fix: Avoid DoesNotExist exception in TokenRefreshSerializer

[yuekui]

#860
For deleted users, they should be treated the same as when no active user is found. This DoesNotExist exception was introduced in the previous version.

[vgrozdanic]

Looks good to me, thank you for the contribution!

I added this PR on a checklist for next major release since it does some breaking changes: #871

[Andrew-Chen-Wang]

this may not be expected since the USER_AUTHENTICATION_RULE expects a user object, not None

djangorestframework-simplejwt/rest_framework_simplejwt/authentication.py

Line 170 in faeea49

def default_user_authentication_rule(user: AuthUser) -> bool:

suggestion: simply check if the user exists OR check authentication rule does not pass rather than solely rely on the authentication rule

[yuekui]

Since the USER_AUTHENTICATION_RULE method already performs the user is not None check, would adding another check outside the method introduce unnecessary code duplication?

djangorestframework-simplejwt/rest_framework_simplejwt/authentication.py

Line 178 in faeea49

return user is not None and (

[Andrew-Chen-Wang]

yea, the problem is the initial typing was typed assuming the user object is valid...

I mean that's my fault for not checking that. I guess this is fine, but we should also update the typing for the authentication rule?

[yuekui]

Makes sense, updated

[Andrew-Chen-Wang]

awesome thank you!