Add unit tests ensuring /preview_email/ requires authentication.

Locks in login_required behavior for issue #16 so unauthenticated access stays redirected.

.gitea/workflows/deploy.yml

@@ -1,6 +1,6 @@
 name: Deploy Company Site
 
-# Deploy pipeline runs only on pushes to master (never on pull requests).
+# Runs after Unit Tests completes on master. Direct pushes only (not PRs).
 on:
   workflow_run:
     workflows: [Unit Tests]
@@ -8,34 +8,14 @@ on:
     branches: [master]
 
 jobs:
-  test:
-    runs-on: self-hosted
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        run: |
-          curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-
-      - name: Install dependencies
-        run: uv sync --frozen
-
-      - name: Run unit tests
-        env:
-          DJANGO_ENV: dev
-          DJANGO_SECRET_KEY: test-secret-key
-        run: |
-          cd company_site
-          uv run python manage.py test
-
   docker:
+    if: gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push'
     runs-on: self-hosted
-    needs: test
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ gitea.event.workflow_run.head_sha }}
 
       - name: Build Docker image
         run: docker compose build
@@ -53,7 +33,7 @@ jobs:
   deploy:
     if: gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push'
     runs-on: self-hosted
-    needs: [test, docker]
+    needs: docker
     env:
       SERVER_INFRA_ROOT: /home/westfarn/Documents/repos/server-infra
     steps:

company_site/public/tests.py

@@ -1,12 +1,40 @@
 from unittest.mock import patch
 
+from django.contrib.auth.models import User
 from django.test import Client, TestCase, override_settings
 from django.urls import reverse
 
-from .models import Contact
+from .models import Contact, EmailMessage
 from .seo import SERVICE_URL_NAMES, get_service_entries
 
 
+class PreviewEmailAuthTests(TestCase):
+    def setUp(self):
+        self.client = Client()
+        self.user = User.objects.create_user(username="previewer", password="pass")
+        self.email = EmailMessage.objects.create(
+            subject="Preview subject",
+            body="Preview body content",
+            recipient="recipient@example.com",
+        )
+        self.url = reverse("preview_email", kwargs={"pk": self.email.pk})
+
+    def test_unauthenticated_user_is_redirected_to_login(self):
+        response = self.client.get(self.url)
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("/accounts/login/", response.url)
+
+    def test_authenticated_user_can_preview_email(self):
+        self.client.login(username="previewer", password="pass")
+
+        response = self.client.get(self.url)
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Preview subject")
+        self.assertContains(response, "Preview body content")
+
+
 @override_settings(
     DEBUG=True,
     EMAIL_BACKEND="django.core.mail.backends.locmem.EmailBackend",

docker-compose.yml

@@ -18,11 +18,14 @@ services:
     build: .
     ports:
       - "8000:8000"
-    env_file:
-      - .env
+    # No required env_file — CI has no .env. Defaults below; for local secrets:
+    #   docker compose --env-file .env up
     environment:
-      DJANGO_ENV: dev
-      DATABASE_URL: postgres://company_site:company_site@db:5432/company_site
+      DJANGO_ENV: ${DJANGO_ENV:-dev}
+      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-dev-only-change-me}
+      DJANGO_DEBUG: ${DJANGO_DEBUG:-true}
+      DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0}
+      DATABASE_URL: ${DATABASE_URL:-postgres://company_site:company_site@db:5432/company_site}
     depends_on:
       db:
         condition: service_healthy