Initial commit

site/public/middleware.py

@@ -0,0 +1,48 @@
+from django.conf import settings
+from django.shortcuts import redirect
+
+
+class UnderConstructionMiddleware:
+    """
+    When SITE_UNDER_CONSTRUCTION is true, redirect public traffic to the holding page.
+
+    Exempt: health, static/media, admin, auth login/logout, SMS webhook, and the
+    under-construction page itself (so notify-me POSTs work).
+    """
+
+    EXEMPT_PREFIXES = (
+        "/healthz",
+        "/static/",
+        "/media/",
+        "/admin/",
+        "/accounts/login",
+        "/accounts/logout",
+        "/under-construction",
+        "/portal/messaging/webhooks/",
+        "/unsubscribe/",
+        "/api/address-suggest",
+        "/robots.txt",
+        "/sitemap.xml",
+    )
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if settings.SITE_UNDER_CONSTRUCTION and not self._is_exempt(request):
+            return redirect("public:under_construction")
+        return self.get_response(request)
+
+    def _is_exempt(self, request) -> bool:
+        path = request.path
+        if any(path.startswith(prefix) for prefix in self.EXEMPT_PREFIXES):
+            return True
+        user = getattr(request, "user", None)
+        if (
+            user is not None
+            and getattr(user, "is_authenticated", False)
+            and getattr(user, "is_staff", False)
+            and path.startswith("/portal/")
+        ):
+            return True
+        return False