#Improve check password on profile delete

authentication/serializers.py

@@ -1,12 +1,10 @@
 from collections import defaultdict
 
-from django.conf import settings
-from django.contrib.auth import authenticate, get_user_model
+from django.contrib.auth import get_user_model
 from django.core.exceptions import ValidationError
 from djoser.serializers import (
     UserCreatePasswordRetypeSerializer,
     UserSerializer,
-    TokenCreateSerializer,
 )
 from rest_framework import serializers
 from rest_framework.validators import UniqueValidator

profiles/serializers.py

@@ -204,6 +204,15 @@ class Meta:
         )
         read_only_fields = ("person",)
 
+    def validate_for_delete(self, data):
+        password = data.get("password")
+        if not password:
+            raise serializers.ValidationError("Password is required")
+        user = self.context["request"].user
+        if not user.check_password(password):
+            raise serializers.ValidationError("Invalid password")
+        return data
+
 
 class ProfileSensitiveDataROSerializer(serializers.ModelSerializer):
     email = serializers.ReadOnlyField(source="person.email")

profiles/views.py

@@ -1,6 +1,5 @@
 import django_filters
 from django.shortcuts import get_object_or_404
-from django.contrib.auth.hashers import check_password
 from rest_framework import status
 from rest_framework.generics import (
     CreateAPIView,
@@ -175,19 +174,12 @@ def get_serializer_class(self):
         else:
             return ProfileOwnerDetailEditSerializer
 
-    def destroy(self, request, *args, **kwargs):
-        instance = self.get_object()
-        user = self.request.user
-        password = self.request.data.get("password")
-        if not password or not check_password(password, user.password):
-            return Response(status=status.HTTP_400_BAD_REQUEST)
-        else:
-            self.perform_destroy(instance)
-            return Response(status=status.HTTP_204_NO_CONTENT)
-
     def perform_destroy(self, instance):
-        instance.is_deleted = True
-        instance.save()
+        request_data = {"password": self.request.data.get("password")}
+        serializer = self.get_serializer(instance)
+        if serializer.validate_for_delete(request_data):
+            instance.is_deleted = True
+            instance.save()
 
 
 class ViewedCompanyList(ListCreateAPIView):