hardening the codebase

Author: Kimmo Virtanen

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Security-sensitive server-side paths.
+# Replace @zache-fi with your GitHub username/team if needed.
+/timepoll/settings.py @zache-fi

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    env:
+      TIMEPOLL_SECRET_KEY: ci-timepoll-secret-key
+      TIMEPOLL_DEBUG: "0"
+      TIMEPOLL_ALLOWED_HOSTS: 127.0.0.1,localhost,testserver
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install runtime dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Install CI tooling
+        run: |
+          pip install ruff mypy bandit pip-audit
+
+      - name: Ruff
+        run: ruff check .
+
+      - name: MyPy
+        run: mypy polls timepoll manage.py --ignore-missing-imports --exclude "polls/migrations/.*"
+
+      - name: Bandit
+        run: bandit -r polls timepoll manage.py -x polls/migrations
+
+      - name: pip-audit
+        run: pip-audit --requirement requirements.txt
+
+      - name: Django tests
+        run: python manage.py test

README.md

@@ -36,10 +36,12 @@ source venv/bin/activate
 pip install -r requirements.txt
 ```
 
-3. Load local development environment variables:
+3. Set required environment variables:
 
 ```bash
-source ./local-dev-env.sh
+export TIMEPOLL_SECRET_KEY='dev-only-secret-change-me'
+export TIMEPOLL_DEBUG='1'
+export TIMEPOLL_ALLOWED_HOSTS='127.0.0.1,localhost'
 ```
 
 4. Run migrations:
@@ -61,12 +63,31 @@ python manage.py runserver
 ## Tests
 
 ```bash
-source ./local-dev-env.sh
 python manage.py test
 ```
 
+## CI merge gates
+
+This repository includes GitHub Actions checks in `.github/workflows/ci.yml`:
+
+- `ruff check .`
+- `mypy polls timepoll manage.py --ignore-missing-imports --exclude "polls/migrations/.*"`
+- `bandit -r polls timepoll manage.py -x polls/migrations`
+- `pip-audit --requirement requirements.txt`
+- `python manage.py test`
+
+To enforce these checks as merge gates in GitHub:
+
+1. Enable branch protection on your default branch.
+2. Enable `Require a pull request before merging`.
+3. Enable `Require review from Code Owners`.
+4. Enable `Require status checks to pass before merging` and select `CI / quality`.
+
 ## Notes
 
 - Vue app code is in Django static files.
 - Vue runtime is loaded from Wikimedia CDN: `https://tools-static.wmflabs.org/cdnjs/...`.
-- `local-dev-env.sh` creates/loads local env vars needed by settings (`TIMEPOLL_SECRET_KEY`, `TIMEPOLL_DEBUG`, `TIMEPOLL_ALLOWED_HOSTS`).
+- Required environment variables:
+  - `TIMEPOLL_SECRET_KEY`: non-empty secret string
+  - `TIMEPOLL_DEBUG`: boolean-like string (`1/0`, `true/false`, `yes/no`, `on/off`)
+  - `TIMEPOLL_ALLOWED_HOSTS`: comma-separated hostnames (for example `127.0.0.1,localhost`)

polls/static/polls/js/app.js

@@ -1908,17 +1908,13 @@
           }
           const yesCount = this.optionCount(option, "yes");
           const noCount = this.optionCount(option, "no");
-          const maybeCount = this.optionCount(option, "maybe");
 
           if (yesCount > noCount) {
             return "vote-yes";
           }
           if (yesCount < noCount) {
             return "vote-no";
           }
-          if ((yesCount === noCount && yesCount > 0) || (yesCount === 0 && noCount === 0 && maybeCount > 0)) {
-            return "vote-maybe";
-          }
           return "vote-none";
         },
         isSelectedVoteValue(option, status) {
@@ -2129,6 +2125,10 @@
           if (!this.canVoteInPoll || this.isVoteSaving(optionId)) {
             return;
           }
+          if (!this.session.authenticated) {
+            this.openAuthDialog();
+            return;
+          }
           this.bulkMenu = null;
           this.editingVoteOptionId = this.editingVoteOptionId === optionId ? null : optionId;
         },
@@ -2574,7 +2574,6 @@
         async openProfile() {
           if (!this.session.authenticated) {
             this.openAuthDialog();
-            this.setError(this.t("authNeeded"));
             return;
           }
           this.setActiveSection("profile");
@@ -2600,7 +2599,6 @@
         async deleteOwnData() {
           if (!this.session.authenticated) {
             this.openAuthDialog();
-            this.setError(this.t("authNeeded"));
             return;
           }
           if (!window.confirm(this.t("profileDeleteConfirm"))) {
@@ -2700,7 +2698,6 @@
           }
           this.pendingAction = action;
           this.openAuthDialog();
-          this.setError(this.t("authNeeded"));
           return Promise.resolve();
         },
         async fetchSession() {

polls/views.py

@@ -633,8 +633,8 @@ def polls_collection(request: HttpRequest) -> JsonResponse:
             .prefetch_related("options__votes")
             .all()
         )
-        payload = [serialize_poll_summary(poll, current_identity) for poll in polls]
-        return JsonResponse({"polls": payload})
+        polls_payload = [serialize_poll_summary(poll, current_identity) for poll in polls]
+        return JsonResponse({"polls": polls_payload})
 
     if current_identity is None:
         return JsonResponse(
@@ -643,8 +643,8 @@ def polls_collection(request: HttpRequest) -> JsonResponse:
         )
 
     try:
-        payload = parse_json_body(request)
-        schedule = parse_poll_payload(payload)
+        request_payload = parse_json_body(request)
+        schedule = parse_poll_payload(request_payload)
         parsed_options = generate_poll_options(schedule)
         tz = ZoneInfo(schedule["timezone_name"])
         window_starts_at = datetime.combine(schedule["start_date"], time.min, tzinfo=tz)