Test CSP nonce support and require django-js-asset 4

The import-map rework now rides on js_asset.Media, so require
django-js-asset>=4 and finalize the changelog accordingly.

Add tests verifying the request nonce reaches the merged import map,
the module scripts and the stylesheets through with_nonce(),
render(nonce=) and render(attrs={"nonce": ...}) -- the last being the
entry point Django 6.2's {% csp_nonce_attr %} tag uses. The tests are
gated to Django 6.0+; the rendered output is identical on older
versions but we only verify it on newer ones.

Refs #34

Author: matthiask

CHANGELOG.rst

@@ -4,14 +4,14 @@ Change log
 Next version
 ~~~~~~~~~~~~
 
-- The editor's import map is now carried by the widget and field media and
-  merged through ``js_asset.Media`` instead of the global ``importmap`` object
-  that ``django-js-asset`` has removed. Rendering ``{{ form.media }}`` now emits
-  the ``<script type="importmap">`` automatically -- in the admin **and** in
-  your own frontend templates -- so you can drop the
+- **Requires django-js-asset 4.0 or newer.** The editor's import map is now
+  carried by the widget and field media and merged through ``js_asset.Media``
+  instead of the global ``importmap`` object that django-js-asset 4.0 has
+  removed. Rendering ``{{ form.media }}`` now emits the
+  ``<script type="importmap">`` automatically -- in the admin **and** in your
+  own frontend templates -- so you can drop the
   ``js_asset.context_processors.importmap`` context processor and the
-  ``{{ importmap }}`` tag from your templates. Requires the upcoming
-  ``django-js-asset`` release that ships ``js_asset.Media``.
+  ``{{ importmap }}`` tag from your templates.
 - Rewrote the ``Figure`` extension to handle both figure-wrapped images and
   standalone bare images. The caption field has been removed from the edit
   dialog (it stripped all formatting from the caption text). Instead, a

pyproject.toml

@@ -36,7 +36,7 @@ dynamic = [
 ]
 dependencies = [
   "django>=4.2",
-  "django-js-asset>=3.1.2", # FIXME bump once the js_asset.Media release is cut
+  "django-js-asset>=4",
 ]
 optional-dependencies.cabinet = [
   "django-cabinet>=0.19",

tests/testapp/test_prose_editor.py

@@ -1,3 +1,6 @@
+from unittest import skipUnless
+
+import django
 from django import test
 from django.contrib.auth.models import User
 from django.test import Client
@@ -85,3 +88,40 @@ def test_utilities(self):
 <script src="/static/django_prose_editor/editor.js" type="module"></script>
 <script src="/static/django_prose_editor/default.js" type="module"></script>"""
         )
+
+
+@skipUnless(
+    django.VERSION >= (6, 0),
+    "CSP nonce support is only verified on newer Django versions",
+)
+class CSPNonceTest(test.SimpleTestCase):
+    """
+    The CSP nonce plumbing lives in ``js_asset.Media`` (which
+    ``prose_editor_media()`` returns); these tests make sure a nonce reaches
+    every tag we render -- the import map, the module scripts and the
+    stylesheets.
+    """
+
+    def test_with_nonce_applies_to_all_tags(self):
+        html = prose_editor_media().with_nonce("r4nd0m").render()
+        assert '<script type="importmap" nonce="r4nd0m">' in html
+        assert (
+            '<script src="/static/django_prose_editor/editor.js"'
+            ' nonce="r4nd0m" type="module"></script>' in html
+        )
+        assert (
+            '<link href="/static/django_prose_editor/material-icons.css"'
+            ' media="all" nonce="r4nd0m" rel="stylesheet">' in html
+        )
+
+    def test_render_nonce_keyword(self):
+        html = prose_editor_media().render(nonce="abc")
+        assert 'nonce="abc"' in html
+
+    def test_render_attrs_nonce(self):
+        # This is exactly what Django 6.2's ``{% csp_nonce_attr %}`` tag calls.
+        html = prose_editor_media().render(attrs={"nonce": "xyz"})
+        assert 'nonce="xyz"' in html
+
+    def test_without_nonce_no_attribute(self):
+        assert "nonce=" not in prose_editor_media().render()