✨ [#8] Render templates with sandboxed backend

backend/src/openarchiefbeheer/destruction/models.py

@@ -1,12 +1,11 @@
-from django.conf import settings
-from django.core.mail import send_mail
 from django.db import models
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 
 from ordered_model.models import OrderedModel
 
 from openarchiefbeheer.destruction.constants import ListItemStatus, ListStatus
+from openarchiefbeheer.emails.utils import send_review_request_email
 
 
 class DestructionList(models.Model):
@@ -140,17 +139,10 @@ def assign(self) -> None:
 
         self.notify()
 
-    # TODO refine what we want to do with notifications
     def notify(self) -> None:
         if not self.user.email:
             return
 
         is_reviewer = self.user != self.destruction_list.author
         if is_reviewer:
-            send_mail(
-                _("Destruction list review request"),
-                _("There is a destruction list review request for you."),
-                settings.DEFAULT_FROM_EMAIL,
-                [self.user.email],
-                fail_silently=False,
-            )
+            send_review_request_email(self.user, self.destruction_list)

backend/src/openarchiefbeheer/emails/render_backend.py

@@ -0,0 +1,31 @@
+from django.template.backends.django import DjangoTemplates
+
+
+class SandboxedTemplates(DjangoTemplates):
+    def __init__(self, params: dict) -> None:
+        params = params.copy()
+        params.setdefault("NAME", "django_sandboxed")
+        # no file system paths to look up files (also blocks {% include %} etc)
+        params.setdefault("DIRS", [])
+        params.setdefault("APP_DIRS", False)
+        params.setdefault("OPTIONS", {})
+
+        super().__init__(params)
+
+    def get_templatetag_libraries(self, custom_libraries: dict) -> dict:
+        """
+        The parent returns template tag libraries from installed
+        applications and the supplied custom_libraries argument.
+        """
+        return {}
+
+    def template_dirs(self) -> list:
+        """
+        The parent returns a list of directories to search for templates.
+        We only need to render from string.
+        """
+        return []
+
+
+def get_sandboxed_backend() -> SandboxedTemplates:
+    return SandboxedTemplates({})

backend/src/openarchiefbeheer/emails/utils.py

@@ -0,0 +1,30 @@
+from typing import TYPE_CHECKING
+
+from django.conf import settings
+from django.core.mail import send_mail
+
+if TYPE_CHECKING:
+    from openarchiefbeheer.accounts.models import User
+    from openarchiefbeheer.destruction.models import DestructionList
+
+from .models import EmailConfig
+from .render_backend import get_sandboxed_backend
+
+
+def send_review_request_email(
+    user: "User", destruction_list: "DestructionList"
+) -> None:
+    config = EmailConfig.get_solo()
+
+    backend = get_sandboxed_backend()
+    template = backend.from_string(config.body_review_required)
+
+    formatted_body = template.render(context={"user": user, "list": destruction_list})
+
+    send_mail(
+        subject=config.subject_review_required,
+        message=formatted_body,
+        from_email=settings.DEFAULT_FROM_EMAIL,
+        recipient_list=[user.email],
+        fail_silently=False,
+    )