优化Django REST Framework自定义用户模型登录认证流程

# account/models.py

from django.contrib.auth.models import AbstractBaseUser, PermissionsMixin
from django.contrib.auth.base_user import BaseUserManager
from django.utils.translation import gettext_lazy as _
from django.db import models

class CustomUserManager(BaseUserManager):
    use_in_migrations = True

    def create_user(self, email, password=None, **extra_fields):
        if not email:
            raise ValueError('The Email must be set')
        email = self.normalize_email(email)
        user = self.model(email=email, **extra_fields)
        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_superuser(self, email, password=None, **extra_fields):
        extra_fields.setdefault('is_staff', True)
        extra_fields.setdefault('is_superuser', True)
        # For AppUser, username is required, so we might need to pass it here or make it optional for superuser creation
        # For simplicity, assuming create_user handles it or we'll add it to REQUIRED_FIELDS
        if not email:
            raise ValueError('An email is required.')
        if not password:
            raise ValueError('A password is required.')
        user = self.create_user(email, password, **extra_fields)
        user.is_superuser = True
        user.is_staff = True # Ensure superusers are also staff
        user.save(using=self._db)
        return user

class AppUser(AbstractBaseUser, PermissionsMixin):
    user_id = models.AutoField(primary_key=True)
    email = models.EmailField(max_length=50, unique=True)
    username = models.CharField(max_length=50) # Note: username is required here
    is_staff = models.BooleanField(default=False)
    is_active = models.BooleanField(default=True)

    USERNAME_FIELD = 'email'
    REQUIRED_FIELDS = ['username'] # Required when creating a user via createsuperuser or custom management commands

    objects = CustomUserManager()

    def __str__(self):
        return self.username

# settings.py
AUTH_USER_MODEL = 'account.AppUser'

# account/serializers.py
from rest_framework import serializers
from django.contrib.auth import get_user_model

UserModel = get_user_model()

class UserRegisterSerializer(serializers.ModelSerializer):
    class Meta:
        model = UserModel
        fields = ['email', 'username', 'password']
        extra_kwargs = {'password': {'write_only': True}} # 密码应只写

    def create(self, validated_data): # 使用标准的create方法，而不是create_user
        user_obj = UserModel.objects.create_user(
            email=validated_data['email'], 
            password=validated_data['password'],
            username=validated_data['username'] # 确保username也被传递
        )
        return user_obj

# account/serializers.py
# ... (previous imports)

class UserLoginSerializer(serializers.Serializer):
    email = serializers.EmailField()
    password = serializers.CharField(write_only=True) # 密码应只写

    # 移除 validate 方法中的认证逻辑，将其移至视图
    # def validate(self, data):
    #     ... (此处的认证逻辑应移除)

# account/views.py
from django.contrib.auth import authenticate, login, logout
from rest_framework.authentication import SessionAuthentication
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import permissions, status
from .serializers import UserRegisterSerializer, UserLoginSerializer, UserSerializer
# from .validations import custom_validation, validate_email, validate_password # 如果需要，保留自定义验证

class UserRegister(APIView):
    permission_classes = (permissions.AllowAny,)
    def post(self, request):
        # clean_data = custom_validation(request.data) # 如果有自定义验证，可以先处理
        serializer = UserRegisterSerializer(data=request.data)
        if serializer.is_valid(raise_exception=True):
            user = serializer.save() # 调用serializer的save方法，它会调用ModelSerializer的create方法
            if user:
                return Response(UserSerializer(user).data, status=status.HTTP_201_CREATED) # 返回用户数据
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)


class UserLogin(APIView):
    permission_classes = (permissions.AllowAny,)
    authentication_classes = (SessionAuthentication,) # 如果使用Session认证，请保留

    def post(self, request):
        serializer = UserLoginSerializer(data=request.data)
        serializer.is_valid(raise_exception=True) # 仅验证数据格式

        email = serializer.validated_data['email']
        password = serializer.validated_data['password']

        # 核心：在视图中调用 authenticate
        user = authenticate(request=request, email=email, password=password)

        if user is not None:
            if user.is_active:
                login(request, user) # 使用Django的login函数进行会话管理
                # 返回成功响应，可以包含用户数据或成功消息
                return Response({"message": "Login successful", "user": UserSerializer(user).data}, status=status.HTTP_200_OK)
            else:
                return Response({"non_field_errors": ["User account is not active."]}, status=status.HTTP_403_FORBIDDEN)
        else:
            # 用户不存在或密码不正确
            return Response({"non_field_errors": ["Invalid credentials."]}, status=status.HTTP_400_BAD_REQUEST)


class UserLogout(APIView):
    permission_classes = (permissions.AllowAny,) # 允许任何用户登出
    authentication_classes = () # 登出通常不需要认证

    def post(self, request):
        logout(request)
        return Response({"message": "Successfully logged out."}, status=status.HTTP_200_OK)


class UserView(APIView):
    permission_classes = (permissions.IsAuthenticated,)
    authentication_classes = (SessionAuthentication,)

    def get(self, request):
        serializer = UserSerializer(request.user)
        return Response({'user': serializer.data}, status=status.HTTP_200_OK)