✨(web-presentation) add a security.txt URL

Author: AntoineAugusti

src/web/config/settings/base.py

@@ -187,6 +187,8 @@
 # Default primary key field type
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
+SECURITY_CONTACT_EMAIL = "ops.csplab@beta.gouv.fr"
+
 # Maximum CV size in cv upload flow
 CV_MAX_SIZE_MB = 5
 

src/web/config/urls.py

@@ -7,9 +7,11 @@
 from presentation.candidate import urls as candidate_urls
 from presentation.ingestion import urls as ingestion_urls
 from presentation.pages import urls as pages_urls
+from presentation.pages.views import security_txt
 from presentation.users import urls as users_urls
 
 urlpatterns: list[URLPattern | URLResolver] = [
+    path(".well-known/security.txt", security_txt),
     path("", include(pages_urls)),
     path("api/", include(api_urls)),
     path("admin/", admin.site.urls),

src/web/presentation/pages/urls.py

@@ -8,6 +8,7 @@
     LegalNoticesView,
     PrivacyView,
     TermsView,
+    security_txt,
 )
 
 app_name = "pages"

src/web/presentation/pages/views.py

@@ -1,3 +1,5 @@
+from django.conf import settings
+from django.http import HttpResponse
 from django.views.generic import TemplateView
 
 
@@ -19,3 +21,8 @@ class PrivacyView(TemplateView):
 
 class LegalNoticesView(TemplateView):
     template_name = "pages/legal_notices.html"
+
+
+def security_txt(request):
+    content = f"Contact: mailto:{settings.SECURITY_CONTACT_EMAIL}\nPreferred-Languages: fr, en\n"
+    return HttpResponse(content, content_type="text/plain; charset=utf-8")

src/web/tests/candidate/presentation/views/test_static_pages_view.py

@@ -5,6 +5,22 @@
 from pytest_django.asserts import assertTemplateUsed
 
 
+class TestSecurityTxtView:
+    def test_returns_ok(self, client, db):
+        response = client.get("/.well-known/security.txt")
+        assert response.status_code == HTTPStatus.OK
+
+    def test_content_type(self, client, db):
+        response = client.get("/.well-known/security.txt")
+        assert "text/plain" in response["Content-Type"]
+
+    def test_content(self, client, db):
+        response = client.get("/.well-known/security.txt")
+        content = response.content.decode()
+        assert "Contact: mailto:ops.csplab@beta.gouv.fr" in content
+        assert "Preferred-Languages: fr, en" in content
+
+
 @pytest.mark.parametrize(
     ("url_name", "template_name"),
     [