Fix #1159: Fallback to USERNAME_FIELD when AXES_USERNAME_FORM_FIELD not in credentials

[Dzhud]

Fix #1159: Fallback to USERNAME_FIELD when AXES_USERNAME_FORM_FIELD not in credentials

Summary

When AXES_USERNAME_FORM_FIELD is set to a custom value (e.g., "auth-username"), the AccessAttempt record wasn't getting the username populated because Django's user_login_failed signal sends credentials using USERNAME_FIELD (typically "username"), not the custom field name.

Changes

• Modified get_client_username() in axes/helpers.py to add fallback logic:
  • First tries the configured AXES_USERNAME_FORM_FIELD
  • Falls back to Django's get_user_model().USERNAME_FIELD if not found
• Updated documentation in docs/4_configuration.rst to describe the fallback behavior

How it works

# Before: Would return None
credentials = {"username": "john"}  # From Django's signal
settings.AXES_USERNAME_FORM_FIELD = "auth-username"
get_client_username(request, credentials)  # → None

# After: Falls back to USERNAME_FIELD
get_client_username(request, credentials)  # → "john"

Tests

Wrote 3 new tests to cover this fix:

Test	Description
test_get_client_username_fallback_to_username_field_from_credentials	Verifies fallback works when credentials use Django's USERNAME_FIELD
test_get_client_username_fallback_to_username_field_from_request	Verifies fallback works for request.POST data
test_get_client_username_custom_field_takes_priority	Ensures custom field is still preferred when present

Verification

• ✅ All existing tests pass (354 tests)
• ✅ All new tests pass (3 tests)
• ✅ mypy passes with no errors
• ✅ Documentation updated

Fixes #1159