search

aaronn / django-rest-framework-passwordless

Passwordless Auth for Django REST Framework
MIT License
717 stars 155 forks source link

Callback token key changes after invalidating it. (after every update actually) #75

Closed thetarby closed 3 years ago

thetarby commented 4 years ago

Because of the pre_save signal which checks whether a token with the same key already exists and recreates key if that is the case, after each save call on a callback token its key value changes. That is not good because even after invalidating a token its key value could be useful and also it requires an unnecessary db hit which is bad for performance.

To solve the problem, in pre_save handler first check if save is called to update an already existing token or it is called to create a new one. If it is called to update it then don't check for key's uniqueness.

gozdecoban commented 3 years ago

Hi Aaron, do you consider merging this? I have the same issue.

aaronn commented 3 years ago

Okay, I'll look into this this week.

aaronn commented 3 years ago

I think we actually need a migration for this too:

unique_together = (('key', 'is_active'),)

Because of this bit, any older keys with is_active=False will collide.

Edit: Actually I suppose this migration can be done separately.