demo mode

tests/unit/test_settings_security.py

@@ -45,6 +45,7 @@ def test_validate_production_security_skips_when_debug_mode_is_enabled():
         ("change-me", ["example.org"], ["https://example.org"], True, True, True),
         ("too-short", ["example.org"], ["https://example.org"], True, True, True),
         ("a" * 64, [], ["https://example.org"], True, True, True),
+        ("a" * 64, ["*"], ["https://example.org"], True, True, True),
         ("a" * 64, ["example.org"], [], True, True, True),
         ("a" * 64, ["example.org"], ["http://example.org"], True, True, True),
         ("a" * 64, ["example.org"], ["https://example.org"], False, True, True),
@@ -70,3 +71,34 @@ def test_validate_production_security_requires_secure_settings_for_prod(
             csrf_cookie_secure=csrf_cookie_secure,
             secure_ssl_redirect=secure_ssl_redirect,
         )
+
+
+def test_validate_production_security_rejects_writable_public_demo():
+    with pytest.raises(ImproperlyConfigured):
+        _validate_production_security(
+            debug=False,
+            secret_key="a" * 64,
+            allowed_hosts=["vacatureradar.itworx.tech"],
+            csrf_trusted_origins=["https://vacatureradar.itworx.tech"],
+            session_cookie_secure=True,
+            csrf_cookie_secure=True,
+            secure_ssl_redirect=True,
+            public_base_url="https://vacatureradar.itworx.tech",
+            demo_mode_enabled=True,
+            demo_read_only=False,
+        )
+
+
+def test_validate_production_security_accepts_read_only_https_demo():
+    _validate_production_security(
+        debug=False,
+        secret_key="a" * 64,
+        allowed_hosts=["vacatureradar.itworx.tech"],
+        csrf_trusted_origins=["https://vacatureradar.itworx.tech"],
+        session_cookie_secure=True,
+        csrf_cookie_secure=True,
+        secure_ssl_redirect=True,
+        public_base_url="https://vacatureradar.itworx.tech",
+        demo_mode_enabled=True,
+        demo_read_only=True,
+    )