From b3e12b975064f0873bdb4d2834cae75925387d6b Mon Sep 17 00:00:00 2001
From: Dennis Fink
Date: Mon, 10 Aug 2026 23:28:03 +0200
Subject: feat(core): add received webmention admin actions

Add authenticated delete and reverify actions to the received
webmentions admin view and protect them with CSRF validation.

Enable CSRF protection globally while exempting the public Webmention
endpoint.
---
 webmentions_ssg/__init__.py | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'webmentions_ssg/__init__.py')

diff --git a/webmentions_ssg/__init__.py b/webmentions_ssg/__init__.py
index f66e478..b799678 100644
--- a/webmentions_ssg/__init__.py
+++ b/webmentions_ssg/__init__.py
@@ -14,6 +14,7 @@ from flask import Flask
 from flask_bootstrap import Bootstrap5
 from flask_migrate import Migrate, upgrade
 from flask_sqlalchemy import SQLAlchemy
+from flask_wtf.csrf import CSRFProtect
 from sqlalchemy.orm import DeclarativeBase
 
 from webmentions_ssg.config import DefaultConfig, DevelopmentConfig, ProductionConfig
@@ -28,6 +29,7 @@ class Base(DeclarativeBase):
     pass
 
 
+CSRF = CSRFProtect()
 BOOTSTRAP = Bootstrap5()
 DATABASE = SQLAlchemy(model_class=Base)
 MIGRATE = Migrate()
@@ -94,6 +96,7 @@ def create_app(config_class: type[DefaultConfig] | None = None) -> Flask:
 
     DATABASE.init_app(app)
     MIGRATE.init_app(app, db=DATABASE)
+    CSRF.init_app(app)
 
     from .auth import AUTH
 
-- 
cgit v1.3.1