django-ip-path-restrict 1.0.0__tar.gz

django_ip_path_restrict-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Peter
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_ip_path_restrict-1.0.0/PKG-INFO

@@ -0,0 +1,247 @@
+Metadata-Version: 2.4
+Name: django-ip-path-restrict
+Version: 1.0.0
+Summary: Restrict Django paths to allowed IP addresses, with optional Cloudflare support.
+Author: Peter Stavrou
+License: MIT License
+        
+        Copyright (c) 2026 Peter
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Project-URL: Homepage, https://github.com/peterstavrou/django-ip-path-restrict
+Project-URL: Repository, https://github.com/peterstavrou/django-ip-path-restrict
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: Django
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django>=5.2
+Dynamic: license-file
+
+# django-ip-path-restrict
+
+Restrict access to specific URLs so that only users with whitelisted IP addresses can access them.
+
+Supports IPv4 and IPv6 addresses, IP ranges, and optional Cloudflare support.
+
+## Requirements
+
+- Python 3.11+
+- Django 5.2+
+
+## Installation
+
+```bash
+pip install django-ip-path-restrict
+```
+
+In the `settings.py` file, add the middleware near the top of `MIDDLEWARE`, preferably immediately after `SecurityMiddleware`:
+
+```python
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django_ip_path_restrict.middleware.RestrictPathsByIPMiddleware',
+    # Other middleware...
+]
+```
+
+Placing the middleware near the top allows unauthorised requests to be blocked early, before other middleware processes them.
+
+## Configuration
+
+Add `PROTECTED_PATHS` to `settings.py` to specify which URLs to restrict based on IP addresses.
+
+```python
+PROTECTED_PATHS = [
+    '/admin/*',  # * matches /admin/ and all paths under it
+    '/login/',   # Only matches /login/
+]
+```
+
+Add `ALLOWED_IPS` to specify which IP addresses are allowed to access the protected URLs.
+
+IPv4, IPv6 and CIDR IP ranges are supported:
+
+```python
+ALLOWED_IPS = [
+    '203.0.113.10',    # IPv4 address
+    '2001:db8::10',    # IPv6 address
+    '198.51.100.0/24', # IPv4 address range
+]
+```
+
+Replace these example IP addresses with the addresses you want to allow.
+
+Users who try to access protected URLs from an IP address that is not in `ALLOWED_IPS` will receive a 404 Not Found response.
+
+All other URLs remain accessible as normal.
+
+If your project already uses django-environ or another settings library, you can load `ALLOWED_IPS` from an environment variable instead.
+
+### Local development
+
+IP restrictions apply regardless of `DEBUG`. To access protected URLs locally, add the localhost IP addresses to `ALLOWED_IPS` in your development settings:
+
+```python
+ALLOWED_IPS = [
+    '127.0.0.1',  # IPv4 localhost
+    '::1',        # IPv6 localhost
+]
+```
+
+Keep these addresses in your development settings rather than adding them to your production allowlist.
+
+## Path matching
+
+
+| Pattern | Paths matched |
+| --- | --- |
+| `/admin` | `/admin` only |
+| `/admin/` | `/admin/` only |
+| `/admin/*` | `/admin/` and all paths under it, but not `/admin` |
+| `/admin*` | All paths starting with `/admin`, including `/administration` |
+
+
+For a standard Django admin installation, use `/admin/*`.
+
+The only supported wildcard is `*`, which must appear at the end of a path.
+
+## Use with a reverse proxy
+
+When Nginx, Apache, LiteSpeed, or another reverse proxy sits in front of Django, `REMOTE_ADDR` may contain the proxy's IP address instead of the visitor's IP address.
+
+Add the IP addresses of trusted reverse proxies to `IP_RESTRICT_TRUSTED_PROXY_IPS` in `settings.py`:
+
+```python
+IP_RESTRICT_TRUSTED_PROXY_IPS = [
+    '127.0.0.1',  # IPv4 localhost
+    '::1',        # IPv6 localhost
+]
+```
+
+These addresses are for reverse proxies running on the same server as Django. If your proxy runs on another server, use its IP address instead.
+
+The middleware only trusts `X-Real-IP` when `REMOTE_ADDR` belongs to a trusted proxy. Otherwise, the header is ignored. If a trusted proxy does not provide a valid `X-Real-IP`, access to protected URLs is denied.
+
+For Nginx, add the following line to the location block that forwards requests to Django:
+
+```nginx
+proxy_set_header X-Real-IP $remote_addr;
+```
+
+Do not add `0.0.0.0/0` or `::/0` to `IP_RESTRICT_TRUSTED_PROXY_IPS`. Ensure the Django application server is not directly accessible from untrusted networks.
+
+This feature supports TCP-connected proxies, not Unix sockets.
+
+## Use with Cloudflare
+
+Without Cloudflare or another reverse proxy, Django normally receives the visitor's IP address directly.
+
+When your domain's DNS record is set to **Proxied** (orange cloud) in Cloudflare, your server receives a Cloudflare IP address instead of the visitor's IP address.
+
+Cloudflare includes the visitor's original IP address in the `CF-Connecting-IP` request header.
+
+Without the Cloudflare configuration, `ALLOWED_IPS` cannot match the real visitor because Django only sees Cloudflare's IP address.
+
+The middleware uses Cloudflare's IP ranges to verify that the connecting IP address belongs to Cloudflare before trusting `CF-Connecting-IP`. It never trusts `X-Forwarded-For` and ignores spoofed `CF-Connecting-IP` headers from other sources.
+
+If Cloudflare sits in front of Nginx or another reverse proxy, configure `IP_RESTRICT_TRUSTED_PROXY_IPS` first. The middleware verifies the Cloudflare IP received through that trusted proxy before reading `CF-Connecting-IP`.
+
+To use the Cloudflare IP update command, add `django_ip_path_restrict` to `INSTALLED_APPS` in `settings.py`:
+
+```python
+INSTALLED_APPS = [
+    # Existing apps...
+    'django_ip_path_restrict',
+]
+```
+
+Adding the package to `INSTALLED_APPS` is not required if you only use the middleware.
+
+### Configure the cache file
+
+Set a location where the package can save Cloudflare's IP ranges. This should be outside publicly accessible directories such as `static` and `media`.
+
+If the directory doesn't exist, the package will create it automatically.
+
+```python
+CLOUDFLARE_IPS_FILE = BASE_DIR / 'private' / 'cloudflare_ips.json'
+```
+
+### Download Cloudflare IP ranges
+
+The package does not include Cloudflare's IP ranges. Run the following command after installation to download them:
+
+```bash
+python manage.py update_cloudflare_ips
+```
+
+### Schedule daily updates
+
+You can use a cron job to update Cloudflare's IP ranges automatically once per day.
+
+**Linux (crontab)**
+
+```cron
+0 4 * * * cd /home/USER/project && /home/USER/project/.venv/bin/python manage.py update_cloudflare_ips >> /home/USER/cloudflare_update.log 2>&1
+```
+
+**cPanel**
+
+In cPanel, go to **Advanced > Cron Jobs** and set the schedule to run daily at 4:00 AM.
+
+Enter the following in the Command field:
+
+```bash
+cd /home/USER/project && /home/USER/virtualenv/project/3.12/bin/python manage.py update_cloudflare_ips >> /home/USER/cloudflare_update.log 2>&1
+```
+
+Replace the example paths with your actual project and virtual environment paths.
+
+### Automatic updates (optional)
+
+If you cannot schedule updates using a cron job, you can enable automatic updates when a protected URL is accessed:
+
+```python
+CLOUDFLARE_IPS_AUTO_UPDATE = True
+```
+
+With this setting enabled, the next request to a protected URL attempts to download Cloudflare's IP ranges if the cache file is missing, invalid, or more than 24 hours old. The request may take longer due to the download, which has a five-second timeout.
+
+If the download fails and no valid cache file is available, requests relying on Cloudflare IP detection will be blocked.
+
+### Share Cloudflare IP ranges between sites on the same server
+
+Set each site's `CLOUDFLARE_IPS_FILE` to the same shared cache file, outside directories publicly accessible by your websites. Each site reads the file directly and automatically detects when it has been updated.
+
+```python
+CLOUDFLARE_IPS_FILE = '/home/USER/private/cloudflare_ips.json'
+```
+
+Run `update_cloudflare_ips` once per day from one site's virtual environment. It safely updates the shared file, preventing other sites from reading incomplete data.
+
+## Author
+
+Created by [Peter Stavrou](https://peterstavrou.com/).

django_ip_path_restrict-1.0.0/README.md

@@ -0,0 +1,205 @@
+# django-ip-path-restrict
+
+Restrict access to specific URLs so that only users with whitelisted IP addresses can access them.
+
+Supports IPv4 and IPv6 addresses, IP ranges, and optional Cloudflare support.
+
+## Requirements
+
+- Python 3.11+
+- Django 5.2+
+
+## Installation
+
+```bash
+pip install django-ip-path-restrict
+```
+
+In the `settings.py` file, add the middleware near the top of `MIDDLEWARE`, preferably immediately after `SecurityMiddleware`:
+
+```python
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django_ip_path_restrict.middleware.RestrictPathsByIPMiddleware',
+    # Other middleware...
+]
+```
+
+Placing the middleware near the top allows unauthorised requests to be blocked early, before other middleware processes them.
+
+## Configuration
+
+Add `PROTECTED_PATHS` to `settings.py` to specify which URLs to restrict based on IP addresses.
+
+```python
+PROTECTED_PATHS = [
+    '/admin/*',  # * matches /admin/ and all paths under it
+    '/login/',   # Only matches /login/
+]
+```
+
+Add `ALLOWED_IPS` to specify which IP addresses are allowed to access the protected URLs.
+
+IPv4, IPv6 and CIDR IP ranges are supported:
+
+```python
+ALLOWED_IPS = [
+    '203.0.113.10',    # IPv4 address
+    '2001:db8::10',    # IPv6 address
+    '198.51.100.0/24', # IPv4 address range
+]
+```
+
+Replace these example IP addresses with the addresses you want to allow.
+
+Users who try to access protected URLs from an IP address that is not in `ALLOWED_IPS` will receive a 404 Not Found response.
+
+All other URLs remain accessible as normal.
+
+If your project already uses django-environ or another settings library, you can load `ALLOWED_IPS` from an environment variable instead.
+
+### Local development
+
+IP restrictions apply regardless of `DEBUG`. To access protected URLs locally, add the localhost IP addresses to `ALLOWED_IPS` in your development settings:
+
+```python
+ALLOWED_IPS = [
+    '127.0.0.1',  # IPv4 localhost
+    '::1',        # IPv6 localhost
+]
+```
+
+Keep these addresses in your development settings rather than adding them to your production allowlist.
+
+## Path matching
+
+
+| Pattern | Paths matched |
+| --- | --- |
+| `/admin` | `/admin` only |
+| `/admin/` | `/admin/` only |
+| `/admin/*` | `/admin/` and all paths under it, but not `/admin` |
+| `/admin*` | All paths starting with `/admin`, including `/administration` |
+
+
+For a standard Django admin installation, use `/admin/*`.
+
+The only supported wildcard is `*`, which must appear at the end of a path.
+
+## Use with a reverse proxy
+
+When Nginx, Apache, LiteSpeed, or another reverse proxy sits in front of Django, `REMOTE_ADDR` may contain the proxy's IP address instead of the visitor's IP address.
+
+Add the IP addresses of trusted reverse proxies to `IP_RESTRICT_TRUSTED_PROXY_IPS` in `settings.py`:
+
+```python
+IP_RESTRICT_TRUSTED_PROXY_IPS = [
+    '127.0.0.1',  # IPv4 localhost
+    '::1',        # IPv6 localhost
+]
+```
+
+These addresses are for reverse proxies running on the same server as Django. If your proxy runs on another server, use its IP address instead.
+
+The middleware only trusts `X-Real-IP` when `REMOTE_ADDR` belongs to a trusted proxy. Otherwise, the header is ignored. If a trusted proxy does not provide a valid `X-Real-IP`, access to protected URLs is denied.
+
+For Nginx, add the following line to the location block that forwards requests to Django:
+
+```nginx
+proxy_set_header X-Real-IP $remote_addr;
+```
+
+Do not add `0.0.0.0/0` or `::/0` to `IP_RESTRICT_TRUSTED_PROXY_IPS`. Ensure the Django application server is not directly accessible from untrusted networks.
+
+This feature supports TCP-connected proxies, not Unix sockets.
+
+## Use with Cloudflare
+
+Without Cloudflare or another reverse proxy, Django normally receives the visitor's IP address directly.
+
+When your domain's DNS record is set to **Proxied** (orange cloud) in Cloudflare, your server receives a Cloudflare IP address instead of the visitor's IP address.
+
+Cloudflare includes the visitor's original IP address in the `CF-Connecting-IP` request header.
+
+Without the Cloudflare configuration, `ALLOWED_IPS` cannot match the real visitor because Django only sees Cloudflare's IP address.
+
+The middleware uses Cloudflare's IP ranges to verify that the connecting IP address belongs to Cloudflare before trusting `CF-Connecting-IP`. It never trusts `X-Forwarded-For` and ignores spoofed `CF-Connecting-IP` headers from other sources.
+
+If Cloudflare sits in front of Nginx or another reverse proxy, configure `IP_RESTRICT_TRUSTED_PROXY_IPS` first. The middleware verifies the Cloudflare IP received through that trusted proxy before reading `CF-Connecting-IP`.
+
+To use the Cloudflare IP update command, add `django_ip_path_restrict` to `INSTALLED_APPS` in `settings.py`:
+
+```python
+INSTALLED_APPS = [
+    # Existing apps...
+    'django_ip_path_restrict',
+]
+```
+
+Adding the package to `INSTALLED_APPS` is not required if you only use the middleware.
+
+### Configure the cache file
+
+Set a location where the package can save Cloudflare's IP ranges. This should be outside publicly accessible directories such as `static` and `media`.
+
+If the directory doesn't exist, the package will create it automatically.
+
+```python
+CLOUDFLARE_IPS_FILE = BASE_DIR / 'private' / 'cloudflare_ips.json'
+```
+
+### Download Cloudflare IP ranges
+
+The package does not include Cloudflare's IP ranges. Run the following command after installation to download them:
+
+```bash
+python manage.py update_cloudflare_ips
+```
+
+### Schedule daily updates
+
+You can use a cron job to update Cloudflare's IP ranges automatically once per day.
+
+**Linux (crontab)**
+
+```cron
+0 4 * * * cd /home/USER/project && /home/USER/project/.venv/bin/python manage.py update_cloudflare_ips >> /home/USER/cloudflare_update.log 2>&1
+```
+
+**cPanel**
+
+In cPanel, go to **Advanced > Cron Jobs** and set the schedule to run daily at 4:00 AM.
+
+Enter the following in the Command field:
+
+```bash
+cd /home/USER/project && /home/USER/virtualenv/project/3.12/bin/python manage.py update_cloudflare_ips >> /home/USER/cloudflare_update.log 2>&1
+```
+
+Replace the example paths with your actual project and virtual environment paths.
+
+### Automatic updates (optional)
+
+If you cannot schedule updates using a cron job, you can enable automatic updates when a protected URL is accessed:
+
+```python
+CLOUDFLARE_IPS_AUTO_UPDATE = True
+```
+
+With this setting enabled, the next request to a protected URL attempts to download Cloudflare's IP ranges if the cache file is missing, invalid, or more than 24 hours old. The request may take longer due to the download, which has a five-second timeout.
+
+If the download fails and no valid cache file is available, requests relying on Cloudflare IP detection will be blocked.
+
+### Share Cloudflare IP ranges between sites on the same server
+
+Set each site's `CLOUDFLARE_IPS_FILE` to the same shared cache file, outside directories publicly accessible by your websites. Each site reads the file directly and automatically detects when it has been updated.
+
+```python
+CLOUDFLARE_IPS_FILE = '/home/USER/private/cloudflare_ips.json'
+```
+
+Run `update_cloudflare_ips` once per day from one site's virtual environment. It safely updates the shared file, preventing other sites from reading incomplete data.
+
+## Author
+
+Created by [Peter Stavrou](https://peterstavrou.com/).

django_ip_path_restrict-1.0.0/django_ip_path_restrict/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class DjangoIPPathRestrictConfig(AppConfig):
+    name = 'django_ip_path_restrict'
+    verbose_name = 'Django IP Path Restrict'

django_ip_path_restrict-1.0.0/django_ip_path_restrict/cloudflare.py

@@ -0,0 +1,163 @@
+"""Cloudflare IP range caching and on-request updates."""
+
+import json
+import os
+import time
+from ipaddress import ip_network
+from pathlib import Path
+from tempfile import NamedTemporaryFile
+from urllib.request import Request, urlopen
+
+API_URL = 'https://api.cloudflare.com/client/v4/ips'
+UPDATE_INTERVAL_SECONDS = 86400 # Default: 24 hours
+IP_VERSIONS = {
+    'ipv4_cidrs': 4,
+    'ipv6_cidrs': 6,
+}
+
+
+def validate_ip_ranges(ip_range_data):
+    """Validate IPv4 and IPv6 ranges and normalize them for storage."""
+    if not isinstance(ip_range_data, dict):
+        raise ValueError('Expected a dictionary containing Cloudflare IP ranges')
+
+    validated_ip_ranges = {}
+
+    for ip_range_key, expected_ip_version in IP_VERSIONS.items():
+        ip_ranges = ip_range_data.get(ip_range_key)
+
+        if not isinstance(ip_ranges, list) or not ip_ranges:
+            raise ValueError(
+                f'Cloudflare response has no valid {ip_range_key}'
+            )
+
+        ip_networks = [
+            ip_network(ip_range, strict=True)
+            for ip_range in ip_ranges
+        ]
+
+        if any(
+            network.version != expected_ip_version
+            for network in ip_networks
+        ):
+            raise ValueError(f'Invalid address family in {ip_range_key}')
+
+        validated_ip_ranges[ip_range_key] = [str(network) for network in ip_networks]
+
+    return validated_ip_ranges
+
+
+def fetch_cloudflare_ranges():
+    """Fetch IP ranges from Cloudflare's public API."""
+    request_headers = {'User-Agent': 'django-ip-path-restrict/1.0.0'}
+
+    with urlopen(
+        Request(API_URL, headers=request_headers), timeout=5
+    ) as api_response:
+        api_response_data = json.load(api_response)
+
+    if not api_response_data.get('success'):
+        raise ValueError('Cloudflare API returned an unsuccessful response')
+
+    return validate_ip_ranges(api_response_data.get('result'))
+
+
+def save_cloudflare_ranges(cache_file_path, ip_ranges):
+    """Save validated IP ranges without leaving an incomplete cache file."""
+    validated_ip_ranges = validate_ip_ranges(ip_ranges)
+    cache_file_path = Path(cache_file_path)
+    cache_file_path.parent.mkdir(parents=True, exist_ok=True)
+    temporary_file_path = None
+
+    try:
+        with NamedTemporaryFile(
+            mode='w',
+            encoding='utf-8',
+            dir=cache_file_path.parent,
+            prefix='.cloudflare_ips_',
+            suffix='.tmp',
+            delete=False,
+        ) as temporary_file:
+            temporary_file_path = Path(temporary_file.name)
+            json.dump(validated_ip_ranges, temporary_file, indent=2)
+            temporary_file.write('\n')
+
+        os.replace(temporary_file_path, cache_file_path)
+    finally:
+        if temporary_file_path is not None:
+            temporary_file_path.unlink(missing_ok=True)
+
+
+def download_and_save(cache_file_path):
+    """Download Cloudflare ranges and safely replace the cache file."""
+    cloudflare_ip_ranges = fetch_cloudflare_ranges()
+    save_cloudflare_ranges(cache_file_path, cloudflare_ip_ranges)
+    return (
+        len(cloudflare_ip_ranges['ipv4_cidrs'])
+        + len(cloudflare_ip_ranges['ipv6_cidrs'])
+    )
+
+
+class CloudflareIPStore:
+    """Load cached Cloudflare ranges and refresh them once every 24 hours."""
+
+    def __init__(self, cache_file_path):
+        self.cache_file_path = Path(cache_file_path)
+        self._cached_networks = ()
+        self._cache_file_modified_time_nanoseconds = None
+        self._last_update_attempt = 0
+
+    @staticmethod
+    def _load_file(cache_file_path):
+        with Path(cache_file_path).open(encoding='utf-8') as cache_file:
+            return validate_ip_ranges(json.load(cache_file))
+
+    @staticmethod
+    def _to_networks(ip_ranges):
+        ip_range_strings = ip_ranges['ipv4_cidrs'] + ip_ranges['ipv6_cidrs']
+        return tuple(ip_network(ip_range) for ip_range in ip_range_strings)
+
+    def get_networks(self):
+        """Reload a changed cache file and fail closed when it is unavailable."""
+        try:
+            cache_file_modified_time_nanoseconds = self.cache_file_path.stat().st_mtime_ns
+        except OSError:
+            self._cached_networks = ()
+            self._cache_file_modified_time_nanoseconds = None
+            return self._cached_networks
+
+        if cache_file_modified_time_nanoseconds != self._cache_file_modified_time_nanoseconds:
+            try:
+                cached_ip_ranges = self._load_file(self.cache_file_path)
+            except (OSError, TypeError, ValueError):
+                self._cached_networks = ()
+            else:
+                self._cached_networks = self._to_networks(cached_ip_ranges)
+
+            self._cache_file_modified_time_nanoseconds = cache_file_modified_time_nanoseconds
+
+        return self._cached_networks
+
+    def refresh_if_stale(self):
+        """Refresh a missing, invalid, or 24-hour-old cache on the next request."""
+        cached_networks = self.get_networks()
+        try:
+            cache_age = time.time() - self.cache_file_path.stat().st_mtime
+        except OSError:
+            cache_age = UPDATE_INTERVAL_SECONDS
+
+        if cached_networks and cache_age < UPDATE_INTERVAL_SECONDS:
+            return
+
+        current_time = time.time()
+        if current_time - self._last_update_attempt < UPDATE_INTERVAL_SECONDS:
+            return
+
+        self._last_update_attempt = current_time
+
+        try:
+            download_and_save(self.cache_file_path)
+        except Exception:
+            return
+
+        self.get_networks()

django_ip_path_restrict-1.0.0/django_ip_path_restrict/management/commands/update_cloudflare_ips.py

@@ -0,0 +1,29 @@
+"""Manually refresh the Cloudflare IP range cache."""
+
+from django.conf import settings
+from django.core.management.base import BaseCommand, CommandError
+
+from ...cloudflare import download_and_save
+
+
+class Command(BaseCommand):
+    help = 'Download Cloudflare IP ranges to CLOUDFLARE_IPS_FILE.'
+
+    def handle(self, *args, **options):
+        cache_file_path = getattr(settings, 'CLOUDFLARE_IPS_FILE', None)
+        if not cache_file_path:
+            raise CommandError('Set CLOUDFLARE_IPS_FILE in Django settings first.')
+
+        try:
+            total_range_count = download_and_save(cache_file_path)
+        except Exception as update_error:
+            raise CommandError(
+                f'Cloudflare IP update failed: {update_error}'
+            ) from update_error
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                f'Updated {total_range_count} Cloudflare IP ranges in '
+                f'{cache_file_path}'
+            )
+        )