BUG: get_user_model().USERNAME_FIELD causing starting Django when using custom user model

[daronzwink]

Describe the bug
After installing 7.0.2, we are getting an error starting Django as we have Django configured to use a custom user model. Our custom user model is:

AUTH_USER_MODEL = "tenants.TenantUser"

We are receiving the following error:

Traceback (most recent call last):
File "/code/manage.py", line 32, in
main()
File "/code/manage.py", line 28, in main
execute_from_command_line(sys.argv)
File "/usr/local/lib/python3.11/site-packages/django/core/management/init.py", line 442, in execute_from_command_line
utility.execute()
File "/usr/local/lib/python3.11/site-packages/django/core/management/init.py", line 416, in execute
django.setup()
File "/usr/local/lib/python3.11/site-packages/django/init.py", line 24, in setup
apps.populate(settings.INSTALLED_APPS)
File "/usr/local/lib/python3.11/site-packages/django/apps/registry.py", line 116, in populate
app_config.import_models()
File "/usr/local/lib/python3.11/site-packages/django/apps/config.py", line 269, in import_models
self.models_module = import_module(models_module_name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/importlib/init.py", line 126, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "", line 1204, in _gcd_import
File "", line 1176, in _find_and_load
File "", line 1147, in _find_and_load_unlocked
File "", line 690, in _load_unlocked
File "", line 940, in exec_module
File "", line 241, in _call_with_frames_removed
File "/code/action_manager/models.py", line 4, in
from utils.models import AbstractItemModel
File "/code/utils/models.py", line 4, in
from tenants.models.tenant import Tenant
File "/code/tenants/models/init.py", line 10, in
from .tenant_user import (
File "/code/tenants/models/tenant_user.py", line 18, in
from axes.utils import reset
File "/usr/local/lib/python3.11/site-packages/axes/utils.py", line 13, in
from axes.handlers.proxy import AxesProxyHandler
File "/usr/local/lib/python3.11/site-packages/axes/handlers/proxy.py", line 10, in
from axes.conf import settings
File "/usr/local/lib/python3.11/site-packages/axes/conf.py", line 47, in
settings, "AXES_USERNAME_FORM_FIELD", get_user_model().USERNAME_FIELD
^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/django/contrib/auth/init.py", line 176, in get_user_model
raise ImproperlyConfigured(
django.core.exceptions.ImproperlyConfigured: AUTH_USER_MODEL refers to model 'tenants.TenantUser' that has not been installed

Just to clear up any questions, we do have our "tenants" in the Django INSTALLED_APPS and we also have our "TenantUser" model imported in the "tenants > models > __init__.py" file. Finally, we do have "USERNAME_FIELD" defined in our "TenatUser" model and it has a value of:

USERNAME_FIELD = "email"

To Reproduce
Steps to reproduce the behavior:

1. Upgrade django-axes to 7.02
2. Configure Django to use a custom model
3. There should be an error attempting to boot Django similar to the trace above.

Expected behavior
If AXES_USERNAME_FORM_FIELD is defined, it should not attempt to resolve "get_user_model().USERNAME_FIELD", which is not able to directly resolve when using a custom model in its current state.

Your environment
python version: 3.11
django version: 4.2.19
django-axes version: 7.0.2

Additional context
As soon as I downgrade to 7.0.1, everything works properly. I believe it is related to recent fix #1270

Possible implementation
Check for the existence of AXES_USERNAME_FORM_FIELD before attempting to resolve get_user_model().USERNAME_FIELD, or if attempting to resolve get_user_model().USERNAME_FIELD, ensure USERNAME_FIELD returns a valid value.

[aliceni81]

+1

[Jedve]

Having the same issue.

[Jacobus-afk]

Hi @daronzwink are you still having this issue? I'm having trouble reproducing it. Do you want to compare notes?

project structure:

⟫ ll -T --git-ignore
drwxrwxr-x    - devuntu 18 Apr 15:02  .
drwxrwxr-x    - devuntu 18 Apr 15:03 ├──  mysite
.rw-rw-r--    0 devuntu 18 Apr 13:23 │   ├──  __init__.py
.rw-rw-r--  389 devuntu 18 Apr 13:23 │   ├──  asgi.py
.rw-rw-r-- 3.7k devuntu 18 Apr 14:38 │   ├──  settings.py
.rw-rw-r--  314 devuntu 18 Apr 14:42 │   ├──  urls.py
.rw-rw-r--  389 devuntu 18 Apr 13:23 │   └──  wsgi.py
drwxr-xr-x    - devuntu 18 Apr 14:40 ├──  templates
drwxr-xr-x    - devuntu 18 Apr 14:45 │   ├──  registration
.rw-r--r--  235 devuntu 18 Apr 14:45 │   │   └──  login.html
.rw-r--r--  220 devuntu 18 Apr 14:40 │   ├──  base.html
.rw-r--r--  263 devuntu 18 Apr 14:40 │   └──  home.html
drwxrwxr-x    - devuntu 18 Apr 15:03 ├──  tenants
drwxrwxr-x    - devuntu 18 Apr 15:03 │   ├──  migrations
.rw-rw-r--  801 devuntu 18 Apr 13:48 │   │   ├──  0001_initial.py
.rw-rw-r--  540 devuntu 18 Apr 14:01 │   │   ├──  0002_tenantuser_is_active_tenantuser_is_admin.py
.rw-rw-r--    0 devuntu 18 Apr 13:39 │   │   └──  __init__.py
.rw-rw-r--    0 devuntu 18 Apr 13:39 │   ├──  __init__.py
.rw-rw-r--   63 devuntu 18 Apr 13:39 │   ├──  admin.py
.rw-rw-r--  146 devuntu 18 Apr 13:39 │   ├──  apps.py
.rw-rw-r-- 1.8k devuntu 18 Apr 14:01 │   ├──  models.py
.rw-rw-r--   60 devuntu 18 Apr 13:39 │   ├──  tests.py
.rw-rw-r--   63 devuntu 18 Apr 13:39 │   └──  views.py
.rw-r--r--   10 devuntu 18 Apr 13:14 ├──  .envrc
.rw-rw-r--    7 devuntu 18 Apr 13:22 ├──  .gitignore
.rw-rw-r--    5 devuntu 18 Apr 13:18 ├──  .python-version
.rw-r--r-- 160k devuntu 18 Apr 14:50 ├──  db.sqlite3
.rw-r--r--  569 devuntu 18 Apr 15:03 ├──  flake.lock
.rw-r--r--  821 devuntu 18 Apr 15:02 ├──  flake.nix
.rwxrwxr-x  662 devuntu 18 Apr 13:23 ├──  manage.py
.rw-rw-r--  186 devuntu 18 Apr 14:26 ├──  pyproject.toml
.rw-rw-r-- 3.6k devuntu 18 Apr 14:27 └──  uv.lock

tenants.models:

from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
from django.db import models


class TenantUserManager(BaseUserManager):
    def create_user(self, email, password=None):
        """
        Creates and saves a User with the given email, date of
        birth and password.
        """
        if not email:
            raise ValueError("Users must have an email address")

        user = self.model(
            email=self.normalize_email(email),
        )

        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_superuser(self, email, password=None):
        """
        Creates and saves a superuser with the given email, date of
        birth and password.
        """
        user = self.create_user(
            email,
            password=password,
        )
        user.is_admin = True
        user.save(using=self._db)
        return user


class TenantUser(AbstractBaseUser):
    email = models.EmailField(
        verbose_name="email address",
        max_length=255,
        unique=True,
    )
    is_active = models.BooleanField(default=True)
    is_admin = models.BooleanField(default=False)

    objects = TenantUserManager()

    USERNAME_FIELD = "email"

    def __str__(self):
        return self.email

    def has_perm(self, perm, obj=None):
        "Does the user have a specific permission?"
        # Simplest possible answer: Yes, always
        return True

    def has_module_perms(self, app_label):
        "Does the user have permissions to view the app `app_label`?"
        # Simplest possible answer: Yes, always
        return True

    @property
    def is_staff(self):
        "Is the user a member of staff?"
        # Simplest possible answer: All admins are staff
        return self.is_admin

relevant settings.py:

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'axes',
    'tenants',
]

AUTHENTICATION_BACKENDS = [
    # AxesStandaloneBackend should be the first backend in the AUTHENTICATION_BACKENDS list.
    'axes.backends.AxesStandaloneBackend',

    # Django ModelBackend is the default authentication backend.
    'django.contrib.auth.backends.ModelBackend',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'axes.middleware.AxesMiddleware',
]

AUTH_USER_MODEL = "tenants.TenantUser"

environment:

⟫ uv tree
Resolved 6 packages in 1ms
dummy-django v0.1.0
├── django v4.2.19
│   ├── asgiref v3.8.1
│   └── sqlparse v0.5.3
└── django-axes v7.0.2
    ├── asgiref v3.8.1
    └── django v4.2.19 (*)
(*) Package tree already displayed

⟫ python --version
Python 3.11.11

[Jedve]

@Jacobus-afk I think it happen if you import get_user_model on top of your models file.

[daronzwink]

@Jacobus-afk Happy to help, I have pinned the previous version in my app for now (7.0.1) to ensure we don't have an issue.

@Jedve I think you are correct. I am importing get_user_model at the top of my models file.

[aleksihakli]

@daronzwink can you try importing the user model inside the function / callable where you need it? That should resolve the Python import order problem; get_user_model is not intended to be invoked on the module / file top-level but inside a function.

[daronzwink]

@aleksihakli, thanks for the suggestion. I gave that a shot and didn't have any luck. I will continue to try some other things, but I think there is still an underlying issue with the latest update that is the root cause because 7.0.1 works great.

[aleksihakli]

Pertaining to your problem:

Have you set the AXES_USERNAME_FORM_FIELD configuration flag?

The problem seems to be that you're importing axes.utils.reset on top of your models file where the user model is not yet initialized and, in turn, the Axes utils module imports your user model since AXES_USERNAME_FORM_FIELD is not set, leading to circular imports and not-yet-initialized errors.

One option would be to only import the reset functionality after your custom model and module has been bootstrapped, e.g. in the function where you are actively using it.

Also, have you given these a try?

https://builtin.com/articles/python-circular-import

Considering the Axes package in general, I'm thinking if it would be best to only resolve the username field in the reset function in Axes where it is used as it's currently resolved at the top level if the AXES_USERNAME_FORM_FIELD is not set, which can lead to import ordering

[blockchainGuru1018]

+1