일단 커밋. 오랫동안 커밋을 안해서 꼬였다.

리팩토리 중.

.venv/lib/python3.12/site-packages/django/middleware/cache.py

@@ -0,0 +1,223 @@
+"""
+Cache middleware. If enabled, each Django-powered page will be cached based on
+URL. The canonical way to enable cache middleware is to set
+``UpdateCacheMiddleware`` as your first piece of middleware, and
+``FetchFromCacheMiddleware`` as the last::
+
+    MIDDLEWARE = [
+        'django.middleware.cache.UpdateCacheMiddleware',
+        ...
+        'django.middleware.cache.FetchFromCacheMiddleware'
+    ]
+
+This is counterintuitive, but correct: ``UpdateCacheMiddleware`` needs to run
+last during the response phase, which processes middleware bottom-up;
+``FetchFromCacheMiddleware`` needs to run last during the request phase, which
+processes middleware top-down.
+
+The single-class ``CacheMiddleware`` can be used for some simple sites.
+However, if any other piece of middleware needs to affect the cache key, you'll
+need to use the two-part ``UpdateCacheMiddleware`` and
+``FetchFromCacheMiddleware``. This'll most often happen when you're using
+Django's ``LocaleMiddleware``.
+
+More details about how the caching works:
+
+* Only GET or HEAD-requests with status code 200 are cached.
+
+* The number of seconds each page is stored for is set by the "max-age" section
+  of the response's "Cache-Control" header, falling back to the
+  CACHE_MIDDLEWARE_SECONDS setting if the section was not found.
+
+* This middleware expects that a HEAD request is answered with the same response
+  headers exactly like the corresponding GET request.
+
+* When a hit occurs, a shallow copy of the original response object is returned
+  from process_request.
+
+* Pages will be cached based on the contents of the request headers listed in
+  the response's "Vary" header.
+
+* This middleware also sets ETag, Last-Modified, Expires and Cache-Control
+  headers on the response object.
+
+"""
+
+import time
+
+from django.conf import settings
+from django.core.cache import DEFAULT_CACHE_ALIAS, caches
+from django.utils.cache import (
+    get_cache_key,
+    get_max_age,
+    has_vary_header,
+    learn_cache_key,
+    patch_response_headers,
+)
+from django.utils.deprecation import MiddlewareMixin
+from django.utils.http import parse_http_date_safe
+
+
+class UpdateCacheMiddleware(MiddlewareMixin):
+    """
+    Response-phase cache middleware that updates the cache if the response is
+    cacheable.
+
+    Must be used as part of the two-part update/fetch cache middleware.
+    UpdateCacheMiddleware must be the first piece of middleware in MIDDLEWARE
+    so that it'll get called last during the response phase.
+    """
+
+    def __init__(self, get_response):
+        super().__init__(get_response)
+        self.cache_timeout = settings.CACHE_MIDDLEWARE_SECONDS
+        self.page_timeout = None
+        self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
+        self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS
+
+    @property
+    def cache(self):
+        return caches[self.cache_alias]
+
+    def _should_update_cache(self, request, response):
+        return hasattr(request, "_cache_update_cache") and request._cache_update_cache
+
+    def process_response(self, request, response):
+        """Set the cache, if needed."""
+        if not self._should_update_cache(request, response):
+            # We don't need to update the cache, just return.
+            return response
+
+        if response.streaming or response.status_code not in (200, 304):
+            return response
+
+        # Don't cache responses that set a user-specific (and maybe security
+        # sensitive) cookie in response to a cookie-less request.
+        if (
+            not request.COOKIES
+            and response.cookies
+            and has_vary_header(response, "Cookie")
+        ):
+            return response
+
+        # Don't cache a response with 'Cache-Control: private'
+        if "private" in response.get("Cache-Control", ()):
+            return response
+
+        # Page timeout takes precedence over the "max-age" and the default
+        # cache timeout.
+        timeout = self.page_timeout
+        if timeout is None:
+            # The timeout from the "max-age" section of the "Cache-Control"
+            # header takes precedence over the default cache timeout.
+            timeout = get_max_age(response)
+            if timeout is None:
+                timeout = self.cache_timeout
+            elif timeout == 0:
+                # max-age was set to 0, don't cache.
+                return response
+        patch_response_headers(response, timeout)
+        if timeout and response.status_code == 200:
+            cache_key = learn_cache_key(
+                request, response, timeout, self.key_prefix, cache=self.cache
+            )
+            if hasattr(response, "render") and callable(response.render):
+                response.add_post_render_callback(
+                    lambda r: self.cache.set(cache_key, r, timeout)
+                )
+            else:
+                self.cache.set(cache_key, response, timeout)
+        return response
+
+
+class FetchFromCacheMiddleware(MiddlewareMixin):
+    """
+    Request-phase cache middleware that fetches a page from the cache.
+
+    Must be used as part of the two-part update/fetch cache middleware.
+    FetchFromCacheMiddleware must be the last piece of middleware in MIDDLEWARE
+    so that it'll get called last during the request phase.
+    """
+
+    def __init__(self, get_response):
+        super().__init__(get_response)
+        self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
+        self.cache_alias = settings.CACHE_MIDDLEWARE_ALIAS
+
+    @property
+    def cache(self):
+        return caches[self.cache_alias]
+
+    def process_request(self, request):
+        """
+        Check whether the page is already cached and return the cached
+        version if available.
+        """
+        if request.method not in ("GET", "HEAD"):
+            request._cache_update_cache = False
+            return None  # Don't bother checking the cache.
+
+        # try and get the cached GET response
+        cache_key = get_cache_key(request, self.key_prefix, "GET", cache=self.cache)
+        if cache_key is None:
+            request._cache_update_cache = True
+            return None  # No cache information available, need to rebuild.
+        response = self.cache.get(cache_key)
+        # if it wasn't found and we are looking for a HEAD, try looking just for that
+        if response is None and request.method == "HEAD":
+            cache_key = get_cache_key(
+                request, self.key_prefix, "HEAD", cache=self.cache
+            )
+            response = self.cache.get(cache_key)
+
+        if response is None:
+            request._cache_update_cache = True
+            return None  # No cache information available, need to rebuild.
+
+        # Derive the age estimation of the cached response.
+        if (max_age_seconds := get_max_age(response)) is not None and (
+            expires_timestamp := parse_http_date_safe(response["Expires"])
+        ) is not None:
+            now_timestamp = int(time.time())
+            remaining_seconds = expires_timestamp - now_timestamp
+            # Use Age: 0 if local clock got turned back.
+            response["Age"] = max(0, max_age_seconds - remaining_seconds)
+
+        # hit, return cached response
+        request._cache_update_cache = False
+        return response
+
+
+class CacheMiddleware(UpdateCacheMiddleware, FetchFromCacheMiddleware):
+    """
+    Cache middleware that provides basic behavior for many simple sites.
+
+    Also used as the hook point for the cache decorator, which is generated
+    using the decorator-from-middleware utility.
+    """
+
+    def __init__(self, get_response, cache_timeout=None, page_timeout=None, **kwargs):
+        super().__init__(get_response)
+        # We need to differentiate between "provided, but using default value",
+        # and "not provided". If the value is provided using a default, then
+        # we fall back to system defaults. If it is not provided at all,
+        # we need to use middleware defaults.
+
+        try:
+            key_prefix = kwargs["key_prefix"]
+            if key_prefix is None:
+                key_prefix = ""
+            self.key_prefix = key_prefix
+        except KeyError:
+            pass
+        try:
+            cache_alias = kwargs["cache_alias"]
+            if cache_alias is None:
+                cache_alias = DEFAULT_CACHE_ALIAS
+            self.cache_alias = cache_alias
+        except KeyError:
+            pass
+
+        if cache_timeout is not None:
+            self.cache_timeout = cache_timeout
+        self.page_timeout = page_timeout

.venv/lib/python3.12/site-packages/django/middleware/clickjacking.py

@@ -0,0 +1,48 @@
+"""
+Clickjacking Protection Middleware.
+
+This module provides a middleware that implements protection against a
+malicious site loading resources from your site in a hidden frame.
+"""
+
+from django.conf import settings
+from django.utils.deprecation import MiddlewareMixin
+
+
+class XFrameOptionsMiddleware(MiddlewareMixin):
+    """
+    Set the X-Frame-Options HTTP header in HTTP responses.
+
+    Do not set the header if it's already set or if the response contains
+    a xframe_options_exempt value set to True.
+
+    By default, set the X-Frame-Options header to 'DENY', meaning the response
+    cannot be displayed in a frame, regardless of the site attempting to do so.
+    To enable the response to be loaded on a frame within the same site, set
+    X_FRAME_OPTIONS in your project's Django settings to 'SAMEORIGIN'.
+    """
+
+    def process_response(self, request, response):
+        # Don't set it if it's already in the response
+        if response.get("X-Frame-Options") is not None:
+            return response
+
+        # Don't set it if they used @xframe_options_exempt
+        if getattr(response, "xframe_options_exempt", False):
+            return response
+
+        response.headers["X-Frame-Options"] = self.get_xframe_options_value(
+            request,
+            response,
+        )
+        return response
+
+    def get_xframe_options_value(self, request, response):
+        """
+        Get the value to set for the X_FRAME_OPTIONS header. Use the value from
+        the X_FRAME_OPTIONS setting, or 'DENY' if not set.
+
+        This method can be overridden if needed, allowing it to vary based on
+        the request or response.
+        """
+        return getattr(settings, "X_FRAME_OPTIONS", "DENY").upper()

.venv/lib/python3.12/site-packages/django/middleware/common.py

@@ -0,0 +1,178 @@
+import re
+from urllib.parse import urlsplit
+
+from django.conf import settings
+from django.core.exceptions import PermissionDenied
+from django.core.mail import mail_managers
+from django.http import HttpResponsePermanentRedirect
+from django.urls import is_valid_path
+from django.utils.deprecation import MiddlewareMixin
+from django.utils.http import escape_leading_slashes
+
+
+class CommonMiddleware(MiddlewareMixin):
+    """
+    "Common" middleware for taking care of some basic operations:
+
+        - Forbid access to User-Agents in settings.DISALLOWED_USER_AGENTS
+
+        - URL rewriting: Based on the APPEND_SLASH and PREPEND_WWW settings,
+          append missing slashes and/or prepends missing "www."s.
+
+            - If APPEND_SLASH is set and the initial URL doesn't end with a
+              slash, and it is not found in urlpatterns, form a new URL by
+              appending a slash at the end. If this new URL is found in
+              urlpatterns, return an HTTP redirect to this new URL; otherwise
+              process the initial URL as usual.
+
+          This behavior can be customized by subclassing CommonMiddleware and
+          overriding the response_redirect_class attribute.
+    """
+
+    response_redirect_class = HttpResponsePermanentRedirect
+
+    def process_request(self, request):
+        """
+        Check for denied User-Agents and rewrite the URL based on
+        settings.APPEND_SLASH and settings.PREPEND_WWW
+        """
+
+        # Check for denied User-Agents
+        user_agent = request.META.get("HTTP_USER_AGENT")
+        if user_agent is not None:
+            for user_agent_regex in settings.DISALLOWED_USER_AGENTS:
+                if user_agent_regex.search(user_agent):
+                    raise PermissionDenied("Forbidden user agent")
+
+        # Check for a redirect based on settings.PREPEND_WWW
+        host = request.get_host()
+
+        if settings.PREPEND_WWW and host and not host.startswith("www."):
+            # Check if we also need to append a slash so we can do it all
+            # with a single redirect. (This check may be somewhat expensive,
+            # so we only do it if we already know we're sending a redirect,
+            # or in process_response if we get a 404.)
+            if self.should_redirect_with_slash(request):
+                path = self.get_full_path_with_slash(request)
+            else:
+                path = request.get_full_path()
+
+            return self.response_redirect_class(f"{request.scheme}://www.{host}{path}")
+
+    def should_redirect_with_slash(self, request):
+        """
+        Return True if settings.APPEND_SLASH is True and appending a slash to
+        the request path turns an invalid path into a valid one.
+        """
+        if settings.APPEND_SLASH and not request.path_info.endswith("/"):
+            urlconf = getattr(request, "urlconf", None)
+            if not is_valid_path(request.path_info, urlconf):
+                match = is_valid_path("%s/" % request.path_info, urlconf)
+                if match:
+                    view = match.func
+                    return getattr(view, "should_append_slash", True)
+        return False
+
+    def get_full_path_with_slash(self, request):
+        """
+        Return the full path of the request with a trailing slash appended.
+
+        Raise a RuntimeError if settings.DEBUG is True and request.method is
+        DELETE, POST, PUT, or PATCH.
+        """
+        new_path = request.get_full_path(force_append_slash=True)
+        # Prevent construction of scheme relative urls.
+        new_path = escape_leading_slashes(new_path)
+        if settings.DEBUG and request.method in ("DELETE", "POST", "PUT", "PATCH"):
+            raise RuntimeError(
+                "You called this URL via %(method)s, but the URL doesn't end "
+                "in a slash and you have APPEND_SLASH set. Django can't "
+                "redirect to the slash URL while maintaining %(method)s data. "
+                "Change your form to point to %(url)s (note the trailing "
+                "slash), or set APPEND_SLASH=False in your Django settings."
+                % {
+                    "method": request.method,
+                    "url": request.get_host() + new_path,
+                }
+            )
+        return new_path
+
+    def process_response(self, request, response):
+        """
+        When the status code of the response is 404, it may redirect to a path
+        with an appended slash if should_redirect_with_slash() returns True.
+        """
+        # If the given URL is "Not Found", then check if we should redirect to
+        # a path with a slash appended.
+        if response.status_code == 404 and self.should_redirect_with_slash(request):
+            return self.response_redirect_class(self.get_full_path_with_slash(request))
+
+        # Add the Content-Length header to non-streaming responses if not
+        # already set.
+        if not response.streaming and not response.has_header("Content-Length"):
+            response.headers["Content-Length"] = str(len(response.content))
+
+        return response
+
+
+class BrokenLinkEmailsMiddleware(MiddlewareMixin):
+    def process_response(self, request, response):
+        """Send broken link emails for relevant 404 NOT FOUND responses."""
+        if response.status_code == 404 and not settings.DEBUG:
+            domain = request.get_host()
+            path = request.get_full_path()
+            referer = request.META.get("HTTP_REFERER", "")
+
+            if not self.is_ignorable_request(request, path, domain, referer):
+                ua = request.META.get("HTTP_USER_AGENT", "<none>")
+                ip = request.META.get("REMOTE_ADDR", "<none>")
+                mail_managers(
+                    "Broken %slink on %s"
+                    % (
+                        (
+                            "INTERNAL "
+                            if self.is_internal_request(domain, referer)
+                            else ""
+                        ),
+                        domain,
+                    ),
+                    "Referrer: %s\nRequested URL: %s\nUser agent: %s\n"
+                    "IP address: %s\n" % (referer, path, ua, ip),
+                    fail_silently=True,
+                )
+        return response
+
+    def is_internal_request(self, domain, referer):
+        """
+        Return True if the referring URL is the same domain as the current
+        request.
+        """
+        # Different subdomains are treated as different domains.
+        return bool(re.match("^https?://%s/" % re.escape(domain), referer))
+
+    def is_ignorable_request(self, request, uri, domain, referer):
+        """
+        Return True if the given request *shouldn't* notify the site managers
+        according to project settings or in situations outlined by the inline
+        comments.
+        """
+        # The referer is empty.
+        if not referer:
+            return True
+
+        # APPEND_SLASH is enabled and the referer is equal to the current URL
+        # without a trailing slash indicating an internal redirect.
+        if settings.APPEND_SLASH and uri.endswith("/") and referer == uri[:-1]:
+            return True
+
+        # A '?' in referer is identified as a search engine source.
+        if not self.is_internal_request(domain, referer) and "?" in referer:
+            return True
+
+        # The referer is equal to the current URL, ignoring the scheme (assumed
+        # to be a poorly implemented bot).
+        parsed_referer = urlsplit(referer)
+        if parsed_referer.netloc in ["", domain] and parsed_referer.path == uri:
+            return True
+
+        return any(pattern.search(uri) for pattern in settings.IGNORABLE_404_URLS)

.venv/lib/python3.12/site-packages/django/middleware/csrf.py

@@ -0,0 +1,483 @@
+"""
+Cross Site Request Forgery Middleware.
+
+This module provides a middleware that implements protection
+against request forgeries from other sites.
+"""
+
+import logging
+import string
+from collections import defaultdict
+from urllib.parse import urlsplit
+
+from django.conf import settings
+from django.core.exceptions import DisallowedHost, ImproperlyConfigured
+from django.http import HttpHeaders, UnreadablePostError
+from django.urls import get_callable
+from django.utils.cache import patch_vary_headers
+from django.utils.crypto import constant_time_compare, get_random_string
+from django.utils.deprecation import MiddlewareMixin
+from django.utils.functional import cached_property
+from django.utils.http import is_same_domain
+from django.utils.log import log_response
+from django.utils.regex_helper import _lazy_re_compile
+
+logger = logging.getLogger("django.security.csrf")
+# This matches if any character is not in CSRF_ALLOWED_CHARS.
+invalid_token_chars_re = _lazy_re_compile("[^a-zA-Z0-9]")
+
+REASON_BAD_ORIGIN = "Origin checking failed - %s does not match any trusted origins."
+REASON_NO_REFERER = "Referer checking failed - no Referer."
+REASON_BAD_REFERER = "Referer checking failed - %s does not match any trusted origins."
+REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
+REASON_CSRF_TOKEN_MISSING = "CSRF token missing."
+REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed."
+REASON_INSECURE_REFERER = (
+    "Referer checking failed - Referer is insecure while host is secure."
+)
+# The reason strings below are for passing to InvalidTokenFormat. They are
+# phrases without a subject because they can be in reference to either the CSRF
+# cookie or non-cookie token.
+REASON_INCORRECT_LENGTH = "has incorrect length"
+REASON_INVALID_CHARACTERS = "has invalid characters"
+
+CSRF_SECRET_LENGTH = 32
+CSRF_TOKEN_LENGTH = 2 * CSRF_SECRET_LENGTH
+CSRF_ALLOWED_CHARS = string.ascii_letters + string.digits
+CSRF_SESSION_KEY = "_csrftoken"
+
+
+def _get_failure_view():
+    """Return the view to be used for CSRF rejections."""
+    return get_callable(settings.CSRF_FAILURE_VIEW)
+
+
+def _get_new_csrf_string():
+    return get_random_string(CSRF_SECRET_LENGTH, allowed_chars=CSRF_ALLOWED_CHARS)
+
+
+def _mask_cipher_secret(secret):
+    """
+    Given a secret (assumed to be a string of CSRF_ALLOWED_CHARS), generate a
+    token by adding a mask and applying it to the secret.
+    """
+    mask = _get_new_csrf_string()
+    chars = CSRF_ALLOWED_CHARS
+    pairs = zip((chars.index(x) for x in secret), (chars.index(x) for x in mask))
+    cipher = "".join(chars[(x + y) % len(chars)] for x, y in pairs)
+    return mask + cipher
+
+
+def _unmask_cipher_token(token):
+    """
+    Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length
+    CSRF_TOKEN_LENGTH, and that its first half is a mask), use it to decrypt
+    the second half to produce the original secret.
+    """
+    mask = token[:CSRF_SECRET_LENGTH]
+    token = token[CSRF_SECRET_LENGTH:]
+    chars = CSRF_ALLOWED_CHARS
+    pairs = zip((chars.index(x) for x in token), (chars.index(x) for x in mask))
+    return "".join(chars[x - y] for x, y in pairs)  # Note negative values are ok
+
+
+def _add_new_csrf_cookie(request):
+    """Generate a new random CSRF_COOKIE value, and add it to request.META."""
+    csrf_secret = _get_new_csrf_string()
+    request.META.update(
+        {
+            "CSRF_COOKIE": csrf_secret,
+            "CSRF_COOKIE_NEEDS_UPDATE": True,
+        }
+    )
+    return csrf_secret
+
+
+def get_token(request):
+    """
+    Return the CSRF token required for a POST form. The token is an
+    alphanumeric value. A new token is created if one is not already set.
+
+    A side effect of calling this function is to make the csrf_protect
+    decorator and the CsrfViewMiddleware add a CSRF cookie and a 'Vary: Cookie'
+    header to the outgoing response.  For this reason, you may need to use this
+    function lazily, as is done by the csrf context processor.
+    """
+    if "CSRF_COOKIE" in request.META:
+        csrf_secret = request.META["CSRF_COOKIE"]
+        # Since the cookie is being used, flag to send the cookie in
+        # process_response() (even if the client already has it) in order to
+        # renew the expiry timer.
+        request.META["CSRF_COOKIE_NEEDS_UPDATE"] = True
+    else:
+        csrf_secret = _add_new_csrf_cookie(request)
+    return _mask_cipher_secret(csrf_secret)
+
+
+def rotate_token(request):
+    """
+    Change the CSRF token in use for a request - should be done on login
+    for security purposes.
+    """
+    _add_new_csrf_cookie(request)
+
+
+class InvalidTokenFormat(Exception):
+    def __init__(self, reason):
+        self.reason = reason
+
+
+def _check_token_format(token):
+    """
+    Raise an InvalidTokenFormat error if the token has an invalid length or
+    characters that aren't allowed. The token argument can be a CSRF cookie
+    secret or non-cookie CSRF token, and either masked or unmasked.
+    """
+    if len(token) not in (CSRF_TOKEN_LENGTH, CSRF_SECRET_LENGTH):
+        raise InvalidTokenFormat(REASON_INCORRECT_LENGTH)
+    # Make sure all characters are in CSRF_ALLOWED_CHARS.
+    if invalid_token_chars_re.search(token):
+        raise InvalidTokenFormat(REASON_INVALID_CHARACTERS)
+
+
+def _does_token_match(request_csrf_token, csrf_secret):
+    """
+    Return whether the given CSRF token matches the given CSRF secret, after
+    unmasking the token if necessary.
+
+    This function assumes that the request_csrf_token argument has been
+    validated to have the correct length (CSRF_SECRET_LENGTH or
+    CSRF_TOKEN_LENGTH characters) and allowed characters, and that if it has
+    length CSRF_TOKEN_LENGTH, it is a masked secret.
+    """
+    # Only unmask tokens that are exactly CSRF_TOKEN_LENGTH characters long.
+    if len(request_csrf_token) == CSRF_TOKEN_LENGTH:
+        request_csrf_token = _unmask_cipher_token(request_csrf_token)
+    assert len(request_csrf_token) == CSRF_SECRET_LENGTH
+    return constant_time_compare(request_csrf_token, csrf_secret)
+
+
+class RejectRequest(Exception):
+    def __init__(self, reason):
+        self.reason = reason
+
+
+class CsrfViewMiddleware(MiddlewareMixin):
+    """
+    Require a present and correct csrfmiddlewaretoken for POST requests that
+    have a CSRF cookie, and set an outgoing CSRF cookie.
+
+    This middleware should be used in conjunction with the {% csrf_token %}
+    template tag.
+    """
+
+    @cached_property
+    def csrf_trusted_origins_hosts(self):
+        return [
+            urlsplit(origin).netloc.lstrip("*")
+            for origin in settings.CSRF_TRUSTED_ORIGINS
+        ]
+
+    @cached_property
+    def allowed_origins_exact(self):
+        return {origin for origin in settings.CSRF_TRUSTED_ORIGINS if "*" not in origin}
+
+    @cached_property
+    def allowed_origin_subdomains(self):
+        """
+        A mapping of allowed schemes to list of allowed netlocs, where all
+        subdomains of the netloc are allowed.
+        """
+        allowed_origin_subdomains = defaultdict(list)
+        for parsed in (
+            urlsplit(origin)
+            for origin in settings.CSRF_TRUSTED_ORIGINS
+            if "*" in origin
+        ):
+            allowed_origin_subdomains[parsed.scheme].append(parsed.netloc.lstrip("*"))
+        return allowed_origin_subdomains
+
+    # The _accept and _reject methods currently only exist for the sake of the
+    # requires_csrf_token decorator.
+    def _accept(self, request):
+        # Avoid checking the request twice by adding a custom attribute to
+        # request.  This will be relevant when both decorator and middleware
+        # are used.
+        request.csrf_processing_done = True
+        return None
+
+    def _reject(self, request, reason):
+        response = _get_failure_view()(request, reason=reason)
+        log_response(
+            "Forbidden (%s): %s",
+            reason,
+            request.path,
+            response=response,
+            request=request,
+            logger=logger,
+        )
+        return response
+
+    def _get_secret(self, request):
+        """
+        Return the CSRF secret originally associated with the request, or None
+        if it didn't have one.
+
+        If the CSRF_USE_SESSIONS setting is false, raises InvalidTokenFormat if
+        the request's secret has invalid characters or an invalid length.
+        """
+        if settings.CSRF_USE_SESSIONS:
+            try:
+                csrf_secret = request.session.get(CSRF_SESSION_KEY)
+            except AttributeError:
+                raise ImproperlyConfigured(
+                    "CSRF_USE_SESSIONS is enabled, but request.session is not "
+                    "set. SessionMiddleware must appear before CsrfViewMiddleware "
+                    "in MIDDLEWARE."
+                )
+        else:
+            try:
+                csrf_secret = request.COOKIES[settings.CSRF_COOKIE_NAME]
+            except KeyError:
+                csrf_secret = None
+            else:
+                # This can raise InvalidTokenFormat.
+                _check_token_format(csrf_secret)
+        if csrf_secret is None:
+            return None
+        # Django versions before 4.0 masked the secret before storing.
+        if len(csrf_secret) == CSRF_TOKEN_LENGTH:
+            csrf_secret = _unmask_cipher_token(csrf_secret)
+        return csrf_secret
+
+    def _set_csrf_cookie(self, request, response):
+        if settings.CSRF_USE_SESSIONS:
+            if request.session.get(CSRF_SESSION_KEY) != request.META["CSRF_COOKIE"]:
+                request.session[CSRF_SESSION_KEY] = request.META["CSRF_COOKIE"]
+        else:
+            response.set_cookie(
+                settings.CSRF_COOKIE_NAME,
+                request.META["CSRF_COOKIE"],
+                max_age=settings.CSRF_COOKIE_AGE,
+                domain=settings.CSRF_COOKIE_DOMAIN,
+                path=settings.CSRF_COOKIE_PATH,
+                secure=settings.CSRF_COOKIE_SECURE,
+                httponly=settings.CSRF_COOKIE_HTTPONLY,
+                samesite=settings.CSRF_COOKIE_SAMESITE,
+            )
+            # Set the Vary header since content varies with the CSRF cookie.
+            patch_vary_headers(response, ("Cookie",))
+
+    def _origin_verified(self, request):
+        request_origin = request.META["HTTP_ORIGIN"]
+        try:
+            good_host = request.get_host()
+        except DisallowedHost:
+            pass
+        else:
+            good_origin = "%s://%s" % (
+                "https" if request.is_secure() else "http",
+                good_host,
+            )
+            if request_origin == good_origin:
+                return True
+        if request_origin in self.allowed_origins_exact:
+            return True
+        try:
+            parsed_origin = urlsplit(request_origin)
+        except ValueError:
+            return False
+        request_scheme = parsed_origin.scheme
+        request_netloc = parsed_origin.netloc
+        return any(
+            is_same_domain(request_netloc, host)
+            for host in self.allowed_origin_subdomains.get(request_scheme, ())
+        )
+
+    def _check_referer(self, request):
+        referer = request.META.get("HTTP_REFERER")
+        if referer is None:
+            raise RejectRequest(REASON_NO_REFERER)
+
+        try:
+            referer = urlsplit(referer)
+        except ValueError:
+            raise RejectRequest(REASON_MALFORMED_REFERER)
+
+        # Make sure we have a valid URL for Referer.
+        if "" in (referer.scheme, referer.netloc):
+            raise RejectRequest(REASON_MALFORMED_REFERER)
+
+        # Ensure that our Referer is also secure.
+        if referer.scheme != "https":
+            raise RejectRequest(REASON_INSECURE_REFERER)
+
+        if any(
+            is_same_domain(referer.netloc, host)
+            for host in self.csrf_trusted_origins_hosts
+        ):
+            return
+        # Allow matching the configured cookie domain.
+        good_referer = (
+            settings.SESSION_COOKIE_DOMAIN
+            if settings.CSRF_USE_SESSIONS
+            else settings.CSRF_COOKIE_DOMAIN
+        )
+        if good_referer is None:
+            # If no cookie domain is configured, allow matching the current
+            # host:port exactly if it's permitted by ALLOWED_HOSTS.
+            try:
+                # request.get_host() includes the port.
+                good_referer = request.get_host()
+            except DisallowedHost:
+                raise RejectRequest(REASON_BAD_REFERER % referer.geturl())
+        else:
+            server_port = request.get_port()
+            if server_port not in ("443", "80"):
+                good_referer = "%s:%s" % (good_referer, server_port)
+
+        if not is_same_domain(referer.netloc, good_referer):
+            raise RejectRequest(REASON_BAD_REFERER % referer.geturl())
+
+    def _bad_token_message(self, reason, token_source):
+        if token_source != "POST":
+            # Assume it is a settings.CSRF_HEADER_NAME value.
+            header_name = HttpHeaders.parse_header_name(token_source)
+            token_source = f"the {header_name!r} HTTP header"
+        return f"CSRF token from {token_source} {reason}."
+
+    def _check_token(self, request):
+        # Access csrf_secret via self._get_secret() as rotate_token() may have
+        # been called by an authentication middleware during the
+        # process_request() phase.
+        try:
+            csrf_secret = self._get_secret(request)
+        except InvalidTokenFormat as exc:
+            raise RejectRequest(f"CSRF cookie {exc.reason}.")
+
+        if csrf_secret is None:
+            # No CSRF cookie. For POST requests, we insist on a CSRF cookie,
+            # and in this way we can avoid all CSRF attacks, including login
+            # CSRF.
+            raise RejectRequest(REASON_NO_CSRF_COOKIE)
+
+        # Check non-cookie token for match.
+        request_csrf_token = ""
+        if request.method == "POST":
+            try:
+                request_csrf_token = request.POST.get("csrfmiddlewaretoken", "")
+            except UnreadablePostError:
+                # Handle a broken connection before we've completed reading the
+                # POST data. process_view shouldn't raise any exceptions, so
+                # we'll ignore and serve the user a 403 (assuming they're still
+                # listening, which they probably aren't because of the error).
+                pass
+
+        if request_csrf_token == "":
+            # Fall back to X-CSRFToken, to make things easier for AJAX, and
+            # possible for PUT/DELETE.
+            try:
+                # This can have length CSRF_SECRET_LENGTH or CSRF_TOKEN_LENGTH,
+                # depending on whether the client obtained the token from
+                # the DOM or the cookie (and if the cookie, whether the cookie
+                # was masked or unmasked).
+                request_csrf_token = request.META[settings.CSRF_HEADER_NAME]
+            except KeyError:
+                raise RejectRequest(REASON_CSRF_TOKEN_MISSING)
+            token_source = settings.CSRF_HEADER_NAME
+        else:
+            token_source = "POST"
+
+        try:
+            _check_token_format(request_csrf_token)
+        except InvalidTokenFormat as exc:
+            reason = self._bad_token_message(exc.reason, token_source)
+            raise RejectRequest(reason)
+
+        if not _does_token_match(request_csrf_token, csrf_secret):
+            reason = self._bad_token_message("incorrect", token_source)
+            raise RejectRequest(reason)
+
+    def process_request(self, request):
+        try:
+            csrf_secret = self._get_secret(request)
+        except InvalidTokenFormat:
+            _add_new_csrf_cookie(request)
+        else:
+            if csrf_secret is not None:
+                # Use the same secret next time. If the secret was originally
+                # masked, this also causes it to be replaced with the unmasked
+                # form, but only in cases where the secret is already getting
+                # saved anyways.
+                request.META["CSRF_COOKIE"] = csrf_secret
+
+    def process_view(self, request, callback, callback_args, callback_kwargs):
+        if getattr(request, "csrf_processing_done", False):
+            return None
+
+        # Wait until request.META["CSRF_COOKIE"] has been manipulated before
+        # bailing out, so that get_token still works
+        if getattr(callback, "csrf_exempt", False):
+            return None
+
+        # Assume that anything not defined as 'safe' by RFC 9110 needs protection
+        if request.method in ("GET", "HEAD", "OPTIONS", "TRACE"):
+            return self._accept(request)
+
+        if getattr(request, "_dont_enforce_csrf_checks", False):
+            # Mechanism to turn off CSRF checks for test suite. It comes after
+            # the creation of CSRF cookies, so that everything else continues
+            # to work exactly the same (e.g. cookies are sent, etc.), but
+            # before any branches that call the _reject method.
+            return self._accept(request)
+
+        # Reject the request if the Origin header doesn't match an allowed
+        # value.
+        if "HTTP_ORIGIN" in request.META:
+            if not self._origin_verified(request):
+                return self._reject(
+                    request, REASON_BAD_ORIGIN % request.META["HTTP_ORIGIN"]
+                )
+        elif request.is_secure():
+            # If the Origin header wasn't provided, reject HTTPS requests if
+            # the Referer header doesn't match an allowed value.
+            #
+            # Suppose user visits http://example.com/
+            # An active network attacker (man-in-the-middle, MITM) sends a
+            # POST form that targets https://example.com/detonate-bomb/ and
+            # submits it via JavaScript.
+            #
+            # The attacker will need to provide a CSRF cookie and token, but
+            # that's no problem for a MITM and the session-independent secret
+            # we're using. So the MITM can circumvent the CSRF protection. This
+            # is true for any HTTP connection, but anyone using HTTPS expects
+            # better! For this reason, for https://example.com/ we need
+            # additional protection that treats http://example.com/ as
+            # completely untrusted. Under HTTPS, Barth et al. found that the
+            # Referer header is missing for same-domain requests in only about
+            # 0.2% of cases or less, so we can use strict Referer checking.
+            try:
+                self._check_referer(request)
+            except RejectRequest as exc:
+                return self._reject(request, exc.reason)
+
+        try:
+            self._check_token(request)
+        except RejectRequest as exc:
+            return self._reject(request, exc.reason)
+
+        return self._accept(request)
+
+    def process_response(self, request, response):
+        if request.META.get("CSRF_COOKIE_NEEDS_UPDATE"):
+            self._set_csrf_cookie(request, response)
+            # Unset the flag to prevent _set_csrf_cookie() from being
+            # unnecessarily called again in process_response() by other
+            # instances of CsrfViewMiddleware. This can happen e.g. when both a
+            # decorator and middleware are used. However,
+            # CSRF_COOKIE_NEEDS_UPDATE is still respected in subsequent calls
+            # e.g. in case rotate_token() is called in process_response() later
+            # by custom middleware but before those subsequent calls.
+            request.META["CSRF_COOKIE_NEEDS_UPDATE"] = False
+
+        return response

.venv/lib/python3.12/site-packages/django/middleware/gzip.py

@@ -0,0 +1,74 @@
+from django.utils.cache import patch_vary_headers
+from django.utils.deprecation import MiddlewareMixin
+from django.utils.regex_helper import _lazy_re_compile
+from django.utils.text import compress_sequence, compress_string
+
+re_accepts_gzip = _lazy_re_compile(r"\bgzip\b")
+
+
+class GZipMiddleware(MiddlewareMixin):
+    """
+    Compress content if the browser allows gzip compression.
+    Set the Vary header accordingly, so that caches will base their storage
+    on the Accept-Encoding header.
+    """
+
+    max_random_bytes = 100
+
+    def process_response(self, request, response):
+        # It's not worth attempting to compress really short responses.
+        if not response.streaming and len(response.content) < 200:
+            return response
+
+        # Avoid gzipping if we've already got a content-encoding.
+        if response.has_header("Content-Encoding"):
+            return response
+
+        patch_vary_headers(response, ("Accept-Encoding",))
+
+        ae = request.META.get("HTTP_ACCEPT_ENCODING", "")
+        if not re_accepts_gzip.search(ae):
+            return response
+
+        if response.streaming:
+            if response.is_async:
+                # pull to lexical scope to capture fixed reference in case
+                # streaming_content is set again later.
+                orignal_iterator = response.streaming_content
+
+                async def gzip_wrapper():
+                    async for chunk in orignal_iterator:
+                        yield compress_string(
+                            chunk,
+                            max_random_bytes=self.max_random_bytes,
+                        )
+
+                response.streaming_content = gzip_wrapper()
+            else:
+                response.streaming_content = compress_sequence(
+                    response.streaming_content,
+                    max_random_bytes=self.max_random_bytes,
+                )
+            # Delete the `Content-Length` header for streaming content, because
+            # we won't know the compressed size until we stream it.
+            del response.headers["Content-Length"]
+        else:
+            # Return the compressed content only if it's actually shorter.
+            compressed_content = compress_string(
+                response.content,
+                max_random_bytes=self.max_random_bytes,
+            )
+            if len(compressed_content) >= len(response.content):
+                return response
+            response.content = compressed_content
+            response.headers["Content-Length"] = str(len(response.content))
+
+        # If there is a strong ETag, make it weak to fulfill the requirements
+        # of RFC 9110 Section 8.8.1 while also allowing conditional request
+        # matches on ETags.
+        etag = response.get("ETag")
+        if etag and etag.startswith('"'):
+            response.headers["ETag"] = "W/" + etag
+        response.headers["Content-Encoding"] = "gzip"
+
+        return response

.venv/lib/python3.12/site-packages/django/middleware/http.py

@@ -0,0 +1,40 @@
+from django.utils.cache import cc_delim_re, get_conditional_response, set_response_etag
+from django.utils.deprecation import MiddlewareMixin
+from django.utils.http import parse_http_date_safe
+
+
+class ConditionalGetMiddleware(MiddlewareMixin):
+    """
+    Handle conditional GET operations. If the response has an ETag or
+    Last-Modified header and the request has If-None-Match or If-Modified-Since,
+    replace the response with HttpNotModified. Add an ETag header if needed.
+    """
+
+    def process_response(self, request, response):
+        # It's too late to prevent an unsafe request with a 412 response, and
+        # for a HEAD request, the response body is always empty so computing
+        # an accurate ETag isn't possible.
+        if request.method != "GET":
+            return response
+
+        if self.needs_etag(response) and not response.has_header("ETag"):
+            set_response_etag(response)
+
+        etag = response.get("ETag")
+        last_modified = response.get("Last-Modified")
+        last_modified = last_modified and parse_http_date_safe(last_modified)
+
+        if etag or last_modified:
+            return get_conditional_response(
+                request,
+                etag=etag,
+                last_modified=last_modified,
+                response=response,
+            )
+
+        return response
+
+    def needs_etag(self, response):
+        """Return True if an ETag header should be added to response."""
+        cache_control_headers = cc_delim_re.split(response.get("Cache-Control", ""))
+        return all(header.lower() != "no-store" for header in cache_control_headers)

.venv/lib/python3.12/site-packages/django/middleware/locale.py

@@ -0,0 +1,80 @@
+from django.conf import settings
+from django.conf.urls.i18n import is_language_prefix_patterns_used
+from django.http import HttpResponseRedirect
+from django.urls import get_script_prefix, is_valid_path
+from django.utils import translation
+from django.utils.cache import patch_vary_headers
+from django.utils.deprecation import MiddlewareMixin
+
+
+class LocaleMiddleware(MiddlewareMixin):
+    """
+    Parse a request and decide what translation object to install in the
+    current thread context. This allows pages to be dynamically translated to
+    the language the user desires (if the language is available).
+    """
+
+    response_redirect_class = HttpResponseRedirect
+
+    def process_request(self, request):
+        urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF)
+        (
+            i18n_patterns_used,
+            prefixed_default_language,
+        ) = is_language_prefix_patterns_used(urlconf)
+        language = translation.get_language_from_request(
+            request, check_path=i18n_patterns_used
+        )
+        language_from_path = translation.get_language_from_path(request.path_info)
+        if (
+            not language_from_path
+            and i18n_patterns_used
+            and not prefixed_default_language
+        ):
+            language = settings.LANGUAGE_CODE
+        translation.activate(language)
+        request.LANGUAGE_CODE = translation.get_language()
+
+    def process_response(self, request, response):
+        language = translation.get_language()
+        language_from_path = translation.get_language_from_path(request.path_info)
+        urlconf = getattr(request, "urlconf", settings.ROOT_URLCONF)
+        (
+            i18n_patterns_used,
+            prefixed_default_language,
+        ) = is_language_prefix_patterns_used(urlconf)
+
+        if (
+            response.status_code == 404
+            and not language_from_path
+            and i18n_patterns_used
+            and prefixed_default_language
+        ):
+            # Maybe the language code is missing in the URL? Try adding the
+            # language prefix and redirecting to that URL.
+            language_path = "/%s%s" % (language, request.path_info)
+            path_valid = is_valid_path(language_path, urlconf)
+            path_needs_slash = not path_valid and (
+                settings.APPEND_SLASH
+                and not language_path.endswith("/")
+                and is_valid_path("%s/" % language_path, urlconf)
+            )
+
+            if path_valid or path_needs_slash:
+                script_prefix = get_script_prefix()
+                # Insert language after the script prefix and before the
+                # rest of the URL
+                language_url = request.get_full_path(
+                    force_append_slash=path_needs_slash
+                ).replace(script_prefix, "%s%s/" % (script_prefix, language), 1)
+                # Redirect to the language-specific URL as detected by
+                # get_language_from_request(). HTTP caches may cache this
+                # redirect, so add the Vary header.
+                redirect = self.response_redirect_class(language_url)
+                patch_vary_headers(redirect, ("Accept-Language", "Cookie"))
+                return redirect
+
+        if not (i18n_patterns_used and language_from_path):
+            patch_vary_headers(response, ("Accept-Language",))
+        response.headers.setdefault("Content-Language", language)
+        return response

.venv/lib/python3.12/site-packages/django/middleware/security.py

@@ -0,0 +1,66 @@
+import re
+
+from django.conf import settings
+from django.http import HttpResponsePermanentRedirect
+from django.utils.deprecation import MiddlewareMixin
+
+
+class SecurityMiddleware(MiddlewareMixin):
+    def __init__(self, get_response):
+        super().__init__(get_response)
+        self.sts_seconds = settings.SECURE_HSTS_SECONDS
+        self.sts_include_subdomains = settings.SECURE_HSTS_INCLUDE_SUBDOMAINS
+        self.sts_preload = settings.SECURE_HSTS_PRELOAD
+        self.content_type_nosniff = settings.SECURE_CONTENT_TYPE_NOSNIFF
+        self.redirect = settings.SECURE_SSL_REDIRECT
+        self.redirect_host = settings.SECURE_SSL_HOST
+        self.redirect_exempt = [re.compile(r) for r in settings.SECURE_REDIRECT_EXEMPT]
+        self.referrer_policy = settings.SECURE_REFERRER_POLICY
+        self.cross_origin_opener_policy = settings.SECURE_CROSS_ORIGIN_OPENER_POLICY
+
+    def process_request(self, request):
+        path = request.path.lstrip("/")
+        if (
+            self.redirect
+            and not request.is_secure()
+            and not any(pattern.search(path) for pattern in self.redirect_exempt)
+        ):
+            host = self.redirect_host or request.get_host()
+            return HttpResponsePermanentRedirect(
+                "https://%s%s" % (host, request.get_full_path())
+            )
+
+    def process_response(self, request, response):
+        if (
+            self.sts_seconds
+            and request.is_secure()
+            and "Strict-Transport-Security" not in response
+        ):
+            sts_header = "max-age=%s" % self.sts_seconds
+            if self.sts_include_subdomains:
+                sts_header += "; includeSubDomains"
+            if self.sts_preload:
+                sts_header += "; preload"
+            response.headers["Strict-Transport-Security"] = sts_header
+
+        if self.content_type_nosniff:
+            response.headers.setdefault("X-Content-Type-Options", "nosniff")
+
+        if self.referrer_policy:
+            # Support a comma-separated string or iterable of values to allow
+            # fallback.
+            response.headers.setdefault(
+                "Referrer-Policy",
+                ",".join(
+                    [v.strip() for v in self.referrer_policy.split(",")]
+                    if isinstance(self.referrer_policy, str)
+                    else self.referrer_policy
+                ),
+            )
+
+        if self.cross_origin_opener_policy:
+            response.setdefault(
+                "Cross-Origin-Opener-Policy",
+                self.cross_origin_opener_policy,
+            )
+        return response