d0a550fee6
- Extract comment templates into reusable partials (_comment.html, _comment_form.html, _comment_list.html, _reply_form.html, etc.) - Add HTMX progressive enhancement: inline form submission with partial responses, delta polling for live updates, form reset on success, success/moderation toast feedback - Integrate Cloudflare Turnstile for invisible bot protection: server-side token validation with hostname check, fail-closed on errors/timeouts, feature-flagged via TURNSTILE_SECRET_KEY env var - Auto-approve comments that pass Turnstile; keep manual approval as fallback when Turnstile is disabled (model default stays False) - Add CommentReaction model with UniqueConstraint for session-based anonymous reactions (heart/thumbs-up), toggle support, separate rate-limit bucket (20/min) - Add comment poll endpoint (GET /comments/poll/<id>/?after_id=N) for HTMX delta polling without duplicates - Update CSP middleware to allow challenges.cloudflare.com in script-src, connect-src, and frame-src - Self-host htmx.min.js (v2.0.4) to minimize CSP surface area - Add django-htmx middleware and requests to dependencies - Add Unapprove bulk action to Wagtail admin for moderation - Extend PII purge command to anonymize reaction session_key - Design refresh: neon glow avatars, solid hover shadows, gradient section header, cyan reply borders, grid-pattern empty state, neon-pink focus glow on form inputs - Add turnstile_site_key to template context via context processor - 18 new tests covering HTMX contracts, Turnstile success/failure/ timeout/hostname-mismatch, polling deltas, reaction toggle/dedup/ rate-limit, CSP headers, and PII purge extension Closes #43 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
43 lines
1.4 KiB
Python
43 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
from .consent import ConsentService
|
|
|
|
|
|
class ConsentMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
request.consent = ConsentService.get_consent(request)
|
|
return self.get_response(request)
|
|
|
|
|
|
class SecurityHeadersMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
ADMIN_PREFIXES = ("/cms/", "/django-admin/")
|
|
|
|
def __call__(self, request):
|
|
nonce = secrets.token_urlsafe(16)
|
|
request.csp_nonce = nonce
|
|
response = self.get_response(request)
|
|
if request.path.startswith(self.ADMIN_PREFIXES):
|
|
return response
|
|
response["Content-Security-Policy"] = (
|
|
f"default-src 'self'; "
|
|
f"script-src 'self' 'nonce-{nonce}' https://challenges.cloudflare.com; "
|
|
"style-src 'self' https://fonts.googleapis.com; "
|
|
"img-src 'self' data: blob:; "
|
|
"font-src 'self' https://fonts.gstatic.com; "
|
|
"connect-src 'self' https://challenges.cloudflare.com; "
|
|
"frame-src https://challenges.cloudflare.com; "
|
|
"object-src 'none'; "
|
|
"base-uri 'self'; "
|
|
"frame-ancestors 'self'"
|
|
)
|
|
response["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
|
|
return response
|