add canary route

admin/base/urls.py

@@ -13,6 +13,7 @@
         include([
             re_path(r'^$', views.home, name='home'),
             re_path(r'^unprotected_views/$', views.unprotected_views, name='unprotected_views'),
+            re_path(r'^middleware_check/$', views.admin_auth_middleware_check, name='middleware_check'),
             re_path(r'^admin/dj-celery-panel/', include('dj_celery_panel.urls')),
             re_path(r'^admin/', admin.site.urls),
             re_path(r'^provider_asset_files/', include('admin.provider_asset_files.urls', namespace='provider_asset_files')),

admin/base/views.py

@@ -1,5 +1,6 @@
 from django.core.exceptions import ObjectDoesNotExist
 from django.contrib.auth.decorators import user_passes_test
+from django.http import HttpResponse
 from django.shortcuts import render
 from django.views.generic import DetailView
 from django.views.defaults import page_not_found
@@ -19,6 +20,12 @@ def unprotected_views(request):
     return render(request, 'unprotected_views.html', context)
 
 
+def admin_auth_middleware_check(request):
+    # This view is used to check and see if the AdminLoginRequiredMiddleware is working correctly.
+    # It requires no permissions so that, if unauthenticated users can access it, the middleware is not working correctly.
+    return HttpResponse('AdminLoginRequiredMiddleware check: you are signed in as a staff user.')
+
+
 class GuidView(DetailView):
     def get(self, request, *args, **kwargs):
         try:

admin_tests/base/test_middleware.py

@@ -90,3 +90,10 @@ def test_non_staff_request_is_denied(self, client):
         client.force_login(user)
         response = client.get('/nodes/')
         assert response.status_code == 403
+
+    def test_anonymous_request_to_middleware_check_is_redirected_to_login(self, client):
+        # /middleware_check/ route has no permission checks of its own
+        # only AdminLoginRequiredMiddleware keeps it private
+        response = client.get('/middleware_check/')
+        assert response.status_code == 302
+        assert response.url == f'{LOGIN_REDIRECT_PREFIX}/middleware_check/'