Why doesn't django's model.save() call full_clean()?

Question

I'm just curious if anyone knows if there's good reason why django's orm doesn't call 'full_clean' on a model unless it is being saved as part of a model form.

Note that full_clean() will not be called automatically when you call your model’s save() method. You’ll need to call it manually when you want to run one-step model validation for your own manually created models. django's full clean doc

(NOTE: quote updated for Django 1.6... previous django docs had a caveat about ModelForms as well.)

Are there good reasons why people wouldn't want this behavior? I'd think if you took the time to add validation to a model, you'd want that validation run every time the model is saved.

I know how to get everything to work properly, I'm just looking for an explanation.

Murrelet

Thank you very much for this question, it stoped me from banging my head against the wall much more time. I created a mixin that might help others. Check out the gist: gist.github.com/glarrain/5448253 – Heartstrings

And I finally use signal to catch the pre_save hook and do full_clean on all caught models. – Sociolinguistics

Answer 1

AFAIK, this is because of backwards compatibility. There are also problems with ModelForms with excluded fields, models with default values, pre_save() signals, etc.

Sources you might be intrested in:

• http://code.djangoproject.com/ticket/13100
• http://groups.google.com/group/django-developers/browse_frm/thread/b888734b05878f87

Junco

The most helpful excerpt (IMHO) from the second reference: "Developing an "automatic" validation option which is both simple enough to actually be useful and robust enough to handle all the edge cases is -- if it's even possible -- far more than can be accomplished on the 1.2 timeframe. Hence, for now, Django doesn't have any such thing, and won't have it in 1.2. If you think you can make it work for 1.3, your best bet is to work up a proposal, including at least some sample code, along with an explanation of how you'll keep it both simple and robust." – Mutton

This is quite outdated now, do you know if this is still the case? – Groovy

Answer 2

Because of the compatibility considering, the auto clean on save is not enabled in django kernel.

If we are starting a new project and want the default save method on Model could clean automatically, we can use the following signal to do clean before every model was saved.

from django.dispatch import receiver
from django.db.models.signals import pre_save, post_save

@receiver(pre_save)
def pre_save_handler(sender, instance, *args, **kwargs):
    instance.full_clean()

Sociolinguistics

Why is this better (or worse) than overriding the save method on some BaseModel (which all others will inherit from) to call full_clean first, then call super()? – Anthropogenesis

@Anthropogenesis Obviously, this method applies on all models, not on a specific one, so you can write once, use everywhere. If you override some BaseModel, you have to write for each model. – Sociolinguistics

However, the signal precludes the possibility of having an exception later on. I don't see why I'd need to make an exception, but it is a disadvantage. – Anthropogenesis

docs.djangoproject.com/en/1.10/ref/models/instances/… See, the clean method should throw an ValidationError when validation failed, it is a recommend procedure. BTW, if the answer helps, please upvote. – Sociolinguistics

Uhm, you might be misinterpreting my use of the word 'exception', but I appreciate the response. – Anthropogenesis

I see two problems with this approach 1) in case of ModelForm's full_clean() would be called twice: by the form and by the signal 2) If the form excludes some fields, they would still be validated by the signal. – Saturday

@Saturday So may be you can add these if send == somemodel, then exclude some fields in pre_save_handler – Cyrstalcyrus

For those who are using or considering using this approach: keep in mind that this approach is not officially supported by Django and won't be supported in the foreseeable future (see this comment in Django bug tracker: code.djangoproject.com/ticket/29655#comment:3), so you are likely to stumble upon some imperfections like authentication stopping to work (code.djangoproject.com/ticket/29655) if you enable validation for all models. You will have to deal with such problems yourself. However, there is no better approach atm. – Catenate

Thank you for your recommend, but still we can make small effort to filter the models with our custom whitelist or blacklist, and this problem can be avoided. – Sociolinguistics

As of Django 2.2.3, this causes an issue with the basic authentication system. You will get a ValidationError: Session with this Session key already exists. To avoid this, you need to add an if-statement for sender in list_of_model_classes to prevent the signal from overriding Django's default auth models. Define list_of_model_classes however you choose – Zabrze

Answer 3

The simplest way to call the full_clean method is just to override the save method in your model:

class YourModel(models.Model):
    ...  
    
    def save(self, *args, **kwargs):
        self.full_clean()
        return super(YourModel, self).save(*args, **kwargs)

Prissie

Why is this better (or worse) than using a signal? – Anthropogenesis

I see two problems with this approach 1) in case of ModelForm's full_clean() would be called twice: by the form and by the save 2) If the form excludes some fields, they would still be validated by the save. – Saturday

Probably better to define a new clean_save() method which calls full_clean() then save() and use this explicitly when manually saving your custom models? – Fletcherfletcherism

Answer 4

Commenting on @Alfred Huang's answer and coments on it. One might lock the pre_save hook down to an app by defining a list of classes in the current module (models.py) and checking against it in the pre_save hook:

CUSTOM_CLASSES = [obj for name, obj in
        inspect.getmembers(sys.modules[__name__])
        if inspect.isclass(obj)]

@receiver(pre_save)
def pre_save_handler(sender, instance, **kwargs):
    if type(instance) in CUSTOM_CLASSES:
        instance.full_clean()

Carpathoukraine

Answer 5

A global pre_save signal can work well if you want to always ensure model validation. However it will run into issues with Django's auth in current versions (3.1.x) and could cause issues with models from other apps you are using.

Elaborating on @Peter Shannon's answer, this version will only validate models inside the module you execute it in, skips validation with "raw" saves and adds a dispatch_uid to avoid duplicate signals.

from django.db.models.signals import pre_save
import inspect
import sys

MODELS = [obj for name, obj in
    inspect.getmembers(sys.modules[__name__], inspect.isclass)]

def validate_model(sender, instance, **kwargs):
    if 'raw' in kwargs and not kwargs['raw']:
        if type(instance) in MODELS:
            instance.full_clean()

pre_save.connect(validate_model, dispatch_uid='validate_models')

Urethritis

Nice answer. 2 things: 1. this snippet must be added a the the bottom of models.py after all the Models definitions. 2. you can use dict.get() instead of doing 2 checks. – Amongst

Answer 6

If you have a model that you want to ensure has at least one FK relationship, and you don't want to use null=False because that requires setting a default FK (which would be garbage data), the best way I've come up with is to add custom .clean() and .save() methods. .clean() raises the validation error, and .save() calls the clean. This way the integrity is enforced both from forms and from other calling code, the command line, and tests. Without this, there is (AFAICT) no way to write a test that ensures that a model has a FK relation to a specifically chosen (not default) other model.

class Payer(models.Model):

    name = models.CharField(blank=True, max_length=100)
    # Nullable, but will enforce FK in clean/save:
    payer_group = models.ForeignKey(PayerGroup, null=True, blank=True,)

    def clean(self):
        # Ensure every Payer is in a PayerGroup (but only via forms)
        if not self.payer_group:
            raise ValidationError(
                {'payer_group': 'Each Payer must belong to a PayerGroup.'})

    def save(self, *args, **kwargs):
        self.full_clean()
        return super().save(*args, **kwargs)

    def __str__(self):
        return self.name

Prosciutto

Answer 7

Instead of inserting a piece of code that declares a receiver, we can use an app as INSTALLED_APPS section in settings.py

INSTALLED_APPS = [
    # ...
    'django_fullclean',
    # your apps here,
]

Before that, you may need to install django-fullclean using PyPI:

pip install django-fullclean

Sociolinguistics

Why would you pip install some app with 4 lines of code in it (check the source code) instead of writing these lines yourself? – Anthropogeography

Another library which I haven't tried myself: github.com/danielgatis/django-smart-save – Dactylology