AuthenticatedHttpRequest use for LoginRequiredMixin

[H4rryK4ne]

As described in https://github.com/typeddjango/django-stubs#how-can-i-create-a-httprequest-thats-guaranteed-to-have-an-authenticated-user one could use AuthenticatedHttpRequest annotate request in function views with @login_required decorators.

But how can this be adapted to class views with LoginRequiredMixin?

Any idea?

[mschoettle]

You can change the type hint for the request argument to AuthenticatedHttpRequest.

class SomeAPIView(...):
    def get(self, request: AuthenticatedHttpRequest, ...)

[H4rryK4ne]

Sorry for the late reply ...

Finally I got to the point to refactor my app and to try your solution. But I get the following error message from mypy v1.8.0

my_app/views/__init__.py:70: error: Argument 1 of "get" is incompatible with supertype "ProcessFormView"; supertype defines the argument type as "HttpRequest"  [override]
        def get(self, request: AuthenticatedHttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

class User(AbstractUser):
    ...

class AuthenticatedHttpRequest(HttpRequest):
    user: User

[mschoettle]

Indeed. My bad.

I unfortunately don't know any solution except explicitly cast()ing request to an authenticated_request in the method body.

[intgr]

Sorry, this thread became disjointed because I converted the issue to a discussion.

[intgr]

Personally I never liked the AuthenticatedHttpRequest hack.

I always use explicit isinstance() guards when I need to access request.user. This adds a little runtime overhead, but is safer because it always validates the assumptions you're making. For example:

from django.contrib.auth.models import User

class SomeAPIView(...):
    def get(self, request: HttpRequest, ...):
        assert isinstance(request.user, User)  # Type guard
        print(request.user.email)              # No error because mypy now knows the type of `request.user`

[mschoettle]

This works as long as optimization is not requested: https://docs.astral.sh/ruff/rules/assert/

[intgr]

True. But it's no worse than the AuthenticatedHttpRequest work-around. When using AuthenticatedHttpRequest, there is no runtime checking at all.