learning-website-django1-5  Exercise 2: Show a Real Page
======================================================

Replace the Chapter 2 placeholder views with real ones: find the page in the
database by its path, check it belongs to this site, and render it inside the
theme.

Save as apps/content/views.py:

from django.shortcuts import get_object_or_404, render

from .models import Page


def home(request, site):
    pages = Page.objects.light().filter(site=site)
    return render(request, "theme/home.html", {"page_count": pages.count(),
                                               "course_count": pages.exclude(course=None).values("course").distinct().count()})


def page(request, site, page_path):
    """An address such as /hungary/x/chapter/ is the file path hungary/x/chapter.html."""
    path = page_path.rstrip("/") + ".html"
    page = get_object_or_404(Page, path=path, site=site)             # a page of ANOTHER site is a 404 too
    # a page with its own <h1> shows it; every other page gets one made from its title (as on the live site)
    show_h1 = "<h1" not in page.fragment.lower()
    return render(request, "theme/page.html", {"page": page, "show_h1": show_h1})

config/urlconfs/__init__.py now imports its views from apps.content instead of
apps.core (one changed line):

  from apps.content import views

THE OLD TESTS BREAK, ON PURPOSE. The Chapter 2 tests asked the placeholder views
what they returned, so replacing the views broke 11 of them. Three kinds of
test needed a different approach:
- "does this site route this folder?" now asks the URL configuration directly,
  with django.urls.resolve(), instead of requesting a page and reading the
  placeholder text. A page that is routed but missing is also a 404, so a status
  code can no longer tell the two apart.
- tests that look for a site in the response now look for data-site="..."
  in the page.
- tests that need a page now create one in the (test) database.
Takeaway: a test that asserts on placeholder output is a test of the placeholder.

The updated tests:

Save as tests/test_routing.py:

from django.test import Client, SimpleTestCase, TestCase, override_settings
from django.urls import Resolver404, resolve

from config.sites_config import SITES


def get(host, path="/"):
    return Client().get(path, HTTP_HOST=host)


def routed(site, path):
    """True if the site's own URL configuration has a route for this path (no database, no view run)."""
    try:
        resolve(path, urlconf=f"config.urlconfs.{site}")
    except Resolver404:
        return False
    return True


class SiteSelectionTests(TestCase):
    """Which site answers is decided from the Host header (Chapter 2)."""

    def test_every_site_answers_on_its_own_host(self):
        for name, info in SITES.items():
            response = get(f"{name}.localhost")
            self.assertEqual(response.status_code, 200, name)
            self.assertIn(f'data-site="{name}"', response.content.decode())

    def test_the_port_in_the_host_header_is_ignored(self):
        response = get("languages.localhost:8000")
        self.assertEqual(response.status_code, 200)
        self.assertIn('data-site="languages"', response.content.decode())

    def test_host_names_are_case_insensitive(self):
        self.assertEqual(get("LANGUAGES.LOCALHOST").status_code, 200)

    def test_an_unknown_host_is_refused_before_any_site_code_runs(self):
        self.assertEqual(get("evil.example.org").status_code, 400)

    def test_an_allowed_but_unmapped_host_gets_the_unknown_site_page(self):
        with override_settings(ALLOWED_HOSTS=["spare.localhost"]):
            response = get("spare.localhost")
        self.assertEqual(response.status_code, 404)
        self.assertEqual(response.content, b"Unknown site")


class RoutesBelongToTheSiteTests(SimpleTestCase):
    """Each site's URL configuration only has routes for its own folders."""

    def test_a_site_routes_its_own_folders(self):
        self.assertTrue(routed("languages", "/hungary/hungarian-basic-3/chapter-1/"))

    def test_a_site_does_not_route_another_sites_folders(self):
        self.assertFalse(routed("languages", "/linux/shell-and-scripting/vim/"))
        self.assertTrue(routed("systems", "/linux/shell-and-scripting/vim/"))

    def test_a_folder_name_must_match_exactly(self):
        self.assertFalse(routed("languages", "/hungary-extra/"))

    def test_every_folder_in_the_map_routes_to_its_own_site_only(self):
        for site, info in SITES.items():
            other = next(s for s in SITES if s != site)
            for folder in info["folders"]:
                self.assertTrue(routed(site, f"/{folder}/x/"), (site, folder))
                self.assertFalse(routed(other, f"/{folder}/x/"), (other, folder))

Save as tests/test_proxy.py:

from django.test import Client, RequestFactory, SimpleTestCase, TestCase, override_settings

PROXY_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")


class BehindAProxyHeaderTests(SimpleTestCase):
    """Apache ends the HTTPS connection and talks plain HTTP to Django. What does Django believe?"""

    def test_https_is_only_believed_when_the_header_is_trusted(self):
        request = RequestFactory().get("/", HTTP_HOST="languages.localhost", HTTP_X_FORWARDED_PROTO="https")
        self.assertFalse(request.is_secure())                      # default: the header is ignored
        with override_settings(SECURE_PROXY_SSL_HEADER=PROXY_HEADER):
            self.assertTrue(request.is_secure())                   # trusted: now https

    def test_without_the_header_a_plain_request_is_not_secure(self):
        request = RequestFactory().get("/", HTTP_HOST="languages.localhost")
        with override_settings(SECURE_PROXY_SSL_HEADER=PROXY_HEADER):
            self.assertFalse(request.is_secure())


class BehindAProxyRequestTests(TestCase):
    @override_settings(SECURE_SSL_REDIRECT=True, SECURE_PROXY_SSL_HEADER=PROXY_HEADER)
    def test_ssl_redirect_does_not_loop_behind_the_proxy(self):
        plain = Client().get("/", HTTP_HOST="languages.localhost")
        self.assertEqual(plain.status_code, 301)
        self.assertEqual(plain["Location"], "https://languages.localhost/")
        proxied = Client().get("/", HTTP_HOST="languages.localhost", HTTP_X_FORWARDED_PROTO="https")
        self.assertEqual(proxied.status_code, 200)                 # no redirect loop

    def test_x_forwarded_host_is_ignored_by_default(self):
        response = Client().get("/", HTTP_HOST="languages.localhost", HTTP_X_FORWARDED_HOST="systems.localhost")
        self.assertIn('data-site="languages"', response.content.decode())

    @override_settings(USE_X_FORWARDED_HOST=True)
    def test_trusting_x_forwarded_host_lets_a_visitor_pick_the_site(self):
        # This is why the setting stays off: anyone can send that header.
        response = Client().get("/", HTTP_HOST="languages.localhost", HTTP_X_FORWARDED_HOST="systems.localhost")
        self.assertIn('data-site="systems"', response.content.decode())

Save as tests/test_unicode_routes.py:

from urllib.parse import quote

from django.test import Client, TestCase

from apps.content.models import Page

PATH = "japan/japanese-language/reference-materials/hiragana/hiragana_あ.html"


class NonAsciiAddressTests(TestCase):
    """Some page names are Japanese characters (hiragana_あ.html). The address is the same path."""

    def setUp(self):
        Page.objects.create(path=PATH, site="languages", kind=Page.Kind.FULL_PAGE,
                            title="あ", fragment="<p>the character あ</p>")

    def get(self, address):
        return Client().get(address, HTTP_HOST="languages.localhost")

    def test_a_percent_encoded_address_reaches_the_page(self):
        response = self.get("/japan/japanese-language/reference-materials/hiragana/hiragana_%E3%81%82/")
        self.assertEqual(response.status_code, 200)
        self.assertIn("the character あ", response.content.decode())

    def test_the_raw_character_in_an_address_works_too(self):
        response = self.get("/japan/japanese-language/reference-materials/hiragana/hiragana_あ/")
        self.assertEqual(response.status_code, 200)

    def test_the_stored_path_gives_the_percent_encoded_address(self):
        page = Page.objects.get()
        self.assertEqual(quote(page.url_path), "/japan/japanese-language/reference-materials/hiragana/hiragana_%E3%81%82/")

Save as tests/test_theme.py (the new tests for this chapter):

import re
from pathlib import Path

from django.test import Client, SimpleTestCase, TestCase

from apps.content.models import Page
from config.sites_config import SITE_STYLE, SITES

STATIC = Path(__file__).resolve().parent.parent / "apps" / "theme" / "static" / "theme"
SURFACES = {"language": "#1a1d27", "technical": "#161b22"}
BG = "#0f1117"


def luminance(hex_colour):
    h = hex_colour.lstrip("#")
    r, g, b = (int(h[i:i + 2], 16) / 255 for i in (0, 2, 4))
    f = lambda c: c / 12.92 if c <= 0.03928 else ((c + 0.055) / 1.055) ** 2.4
    return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b)


def contrast(a, b):
    hi, lo = sorted((luminance(a), luminance(b)), reverse=True)
    return (hi + 0.05) / (lo + 0.05)


class DesignTokenTests(SimpleTestCase):
    def test_every_site_has_a_style(self):
        self.assertEqual(set(SITE_STYLE), set(SITES))

    def test_every_accent_is_readable_on_its_surface_and_the_page_background(self):
        for site, style in SITE_STYLE.items():
            surface = SURFACES[style["family"]]
            for background in (surface, BG):
                self.assertGreaterEqual(contrast(style["accent"], background), 4.5, (site, style["accent"], background))

    def test_the_accents_are_all_different(self):
        accents = [s["accent"] for s in SITE_STYLE.values()]
        self.assertEqual(len(set(accents)), len(accents))

    def test_the_shared_css_never_uses_important(self):
        for name in ("tokens.css", "base.css", "components.css"):
            self.assertNotIn("!important", (STATIC / name).read_text(encoding="utf-8"), name)

    def test_the_shared_component_rules_are_not_more_specific_than_a_fragments_own(self):
        # A fragment's rule looks like ".wrapper .tip-box" (two classes). Shared rules must not use ids or
        # three-part selectors, or they would beat it.
        css = (STATIC / "components.css").read_text(encoding="utf-8")
        for selector in re.findall(r"([^{}/]+)\{", css):
            for part in selector.split(","):
                self.assertNotIn("#", part, part)
                self.assertLessEqual(len(part.split()), 2, part)


class PageRenderingTests(TestCase):
    def make(self, **kw):
        values = dict(path="hungary/hungarian-basic-3/hungarian_basic_conversation_3_1.html", site="languages",
                      kind=Page.Kind.COURSE_CHAPTER, title="Buying Clothes: Sizes & Fit",
                      fragment='<div class="hu-lesson"><p>body text</p></div>')
        values.update(kw)
        return Page.objects.create(**values)

    def get(self, host="languages.localhost", path="/hungary/hungarian-basic-3/hungarian_basic_conversation_3_1/"):
        return Client().get(path, HTTP_HOST=host)

    def test_a_page_is_shown_inside_the_site_layout(self):
        self.make()
        html = self.get().content.decode()
        self.assertIn('data-site="languages"', html)
        self.assertIn('data-family="language"', html)
        self.assertIn('style="--accent: #a78bfa"', html)
        self.assertIn('<div class="page-body"><div class="hu-lesson"><p>body text</p></div></div>', html)

    def test_the_title_is_escaped_but_the_stored_body_is_not(self):
        self.make(title="<b>x</b>", fragment="<b>y</b>")
        html = self.get().content.decode()
        self.assertIn("&lt;b&gt;x&lt;/b&gt;", html)
        self.assertIn("<b>y</b>", html)

    def test_a_page_without_its_own_h1_gets_one_made_from_its_title(self):
        self.make()
        self.assertIn('<h1 class="page-title">Buying Clothes: Sizes &amp; Fit</h1>', self.get().content.decode())

    def test_a_page_with_its_own_h1_does_not_get_a_second(self):
        self.make(fragment="<h1>Its own</h1><p>x</p>")
        self.assertEqual(self.get().content.decode().lower().count("<h1"), 1)

    def test_the_stylesheets_load_in_the_right_order(self):
        self.make()
        html = self.get().content.decode()
        order = [html.index(f"theme/{n}") for n in ("tokens.css", "base.css", "components.css")]
        self.assertEqual(order, sorted(order))
        self.assertLess(html.index("components.css"), html.index('class="page-body"'))

    def test_each_site_has_its_own_accent(self):
        seen = set()
        for site, style in SITE_STYLE.items():
            seen.add(re.search(r'style="--accent: (#[0-9a-f]{6})"', Client().get("/", HTTP_HOST=f"{site}.localhost").content.decode())[1])
        self.assertEqual(len(seen), len(SITE_STYLE))

    def test_a_missing_page_is_a_404(self):
        self.assertEqual(self.get().status_code, 404)

    def test_a_page_stored_for_another_site_is_a_404(self):
        self.make(site="systems")                       # the row says systems, the path is a languages path
        self.assertEqual(self.get().status_code, 404)

Run everything (Django 6.1.2):

  python manage.py test tests

Found 92 test(s).
System check identified no issues (0 silenced).
Creating test database for alias 'default'...
............................................................................................
----------------------------------------------------------------------
Ran 92 tests in 0.429s
OK
Destroying test database for alias 'default'...

What the new tests protect
--------------------------
- Every accent has at least 4.5 contrast on its surface AND on the page
  background (the WCAG AA level for normal text), and no two sites share one.
- The shared CSS never uses !important, and a component rule never has an id or
  more than two parts, so a fragment's own rule can always win.
- The stylesheets load tokens, then base, then components, all before the page
  body. A stored body is output as it is, while a title is escaped (a title of
  <b>x</b> shows as text).
- A page without its own h1 gets one made from its title; a page with one does
  not get a second.
- A missing page, and a page whose stored site disagrees with the address, are
  404s.

WHY THIS WORKS AS AN ANSWER
---------------------------
The view is six lines, and the tests pin down everything that could go wrong
around it: the site boundary, the escaping rules, the heading rule, the load
order and the readability of every colour.