# Sharing password management functionality within auth forms

**URL:** <https://forum.djangoproject.com/t/sharing-password-management-functionality-within-auth-forms/28116>\
**Category:** Django Internals\
**Created:** [February 15, 2024, 4:29pm UTC](https://forum.djangoproject.com/t/sharing-password-management-functionality-within-auth-forms/28116 "2024-02-15T16:29:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nessita](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/nessita/32/12194_2.png) [@nessita](https://forum.djangoproject.com/u/nessita)\
**Post date:** [February 15, 2024, 4:29pm UTC](https://forum.djangoproject.com/t/sharing-password-management-functionality-within-auth-forms/28116/1 "2024-02-15T16:29:45Z")

</div>

Hello everyone!

While continuing with the review for the new feature proposed in [PR #16942](https://github.com/django/django/pull/16942), I stumbled with the following question for which I’m not 100% sure about the answer, so I’m reaching out to you all to hear/read your thoughts (@adamchainz @carltongibson I’m particularly interested in your view).

## Intro

The new feature is about allowing admin users to set unusable password for users. This work requires changes in every “form that deals with passwords”, so a few review iterations ago I asked Fabian to define a `SetPasswordMixin` to isolate and unify this non trivial (and new) logic. I also requested that we [split the creation and usage of the mixin in two commits](https://github.com/django/django/pull/16942/commits) to ease reviewing.

## Challenge

Now, I’m reviewing those two commits and while they match my request, it bothered me that `SetPasswordMixin` inherits from `forms.Form`. So, I started making changes locally to make the mixin a “pure” mixin, removing the inheritance on `forms.Form` and adjusting the methods so they make sense for the “real” forms (`BaseUserCreationForm`, `AdminPasswordChangeForm`, and tangentially `SetPasswordForm`). This is what I ended up with:

> <https://github.com/nessita/django/pull/7/files>
>
> \[ticket-34429\](https://code.djangoproject.com/ticket/34429)

Is this a “sufficiently idiomatic” proposal? Is there a better/cleaner way? Would inheriting from `forms.Form` be preferred?

---

<div class="post-metadata">

**Author:** ![carltongibson](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/carltongibson/32/267_2.png) [@carltongibson](https://forum.djangoproject.com/u/carltongibson)\
**Post date:** [February 15, 2024, 7:12pm UTC](https://forum.djangoproject.com/t/sharing-password-management-functionality-within-auth-forms/28116/2 "2024-02-15T19:12:18Z")

</div>

Hi @nessita.

I had a quick look at the PR.

I haven’t been following it closely, so I’d defer to those already involved, but the mixin change looked reasonable enough on the surface. Certainly given the amount of thought that’s gone in, it seems likely so. (I’m not sure I can say more without spending quite a bit more time so let me know if that’s sufficient.)

(I thought the release note could do with a rephrase…)

HTH.  
C.