AccessMixin: object HttpResponseRedirect can't be used in 'await' expression

[Johannes Maron]

The redirect response in AccessMixin.handle_no_permission isn't async compatible.

If you have access, everything works fine, since all HTTP method handlers are async and return coroutines; only if you lack permissions or are unauthenticated is the redirect response synchronous.

With access to view_is_async it should be a fairly easy fix to have handle_no_permission return a coroutine.

Thanks to @amirreza-sf80 for reporting:
​https://github.com/django/new-features/issues/162#issuecomment-4562082172

I could find the bug on Stack Overflow as well, but no ticket on Trac:
​https://stackoverflow.com/questions/66512353/using-loginrequiredmixin-with-async-views

[amirreza]

should mention LoginRequiredMixin also uses request.user.is_authenticated inside dispatch, but it should use auser instead,
which requires awaiting.

[Johannes Maron]

As much as I share your enthusiasm, @ZKY, please be so kind and follow the ​ticket workflow and either wait for triage or do it yourself. Tickets must be accepted before they are assigned.

[zky]

Oh, apologies! I didn't realize I could triage and accept the status myself. I have successfully reproduced this issue locally with a minimal script now.

I'll update the Triage Stage to 'Accepted', re-assign it to myself, and open a PR with the sync_to_async and auser() fix this weekend. Thanks for guiding me through the workflow!

[zky]

​https://github.com/django/django/pull/21379

[Mykhailo Havelia]

I don't think this is really a bug, it's more that it was never implemented, so I'd lean toward treating it as a new feature. 🙂

• LoginRequiredMixin
• PermissionRequiredMixin
• UserPassesTestMixin

These all rely heavily on sync code like request.user, request.user.has_perms, etc.
Also, request.user and request.auser() don't share a cache, so you'd end up doing two separate queries. To avoid that, I think we should adapt the views for async properly instead of applying partial hot-fixes.

I feel like ​https://github.com/django/new-features is the right place to discuss both the solution and the future design.

What do you all think?

[Carlton Gibson]

Yes, these mixins were never in-scope for allowing View to define asynchronous handlers. (So New Feature is correct.)

Whilst I disagree with Mykhailo about duplicating View in a separate async version, I agree that some discussion of how to proceed is called for.

... so you'd end up doing two separate queries ...

Yes, any async version here would need to ensure it was using the same pathways as the view it's going to be applied to.

[Johannes Maron]

I was suspicious when I transported the issue here already. It looked like a pretty big oversight.

That being said, should we maybe update the docs to reflect the limitation? Not everyone in the community can draw on the level of experience you two have with this code base.

A small note is probably sufficient, right?