From 95d7e89b42c61d1061830b61429de0b0884a6a34 Mon Sep 17 00:00:00 2001 From: Nathan Dahlberg Date: Tue, 16 Jun 2026 11:39:12 -0400 Subject: [PATCH 1/2] fix(api_views): remove throttles and add auth classes to webhook endpoints Fixes #7452 --- cl/users/api_views.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cl/users/api_views.py b/cl/users/api_views.py index 2e48866b4d..f686f6a3bf 100644 --- a/cl/users/api_views.py +++ b/cl/users/api_views.py @@ -10,6 +10,7 @@ from rest_framework.viewsets import ModelViewSet from cl.api.api_permissions import IsOwner +from cl.api.authentication import ReplicaRoutingSessionAuthentication from cl.api.models import ( Webhook, WebhookEvent, @@ -29,6 +30,8 @@ class WebhooksViewSet(ModelViewSet): permission_classes = [IsAuthenticated, IsOwner] renderer_classes = [JSONRenderer, TemplateHTMLRenderer] + authentication_classes = [ReplicaRoutingSessionAuthentication] + throttle_classes = [] def get_queryset(self): """ @@ -274,6 +277,8 @@ class WebhookEventViewSet(ModelViewSet): permission_classes = [IsAuthenticated, IsOwner] renderer_classes = [TemplateHTMLRenderer] filterset_class = WebhookEventViewFilter + authentication_classes = [ReplicaRoutingSessionAuthentication] + throttle_classes = [] def get_queryset(self): """ From 2573e937220c0594f8f1769b8f7107aec311dd39 Mon Sep 17 00:00:00 2001 From: Nathan Dahlberg Date: Tue, 16 Jun 2026 12:39:00 -0400 Subject: [PATCH 2/2] feat(tests): add session client helper for webhook tests --- cl/tests/utils.py | 8 ++++++++ cl/users/tests.py | 6 +++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/cl/tests/utils.py b/cl/tests/utils.py index f4156fbe11..d7bb4973c8 100644 --- a/cl/tests/utils.py +++ b/cl/tests/utils.py @@ -113,6 +113,14 @@ def make_client(user_pk: int) -> AsyncAPIClient: return client +def make_session_client(user_pk: int) -> AsyncAPIClient: + # Use for endpoints that only accept session authentication + user = User.objects.get(pk=user_pk) + client = AsyncAPIClient() + client.force_login(user) + return client + + def get_with_wait( wait: WebDriverWait, locator: tuple[str, str], diff --git a/cl/users/tests.py b/cl/users/tests.py index bf32b6592f..3575e86e69 100644 --- a/cl/users/tests.py +++ b/cl/users/tests.py @@ -85,7 +85,7 @@ TestCase, ) from cl.tests.utils import MockResponse as MockPostResponse -from cl.tests.utils import make_client +from cl.tests.utils import make_session_client from cl.users.admin import UserAdmin from cl.users.email_handlers import ( add_bcc_random, @@ -3553,8 +3553,8 @@ def setUpTestData(cls): def setUp(self) -> None: self.webhook_path = reverse("webhooks-list") - self.client = make_client(self.user_1.pk) - self.client_2 = make_client(self.user_2.pk) + self.client = make_session_client(self.user_1.pk) + self.client_2 = make_session_client(self.user_2.pk) def tearDown(cls): Webhook.objects.all().delete()