[ENG-445] refact: user change password py to pydantic#3667
Merged
vigneshhari merged 12 commits intoJul 3, 2026
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughReplaces DRF serializer flow with a Pydantic ChangePasswordSpec that strips whitespace and validates old/new passwords; updates ChangePasswordView to parse via the spec and return via the configured exception handler; rewrites tests to centralize payloads and add whitespace-handling and invalid-password cases. ChangesPassword Change Validation Refactor
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related PRs
Suggested labels
Suggested Reviewers
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Greptile SummaryThis PR refactors the change-password endpoint from a DRF serializer to a Pydantic
Confidence Score: 4/5Safe to merge after confirming CommonPasswordValidator is in AUTH_PASSWORD_VALIDATORS and that API consumers can tolerate the new model-level error shape. The core logic is correct and the previously identified 500-error and schema annotation bugs are fixed. The one lingering concern is that test_change_password_invalid_password implicitly relies on a specific validator being configured — if that assumption doesn't hold the test will fail rather than erroneously pass, so it is a test reliability issue rather than a silent production defect. care/users/tests/test_change_password.py — the test_change_password_invalid_password test's correctness depends on validator configuration that is not stated in the test itself. Important Files Changed
Reviews (3): Last reviewed commit: "Fix review comment" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@care/users/api/viewsets/change_password.py`:
- Around line 18-22: The top-level request=ChangePasswordSpec on
extend_schema_view won't apply to per-operation docs; move the
request=ChangePasswordSpec into each per-method extend_schema call so the PUT
and PATCH operations get the ChangePasswordSpec request body. Update the
extend_schema_view usage so extend_schema(tags=["users"],
request=ChangePasswordSpec) is applied for the put and patch entries (i.e.,
put=extend_schema(tags=["users"], request=ChangePasswordSpec) and
patch=extend_schema(tags=["users"], request=ChangePasswordSpec)), referencing
extend_schema_view, extend_schema, put, patch, and ChangePasswordSpec.
- Line 32: Wrap the construction of ChangePasswordSpec(**request.data) in a
try/except that catches pydantic.ValidationError in the change password view
(change_password.py) and translate it to a DRF 400 response by raising
rest_framework.exceptions.ValidationError (or returning Response with status=400
and the validation details); reference the ChangePasswordSpec symbol and the
view's handler where request.data is parsed. Also add a new test
test_change_password_missing_fields in care/users/tests/test_change_password.py
that POSTs with missing/invalid old_password or new_password and asserts HTTP
400 plus the returned validation error details.
In `@care/users/tests/test_change_password.py`:
- Around line 44-49: The test test_change_password_invalid_password currently
sets self.payload["new_password"] to the same value as the current password, so
the final assertion self.user.check_password("password123") is meaningless;
change the test to record the current password (or use its known value) as
original_password, set self.payload["new_password"] to a distinct invalid value
(e.g. "invalid_new_pwd"), call self.client.put(self.url, self.payload,
format="json") as before, refresh the user with self.user.refresh_from_db(), and
assert that self.user.check_password(original_password) is still True to prove
the password was not changed.
- Around line 10-15: The test uses hardcoded passwords
(password123/newpassword456) in care/users/tests/test_change_password.py via
create_user_with_password and payload which will trigger Ruff bandit rules
S105/S106; either add "S105,S106" to
tool.ruff.lint.per-file-ignores["**/tests/**"] in ruff.toml so tests are exempt,
or change the test to generate non-literal passwords (e.g., derive them at
runtime via secrets or a test factory) and assign them to the same variables
used (self.create_user_with_password call and
self.payload["old_password"/"new_password"]) to avoid hardcoded string literals.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 89f9cbab-0607-4c27-bfe2-4ce029b0d1ba
📒 Files selected for processing (3)
care/users/api/viewsets/change_password.pycare/users/tests/__init__.pycare/users/tests/test_change_password.py
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
care/users/tests/test_change_password.py (1)
51-91: ⚡ Quick winWhitespace coverage only exercises
old_password;new_passwordstripping is left untested.These three tests thoroughly cover stripping on
old_password, which is nice. However,ChangePasswordSpec.strip_passwordsalso stripsnew_password— meaning a user submitting"newpassword456 "would silently get a different stored password than they typed. That behavior currently has no test guarding it. Consider adding a case that submits anew_passwordwith surrounding whitespace and asserts the stripped value is what's persisted.💚 Suggested additional test
def test_change_password_strips_new_password_whitespace(self): self.payload["new_password"] = " newpassword456 " response = self.client.put(self.url, self.payload, format="json") self.assertEqual(response.status_code, status.HTTP_200_OK) self.user.refresh_from_db() self.assertTrue(self.user.check_password("newpassword456")) self.assertFalse(self.user.check_password(" newpassword456 "))🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@care/users/tests/test_change_password.py` around lines 51 - 91, The tests exercise stripping of old_password but miss asserting that new_password is stripped before being stored; add a test in care/users/tests/test_change_password.py (e.g., test_change_password_strips_new_password_whitespace) that sets self.payload["new_password"] to a value with surrounding whitespace, sends the PUT to self.url, asserts a 200 response, refreshes self.user (self.user.refresh_from_db()) and then asserts the stored password matches the stripped value (self.user.check_password("newpassword456")) and not the unstripped value; this verifies ChangePasswordSpec.strip_passwords correctly strips new_password as well.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@care/users/tests/test_change_password.py`:
- Around line 51-91: The tests exercise stripping of old_password but miss
asserting that new_password is stripped before being stored; add a test in
care/users/tests/test_change_password.py (e.g.,
test_change_password_strips_new_password_whitespace) that sets
self.payload["new_password"] to a value with surrounding whitespace, sends the
PUT to self.url, asserts a 200 response, refreshes self.user
(self.user.refresh_from_db()) and then asserts the stored password matches the
stripped value (self.user.check_password("newpassword456")) and not the
unstripped value; this verifies ChangePasswordSpec.strip_passwords correctly
strips new_password as well.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: d62a9170-ec83-4e85-b589-77ef178d2a0a
📒 Files selected for processing (3)
care/emr/tests/test_reset_password_api.pycare/users/api/viewsets/change_password.pycare/users/tests/test_change_password.py
💤 Files with no reviewable changes (1)
- care/emr/tests/test_reset_password_api.py
🚧 Files skipped from review as they are similar to previous changes (1)
- care/users/api/viewsets/change_password.py
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #3667 +/- ##
===========================================
+ Coverage 79.55% 79.66% +0.10%
===========================================
Files 479 479
Lines 22996 23010 +14
Branches 2378 2379 +1
===========================================
+ Hits 18295 18330 +35
+ Misses 4096 4080 -16
+ Partials 605 600 -5 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
vigneshhari
requested changes
May 30, 2026
vigneshhari
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@care/users/api/viewsets/change_password.py`:
- Around line 27-44: The validator validate_passwords is running after
new_password has been normalized/stripped so the server may silently change the
credential; fix by validating the original, unmodified new password instead of
mutating self.new_password: retrieve the raw submitted value from the
request/validation context (e.g., info.context["raw_new_password"] or similar)
and pass that raw value into validate_password (leave self.new_password
untouched), or alternatively move normalization to happen after
validate_passwords so validate_passwords always sees the exact user-submitted
new_password; ensure no assignment to self.new_password in validate_passwords
and keep references to old_password, new_password, validate_passwords, and
set_password in mind when making the change.
- Around line 65-66: ChangePasswordSpec is too permissive: add Pydantic model
config to forbid unknown fields so
ChangePasswordSpec.model_validate(request.data, context={"user": request.user})
will raise on extra keys. Modify the ChangePasswordSpec class to include
model_config = ConfigDict(extra="forbid") (import ConfigDict from pydantic) so
unexpected request keys are rejected; keep using
ChangePasswordSpec.model_validate(...) where currently called.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 3fa8b4ef-a714-41bc-a9e4-4f43655f5eee
📒 Files selected for processing (2)
care/users/api/viewsets/change_password.pycare/users/tests/test_change_password.py
vigneshhari
changed the title
nandkishorr
force-pushed
the
ENG-445-move-care-users-api-viewsets-change-password-py-to-pydantic
branch
from
c382f93 to
9412d6d
Compare
vigneshhari
deleted the
ENG-445-move-care-users-api-viewsets-change-password-py-to-pydantic
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Associated Issue
Merge Checklist
/docsOnly PR's with test cases included and passing lint and test pipelines will be reviewed
@ohcnetwork/care-backend-maintainers @ohcnetwork/care-backend-admins
Summary by CodeRabbit
Bug Fixes
Tests