with the django validators.
Here is the serializers.py
import django.contrib.auth.password_validation as validators from rest_framework import serializers class RegisterUserSerializer(serializers.ModelSerializer): password = serializers.CharField(style={'input_type': 'password'}, write_only=True) class Meta: model = User fields = ('id', 'username', 'email, 'password') def validate_password(self, data): validators.validate_password(password=data, user=User) return data def create(self, validated_data): user = User.objects.create_user(**validated_data) user.is_active = False user.save() return user
I managed to get MinimumLengthValidator and NumericPasswordValidator correct because both function validate don't use 'user' in validating. Source code is here
Excerpt from django source code:
def validate(self, password, user=None): if password.isdigit(): raise ValidationError( _("This password is entirely numeric."), code='password_entirely_numeric', )
For other validators like UserAttributeSimilarityValidator, the function uses another one argument 'user' in validating ('user' is django User model, if I'm not wrong)
Excerpt from django source code:
def validate(self, password, user=None): if not user: return for attribute_name in self.user_attributes: value = getattr(user, attribute_name, None)
How can I change serialized User into what django validators(UserAttributeSimilarityValidator) can see
Excerpt from django source code:
def validate(self, password, user=None): if not user: return for attribute_name in self.user_attributes: value = getattr(user, attribute_name, None) if not value or not isinstance(value, string_types): continue
Edit
Django Rest Framework can get all of Django's built-in password validation (but it's like a hack). Here's a problem:
The validationError is like this
[ValidationError(['This password is too short. It must contain at least 8 characters.']), ValidationError(['This password is entirely numeric.'])]
The validation doesn't contain a field. Django rest framework see it as
{ "non_field_errors": [ "This password is too short. It must contain at least 8 characters.", "This password is entirely numeric." ] }
How can I inject a field at raise ValidationError
Like you mentioned, when you validate the password in validate_password method using UserAttributeSimilarityValidator validator, you don't have the user object.
What I suggest that instead of doing field-level validation, you shall perform object-level validation by implementing validate method on the serializer:
import sys from django.core import exceptions import django.contrib.auth.password_validation as validators class RegisterUserSerializer(serializers.ModelSerializer): # rest of the code def validate(self, data): # here data has all the fields which have validated values # so we can create a User instance out of it user = User(**data) # get the password from the data password = data.get('password') errors = dict() try: # validate the password and catch the exception validators.validate_password(password=password, user=User) # the exception raised here is different than serializers.ValidationError except exceptions.ValidationError as e: errors['password'] = list(e.messages) if errors: raise serializers.ValidationError(errors) return super(RegisterUserSerializer, self).validate(data)
You can access the user object through self.instance on the serializer object, even when doing field-level validation. Something like this should work:
from django.contrib.auth import password_validation def validate_password(self, value): password_validation.validate_password(value, self.instance) return value
Use Serializers! Have a validate_fieldname method!
class UserSerializer(serializers.ModelSerializer): class Meta: model = User fields = ( 'id', 'username', 'password', 'first_name', 'last_name', 'email' ) extra_kwargs = { 'password': {'write_only': True}, 'username': {'read_only': True} } def validate_password(self, value): try: validate_password(value) except ValidationError as exc: raise serializers.ValidationError(str(exc)) return value def create(self, validated_data): validated_data = self.check_for_unique_email(validated_data) validated_data.setdefault('username', validated_data['email']) user = super().create(validated_data) user.set_password(validated_data['password']) user.is_active = False user.save() return user def update(self, instance, validated_data): validated_data = self.check_for_unique_email(validated_data) user = super().update(instance, validated_data) if 'password' in validated_data: user.set_password(validated_data['password']) user.save() return user
At the time of creating new user(registration) then self.instance will be none, it will work when your are resting the password, change password or updating user data with password. But if you want to check the password should not be similar to your email or username then you need to include "SequenceMatcher" in your validation
data = self.get_initial() username = data.get("username") email = data.get("email") password = data.get("password") max_similarity = 0.7 if SequenceMatcher(a=password.lower(), b=username.lower()).quick_ratio() > max_similarity: raise serializers.ValidationError("The password is too similar to the username.") if SequenceMatcher(a=password.lower(), b=email.lower()).quick_ratio() > max_similarity: raise serializers.ValidationError("The password is too similar to the email.")
