djust 1.1.7

The djust admin change list filters and sorts only on declared fields. ModelListView.apply_filter accepts the field names in the ModelAdmin's list_filter (get_list_filter()), and sort_by accepts the sortable list_display columns and the fields named in ordering (get_ordering()), as Django's admin does. The queryset applies the same check to the stored filters and ordering, so any other name (another lookup, a path through a relation, an expression) is ignored and logged at debug level. The filter list on the page now comes from get_list_filter() as well. A custom change-list template that filters or sorts on other fields must declare them in list_filter, list_display or ordering. The auth admin's social accounts list sorts only on its own columns.

The djust admin loads rows through the ModelAdmin's get_queryset(). A DjustModelAdmin that scopes rows in get_queryset(request) was honoured by the change list only: bulk actions ran on the selected primary keys through Model.objects, and the change and delete views loaded their object with Model.objects.get(). As in Django's admin, an action now runs on the selected rows that get_queryset(request) holds (other selected keys are ignored), and the change and delete views load their object with the new DjustModelAdmin.get_object(request, object_id), which looks it up in that queryset; a row it leaves out, or a key that names no row, is a 404.

A live view whose mount() raises is no longer left mounted. An exception from mount(), handle_params() or the first render used to answer with an error frame and keep the view as the connection's mounted view, so later events still ran its handlers, and it stayed in its channel groups with its presence tracked. Such a mount now ends like a refused one on WebSocket and SSE: a PermissionDenied is answered as the authorization check answers it (Permission denied; the socket closes with 4403 outside a mount_batch), any other exception keeps its error frame, and in both cases the view is dropped, its groups are left, its presence is untracked and its tick stops. A view whose object permission is refused after mount() also untracks its presence. The HTTP fallback and the HTTP API already refused such a request.

One @rate_limit budget per handler function, whatever name reaches it. The shared store keyed buckets on the caller and the name the route used (the client-supplied event_name on WebSocket/SSE, the function name on the HTTP API), so a method reachable under two names (an alias attribute, or a second name bound in mount) had a separate budget per name. The bucket is now keyed on the function that actually runs (__func__ of a bound method), accepted only when that function is declared on the owning class; only the exact builtin staticmethod/classmethod wrappers are unwrapped, and membership is compared with is. A handler whose identity cannot be determined this way (a property or other descriptor, a functools.partial, a callable instance, a function from an unrelated class) is refused with a named error rather than given a budget of its own, and two handlers that resolve to one key with different limit settings are refused rather than sharing the first one's settings. Functions made by one factory keep separate budgets. Tests: python/djust/tests/test_ratelimit_post_fallback.py.

@rate_limit now applies on the page-POST fallback. The per-handler @rate_limit was checked on WebSocket/SSE and on the HTTP API, but the page-POST fallback (mixins/request.post), which also runs an @event_handler from the request body, did not consult it, so calls through it did not use the shared per-caller budget that F27 documents as "one budget per handler regardless of transport". The fallback now checks the limit at the same point as the WebSocket path (after the decorator and permission checks, before the handler runs) and answers 429 with code: "rate_limited" in its existing JSON error shape. Both HTTP transports share one implementation, djust.rate_limit.http_handler_rate_check, and one caller-key helper, caller_key_for_request (still behind resolve_client_ip, so DJUST_TRUSTED_PROXY_COUNT still applies); the HTTP API's behaviour is unchanged. Tests: python/djust/tests/test_ratelimit_post_fallback.py.

Theming URLs use a shared script-scheme denylist (backported from #3400, #3407, #3420). Data-derived URLs in navigation, breadcrumbs, pagination, avatars and page tags are neutralised to "#" for javascript:, vbscript: and data: schemes, including whitespace and control-character obfuscation. Image sources retain data:image/*; links do not. Other schemes, including sms:, geo: and app deep links, remain unchanged. Developer-supplied URL keyword arguments (button href=, and href/src/action/formaction passed to the button, input, select and progress tags) raise ValueError. Navigation covers dictionary and object items, iterable collections and sidebar sections without mutating caller-owned items. Pagination checks every page, first, last, previous and next URL after formatting.

The live mount checks object permission after handle_params(). The WebSocket and SSE mounts ran has_object_permission() after mount() but before handle_params(), so a view that selects its object from the URL's query parameters in handle_params() was checked against the object mount() chose and then rendered the one the parameters selected. The mount now runs mount(), handle_params(), the object check, and then the first render: the order the HTTP GET render and url_change navigation already used. A refused mount still sends a permission_denied error frame and closes the WebSocket with 4403.

Live transports enforce or refuse access control that only the HTTP request runs. The WebSocket and SSE mount, events, the HTTP POST event fallback, the API and {% live_render %} children never call a view's setup(), dispatch(), get() or post(), and never run the wrappers the URLconf puts around as_view(). djust replays its own declarations and Django's LoginRequiredMixin, PermissionRequiredMixin and UserPassesTestMixin there, but a custom AccessMixin subclass that checks the user in its own dispatch(), a @method_decorator(...) on dispatch, get or post, an overridden method that checks the user, or a URLconf wrapper such as path("x/", login_required(MyView.as_view())) did not run at all. check_view_auth now:

• replays Django's login_required, staff_member_required, user_passes_test(...) and permission_required(...) applied with @method_decorator, wrapped around as_view() in the URLconf (read from the server's URLconf, not from the URL the client sends) or by an as_view() override, and other packages' decorators built on user_passes_test. The same users are admitted as on the HTTP request; an authenticated user who fails the test gets PermissionDenied, where Django's HTTP response would redirect to the login page. Async test functions are awaited (called directly on the event loop's thread, the check refuses instead of blocking). login_not_required is not access control. A decorator applied only to post is checked for every event on the page (the view's, its components', its embedded views' and uploads), not for the mount;
• refuses a view whose custom AccessMixin subclass defines dispatch(), unless it declares permission_required or check_permissions() (login_required = True alone does not cover it);
• refuses a view whose setup()/dispatch()/get()/post() override, a decorator on one (also under another decorator stacked above @method_decorator, or returned by a project decorator that delegates to it), or a URLconf wrapper checks the user (any attribute of it, such as is_staff, groups or a role) and denies by any means (raises, including PermissionDenied and Http404; calls handle_no_permission() or redirect_to_login(); returns a redirect, an error response or a page of its own such as render(...) or HttpResponse(...); calls get_object_or_404()), unless a declared rule covers it (login_required covers a check that reads only is_authenticated / is_anonymous);
• does not refuse a view for any other decorator or URLconf wrapper that is neither Django's nor djust's and whose code does not check the user (a CSP, rate-limit or logging decorator); it does not run on live transports, and djust.V013 warns about it.

Permitted users of views using Django's login_required, staff_member_required, user_passes_test and permission_required decorators and wrappers, or its three auth mixins, are unaffected. Views whose access check lives in their own setup(), dispatch(), get(), post(), decorators or URLconf wrappers are refused for every user until the rule is declared. The HTTP GET page, which Django's dispatch already gated, is unchanged. System check djust.S012 (an Error, so manage.py check and migrate stop until the view is fixed) names each refused view defined in the project; djust.V013 (a warning) names overrides that only read the user and unknown decorators and wrappers, which are not refused, refused views that an installed package defines, and URLconf routes whose wrapper does not use functools.wraps (djust cannot read it). djust.S012 no longer reports Django's own decorators on dispatch(), which are replayed. Only djust and djust.* modules are treated as framework code: apps and packages named djust_* are inspected, djust-auth's LoginRequiredLiveViewMixin is read as login_required = True, and djust-tenants' TenantMixin is not reported. LoginRequiredLiveViewMixin in djust.auth now also sets login_required = True. Upgrade note: a view refused this way must declare its rule; login_required = False is not a declaration.

MCP tools keep filesystem paths inside the project. find_handlers_for_template read any absolute path that existed, so it confirmed which files existed anywhere on disk and returned dj-*-shaped strings from them. It now reads an absolute path only when the file resolves (symlinks and .. followed) inside a directory the template loaders serve or inside BASE_DIR, and answers any other absolute path like a missing template. seed_fixtures compared paths with a string prefix, so /app-data passed for a BASE_DIR of /app, and skipped the check when BASE_DIR was unset; it now compares whole path components and refuses to load anything without BASE_DIR. Both use one containment helper.