-
GitHub
+
GitHub
Next
diff --git a/rest_framework/__init__.py b/rest_framework/__init__.py
index 9b9bb6eda..413f32606 100644
--- a/rest_framework/__init__.py
+++ b/rest_framework/__init__.py
@@ -21,6 +21,7 @@ HTTP_HEADER_ENCODING = 'iso-8859-1'
# Default datetime input and output formats
ISO_8601 = 'iso-8601'
+DJANGO_DURATION_FORMAT = 'django'
class RemovedInDRF317Warning(PendingDeprecationWarning):
diff --git a/rest_framework/authtoken/models.py b/rest_framework/authtoken/models.py
index 6a17c2452..b75d1a842 100644
--- a/rest_framework/authtoken/models.py
+++ b/rest_framework/authtoken/models.py
@@ -1,5 +1,4 @@
-import binascii
-import os
+import secrets
from django.conf import settings
from django.db import models
@@ -28,13 +27,22 @@ class Token(models.Model):
verbose_name_plural = _("Tokens")
def save(self, *args, **kwargs):
+ """
+ Save the token instance.
+
+ If no key is provided, generates a cryptographically secure key.
+ For new tokens, ensures they are inserted as new (not updated).
+ """
if not self.key:
self.key = self.generate_key()
+ # For new objects, force INSERT to prevent overwriting existing tokens
+ if self._state.adding:
+ kwargs['force_insert'] = True
return super().save(*args, **kwargs)
@classmethod
def generate_key(cls):
- return binascii.hexlify(os.urandom(20)).decode()
+ return secrets.token_hex(20)
def __str__(self):
return self.key
diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index 89c0a714c..847ee7b19 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -24,7 +24,7 @@ from django.utils import timezone
from django.utils.dateparse import (
parse_date, parse_datetime, parse_duration, parse_time
)
-from django.utils.duration import duration_string
+from django.utils.duration import duration_iso_string, duration_string
from django.utils.encoding import is_protected_type, smart_str
from django.utils.formats import localize_input, sanitize_separators
from django.utils.ipv6 import clean_ipv6_address
@@ -35,7 +35,7 @@ try:
except ImportError:
pytz = None
-from rest_framework import ISO_8601
+from rest_framework import DJANGO_DURATION_FORMAT, ISO_8601
from rest_framework.compat import ip_address_validators
from rest_framework.exceptions import ErrorDetail, ValidationError
from rest_framework.settings import api_settings
@@ -1351,9 +1351,22 @@ class DurationField(Field):
'overflow': _('The number of days must be between {min_days} and {max_days}.'),
}
- def __init__(self, **kwargs):
+ def __init__(self, *, format=empty, **kwargs):
self.max_value = kwargs.pop('max_value', None)
self.min_value = kwargs.pop('min_value', None)
+ if format is not empty:
+ if format is None or (isinstance(format, str) and format.lower() in (ISO_8601, DJANGO_DURATION_FORMAT)):
+ self.format = format
+ elif isinstance(format, str):
+ raise ValueError(
+ f"Unknown duration format provided, got '{format}'"
+ " while expecting 'django', 'iso-8601' or `None`."
+ )
+ else:
+ raise TypeError(
+ "duration format must be either str or `None`,"
+ f" not {type(format).__name__}"
+ )
super().__init__(**kwargs)
if self.max_value is not None:
message = lazy_format(self.error_messages['max_value'], max_value=self.max_value)
@@ -1376,7 +1389,26 @@ class DurationField(Field):
self.fail('invalid', format='[DD] [HH:[MM:]]ss[.uuuuuu]')
def to_representation(self, value):
- return duration_string(value)
+ output_format = getattr(self, 'format', api_settings.DURATION_FORMAT)
+
+ if output_format is None:
+ return value
+
+ if isinstance(output_format, str):
+ if output_format.lower() == ISO_8601:
+ return duration_iso_string(value)
+
+ if output_format.lower() == DJANGO_DURATION_FORMAT:
+ return duration_string(value)
+
+ raise ValueError(
+ f"Unknown duration format provided, got '{output_format}'"
+ " while expecting 'django', 'iso-8601' or `None`."
+ )
+ raise TypeError(
+ "duration format must be either str or `None`,"
+ f" not {type(output_format).__name__}"
+ )
# Choice types...
diff --git a/rest_framework/schemas/openapi.py b/rest_framework/schemas/openapi.py
index eb7dc909d..e569e2501 100644
--- a/rest_framework/schemas/openapi.py
+++ b/rest_framework/schemas/openapi.py
@@ -428,7 +428,7 @@ class AutoSchema(ViewInspector):
}
# "Formats such as "email", "uuid", and so on, MAY be used even though undefined by this specification."
- # see: https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md#data-types
+ # see: https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.2.md#data-types
# see also: https://swagger.io/docs/specification/data-models/data-types/#string
if isinstance(field, serializers.EmailField):
return {
@@ -555,7 +555,7 @@ class AutoSchema(ViewInspector):
"""
for v in field.validators:
# "Formats such as "email", "uuid", and so on, MAY be used even though undefined by this specification."
- # https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md#data-types
+ # https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.0.2.md#data-types
if isinstance(v, EmailValidator):
schema['format'] = 'email'
if isinstance(v, URLValidator):
diff --git a/rest_framework/settings.py b/rest_framework/settings.py
index b0d7bacec..50e3ad40e 100644
--- a/rest_framework/settings.py
+++ b/rest_framework/settings.py
@@ -24,7 +24,7 @@ from django.conf import settings
from django.core.signals import setting_changed
from django.utils.module_loading import import_string
-from rest_framework import ISO_8601
+from rest_framework import DJANGO_DURATION_FORMAT, ISO_8601
DEFAULTS = {
# Base API policies
@@ -109,6 +109,8 @@ DEFAULTS = {
'TIME_FORMAT': ISO_8601,
'TIME_INPUT_FORMATS': [ISO_8601],
+ 'DURATION_FORMAT': DJANGO_DURATION_FORMAT,
+
# Encoding
'UNICODE_JSON': True,
'COMPACT_JSON': True,
diff --git a/rest_framework/validators.py b/rest_framework/validators.py
index 4c444cf01..76d2a2159 100644
--- a/rest_framework/validators.py
+++ b/rest_framework/validators.py
@@ -189,7 +189,12 @@ class UniqueTogetherValidator:
]
condition_sources = (serializer.fields[field_name].source for field_name in self.condition_fields)
- condition_kwargs = {source: attrs[source] for source in condition_sources}
+ condition_kwargs = {
+ source: attrs[source]
+ if source in attrs
+ else getattr(serializer.instance, source)
+ for source in condition_sources
+ }
if checked_values and None not in checked_values and qs_exists_with_condition(queryset, self.condition, condition_kwargs):
field_names = ', '.join(self.fields)
message = self.message.format(field_names=field_names)
diff --git a/tests/authentication/test_authentication.py b/tests/authentication/test_authentication.py
index 2f05ce7d1..3b6c633ee 100644
--- a/tests/authentication/test_authentication.py
+++ b/tests/authentication/test_authentication.py
@@ -81,6 +81,7 @@ urlpatterns = [
@override_settings(ROOT_URLCONF=__name__)
class BasicAuthTests(TestCase):
"""Basic authentication"""
+
def setUp(self):
self.csrf_client = APIClient(enforce_csrf_checks=True)
self.username = 'john'
@@ -198,6 +199,7 @@ class BasicAuthTests(TestCase):
@override_settings(ROOT_URLCONF=__name__)
class SessionAuthTests(TestCase):
"""User session authentication"""
+
def setUp(self):
self.csrf_client = APIClient(enforce_csrf_checks=True)
self.non_csrf_client = APIClient(enforce_csrf_checks=False)
@@ -418,6 +420,41 @@ class TokenAuthTests(BaseTokenAuthTests, TestCase):
key = self.model.generate_key()
assert isinstance(key, str)
+ def test_generate_key_returns_valid_format(self):
+ """Ensure generate_key returns a valid token format"""
+ key = self.model.generate_key()
+ assert len(key) == 40
+ # Should contain only valid hexadecimal characters
+ assert all(c in '0123456789abcdef' for c in key)
+
+ def test_generate_key_produces_unique_values(self):
+ """Ensure generate_key produces unique values across multiple calls"""
+ keys = set()
+ for _ in range(100):
+ key = self.model.generate_key()
+ assert key not in keys, f"Duplicate key generated: {key}"
+ keys.add(key)
+
+ def test_generate_key_collision_resistance(self):
+ """Test collision resistance with reasonable sample size"""
+ keys = set()
+ for _ in range(500):
+ key = self.model.generate_key()
+ assert key not in keys, f"Collision found: {key}"
+ keys.add(key)
+ assert len(keys) == 500, f"Expected 500 unique keys, got {len(keys)}"
+
+ def test_generate_key_randomness_quality(self):
+ """Test basic randomness properties of generated keys"""
+ keys = [self.model.generate_key() for _ in range(10)]
+ # Consecutive keys should be different
+ for i in range(len(keys) - 1):
+ assert keys[i] != keys[i + 1], "Consecutive keys should be different"
+ # Keys should not follow obvious patterns
+ for key in keys:
+ # Should not be all same character
+ assert not all(c == key[0] for c in key), f"Key has all same characters: {key}"
+
def test_token_login_json(self):
"""Ensure token login view using JSON POST works."""
client = APIClient(enforce_csrf_checks=True)
@@ -480,6 +517,7 @@ class IncorrectCredentialsTests(TestCase):
authentication should run and error, even if no permissions
are set on the view.
"""
+
class IncorrectCredentialsAuth(BaseAuthentication):
def authenticate(self, request):
raise exceptions.AuthenticationFailed('Bad credentials')
@@ -571,6 +609,7 @@ class BasicAuthenticationUnitTests(TestCase):
class MockUser:
is_active = False
+
old_authenticate = authentication.authenticate
authentication.authenticate = lambda **kwargs: MockUser()
try:
diff --git a/tests/test_authtoken.py b/tests/test_authtoken.py
index 30e416d65..3cfcbb394 100644
--- a/tests/test_authtoken.py
+++ b/tests/test_authtoken.py
@@ -5,6 +5,7 @@ import pytest
from django.contrib.admin import site
from django.contrib.auth.models import User
from django.core.management import CommandError, call_command
+from django.db import IntegrityError
from django.test import TestCase, modify_settings
from rest_framework.authtoken.admin import TokenAdmin
@@ -48,6 +49,45 @@ class AuthTokenTests(TestCase):
self.user.save()
assert AuthTokenSerializer(data=data).is_valid()
+ def test_token_creation_collision_raises_integrity_error(self):
+ user2 = User.objects.create_user('user2', 'user2@example.com', 'p')
+ existing_token = Token.objects.create(user=user2)
+
+ # Try to create another token with the same key
+ with self.assertRaises(IntegrityError):
+ Token.objects.create(key=existing_token.key, user=self.user)
+
+ def test_key_generated_on_save_when_cleared(self):
+ # Create a new user for this test to avoid conflicts with setUp token
+ user2 = User.objects.create_user('test_user2', 'test2@example.com', 'password')
+
+ # Create a token without a key - it should generate one automatically
+ token = Token(user=user2)
+ token.key = "" # Explicitly clear the key
+ token.save()
+
+ # Verify the key was generated
+ self.assertEqual(len(token.key), 40)
+ self.assertEqual(token.user, user2)
+
+ def test_clearing_key_on_existing_token_raises_integrity_error(self):
+ """Test that clearing the key on an existing token raises IntegrityError."""
+ user = User.objects.create_user('test_user3', 'test3@example.com', 'password')
+ token = Token.objects.create(user=user)
+ token.key = ""
+
+ # This should raise IntegrityError because:
+ # 1. We're trying to update a record with an empty primary key
+ # 2. The OneToOneField constraint would be violated
+ with self.assertRaises(Exception): # Could be IntegrityError or DatabaseError
+ token.save()
+
+ def test_saving_existing_token_without_changes_does_not_alter_key(self):
+ original_key = self.token.key
+
+ self.token.save()
+ self.assertEqual(self.token.key, original_key)
+
class AuthTokenCommandTests(TestCase):
diff --git a/tests/test_fields.py b/tests/test_fields.py
index 56693ed7a..b52442a2c 100644
--- a/tests/test_fields.py
+++ b/tests/test_fields.py
@@ -1770,9 +1770,69 @@ class TestDurationField(FieldValues):
}
field = serializers.DurationField()
+ def test_invalid_format(self):
+ with pytest.raises(ValueError) as exc_info:
+ serializers.DurationField(format='unknown')
+ assert str(exc_info.value) == (
+ "Unknown duration format provided, got 'unknown'"
+ " while expecting 'django', 'iso-8601' or `None`."
+ )
+ with pytest.raises(TypeError) as exc_info:
+ serializers.DurationField(format=123)
+ assert str(exc_info.value) == (
+ "duration format must be either str or `None`, not int"
+ )
+
+ def test_invalid_format_in_config(self):
+ field = serializers.DurationField()
+
+ with override_settings(REST_FRAMEWORK={'DURATION_FORMAT': 'unknown'}):
+ with pytest.raises(ValueError) as exc_info:
+ field.to_representation(datetime.timedelta(days=1))
+
+ assert str(exc_info.value) == (
+ "Unknown duration format provided, got 'unknown'"
+ " while expecting 'django', 'iso-8601' or `None`."
+ )
+ with override_settings(REST_FRAMEWORK={'DURATION_FORMAT': 123}):
+ with pytest.raises(TypeError) as exc_info:
+ field.to_representation(datetime.timedelta(days=1))
+ assert str(exc_info.value) == (
+ "duration format must be either str or `None`, not int"
+ )
+
+
+class TestNoOutputFormatDurationField(FieldValues):
+ """
+ Values for `DurationField` with a no output format.
+ """
+ valid_inputs = {}
+ invalid_inputs = {}
+ outputs = {
+ datetime.timedelta(1): datetime.timedelta(1)
+ }
+ field = serializers.DurationField(format=None)
+
+
+class TestISOOutputFormatDurationField(FieldValues):
+ """
+ Values for `DurationField` with a custom output format.
+ """
+ valid_inputs = {
+ '13': datetime.timedelta(seconds=13),
+ 'P3DT08H32M01.000123S': datetime.timedelta(days=3, hours=8, minutes=32, seconds=1, microseconds=123),
+ 'PT8H1M': datetime.timedelta(hours=8, minutes=1),
+ '-P999999999D': datetime.timedelta(days=-999999999),
+ 'P999999999D': datetime.timedelta(days=999999999)
+ }
+ invalid_inputs = {}
+ outputs = {
+ datetime.timedelta(days=3, hours=8, minutes=32, seconds=1, microseconds=123): 'P3DT08H32M01.000123S'
+ }
+ field = serializers.DurationField(format='iso-8601')
+
# Choice types...
-
class TestChoiceField(FieldValues):
"""
Valid and invalid values for `ChoiceField`.
diff --git a/tests/test_validators.py b/tests/test_validators.py
index c594eecbe..ea5bf3a4d 100644
--- a/tests/test_validators.py
+++ b/tests/test_validators.py
@@ -589,6 +589,21 @@ class UniqueConstraintModel(models.Model):
]
+class UniqueConstraintReadOnlyFieldModel(models.Model):
+ state = models.CharField(max_length=100, default="new")
+ position = models.IntegerField()
+ something = models.IntegerField()
+
+ class Meta:
+ constraints = [
+ models.UniqueConstraint(
+ name="unique_constraint_%(class)s",
+ fields=("position", "something"),
+ condition=models.Q(state="new"),
+ ),
+ ]
+
+
class UniqueConstraintNullableModel(models.Model):
title = models.CharField(max_length=100)
age = models.IntegerField(null=True)
@@ -738,6 +753,31 @@ class TestUniqueConstraintValidation(TestCase):
)
assert serializer.is_valid()
+ def test_uniq_constraint_condition_read_only_create(self):
+ class UniqueConstraintReadOnlyFieldModelSerializer(serializers.ModelSerializer):
+ class Meta:
+ model = UniqueConstraintReadOnlyFieldModel
+ read_only_fields = ("state",)
+ fields = ("position", "something", *read_only_fields)
+ serializer = UniqueConstraintReadOnlyFieldModelSerializer(
+ data={"position": 1, "something": 1}
+ )
+ assert serializer.is_valid()
+
+ def test_uniq_constraint_condition_read_only_partial(self):
+ class UniqueConstraintReadOnlyFieldModelSerializer(serializers.ModelSerializer):
+ class Meta:
+ model = UniqueConstraintReadOnlyFieldModel
+ read_only_fields = ("state",)
+ fields = ("position", "something", *read_only_fields)
+ instance = UniqueConstraintReadOnlyFieldModel.objects.create(position=1, something=1)
+ serializer = UniqueConstraintReadOnlyFieldModelSerializer(
+ instance=instance,
+ data={"position": 1, "something": 1},
+ partial=True
+ )
+ assert serializer.is_valid()
+
# Tests for `UniqueForDateValidator`
# ----------------------------------