crudkit 0.2.1__tar.gz → 0.2.3__tar.gz

{crudkit-0.2.1 → crudkit-0.2.3}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.2.3 (2026-09-21)
+
+- `crudkit_api`: `GET /api/v1/` no longer returns 403 under `CrudKitModelPermissions`.
+  `has_permission` checks authentication first and honours DRF's
+  `_ignore_model_permissions`; the API root (`CrudKitRouter`/`CrudKitAPIRootView`) now lists
+  only the models the user may view. (#25)
+- `crudkit_frontend`: the detail view wraps long (over 60 characters) and multiline text,
+  with a Show more/less toggle when it overflows, instead of a single ellipsised line. (#26)
+- `crudkit_api`: fix a 500 when listing FeedItem or ExternalObject rows; generic relations
+  are no longer included in the list prefetch. (#27)
+- `crudkit`: multi-table-inheritance children are reachable by their own CK-ID again; the
+  parent's `CrudKitIDField` accepts the TYPE_IDs of its descendants. (#28)
+
+## 0.2.2 (2026-09-19)
+
+- `crudkit_api`: list endpoints no longer build a serializer per row. `GenericViewSet.list`
+  reuses one serializer for the whole page, `GenericSerializer.build_nested_field` caches the
+  generated nested field classes per (related model, depth), and the nested serializer behind a
+  forward FK is built once per field instead of once per value. A 500-row page of a model with
+  11 FKs went from a 216 MB to a 15 MB peak downstream (72 MB to 8.5 MB in the test suite's
+  smaller fixtures) and serializes ~2.6x faster; the JSON is unchanged. Worker RSS on gunicorn
+  no longer climbs from refetching kanban/swimlane views, which request `page_size=500`.
+
+- Workspaces: new `Workspace` model (TYPE_ID `WSP`) — switchable sidebar
+  apps that pin an ordered set of saved views as tabs, picked from a switcher
+  in the sidebar header. Purely additive: deployments with no Workspace rows
+  render exactly as before.
+
 ## 0.2.1 (2026-08-11)
 
 - `crudkit_frontend`: asset URLs are no longer hardcoded to `/static/`. The

{crudkit-0.2.1 → crudkit-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: crudkit
-Version: 0.2.1
+Version: 0.2.3
 Summary: A metadata-driven CRUD framework for Django: typed object IDs, soft delete, merge, change log, activity feed, saved views, AI fields and a generic REST API.
 Project-URL: Homepage, https://github.com/fenerum/crudkit
 Project-URL: Changelog, https://github.com/fenerum/crudkit/blob/main/backend/CHANGELOG.md
@@ -80,6 +80,9 @@ INSTALLED_APPS = [
 ]
 
 REST_FRAMEWORK = {
+    "DEFAULT_PERMISSION_CLASSES": [
+        "crudkit_api.permissions.CrudKitModelPermissions",
+    ],
     "DEFAULT_PAGINATION_CLASS": "crudkit_api.pagination.CrudKitPagination",
     "DEFAULT_FILTER_BACKENDS": ["crudkit_api.filters.BasicFilter"],
     "PAGE_SIZE": 50,
@@ -89,6 +92,13 @@ REST_FRAMEWORK = {
 urlpatterns = [path("api/v1/", include("crudkit_api.urls"))]
 ```
 
+CrudKit requires the standard Django model permissions for every API and
+assistant operation. Projects that need row-level rules can override
+`CrudKitSettings.get_authorized_queryset(user, queryset, action)`; `action`
+is one of `view`, `add`, `change`, or `delete`. Model actions require `change`
+permission and can be narrowed further with
+`CrudKitSettings.has_action_permission(user, instance, action_name)`.
+
 ## Settings
 
 | Setting | Purpose |

{crudkit-0.2.1 → crudkit-0.2.3}/README.md

@@ -46,6 +46,9 @@ INSTALLED_APPS = [
 ]
 
 REST_FRAMEWORK = {
+    "DEFAULT_PERMISSION_CLASSES": [
+        "crudkit_api.permissions.CrudKitModelPermissions",
+    ],
     "DEFAULT_PAGINATION_CLASS": "crudkit_api.pagination.CrudKitPagination",
     "DEFAULT_FILTER_BACKENDS": ["crudkit_api.filters.BasicFilter"],
     "PAGE_SIZE": 50,
@@ -55,6 +58,13 @@ REST_FRAMEWORK = {
 urlpatterns = [path("api/v1/", include("crudkit_api.urls"))]
 ```
 
+CrudKit requires the standard Django model permissions for every API and
+assistant operation. Projects that need row-level rules can override
+`CrudKitSettings.get_authorized_queryset(user, queryset, action)`; `action`
+is one of `view`, `add`, `change`, or `delete`. Model actions require `change`
+permission and can be narrowed further with
+`CrudKitSettings.has_action_permission(user, instance, action_name)`.
+
 ## Settings
 
 | Setting | Purpose |

{crudkit-0.2.1 → crudkit-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "crudkit"
-version = "0.2.1"
+version = "0.2.3"
 description = "A metadata-driven CRUD framework for Django: typed object IDs, soft delete, merge, change log, activity feed, saved views, AI fields and a generic REST API."
 readme = "README.md"
 license = "MIT"

{crudkit-0.2.1 → crudkit-0.2.3}/src/crudkit/apps.py

@@ -6,4 +6,5 @@ class CrudKitConfig(AppConfig):
     name = "crudkit"
 
     def ready(self):
+        import crudkit.checks  # noqa: F401  # App registry must load model classes first.
         import crudkit.signals  # noqa

crudkit-0.2.3/src/crudkit/authorization.py

@@ -0,0 +1,54 @@
+from django.core.exceptions import PermissionDenied
+from django.db.models import Model, QuerySet
+
+
+def get_permission_action(method: str, view_action: str | None = None) -> str:
+    if view_action in {"create", "initial_data"}:
+        return "add"
+    if view_action in {"update", "partial_update", "merge", "call_action"}:
+        return "change"
+    if view_action == "destroy":
+        return "delete"
+    return "view"
+
+
+def has_model_permission(user, model: type[Model], action: str) -> bool:
+    if not getattr(user, "is_authenticated", False):
+        return False
+    permission = f"{model._meta.app_label}.{action}_{model._meta.model_name}"
+    return user.has_perm(permission)
+
+
+def get_authorized_queryset(user, queryset: QuerySet, action: str = "view") -> QuerySet:
+    model = queryset.model
+    if not has_model_permission(user, model, action):
+        return queryset.none()
+    if getattr(user, "is_superuser", False):
+        return queryset
+
+    settings = getattr(model, "CrudKitSettings", None)
+    authorize = getattr(settings, "get_authorized_queryset", None)
+    return authorize(user, queryset, action) if authorize else queryset
+
+
+def has_object_permission(user, instance: Model, action: str = "view") -> bool:
+    queryset = get_authorized_queryset(user, instance.__class__._default_manager.all(), action)
+    return queryset.filter(pk=instance.pk).exists()
+
+
+def require_object_permission(user, instance: Model, action: str = "view") -> None:
+    if not has_object_permission(user, instance, action):
+        raise PermissionDenied
+
+
+def has_action_permission(user, instance: Model, action_name: str) -> bool:
+    if not has_object_permission(user, instance, "change"):
+        return False
+    settings = getattr(instance.__class__, "CrudKitSettings", None)
+    authorize = getattr(settings, "has_action_permission", None)
+    return authorize(user, instance, action_name) if authorize else True
+
+
+def require_action_permission(user, instance: Model, action_name: str) -> None:
+    if not has_action_permission(user, instance, action_name):
+        raise PermissionDenied

crudkit-0.2.3/src/crudkit/checks.py

@@ -0,0 +1,43 @@
+import re
+from collections import defaultdict
+
+from django.apps import apps
+from django.core.checks import Error, Tags, register
+
+from crudkit.models import BaseCrudKitModel
+
+TYPE_ID_PATTERN = re.compile(r"^[A-Z]{3}$")
+
+
+@register(Tags.models)
+def check_type_ids(app_configs, **kwargs):
+    models_by_type_id = defaultdict(list)
+    errors = []
+
+    for model in apps.get_models():
+        if not issubclass(model, BaseCrudKitModel):
+            continue
+        type_id = getattr(model, "TYPE_ID", None)
+        if not isinstance(type_id, str) or not TYPE_ID_PATTERN.fullmatch(type_id):
+            errors.append(
+                Error(
+                    f"{model._meta.label} must define TYPE_ID as three uppercase letters.",
+                    obj=model,
+                    id="crudkit.E001",
+                )
+            )
+            continue
+        models_by_type_id[type_id].append(model)
+
+    for type_id, models in models_by_type_id.items():
+        if len(models) < 2:
+            continue
+        labels = ", ".join(model._meta.label for model in models)
+        errors.append(
+            Error(
+                f"TYPE_ID {type_id!r} is used by multiple models: {labels}.",
+                id="crudkit.E002",
+            )
+        )
+
+    return errors

crudkit-0.2.3/src/crudkit/migrations/0002_workspace.py

@@ -0,0 +1,83 @@
+# Generated by Django 5.1.15 on 2026-08-20 17:54
+
+import crudkit.models
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("crudkit", "0001_squashed"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Workspace",
+            fields=[
+                (
+                    "id",
+                    crudkit.models.CrudKitIDField(
+                        editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("deleted", models.BooleanField(default=False, editable=False)),
+                ("name", models.CharField(max_length=128)),
+                (
+                    "icon",
+                    models.CharField(
+                        blank=True,
+                        help_text="Icon name shown in the workspace switcher",
+                        max_length=64,
+                        null=True,
+                    ),
+                ),
+                ("public", models.BooleanField(blank=True, default=True)),
+                (
+                    "views",
+                    models.JSONField(
+                        blank=True,
+                        default=list,
+                        encoder=crudkit.models.PrettyJSONEncoder,
+                        help_text='Format: ["VIW1", "VIW2", ...] — tab order follows the list order',
+                    ),
+                ),
+                (
+                    "created_by",
+                    models.ForeignKey(
+                        editable=False,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="%(class)s_created_by_set",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "merged_into",
+                    models.ForeignKey(
+                        blank=True,
+                        editable=False,
+                        null=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="%(class)s_merged_set",
+                        to="crudkit.workspace",
+                    ),
+                ),
+                (
+                    "updated_by",
+                    models.ForeignKey(
+                        editable=False,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="%(class)s_updated_by_set",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ["name"],
+            },
+        ),
+    ]

crudkit-0.2.3/src/crudkit/migrations/0003_enforce_data_invariants.py

@@ -0,0 +1,57 @@
+# Generated by Django 5.1.15 on 2026-08-24 11:38
+
+from django.conf import settings
+from django.db import migrations, models
+from django.db.models import Count, F
+
+
+def close_duplicate_active_worklogs(apps, schema_editor):
+    worklog = apps.get_model("crudkit", "WorkLog")
+    duplicate_users = (
+        worklog.objects.filter(end_at__isnull=True)
+        .values("created_by_id")
+        .annotate(total=Count("id"))
+        .filter(total__gt=1)
+    )
+    for row in duplicate_users:
+        active = worklog.objects.filter(created_by_id=row["created_by_id"], end_at__isnull=True).order_by(
+            "-created_at", "-pk"
+        )
+        keep_id = active.values_list("pk", flat=True).first()
+        active.exclude(pk=keep_id).update(end_at=F("created_at"))
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("contenttypes", "0002_remove_content_type_name"),
+        ("crudkit", "0002_workspace"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name="worklog",
+            unique_together=set(),
+        ),
+        migrations.AddConstraint(
+            model_name="exchangerate",
+            constraint=models.CheckConstraint(
+                condition=models.Q(
+                    ("to_date__isnull", True),
+                    ("to_date__gte", models.F("from_date")),
+                    _connector="OR",
+                ),
+                name="crudkit_exchange_rate_dates_ordered",
+            ),
+        ),
+        migrations.RunPython(close_duplicate_active_worklogs, migrations.RunPython.noop),
+        migrations.AddConstraint(
+            model_name="worklog",
+            constraint=models.UniqueConstraint(
+                condition=models.Q(("end_at__isnull", True)),
+                fields=("created_by",),
+                name="crudkit_one_active_worklog_per_user",
+            ),
+        ),
+    ]

{crudkit-0.2.1 → crudkit-0.2.3}/src/crudkit/models.py

@@ -1,3 +1,4 @@
+import functools
 import re
 
 from django.conf import settings
@@ -20,7 +21,16 @@ def get_ck_id(type_id, pk):
     return f"{type_id}{pk}"
 
 
+@functools.lru_cache(maxsize=None)
+def get_accepted_type_ids(model):
+    """The TYPE_IDs that address a row of `model`: its own, plus those of its
+    multi-table-inheritance children, which share the parent's pk column."""
+    return frozenset(type_id for type_id, mdl in get_model_types().items() if issubclass(mdl, model))
+
+
 def parse_ck_id(ck_id: str) -> tuple[str, int]:
+    if not isinstance(ck_id, str) or not ck_id_regex.fullmatch(ck_id):
+        raise ValueError(f"Invalid CrudKit ID: {ck_id!r}")
     return ck_id[0:3], int(ck_id[3:])
 
 
@@ -58,7 +68,11 @@ class CrudKitIDField(models.BigAutoField):
         if value == "":
             return None
         if type(value) is str and value is not None:
-            type_id, pk = parse_ck_id(value)
+            if value.isdigit():
+                pk = int(value)
+            else:
+                type_id, pk = parse_ck_id(value)
+                self._validate_type_id(type_id)
         else:
             pk = value
         return super().get_prep_value(pk)
@@ -71,10 +85,21 @@ class CrudKitIDField(models.BigAutoField):
         if value == "":
             return super().get_db_prep_value(None, connection, prepared)
         if value is not None:
-            type_id, pk = parse_ck_id(value)
+            if isinstance(value, str) and value.isdigit():
+                pk = int(value)
+            else:
+                type_id, pk = parse_ck_id(value)
+                self._validate_type_id(type_id)
             return super().get_db_prep_value(pk, connection, prepared)
         return super().get_db_prep_value(value, connection, prepared)
 
+    def _validate_type_id(self, type_id):
+        expected = getattr(self.model, "TYPE_ID", None)
+        if expected is None or type_id == expected:
+            return
+        if type_id not in get_accepted_type_ids(self.model):
+            raise ValueError(f"Expected a {expected} ID, got {type_id}")
+
 
 class CrudKitPositiveIntegerField(models.PositiveIntegerField):
     def from_db_value(self, value, expression, connection):
@@ -352,6 +377,14 @@ class BaseCrudKitModel(models.Model):
         # capabilities without touching the framework app.
         assistant_tools = []
 
+        @staticmethod
+        def get_authorized_queryset(user, queryset, action):
+            return queryset
+
+        @staticmethod
+        def has_action_permission(user, instance, action_name):
+            return True
+
     class Meta:
         abstract = True
         ordering = ["id"]
@@ -577,6 +610,12 @@ class View(BaseCrudKitModel):
     class CrudKitSettings(BaseCrudKitModel.CrudKitSettings):
         allowed_prefills = ["model", "fields"]
 
+        @staticmethod
+        def get_authorized_queryset(user, queryset, action):
+            if action == "view":
+                return queryset.filter(models.Q(public=True) | models.Q(created_by=user))
+            return queryset.filter(created_by=user)
+
     @classmethod
     def from_query_params(cls, params, kwargs=None):
         instance = super().from_query_params(params, kwargs)
@@ -585,6 +624,49 @@ class View(BaseCrudKitModel):
         return instance
 
 
+class Workspace(BaseCrudKitModel):
+    TYPE_ID = "WSP"
+
+    name = models.CharField(max_length=128)
+    icon = models.CharField(
+        max_length=64,
+        blank=True,
+        null=True,
+        help_text=_("Icon name shown in the workspace switcher"),
+    )
+    public = models.BooleanField(blank=True, default=True)
+    views = models.JSONField(
+        blank=True,
+        default=list,
+        encoder=PrettyJSONEncoder,
+        help_text='Format: ["VIW1", "VIW2", ...] — tab order follows the list order',
+    )
+
+    class Meta:
+        ordering = ["name"]
+
+    class CrudKitSettings(BaseCrudKitModel.CrudKitSettings):
+        search_fields = ["name"]
+
+        @staticmethod
+        def get_authorized_queryset(user, queryset, action):
+            if action == "view":
+                return queryset.filter(models.Q(public=True) | models.Q(created_by=user))
+            return queryset.filter(created_by=user)
+
+    def __str__(self):
+        return self.name
+
+    def clean(self):
+        if not isinstance(self.views, list):
+            raise ValidationError({"views": _('Format: ["VIW1", "VIW2", ...]')})
+        for ck_id in self.views:
+            if not isinstance(ck_id, str) or not ck_id_regex.match(ck_id) or ck_id[:3] != View.TYPE_ID:
+                raise ValidationError({"views": _(f"'{ck_id}' is not a View id.")})
+            if not View.objects.filter(pk=ck_id).exists():
+                raise ValidationError({"views": _(f"View '{ck_id}' does not exist.")})
+
+
 class FeedItem(BaseCrudKitModel):
     TYPE_ID = "FEI"
 
@@ -767,7 +849,13 @@ class WorkLog(BaseCrudKitModel):
             models.Index(fields=["created_by", "end_at"]),
             models.Index(fields=["related_content_type", "related_object_id"]),
         ]
-        unique_together = [("created_by", "end_at")]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["created_by"],
+                condition=models.Q(end_at__isnull=True),
+                name="crudkit_one_active_worklog_per_user",
+            )
+        ]
 
     def __str__(self):
         return f"Work log on {self.related_object} from {self.created_at}"
@@ -813,6 +901,12 @@ class ExchangeRate(BaseCrudKitModel):
         indexes = [
             models.Index(fields=["currency", "from_date", "to_date"]),
         ]
+        constraints = [
+            models.CheckConstraint(
+                condition=models.Q(to_date__isnull=True) | models.Q(to_date__gte=models.F("from_date")),
+                name="crudkit_exchange_rate_dates_ordered",
+            )
+        ]
 
     def __str__(self):
         to_date_str = f" - {self.to_date}" if self.to_date else " - ongoing"
@@ -822,29 +916,13 @@ class ExchangeRate(BaseCrudKitModel):
         """
         Validate that there are no overlaps for a currency in terms of from_date and to_date.
         """
-        # Set a far future date for "no end date" comparisons
-        far_future = timezone.now().date() + timezone.timedelta(days=36500)
-        effective_to_date = self.to_date or far_future
-
         # Check for start date after end date
         if self.to_date and self.from_date > self.to_date:
             raise ValidationError({"to_date": _("End date must be after start date")})
 
         # Check for overlapping date ranges for the same currency
-        overlapping_query = models.Q(
-            # Overlapping cases:
-            # 1. starts during our range
-            models.Q(from_date__gte=self.from_date, from_date__lte=effective_to_date)
-            |
-            # 2. ends during our range
-            models.Q(to_date__gte=self.from_date, to_date__lte=effective_to_date)
-            |
-            # 3. spans our entire range
-            models.Q(from_date__lte=self.from_date, to_date__gte=effective_to_date)
-            |
-            # 4. our range spans their entire range
-            models.Q(from_date__gte=self.from_date, to_date__lte=effective_to_date)
-        )
+        overlapping_query = models.Q(from_date__lte=self.to_date) if self.to_date else models.Q()
+        overlapping_query &= models.Q(to_date__isnull=True) | models.Q(to_date__gte=self.from_date)
 
         overlapping_filter = ExchangeRate.objects.filter(currency=self.currency).filter(overlapping_query)
 

{crudkit-0.2.1 → crudkit-0.2.3}/src/crudkit/tests/test_fields.py

@@ -1,7 +1,9 @@
+from django.contrib.auth.models import User
 from django.db import connection
 from django.test import TestCase
 
 from crudkit.models import CrudKitIDField, CrudKitPositiveIntegerField, parse_ck_id
+from tests.testapp.models import Comment, Ticket, UrgentComment
 
 
 class TestModel:
@@ -121,3 +123,32 @@ class CrudKitPositiveIntegerFieldTests(TestCase):
             pk = 42
 
         self.assertEqual(self.field.get_prep_value(_FakeInstance()), 42)
+
+
+class SubclassCkIdLookupTests(TestCase):
+    """A multi-table-inheritance child shares the parent's pk column, so both the
+    parent's and the child's TYPE_ID address the same row."""
+
+    def setUp(self):
+        self.user = User.objects.create_user(username="fielduser", password="pw")
+        self.ticket = Ticket.objects.create(subject="Broken invoice", created_by=self.user, updated_by=self.user)
+        self.comment = UrgentComment.objects.create(
+            ticket=self.ticket,
+            body="Test content",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+        self.pk = int(str(self.comment.pk).removeprefix("COM").removeprefix("URG"))
+
+    def test_lookup_by_child_type_id(self):
+        self.assertEqual(UrgentComment.objects.get(pk=f"URG{self.pk}"), self.comment)
+
+    def test_lookup_by_parent_type_id(self):
+        self.assertEqual(UrgentComment.objects.get(pk=f"COM{self.pk}"), self.comment)
+
+    def test_parent_queryset_accepts_child_type_id(self):
+        self.assertEqual(Comment.objects.get(pk=f"URG{self.pk}").pk, self.comment.pk)
+
+    def test_unrelated_type_id_still_rejected(self):
+        with self.assertRaises(ValueError):
+            UrgentComment.objects.get(pk=f"TIC{self.pk}")

crudkit-0.2.3/src/crudkit/tests/test_integrity.py

@@ -0,0 +1,100 @@
+from datetime import date
+from decimal import Decimal
+from unittest.mock import patch
+
+from django.contrib.auth.models import User
+from django.contrib.contenttypes.models import ContentType
+from django.core.exceptions import ValidationError
+from django.db import IntegrityError, transaction
+from django.test import TestCase
+
+from crudkit.checks import check_type_ids
+from crudkit.models import ExchangeRate, WorkLog, parse_ck_id
+from tests.testapp.models import Customer, Topic
+
+
+class CrudKitIDTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username="ids", password="pw")
+        self.customer = Customer.objects.create(
+            name="Customer",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+        self.topic = Topic.objects.create(
+            name="Topic",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+
+    def test_wrong_model_prefix_is_rejected(self):
+        with self.assertRaises(ValueError):
+            Customer.objects.get(pk=self.topic.pk)
+
+    def test_parse_rejects_malformed_ids(self):
+        for value in ("CUS", "CUS1x", "cus1", "1"):
+            with self.subTest(value=value), self.assertRaises(ValueError):
+                parse_ck_id(value)
+
+    def test_system_check_rejects_duplicate_type_ids(self):
+        with (
+            patch.object(Topic, "TYPE_ID", Customer.TYPE_ID),
+            patch("crudkit.checks.apps.get_models", return_value=[Customer, Topic]),
+        ):
+            errors = check_type_ids(None)
+        self.assertEqual([error.id for error in errors], ["crudkit.E002"])
+
+
+class DatabaseInvariantTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username="integrity", password="pw")
+        self.customer = Customer.objects.create(
+            name="Customer",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+
+    def test_only_one_active_worklog_per_user(self):
+        content_type = ContentType.objects.get_for_model(self.customer)
+        values = {
+            "related_content_type": content_type,
+            "related_object_id": self.customer.pk,
+            "created_by": self.user,
+            "updated_by": self.user,
+        }
+        WorkLog.objects.create(**values)
+
+        with self.assertRaises(IntegrityError), transaction.atomic():
+            WorkLog.objects.create(**values)
+
+    def test_exchange_rate_rejects_overlap_with_open_interval(self):
+        ExchangeRate.objects.create(
+            currency="USD",
+            from_date=date(2024, 1, 1),
+            to_date=None,
+            rate=Decimal("7.00"),
+            created_by=self.user,
+            updated_by=self.user,
+        )
+        overlapping = ExchangeRate(
+            currency="USD",
+            from_date=date(2025, 1, 1),
+            to_date=date(2025, 12, 31),
+            rate=Decimal("7.10"),
+            created_by=self.user,
+            updated_by=self.user,
+        )
+
+        with self.assertRaises(ValidationError):
+            overlapping.full_clean()
+
+    def test_exchange_rate_database_constraint_orders_dates(self):
+        with self.assertRaises(IntegrityError), transaction.atomic():
+            ExchangeRate.objects.create(
+                currency="USD",
+                from_date=date(2025, 2, 1),
+                to_date=date(2025, 1, 1),
+                rate=Decimal("7.00"),
+                created_by=self.user,
+                updated_by=self.user,
+            )