Admin Site

is_staff lets an active user into the Django admin; is_superuser makes has_perm() return True for every permission. They are independent: a superuser with is_staff=False cannot log in to the admin, and a staff user with no permissions sees nothing to edit.

Pass permissions=["ship"] to @admin.action and define has_ship_permission(self, request) on the ModelAdmin. The admin hides the action from users failing every listed check and refuses a forged POST for it; per-object checks remain your job.

Write a function taking (modeladmin, request, queryset), decorate it with @admin.action(description=...), and list it in the ModelAdmin's actions. The queryset holds the ticked rows; returning None sends the user back to the change list.

Define a TabularInline or StackedInline subclass with model = Lesson and list it in the course ModelAdmin's inlines. Tabular renders one compact row per lesson, stacked renders each lesson as a full form; the only difference is the template.

list_filter adds sidebar filters built from field names, SimpleListFilter subclasses or (field, FieldListFilter) pairs. search_fields adds a search box: each word must match at least one listed field, using icontains unless a lookup or prefix says otherwise.

Override ModelAdmin.get_urls() and prepend a path whose view is wrapped in self.admin_site.admin_view(); render a template extending admin/base_site.html with admin_site.each_context(request). admin_view only checks staff access, so check model permissions inside the view.

A Django admin change list runs two COUNT queries per page by default. Set show_full_result_count = False to drop the unfiltered one, supply a paginator whose count is estimated or capped, and keep search, sorting, date_hierarchy and filters on indexed, cheap paths.

Override ModelAdmin.get_queryset() to filter by the manager's region; the change list, change and delete views and actions inherit it. It does not scope foreign-key choices on other forms, raw-id inputs, related list filters or inlines, so limit those too.

Django's admin registers delete_selected on every AdminSite: it lists the ticked rows plus everything that would cascade with them, asks for confirmation, then logs and deletes them. Remove it site-wide with admin.site.disable_action(), or per model by overriding get_actions().

fields picks and orders the inputs; fieldsets groups them under headings with classes and descriptions; readonly_fields shows values as text and removes them from the form; prepopulated_fields fills a slug from other fields with JavaScript.

Set site_header, site_title and index_title on the Django admin site, either on admin.site directly or on an AdminSite subclass made the default through an AdminConfig subclass's default_site. Logos and colours come from overriding admin/base_site.html.

The default ForeignKey widget is a select filled with every related row. autocomplete_fields swaps in a search-as-you-type box that queries the related ModelAdmin's search; raw_id_fields swaps in a plain id input with a lookup popup.

Override the get_* hook matching the option: get_readonly_fields(), get_fields() or get_fieldsets() receive request and obj. get_form() returns the ModelForm class, so override it to swap forms. Return new lists; never append to the class attribute.

Add a ModelAdmin method (or model method, property or callable) taking the object to list_display. @admin.display sets its header (description), yes/no icons (boolean), the field or expression to sort by (ordering) and the placeholder for empty values (empty_value).

Create a second AdminSite instance with its own name, register the models it should show on it explicitly, and mount its urls at another path. The name is its URL instance namespace; permissions still come from the same users and groups.

Put the template at templates/admin/<app_label>/<model_name>/<name>.html, extend the admin original and override one block. Only a listed set, such as change_form.html and change_list.html, is looked up per model; base_site.html and others are project-wide only.

Django's admin is a model-centric interface for trusted staff: it exposes tables, relations, bulk actions and cascading deletes, with per-model permissions. Customers need process-centric flows, per-row rules and a hardened public surface, so they get ordinary views.

The Django admin calls has_view_permission, has_add_permission, has_change_permission and has_delete_permission on the ModelAdmin, plus has_module_permission for the app on the index. Returning False from add, change and delete leaves a read-only model for users with view rights.

Return a TemplateResponse from the action on the first POST; its form re-posts the selected keys as _selected_action inputs, the action name and a marker such as apply. On that second POST the action sees the marker and does the work.

delete_selected calls ModelAdmin.delete_queryset(), whose default runs queryset.delete() and never calls Order.delete(). Override delete_queryset() to delete per object in a transaction, and keep delete_model() consistent for the single-object delete view.

save_model() runs before the inline lessons are saved; save_related() saves many-to-many data and inline formsets afterwards. Recompute totals in save_related() after calling super(), when the lessons in the database match the form.

By default the change list joins only ForeignKeys named directly in list_display; a method or customer__company__name path reaches the relation lazily per row. Set list_select_related to the relations used, or join them in get_queryset(), to return to a fixed query count.

Mount the Django admin at a non-default path, keep staff and superuser accounts few, add a second factor, and restrict who can reach it. Django does not throttle admin logins; add rate limiting or override AdminSite.has_permission for extra conditions.

Django 6.1 added location= to @admin.action: ActionLocation.CHANGE_FORM puts the action on the change form, a list puts it on both. description labels it there; description_plural labels it on the change list and defaults to description.

show_facets (Django 5.0+) shows per-choice row counts in the filter sidebar, at one aggregate query per filter; the default ALLOW computes them only when _facets is in the URL. date_hierarchy adds a date drill-down: a min/max query plus a distinct-dates query.

django.contrib.admindocs builds staff-only documentation pages from the docstrings of models, views, template tags and filters. Enable it by adding the app, including its URLs before the admin's, and installing docutils; the admin then shows a Documentation link.