django-codenerix 5.3.2__tar.gz → 5.3.3__tar.gz

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/CHANGELOG

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.3.3] - 2026-10-13
+### Security
+- `autoload()` inserts the debug toolbar middleware (`DebugToolbarMiddleware`, or `DebugPanelMiddleware` with `DEBUG_PANEL`) at the start of `MIDDLEWARE`, or right after `GZipMiddleware` when present, instead of appending it. Appended, it sat behind Django's page cache (`UpdateCacheMiddleware` ... `FetchFromCacheMiddleware`): responses without cookies were cached with the toolbar output (`djdt-request-id`, `Server-Timing` with SQL timings, or the full toolbar HTML) and served to every client, and cache hits bypassed the toolbar. A toolbar middleware already present in `MIDDLEWARE` keeps its position. Other extra middlewares are still appended.
+- `show_toolbar` fails closed, and system check `codenerix.E001` reports it, when a toolbar middleware comes after a page cache middleware in `MIDDLEWARE`, with or without `DEBUG_TOOLBAR_ALLOWED_IPS`. This covers settings that add the page cache after calling `autoload()`, and Django's recommended `UpdateCacheMiddleware` before `GZipMiddleware` order, where the toolbar cannot sit both after GZip and before the cache.
+
 ## [5.3.2] - 2026-10-07
 ### Security
 - `OTPAuthMiddleware` only follows the post-login `next` parameter when it points to the current host (`url_has_allowed_host_and_scheme`); anything else redirects to `LOGIN_REDIRECT_URL`.

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: django-codenerix
-Version: 5.3.2
+Version: 5.3.3
 Summary: Codenerix it is a framework that goes on top of Django so it makes easier development and building of ERPs.
 Project-URL: Homepage, https://github.com/codenerix/django-codenerix
 Project-URL: Documentation, http://doc.codenerix.com
@@ -55,8 +55,9 @@ Description-Content-Type: text/markdown
 
 [![PyPI](https://img.shields.io/pypi/v/django-codenerix?color=blue)](https://pypi.org/project/django-codenerix/)
 [![CI](https://github.com/codenerix/django-codenerix/actions/workflows/ci.yml/badge.svg)](https://github.com/codenerix/django-codenerix/actions/workflows/ci.yml)
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=codenerix_django-codenerix&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=codenerix_django-codenerix)
 [![Python versions](https://img.shields.io/pypi/pyversions/django-codenerix)](https://pypi.org/project/django-codenerix/)
-[![Django](https://img.shields.io/badge/Django-5.2%20%7C%206.0-092E20?logo=django&logoColor=white)](https://www.djangoproject.com/)
+[![Django](https://img.shields.io/badge/Django-5.2%20%7C%206.0%20%7C%206.1-092E20?logo=django&logoColor=white)](https://www.djangoproject.com/)
 [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-yellow)](https://opensource.org/license/apache-2.0)
 [![Changelog](https://img.shields.io/badge/changelog-CHANGELOG-orange.svg)](CHANGELOG)
 

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/README.md

@@ -2,8 +2,9 @@
 
 [![PyPI](https://img.shields.io/pypi/v/django-codenerix?color=blue)](https://pypi.org/project/django-codenerix/)
 [![CI](https://github.com/codenerix/django-codenerix/actions/workflows/ci.yml/badge.svg)](https://github.com/codenerix/django-codenerix/actions/workflows/ci.yml)
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=codenerix_django-codenerix&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=codenerix_django-codenerix)
 [![Python versions](https://img.shields.io/pypi/pyversions/django-codenerix)](https://pypi.org/project/django-codenerix/)
-[![Django](https://img.shields.io/badge/Django-5.2%20%7C%206.0-092E20?logo=django&logoColor=white)](https://www.djangoproject.com/)
+[![Django](https://img.shields.io/badge/Django-5.2%20%7C%206.0%20%7C%206.1-092E20?logo=django&logoColor=white)](https://www.djangoproject.com/)
 [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-yellow)](https://opensource.org/license/apache-2.0)
 [![Changelog](https://img.shields.io/badge/changelog-CHANGELOG-orange.svg)](CHANGELOG)
 

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/codenerix/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "5.3.2"
+__version__ = "5.3.3"
 
 __authors__ = [
     "Juanmi Taboada",

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/codenerix/checks.py

@@ -30,7 +30,8 @@ def check_debug_toolbar_access(
     app_configs: Sequence[AppConfig] | None,
     **kwargs: Any,
 ) -> list[CheckMessage]:
-    """Report unsafe or malformed DEBUG_TOOLBAR_ALLOWED_IPS settings.
+    """Report unsafe or malformed DEBUG_TOOLBAR_ALLOWED_IPS settings, and a
+    toolbar middleware placed behind the page cache middlewares.
 
     show_toolbar() already fails closed on these; this makes the cause visible
     on runserver and on any management command (e.g. `manage.py check --deploy`).

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/codenerix/context.py

@@ -122,7 +122,8 @@ def codenerix_js(request):
         daterangepicker += '"'
         cnf["daterangepicker"] = mark_safe(daterangepicker)
     else:
-        cnf["daterangepicker"] = mark_safe(
+        # Developer-set settings rendered as JS; HTML-escaping would break it
+        cnf["daterangepicker"] = mark_safe(  # pylint: disable=mark-safe-interpolation
             settings.DATERANGEPICKER_OPTIONS.format(
                 Format=settings.DATETIME_RANGE_FORMAT[1],
                 From=_("From"),

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/codenerix/debug.py

@@ -35,6 +35,18 @@ if TYPE_CHECKING:
 # never be a real REMOTE_ADDR, so it cannot collide with a listed client.
 DEBUG_TOOLBAR_ANY_IP = "0.0.0.0"
 
+# Matched by dotted path: settings-time code cannot import project middlewares
+_TOOLBAR_MIDDLEWARES = (
+    "debug_toolbar.middleware.DebugToolbarMiddleware",
+    "debug_panel.middleware.DebugPanelMiddleware",
+)
+_PAGE_CACHE_MIDDLEWARES = (
+    "django.middleware.cache.UpdateCacheMiddleware",
+    "django.middleware.cache.CacheMiddleware",
+    "django.middleware.cache.FetchFromCacheMiddleware",
+)
+_CONTENT_ENCODING_MIDDLEWARES = ("django.middleware.gzip.GZipMiddleware",)
+
 
 def debug_toolbar_access_errors() -> list[str]:
     """Return the problems found in the toolbar access settings, if any.
@@ -42,18 +54,46 @@ def debug_toolbar_access_errors() -> list[str]:
     Shared by show_toolbar() (which fails closed on any of them) and the
     codenerix system check (which reports them at startup).
     """
+    errors = _middleware_order_errors()
     allowed = getattr(settings, "DEBUG_TOOLBAR_ALLOWED_IPS", None)
     if allowed is None:
-        return []
+        return errors
     # A bare string would turn the membership test into a substring match
     if isinstance(allowed, str) or not isinstance(allowed, Collection):
-        return ["DEBUG_TOOLBAR_ALLOWED_IPS must be a list, tuple or set of IP strings."]
-    if DEBUG_TOOLBAR_ANY_IP in allowed and not settings.DEBUG and not _require_superuser():
-        return [
+        errors.append("DEBUG_TOOLBAR_ALLOWED_IPS must be a list, tuple or set of IP strings.")
+    elif DEBUG_TOOLBAR_ANY_IP in allowed and not settings.DEBUG and not _require_superuser():
+        errors.append(
             f"DEBUG_TOOLBAR_ALLOWED_IPS contains {DEBUG_TOOLBAR_ANY_IP!r} with DEBUG=False "
             "and DEBUG_TOOLBAR_REQUIRE_SUPERUSER=False: the toolbar would be public.",
-        ]
-    return []
+        )
+    return errors
+
+
+def _middleware_order_errors() -> list[str]:
+    middleware = list(getattr(settings, "MIDDLEWARE", None) or ())
+    toolbar = [i for i, path in enumerate(middleware) if path in _TOOLBAR_MIDDLEWARES]
+    cache = [i for i, path in enumerate(middleware) if path in _PAGE_CACHE_MIDDLEWARES]
+    if not toolbar or not cache or max(toolbar) < min(cache):
+        return []
+    return [
+        f"{middleware[max(toolbar)]} comes after {middleware[min(cache)]} in MIDDLEWARE: "
+        "the page cache would store toolbar output and serve it to every client. "
+        "Move the toolbar middleware before the page cache middlewares.",
+    ]
+
+
+def _insert_toolbar_middleware(
+    middleware: list[str] | tuple[str, ...],
+    toolbar: str,
+) -> list[str] | tuple[str, ...]:
+    # As early as possible, but after anything that encodes the response body
+    # (django-debug-toolbar installation docs); early also keeps it outside the page cache
+    encoders = [i for i, path in enumerate(middleware) if path in _CONTENT_ENCODING_MIDDLEWARES]
+    position = encoders[-1] + 1 if encoders else 0
+    if isinstance(middleware, tuple):
+        return (*middleware[:position], toolbar, *middleware[position:])
+    middleware.insert(position, toolbar)
+    return middleware
 
 
 def _require_superuser() -> bool:
@@ -69,15 +109,15 @@ def show_toolbar(request: HttpRequest) -> bool:
     projects may define them anywhere in their settings module.
     """
 
+    if debug_toolbar_access_errors():
+        # Fail closed; the system check reports the misconfiguration
+        return False
     allowed = getattr(settings, "DEBUG_TOOLBAR_ALLOWED_IPS", None)
     if allowed is None:
         # Imported lazily: debug.py is loaded from settings.py, before apps are ready
         from debug_toolbar.middleware import show_toolbar as upstream_show_toolbar
 
         return upstream_show_toolbar(request)
-    if debug_toolbar_access_errors():
-        # Fail closed; the system check reports the misconfiguration
-        return False
     if DEBUG_TOOLBAR_ANY_IP not in allowed and request.META.get("REMOTE_ADDR") not in allowed:
         return False
     if _require_superuser():
@@ -140,6 +180,7 @@ def autoload(
     DEBUG_TOOLBAR_PRODUCTION: bool = False,
 ):
     EXTRA_MIDDLEWARES = []  # noqa: N806
+    toolbar_middleware: str | None = None
     if DEBUG and SPAGHETTI:
         INSTALLED_APPS += ("django_spaghetti",)
     if DEBUG and ROSETTA:
@@ -155,13 +196,9 @@ def autoload(
         INSTALLED_APPS += ("debug_toolbar",)
         if DEBUG_PANEL:
             INSTALLED_APPS += ("debug_panel",)
-            EXTRA_MIDDLEWARES.append(
-                "debug_panel.middleware.DebugPanelMiddleware",
-            )
+            toolbar_middleware = "debug_panel.middleware.DebugPanelMiddleware"
         else:
-            EXTRA_MIDDLEWARES.append(
-                "debug_toolbar.middleware.DebugToolbarMiddleware",
-            )
+            toolbar_middleware = "debug_toolbar.middleware.DebugToolbarMiddleware"
     if DEBUG and SNIPPET_SCREAM:
         EXTRA_MIDDLEWARES.append("snippetscream.ProfileMiddleware")
     if DEBUG and GRAPH_MODELS:
@@ -176,6 +213,9 @@ def autoload(
         MIDDLEWARE += tuple(extra)
     else:
         MIDDLEWARE += extra
+    # Not appended: behind the page cache its output would be cached for everyone
+    if toolbar_middleware is not None and toolbar_middleware not in existing:
+        MIDDLEWARE = _insert_toolbar_middleware(MIDDLEWARE, toolbar_middleware)  # noqa: N806
 
     # Return final results
     return (INSTALLED_APPS, MIDDLEWARE)

{django_codenerix-5.3.2 → django_codenerix-5.3.3}/codenerix/templatetags/codenerix_lists.py

@@ -305,7 +305,8 @@ def linkedinfo(element, info_input=None):
 
     ngm = element.html_name  # field.widget.attrs['ng-model']
     baseurl = getattr(settings, "BASE_URL", "")
-    return mark_safe(
+    # Settings, field and model names rendered as JS args; escaping would break them
+    return mark_safe(  # pylint: disable=mark-safe-interpolation
         f"'{baseurl}','{ngm}','{info['appname']}', '{info['modelname'].lower()}s'",
     )
 
@@ -343,7 +344,8 @@ def get_field_list(forms):
 
 @register.filter
 def invalidator(formname, inp):
-    return mark_safe(
+    # Form and field names rendered as an Angular expression; escaping would break it
+    return mark_safe(  # pylint: disable=mark-safe-interpolation
         f"{{'codenerix_invalid':{smart_str(formname)}.{ngmodel(inp)}.$invalid}}",
     )
 

django_codenerix-5.3.3/codenerix/tests/test_debug_toolbar_access.py

@@ -0,0 +1,312 @@
+"""Visibility rules of codenerix.debug.show_toolbar and its activation helpers."""
+
+from collections.abc import Iterator
+from types import SimpleNamespace
+from typing import Any
+
+import pytest
+from django.conf import settings
+from django.http import HttpRequest, HttpResponse, JsonResponse
+from django.test import Client, RequestFactory, override_settings
+from django.urls import URLPattern, URLResolver, include, path
+from django.utils.module_loading import import_string
+
+from codenerix.checks import check_debug_toolbar_access
+from codenerix.debug import (
+    DEBUG_TOOLBAR_DEFAULT_CONFIG,
+    autoload,
+    autourl,
+    show_toolbar,
+)
+
+MY_IP = "203.0.113.7"
+OTHER_IP = "198.51.100.9"
+
+TOOLBAR_MW = "debug_toolbar.middleware.DebugToolbarMiddleware"
+PANEL_MW = "debug_panel.middleware.DebugPanelMiddleware"
+UPDATE_CACHE_MW = "django.middleware.cache.UpdateCacheMiddleware"
+FETCH_CACHE_MW = "django.middleware.cache.FetchFromCacheMiddleware"
+COMMON_MW = "django.middleware.common.CommonMiddleware"
+GZIP_MW = "django.middleware.gzip.GZipMiddleware"
+PAGE_CACHE = [UPDATE_CACHE_MW, COMMON_MW, FETCH_CACHE_MW]
+
+# Same nesting rationale as in test_debug_toolbar.py: the toolbar app's ready()
+# reads STATIC_URL, which must already be set when the registry repopulates.
+_TOOLBAR_APPS = [
+    *settings.INSTALLED_APPS,
+    "django.contrib.staticfiles",
+    "debug_toolbar",
+]
+
+
+def _request(ip: str, superuser: bool | None = None) -> HttpRequest:
+    request = RequestFactory().get("/", REMOTE_ADDR=ip)
+    if superuser is not None:
+        # Stand-in for request.user; avoids touching the database
+        request.user = SimpleNamespace(is_authenticated=True, is_superuser=superuser)  # type: ignore[assignment]
+    return request
+
+
+# --- DEBUG_TOOLBAR_ALLOWED_IPS unset: upstream behaviour, unchanged -----------
+
+
+@override_settings(DEBUG=False, INTERNAL_IPS=[MY_IP])
+def test_unset_delegates_upstream_debug_off() -> None:
+    assert show_toolbar(_request(MY_IP)) is False
+
+
+@override_settings(DEBUG=True, INTERNAL_IPS=[MY_IP])
+def test_unset_delegates_upstream_debug_on() -> None:
+    assert show_toolbar(_request(MY_IP)) is True
+    assert show_toolbar(_request(OTHER_IP)) is False
+
+
+# --- DEBUG=True: IP only by default ------------------------------------------
+
+
+@override_settings(DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP])
+def test_debug_listed_ip_only() -> None:
+    assert show_toolbar(_request(MY_IP)) is True
+    assert show_toolbar(_request(OTHER_IP)) is False
+
+
+@override_settings(DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=["0.0.0.0"])
+def test_debug_any_ip() -> None:
+    assert show_toolbar(_request(OTHER_IP)) is True
+
+
+# --- DEBUG=False: IP + superuser by default ----------------------------------
+
+
+@override_settings(DEBUG=False, DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP])
+def test_production_requires_superuser() -> None:
+    assert show_toolbar(_request(MY_IP)) is False
+    assert show_toolbar(_request(MY_IP, superuser=False)) is False
+    assert show_toolbar(_request(MY_IP, superuser=True)) is True
+    assert show_toolbar(_request(OTHER_IP, superuser=True)) is False
+
+
+@override_settings(
+    DEBUG=False,
+    DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP],
+    DEBUG_TOOLBAR_REQUIRE_SUPERUSER=False,
+)
+def test_production_ip_only_when_opted_out() -> None:
+    assert show_toolbar(_request(MY_IP)) is True
+    assert show_toolbar(_request(OTHER_IP)) is False
+
+
+@override_settings(
+    DEBUG=False,
+    DEBUG_TOOLBAR_ALLOWED_IPS=["0.0.0.0"],
+    DEBUG_TOOLBAR_REQUIRE_SUPERUSER=False,
+)
+def test_public_toolbar_fails_closed_and_is_reported() -> None:
+    assert show_toolbar(_request(MY_IP, superuser=True)) is False
+    assert [e.id for e in check_debug_toolbar_access(None)] == ["codenerix.E001"]
+
+
+@override_settings(DEBUG=False, DEBUG_TOOLBAR_ALLOWED_IPS=["0.0.0.0"])
+def test_production_any_ip_with_superuser_is_allowed() -> None:
+    assert show_toolbar(_request(OTHER_IP, superuser=True)) is True
+    assert check_debug_toolbar_access(None) == []
+
+
+@pytest.mark.parametrize("value", [MY_IP, 42])
+def test_malformed_setting_fails_closed_and_is_reported(value: object) -> None:
+    with override_settings(DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=value):
+        # A bare string must not degrade into a substring match
+        assert show_toolbar(_request(MY_IP)) is False
+        assert [e.id for e in check_debug_toolbar_access(None)] == ["codenerix.E001"]
+
+
+# --- Wiring -------------------------------------------------------------------
+
+
+def test_default_config_points_at_show_toolbar() -> None:
+    assert import_string(DEBUG_TOOLBAR_DEFAULT_CONFIG["SHOW_TOOLBAR_CALLBACK"]) is show_toolbar
+
+
+def test_autoload_production_is_opt_in() -> None:
+    apps, middleware = autoload((), [], DEBUG=False, DEBUG_TOOLBAR=True)
+    assert "debug_toolbar" not in apps
+    assert middleware == []
+
+    apps, middleware = autoload(
+        (),
+        [],
+        DEBUG=False,
+        DEBUG_TOOLBAR=True,
+        DEBUG_TOOLBAR_PRODUCTION=True,
+    )
+    assert "debug_toolbar" in apps
+    assert "debug_toolbar.middleware.DebugToolbarMiddleware" in middleware
+
+
+def _production_middleware(middleware: Any, **kwargs: bool) -> Any:
+    return autoload(
+        (),
+        middleware,
+        DEBUG_TOOLBAR=True,
+        DEBUG_TOOLBAR_PRODUCTION=True,
+        **kwargs,
+    )[1]
+
+
+@pytest.mark.parametrize("container", [list, tuple])
+def test_autoload_puts_toolbar_before_page_cache(container: type) -> None:
+    middleware = _production_middleware(container(PAGE_CACHE))
+    assert type(middleware) is container
+    assert list(middleware) == [TOOLBAR_MW, *PAGE_CACHE]
+
+
+def test_autoload_places_debug_panel_like_the_toolbar() -> None:
+    middleware = _production_middleware(list(PAGE_CACHE), DEBUG_PANEL=True)
+    assert middleware == [PANEL_MW, *PAGE_CACHE]
+
+
+def test_autoload_puts_toolbar_after_content_encoding() -> None:
+    middleware = _production_middleware([GZIP_MW, *PAGE_CACHE])
+    assert middleware == [GZIP_MW, TOOLBAR_MW, *PAGE_CACHE]
+
+
+def test_autoload_keeps_existing_toolbar_position() -> None:
+    assert _production_middleware([*PAGE_CACHE, TOOLBAR_MW]) == [*PAGE_CACHE, TOOLBAR_MW]
+
+
+def test_autoload_without_toolbar_leaves_middleware_unchanged() -> None:
+    assert autoload((), list(PAGE_CACHE), DEBUG=False, DEBUG_TOOLBAR=True)[1] == PAGE_CACHE
+    assert autoload((), list(PAGE_CACHE), DEBUG=True)[1] == PAGE_CACHE
+
+
+def test_autoload_still_appends_other_extras() -> None:
+    _, middleware = autoload(
+        (),
+        [COMMON_MW],
+        DEBUG=True,
+        DEBUG_TOOLBAR=True,
+        ADMINSITE=True,
+        DEBUG_PYINSTRUMENT=True,
+    )
+    assert middleware == [
+        TOOLBAR_MW,
+        COMMON_MW,
+        "django.contrib.messages.middleware.MessageMiddleware",
+        "pyinstrument.middleware.ProfilerMiddleware",
+    ]
+
+
+@pytest.mark.parametrize(
+    "middleware",
+    [
+        [*PAGE_CACHE, TOOLBAR_MW],
+        [UPDATE_CACHE_MW, TOOLBAR_MW, COMMON_MW, FETCH_CACHE_MW],
+        # Django's recommended order with GZip: autoload() cannot satisfy both rules
+        _production_middleware([UPDATE_CACHE_MW, GZIP_MW, COMMON_MW, FETCH_CACHE_MW]),
+    ],
+)
+@pytest.mark.parametrize(
+    "access",
+    [
+        {"INTERNAL_IPS": [MY_IP]},
+        {"DEBUG_TOOLBAR_ALLOWED_IPS": [MY_IP]},
+    ],
+)
+def test_toolbar_behind_page_cache_fails_closed_and_is_reported(
+    middleware: list[str],
+    access: dict[str, list[str]],
+) -> None:
+    with override_settings(DEBUG=True, MIDDLEWARE=middleware, **access):
+        assert show_toolbar(_request(MY_IP)) is False
+        assert [e.id for e in check_debug_toolbar_access(None)] == ["codenerix.E001"]
+
+
+@override_settings(
+    DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP], MIDDLEWARE=[TOOLBAR_MW, *PAGE_CACHE]
+)
+def test_toolbar_before_page_cache_is_allowed() -> None:
+    assert show_toolbar(_request(MY_IP)) is True
+    assert check_debug_toolbar_access(None) == []
+
+
+# --- End to end: toolbar output must never reach the page cache ---------------
+
+
+def _json_view(request: HttpRequest) -> JsonResponse:
+    return JsonResponse({"ok": True})
+
+
+def _html_view(request: HttpRequest) -> HttpResponse:
+    return HttpResponse("<html><body><p>page</p></body></html>")
+
+
+# ROOT_URLCONF for the end-to-end test; filled once the toolbar app is installed
+urlpatterns: list[URLPattern | URLResolver] = []
+
+
+@pytest.fixture
+def cached_site_with_toolbar() -> Iterator[None]:
+    middleware = _production_middleware(list(PAGE_CACHE))
+    with override_settings(STATIC_URL="/static/"):
+        with override_settings(
+            INSTALLED_APPS=_TOOLBAR_APPS,
+            MIDDLEWARE=middleware,
+            ROOT_URLCONF=__name__,
+            DEBUG=False,
+            DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP],
+            DEBUG_TOOLBAR_REQUIRE_SUPERUSER=False,
+            DEBUG_TOOLBAR_CONFIG=DEBUG_TOOLBAR_DEFAULT_CONFIG,
+            CACHES={"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}},
+            CACHE_MIDDLEWARE_SECONDS=600,
+            TEMPLATES=[
+                {"BACKEND": "django.template.backends.django.DjangoTemplates", "APP_DIRS": True},
+            ],
+        ):
+            # Only importable once the toolbar app is installed (its models load on import)
+            from debug_toolbar.middleware import show_toolbar_func_or_path
+
+            # The toolbar memoises the callback; another test may have resolved it already
+            show_toolbar_func_or_path.cache_clear()
+            urlpatterns[:] = [
+                path("json/", _json_view),
+                path("html/", _html_view),
+                path("__debug__/", include("debug_toolbar.urls")),
+            ]
+            try:
+                yield
+            finally:
+                urlpatterns.clear()
+                show_toolbar_func_or_path.cache_clear()
+
+
+@pytest.mark.parametrize(
+    ("url", "body"),
+    [
+        ("/json/", b'{"ok": true}'),
+        ("/html/", b"<html><body><p>page</p></body></html>"),
+    ],
+)
+@pytest.mark.usefixtures("cached_site_with_toolbar")
+def test_toolbar_output_never_reaches_page_cache(url: str, body: bytes) -> None:
+    mine = Client(REMOTE_ADDR=MY_IP).get(url)
+    # Guard against a vacuous pass: the toolbar must really run for the allowed IP
+    assert "djdt-request-id" in mine.headers
+
+    other = Client(REMOTE_ADDR=OTHER_IP).get(url)
+    assert "Age" in other.headers  # served from the page cache
+    assert "djdt-request-id" not in other.headers
+    assert "Server-Timing" not in other.headers
+    assert other.content == body
+
+
+def test_autourl_follows_installed_apps() -> None:
+    def mounted() -> bool:
+        patterns = autourl(
+            [], DEBUG=False, ROSETTA=False, ADMINSITE=False, SPAGHETTI=False, DEBUG_TOOLBAR=True
+        )
+        return any(str(p.pattern) == "^__debug__/" for p in patterns)
+
+    assert mounted() is False
+    with override_settings(STATIC_URL="/static/"):
+        with override_settings(INSTALLED_APPS=_TOOLBAR_APPS):
+            assert mounted() is True

django_codenerix-5.3.2/codenerix/tests/test_debug_toolbar_access.py

@@ -1,145 +0,0 @@
-"""Visibility rules of codenerix.debug.show_toolbar and its activation helpers."""
-
-from types import SimpleNamespace
-
-import pytest
-from django.conf import settings
-from django.http import HttpRequest
-from django.test import RequestFactory, override_settings
-from django.utils.module_loading import import_string
-
-from codenerix.checks import check_debug_toolbar_access
-from codenerix.debug import (
-    DEBUG_TOOLBAR_DEFAULT_CONFIG,
-    autoload,
-    autourl,
-    show_toolbar,
-)
-
-MY_IP = "203.0.113.7"
-OTHER_IP = "198.51.100.9"
-
-# Same nesting rationale as in test_debug_toolbar.py: the toolbar app's ready()
-# reads STATIC_URL, which must already be set when the registry repopulates.
-_TOOLBAR_APPS = [
-    *settings.INSTALLED_APPS,
-    "django.contrib.staticfiles",
-    "debug_toolbar",
-]
-
-
-def _request(ip: str, superuser: bool | None = None) -> HttpRequest:
-    request = RequestFactory().get("/", REMOTE_ADDR=ip)
-    if superuser is not None:
-        # Stand-in for request.user; avoids touching the database
-        request.user = SimpleNamespace(is_authenticated=True, is_superuser=superuser)  # type: ignore[assignment]
-    return request
-
-
-# --- DEBUG_TOOLBAR_ALLOWED_IPS unset: upstream behaviour, unchanged -----------
-
-
-@override_settings(DEBUG=False, INTERNAL_IPS=[MY_IP])
-def test_unset_delegates_upstream_debug_off() -> None:
-    assert show_toolbar(_request(MY_IP)) is False
-
-
-@override_settings(DEBUG=True, INTERNAL_IPS=[MY_IP])
-def test_unset_delegates_upstream_debug_on() -> None:
-    assert show_toolbar(_request(MY_IP)) is True
-    assert show_toolbar(_request(OTHER_IP)) is False
-
-
-# --- DEBUG=True: IP only by default ------------------------------------------
-
-
-@override_settings(DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP])
-def test_debug_listed_ip_only() -> None:
-    assert show_toolbar(_request(MY_IP)) is True
-    assert show_toolbar(_request(OTHER_IP)) is False
-
-
-@override_settings(DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=["0.0.0.0"])
-def test_debug_any_ip() -> None:
-    assert show_toolbar(_request(OTHER_IP)) is True
-
-
-# --- DEBUG=False: IP + superuser by default ----------------------------------
-
-
-@override_settings(DEBUG=False, DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP])
-def test_production_requires_superuser() -> None:
-    assert show_toolbar(_request(MY_IP)) is False
-    assert show_toolbar(_request(MY_IP, superuser=False)) is False
-    assert show_toolbar(_request(MY_IP, superuser=True)) is True
-    assert show_toolbar(_request(OTHER_IP, superuser=True)) is False
-
-
-@override_settings(
-    DEBUG=False,
-    DEBUG_TOOLBAR_ALLOWED_IPS=[MY_IP],
-    DEBUG_TOOLBAR_REQUIRE_SUPERUSER=False,
-)
-def test_production_ip_only_when_opted_out() -> None:
-    assert show_toolbar(_request(MY_IP)) is True
-    assert show_toolbar(_request(OTHER_IP)) is False
-
-
-@override_settings(
-    DEBUG=False,
-    DEBUG_TOOLBAR_ALLOWED_IPS=["0.0.0.0"],
-    DEBUG_TOOLBAR_REQUIRE_SUPERUSER=False,
-)
-def test_public_toolbar_fails_closed_and_is_reported() -> None:
-    assert show_toolbar(_request(MY_IP, superuser=True)) is False
-    assert [e.id for e in check_debug_toolbar_access(None)] == ["codenerix.E001"]
-
-
-@override_settings(DEBUG=False, DEBUG_TOOLBAR_ALLOWED_IPS=["0.0.0.0"])
-def test_production_any_ip_with_superuser_is_allowed() -> None:
-    assert show_toolbar(_request(OTHER_IP, superuser=True)) is True
-    assert check_debug_toolbar_access(None) == []
-
-
-@pytest.mark.parametrize("value", [MY_IP, 42])
-def test_malformed_setting_fails_closed_and_is_reported(value: object) -> None:
-    with override_settings(DEBUG=True, DEBUG_TOOLBAR_ALLOWED_IPS=value):
-        # A bare string must not degrade into a substring match
-        assert show_toolbar(_request(MY_IP)) is False
-        assert [e.id for e in check_debug_toolbar_access(None)] == ["codenerix.E001"]
-
-
-# --- Wiring -------------------------------------------------------------------
-
-
-def test_default_config_points_at_show_toolbar() -> None:
-    assert import_string(DEBUG_TOOLBAR_DEFAULT_CONFIG["SHOW_TOOLBAR_CALLBACK"]) is show_toolbar
-
-
-def test_autoload_production_is_opt_in() -> None:
-    apps, middleware = autoload((), [], DEBUG=False, DEBUG_TOOLBAR=True)
-    assert "debug_toolbar" not in apps
-    assert middleware == []
-
-    apps, middleware = autoload(
-        (),
-        [],
-        DEBUG=False,
-        DEBUG_TOOLBAR=True,
-        DEBUG_TOOLBAR_PRODUCTION=True,
-    )
-    assert "debug_toolbar" in apps
-    assert "debug_toolbar.middleware.DebugToolbarMiddleware" in middleware
-
-
-def test_autourl_follows_installed_apps() -> None:
-    def mounted() -> bool:
-        patterns = autourl(
-            [], DEBUG=False, ROSETTA=False, ADMINSITE=False, SPAGHETTI=False, DEBUG_TOOLBAR=True
-        )
-        return any(str(p.pattern) == "^__debug__/" for p in patterns)
-
-    assert mounted() is False
-    with override_settings(STATIC_URL="/static/"):
-        with override_settings(INSTALLED_APPS=_TOOLBAR_APPS):
-            assert mounted() is True