Prevent read-only form state from leaking between requests

[gpg4]

Problem

ConstanceForm reuses field constructor option dictionaries from the module-level FIELDS mapping. When a request user does not have constance.change_config, the form adds disabled=True directly to one of those shared dictionaries.

In a long-running process, that state survives after the read-only form has been built. Later forms of the same field type remain disabled even when their request user has change permission.

Fix

Copy the field options before applying request-specific read-only state. This keeps disabled scoped to the current form construction and leaves the shared FIELDS definitions unchanged.

A regression test builds a read-only form followed by an editable form and verifies that only the first form is disabled.

Testing

• django-admin test: 154 passed, 1 skipped
• focused pytest tests/test_form.py: 2 passed
• django-admin makemigrations --check --dry-run: no changes detected
• Ruff 0.5.0 lint: passed
• Ruff 0.5.0 format check: passed

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.13%. Comparing base (7c2bac5) to head (fe0661c).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #672      +/-   ##
==========================================
+ Coverage   90.72%   91.13%   +0.40%     
==========================================
  Files          21       21              
  Lines        1014     1015       +1     
  Branches      169      169              
==========================================
+ Hits          920      925       +5     
+ Misses         63       61       -2     
+ Partials       31       29       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Prevents read-only form permissions from mutating shared field options across requests.

Changes:

• Copies field options before adding disabled=True.
• Adds a regression test covering read-only followed by editable form creation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
constance/forms.py	Isolates per-form field options.
tests/test_form.py	Verifies disabled state does not leak.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[camilonova]

LGTM