Implementing Optional Username and Password in Django

You can implement a custom user model with optional username and password fields while supporting email-based login with verification codes. Here's how to approach this:

1. Create a Custom User Model

PYTHONCopied
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager, PermissionsMixin
from django.db import models

class CustomUserManager(BaseUserManager):
    def create_user(self, email, password=None, **extra_fields):
        if not email:
            raise ValueError('Email is required')
        email = self.normalize_email(email)
        user = self.model(email=email, **extra_fields)
        if password:
            user.set_password(password)
        else:
            # Set an unusable password if none is provided
            user.set_unusable_password()
        user.save(using=self._db)
        return user

    def create_superuser(self, email, password=None, **extra_fields):
        extra_fields.setdefault('is_staff', True)
        extra_fields.setdefault('is_superuser', True)
        return self.create_user(email, password, **extra_fields)

class CustomUser(AbstractBaseUser, PermissionsMixin):
    email = models.EmailField(unique=True)
    username = models.CharField(max_length=150, blank=True, null=True)
    is_active = models.BooleanField(default=True)
    is_staff = models.BooleanField(default=False)
    date_joined = models.DateTimeField(auto_now_add=True)
    
    USERNAME_FIELD = 'email'
    REQUIRED_FIELDS = []
    
    objects = CustomUserManager()
    
    def __str__(self):
        return self.email

2. Configure settings.py

PYTHONCopied
AUTH_USER_MODEL = 'yourapp.CustomUser'

3. Create a Custom Authentication Backend

PYTHONCopied
from django.contrib.auth.backends import ModelBackend
from django.contrib.auth import get_user_model

User = get_user_model()

class EmailVerificationBackend(ModelBackend):
    def authenticate(self, request, email=None, verification_code=None, **kwargs):
        if email is None or verification_code is None:
            return None
            
        try:
            # Verify the code against what you have stored
            # This depends on how you implement verification codes
            user = User.objects.get(email=email)
            
            # Check if the verification code is valid
            if self.verify_code(user, verification_code):
                return user
                
        except User.DoesNotExist:
            return None
            
    def verify_code(self, user, verification_code):
        # Implement your verification logic here
        # For example, check against a VerificationCode model or cache
        return True  # Replace with actual verification

4. Add the Backend to settings.py

PYTHONCopied
AUTHENTICATION_BACKENDS = [
    'yourapp.backends.EmailVerificationBackend',
    'django.contrib.auth.backends.ModelBackend',  # Keep the default backend
]

5. Implement the Verification Code Logic

You'll need to create a model or system to generate, store, and verify the one-time codes:

PYTHONCopied
from django.core.mail import send_mail
import random
import string

class VerificationCode(models.Model):
    user = models.ForeignKey(User, on_delete=models.CASCADE)
    code = models.CharField(max_length=6)
    created_at = models.DateTimeField(auto_now_add=True)
    
    @classmethod
    def generate_code(cls, user):
        # Generate a random 6-digit code
        code = ''.join(random.choices(string.digits, k=6))
        
        # Save the code
        verification = cls.objects.create(user=user, code=code)
        
        # Send the code via email
        send_mail(
            'Your Verification Code',
            f'Your verification code is: {code}',
            'from@example.com',
            [user.email],
            fail_silently=False,
        )
        
        return verification

6. Login View Example

PYTHONCopied
from django.contrib.auth import authenticate, login
from django.shortcuts import render, redirect

def email_verification_view(request):
    if request.method == 'POST':
        email = request.POST.get('email')
        verification_code = request.POST.get('verification_code')
        
        user = authenticate(request, email=email, verification_code=verification_code)
        
        if user is not None:
            login(request, user)
            return redirect('home')
        else:
            # Handle invalid login
            pass
            
    return render(request, 'login.html')

This approach allows you to:

1. Create users with only an email
2. Let users optionally set a username and password later
3. Support email-based verification code login
4. Enable two-step verification when a password is set

The key is using set_unusable_password() for users without passwords and implementing a custom authentication backend for the verification code flow.