Django AbstractBaseUserでカスタムユーザー作成

AbstractBaseUserを利用してUserモデルをカスタマイズし、ご多分に漏れずemailを利用したログイン認証に変更します。

Userモデルのカスタマイズ（拡張）自体の説明、および管理サイトではないログイン・ログアウト機能（画面）の実装については下記関連ページをご覧下さい。

関連ページ

ログイン時の認証においてusername以外を利用したい場合は、AbstractBaseUserを継承したモデルであるカスタムユーザーを作成する必要があります。本記事ではメールアドレス（email）をユニークとするモデルを作成します。※コード自体は公式サイトである「Django の認証方法のカスタマイズ」の完全な具体例を引用し、説明を加えています。

models.pyを編集しマネージャーとモデルを作成します。なお本記事ではmyappという名前のアプリケーションにおいて実装していきます。

myapp/models.py

from django.db import models
from django.contrib.auth.models import (
    BaseUserManager, AbstractBaseUser
)


class MyUserManager(BaseUserManager):
    def create_user(self, email, date_of_birth, password=None):
        """
        Creates and saves a User with the given email, date of
        birth and password.
        """
        if not email:
            raise ValueError('Users must have an email address')

        user = self.model(
            email=self.normalize_email(email),
            date_of_birth=date_of_birth,
        )

        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_superuser(self, email, date_of_birth, password=None):
        """
        Creates and saves a superuser with the given email, date of
        birth and password.
        """
        user = self.create_user(
            email,
            password=password,
            date_of_birth=date_of_birth,
        )
        user.is_admin = True
        user.save(using=self._db)
        return user


class MyUser(AbstractBaseUser):
    email = models.EmailField(
        verbose_name='メールアドレス',
        max_length=255,
        unique=True,
    )
    date_of_birth = models.DateField()
    is_active = models.BooleanField(default=True)
    is_admin = models.BooleanField(default=False)

    objects = MyUserManager()

    USERNAME_FIELD = 'email'
    REQUIRED_FIELDS = ['date_of_birth']

    def __str__(self):
        return self.email

    def has_perm(self, perm, obj=None):
        "Does the user have a specific permission?"
        # Simplest possible answer: Yes, always
        return True

    def has_module_perms(self, app_label):
        "Does the user have permissions to view the app `app_label`?"
        # Simplest possible answer: Yes, always
        return True

    @property
    def is_staff(self):
        "Is the user a member of staff?"
        # Simplest possible answer: All admins are staff
        return self.is_admin

from django.db import models

from django.contrib.auth.models import (

BaseUserManager, AbstractBaseUser

)

class MyUserManager(BaseUserManager):

def create_user(self, email, date_of_birth, password=None):

"""

Creates and saves a User with the given email, date of

birth and password.

"""

if not email:

raise ValueError('Users must have an email address')

user = self.model(

email=self.normalize_email(email),

date_of_birth=date_of_birth,

)

user.set_password(password)

user.save(using=self._db)

return user

def create_superuser(self, email, date_of_birth, password=None):

"""

Creates and saves a superuser with the given email, date of

birth and password.

"""

user = self.create_user(

email,

password=password,

date_of_birth=date_of_birth,

)

user.is_admin = True

user.save(using=self._db)

return user

class MyUser(AbstractBaseUser):

email = models.EmailField(

verbose_name='メールアドレス',

max_length=255,

unique=True,

)

date_of_birth = models.DateField()

is_active = models.BooleanField(default=True)

is_admin = models.BooleanField(default=False)

objects = MyUserManager()

USERNAME_FIELD = 'email'

REQUIRED_FIELDS = ['date_of_birth']

def __str__(self):

return self.email

def has_perm(self, perm, obj=None):

"Does the user have a specific permission?"

# Simplest possible answer: Yes, always

return True

def has_module_perms(self, app_label):

"Does the user have permissions to view the app `app_label`?"

# Simplest possible answer: Yes, always

return True

@property

def is_staff(self):

"Is the user a member of staff?"

# Simplest possible answer: All admins are staff

return self.is_admin

7〜37行目

AbstractBaseUserを利用してカスタムユーザーを作成する場合、BaseUserManagerを継承したカスタムマネージャーを実装する必要があります。create_userは通常のユーザーを作成する場合に、create_superuserは「python manage.py createsuperuser」コマンドで管理者ユーザーを作成する場合などに利用されます。

40〜72行目

AbstractBaseUserを継承しMyUserクラスとしてのモデルを作成しています。AbstractUserと違いフィールドを全て記述する必要があります。モデルにはユニークなフィールドを指定する必要があり、52行目のUSERNAME_FIELDにて本記事の目的であるメールアドレスを設定しています。もし既に登録されたユーザーと同じメールアドレスを登録しようとするとバリデーションによってエラーとなります。

次にadmin.pyを編集し、管理サイト内（http://localhost:8000/admin/）でカスタムユーザーを登録・編集できるようにします。

myapp/admin.py

from django import forms
from django.contrib import admin
from django.contrib.auth.models import Group
from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
from django.contrib.auth.forms import ReadOnlyPasswordHashField

from .models import MyUser


class UserCreationForm(forms.ModelForm):
    """A form for creating new users. Includes all the required
    fields, plus a repeated password."""
    password1 = forms.CharField(label='Password', widget=forms.PasswordInput)
    password2 = forms.CharField(
        label='Password confirmation', widget=forms.PasswordInput)

    class Meta:
        model = MyUser
        fields = ('email', 'date_of_birth')

    def clean_password2(self):
        # Check that the two password entries match
        password1 = self.cleaned_data.get("password1")
        password2 = self.cleaned_data.get("password2")
        if password1 and password2 and password1 != password2:
            raise forms.ValidationError("Passwords don't match")
        return password2

    def save(self, commit=True):
        # Save the provided password in hashed format
        user = super().save(commit=False)
        user.set_password(self.cleaned_data["password1"])
        if commit:
            user.save()
        return user


class UserChangeForm(forms.ModelForm):
    """A form for updating users. Includes all the fields on
    the user, but replaces the password field with admin's
    password hash display field.
    """
    password = ReadOnlyPasswordHashField()

    class Meta:
        model = MyUser
        fields = ('email', 'password', 'date_of_birth',
                  'is_active', 'is_admin')

    def clean_password(self):
        # Regardless of what the user provides, return the initial value.
        # This is done here, rather than on the field, because the
        # field does not have access to the initial value
        return self.initial["password"]


class UserAdmin(BaseUserAdmin):
    # The forms to add and change user instances
    form = UserChangeForm
    add_form = UserCreationForm

    # The fields to be used in displaying the User model.
    # These override the definitions on the base UserAdmin
    # that reference specific fields on auth.User.
    list_display = ('email', 'date_of_birth', 'is_admin')
    list_filter = ('is_admin',)
    fieldsets = (
        (None, {'fields': ('email', 'password')}),
        ('Personal info', {'fields': ('date_of_birth',)}),
        ('Permissions', {'fields': ('is_admin',)}),
    )
    # add_fieldsets is not a standard ModelAdmin attribute. UserAdmin
    # overrides get_fieldsets to use this attribute when creating a user.
    add_fieldsets = (
        (None, {
            'classes': ('wide',),
            'fields': ('email', 'date_of_birth', 'password1', 'password2'),
        }),
    )
    search_fields = ('email',)
    ordering = ('email',)
    filter_horizontal = ()


# Now register the new UserAdmin...
admin.site.register(MyUser, UserAdmin)
# ... and, since we're not using Django's built-in permissions,
# unregister the Group model from admin.
admin.site.unregister(Group)

from django import forms

from django.contrib import admin

from django.contrib.auth.models import Group

from django.contrib.auth.admin import UserAdmin as BaseUserAdmin

from django.contrib.auth.forms import ReadOnlyPasswordHashField

from .models import MyUser

class UserCreationForm(forms.ModelForm):

"""A form for creating new users. Includes all the required

fields, plus a repeated password."""

password1 = forms.CharField(label='Password', widget=forms.PasswordInput)

password2 = forms.CharField(

label='Password confirmation', widget=forms.PasswordInput)

class Meta:

model = MyUser

fields = ('email', 'date_of_birth')

def clean_password2(self):

# Check that the two password entries match

password1 = self.cleaned_data.get("password1")

password2 = self.cleaned_data.get("password2")

if password1 and password2 and password1 != password2:

raise forms.ValidationError("Passwords don't match")

return password2

def save(self, commit=True):

# Save the provided password in hashed format

user = super().save(commit=False)

user.set_password(self.cleaned_data["password1"])

if commit:

user.save()

return user

class UserChangeForm(forms.ModelForm):

"""A form for updating users. Includes all the fields on

the user, but replaces the password field with admin's

password hash display field.

"""

password = ReadOnlyPasswordHashField()

class Meta:

model = MyUser

fields = ('email', 'password', 'date_of_birth',

'is_active', 'is_admin')

def clean_password(self):

# Regardless of what the user provides, return the initial value.

# This is done here, rather than on the field, because the

# field does not have access to the initial value

return self.initial["password"]

class UserAdmin(BaseUserAdmin):

# The forms to add and change user instances

form = UserChangeForm

add_form = UserCreationForm

# The fields to be used in displaying the User model.

# These override the definitions on the base UserAdmin

# that reference specific fields on auth.User.

list_display = ('email', 'date_of_birth', 'is_admin')

list_filter = ('is_admin',)

fieldsets = (

(None, {'fields': ('email', 'password')}),

('Personal info', {'fields': ('date_of_birth',)}),

('Permissions', {'fields': ('is_admin',)}),

)

# add_fieldsets is not a standard ModelAdmin attribute. UserAdmin

# overrides get_fieldsets to use this attribute when creating a user.

add_fieldsets = (

(None, {

'classes': ('wide',),

'fields': ('email', 'date_of_birth', 'password1', 'password2'),

}),

)

search_fields = ('email',)

ordering = ('email',)

filter_horizontal = ()

# Now register the new UserAdmin...

admin.site.register(MyUser, UserAdmin)

# ... and, since we're not using Django's built-in permissions,

# unregister the Group model from admin.

admin.site.unregister(Group)

ModelFormを継承したUserCreationForm（10行目〜）およびUserChangeForm（38行目〜）を作成し、管理サイトにおいてユーザーの新規作成および編集フォームを構築しています。

モデルからフォーム画面を作成 [ModelForm]

setting.pyに下記項目を追記します。MyUserはカスタマイズしたモデルの名前です。

AUTH_USER_MODEL = 'myapp.MyUser'

1	AUTH_USER_MODEL = 'myapp.MyUser'

マイグレーションファイルの作成と実行。

$ python manage.py makemigrations myapp
$ python manage.py migrate

1 2	$ python manage.py makemigrations myapp $ python manage.py migrate

スーパーユーザー（管理ユーザー）を作成します。カスタマイズされていることが確認できます。

$ python manage.py createsuperuser
Email address: hoge@hoge.co.jp
Date of birth: 2000-01-01
Password: 
Password (again):

$ python manage.py createsuperuser

Email address: hoge@hoge.co.jp

Date of birth: 2000-01-01

Password:

Password (again):

参照ページ

django ドキュメント

Django の認証方法のカスタマイズ

思考の葉

プログラミング時々、批評

思考の葉

プログラミング時々、批評

Django AbstractBaseUserでカスタムユーザー作成