1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
# SPDX-FileCopyrightText: 2026 pacmanics
#
# SPDX-License-Identifier: 0BSD
from __future__ import annotations
import os
from django.contrib.auth import get_user_model, login
from django.http import HttpResponseRedirect
TRUE_VALUES = {"1", "true", "yes", "on"}
LOOPBACKS = {"127.0.0.1", "::1", "localhost"}
BLOCKED_PATH_PREFIXES = (
"/accounts/login/",
"/accounts/logout/",
"/accounts/password/change/",
"/accounts/password/reset/",
)
class LocalTrustAutoLoginMiddleware:
def __init__(self, get_response):
self.get_response = get_response
def __call__(self, request):
enabled = os.getenv("LOCAL_TRUST_MODE", "false").strip().lower() in TRUE_VALUES
if enabled:
remote = request.META.get("REMOTE_ADDR", "").strip().lower()
host = request.get_host().split(":", 1)[0].strip().lower()
if remote in LOOPBACKS or host in LOOPBACKS:
if not getattr(request, "user", None).is_authenticated:
username = os.getenv("LOCAL_TRUST_USERNAME") or os.getenv("DJANGO_SUPERUSER_USERNAME", "admin")
User = get_user_model()
try:
user = User.objects.get(username=username, is_active=True)
except User.DoesNotExist:
user = None
if user is not None:
login(request, user, backend="django.contrib.auth.backends.ModelBackend")
if request.path.startswith(BLOCKED_PATH_PREFIXES):
return HttpResponseRedirect("/home/")
return self.get_response(request)
|