AAP-47499 Use get_settings to get CSRF_TRUSTED_ORIGINS in ansible_base SessionAuthentication

ansible_base/authentication/session.py

@@ -1,10 +1,23 @@
 from rest_framework import authentication
 
+from ansible_base.lib.utils.settings import replace_trusted_origins
+
 
 class SessionAuthentication(authentication.SessionAuthentication):
     """
     This class allows us to fail with a 401 if the user is not authenticated.
+
+    Allows CSRF_TRUSTED_ORIGINS to be read dynamically using get_setting.
+    Reverting the value of CSRF_TRUSTED_ORIGINS afterwards.
     """
 
     def authenticate_header(self, request):
         return "Session"
+
+    @replace_trusted_origins
+    def enforce_csrf(self, request):
+        """
+        Enforce CSRF validation for session based authentication using
+        AnsibleBaseCsrfViewMiddleware instead of Django's CsrfViewMiddleware.
+        """
+        return super().enforce_csrf(request)

ansible_base/lib/utils/settings.py

@@ -49,6 +49,24 @@ def get_function_from_setting(setting_name: str) -> Any:
         return None
 
 
+def replace_trusted_origins(func):
+    """Decorator for patching the CSRF_TRUSTED_ORIGINS django setting using the potentially different value in get_setting for the duration of a
+    function call
+    """
+
+    def override_setting(*args, **kwargs):
+        csrf_trusted_origins = settings.CSRF_TRUSTED_ORIGINS
+        try:
+            # Temporarily patch the setting
+            settings.CSRF_TRUSTED_ORIGINS = get_setting("CSRF_TRUSTED_ORIGINS", csrf_trusted_origins)
+            return func(*args, **kwargs)
+        finally:
+            # Revert setting after this is done
+            settings.CSRF_TRUSTED_ORIGINS = csrf_trusted_origins
+
+    return override_setting
+
+
 def get_from_import(module_name, attr):
     "Thin wrapper around importlib.import_module, mostly exists so that we can safely mock this in tests"
     module = importlib.import_module(module_name, package=attr)

test_app/tests/authentication/test_middleware.py

@@ -1,7 +1,9 @@
 from django.conf import settings
 from social_core.exceptions import AuthException
 
-from ansible_base.authentication.middleware import SocialExceptionHandlerMiddleware
+from ansible_base.authentication.middleware import (
+    SocialExceptionHandlerMiddleware,
+)
 
 
 def test_social_exception_handler_mw():