Django Developer

---
name: Django Developer
description: Use when building applications with Django 5+ and Django REST Framework, including ORM optimization, migrations, and async views.
category: Languages
version: 1.0.0
tools: []
---

# Django 5+ Development

Build robust web applications and APIs using Django 5+ and Django REST Framework with batteries-included philosophy.

## Core Principles

- **Follow Django conventions.** Do not fight the framework. Custom solutions are the exception.
- **Optimize every queryset.** Use `select_related` and `prefetch_related` by default on querysets touching templates or serializers.
- **Fat models, thin views.** Business logic belongs in model methods, managers, or service functions, not views.
- **Migrations are code.** Review, test, and never edit a migration already applied to production.

## Project Structure

```
config/
  settings/
    base.py           # Shared settings
    development.py    # DEBUG=True, local database
    production.py     # Security, caching, email
aps/
  users/
    models.py
    views.py
    serializers.py    # DRF serializers
    services.py       # Business logic
    tests/
```

## ORM Best Practices

- `select_related` for ForeignKey and OneToOneField lookups (SQL JOIN).
- `prefetch_related` for ManyToManyField and reverse ForeignKey (separate query + Python join).
- `.only()` or `.defer()` to load only needed fields from large models.
- `F()` expressions for database-level updates: `Product.objects.filter(id=1).update(stock=F("stock") - 1)`.
- `Q()` objects for complex queries: `User.objects.filter(Q(is_active=True) & (Q(role="admin") | Q(role="staff")))`.
- `.explain()` during development to verify query plans and index usage.

## Django REST Framework

- `ModelSerializer` with explicit `fields` lists. Never use `fields = "__all__"`.
- Custom permissions via `BasePermission` and `has_object_permission`.
- `FilterSet` from `django-filter` for queryset filtering with explicit field definitions.
- Pagination globally: set `DEFAULT_PAGINATION_CLASS` to `CursorPagination` for large datasets.
- `@action(detail=True)` for custom ViewSet endpoints: `/users/{id}/deactivate/`.

## Authentication and Security

- `AbstractUser` for custom user models. Set `AUTH_USER_MODEL` before first migration.
- `django-allauth` or `dj-rest-auth` with SimpleJWT for token-based API authentication.
- CSRF protection for all form submissions. Use `@csrf_exempt` only for webhook endpoints with signature verification.
- Production settings: `SECURE_SSL_REDIRECT`, `SECURE_HSTS_SECONDS`, `SESSION_COOKIE_SECURE`.

## Async Django

- `async def` views with `await` for I/O-bound operations in Django 5+.
- `sync_to_async` to call ORM methods from async views (ORM not natively async yet).
- `aiohttp` or `httpx.AsyncClient` for non-blocking HTTP calls.
- Run with `uvicorn` or `daphne` via ASGI for async support (WSGI does not support async views).

## Testing

- `pytest-django` with `@pytest.mark.django_db` for database access.
- `factory_boy` with `faker` for test data generation (one factory per model).
- `APIClient` from DRF for API endpoint tests. Set authentication with `client.force_authenticate(user)`.
- Test permissions, validation errors, and edge cases.