Django REST Framework自定义用户模型实现邮箱登录认证教程

# your_app_name/models.py
from django.db import models
from django.contrib.auth.models import AbstractBaseUser, PermissionsMixin
from django.utils.translation import gettext_lazy as _
from .managers import CustomUserManager # 假设你有一个自定义的用户管理器

class CustomUser(AbstractBaseUser, PermissionsMixin):
    email = models.EmailField(_("email address"), unique=True)
    is_staff = models.BooleanField(default=False)
    is_active = models.BooleanField(default=True)
    date_joined = models.DateTimeField(auto_now_add=True)
    is_company = models.BooleanField(blank=True, null=True)

    USERNAME_FIELD = "email" # 指定使用email作为登录用户名
    REQUIRED_FIELDS = [] # 对于AbstractBaseUser，email是USERNAME_FIELD，不需要在这里重复

    objects = CustomUserManager() # 使用自定义的用户管理器

    def __str__(self):
        return self.email

# your_project_name/settings.py
AUTH_USER_MODEL = 'your_app_name.CustomUser'

# your_app_name/backends.py
from django.contrib.auth.backends import ModelBackend
from django.contrib.auth import get_user_model
from django.db.models import Q, MultipleObjectsReturned

# 动态获取当前项目配置的用户模型，这是最佳实践
User = get_user_model()

class EmailBackend(ModelBackend):
    def authenticate(self, request, username=None, password=None, **kwargs):
        try:
            # 使用 Q 对象进行不区分大小写的邮箱匹配
            user = User.objects.get(Q(email__iexact=username))
        except User.DoesNotExist:
            # 如果用户不存在，应返回 None，而不是尝试设置密码
            return None
        except MultipleObjectsReturned:
            # 如果存在多个匹配的用户，通常返回第一个
            return User.objects.filter(email=username).order_by('id').first()
        else:
            # 验证密码并检查用户是否可认证
            if user.check_password(password) and self.user_can_authenticate(user):
                return user
        # 认证失败（如密码不匹配）时，也应返回 None
        return None

    def get_user(self, user_id):
        try:
            user = User.objects.get(pk=user_id)
        except User.DoesNotExist:
            return None
        return user if self.user_can_authenticate(user) else None

# your_project_name/settings.py
AUTHENTICATION_BACKENDS = [
    'your_app_name.backends.EmailBackend', # 你的自定义后端
    'django.contrib.auth.backends.ModelBackend', # Django默认的ModelBackend
]

# your_app_name/serializers.py
from rest_framework import serializers
from .models import CustomUser

class LoginSerializer(serializers.Serializer): # 继承 serializers.Serializer 即可
    email = serializers.EmailField()
    password = serializers.CharField(write_only=True) # 密码不应被序列化输出

    # 如果需要，可以添加一个 validate 方法来验证邮箱是否存在，但 authenticate 方法会处理
    # def validate(self, data):
    #     email = data.get('email')
    #     password = data.get('password')
    #     if not email or not password:
    #         raise serializers.ValidationError("Email and password are required.")
    #     return data

# your_app_name/views.py
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from rest_framework.authtoken.models import Token
from django.contrib.auth import authenticate # 导入Django的authenticate函数

from .serializers import LoginSerializer
from .models import CustomUser # 导入CustomUser模型

class LoginAPIView(APIView):
    def post(self, request):
        serializer = LoginSerializer(data=request.data)
        if serializer.is_valid():
            email = serializer.validated_data["email"]
            password = serializer.validated_data["password"]

            # 调用Django的authenticate函数，它会遍历所有注册的认证后端
            user = authenticate(request, username=email, password=password)

            if user is not None:
                # 认证成功，获取或创建Token
                token, created = Token.objects.get_or_create(user=user)
                response_data = {
                    "status": status.HTTP_200_OK,
                    "message": "success",
                    "data": {
                        "Token": token.key
                    }
                }
                return Response(response_data, status=status.HTTP_200_OK)
            else:
                # 认证失败
                response_data = {
                    "status": status.HTTP_401_UNAUTHORIZED,
                    "message": "Invalid Email or Password",
                }
                return Response(response_data, status=status.HTTP_401_UNAUTHORIZED)
        else:
            # 序列化器验证失败
            response_data = {
                "status": status.HTTP_400_BAD_REQUEST,
                "message": "Bad Request",
                "data": serializer.errors
            }
            return Response(response_data, status=status.HTTP_400_BAD_REQUEST)

# your_app_name/urls.py
from django.urls import path
from .views import LoginAPIView

urlpatterns = [
    path('login/', LoginAPIView.as_view(), name='login'),
]

# your_project_name/urls.py
from django.contrib import admin
from django.urls import path, include

urlpatterns = [
    path('admin/', admin.site.urls),
    path('api/', include('your_app_name.urls')),
]