fix(settings): resolve static asset URLs through STATIC_URL - #45
Merged
Conversation
Signed-off-by: tdruez <tdruez@aboutcode.org>
hleroy
pushed a commit
to hleroy/django-altcha
that referenced
this pull request
Aug 6, 2026
Upgrade the bundled JS widget from ALTCHA v2.3.0 to v3.2.1 and move the server side from the v1 Proof-of-Work API to the v2 one, raising the altcha requirement to >=2.1.0,<3.0.0. PR aboutcode-org#48 took the altcha v2 package while staying on the *_v1 compatibility functions; this replaces those with the real v2 API, so the widget and the library speak the same KDF-based Proof-of-Work. Challenges and payloads are not compatible across versions. `get_altcha_challenge()` now takes `algorithm` and `cost` in place of `max_number`, driven by the new ALTCHA_ALGORITHM and ALTCHA_COST settings, and `verify_solution()` returns a result object rather than a tuple. Replay protection keys the cache on the challenge signature, as the v3 payload no longer carries a challenge string. Widget side, the v3 options replace the v2 ones. `challengeurl` and `challengejson` are mapped to the unified `challenge` option with a DeprecationWarning; options the widget does not accept as an HTML attribute are collected into the JSON-encoded `configuration` attribute. Add an ALTCHA_STRICT_CSP setting that switches the widget template and the new form Media to the modular /dist_external build: the stylesheet is served as a separate file and the Proof-of-Work workers are loaded from the static files instead of a blob: URL, removing the need for `style-src 'unsafe-inline'` and `worker-src blob:`. The modular build registers no algorithm on its own, so a small altcha-workers.js module wires $altcha.algorithms to the bundled worker scripts. The new asset settings — ALTCHA_JS_STRICT_CSP_URL, ALTCHA_CSS_URL, ALTCHA_WORKERS_REGISTER_URL and ALTCHA_WORKERS_URL — go through the STATIC_URL resolution added in aboutcode-org#45. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01956qnAS7qztaS7tghEKDta
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ALTCHA_JS_URLandALTCHA_JS_TRANSLATIONS_URLwere hardcoded to/static/...paths, breaking projects that customizeSTATIC_URL, useManifestStaticFilesStorage, or serve assets from a CDN.Defaults are now relative paths resolved through
django.templatetags.static.static()at read time. Absolute paths (starting with /) and full URLs (http://, https://) are passed through unchanged, matching the convention used by Django's form Media class.