betagouv / django-magicauth

Hi,

Thanks for this nice building block!
Just a quick note: if you don't set the MAGICAUTH_EMAIL_FIELD settings, you won't get any lookup working.
Maybe it would be nice to add a default value or explicitly add that to the docs?

Cheers,

Guillaume

Hello :)

I see in the code that there is a default, "username" :

django-magicauth/magicauth/settings.py

Line 39 in 00dde13

EMAIL_FIELD = getattr(django_settings, "MAGICAUTH_EMAIL_FIELD", "username")

So the code assumes by default that in User, the field username is an email. Maybe it is not the case for you ? Are you seeing any errors ? What is in your User model ?

I'm interested to know how to make this better.
Where would you like to see this extra information ? Is it enough to send you to this settings.py file, or do you need more detailed explanations ?

Thanks for the quick answer.
Well, since username can be an email, but not necessarily, I would assume a more sensible default field could be email (https://docs.djangoproject.com/en/3.2/ref/contrib/auth/#django.contrib.auth.models.User.email). This is the default behavior I was expecting but maybe that's just me ;-)

On the other hand, since email is not unique, it may lead to security problems if it matches only the first one (I haven't checked the code).

Another option, with sticking to the current code, may just be adding a note in the README about the default matched field so there's no misunderstanding.

MAGICAUTH_EMAIL_FIELD needs to be set