Add support for Django 5.1 and LoginRequiredMiddleware

Author: matthiask

CHANGELOG.rst

@@ -11,6 +11,8 @@ Next version
   ``has_perm`` is an acceptable fallback.
 - Force account selection when failing to authenticate once in the Django admin
   using a Google account.
+- Added support for Django 5.1.
+- Exempted our login views from the ``LoginRequiredMiddleware``.
 
 
 0.16 (2023-09-17)

authlib/_compat.py

@@ -0,0 +1,13 @@
+__all__ = ["login_not_required"]
+
+
+try:
+    from django.contrib.auth.decorators import login_not_required
+except ImportError:
+    # For Django < 5.1, copy the current Django implementation
+    def login_not_required(view_func):
+        """
+        Decorator for views that allows access to unauthenticated requests.
+        """
+        view_func.login_required = False
+        return view_func

authlib/views.py

@@ -12,6 +12,7 @@
 from django.views.decorators.cache import never_cache
 from django.views.decorators.debug import sensitive_post_parameters
 
+from authlib._compat import login_not_required
 from authlib.email import decode, send_registration_mail
 
 
@@ -69,6 +70,7 @@ def email_login(request, *, email, **kwargs):
     return None, None
 
 
+@login_not_required
 @never_cache
 @sensitive_post_parameters()
 @set_next_cookie
@@ -88,6 +90,7 @@ def login(
     return render(request, template_name, {"form": form})
 
 
+@login_not_required
 @never_cache
 def oauth2(
     request,
@@ -155,6 +158,7 @@ def send_mail(self, **kwargs):
         )
 
 
+@login_not_required
 @never_cache
 def email_registration(
     request,
@@ -191,6 +195,7 @@ def email_registration(
         return redirect("login")
 
 
+@login_not_required
 @never_cache
 def logout(request, *, post_logout_response=post_logout_response):
     auth.logout(request)

tests/testapp/test_authlib.py

@@ -1,19 +1,29 @@
 import base64
 import json
 from contextlib import contextmanager
+from unittest import skipUnless
 from unittest.mock import patch
 from urllib.parse import parse_qsl, urlparse
 
 import requests_mock
 from django.test import Client, TestCase
-from django.test.utils import isolate_apps
+from django.test.utils import isolate_apps, modify_settings
 from django.utils.translation import deactivate_all
 
 from authlib.base_user import BaseUser
 from authlib.facebook import FacebookOAuth2Client
 from authlib.little_auth.models import User
 
 
+try:
+    from django.contrib.auth.middleware import LoginRequiredMiddleware  # noqa: F401
+
+    has_login_required_middleware = True
+except ImportError:
+    # Django < 5.1
+    has_login_required_middleware = False
+
+
 @contextmanager
 def google_oauth_data(data):
     with requests_mock.Mocker() as m:
@@ -274,3 +284,17 @@ def test_oauth2_inactive(self):
         self.assertEqual(
             messages, ["No active user with email address [email protected] found."]
         )
+
+    @skipUnless(
+        has_login_required_middleware, "LoginRequiredMiddleware needs Django 5.1+"
+    )
+    @modify_settings(
+        MIDDLEWARE={"append": "django.contrib.auth.middleware.LoginRequiredMiddleware"}
+    )
+    def test_login_not_required(self):
+        client = Client()
+        response = client.get("/login/")
+        self.assertEqual(response.status_code, 200)
+
+        response = client.get("/email/")
+        self.assertEqual(response.status_code, 200)

tox.ini

@@ -15,6 +15,7 @@ deps =
     dj41: Django>=4.1,<4.2
     dj42: Django>=4.2,<5.0
     dj50: Django>=5.0,<5.1
+    dj51: Django>=5.1,<5.2
     djmain: https://github.com/django/django/archive/main.tar.gz
 
 [testenv:docs]