Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a fuller Django app and harden it for production (a multi-user SaaS-style app, a marketplace). Requirements: (1) auth flows gated with @login_required / LoginRequiredMixin and permissions/GROUPS; (2) class-based GENERIC views (ListView/DetailView/CreateView) plus a ModelForm with custom clean() validation; (3) OFFLOAD slow work — send email or process a job via CELERY (or a Django async view) instead of blocking the request; (4) SECURITY: read SECRET_KEY from an environment variable (never commit it), set DEBUG=False + ALLOWED_HOSTS in the production settings, rely on the ORM (no string-built SQL) + {% csrf_token %} + template autoescaping, and make 'manage.py check --deploy' pass; (5) a test suite (TestCase + the test client) covering the key flows; (6) a real deploy story — gunicorn or uvicorn behind nginx, collectstatic + WhiteNoise, Postgres, migrations on deploy, a Dockerfile. Document the security and deployment choices.
Custom auth/permissions (login_required/mixins + groups); CBV generic views + a validating ModelForm; slow work offloaded to Celery or an async view.
SECRET_KEY from env; DEBUG=False + ALLOWED_HOSTS in prod; ORM/csrf/autoescape relied on (no string-built SQL); 'check --deploy' passes.
TestCase + client cover the key flows; a credible deploy story — gunicorn/uvicorn, collectstatic + WhiteNoise, Postgres, migrations on deploy, Docker.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A production-hardened, secure Django app
## Goal
Build a fuller Django app and harden it for production (a multi-user SaaS-style app, a marketplace). Requirements: (1) auth flows gated with @login_required / LoginRequiredMixin and permissions/GROUPS; (2) class-based GENERIC views (ListView/DetailView/CreateView) plus a ModelForm with custom clean() validation; (3) OFFLOAD slow work — send email or process a job via CELERY (or a Django async view) instead of blocking the request; (4) SECURITY: read SECRET_KEY from an environment variable (never commit it), set DEBUG=False + ALLOWED_HOSTS in the production settings, rely on the ORM (no string-built SQL) + {% csrf_token %} + template autoescaping, and make 'manage.py check --deploy' pass; (5) a test suite (TestCase + the test client) covering the key flows; (6) a real deploy story — gunicorn or uvicorn behind nginx, collectstatic + WhiteNoise, Postgres, migrations on deploy, a Dockerfile. Document the security and deployment choices.
## Acceptance criteria
- [ ] Feature depth: Custom auth/permissions (login_required/mixins + groups); CBV generic views + a validating ModelForm; slow work offloaded to Celery or an async view.
- [ ] Security hardening: SECRET_KEY from env; DEBUG=False + ALLOWED_HOSTS in prod; ORM/csrf/autoescape relied on (no string-built SQL); 'check --deploy' passes.
- [ ] Tests & deployment: TestCase + client cover the key flows; a credible deploy story — gunicorn/uvicorn, collectstatic + WhiteNoise, Postgres, migrations on deploy, Docker.
## Verification
- [ ] Document installation and run commands.
- [ ] Record automated checks and their exact commands.
- [ ] Add representative output, screenshots, or a short demo where useful.
- [ ] Confirm failure paths and known constraints.
## Decision log
### Decision title
- Context:
- Choice:
- Alternatives considered:
- Tradeoffs:
## Evidence
- Link each rubric criterion to the file, test, or artifact that demonstrates it.
## Known limitations
- List what is intentionally out of scope and what should be improved next.