密码不会与 Django 以及一些缺失的列一起散列

Question

I'm not sure why my passwords are not hashed when creating a new custom user (email as username) using Django Rest Framework

This is what I see in postgres. Not sure why my admin/staff/active columns aren't showing up either even after migrating

models.py

from django.db import models
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager

class UserManager(BaseUserManager):
    def create_user(self, email, password=None, first_name=None, last_name=None, is_active=True, is_staff=False, is_admin=False):
        if not email or not first_name or not last_name:
            raise ValueError('Email is required')
        if not password:
            raise ValueError('Password is required')
        if not first_name:
            raise ValueError('First name is required')
        if not last_name:
            raise ValueError('Last name is required')

        user_object = self.model(
            email=self.normalize_email(email),
            first_name=first_name,
            last_name=last_name,
            active=is_active,
            staff=is_staff,
            admin=is_admin,
        )
        user_object.set_password(password) # change password
        user_object.save(self._db)
        return user_object

    def create_staff_user(self, email, first_name, last_name, password=None):
        staff_user_object = self.create_user(email, first_name, last_name, password, is_staff=True)
        return staff_user_object

    def create_superuser(self, email, first_name, last_name, password=None):
        super_user_object = self.create_user(email, first_name, last_name, password, is_staff=True, is_admin=True)
        return super_user_object


class User(AbstractBaseUser):
    email = models.EmailField(unique=True, max_length=255)
    first_name = models.CharField(max_length=255)
    last_name = models.CharField(max_length=255)
    date_joined = models.DateTimeField(auto_now_add=True)    # joined timestamp
    is_active = models.BooleanField(default=True)    # Can login?
    is_staff = models.BooleanField(default=False)    # staff user, non super user
    is_admin = models.BooleanField(default=False)    # super user?

    objects = UserManager()
    USERNAME_FIELD = 'email'
    EMAIL_FIELD = 'email'
    REQUIRED_FIELDS = []    # email and passwords are required by default

settings.py

PASSWORD_HASHERS = [
    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',   # Using Bcrypt to store passwords

views.py

class UserList(generics.ListCreateAPIView):
    """ List all Users, or create a new User. """
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    """ Retrieve, update or delete a User instance. """
    queryset = User.objects.all()
    serializer_class = UserSerializer
]

urls.py

urlpatterns = [
    path('accounts/', views.UserList.as_view()),
    path('accounts/<int:pk>/', views.UserDetail.as_view()),
]

serializer.py

from rest_framework import serializers
from .models import User
from properties.models import Property

class UserSerializer(serializers.ModelSerializer):
    properties = serializers.PrimaryKeyRelatedField(many=True, queryset=Property.objects.all())

    class Meta:
        model = User
        fields = '__all__'

Answer 1

The DRF serializer calls the default create() method of the model and it won't call the .set_password() method. So, You have to call the method explicitly in your create() method of UserSerializer

class UserSerializer(serializers.ModelSerializer):
    # other code