omab/django-social-auth — Issue #224: Prevent disconnection of social account if the user has no password set
Author: mkai
Created: 2012-01-17 14:46:01+00:00
State: open

If a user doesn't have a password set (i. e. has only ever signed up using social accounts or OpenID etc.) and has a single social account connected, then django-social-auth should provide some way to prevent the disconnection of that account. Otherwise, the user will not be able to log in again and the account becomes unusable.

In that case, the implementation might tell the user to either manually set a password or to delete her account.

I'm currently manually wrapping the ``social_auth.views.disconnect`` view to redirect the user to an explanation message in that case. Maybe django-social-auth could provide an option for that or another specific redirect URL? I'm unsure how a good implementation of that might look.

The statement to check for that situation might look like this:

```python
# make sure that the user gets an error message if she has only one linked
# social account and no password set. She needs to set a password first.
if request.user.social_auth.count() == 1 and request.user.password == '!':
return HttpResponseRedirect(disconnect_explanation_url)
```