Bad User Creation

user.py

from django.core.exceptions import ValidationError
from django.shortcuts import get_object_or_404
from rest_framework import status
from rest_framework.response import Response
from rest_framework.views import APIView
from v1.accounts.models.profile import Profile
from v1.accounts.models.user import User
from v1.accounts.serializers.user import UserSerializer, UserSerializerCreate, UserSerializerLogin, UserSerializerUpdate
from v1.credits.models.invitation import Invitation
from v1.utils import constants
from v1.utils.permissions import is_administrator, is_moderator


def get_valid_invitation(code):
    """
    Returns valid (unused) invitation or None
    """

    try:
        return Invitation.objects.filter(code=code, receiver__isnull=True).first()
    except ValidationError:
        return None


# users
class UserView(APIView):
    authentication_classes = ()
    permission_classes = ()

    @staticmethod
    def get(request):
        """
        List users
        """

        users = User.objects.all()
        return Response(UserSerializer(users, many=True).data)

    @staticmethod
    def post(request):
        """
        Create user (must have valid invitation code or administrator permissions)
        """

        invitation = get_valid_invitation(request.data.get('code'))
        if not invitation and not is_administrator(request.user):
            return Response(status=status.HTTP_403_FORBIDDEN)

        serializer = UserSerializerCreate(data=request.data, context={'request': request})
        if serializer.is_valid():
            user = serializer.save()
            sponsor = request.user
            if invitation:
                sponsor = invitation.sender
                invitation.receiver = user
                invitation.save()
            Profile(sponsor=sponsor, user=user).save()
            return Response(UserSerializerLogin(user).data, status=status.HTTP_201_CREATED)

        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)