fix: /graphql/ GraphiQL interface by changing CSP rules

fix error when opening /graphql/ with GraphiQL enabled:
> Refused to execute inline script because it violates the following
> Content Security Policy directive: "script-src 'self' 'unsafe-eval'
> cdn.jsdelivr.net blob:". Either the 'unsafe-inline' keyword, a hash
> ('sha256-HHh/PGb5Jp8ck+QB/v7zeWzuHf3vYssM0CBPvYgEHR4='), or a nonce
> ('nonce-...') is required to enable inline execution.

and being unable to load "data:" inline base64 encoded fonts as well

refs KK-1360

Author: karisal-anders

kukkuu/settings.py

@@ -292,6 +292,7 @@
     CSP.SELF,
     "fonts.googleapis.com",
     "fonts.gstatic.com",
+    "data:",  # /graphql/ endpoint uses "data:font/woff2"
 ]
 
 # CSP_IMG_SRC includes sources for images fetched by `SpectacularRedocView`

kukkuu/urls.py

@@ -1,3 +1,4 @@
+from csp.decorators import csp_update
 from django.conf import settings
 from django.conf.urls.static import static
 from django.http import JsonResponse
@@ -11,6 +12,7 @@
 from common.utils import get_api_version
 from custom_health_checks.views import HealthCheckJSONView
 from kukkuu import __version__
+from kukkuu.consts import CSP
 from kukkuu.views import SentryGraphQLView
 from reports.api import ChildViewSet, EventGroupViewSet, EventViewSet, VenueViewSet
 
@@ -24,17 +26,24 @@
 router.register(r"event-group", EventGroupViewSet)
 router.register(r"venue", VenueViewSet)
 
+IS_GRAPHIQL_ENABLED = settings.ENABLE_GRAPHIQL or settings.DEBUG
+
+
+# Add unsafe-inline to enable GraphiQL interface at /graphql/
+@csp_update(
+    SCRIPT_SRC=settings.CSP_SCRIPT_SRC
+    + ([CSP.UNSAFE_INLINE] if IS_GRAPHIQL_ENABLED else [])
+)
+@csrf_exempt
+def graphql_view(request, *args, **kwargs):
+    return SentryGraphQLView.as_view(graphiql=IS_GRAPHIQL_ENABLED)(
+        request, *args, **kwargs
+    )
+
 
 urlpatterns = [
     path("admin/", admin.site.urls),
-    re_path(
-        r"^graphql/?$",
-        csrf_exempt(
-            SentryGraphQLView.as_view(
-                graphiql=settings.ENABLE_GRAPHIQL or settings.DEBUG
-            )
-        ),
-    ),
+    re_path(r"^graphql/?$", graphql_view),
     path("reports/", include(router.urls)),
     path("reports/schema/", SpectacularAPIView.as_view(), name="schema"),
     path(