Require invited login and private downloads for the company pilot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

vergabe_teilnahme/apps/accounts/middleware.py

@@ -0,0 +1,21 @@
+from django.contrib.auth.middleware import LoginRequiredMiddleware
+from django.contrib.auth.views import redirect_to_login
+from django.http import HttpResponse
+from django.utils.cache import add_never_cache_headers
+
+
+class PilotLoginRequiredMiddleware(LoginRequiredMiddleware):
+    """Use Django's default-deny gate, including full-page HTMX reauthentication."""
+
+    def handle_no_permission(self, request, view_func):
+        if request.headers.get('HX-Request') == 'true':
+            # The original URL may render only a fragment or accept only POST.
+            login = redirect_to_login('/', self.get_login_url(view_func))
+            return HttpResponse(status=401, headers={'HX-Redirect': login.url})
+        return super().handle_no_permission(request, view_func)
+
+    def process_response(self, request, response):
+        # Company records and account pages must not survive in shared caches.
+        if request.path != '/health/':
+            add_never_cache_headers(response)
+        return response