disable django admin panel by default

Author: dogboat

dojo/settings/settings.dist.py

@@ -51,7 +51,7 @@
     DD_DJANGO_METRICS_ENABLED=(bool, False),
     DD_LOGIN_REDIRECT_URL=(str, "/"),
     DD_LOGIN_URL=(str, "/login"),
-    DD_DJANGO_ADMIN_ENABLED=(bool, True),
+    DD_DJANGO_ADMIN_ENABLED=(bool, False),
     DD_SESSION_COOKIE_HTTPONLY=(bool, True),
     DD_CSRF_COOKIE_HTTPONLY=(bool, True),
     DD_SECURE_SSL_REDIRECT=(bool, False),

dojo/settings/template-env

@@ -1,8 +1,9 @@
 # Django Debug, don't enable on production!
 DD_DEBUG=False
 
-# Enables Django Admin
-DD_DJANGO_ADMIN_ENABLED=True
+# Enables the Django admin interface at /admin/. Off by default; uncomment
+# this line to expose it. Access is restricted to superusers regardless.
+# DD_DJANGO_ADMIN_ENABLED=True
 
 # A secret key for a particular Django installation.
 DD_SECRET_KEY=#DD_SECRET_KEY#

unittests/test_adminsite.py

@@ -1,7 +1,8 @@
 import django.apps
 from django.contrib import admin
 from django.contrib.auth import get_user_model
-from django.urls import reverse
+from django.contrib.auth.models import AnonymousUser
+from django.http import HttpRequest
 
 from .dojo_test_case import DojoTestCase
 
@@ -30,37 +31,48 @@ class AdminAccessGate(DojoTestCase):
     is_staff is a near-superuser bypass under the legacy OS auth model, so
     /admin/ must require is_superuser. Django's default UserAdmin change
     form would otherwise let any is_staff user with auth.change_user tick
-    is_superuser on themselves.
+    is_superuser on themselves. Tested at the gate-function level so the
+    assertions hold regardless of whether DD_DJANGO_ADMIN_ENABLED mounts
+    the admin URLConf in the current environment.
     """
 
-    def test_staff_non_superuser_blocked_from_admin(self):
+    @staticmethod
+    def _request_for(user):
+        req = HttpRequest()
+        req.user = user
+        return req
+
+    def test_staff_non_superuser_denied(self):
         User = get_user_model()
         password = "testTEST1234!@#$"
         staff = User.objects.create_user(
             username="staff-no-root", password=password, is_staff=True,
         )
-        self.client.force_login(staff)
+        self.assertFalse(admin.site.has_permission(self._request_for(staff)))
 
-        for url in (
-            reverse("admin:index"),
-            reverse("admin:auth_user_changelist"),
-            reverse("admin:auth_user_change", args=[staff.id]),
-        ):
-            with self.subTest(url=url):
-                resp = self.client.get(url)
-                self.assertEqual(resp.status_code, 302, url)
-                self.assertIn("/admin/login/", resp["Location"], url)
+    def test_non_staff_non_superuser_denied(self):
+        User = get_user_model()
+        password = "testTEST1234!@#$"
+        plain = User.objects.create_user(username="plain-user", password=password)
+        self.assertFalse(admin.site.has_permission(self._request_for(plain)))
 
-    def test_superuser_can_reach_admin(self):
+    def test_anonymous_denied(self):
+        self.assertFalse(admin.site.has_permission(self._request_for(AnonymousUser())))
+
+    def test_inactive_superuser_denied(self):
         User = get_user_model()
         password = "testTEST1234!@#$"
         root = User.objects.create_superuser(
-            username="root-test", email="r@example.com", password=password,
+            username="inactive-root", email="i@example.com", password=password,
         )
-        self.client.force_login(root)
+        root.is_active = False
+        root.save(update_fields=["is_active"])
+        self.assertFalse(admin.site.has_permission(self._request_for(root)))
 
-        self.assertEqual(self.client.get(reverse("admin:index")).status_code, 200)
-        self.assertEqual(
-            self.client.get(reverse("admin:auth_user_changelist")).status_code,
-            200,
+    def test_active_superuser_allowed(self):
+        User = get_user_model()
+        password = "testTEST1234!@#$"
+        root = User.objects.create_superuser(
+            username="root-test", email="r@example.com", password=password,
         )
+        self.assertTrue(admin.site.has_permission(self._request_for(root)))