Repository: cookiecutter/cookiecutter-django

Issue:
Admin login as non-superuser avoids allauth login flow
## What happened?
When logging into the admin console through allauth (DJANGO_ADMIN_FORCE_ALLAUTH=True), everything works fine when logging in as a superuser.
When logging in as a normal user, the user gets redirected to the Django admin site with "You are logged in but do not have access to this page. Do you want to log in as a different user?".
This seems like a way to go around the allauth login flow.

## Solution
Currently, this snippet is used to check for a logged-in user:
```python
from django.contrib.auth import decorators

if settings.DJANGO_ADMIN_FORCE_ALLAUTH:
    # Force the `admin` sign in process to go through the `django-allauth` workflow:
    # https://django-allauth.readthedocs.io/en/stable/advanced.html#admin
    admin.site.login = decorators.login_required(admin.site.login)  # type: ignore[method-assign]
```

But shouldn't it rather check for a superuser like specified in the allauth docu, like so?
```python
from django.contrib.admin.views.decorators import staff_member_required

if settings.DJANGO_ADMIN_FORCE_ALLAUTH:
    # Force the `admin` sign in process to go through the `django-allauth` workflow:
    # https://django-allauth.readthedocs.io/en/stable/advanced.html#admin
    admin.site.login = staff_member_required(
        admin.site.login, login_url=settings.LOGIN_URL
    )
```




Discussion:
When applying your proposal I'm facing `ERR_TOO_MANY_REDIRECTS`. 
It is true, I did not realize that the first time...
Maybe it is a `django-allauth` problem?
If I log in as a non staff member with the snippet from the allauth docs the too many redirects error is raised
If I take the current `admin.site.login = decorators.login_required(admin.site.login)` snippet I can go around the allauth login flow.
Perhaps we can destroy the current session when this occurs? The the user is redirected to the correct form with the correct redirect url. 
Something like this would work to check if the user is a staff member and if not automatically perform a logout, display an error message and redirect to the login page:
```
from django.contrib.auth import decorators, logout
from django.shortcuts import redirect
from django.contrib import messages

if settings.DJANGO_ADMIN_FORCE_ALLAUTH:
    # Define a custom AdminSite class to check if the user is a staff member
    class CustomAdminSite(admin.AdminSite):
        def login(self, request, extra_context=None):
            if request.user.is_authenticated and not request.user.is_staff:
                logout(request)
                storage = messages.get_messages(request)
                # Clear all other messages first
                storage.used = True
                messages.error(
                    request, "You are not authorized and have been logged out."
                )
                return redirect("account_login")
            return super().login(request, extra_context)

    admin.site = CustomAdminSite()

    # Force the `admin` sign in process to go through the `django-allauth` workflow:
    # https://django-allauth.readthedocs.io/en/stable/advanced.html#admin
    admin.site.login = decorators.login_required(admin.site.login)  # type: ignore[method-assign]
```

Not sure if you meant somthing like that
Exactly what I meant! Do you mind providing a PR (when you do, do not forget to translate the error message)? 
Perfect!
No worries I will do a PR in the next days :)

Resolving patch:
diff --git a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/admin.py b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/admin.py
--- a/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/admin.py
+++ b/{{cookiecutter.project_slug}}/{{cookiecutter.project_slug}}/users/admin.py
@@ -1,7 +1,7 @@
+from allauth.account.decorators import secure_admin_login
 from django.conf import settings
 from django.contrib import admin
 from django.contrib.auth import admin as auth_admin
-from django.contrib.auth.decorators import login_required
 from django.utils.translation import gettext_lazy as _
 
 from .forms import UserAdminChangeForm
@@ -11,7 +11,8 @@
 if settings.DJANGO_ADMIN_FORCE_ALLAUTH:
     # Force the `admin` sign in process to go through the `django-allauth` workflow:
     # https://docs.allauth.org/en/latest/common/admin.html#admin
-    admin.site.login = login_required(admin.site.login)  # type: ignore[method-assign]
+    admin.autodiscover()
+    admin.site.login = secure_admin_login(admin.site.login)  # type: ignore[method-assign]
 
 
 @admin.register(User)


Test patch: