Add honeypot field to newsletter form to prevent spam submissions

[localjo]

Fixes #16231

• Added office_fax as a honeypot field in the form to trap bots.
• Implemented validation to check for any input in the honeypot field, logging a warning if filled.
• Updated the newsletter subscription view to handle errors related to the honeypot field.
• Added corresponding tests to ensure the honeypot functionality works as intended.
• Styled the honeypot field to be hidden from users while remaining accessible to bots.

If this changeset needs to go into the FXC codebase, please add the WMO and FXC label.

One-line summary

Add honeypot for email capture in footer on mozilla.org

Significant changes and points to review

• Depends on changes to Protocol for validation: Add honeypot field validation to newsletter form protocol#1072
• This doesn't implement the signature/HMAC approach, but that is also worth considering

Issue / Bugzilla link

Fixes #16231

Testing

http://localhost:8000/en-US/newsletter/

[Copilot]

Pull Request Overview

Adds a honeypot field to the newsletter footer form to trap automated spam submissions.

• Introduces an office_fax honeypot field in the form, widget, validation, view logic, and template.
• Hides the honeypot field via SCSS and ensures it doesn’t affect user interaction.
• Covers honeypot behavior with form-level tests for empty, filled, and whitespace inputs.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
media/css/protocol/components/newsletter-form.scss	Styles .super-priority-field to hide the honeypot input
bedrock/newsletter/forms.py	Adds office_fax field with HoneyPotWidget and validation
bedrock/newsletter/views.py	Handles honeypot validation errors and appends an FTL error
bedrock/newsletter/templates/newsletter/includes/form.html	Renders the honeypot field in the subscription form
bedrock/newsletter/tests/test_forms.py	Tests for valid/invalid honeypot inputs

Comments suppressed due to low confidence (4)

bedrock/newsletter/forms.py:190

• The NewsletterFooterForm docstring doesn't mention the new office_fax honeypot field. Consider updating the class docstring to describe its purpose so maintainers know why it's present.

    office_fax = forms.CharField(widget=HoneyPotWidget(), required=False, empty_value='')

bedrock/newsletter/tests/test_forms.py:273

• There are good form‐level tests for the honeypot, but no integration test for the view’s response message. Consider adding a test that submits via the view and asserts the correct FTL error message is returned in the response.

        self.assertIn("office_fax", form.errors)

media/css/protocol/components/newsletter-form.scss:60

• The CSS property tab-index is invalid. To remove the field from tab order, set the tabindex="-1" attribute on the input element via the form widget or markup rather than in CSS.

        tab-index: -1 !important;

media/css/protocol/components/newsletter-form.scss:48

• [nitpick] Consider using Protocol’s built-in visually-hidden or equivalent utility class instead of a custom .super-priority-field to reduce duplicated hide/show styles and improve consistency.

.super-priority-field {

[localjo]

Please excuse the force-pushes. My local pre-commit hooks stopped working for some reason, and there were linter issues to fix, so I force-pushed to keep the commit history clean.

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 79.83%. Comparing base (874df8c) to head (2e228ce).
⚠️ Report is 28 commits behind head on main.

Files with missing lines	Patch %	Lines
bedrock/newsletter/views.py	50.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #16406   +/-   ##
=======================================
  Coverage   79.82%   79.83%           
=======================================
  Files         158      158           
  Lines        8517     8525    +8     
=======================================
+ Hits         6799     6806    +7     
- Misses       1718     1719    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[stephaniehobson]

Blocked as noted in the issue.