[Gwerdonatus]

Summary

The callback example is exempt from CSRF, but the existing adapter tests bypass middleware. Add integration tests that import and execute examples/django/payments/views.py through Client(enforce_csrf_checks=True) and CsrfViewMiddleware, so removing the exemption cannot silently break server-to-server callbacks.

Valid callbacks return 200 and look up the supplied payment ID through a mocked TBCClient. Invalid JSON, a missing payment ID, and an array body return 400 without invoking the client. A separate unexempt endpoint returns 403, confirming middleware is active. No real credentials or network calls are used.

Closes #13.

Validation

Python 3.12.14 / Django 5.2.17:

• Full suite: 94 passed; 92.66% coverage (85% gate passed).
• Removing @csrf_exempt from the runnable example: four callback cases fail with 403; control still passes. Restored example: all five pass.
• ruff check ., ruff format --check ., and git diff --check pass.
• Local mypy was not run. This change only adds tests and a changelog entry; no SDK source or public types change.

Checklist

• I added or updated tests for behavioural changes.
• I preserved backwards compatibility, or documented a breaking change.
• I ran pytest, ruff check ., and mypy (pytest/Ruff passed; mypy not run locally).
• I updated documentation and CHANGELOG.md when appropriate.
• I did not add credentials, tokens, card data, or customer data.

AI assistance was used to prepare and verify this contribution.