Reorganize settings if report-only CSP doesn't exist

bedrock/settings/__init__.py

@@ -262,16 +262,6 @@
     },
 }
 
-# Start report-only CSP as a copy. We'll modify it later if needed.
-# Only set up report-only CSP if we have a report-uri set.
-if csp_report_uri := config("CSP_REPORT_URI", default="") or None:
-    CONTENT_SECURITY_POLICY_REPORT_ONLY = deepcopy(CONTENT_SECURITY_POLICY)
-    CONTENT_SECURITY_POLICY_REPORT_ONLY["REPORT_PERCENTAGE"] = config("CSP_REPORT_PERCENTAGE", default="100", parser=int)
-    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["report-uri"] = csp_report_uri
-    # Remove `UNSAGE_INLINE` and `UNSAGE_EVAL` from `script-src`.
-    _csp_ro_script_src = [src for src in _csp_script_src if src not in [UNSAFE_INLINE, UNSAFE_EVAL]]
-    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["script-src"] = list(set(_csp_default_src + _csp_ro_script_src))
-
 # Mainly for overriding CSP settings for CMS admin.
 # Works in conjunction with the `bedrock.base.middleware.CSPMiddlewareByPathPrefix` middleware.
 
@@ -285,15 +275,26 @@
     "/cms-admin/images/": CMS_ADMIN_IMAGES_CSP,
 }
 
-CMS_ADMIN_CSP_RO = deepcopy(CONTENT_SECURITY_POLICY_REPORT_ONLY)
-CMS_ADMIN_CSP_RO["DIRECTIVES"]["script-src"] += [UNSAFE_INLINE]
-CMS_ADMIN_IMAGES_CSP_RO = deepcopy(CONTENT_SECURITY_POLICY_REPORT_ONLY)
-CMS_ADMIN_IMAGES_CSP_RO["DIRECTIVES"]["img-src"] += ["blob:"]
+# Start report-only CSP as a copy. We'll modify it later if needed.
+# Only set up report-only CSP if we have a report-uri set.
+if csp_report_uri := config("CSP_REPORT_URI", default="") or None:
+    CONTENT_SECURITY_POLICY_REPORT_ONLY = deepcopy(CONTENT_SECURITY_POLICY)
+    CONTENT_SECURITY_POLICY_REPORT_ONLY["REPORT_PERCENTAGE"] = config("CSP_REPORT_PERCENTAGE", default="100", parser=int)
+    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["report-uri"] = csp_report_uri
+    # Remove `UNSAGE_INLINE` and `UNSAGE_EVAL` from `script-src`.
+    _csp_ro_script_src = [src for src in _csp_script_src if src not in [UNSAFE_INLINE, UNSAFE_EVAL]]
+    CONTENT_SECURITY_POLICY_REPORT_ONLY["DIRECTIVES"]["script-src"] = list(set(_csp_default_src + _csp_ro_script_src))
 
-CSP_PATH_OVERRIDES_REPORT_ONLY = {
-    "/cms-admin/images/": CMS_ADMIN_IMAGES_CSP,
-    "/cms-admin/": CMS_ADMIN_CSP_RO,
-}
+    # For overriding CSP report-only settings for CMS admin.
+    CMS_ADMIN_CSP_RO = deepcopy(CONTENT_SECURITY_POLICY_REPORT_ONLY)
+    CMS_ADMIN_CSP_RO["DIRECTIVES"]["script-src"] += [UNSAFE_INLINE]
+    CMS_ADMIN_IMAGES_CSP_RO = deepcopy(CONTENT_SECURITY_POLICY_REPORT_ONLY)
+    CMS_ADMIN_IMAGES_CSP_RO["DIRECTIVES"]["img-src"] += ["blob:"]
+
+    CSP_PATH_OVERRIDES_REPORT_ONLY = {
+        "/cms-admin/images/": CMS_ADMIN_IMAGES_CSP,
+        "/cms-admin/": CMS_ADMIN_CSP_RO,
+    }
 
 
 # 4. SETTINGS WHICH APPLY REGARDLESS OF SITE MODE