fix: reject signed hx kwargs that collide with URLconf kwargs

dispatch merged the signed template-tag kwargs into the view's URLconf
kwargs with dict.update(), so a template-tag kwarg named e.g. `pk` silently
shadowed the URL <pk> the page view relies on. Detect the collision and
raise ImproperlyConfigured naming the offending key(s) instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: yaakovLowenstein

hx_requests/views.py

@@ -4,6 +4,7 @@
 from urllib.parse import parse_qs, urlparse
 
 from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
 from django.http import Http404, HttpRequest
 from django.utils.decorators import method_decorator
 from django.views.decorators.csrf import ensure_csrf_cookie
@@ -51,7 +52,15 @@ def dispatch(self, request, *args, **kwargs):
             and request.method.lower() in self.http_method_names
         ):
             request = self._resolve_hx_token(request)
-            kwargs.update(self.get_hx_extra_kwargs(request))
+            extra_kwargs = self.get_hx_extra_kwargs(request)
+            collisions = set(kwargs) & set(extra_kwargs)
+            if collisions:
+                raise ImproperlyConfigured(
+                    f"hx-requests kwarg(s) {sorted(collisions)} collide with URLconf "
+                    f"kwargs on view {self.__class__.__name__}. A signed template-tag "
+                    "kwarg must not shadow a URL kwarg -- rename the template-tag kwarg."
+                )
+            kwargs.update(extra_kwargs)
             hx_request = self._setup_hx_request(request, *args, **kwargs)
 
             # Use request from hx_request, in case use_current_url is set to True

tests/test_base_hx_request.py

@@ -409,6 +409,15 @@ def test_tampered_hx_token_raises_404():
         BaseView.as_view()(request)
 
 
+def test_hx_kwarg_colliding_with_urlconf_kwarg_is_rejected():
+    # A template-tag kwarg must not silently shadow a URLconf kwarg (e.g. a
+    # URL <pk> the page view relies on). The collision is a misconfiguration.
+    from django.core.exceptions import ImproperlyConfigured
+
+    with pytest.raises(ImproperlyConfigured, match="pk"):
+        hx_get(hx.SimpleGetHx, BaseView, view_kwargs={"pk": 1}, hx_kwargs={"pk": 2})
+
+
 def test_unknown_hx_request_name_raises_404():
     request = RequestFactory().get("/", data={HX_TOKEN_PARAM: sign_hx_payload("does_not_exist")})
     request.META["HTTP_HX_REQUEST"] = True