drf-query-method 0.2.0__tar.gz → 0.3.0__tar.gz

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/.github/dependabot.yml

@@ -6,6 +6,11 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+    groups:
+      # CodeQL's init and analyze steps must run the same version.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
     open-pull-requests-limit: 5
 
   - package-ecosystem: uv

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/.github/workflows/ci.yml

@@ -122,7 +122,7 @@ jobs:
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Download coverage data
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: coverage-*
           merge-multiple: true
@@ -144,6 +144,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check job results
-        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+        uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
         with:
           jobs: ${{ toJSON(needs) }}

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/.github/workflows/codeql.yml

@@ -25,11 +25,11 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: python  # Add c-cpp, go, java-kotlin, or swift if needed
           build-mode: none   # Switch to autobuild for compiled languages
           queries: security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/.github/workflows/publish.yml

@@ -50,13 +50,13 @@ jobs:
       url: https://pypi.org/p/drf-query-method
     steps:
       - name: Download distribution
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: "dist/*"
 

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/.github/workflows/zizmor.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           advanced-security: ${{ github.event.repository.private == false || vars.CODE_SECURITY_ENABLED == 'true' }}
           inputs: ./.github/

drf_query_method-0.3.0/CHANGELOG/0.3.0.md

@@ -0,0 +1,11 @@
+# drf-query-method 0.3.0
+
+## Changed
+
+- On Django 4.2 to 6.1, `add_query_method()` (and so `patch()`) now treats `QUERY` as a safe method in Django's
+  `CsrfViewMiddleware`, matching Django 6.2. `QUERY` requests no longer need a CSRF token on any supported version,
+  including session-authenticated requests through DRF's `SessionAuthentication`.
+
+## Documentation
+
+- README and usage docs explain CSRF for `QUERY`, and the README no longer says the package is unreleased.

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: drf-query-method
-Version: 0.2.0
+Version: 0.3.0
 Summary: HTTP QUERY method (RFC 10008) support for Django REST framework.
 Project-URL: bugs, https://github.com/BenA-SA/drf-query-method/issues
 Project-URL: changelog, https://github.com/BenA-SA/drf-query-method/releases
@@ -78,12 +78,24 @@ Routers then send `QUERY /notes/` to `query()`, and `SearchFilter`, `OrderingFil
 classes with the same names from `drf_query_method` instead. See the [documentation](https://BenA-SA.github.io/drf-query-method/usage/)
 for both approaches, and for sending `QUERY` requests from JavaScript and other clients.
 
-The package is in early development and not yet released.
+The package is in early development. Releases are on [PyPI](https://pypi.org/project/drf-query-method/).
+
+## CSRF
+
+`QUERY` is a safe method, so it never needs a CSRF token, on any supported Django version. Django 6.2 exempts it from
+CSRF checks itself. On Django 4.2 to 6.1, where this package adds `QUERY`, it also teaches Django's
+`CsrfViewMiddleware` to treat `QUERY` as safe, so the behaviour matches 6.2. DRF's `SessionAuthentication` uses the same
+check, so session-authenticated `QUERY` requests work without a token too.
+
+The trade-off is the one `GET` has always had: a `query()` handler must never change data. Cross-site requests are
+still guarded by CORS, because browsers can only send `QUERY` from JavaScript, and `QUERY` isn't a CORS-safelisted
+method, so a cross-origin request needs your server's permission first.
 
 ## Compatibility
 
 * Python 3.10+
-* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it.
+* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it,
+  including Django 6.2's CSRF behaviour.
 * Django REST framework 3.16+
 * django-filter and django-rest-framework-datatables, optionally
 

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/README.md

@@ -40,12 +40,24 @@ Routers then send `QUERY /notes/` to `query()`, and `SearchFilter`, `OrderingFil
 classes with the same names from `drf_query_method` instead. See the [documentation](https://BenA-SA.github.io/drf-query-method/usage/)
 for both approaches, and for sending `QUERY` requests from JavaScript and other clients.
 
-The package is in early development and not yet released.
+The package is in early development. Releases are on [PyPI](https://pypi.org/project/drf-query-method/).
+
+## CSRF
+
+`QUERY` is a safe method, so it never needs a CSRF token, on any supported Django version. Django 6.2 exempts it from
+CSRF checks itself. On Django 4.2 to 6.1, where this package adds `QUERY`, it also teaches Django's
+`CsrfViewMiddleware` to treat `QUERY` as safe, so the behaviour matches 6.2. DRF's `SessionAuthentication` uses the same
+check, so session-authenticated `QUERY` requests work without a token too.
+
+The trade-off is the one `GET` has always had: a `query()` handler must never change data. Cross-site requests are
+still guarded by CORS, because browsers can only send `QUERY` from JavaScript, and `QUERY` isn't a CORS-safelisted
+method, so a cross-origin request needs your server's permission first.
 
 ## Compatibility
 
 * Python 3.10+
-* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it.
+* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it,
+  including Django 6.2's CSRF behaviour.
 * Django REST framework 3.16+
 * django-filter and django-rest-framework-datatables, optionally
 

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/docs/usage.md

@@ -135,8 +135,8 @@ A few things to check before relying on `QUERY` in production:
     CORS_ALLOW_METHODS = (*default_methods, "QUERY")
     ```
 
-* **CSRF.** On Django versions before 6.2, session-authenticated `QUERY` requests need a CSRF token, the same as
-  `POST`.
+* **CSRF.** None needed: `QUERY` is a safe method, so it never needs a CSRF token on any supported Django version. See
+  [Django versions before 6.2](#django-versions-before-62) for how older versions get the same behaviour.
 * **Proxies, CDNs and firewalls.** Some reject request methods they don't recognise. Check that `QUERY` reaches your
   application through everything in front of it.
 * **Caching.** `QUERY` responses are cacheable in principle, but caches generally don't key on request bodies, and
@@ -161,8 +161,21 @@ still read from the URL.
 
 ## Django versions before 6.2
 
-Django 6.2 supports `QUERY` natively. On earlier versions this package adds it, with one difference: Django's CSRF
-middleware treats `QUERY` as unsafe until 6.2, so session-authenticated `QUERY` requests need a CSRF token.
+Django 6.2 supports `QUERY` natively. On Django 4.2 to 6.1, `add_query_method()` (which `patch()` calls) brings the same
+behaviour to older versions in two ways:
+
+* It adds `query` to Django's allowed view methods, so views can define a `query()` handler.
+* It treats `QUERY` as a safe method in `CsrfViewMiddleware`, as Django 6.2 does. Before 6.2 the middleware only
+  exempts `GET`, `HEAD`, `OPTIONS` and `TRACE`, so without this, session-authenticated `QUERY` requests would need a
+  CSRF token. DRF's `SessionAuthentication` checks CSRF through the same middleware, so it follows suit.
+
+The result is that `QUERY` never needs a CSRF token, whichever supported Django version you're on. If you call
+`add_query_method()` yourself rather than `patch()`, call it once at startup, before requests are served.
+
+This is safe for the same reason it is in Django 6.2. CSRF protects against another site making a logged-in user's
+browser send a request. HTML forms can only send `GET` and `POST`, so `QUERY` can only come from JavaScript, and
+because `QUERY` is not a CORS-safelisted method, the browser asks your server's permission with a preflight request
+before sending a cross-origin one. As with `GET`, a `query()` handler must never change data.
 
 ## Moving to DRF's own support
 

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "drf-query-method"
-version = "0.2.0"
+version = "0.3.0"
 description = "HTTP QUERY method (RFC 10008) support for Django REST framework."
 readme = "README.md"
 authors = [

drf_query_method-0.3.0/src/drf_query_method/methods.py

@@ -0,0 +1,47 @@
+"""Make Django accept the QUERY method on versions before 6.2."""
+
+import functools
+
+from django.middleware.csrf import CsrfViewMiddleware
+from django.views.generic import View
+
+
+def add_query_method() -> None:
+    """Make Django before 6.2 handle ``QUERY`` as Django 6.2 does.
+
+    Django 6.2 supports ``QUERY`` natively, so this does nothing there. On
+    earlier versions it adds ``query`` to ``View.http_method_names``, so any
+    view, including DRF's, can dispatch ``QUERY`` requests to a ``query()``
+    handler, and it treats ``QUERY`` as a safe method in
+    ``CsrfViewMiddleware``, so ``QUERY`` requests need no CSRF token. See
+    :func:`skip_csrf_for_query`.
+    """
+    if "query" in View.http_method_names:
+        return
+    View.http_method_names = [*View.http_method_names, "query"]
+    CsrfViewMiddleware.process_view = skip_csrf_for_query(CsrfViewMiddleware.process_view)
+
+
+def skip_csrf_for_query(process_view):
+    """Wrap ``CsrfViewMiddleware.process_view`` to accept ``QUERY`` like ``GET``.
+
+    Django 6.2 adds ``QUERY`` to the methods the middleware exempts as safe
+    under RFC 9110. Earlier versions hard-code ``GET``, ``HEAD``, ``OPTIONS``
+    and ``TRACE``, so the wrapper sends ``QUERY`` down the same path: a request
+    already processed, or a ``csrf_exempt`` view, is left alone, and anything
+    else is accepted without a token. Every other method falls through to
+    Django unchanged.
+
+    DRF's ``SessionAuthentication`` checks CSRF through ``CSRFCheck``, a
+    ``CsrfViewMiddleware`` subclass, so it follows the same rule.
+    """
+
+    @functools.wraps(process_view)
+    def wrapper(self, request, callback, callback_args, callback_kwargs):
+        if request.method != "QUERY":
+            return process_view(self, request, callback, callback_args, callback_kwargs)
+        if getattr(request, "csrf_processing_done", False) or getattr(callback, "csrf_exempt", False):
+            return None
+        return self._accept(request)
+
+    return wrapper

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/tests/settings.py

@@ -5,12 +5,19 @@ SECRET_KEY = "drf-query-method-tests"
 INSTALLED_APPS = [
     "django.contrib.auth",
     "django.contrib.contenttypes",
+    "django.contrib.sessions",
     "django_filters",
     "rest_framework",
 ]
 
 ROOT_URLCONF = "tests.urls"
 
+MIDDLEWARE = [
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+]
+
 DATABASES = {
     "default": {
         "ENGINE": "django.db.backends.sqlite3",

drf_query_method-0.3.0/tests/test_csrf.py

@@ -0,0 +1,39 @@
+import pytest
+from django.contrib.auth.models import User
+from django.http import HttpResponse
+from django.middleware.csrf import CsrfViewMiddleware
+from django.test import RequestFactory
+
+from drf_query_method import add_query_method
+from drf_query_method.test import APIClient
+
+
+@pytest.fixture
+def client(db):
+    client = APIClient(enforce_csrf_checks=True)
+    client.force_login(User.objects.create(username="alice"))
+    return client
+
+
+def test_session_authenticated_query_needs_no_csrf_token(client):
+    response = client.query("/session/", {"search": "a"}, format="json")
+    assert response.status_code == 200
+    assert response.data == {"method": "QUERY"}
+
+
+def test_session_authenticated_post_still_needs_a_csrf_token(client):
+    assert client.post("/session/", {}, format="json").status_code == 403
+
+
+def test_csrf_middleware_accepts_query_as_a_safe_method():
+    middleware = CsrfViewMiddleware(lambda request: HttpResponse())
+    request = RequestFactory().generic("QUERY", "/")
+    assert middleware.process_view(request, lambda request: HttpResponse(), (), {}) is None
+    assert request.csrf_processing_done
+
+
+def test_add_query_method_wraps_the_middleware_once():
+    add_query_method()
+    add_query_method()
+    process_view = CsrfViewMiddleware.process_view
+    assert not hasattr(getattr(process_view, "__wrapped__", None), "__wrapped__")

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/tests/urls.py

@@ -1,8 +1,9 @@
 from django.urls import path
 
-from tests.views import QueryEchoView, redirect_view
+from tests.views import QueryEchoView, SessionQueryView, redirect_view
 
 urlpatterns = [
     path("query/", QueryEchoView.as_view()),
     path("redirect/", redirect_view),
+    path("session/", SessionQueryView.as_view()),
 ]

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/tests/views.py

@@ -3,7 +3,9 @@
 from django.contrib.auth.models import User
 from django.http.response import HttpResponseRedirectBase
 from rest_framework import generics, serializers
+from rest_framework.authentication import SessionAuthentication
 from rest_framework.decorators import action, api_view
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
@@ -72,3 +74,14 @@ class QueryActionViewSet(viewsets.GenericViewSet):
     @action(detail=False, methods=["post"])
     def query(self, request):
         return Response("action")
+
+
+class SessionQueryView(APIView):
+    authentication_classes = [SessionAuthentication]
+    permission_classes = [IsAuthenticated]
+
+    def query(self, request):
+        return Response({"method": request.method})
+
+    def post(self, request):
+        return Response({"method": request.method})

{drf_query_method-0.2.0 → drf_query_method-0.3.0}/uv.lock

@@ -422,7 +422,7 @@ wheels = [
 
 [[package]]
 name = "drf-query-method"
-version = "0.2.0"
+version = "0.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "django", version = "5.2.18", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" },

drf_query_method-0.2.0/src/drf_query_method/methods.py

@@ -1,16 +0,0 @@
-"""Make Django accept the QUERY method on versions before 6.2."""
-
-from django.views.generic import View
-
-
-def add_query_method() -> None:
-    """Add ``query`` to Django's ``View.http_method_names`` if it is missing.
-
-    Django 6.2 lists ``query`` itself, so this does nothing there. On earlier
-    versions it lets any view, including DRF's, dispatch ``QUERY`` requests to
-    a ``query()`` handler. Earlier versions of Django's CSRF middleware treat
-    ``QUERY`` as unsafe, so session-authenticated ``QUERY`` requests need a
-    CSRF token until Django 6.2.
-    """
-    if "query" not in View.http_method_names:
-        View.http_method_names = [*View.http_method_names, "query"]