Schema generator: ReadOnlyField missing

[peterthomassen]

Context

I have an endpoint to create an API token, which is stored in the database in hashed form. When GET'ing a token, the plain value is therefore not included. However, when the token is being created via POST, the response should contain an extra field (token) with the plain value. This field is dropped when not needed. The schema generator does not seem to handle this case properly.

urls.py contains:

tokens_router = SimpleRouter()
tokens_router.register(r'', views.TokenViewSet, basename='token')

auth_urls = [
    path('tokens/', include(tokens_router.urls)),
]
urlpatterns = [
    path('auth/', include(auth_urls)),
]

views.py has the following view:

class TokenViewSet(viewsets.ModelViewSet):
    serializer_class = serializers.TokenSerializer
    permission_classes = (IsAuthenticated,)

    def get_queryset(self):
        return self.request.user.auth_tokens.all()

    def get_serializer(self, *args, **kwargs):
        # When creating a new token, return the plaintext representation
        if self.action == 'create':
            kwargs.setdefault('include_plain', True)
        return super().get_serializer(*args, **kwargs)

    def perform_create(self, serializer):
        serializer.save(user=self.request.user)

serializers.py has the following serializer:

class TokenSerializer(serializers.ModelSerializer):
    token = serializers.ReadOnlyField(source='plain')
    is_valid = serializers.ReadOnlyField()

    class Meta:
        model = models.Token
        fields = ('id', 'is_valid', 'token',)
        read_only_fields = ('id', 'token')

    def __init__(self, *args, include_plain=False, **kwargs):
        self.include_plain = include_plain
        return super().__init__(*args, **kwargs)

    def get_fields(self):
        fields = super().get_fields()
        if not self.include_plain:
            fields.pop('token')
        return fields

models.py has the following model:

class Token(rest_framework.authtoken.models.Token):
    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
    key = models.CharField("Key", max_length=128, db_index=True, unique=True)
    user = models.ForeignKey(
        User, related_name='auth_tokens',
        on_delete=models.CASCADE, verbose_name="User"
    )

    plain = None

    @property
    def is_valid(self):
        return True

    def generate_key(self):
        self.plain = secrets.token_urlsafe(21)
        self.key = Token.make_hash(self.plain)
        return self.key

    @staticmethod
    def make_hash(plain):
        return make_password(plain, salt='static', hasher='pbkdf2_sha256_iter1')

Problem

According to the serializer's Meta.fields setting, the response contains is_valid and token.

I generated a schema with ./manage.py generateschema --file openapi-schema.yml. The schema has the field is_valid, but not token.

• Is this due to the logic in get_fields()?
• If so, how can I retain this logic, but still have the field in the schema?

[tomchristie]

Anyone available to help Peter dig into this?