Building a Robust Account Management System in Django

By Joe EL OUFIR
2023-12-27

Account Registration

The account registration function is the gateway for users into your SaaS platform. This process should handle various scenarios, including the prevention of registrations from junk or temporary email domains. A robust registration system should also incorporate email verification to ensure that the user's email is valid and active, enhancing the security and integrity of user data.

Account Activation

After registration, the account activation step is crucial. This typically involves sending an activation link via email. It's important to ensure a smooth and secure activation process. This step validates the user and acts as a safeguard against fraudulent accounts. Considerations for time-sensitive activation links and user-friendly error messages for invalid or expired links are vital.

Login

The login function is more than just a gateway; it's the first touchpoint for user experience. Implementing secure and efficient login procedures, including options for social media logins, enhances user convenience. Features like two-factor authentication can be considered for added security.

Password Reset

A user-friendly password reset process is essential. This function should include sending a secure link to the user’s email, allowing them to reset their password without hassle. Security measures to prevent abuse of the password reset feature, such as rate limiting and verification checks, are important.

Change Password

Allowing users to change their password while logged in is a fundamental aspect of account management. This function should include identity verification steps, such as asking for the current password before allowing a new one to be set, ensuring account security.

Edit Account Details

Users should have the ability to edit their account details. This function must be intuitive and user-friendly, allowing changes to personal information like name, email, and contact details. Implementing proper validation rules to ensure the integrity of the updated information is critical.

Each function in the account management system plays a pivotal role in ensuring a secure and user-friendly experience. The details matter just as much as the broader picture in building trust and reliability in your SaaS platform.

Code Snippet

def account_register(request):
    if request.user.is_authenticated:
        return redirect("account:dashboard")

    if request.method == "POST":
        registerForm = RegistrationForm(data=request.POST)
        loginForm = UserLoginForm()
        # Check if the email domain is disposable
        if is_disposable_email(registerForm.data["email"]):
            print('is_disposable_email')
            messages.error(request, 'Registrations using disposable email addresses are not allowed.')
            return render(request, "account/registration/register.html", {"registerForm": registerForm, "loginForm": loginForm})

        if registerForm.is_valid():
            user = registerForm.save(commit=False)
            user.email = registerForm.cleaned_data["email"]
            user.name = registerForm.cleaned_data["user_name"]
            user.set_password(registerForm.cleaned_data["password"])
            user.is_active = False
            user.save()
            group = Group.objects.get(name='Default')
            user.groups.add(group)

            current_site = get_current_site(request)
            subject = "Activate your Account"
            message = render_to_string(
                "account/registration/account_activation_email.html",
                {
                    "user": user,
                    "domain": current_site.domain,
                    "uid": urlsafe_base64_encode(force_bytes(user.pk)),
                    "token": account_activation_token.make_token(user),
                },
            )
            user.email_user(subject=subject, message=message)
            # send_mail("Jawad", subject, user.email, message,
            #           ['projet3dmaroc@gmail.com', user.email])
            if not getattr(request, 'skip_facebook_pixel', False):
                send_facebook_event(request, "Lead", email=user.email)
            return render(request, "account/registration/register_email_confirm.html", {"form": registerForm})
        else:
            messages.error(request, 'Please correct the error below.')


    else:
        registerForm = RegistrationForm()
        loginForm = UserLoginForm()
    return render(request, "account/registration/register.html", {"registerForm": registerForm, "loginForm": loginForm})



def account_activate(request, uidb64, token):
    try:
        uid = force_str(urlsafe_base64_decode(uidb64))
        user = Customer.objects.get(pk=uid)
    except (TypeError, ValueError, OverflowError, user.DoesNotExist):
        user = None
    if user is not None and account_activation_token.check_token(user, token):
        user.is_active = True
        user.save()
        login(request, user)
        print("-CompleteRegistration-")
        if not getattr(request, 'skip_facebook_pixel', False):
                send_facebook_event(request, "CompleteRegistration")
        return render(request, "account/registration/register_success.html")
    else:
        return render(request, "account/registration/activation_invalid.html")