Password reset does not support a custom user model with a composite primary key

[Jacob Walls]

It may not be likely someone would try this, but even so, we might add a system check or otherwise document that contrib.auth is not composite primary key ready. Then we can decide on whether to add support.

Adjusting a custom user model like this:

tests/auth_tests/models/custom_user.py

@@ -52 +52 @@
 
 
 class CustomUser(AbstractBaseUser):
+    pk = models.CompositePrimaryKey("email", "date_of_birth")
     email = models.EmailField(verbose_name="email address", max_length=255, unique=True)
     is_active = models.BooleanField(default=True)
     is_admin = models.BooleanField(default=False)

Leads to various failures in contrib.auth that expect to deserialize a pk by decoding to a bytestring.

The failure I was playing with was a little easier to see by doing this:

django/contrib/auth/views.py

@@ -304 +304 @@
             user = UserModel._default_manager.get(pk=uid)
         except (
             TypeError,
-            ValueError,
+            # ValueError,
             OverflowError,
             UserModel.DoesNotExist,
             ValidationError,

Then...

======================================================================
ERROR: test_confirm_valid_custom_user (auth_tests.test_views.CustomUserPasswordResetTest.test_confirm_valid_custom_user)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/.../django/tests/auth_tests/test_views.py", line 529, in test_confirm_valid_custom_user
    response = self.client.get(path)
               ^^^^^^^^^^^^^^^^^^^^^

...

File "/Users/.../django/django/contrib/auth/views.py", line 275, in dispatch
    self.user = self.get_user(kwargs["uidb64"])
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/.../django/django/contrib/auth/views.py", line 304, in get_user
    user = UserModel._default_manager.get(pk=uid)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
...
  File "/Users/.../django/django/db/models/lookups.py", line 30, in __init__
    self.rhs = self.get_prep_lookup()
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/.../django/django/db/models/fields/tuple_lookups.py", line 36, in get_prep_lookup
    self.check_rhs_is_tuple_or_list()
  File "/Users/.../django/django/db/models/fields/tuple_lookups.py", line 45, in check_rhs_is_tuple_or_list
    raise ValueError(
ValueError: 'exact' lookup of 'pk' must be a tuple or a list

----------------------------------------------------------------------
Ran 2 tests in 0.056s

FAILED (errors=1)

[Sarah Boyce]

Good spot!
There's a chance that adding support for custom user models with CompositePrimaryKey's might be easier than adding a system check
Something roughly like:

django/contrib/auth/forms.py

@@ -478 +478 @@
         email_field_name = UserModel.get_email_field_name()
         for user in self.get_users(email):
             user_email = getattr(user, email_field_name)
+            user_pk_bytes = force_bytes(UserModel._meta.pk.value_to_string(user))
             context = {
                 "email": user_email,
                 "domain": domain,
                 "site_name": site_name,
-                "uid": urlsafe_base64_encode(force_bytes(user.pk)),
+                "uid": urlsafe_base64_encode(user_pk_bytes),
                 "user": user,
                 "token": token_generator.make_token(user),
                 "protocol": "https" if use_https else "http",

django/contrib/auth/views.py

@@ -301 +301 @@
         try:
             # urlsafe_base64_decode() decodes to bytestring
             uid = urlsafe_base64_decode(uidb64).decode()
-            user = UserModel._default_manager.get(pk=uid)
+            pk = UserModel._meta.pk.to_python(uid)
+            user = UserModel._default_manager.get(pk=pk)
         except (
             TypeError,

If it's more complex, then perhaps we add some docs or a system check as suggested

[Sarah Boyce <42296566+sarahboyce@…>]

In 23c6effa:

Fixed #36087 -- Supported password reset on a custom user model with a composite primary key.