django-forms-workflows 0.77.4__tar.gz → 0.78.0__tar.gz

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/CHANGELOG.md

@@ -8,6 +8,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Security
+- **Payment endpoints hardened against unauthorized access and unsafe state
+  transitions (issue #27, supersedes #4).** All checkout endpoints
+  (`initiate`, `confirm`, `return`, `cancel`) now enforce one access policy
+  before touching records or providers: an authenticated submitter may act
+  only on their own submission, and an anonymous public-form submitter needs
+  a short-lived (`FORMS_WORKFLOWS_PAYMENT_CHECKOUT_TTL`, default 1 hour),
+  unguessable session-bound checkout credential issued when the form post
+  enters `pending_payment`. Guessing a numeric submission or payment-record
+  ID now yields a non-disclosing 404. Payment initiation is idempotent per
+  attempt — repeated GETs reuse the single open `PaymentRecord` and its
+  stable idempotency key (now forwarded to Stripe's `PaymentIntent.create`)
+  instead of creating uncontrolled attempts; a legitimate retry after
+  cancel/failure starts a fresh key. Cancellation is a CSRF-protected
+  `POST`-only action restricted to `pending_payment` submissions and can no
+  longer revert a completed/submitted/approved submission to `draft`.
+  Stripe webhooks now **fail closed**: events are rejected (HTTP 400) when
+  `STRIPE_WEBHOOK_SECRET` is unset or the signature is invalid, and the
+  provider interface requires the same authenticated-event guarantee from
+  all providers via `WebhookVerificationError`. Replayed or out-of-order
+  events no longer roll payment state backward (`completed`/`refunded` are
+  terminal; only `completed → refunded` is allowed) and duplicate deliveries
+  create no duplicate workflow tasks. `payment_collect.html` and
+  `payment_error.html` cancel actions are now POST forms.
+
 - **`social-auth-core` 4.8.3 → 5.1.1 in `poetry.lock`.** Closes five Dependabot
   advisories against the locked version: GHSA-vqg6-3fw6-j9jg (session fixation),
   GHSA-3c93-f73f-qc9h (VK App backend accepted unsigned callback data),

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/PKG-INFO

@@ -1,22 +1,22 @@
 Metadata-Version: 2.4
 Name: django-forms-workflows
-Version: 0.77.4
+Version: 0.78.0
 Summary: Enterprise-grade, database-driven form builder with approval workflows and external data integration
 License: LGPL-3.0-only
 License-File: LICENSE
 Keywords: django,forms,workflows,approval,form-builder,dynamic-forms,ldap,enterprise,audit,database-driven,sso,saml,oauth2
 Author: Matt Davis
 Author-email: matt@opensensor.io
-Requires-Python: >=3.10,<4.0
+Requires-Python: >=3.11,<4.0
 Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Provides-Extra: all
+Provides-Extra: cache
 Provides-Extra: dev
 Provides-Extra: docs
 Provides-Extra: excel
@@ -31,7 +31,7 @@ Provides-Extra: postgresql
 Provides-Extra: qr
 Provides-Extra: saml
 Provides-Extra: sso
-Requires-Dist: Django (>=5.1,<7.0)
+Requires-Dist: Django (>=5.2.18,<7.0,!=6.0.0,!=6.0.1,!=6.0.2,!=6.0.3,!=6.0.4,!=6.0.5,!=6.0.6,!=6.0.7,!=6.0.8,!=6.1.0,!=6.1.1)
 Requires-Dist: celery (>=5.3)
 Requires-Dist: crispy-bootstrap5 (>=2.0)
 Requires-Dist: django-auth-ldap (>=4.0) ; extra == "ldap" or extra == "all"
@@ -44,7 +44,9 @@ Requires-Dist: google-auth (>=2.20) ; extra == "gmail" or extra == "all"
 Requires-Dist: markdown (>=3.4) ; extra == "markdown" or extra == "all"
 Requires-Dist: mssql-django (>=1.3) ; extra == "mssql" or extra == "all"
 Requires-Dist: mysqlclient (>=2.2) ; extra == "mysql" or extra == "all"
+Requires-Dist: nh3 (>=0.3.2)
 Requires-Dist: openpyxl (>=3.1) ; extra == "excel" or extra == "all"
+Requires-Dist: pillow (>=13.0.0) ; extra == "pdf" or extra == "all"
 Requires-Dist: psycopg2-binary (>=2.9) ; extra == "postgresql" or extra == "all"
 Requires-Dist: pyodbc (>=5.0) ; extra == "mssql" or extra == "all"
 Requires-Dist: pytest (>=7.4) ; extra == "dev"
@@ -53,6 +55,7 @@ Requires-Dist: pytest-django (>=4.5) ; extra == "dev"
 Requires-Dist: python-decouple (>=3.8)
 Requires-Dist: python-ldap (>=3.4) ; extra == "ldap" or extra == "all"
 Requires-Dist: python3-saml (>=1.16) ; extra == "sso" or extra == "saml" or extra == "all"
+Requires-Dist: redis (>=5.0) ; extra == "cache" or extra == "all"
 Requires-Dist: requests (>=2.31)
 Requires-Dist: ruff (>=0.4) ; extra == "dev"
 Requires-Dist: segno (>=1.6) ; extra == "qr" or extra == "all"
@@ -72,7 +75,7 @@ Description-Content-Type: text/markdown
 **Enterprise-grade, database-driven form builder with multi-stage approval workflows, external data integration, and cross-instance sync**
 
 [![License: LGPL v3](https://img.shields.io/badge/License-LGPL_v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
-[![Python Version](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![Python Version](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
 [![Django Version](https://img.shields.io/badge/django-5.2%2B-green)](https://www.djangoproject.com/)
 [![Version](https://img.shields.io/badge/version-0.49.0-orange)](https://github.com/opensensor/django-forms-workflows)
 
@@ -258,6 +261,8 @@ Move form definitions between environments from the Django Admin:
 
 ## Quick Start
 
+See [security upgrade notes](docs/SECURITY_UPGRADE.md) before upgrading an existing deployment.
+
 ### Installation
 
 ```bash
@@ -413,8 +418,8 @@ graph TB
 
 ## Requirements
 
-- Python 3.10+
-- Django 5.2+
+- Python 3.11+
+- Django 5.2.18+, 6.0.9+, or 6.1.2+ (security patch minimums)
 - PostgreSQL, MySQL, or SQLite (PostgreSQL recommended for production)
 - Optional: Celery 5.0+ with Redis/Valkey for background task processing
 - Optional: `openpyxl` for Excel spreadsheet field support (`pip install django-forms-workflows[excel]`)

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/README.md

@@ -3,7 +3,7 @@
 **Enterprise-grade, database-driven form builder with multi-stage approval workflows, external data integration, and cross-instance sync**
 
 [![License: LGPL v3](https://img.shields.io/badge/License-LGPL_v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
-[![Python Version](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![Python Version](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
 [![Django Version](https://img.shields.io/badge/django-5.2%2B-green)](https://www.djangoproject.com/)
 [![Version](https://img.shields.io/badge/version-0.49.0-orange)](https://github.com/opensensor/django-forms-workflows)
 
@@ -189,6 +189,8 @@ Move form definitions between environments from the Django Admin:
 
 ## Quick Start
 
+See [security upgrade notes](docs/SECURITY_UPGRADE.md) before upgrading an existing deployment.
+
 ### Installation
 
 ```bash
@@ -344,8 +346,8 @@ graph TB
 
 ## Requirements
 
-- Python 3.10+
-- Django 5.2+
+- Python 3.11+
+- Django 5.2.18+, 6.0.9+, or 6.1.2+ (security patch minimums)
 - PostgreSQL, MySQL, or SQLite (PostgreSQL recommended for production)
 - Optional: Celery 5.0+ with Redis/Valkey for background task processing
 - Optional: `openpyxl` for Excel spreadsheet field support (`pip install django-forms-workflows[excel]`)

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/admin.py

@@ -1154,6 +1154,15 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
 
     def sync_import_admin_view(self, request):
         """Admin page for importing form definitions from a JSON file or raw JSON."""
+        from django.core.exceptions import PermissionDenied
+
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+        if not (
+            self.has_add_permission(request) and self.has_change_permission(request)
+        ):
+            raise PermissionDenied
+
         from .sync_api import import_payload
 
         context = dict(self.admin_site.each_context(request))
@@ -1219,6 +1228,15 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
         Step 1 (POST) – fetch available forms from the remote, show checkbox list
         Step 2 (POST) – import selected forms, show results
         """
+        from django.core.exceptions import PermissionDenied
+
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+        if not (
+            self.has_add_permission(request) and self.has_change_permission(request)
+        ):
+            raise PermissionDenied
+
         from .sync_api import (
             build_export_payload,
             fetch_remote_payload,
@@ -1372,6 +1390,11 @@ class FormDefinitionAdmin(nested_admin.NestedModelAdmin):
         Step 1 (POST) – show all local forms with checkboxes + diff status
         Step 2 (POST) – execute push for selected forms, show results
         """
+        from django.core.exceptions import PermissionDenied
+
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+
         from .sync_api import (
             build_export_payload,
             fetch_remote_payload,

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/api_views.py

@@ -106,7 +106,7 @@ def require_api_token(view_func):
         raw = auth.removeprefix("Bearer ").strip()
         try:
             token_obj = APIToken.objects.select_related("user").get(
-                token=raw, is_active=True
+                token=raw, is_active=True, user__is_active=True
             )
         except (APIToken.DoesNotExist, ValueError, Exception):  # noqa: BLE001
             return JsonResponse({"error": "Invalid or inactive token."}, status=401)

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/apps.py

@@ -17,7 +17,7 @@ class DjangoFormsWorkflowsConfig(AppConfig):
         Import signal handlers and perform app initialization.
         """
         # Import signals to register handlers
-        from . import signals  # noqa: F401
+        from . import checks, signals  # noqa: F401
 
         # Load custom callback handlers from FORMS_WORKFLOWS_CALLBACKS setting
         from .callback_registry import load_from_settings

django_forms_workflows-0.78.0/django_forms_workflows/checks.py

@@ -0,0 +1,24 @@
+"""Deployment checks for public submission throttling."""
+
+from django.conf import settings
+from django.core.checks import Tags, Warning, register
+
+
+@register(Tags.security, deploy=True)
+def check_rate_limit_cache(app_configs, **kwargs):
+    alias = getattr(settings, "FORMS_WORKFLOWS_RATE_LIMIT_CACHE", "default")
+    backend = settings.CACHES.get(alias, {}).get("BACKEND", "")
+    if backend not in {
+        "django.core.cache.backends.redis.RedisCache",
+        "django.core.cache.backends.memcached.PyMemcacheCache",
+        "django.core.cache.backends.memcached.PyLibMCCache",
+        "django_redis.cache.RedisCache",
+    }:
+        return [
+            Warning(
+                "Public form rate limiting requires a shared cache with atomic add/incr.",
+                hint="Configure Redis or Memcached and FORMS_WORKFLOWS_RATE_LIMIT_CACHE; local-memory caches only limit one process.",
+                id="django_forms_workflows.W001",
+            )
+        ]
+    return []

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/diff_views.py

@@ -8,6 +8,7 @@ from django.http import HttpResponseBadRequest
 from django.shortcuts import render
 
 from .models import FormDefinition
+from .security import builder_permission_required
 from .sync_api import build_export_payload
 
 
@@ -429,6 +430,7 @@ def _build_summary(forms_data):
     return summaries
 
 
+@builder_permission_required("view_formdefinition")
 def diff_forms_view(request):
     """Render a side-by-side JSON diff of selected FormDefinitions."""
     pks = request.GET.get("pks", "")

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/form_builder_views.py

@@ -26,11 +26,13 @@ from .models import (
     WorkflowDefinition,
     WorkflowStage,
 )
+from .security import builder_permission_required
 
 logger = logging.getLogger(__name__)
 
 
 @require_GET
+@builder_permission_required("view_formtemplate")
 def form_builder_templates(request):
     """
     API endpoint to list available form templates.
@@ -63,6 +65,7 @@ def form_builder_templates(request):
 
 
 @require_GET
+@builder_permission_required("view_formtemplate")
 def form_builder_load_template(request, template_id):
     """
     API endpoint to load a form template.
@@ -83,6 +86,7 @@ def form_builder_load_template(request, template_id):
 
 
 @require_POST
+@builder_permission_required("view_formdefinition", "add_formdefinition")
 def form_builder_clone(request, form_id):
     """
     API endpoint to clone an existing form.
@@ -225,6 +229,7 @@ def form_builder_clone(request, form_id):
 
 
 @require_GET
+@builder_permission_required("view_formdefinition")
 def form_builder_view(request, form_id=None):
     """
     Main form builder page.
@@ -269,6 +274,7 @@ def form_builder_view(request, form_id=None):
 
 
 @require_GET
+@builder_permission_required("view_formdefinition")
 def form_builder_load(request, form_id):
     """
     API endpoint to load form data as JSON.
@@ -353,6 +359,7 @@ def form_builder_load(request, form_id):
 
 
 @require_POST
+@builder_permission_required("save_formdefinition")
 def form_builder_save(request):
     """
     API endpoint to save form data.
@@ -604,6 +611,7 @@ def save_form_definition_from_builder_data(data, user, form_definition=None):
 
 
 @require_POST
+@builder_permission_required("view_formdefinition")
 def form_builder_preview(request):
     """
     API endpoint to generate a preview of the form.
@@ -764,6 +772,7 @@ def form_builder_preview(request):
 
 
 @require_GET
+@builder_permission_required("view_formdefinition", "view_documenttemplate")
 def document_template_list(request, form_id):
     """List document templates for a form."""
     templates = DocumentTemplate.objects.filter(form_definition_id=form_id).order_by(
@@ -789,6 +798,7 @@ def document_template_list(request, form_id):
 
 
 @require_POST
+@builder_permission_required("change_formdefinition", "save_documenttemplate")
 def document_template_save(request, form_id):
     """Create or update a document template."""
     try:
@@ -847,6 +857,7 @@ def document_template_save(request, form_id):
 
 
 @require_POST
+@builder_permission_required("change_formdefinition", "delete_documenttemplate")
 def document_template_delete(request, form_id, template_id):
     """Delete a document template."""
     tpl = get_object_or_404(
@@ -862,6 +873,7 @@ def document_template_delete(request, form_id, template_id):
 
 
 @require_GET
+@builder_permission_required("view_sharedoptionlist")
 def shared_option_list_api(request):
     """List all shared option lists (for form builder dropdowns)."""
     lists = SharedOptionList.objects.filter(is_active=True).order_by("name")
@@ -882,6 +894,7 @@ def shared_option_list_api(request):
 
 
 @require_POST
+@builder_permission_required("save_sharedoptionlist")
 def shared_option_list_save(request):
     """Create or update a shared option list."""
     try:
@@ -924,6 +937,7 @@ def shared_option_list_save(request):
 
 
 @require_POST
+@builder_permission_required("delete_sharedoptionlist")
 def shared_option_list_delete(request, list_id):
     """Delete a shared option list."""
     ol = get_object_or_404(SharedOptionList, id=list_id)

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/forms.py

@@ -333,18 +333,6 @@ class DynamicForm(forms.Form):
         # files).  Also used to carry forward draft / resubmit file data.
         self.stashed_files = stashed_files or {}
 
-        # Recover stashed-file metadata carried forward via hidden input from
-        # a prior validation-failure render (browsers cannot re-send files).
-        if not self.stashed_files and self.data:
-            prev = self.data.get("_stashed_files")
-            if prev:
-                try:
-                    self.stashed_files = json.loads(prev)
-                except (json.JSONDecodeError, TypeError):
-                    # Ignore malformed client metadata; uploaded files are rebuilt
-                    # from validated server-side data below.
-                    pass
-
         # Build form fields from definition
         # Exclude fields scoped to a workflow stage - those are for approvers only
         for field in (
@@ -354,15 +342,6 @@ class DynamicForm(forms.Form):
         ):
             self.add_field(field, initial_data)
 
-        # Embed stashed-file metadata as a hidden field so it survives
-        # validation-failure round-trips (browsers cannot re-send files).
-        if self.stashed_files:
-            self.fields["_stashed_files"] = forms.CharField(
-                widget=forms.HiddenInput(),
-                required=False,
-                initial=json.dumps(self.stashed_files),
-            )
-
         # Setup form layout with Crispy Forms
         self.helper = FormHelper()
         self.helper.form_method = "post"
@@ -763,7 +742,7 @@ class DynamicForm(forms.Form):
             # failure, saved with a draft, or carried from a resubmission).
             existing_file = self._get_existing_file_info(field_def.field_name)
             if existing_file:
-                fname = existing_file.get("filename", "file")
+                fname = html_escape(existing_file.get("filename", "file"))
                 extra_help = f"Previously uploaded: <strong>{fname}</strong>. Leave blank to keep it."
                 base_help = field_args.get("help_text", "") or ""
                 field_args["help_text"] = (
@@ -789,10 +768,11 @@ class DynamicForm(forms.Form):
                     if isinstance(existing_file, list)
                     else existing_file.get("filename", "file")
                 )
-                extra = f"Previously uploaded: <strong>{names}</strong>. Leave blank to keep."
+                extra = f"Previously uploaded: <strong>{html_escape(names)}</strong>. Leave blank to keep."
                 help_text = f"{help_text} {extra}" if help_text else extra
                 required = False
             self.fields[field_def.field_name] = MultipleFileField(
+                validators=_build_file_validators(field_def),
                 required=required,
                 label=field_def.field_label,
                 help_text=help_text,
@@ -931,12 +911,13 @@ class DynamicForm(forms.Form):
             )
 
         elif field_def.field_type == "display_text":
-            display_html = _render_display_text(initial or field_def.default_value)
+            display_html = _render_display_text(field_def.default_value)
             self.fields[field_def.field_name] = forms.CharField(
                 required=False,
                 label=field_def.field_label,
                 help_text=field_def.help_text,
-                initial=initial or field_def.default_value,
+                initial=field_def.default_value,
+                disabled=True,
                 widget=DisplayTextWidget(
                     display_html=display_html,
                     attrs={"data-display-text": "true"},

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/models.py

@@ -881,6 +881,8 @@ class DocumentTemplate(models.Model):
         """Render this template with submission data, returning HTML string."""
         import re
 
+        from django.utils.html import escape
+
         form_data = submission.form_data or {}
 
         # Build merge context with system variables + form data
@@ -906,6 +908,7 @@ class DocumentTemplate(models.Model):
             else:
                 context[key] = str(val) if val is not None else ""
 
+        context = {key: str(escape(value)) for key, value in context.items()}
         html = self.html_content
 
         # Process conditional blocks: {% if field_name %}...{% endif %}

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/payments/__init__.py

@@ -12,7 +12,13 @@ apps can add ECSI, PayPal, Authorize.Net, or any other provider
 without modifying the library itself.
 """
 
-from .base import PaymentFlow, PaymentProvider, PaymentResult, PaymentStatus
+from .base import (
+    PaymentFlow,
+    PaymentProvider,
+    PaymentResult,
+    PaymentStatus,
+    WebhookVerificationError,
+)
 from .registry import (
     clear,
     get_available_providers,
@@ -27,6 +33,7 @@ __all__ = [
     "PaymentProvider",
     "PaymentResult",
     "PaymentStatus",
+    "WebhookVerificationError",
     "clear",
     "get_available_providers",
     "get_provider",

{django_forms_workflows-0.77.4 → django_forms_workflows-0.78.0}/django_forms_workflows/payments/base.py

@@ -47,6 +47,17 @@ class PaymentStatus(Enum):
     REFUNDED = "refunded"
 
 
+class WebhookVerificationError(Exception):
+    """
+    Raised by a provider's ``handle_webhook()`` when the event payload
+    cannot be authenticated (e.g. a missing/invalid signature, or a
+    required verification secret that is not configured).
+
+    Providers must raise this instead of processing unverified payloads:
+    the webhook endpoint fails closed and discards the event.
+    """
+
+
 @dataclass
 class PaymentResult:
     """Returned by create_payment() and confirm_payment()."""
@@ -93,12 +104,19 @@ class PaymentProvider(ABC):
         submission_id: int,
         description: str = "",
         metadata: dict[str, Any] | None = None,
+        idempotency_key: str | None = None,
     ) -> PaymentResult:
         """
         Initiate a payment.
 
         For INLINE providers: creates a payment intent, returns client_secret.
         For REDIRECT providers: creates a session, returns redirect_url.
+
+        ``idempotency_key`` is stable for a single payment attempt (one
+        ``PaymentRecord``).  Providers that support request idempotency
+        should forward it so a retried initiation cannot create duplicate
+        provider-side charges.  A new attempt (after a cancellation or
+        failure) is issued a fresh key.
         """
 
     @abstractmethod
@@ -121,6 +139,12 @@ class PaymentProvider(ABC):
 
         Override if the provider sends server-to-server callbacks.
         Returns None if the event is not relevant.
+
+        Implementations MUST authenticate the event before returning a
+        result (e.g. verify a signature or shared secret) and raise
+        :class:`WebhookVerificationError` when verification fails or the
+        required verification secret is not configured.  Unverified
+        payloads must never produce a state-changing result.
         """
         return None
 

django_forms_workflows-0.78.0/django_forms_workflows/payments/checkout.py

@@ -0,0 +1,84 @@
+"""
+Checkout authorization for the payment flow.
+
+Payment endpoints act on a :class:`~django_forms_workflows.models.FormSubmission`
+that is in ``pending_payment``.  Access is governed by exactly one policy:
+
+* **Owned submissions** — only the authenticated submitter may act on them.
+  A numeric submission or payment-record ID alone grants nothing.
+* **Anonymous (public-form) submissions** — the browser that just posted the
+  public form is issued a *checkout credential*: an unguessable token stored
+  in its session and bound to the submission ID, valid for a short time
+  (``FORMS_WORKFLOWS_PAYMENT_CHECKOUT_TTL`` seconds, default one hour).
+
+The credential is granted by the submit views when a submission enters
+``pending_payment`` and is revoked when the checkout is cancelled.  It is
+never exposed in a URL.  Callers that fail the policy receive a
+non-disclosing 404, identical to a nonexistent submission.
+"""
+
+from __future__ import annotations
+
+import secrets
+import time
+
+from django.conf import settings
+
+SESSION_KEY = "payment_checkouts"
+DEFAULT_CHECKOUT_TTL_SECONDS = 3600  # 1 hour
+
+
+def _checkout_ttl() -> int:
+    return int(
+        getattr(
+            settings,
+            "FORMS_WORKFLOWS_PAYMENT_CHECKOUT_TTL",
+            DEFAULT_CHECKOUT_TTL_SECONDS,
+        )
+    )
+
+
+def grant_checkout_access(request, submission) -> None:
+    """Bind a short-lived checkout credential for *submission* to the session.
+
+    Called by the submit views right after a submission enters
+    ``pending_payment`` so the same browser session can complete (confirm,
+    return, or cancel) the checkout that belongs to it.
+    """
+    checkouts = dict(request.session.get(SESSION_KEY, {}))
+    checkouts[str(submission.id)] = {
+        "token": secrets.token_urlsafe(32),
+        "exp": time.time() + _checkout_ttl(),
+    }
+    request.session[SESSION_KEY] = checkouts
+    request.session.modified = True
+
+
+def revoke_checkout_access(request, submission) -> None:
+    """Drop any checkout credential for *submission* from the session."""
+    checkouts = dict(request.session.get(SESSION_KEY, {}))
+    if checkouts.pop(str(submission.id), None) is not None:
+        request.session[SESSION_KEY] = checkouts
+        request.session.modified = True
+
+
+def has_checkout_access(request, submission) -> bool:
+    """The single payment access policy used by every payment endpoint.
+
+    * Authenticated submitter: may act only on their own submission.
+    * Anonymous submission (``submitter`` is null): the caller's session
+      must hold an unexpired checkout credential issued by
+      :func:`grant_checkout_access`.
+    """
+    if submission.submitter_id is not None:
+        return (
+            request.user.is_authenticated and request.user.pk == submission.submitter_id
+        )
+
+    entry = request.session.get(SESSION_KEY, {}).get(str(submission.id))
+    if not entry:
+        return False
+    try:
+        return float(entry.get("exp", 0)) > time.time()
+    except (TypeError, ValueError):
+        return False