From 28821944851bd680530dd83625e23312c2a47c7f Mon Sep 17 00:00:00 2001
From: Yuhuai Liu <yuhuai@cos.io>
Date: Thu, 29 Oct 2026 11:45:34 -0400
Subject: [PATCH] add canary route

---
 admin/base/urls.py                  | 1 +
 admin/base/views.py                 | 7 +++++++
 admin_tests/base/test_middleware.py | 7 +++++++
 3 files changed, 15 insertions(+)

diff --git a/admin/base/urls.py b/admin/base/urls.py
index 002c41efec3..b4531add6bd 100644
--- a/admin/base/urls.py
+++ b/admin/base/urls.py
@@ -13,6 +13,7 @@
         include([
             re_path(r'^$', views.home, name='home'),
             re_path(r'^unprotected_views/$', views.unprotected_views, name='unprotected_views'),
+            re_path(r'^middleware_check/$', views.admin_auth_middleware_check, name='middleware_check'),
             re_path(r'^admin/dj-celery-panel/', include('dj_celery_panel.urls')),
             re_path(r'^admin/', admin.site.urls),
             re_path(r'^provider_asset_files/', include('admin.provider_asset_files.urls', namespace='provider_asset_files')),
diff --git a/admin/base/views.py b/admin/base/views.py
index 08dea5c418d..dffd296e064 100644
--- a/admin/base/views.py
+++ b/admin/base/views.py
@@ -1,5 +1,6 @@
 from django.core.exceptions import ObjectDoesNotExist
 from django.contrib.auth.decorators import user_passes_test
+from django.http import HttpResponse
 from django.shortcuts import render
 from django.views.generic import DetailView
 from django.views.defaults import page_not_found
@@ -19,6 +20,12 @@ def unprotected_views(request):
     return render(request, 'unprotected_views.html', context)
 
 
+def admin_auth_middleware_check(request):
+    # This view is used to check and see if the AdminLoginRequiredMiddleware is working correctly.
+    # It requires no permissions so that, if unauthenticated users can access it, the middleware is not working correctly.
+    return HttpResponse('AdminLoginRequiredMiddleware check: you are signed in as a staff user.')
+
+
 class GuidView(DetailView):
     def get(self, request, *args, **kwargs):
         try:
diff --git a/admin_tests/base/test_middleware.py b/admin_tests/base/test_middleware.py
index 65a19922fe8..ebf9d6d0a2c 100644
--- a/admin_tests/base/test_middleware.py
+++ b/admin_tests/base/test_middleware.py
@@ -90,3 +90,10 @@ def test_non_staff_request_is_denied(self, client):
         client.force_login(user)
         response = client.get('/nodes/')
         assert response.status_code == 403
+
+    def test_anonymous_request_to_middleware_check_is_redirected_to_login(self, client):
+        # /middleware_check/ route has no permission checks of its own
+        # only AdminLoginRequiredMiddleware keeps it private
+        response = client.get('/middleware_check/')
+        assert response.status_code == 302
+        assert response.url == f'{LOGIN_REDIRECT_PREFIX}/middleware_check/'