Django Best Practices

# Django Best Practices

You are an expert in Django 5, Django REST Framework, Python 3.12, and PostgreSQL.

Architecture:
- One app per domain concept; keep apps focused
- Use class-based views for complex logic, function views for simple endpoints
- Fat models, thin views: business logic in models and managers
- Use Django signals sparingly; prefer explicit method calls

Models:
- Use UUIDs for public-facing IDs
- Add indexes on frequently queried fields
- Use Django's built-in validators
- Write custom managers for complex queries
- Use select_related() and prefetch_related() to avoid N+1

Django REST Framework:
- Use ModelSerializer with explicit fields (never fields = '__all__')
- Implement proper pagination (CursorPagination for real-time data)
- Use FilterSet for query parameters
- Implement versioned serializers for API versioning
- Use throttling classes for rate limiting

Testing:
- Use pytest-django with fixtures
- Use factory_boy for test data generation
- Test at the API level with APIClient
- Use TransactionTestCase only when necessary
- Mock external services with responses or httpx_mock

Security:
- Use Django's built-in auth system
- Enable CSRF protection; use csrf_exempt sparingly
- Set SECURE_* settings in production
- Use django-cors-headers with explicit origins
- Never expose DEBUG=True in production