duck.contrib.auth.decorators

Decorators for authentication.

Module Contents

Functions

condition_required

Restricts a view or View.run method to requests matching a condition evaluated against the request object.

login_required

Restricts a view or View.run method to authenticated users only.

set_default_login_url

Sets the fallback login_url used by login_required when a decorated view provides neither login_url nor login_url_resolver.

set_default_login_url_resolver

Sets the fallback login_url_resolver used by login_required when a decorated view provides neither login_url nor login_url_resolver.

user_required

Restricts a view or View.run method to authenticated users only, resolving the full user model and attaching it to the request.

Data

DEFAULT_LOGIN_URL

DEFAULT_LOGIN_URL_RESOLVER

API

duck.contrib.auth.decorators.DEFAULT_LOGIN_URL: Optional[str]

None

duck.contrib.auth.decorators.DEFAULT_LOGIN_URL_RESOLVER: Optional[Callable]

None

duck.contrib.auth.decorators.condition_required(condition: Callable[..., bool], view: Optional[Union[Callable, duck.views.View]] = None, *, redirect_url: Optional[str] = None, redirect_url_resolver: Optional[Callable] = None, condition_args: Optional[tuple] = None, condition_kwargs: Optional[dict] = None)[source]

Restricts a view or View.run method to requests matching a condition evaluated against the request object.

Generalizes login_required/user_required into an arbitrary predicate, e.g. request.user.is_staff or request.headers.get(…). Use a plain function for sync views and a coroutine function for async views, matching the handler’s own nature.

Parameters:

  • condition – Callable receiving request (plus any condition_args/condition_kwargs) and returning a bool. This can be either a synchronous or asynchronous condition.

  • view – The view function or View.run method being decorated. Left as None when the decorator is called with arguments, e.g. @condition_required(is_staff, redirect_url="/login").

  • redirect_url – A fixed route name or path to redirect to when the condition fails. Passed through resolve() first, falling back to the raw value if resolution fails (e.g. it’s already a raw path).

  • redirect_url_resolver – A callable receiving the request and returning the redirect URL as a string. Use this when the destination depends on request state, e.g. a next param.

  • condition_args – Positional args forwarded to condition after request.

  • condition_kwargs – Keyword args forwarded to condition after request.

Returns:

The decorated view, or a decorator awaiting the view if called with keyword arguments only.

Raises:

ValueError – If both redirect_url and redirect_url_resolver are given, or if neither is given and no default is set.

duck.contrib.auth.decorators.login_required(view: Optional[Union[Callable, duck.views.View]] = None, *, login_url: Optional[str] = None, login_url_resolver: Optional[Callable] = None)[source]

Restricts a view or View.run method to authenticated users only.

Wraps a Duck view so unauthenticated requests are redirected instead of reaching the handler. Works on plain view functions and on View.run methods alike, and supports both sync and async handlers.

If neither login_url nor login_url_resolver is given, the values set via set_default_login_url/set_default_login_url_resolver are used instead. Exactly one source, explicit or default, must resolve for the decorator to know where to redirect.

Parameters:

  • view – The view function or View.run method being decorated. Left as None when the decorator is called with arguments, e.g. @login_required(login_url="/login").

  • login_url – A fixed route name or path to redirect to. Passed through resolve() first, falling back to the raw value if resolution fails (e.g. it’s already a raw path).

  • login_url_resolver – A callable receiving the request and returning the redirect URL as a string. Use this when the destination depends on request state, e.g. a next param.

Returns:

The decorated view, or a decorator awaiting the view if called with keyword arguments only.

Raises:

ValueError – If both login_url and login_url_resolver are given, or if neither is given and no default is set.

duck.contrib.auth.decorators.set_default_login_url(login_url: str) → None[source]

Sets the fallback login_url used by login_required when a decorated view provides neither login_url nor login_url_resolver.

Parameters:

login_url – A fixed route name or path to redirect to.

duck.contrib.auth.decorators.set_default_login_url_resolver(login_url_resolver: Callable) → None[source]

Sets the fallback login_url_resolver used by login_required when a decorated view provides neither login_url nor login_url_resolver.

Parameters:

login_url_resolver – A callable receiving the request and returning the redirect URL as a string.

duck.contrib.auth.decorators.user_required(view: Optional[Union[Callable, duck.views.View]] = None, *, login_url: Optional[str] = None, login_url_resolver: Optional[Callable] = None, **get_user_kwargs)[source]

Restricts a view or View.run method to authenticated users only, resolving the full user model and attaching it to the request.

Unlike login_required, which only checks that a user_id is present in the session/JWT, this decorator resolves the actual user model (a DB read) and sets request.user before calling the handler. Use this when the view body needs user fields, not just the fact that someone is logged in.

Parameters:

  • view – The view function or View.run method being decorated. Left as None when the decorator is called with arguments, e.g. @user_required(login_url="/login").

  • login_url – A fixed route name or path to redirect to. Passed through resolve() first, falling back to the raw value if resolution fails (e.g. it’s already a raw path).

  • login_url_resolver – A callable receiving the request and returning the redirect URL as a string. Use this when the destination depends on request state, e.g. a next param.

  • **get_user_kwargs – Forwarded to get_user/async_get_user after request, e.g. select_related=[…] or a tenant scope.

Returns:

The decorated view, or a decorator awaiting the view if called with keyword arguments only.

Raises:

ValueError – If both login_url and login_url_resolver are given, or if neither is given and no default is set.