ansible / django-ansible-base

Apache License 2.0
12 stars 43 forks source link

[get_fully_qualified_url] Fallback to crum request #528

Closed relrod closed 1 month ago

relrod commented 1 month ago

In the event where we a request isn't passed in to DRF reverse(), it will return a relative URL. This is unexpected, given the name of our wrapper, get_fully_qualified_url().

In one case, in social auth completion, we weren't passing in a request and were getting a relative URL back. This is used as a default CALLBACK_URL in SAML. That field gets url-validated, and since we were ending up with a relative URL there, validation failed. This means that any attempt to create a SAML authenticator without a CALLBACK_URL explicitly defined, was failing validation and not saving.

With this patch, get_fully_qualified_url() defaults to django-crum's get_current_request(), if a request isn't passed in. It will still fall back to a relative URL if get_current_request() isn't able to identify a request (e.g. if get_fully_qualified_url() ends up being called somewhere in the lifespan of a CLI command where there's no request).

Test plan: Added new test_app test to use the API to create a SAML authenticator with no CALLBACK_URL set. Before this patch, the test failed. After this patch, the test passes. Also added more test cases for get_fully_qualified_url().

sonarcloud[bot] commented 1 month ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud