BaseUserCreationForm should not have the admin-specific usable_password field

[Simon Willison]

A bug came up today in django-registration where a new form field for the registration flow suddenly appeared called "Password-based authentication" - it turns out that's because a usable_password field that was added to the Django UserCreationForm class in the latest release.

Bug report here: ​https://github.com/ubernostrum/django-registration/issues/245

It appears that the django.contrib.auth.forms.UserCreationForm class isn't actually intended for use outside the admin, it would be great if the documentation reflected that.

[Tim Graham]

Based on past efforts (e.g. #34438), it's inaccurate to say that UserCreationForm is intended only for the admin. The addition of the usable_password field to UserCreationForm in #34429 should likely be reverted. This field could be added to a new UserCreationForm subclass in contrib/admin/forms.py.

[James Bennett]

Forum discussion: ​https://forum.djangoproject.com/t/the-purpose-of-usercreationform/33836

[Natalia Bidart]

Fabian has started a draft PR and so did I when I assigned the ticket to myself this morning. I think we want to keep the unusable password functionality from the AdminPasswordChangeForm, so I believe we should follow the approach from ​PR 18484.

Both PRs needs docs updates.

[Natalia Bidart]

​PR is ready for review, Fabian and I agreed on closing the other one.

[Carlton Gibson]

Just worth copying here from the Forum thread, ​a workaround for the very short term:

I ran into this and quickly added to following my subclass.

# Remove the option to create an account with an unusable password.
usable_password = None

Hopefully that saves someone a cycle.

[nessita <124304+nessita@…>]

In b60fd87:

Refs #35678 -- Split tests for BaseUserCreationForm when using a custom User model.

This work also allows to subclass BaseUserCreationFormTest to reuse the
tests and assertions for testing forms that extend BaseUserCreationForm,
which is now used for UserCreationFormTest, increasing its coverage.

[nessita <124304+nessita@…>]

In 0ebed5f:

Fixed #35678 -- Removed "usable_password" field from BaseUserCreationForm.

Refs #34429: Following the implementation allowing the setting of
unusable passwords via the admin site, the BaseUserCreationForm and
UserCreationForm were extended to include a new field for choosing
whether password-based authentication for the new user should be enabled
or disabled at creation time.
Given that these forms are designed to be extended when implementing
custom user models, this branch ensures that this new field is moved to
a new, admin-dedicated, user creation form AdminUserCreationForm.

Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3.

Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for
the review.

[Natalia <124304+nessita@…>]

In cfad0655:

[5.1.x] Refs #35678 -- Split tests for BaseUserCreationForm when using a custom User model.

This work also allows to subclass BaseUserCreationFormTest to reuse the
tests and assertions for testing forms that extend BaseUserCreationForm,
which is now used for UserCreationFormTest, increasing its coverage.

Backport of b60fd8722f305ec29c87f34d3fea262e56394ebd from main.

[Natalia <124304+nessita@…>]

In da22e6cb:

[5.1.x] Fixed #35678 -- Removed "usable_password" field from BaseUserCreationForm.

Refs #34429: Following the implementation allowing the setting of
unusable passwords via the admin site, the BaseUserCreationForm and
UserCreationForm were extended to include a new field for choosing
whether password-based authentication for the new user should be enabled
or disabled at creation time.
Given that these forms are designed to be extended when implementing
custom user models, this branch ensures that this new field is moved to
a new, admin-dedicated, user creation form AdminUserCreationForm.

Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3.

Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for
the review.

Backport of 0ebed5fa95f53b87383901bbd9341ef3c974344f from main.