dj-rest-auth：ACCOUNT_LOGIN_ON_EMAIL_CONFIRMATION 不工作

Question

I'm using dj-rest-auth, allauth, and simple jwt to implement authentication.

In django-allauth, setting ACCOUNT_LOGIN_ON_EMAIL_CONFIRMATION=True will automatically login user after the email is verified. But posting key to "/dj-rest-auth/registration/verify-email/" only returns {"detail":"ok"}.

The source code below explains why:

# allauth
class ConfirmEmailView(TemplateResponseMixin, LogoutFunctionalityMixin, View):
    # ...

    def post(self, *args, **kwargs):
        # ...

        if app_settings.LOGIN_ON_EMAIL_CONFIRMATION:
            resp = self.login_on_confirm(confirmation)
            if resp is not None:
                return resp # this is a HttpResponseRedirect object

# ...
# dj-rest-auth
class VerifyEmailView(APIView, ConfirmEmailView):
    # ...

    def post(self, request, *args, **kwargs):
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.kwargs['key'] = serializer.validated_data['key']
        confirmation = self.get_object()
        confirmation.confirm(self.request)
        return Response({'detail': _('ok')}, status=status.HTTP_200_OK)

Since I'm using JWT, how could I override this view to login user after verification and return access code?

Answer 1

You should take that confirmation object, write confirmation.email_address which is a django-allauth EmailAddress model object, then get the user (ie your User model). All in all, just do confirmation.email_address.user . Finally, generate a JWT from the user object.

To generate the proper JSON response, instantiate the LoginView class, set the user class attribute by doing view = LoginView(); view.user = confirmation.email_address.user; # TODO do view.login() but you need to customize it so that you don't call user view = LoginView(); view.user = confirmation.email_address.user; # TODO do view.login() but you need to customize it so that you don't call user view = LoginView(); view.user = confirmation.email_address.user; # TODO do view.login() but you need to customize it so that you don't call user , and grab Response object by doing LoginView().get_response()

Make sure you check for all edge cases like if email address does not exist etc.

All in all:

class CustomVerifyEmailView(VerifyEmailView):
    # ...

    def post(self, *args, **kwargs):
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.kwargs['key'] = serializer.validated_data['key']
        confirmation = self.get_object()
        confirmation.confirm(self.request)
        login_view = LoginView()
        login_view.user = confirmation.email_address.user

        if getattr(settings, 'REST_USE_JWT', False):
            self.access_token, self.refresh_token = jwt_encode(self.user)
        else:
            self.token = create_token(
                self.token_model, self.user,
                self.serializer,
            )

        if getattr(settings, 'REST_SESSION_LOGIN', True):
            self.process_login()

        return login_view.get_response()

Let us know if that works!

References:

• confirmation object perma
• email address model perma

I've posted this in your GitHub issue as well. So hopefully whatever edits happen here also land there too.

Answer 2

I had to deal with the exact same case and what seems to work quite well for me is the following

1. Create a custome email verify view instead of use the provided one from the dj_rest_auth.
2. Copy most of the code from the original VerifyEmailView's own post method
3. add a line to get jwt tokens (self.access_token, self.refresh_token = jwt_encode(confirmation.email_address.user))
4. Response with tokens

all and all my Custom view looks like this

from dj_rest_auth.utils import jwt_encode
from dj_rest_auth.registration.views import VerifyEmailView

class CustomeVerifyEmailView(VerifyEmailView):
    
    def post(self, request, *args, **kwargs):
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.kwargs['key'] = serializer.validated_data['key']
        confirmation = self.get_object()
        confirmation.confirm(self.request)
       
        self.access_token, self.refresh_token = jwt_encode(confirmation.email_address.user)
        return Response({"refresh": str(self.refresh_token), "access": str(self.access_token)})

Answer 3

I got the following working based on a combination of ideas from both of the above two answers and comments on the github issue :

from dj_rest_auth.utils import jwt_encode
from dj_rest_auth.registration.views import VerifyEmailView, LoginView

from dj_rest_auth.registration import views

class CustomVerifyEmailView(VerifyEmailView):
    def post(self, request, *args, **kwargs):
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.kwargs['key'] = serializer.validated_data['key']
        confirmation = self.get_object()
        confirmation.confirm(self.request)

        login_view = LoginView()

        self.user = login_view.user = confirmation.email_address.user 

        if getattr(settings, 'REST_USE_JWT', False):
            self.access_token, self.refresh_token = jwt_encode(self.user)
        else:
            #you'll have to figure this out if you need it. I didn't.
            raise NotImplementedError 


        data = {
            'user': self.user,
            'access_token': self.access_token,
            'refresh_token': self.refresh_token
            }

        login_response_serializer = login_view.get_response_serializer()
        login_serializer = login_response_serializer(instance=data)

        return Response(login_serializer.data, status=status.HTTP_200_OK)
        

views.VerifyEmailView = CustomVerifyEmailView