Add AXES_ENABLE_ADMIN flag to configure showing Axes in admin (#499)

axes/admin.py

@@ -1,10 +1,10 @@
+from django.conf import settings
 from django.contrib import admin
 from django.utils.translation import gettext_lazy as _
 
 from axes.models import AccessAttempt, AccessLog
 
 
-@admin.register(AccessAttempt)
 class AccessAttemptAdmin(admin.ModelAdmin):
     list_display = (
         "attempt_time",
@@ -43,7 +43,6 @@ class AccessAttemptAdmin(admin.ModelAdmin):
         return False
 
 
-@admin.register(AccessLog)
 class AccessLogAdmin(admin.ModelAdmin):
     list_display = (
         "attempt_time",
@@ -77,3 +76,8 @@ class AccessLogAdmin(admin.ModelAdmin):
 
     def has_add_permission(self, request):
         return False
+
+
+if settings.AXES_ENABLE_ADMIN:
+    admin.site.register(AccessAttempt, AccessAttemptAdmin)
+    admin.site.register(AccessLog, AccessLogAdmin)

axes/conf.py

@@ -23,6 +23,9 @@ class AxesAppConf(AppConf):
     # lock out just for admin site
     ONLY_ADMIN_SITE = False
 
+    # show Axes logs in admin
+    ENABLE_ADMIN = True
+
     # lock out with the user agent, has no effect when ONLY_USER_FAILURES is set
     USE_USER_AGENT = False
 

axes/tests/test_admin.py

@@ -0,0 +1,28 @@
+from contextlib import suppress
+from importlib import reload
+
+from django.contrib import admin
+from django.test import override_settings
+
+import axes.admin
+from axes.models import AccessAttempt, AccessLog
+from axes.tests.base import AxesTestCase
+
+
+class AxesEnableAdminFlag(AxesTestCase):
+    def setUp(self):
+        with suppress(admin.sites.NotRegistered):
+            admin.site.unregister(AccessAttempt)
+        with suppress(admin.sites.NotRegistered):
+            admin.site.unregister(AccessLog)
+
+    @override_settings(AXES_ENABLE_ADMIN=False)
+    def test_disable_admin(self):
+        reload(axes.admin)
+        self.assertFalse(admin.site.is_registered(AccessAttempt))
+        self.assertFalse(admin.site.is_registered(AccessLog))
+
+    def test_enable_admin_by_default(self):
+        reload(axes.admin)
+        self.assertTrue(admin.site.is_registered(AccessAttempt))
+        self.assertTrue(admin.site.is_registered(AccessLog))

docs/4_configuration.rst

@@ -38,6 +38,9 @@ The following ``settings.py`` options are available for customizing Axes behavio
   and never lock based on IP if attempts exceed the limit.
   Otherwise utilize the existing IP and user locking logic.
   Default: ``False``
+* ``AXES_ENABLE_ADMIN``: If ``True``, admin views for access attempts and
+  logins are shown in Django admin interface.
+  Default: ``True``
 * ``AXES_LOCK_OUT_BY_COMBINATION_USER_AND_IP``: If ``True``, prevent login
   from IP under a particular username if the attempt limit has been exceeded,
   otherwise lock out based on IP.