make csrf work within components

includecontents/templatetags/includecontents.py

@@ -181,7 +181,14 @@ def __init__(
         self.isolated_context = isolated_context
 
     def render(self, context):
-        new_context = context.new() if self.isolated_context else context
+        if self.isolated_context:
+            new_context = context.new()
+            if request := getattr(context, "request", None):
+                new_context.request = request
+            if csrf_token := context.get("csrf_token"):
+                new_context["csrf_token"] = csrf_token
+        else:
+            new_context = context
         with new_context.push():
             new_context["contents"] = RenderedContents(
                 # Contents aren't rendered with isolation, hence the use of context

tests/templates/components/csrf.html

@@ -0,0 +1,4 @@
+<div class="inner-component">
+  {% csrf_token %}
+  {{ contents }}
+</div>

tests/templates/test_csrf/base.html

@@ -0,0 +1,5 @@
+<div class="outer">
+  {% includecontents "test_csrf/inner.html" %}
+    Testing CSRF token passing
+  {% endincludecontents %}
+</div>

tests/templates/test_csrf/component.html

@@ -0,0 +1,3 @@
+<div class="component">
+  <include:csrf>Testing CSRF in component</include:csrf>
+</div>

tests/templates/test_csrf/inner.html

@@ -0,0 +1,4 @@
+<div class="inner">
+  {% csrf_token %}
+  {{ contents }}
+</div>

tests/test_csrf.py

@@ -0,0 +1,48 @@
+from django.middleware.csrf import get_token
+from django.template.loader import render_to_string
+
+
+def test_csrf_token_passing(rf):
+    """Test that CSRF token is properly passed through includecontents."""
+    request = rf.get("/")
+    csrf_token = get_token(request)
+
+    context = {
+        "request": request,
+        "csrf_token": csrf_token,
+    }
+
+    rendered = render_to_string("test_csrf/base.html", context)
+    assert csrf_token in rendered
+    assert '<input type="hidden" name="csrfmiddlewaretoken"' in rendered
+
+
+def test_csrf_token_in_component(rf):
+    """Test that CSRF token works in component-style includecontents."""
+    request = rf.get("/")
+    csrf_token = get_token(request)
+
+    context = {
+        "request": request,
+        "csrf_token": csrf_token,
+    }
+
+    rendered = render_to_string("test_csrf/component.html", context)
+    assert csrf_token in rendered
+    assert '<input type="hidden" name="csrfmiddlewaretoken"' in rendered
+
+
+def test_csrf_token_isolated_context(rf):
+    """Test that CSRF token is passed even with isolated context."""
+    request = rf.get("/")
+    csrf_token = get_token(request)
+
+    context = {
+        "request": request,
+        "csrf_token": csrf_token,
+        "isolated_context": True,
+    }
+
+    rendered = render_to_string("test_csrf/base.html", context)
+    assert csrf_token in rendered
+    assert '<input type="hidden" name="csrfmiddlewaretoken"' in rendered