Serialize User.has_usable_password

arkindex/users/serializers.py

@@ -29,6 +29,7 @@ class SimpleUserSerializer(serializers.ModelSerializer):
 
 class UserSerializer(SimpleUserSerializer):
 
+    has_usable_password = serializers.BooleanField(read_only=True)
     features = serializers.SerializerMethodField(read_only=True)
 
     class Meta(SimpleUserSerializer.Meta):
@@ -38,6 +39,7 @@ class UserSerializer(SimpleUserSerializer):
             "is_admin",
             "auth_token",
             "features",
+            "has_usable_password",
         )
         extra_kwargs = {
             "id": {"read_only": True},

arkindex/users/tests/test_registration.py

@@ -45,9 +45,23 @@ class TestRegistration(FixtureAPITestCase):
         data = response.json()
         self.assertEqual(data["email"], "email@address.com")
         self.assertEqual(data["is_admin"], False)
+        self.assertEqual(data["has_usable_password"], True)
         self.assertNotIn("password", data)
 
+    def test_retrieve_unusable_password(self):
+        self.user.set_unusable_password()
+        self.user.save()
+        self.client.force_login(self.user)
+        response = self.client.get(reverse("api:user-retrieve"))
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        data = response.json()
+        self.assertEqual(data["email"], "email@address.com")
+        self.assertEqual(data["is_admin"], False)
+        self.assertEqual(data["has_usable_password"], False)
+
     def test_update_password(self):
+        self.user.set_unusable_password()
+        self.user.save()
         self.client.force_login(self.user)
         response = self.client.patch(
             reverse("api:user-retrieve"),
@@ -57,6 +71,7 @@ class TestRegistration(FixtureAPITestCase):
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.user.refresh_from_db()
         self.assertTrue(self.user.check_password("N€wP4$5w0Rd"))
+        self.assertEqual(response.json()["has_usable_password"], True)
         # Ensure client session is still valid
         response = self.client.get(
             reverse("api:user-retrieve"),