feat: add sane views for 403 Forbidden and 404 Not Found

src/wuttaweb/templates/base.mako

@@ -347,7 +347,7 @@
           % elif request.is_admin:
               ${h.form(url('become_root'), ref='startBeingRootForm')}
               ${h.csrf_token(request)}
-              <input type="hidden" name="referrer" value="${request.current_route_url()}" />
+              <input type="hidden" name="referrer" value="${request.url}" />
               <a @click="startBeingRoot()"
                  class="navbar-item has-background-danger has-text-white">
                 Become root

src/wuttaweb/templates/forbidden.mako

@@ -0,0 +1,26 @@
+## -*- coding: utf-8; -*-
+<%inherit file="/page.mako" />
+
+<%def name="title()">Access Denied</%def>
+
+<%def name="page_content()">
+  <div style="padding: 4rem;">
+    <p class="block is-size-5">
+      You are trying to access something for which you do not have permission.
+    </p>
+    <p class="block is-size-5">
+      If you feel this is an error, please ask a site admin to give you access.
+    </p>
+    % if not request.user:
+        <p class="block is-size-5">
+          Or probably, you should just ${h.link_to("Login", url('login'))}.
+        </p>
+    % endif
+    <b-field label="Current URL">
+      ${request.url}
+    </b-field>
+  </div>
+</%def>
+
+
+${parent.body()}

src/wuttaweb/templates/notfound.mako

@@ -0,0 +1,23 @@
+## -*- coding: utf-8; -*-
+<%inherit file="/page.mako" />
+
+<%def name="title()">Not Found</%def>
+
+<%def name="page_content()">
+  <div style="padding: 4rem;">
+    <p class="block is-size-5">
+      Not saying <span class="has-text-weight-bold">you</span> don't
+      know what you're talking about..
+    </p>
+    <p class="block is-size-5">
+      ..but <span class="has-text-weight-bold">*I*</span> don't know
+      what you're talking about.
+    </p>
+    <b-field label="Current URL">
+      ${request.url}
+    </b-field>
+  </div>
+</%def>
+
+
+${parent.body()}

src/wuttaweb/views/common.py

@@ -57,6 +57,22 @@ class CommonView(View):
             'index_title': self.app.get_title(),
         }
 
+    def forbidden_view(self):
+        """
+        This view is shown when a request triggers a 403 Forbidden error.
+
+        Template: ``/forbidden.mako``
+        """
+        return {'index_title': self.app.get_title()}
+
+    def notfound_view(self):
+        """
+        This view is shown when a request triggers a 404 Not Found error.
+
+        Template: ``/notfound.mako``
+        """
+        return {'index_title': self.app.get_title()}
+
     def setup(self, session=None):
         """
         View for first-time app setup, to create admin user.
@@ -173,15 +189,22 @@ class CommonView(View):
     @classmethod
     def _defaults(cls, config):
 
-        # auto-correct URLs which require trailing slash
-        config.add_notfound_view(cls, attr='notfound', append_slash=True)
-
         # home page
         config.add_route('home', '/')
         config.add_view(cls, attr='home',
                         route_name='home',
                         renderer='/home.mako')
 
+        # forbidden
+        config.add_forbidden_view(cls, attr='forbidden_view',
+                                  renderer='/forbidden.mako')
+
+        # notfound
+        # nb. also, auto-correct URLs which require trailing slash
+        config.add_notfound_view(cls, attr='notfound_view',
+                                 append_slash=True,
+                                 renderer='/notfound.mako')
+
         # setup
         config.add_route('setup', '/setup')
         config.add_view(cls, attr='setup',

tests/views/test_common.py

@@ -12,6 +12,16 @@ class TestCommonView(WebTestCase):
     def test_includeme(self):
         self.pyramid_config.include('wuttaweb.views.common')
 
+    def test_forbidden_view(self):
+        view = self.make_view()
+        context = view.forbidden_view()
+        self.assertEqual(context['index_title'], self.app.get_title())
+
+    def test_notfound_view(self):
+        view = self.make_view()
+        context = view.notfound_view()
+        self.assertEqual(context['index_title'], self.app.get_title())
+
     def test_home(self):
         self.pyramid_config.add_route('setup', '/setup')
         model = self.app.model