chore: add locust files + testing setup

polylan_submitter/testing_auth_views.py

@@ -0,0 +1,34 @@
+"""Test-only username/password login.
+
+Lets load-testing tools (see loadtest/locustfile.py) authenticate local
+Django accounts through AUTHENTICATION_BACKENDS' ModelBackend, entirely
+bypassing SimpleCASBackend - so hammering this app under load never sends a
+single request to the real CAS server at polylan.ch.
+
+Only wired up in urls.py when settings.LOAD_TEST_LOGIN_ENABLED is true, and
+that must stay off in production: it lets anyone who knows a local test
+account's password log in without going through CAS at all. The "Create
+load test users" admin action on CustomUser (see accounts/admin.py) is
+hidden unless that same flag is set, as a second layer of the same guard
+rail.
+"""
+
+from django.contrib.auth import authenticate, login
+from django.http import HttpRequest, JsonResponse
+from django.utils.decorators import method_decorator
+from django.views import View
+from django.views.decorators.csrf import csrf_exempt
+
+
+@method_decorator(csrf_exempt, name="dispatch")
+class TestLoginView(View):
+    def post(self, request: HttpRequest):
+        username = request.POST.get("username")
+        password = request.POST.get("password")
+
+        user = authenticate(request, username=username, password=password)
+        if user is None:
+            return JsonResponse({"detail": "invalid credentials"}, status=401)
+
+        login(request, user)
+        return JsonResponse({"detail": "ok"})