chore(accounts): django-axes keeps no record of successful logins

django-axes wrote an AccessLog row at every successful login and nothing
removed them; the Logs page already records each login. Its access log
is now off; failed logins are still counted for the lock.

accounts/tests/test_login_lockout.py

@@ -38,6 +38,14 @@ class LoginLockoutTests(TestCase):
         self.login("wrong")
         self.assertEqual(self.login("right-pass-1").status_code, 302)
 
+    def test_a_successful_login_is_logged_on_the_logs_page_only(self):
+        from axes.models import AccessLog
+        from logs.models import Logs
+
+        self.assertEqual(self.login("right-pass-1").status_code, 302)
+        self.assertTrue(Logs.objects.filter(user="lo-user").exists())
+        self.assertFalse(AccessLog.objects.exists())
+
     def test_the_proxy_header_is_trusted_only_from_the_local_proxy(self):
         # direct requests: X-Real-IP is ignored, so changing it does not escape the lock
         for n in range(3):

webvirtcloud/settings.py.template

@@ -191,6 +191,8 @@ AXES_FAILURE_LIMIT = "accounts.lockout.failure_limit"
 AXES_COOLOFF_TIME = "accounts.lockout.cooloff_time"
 AXES_LOCKOUT_PARAMETERS = [["username", "ip_address"]]
 AXES_RESET_ON_SUCCESS = True
+# successful logins are on the Logs page; django-axes' own record of them would only grow
+AXES_DISABLE_ACCESS_LOG = True
 AXES_CLIENT_IP_CALLABLE = "accounts.lockout.client_ip"
 # Reverse proxies other than a local one whose X-Real-IP header gives the
 # client address, e.g. ["10.0.0.5", "172.18.0.0/16"]