How do I prevent the creation of a user if validation on the nested serializer fails?

Question

I am creating a REST api for user registration, and I have a nested serializer where I store additional information about a user.

The User serializer asks for first_name, last_name, email, and password.

The nested serializer asks for agreed_terms_of_service

email, password, and agreed_terms_of_service are required.

But if a user keys in their email and password and DOES NOT check the agreed_terms_of_service box, it returns and error, but still creates a user with the email and password.

Then when the user goes to 'remedy the situation', the email address is already in use.

If I update instead of create, I feel like I would run into a situation where people are overwriting other users... I am wondering how people handle this with django rest serializers and what is the best practice?

VIEWS.PY

def serialize(self, request):
        if request.method =='POST':
            data = json.loads(request.body)
            #first validation
            if data['password'] != data['password2']:
                raise serializers.ValidationError({'msgType':'error','message':'Passwords do not match.'})
            #move to serializer
            else:                   
            serializer = userSerializer(data = data)
            data['username'] = data['email'] 
            if serializer.is_valid(raise_exception=True): 
                serializer.save() 
                response = {'msgType':'success', 'message':'Your account has been created successfully.'}
            elif serializer.errors:
                raise serializers.ValidationError({'msgType':'error', 'message': serializer.errors})
            return Response(response)

SERIALIZERS.PY

class nestedSerializer(serializers.ModelSerializer):

class Meta:
    model = Nested
    fields = ('agreed_terms_of_service')

def validate(self, data):
    return data


class userSerializer(serializers.ModelSerializer):

nested = nestedSerializer()

class Meta:
    model = User
    fields = ('pk','email', 'password', 'username','first_name','last_name','nested')

def validate(self, data):
    email = data['email']
    try:
        User.objects.get(email = email)
    except User.DoesNotExist:
        return data
    else:
        raise serializers.ValidationError({'msgType':'error', 'message':'A user with this email address already exists.'})
    return data

def create(self, validated_data):
    nested_data = validated_data.pop('extend')
    email = validated_data['email']
    user = User.objects.create(**validated_data)
    user.username = user.id
    user.set_password(validated_data['password'])
    user.save()
    nested = Nested.objects.create(user=user, **nested_data)
    return user

Models.py

class Nested(models.Model):
    user = models.OneToOneField(User)
    personalid = models.CharField(max_length=255)
    agreed_terms_of_service = models.BooleanField()
    city = models.CharField(max_length=255, blank=True, null=True)

Thank you for your help in advance. It is much appreciated.

Answer 1

First, I'd change your current validate() function to validate_email() (because all you're doing is validating that the email is not already in use). You should use validate() if you want access to multiple fields in your function. See the documentation here to read more about when you should use field-level validation and object-level validation: http://www.django-rest-framework.org/api-guide/serializers/#validation

Second, in your view, you do:

if data['password'] != data['password2']:
                raise serializers.ValidationError({'msgType':'error','message':'Passwords do not match.'})

If you're verifying that "password" and "confirm password" field match, I'd do that check in the validate() function of your serializer (since you'll be accessing both the 'password' and the 'password2' field.

Third, in your create method, I'd use User.objects.create_user to create a user (create_user will handle the hashing of the password, etc. That way, you don't need to explicitly do user.set_password(validated_data['password'])). See the answer here for more information: How to create a user in Django?

Lastly, to address the main issue. Your "agreed_terms_of_service" is a Boolean field, which means it accepts both True and False. What I'd try is this:

class nestedSerializer(serializers.ModelSerializer):

    class Meta:
        model = Nested
        fields = ('agreed_terms_of_service')

    def validate_agreed_terms_of_service(self, data):
        print(data) # to verify if data is even a boolean
        if data == True or data == 'True':
            return data
        raise serializers.ValidationError({'msgType':'error', 'message':'Please accept the terms and conditions.'})

and in your create function for your userSerializer, add a print statement at the beginning to see if create is being executed before the "agreed_terms_of_service" validation.

def create(self, validated_data):
    print("Creating the object before validating the nested field.")
    # I'd be surprised if DRF executes a create function before
    # even validating it's nested fields.

    # rest of the create code goes here

When you add the statements above, what does it print for "data" and does it print "data" before "creating the object"?