fix(api): disable csrf checks for api routes

tests/apps/core/test_middleware.py

@@ -4,6 +4,7 @@ import logging
 from io import StringIO
 
 from apps.core.middleware import (
+    ApiCsrfExemptMiddleware,
     RequestIDMiddleware,
     RequestLoggingMiddleware,
     get_request_id,
@@ -73,3 +74,23 @@ class RequestLoggingMiddlewareTest(APITestCase):
         response = middleware.process_response(request, HttpResponse(status=200))
         self.assertIn("X-Request-ID", response)
         self.assertIsNone(get_request_id())
+
+
+class ApiCsrfExemptMiddlewareTest(APITestCase):
+    def setUp(self):
+        self.factory = RequestFactory()
+        self.middleware = ApiCsrfExemptMiddleware(lambda req: HttpResponse(status=200))
+
+    def test_api_path_skips_csrf_check(self):
+        request = self.factory.post("/api/v1/users/login/", data={})
+
+        response = self.middleware.process_view(request, lambda req: None, (), {})
+
+        self.assertIsNone(response)
+
+    def test_non_api_path_keeps_csrf_check(self):
+        request = self.factory.post("/admin/login/", data={})
+
+        response = self.middleware.process_view(request, lambda req: None, (), {})
+
+        self.assertEqual(response.status_code, 403)