Decorators API

View-protection helpers, exported from the package root:

from django_gauth import gauth_required, GauthRequiredMixin

Both are dual-mode: when GOOGLE_USER_INTEGRATION is enabled they read request.user.is_authenticated (so admin/password logins count too); otherwise they fall back to the session-only check_gauth_authentication() check — so they work with or without a User model.

On failure they honour the same response= convention as login() / logout(): redirect (a 302 to the login endpoint, default) or json (a 401 body).

Django REST Framework is not supported (yet)

gauth_required and GauthRequiredMixin target Django's native view contract (django.http.HttpRequest, request.session, request.user as populated by AuthenticationMiddleware). They are not designed for Django REST Framework views.

On a DRF view, request.user is populated by DRF's own authentication_classes (not Django's middleware), access control is expected to flow through permission_classes, and failures should be raised as DRF exceptions (rendered 401/403) rather than returned as a 302 redirect. Using these helpers on APIView / ViewSet / @api_view endpoints may therefore behave incorrectly.

DRF-native adapters (a BaseAuthentication + BasePermission pair) are planned — track this feature request. Until then, protect DRF endpoints with DRF's own authentication/permission classes.

---

gauth_required

Protects a function-based view. Usable bare or parameterised.

Parameters:

Name	Type	Default	Description
view_func	Callable \| None	—	Supplied automatically when used bare
response	str	"redirect"	"redirect" (302 to login) or "json" (401 body)
login_url	str \| None	None	Redirect target override; defaults to reverse("django_gauth:login")

Raises: ValueError if response is not "redirect" or "json".

from django_gauth import gauth_required

@gauth_required
def dashboard(request):
    return render(request, "dashboard.html")

@gauth_required(response="json")
def api_me(request):
    return JsonResponse({"email": request.user.email})

@gauth_required(login_url="/accounts/login/")
def billing(request):
    ...

On an unauthenticated request the json mode returns:

{ "detail": "Authentication required.", "authenticated": false }

---

GauthRequiredMixin

The class-based-view equivalent. Place it before the base view so super().dispatch resolves correctly, and configure via class attributes.

Attribute	Type	Default	Description
gauth_response	str	"redirect"	"redirect" or "json"
gauth_login_url	str \| None	None	Redirect target override

Raises: ValueError (at dispatch) if gauth_response is invalid.

from django.views.generic import TemplateView
from django_gauth import GauthRequiredMixin

class Dashboard(GauthRequiredMixin, TemplateView):
    template_name = "dashboard.html"

class MeView(GauthRequiredMixin, View):
    gauth_response = "json"

    def get(self, request):
        return JsonResponse({"email": request.user.email})

Works before you have a User model

Because the guard falls back to the session check when integration is off, you can protect views on day one — and the same decorator keeps working unchanged once you flip on GOOGLE_USER_INTEGRATION.