Myujth

I'm trying to validate a form through DRF, but it would require the user to enter their password for confirmation. I can't seem to get it to work. Here is my current View and Serializer. Its for a 'change email' form, two fields required, the email and user password. It's for a seperate email model. The serializer:

class UpdateEmailAddressSerializer(serializers.ModelSerializer):

 class Meta:
 model = EmailAddress
 fields = ('email',)

And the APIView:

class UpdateEmailAPI(APIView):

permission_classes = (IsAuthenticated,)
serializer_class = UpdateEmailAddressSerializer

def post(self, request, user, format=None):
 user = User.objects.get(username=user)
 serializer = UpdateEmailAddressSerializer(data=request.data, instance=user)
 if serializer.is_valid():

 ## logic to check and send email

 serializer.save()
 return Response(serializer.data, status=status.HTTP_201_CREATED)

 else:
 return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST) 

I'm not sure where to place the password or what to do with it. Its from the User model itself. When I attempted to add password to the fields in the UpdateEmail serializer it ended up updating the User password with plain text and making that user object unable to use that password.

I just want to check the password of the user for confirmation of this form. Is there an obvious way to do this?

EDIT

When I attempt to bring 'password' into the serializer, an error tells "Field name password is not valid for model EmailAddress." So when I attempt to bring it in e.g.

password = serializers.CharField(required=True)

or try:

## UserPasswordSerializer 
class UserPasswordSerializer(serializers.ModelSerializer):

class Meta:
 model = User
 fields = (
 'password',
 )

## In UpdateEmailAddressSerializer
password = UserPasswordSerializer()

I get this error when submitting the form on DRF:

Got AttributeError when attempting to get a value for field
password on serializer UpdateEmailAddressSerializer. The
serializer field might be named incorrectly and not match any
attribute or key on the EmailAddress instance. Original exception
text was: 'EmailAddress' object has no attribute 'password'

So it seems to be telling me password isn't part of EmailAddress model which is correct. But I cant figure out how to simply check the password alongside the form post without making it part of EmailAddress.

I think you can try like this:

class UpdateEmailAddressSerializer(serializers.ModelSerializer):
 password = serializers.CharField(write_only=True)
 class Meta:
 model = EmailAddress
 fields = ('email', 'password',)

 def create(self, validated_data):
 validated_data.pop('password', None)
 return super(UpdateEmailAddressSerializer, self).create(validated_data)

 def update(self, instance, validated_data):
 if instance.check_password(validated_data.get('password')):
 instance.email = validated_data.get('email', instance.email)
 # else throw validation error
 return instance