Django 6.0: Add stubs for built-in CSP support

[federicobond]

Documentation: https://docs.djangoproject.com/en/6.0/ref/csp/

I reused a trick from django-stubs/db/models/enums.pyi to make it compatible with Python < 3.11.

[federicobond]

Apparently the stubtest job needs the Django 6.0 dependency update to be merged first.

[intgr]

Django 6.0 dependency update to be merged first

• ✅ merged Tests: Update to Django 6.0; fall back to 5.2 on Python <3.12 #2939

[intgr]

Please look at stubtest output https://github.com/typeddjango/django-stubs/actions/runs/20098667950/job/57663468906?pr=2931

And update stubs or stubtest allowlist files scripts/stubtest/allowlist_*.txt as needed.

[federicobond]

Should I include undocumented functions like get_nonce and build_policy in the type stubs or allow them in the allowlist?

[intgr]

Yes, add them to stubs. If you know they are undocumented, it's worth adding a code comment about it.

[sobolevn]

Suggested change

	SECURE_CSP: dict[str, Any] = {}
	SECURE_CSP_REPORT_ONLY: dict[str, Any] = {}
	SECURE_CSP: dict[str, Any]
	SECURE_CSP_REPORT_ONLY: dict[str, Any]

[sobolevn]

We might also type it as Sequence[str] instead of Any maybe?

[intgr]

Apparently SECURE_CSP_REPORT_ONLY = {"report-uri": "/path/to/reports-endpoint/"} is a valid value, so it's not always Sequence.

[federicobond]

Would Sequence[str] | str cover all use cases?

[intgr]

I'm not sure. Check the docs and if that is inconclusive, maybe check source too.

[federicobond]

From the docs:

The setting must be a mapping (typically a dictionary) of directive names to their values. Each key should be a valid CSP directive such as default-src or script-src. The corresponding value can be a list, tuple, or set of source expressions or URLs to allow for that directive. If a set is used, it will be automatically sorted to ensure consistent output in the generated headers.

Based on this, I updated the type for the policies to be Mapping[str, Collection[str] | str]. Let me know if that works.

[intgr]

Thanks!

[federicobond]

I've updated the PR based on the review comments. All build jobs pass now.

[intgr]

Awesome, thanks for your help.