django-cfg 2.3.332__tar.gz → 2.3.334__tar.gz

{django_cfg-2.3.332 → django_cfg-2.3.334}/CHANGELOG.md

@@ -8,6 +8,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- **`admin_access`: where the Django admin lives and who may reach it.**
+  `AdminAccessConfig` on `DjangoConfig.admin_access`. Scanners probe `/admin/`
+  on every host; the location and availability are now core-config settings,
+  not a line hard-wired in each project's `urls.py`.
+  - `enabled` (default `True`): `False` mounts nothing, so the route answers
+    404, nothing links to it, and management commands are unaffected.
+  - `path` (default `"admin/"`): the URL prefix. No leading slash, ends with a
+    slash, URL-safe characters only, no `..`; anything else fails at startup.
+  - `allowed_networks` (default `[]`): a CIDR allowlist (IPv4/IPv6). When set,
+    any request under the admin prefix from outside it gets **404, never
+    403**. The address is `REMOTE_ADDR`, which `RealIPMiddleware` rewrites from
+    `CF-Connecting-IP` / `X-Forwarded-For`; that is only trustworthy when the
+    app is reachable through the proxy alone. Defence in depth: the primary
+    control belongs at the proxy (Traefik, Cloudflare).
+  - Env, the same nested `__` style as `DATABASE__URL`: `ADMIN_ACCESS__ENABLED`,
+    `ADMIN_ACCESS__PATH`, `ADMIN_ACCESS__ALLOWED_NETWORKS` (comma-separated or a
+    JSON list). It works for a project that never mentions `admin_access`; a
+    value passed in code wins over env.
+  - One-line wiring: `*admin_urlpatterns()` (`from django_cfg import
+    admin_urlpatterns`) replaces `path("admin/", admin.site.urls)` and returns
+    `[]` when disabled. The old line keeps working untouched.
+  - The framework's own staff surface under `/cfg/admin/` (dashboard tabs, the
+    Next.js admin) follows the same `enabled` / allowlist rules.
+  - New system checks, both warnings: `django_cfg.W011` (production with the
+    admin at the default `/admin/`; suggests `secrets.token_urlsafe`) and
+    `django_cfg.W012` (`admin_access` asks for a path or `enabled=False` but the
+    admin is still mounted elsewhere, e.g. a hard-coded `path("admin/", ...)`,
+    so setting only the env var would change nothing). **W011 becomes an error
+    in a later release**; existing projects start unchanged today.
+  - Anything that assumed `/admin/` now reads the configured prefix:
+    `PublicEndpointsMiddleware`, admin login notifications, `NoIndexMiddleware`
+    (no-store), dashboard quick actions, the `get_admin_url` tag, extension
+    navigation links, the URL list and endpoint-status tools, the Unfold search
+    and badge callbacks. With the admin disabled the dashboard quick actions
+    omit it and `get_admin_url` returns `""`.
+  - **Behaviour change:** `/cfg/admin/dashboard/` (staff-only, opened inside the
+    admin) now answers 404 to anyone who is not staff, where it used to redirect
+    to `admin:login`. The redirect failed with the admin disabled, and with a
+    moved admin it told an anonymous scanner where the admin lives.
 - **IndexNow — push changed sitemap URLs to Bing, Yandex, Seznam, Naver.**
   `IndexNowConfig` on `DjangoConfig.indexnow`. It reads the registered
   sitemap sources with the feed's template and fields, so IndexNow never

{django_cfg-2.3.332 → django_cfg-2.3.334}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-cfg
-Version: 2.3.332
+Version: 2.3.334
 Summary: Modern Django framework with type-safe Pydantic v2 configuration, Next.js admin integration, and 8 enterprise apps. Replace settings.py with validated models,  90% less code. Production-ready with AI agents, auto-generated TypeScript clients,  and zero-config features.
 Project-URL: Homepage, https://djangocfg.com
 Project-URL: Documentation, https://djangocfg.com

{django_cfg-2.3.332 → django_cfg-2.3.334}/pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "django-cfg"
-version = "2.3.332"
+version = "2.3.334"
 description = "Modern Django framework with type-safe Pydantic v2 configuration, Next.js admin integration,\nand 8 enterprise apps. Replace settings.py with validated models, \n90% less code. Production-ready with AI agents, auto-generated TypeScript clients, \nand zero-config features.\n"
 readme = "README.md"
 keywords = [

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/__init__.py

@@ -32,7 +32,7 @@ Example:
 default_app_config = "django_cfg.apps.DjangoCfgConfig"
 
 # Version information
-__version__ = "2.3.332"
+__version__ = "2.3.334"
 __license__ = "MIT"
 
 # Setup warnings debug early (checks env var only at this point)
@@ -56,6 +56,7 @@ __author__ = LIB_NAME
 # ---------------------------------------------------------------------------
 from .core.config import DjangoConfig, StartupInfoMode, set_current_config
 from .core.integration import add_django_cfg_urls, get_django_cfg_urls_info
+from .core.admin_access import admin_urlpatterns
 from .core.exceptions import (
     DjangoCfgException,
     ConfigurationError,
@@ -94,6 +95,7 @@ from .models.django.rq_health import QueueHealthThresholds, RQHealthConfig
 from .modules.django_logging.__cfg__ import DjangoLoggingConfig
 from .models.django.currency import CurrencyConfig
 from .models.django.payments import PaymentsConfig
+from .models.django.admin_access import AdminAccessConfig
 from .models.django.geo import GeoConfig
 from .models.django.indexnow import IndexNowConfig, IndexNowSite
 from .models.django.analytics import AnalyticsConfig
@@ -260,7 +262,7 @@ __all__ = [
     "LIB_NAME", "LIB_SITE_URL", "LIB_HEALTH_URL", "get_default_dropdown_items",
     # core
     "DjangoConfig", "StartupInfoMode", "set_current_config",
-    "add_django_cfg_urls", "get_django_cfg_urls_info",
+    "add_django_cfg_urls", "get_django_cfg_urls_info", "admin_urlpatterns",
     "DjangoCfgException", "ConfigurationError", "ValidationError",
     "DatabaseError", "CacheError", "EnvironmentError",
     "get_ticket_url", "get_otp_url", "get_media_url", "build_media_url", "build_api_url", "get_api_url",
@@ -275,7 +277,7 @@ __all__ = [
     "DjangoRQConfig", "RQQueueConfig", "RQScheduleConfig",
     "RQHealthConfig", "QueueHealthThresholds",
     "DjangoLoggingConfig",
-    "CurrencyConfig", "PaymentsConfig", "GeoConfig", "IndexNowConfig", "IndexNowSite", "AnalyticsConfig", "SimpleHistoryConfig",
+    "CurrencyConfig", "PaymentsConfig", "AdminAccessConfig", "GeoConfig", "IndexNowConfig", "IndexNowSite", "AnalyticsConfig", "SimpleHistoryConfig",
     "ConstanceConfig", "ConstanceField", "StorageConfig", "FileCleanupConfig", "S3StorageConfig", "OpenAPIClientConfig",
     "EmailConfig", "TelegramConfig",
     # middleware (lazy — DRF reads settings at import time)

django_cfg-2.3.334/src/django_cfg/appconfig.py

@@ -0,0 +1,73 @@
+"""
+Django app configuration for django_cfg.
+
+Lives here, not in `apps.py`: the package `django_cfg/apps/` shadows a module of
+that name, so Django never saw an AppConfig defined in it and ready() never ran.
+`django_cfg/apps/__init__.py` re-exports DjangoCfgConfig, which is what Django
+looks for when it resolves the "django_cfg" INSTALLED_APPS entry.
+
+Each startup concern lives in its own module under django_cfg/startup/:
+  constance.py          — Constance + Unfold admin registration
+  drf_patch.py          — JWT-aware DRF authentication patch
+  mime_types.py         — Media types a slim container image leaves out
+  type_stubs.py         — Auto-install DRF validated_data type stubs (dev only)
+  registry_validation.py — Validate DJANGO_CFG_REGISTRY entries at startup
+  command_shadowing.py  — Warn when a project command shares a name with a django-cfg one
+  admin_access.py       — Warn about the default /admin/ in production and unwired admin_access
+"""
+
+import logging
+
+from django.apps import AppConfig
+
+logger = logging.getLogger("django_cfg.startup")
+
+
+def _run_hook(hook) -> None:
+    """Run one startup hook; a failure is logged, never raised."""
+    try:
+        hook()
+    except Exception as exc:  # noqa: BLE001 - startup must never crash on an optional hook
+        logger.warning("django_cfg startup hook %s failed: %s", getattr(hook, "__name__", hook), exc)
+
+
+class DjangoCfgConfig(AppConfig):
+    """Configuration for django_cfg app."""
+
+    # Explicit: Django picks this config for the bare "django_cfg" entry.
+    default = True
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "django_cfg"
+    verbose_name = "Django Configuration"
+
+    def ready(self) -> None:
+        """Called when Django is ready — run all startup hooks.
+
+        Every optional hook is isolated: a failure logs a warning and never
+        stops the process. Each hook is idempotent (ready() may run twice).
+        """
+        try:
+            # Import registers the check; nothing to call.
+            from django_cfg.startup import command_shadowing  # noqa: F401
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("django_cfg command_shadowing check not registered: %s", exc)
+        try:
+            from django_cfg.startup import admin_access  # noqa: F401  (registers the check)
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("django_cfg admin_access check not registered: %s", exc)
+        from django_cfg.startup.constance import register_constance_admin
+        from django_cfg.startup.drf_patch import patch_drf_authentication
+        from django_cfg.startup.mime_types import register_media_types
+        from django_cfg.startup.registry_validation import validate_registry
+        from django_cfg.startup.type_stubs import install_type_stubs
+
+        # First: django-storages reads `mimetypes` when it uploads, so the
+        # table has to be complete before anything can write a file.
+        for hook in (
+            register_media_types,
+            register_constance_admin,
+            install_type_stubs,
+            patch_drf_authentication,
+            validate_registry,
+        ):
+            _run_hook(hook)

django_cfg-2.3.334/src/django_cfg/apps/__init__.py

@@ -0,0 +1,10 @@
+"""
+django_cfg.apps — package of django-cfg sub-apps (system, api, payments, tools).
+
+Django resolves the INSTALLED_APPS entry "django_cfg" by importing
+`django_cfg.apps` and picking the AppConfig subclass found there. This package
+(not a module) is what that import returns, so the config is re-exported here.
+Keep this file light: no models and no heavy imports at import time.
+"""
+
+from django_cfg.appconfig import DjangoCfgConfig  # noqa: F401

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/apps/api/dashboard/services/system_health_service.py

@@ -258,12 +258,16 @@ class SystemHealthService:
                 self.logger.debug(f"Could not reverse URL '{url_name}', using fallback: {fallback}")
                 return fallback
 
-        actions = [
+        from django_cfg.core.admin_access import get_admin_prefix, get_mounted_admin_prefix
+
+        admin_prefix = get_admin_prefix()
+
+        admin_actions = [
             {
                 'title': 'Admin Panel',
                 'description': 'Open Django admin interface',
                 'icon': 'admin_panel_settings',
-                'link': safe_reverse('admin:index', '/admin/'),
+                'link': safe_reverse('admin:index', admin_prefix),
                 'color': 'primary',
                 'category': 'admin',
             },
@@ -271,7 +275,7 @@ class SystemHealthService:
                 'title': 'User Management',
                 'description': 'Manage users and permissions',
                 'icon': 'people',
-                'link': safe_reverse('admin:auth_user_changelist', '/admin/auth/user/'),
+                'link': safe_reverse('admin:auth_user_changelist', admin_prefix + 'auth/user/'),
                 'color': 'primary',
                 'category': 'admin',
             },
@@ -279,10 +283,13 @@ class SystemHealthService:
                 'title': 'Settings',
                 'description': 'Configure application settings',
                 'icon': 'settings',
-                'link': safe_reverse('admin:constance_config_changelist', '/admin/constance/config/'),
+                'link': safe_reverse('admin:constance_config_changelist', admin_prefix + 'constance/config/'),
                 'color': 'default',
                 'category': 'admin',
             },
+        ]
+
+        actions = [
             {
                 'title': 'System Health',
                 'description': 'Check system health status',
@@ -325,4 +332,8 @@ class SystemHealthService:
             },
         ]
 
+        # No admin route (admin_access.enabled=False): do not link to it.
+        if get_mounted_admin_prefix() is not None:
+            actions = admin_actions + actions
+
         return actions

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/apps/api/endpoints/endpoints_status/checker.py

@@ -75,6 +75,12 @@ def should_check_endpoint(url_pattern: str, url_name: Optional[str] = None) -> b
         if re.match(pattern, url_pattern):
             return False
 
+    # The admin may live elsewhere than /admin/ (admin_access.path)
+    from django_cfg.core.admin_access import get_admin_path
+
+    if url_pattern.lstrip('/').startswith(get_admin_path()):
+        return False
+
     # Exclude DRF format suffix patterns (e.g., \.(?P<format>[a-z0-9]+))
     # These cause "got an unexpected keyword argument 'format'" errors in action methods
     if r'\.(?P<format>' in url_pattern or '<drf_format_suffix:' in url_pattern:

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/apps/api/endpoints/urls_list/views.py

@@ -108,7 +108,10 @@ class DRFURLsListView(APIView):
         if filter_type == 'api':
             return [url for url in urls if url['pattern'].startswith('api/')]
         elif filter_type == 'admin':
-            return [url for url in urls if url['pattern'].startswith('admin/')]
+            from django_cfg.core.admin_access import get_admin_path
+
+            admin_path = get_admin_path()
+            return [url for url in urls if url['pattern'].startswith(admin_path)]
         elif filter_type == 'cfg':
             return [url for url in urls if url['pattern'].startswith('cfg/')]
         else:

django_cfg-2.3.334/src/django_cfg/core/admin_access.py

@@ -0,0 +1,85 @@
+"""Single source of truth for where the admin is mounted.
+
+Everything that used to assume `/admin/` (middleware, notifications, nav
+fallbacks, the project's own `urls.py`) asks here instead.
+
+Truth order for the prefix: what is actually mounted (`reverse("admin:index")`)
+wins, because a project may still hard-code `path("admin/", ...)` or any other
+prefix; the configured `admin_access.path` is the fallback for when no admin
+route exists yet or at all.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, List, Optional
+
+from django.urls import URLPattern, get_script_prefix, path, reverse
+
+if TYPE_CHECKING:
+    from ..models.django.admin_access import AdminAccessConfig
+
+# The framework's own staff-only surface (dashboard tabs, Next.js admin). It
+# belongs to the admin, so it follows the same enabled / allowlist rules.
+CFG_ADMIN_PREFIX = "/cfg/admin/"
+
+
+def get_admin_access() -> "AdminAccessConfig":
+    """The active config, or a default one (env-aware) when none is registered."""
+    from ..models.django.admin_access import AdminAccessConfig
+    from .state.registry import get_current_config
+
+    config = get_current_config()
+    access = getattr(config, "admin_access", None) if config is not None else None
+    return access if access is not None else AdminAccessConfig()
+
+
+def get_mounted_admin_prefix() -> Optional[str]:
+    """`/<path>/` where the admin is actually mounted, or None if it is not."""
+    try:
+        url = reverse("admin:index")
+    except Exception:  # noqa: BLE001 - NoReverseMatch, or a broken URLconf: never take callers down
+        return None
+    # An admin mounted at the root claims every URL; it cannot name a prefix.
+    return None if url == get_script_prefix() else url
+
+
+def get_admin_prefix() -> str:
+    """Absolute URL prefix of the admin, with leading and trailing slash."""
+    return get_mounted_admin_prefix() or get_script_prefix() + get_admin_access().path
+
+
+def get_admin_path() -> str:
+    """Admin prefix relative to the script prefix, no leading slash (`admin/`)."""
+    return get_admin_prefix()[len(get_script_prefix()):]
+
+
+def is_admin_path(request_path: str) -> bool:
+    """True for the admin prefix itself (`/admin`) and everything below it."""
+    prefix = get_admin_prefix()
+    return (request_path if request_path.endswith("/") else request_path + "/").startswith(prefix)
+
+
+def is_guarded_path(request_path: str) -> bool:
+    """Admin or the framework's staff surface under /cfg/admin/."""
+    if is_admin_path(request_path):
+        return True
+    return (request_path if request_path.endswith("/") else request_path + "/").startswith(
+        get_script_prefix().rstrip("/") + CFG_ADMIN_PREFIX
+    )
+
+
+def admin_urlpatterns(site=None) -> List[URLPattern]:
+    """The admin route for `urls.py`, honouring `admin_access`.
+
+        urlpatterns = [*admin_urlpatterns(), ...]
+
+    Returns `[]` when the admin is disabled, so it is simply not routed.
+    """
+    access = get_admin_access()
+    if not access.enabled:
+        return []
+    if site is None:
+        from django.contrib import admin
+
+        site = admin.site
+    return [path(access.path, site.urls)]

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/core/base/config_model.py

@@ -33,6 +33,7 @@ from ...models import (
     EmailConfig,
     GeoConfig,
     IndexNowConfig,
+    AdminAccessConfig,
     PaymentsConfig,
     SimpleHistoryConfig,
     GitHubOAuthConfig,
@@ -244,6 +245,13 @@ class DjangoConfig(BaseModel):
         ),
     )
 
+    # An instance, not None: env (ADMIN_ACCESS__*) must work for a project that
+    # never mentions it, so an operator can move or close the admin per deploy.
+    admin_access: AdminAccessConfig = Field(
+        default_factory=AdminAccessConfig,
+        description="Django admin availability, URL prefix and optional CIDR allowlist",
+    )
+
     # ╔══════════════════════════════════════════════════════════════════════════╗
     # ║                               CACHE                                       ║
     # ╚══════════════════════════════════════════════════════════════════════════╝

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/core/builders/middleware_builder.py

@@ -16,6 +16,7 @@ if TYPE_CHECKING:
 
 REAL_IP_MIDDLEWARE = 'django_cfg.middleware.real_ip.RealIPMiddleware'
 NOINDEX_MIDDLEWARE = 'django_cfg.core.middleware.noindex.NoIndexMiddleware'
+ADMIN_ACCESS_MIDDLEWARE = 'django_cfg.middleware.admin_access.AdminAccessMiddleware'
 
 
 class MiddlewareBuilder:
@@ -66,6 +67,13 @@ class MiddlewareBuilder:
         if not self.config.search_indexing:
             middleware.append(NOINDEX_MIDDLEWARE)
 
+        # Right after Real IP (it reads the real client IP) and before anything
+        # that does work for a request that will 404. Only when it can act, so a
+        # default project's MIDDLEWARE is unchanged.
+        access = self.config.admin_access
+        if not access.enabled or access.allowed_networks:
+            middleware.append(ADMIN_ACCESS_MIDDLEWARE)
+
         # Default middleware (includes CorsMiddleware)
         middleware.extend(DEFAULT_MIDDLEWARE)
 

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/core/integration/setup_types.py

@@ -33,15 +33,18 @@ def _get_version() -> str:
         return "unknown"
 
 
-def _find_project_root() -> Path:
-    """Walk up from cwd to find project root (contains manage.py or pyrightconfig.json)."""
+def _find_project_root() -> Path | None:
+    """Walk up from cwd to find project root (contains manage.py or pyrightconfig.json).
+
+    Returns None when there is none: stubs are never written into an arbitrary cwd.
+    """
     cwd = Path.cwd()
     for directory in [cwd, *cwd.parents]:
         if (directory / "manage.py").exists() or (directory / "pyrightconfig.json").exists():
             return directory
         if directory == directory.parent or directory == Path.home():
             break
-    return cwd
+    return None
 
 
 def _get_stubs_source() -> Path:
@@ -118,6 +121,8 @@ def install(force: bool = False) -> None:
     Safe to call multiple times — re-runs only when django-cfg version changes.
     """
     project_root = _find_project_root()
+    if project_root is None:
+        return
     version = _get_version()
 
     if not force and _is_current_version_installed(project_root, version):

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/core/integration/url_integration.py

@@ -145,11 +145,13 @@ def add_django_cfg_urls(urlpatterns: List[URLPattern]) -> List[URLPattern]:
 
     Example:
         # In your main urls.py
-        from django_cfg import add_django_cfg_urls
+        from django_cfg import add_django_cfg_urls, admin_urlpatterns
 
         urlpatterns = [
             path("", home_view, name="home"),
-            path("admin/", admin.site.urls),
+            # Honours config.admin_access (enabled / path); [] when disabled.
+            # The old `path("admin/", admin.site.urls)` keeps working.
+            *admin_urlpatterns(),
         ]
 
         # Automatically adds django_cfg URLs with proper prefixes

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/core/middleware/noindex.py

@@ -12,11 +12,13 @@ from typing import Callable
 
 from django.http import HttpRequest, HttpResponse
 
+from django_cfg.core.admin_access import is_admin_path
+
 X_ROBOTS_TAG = "noindex, nofollow, noarchive"
 
 
 class NoIndexMiddleware:
-    """Add `X-Robots-Tag` to every response; no-store on /cfg/ and /admin/."""
+    """Add `X-Robots-Tag` to every response; no-store on /cfg/ and the admin."""
 
     def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
         self.get_response = get_response
@@ -24,6 +26,6 @@ class NoIndexMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         response = self.get_response(request)
         response["X-Robots-Tag"] = X_ROBOTS_TAG
-        if request.path.startswith(("/cfg/", "/admin/")):
+        if request.path.startswith("/cfg/") or is_admin_path(request.path):
             response["Cache-Control"] = "no-cache, no-store, must-revalidate"
         return response

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/extensions/configs/apps/base/navigation.py

@@ -27,7 +27,7 @@ class NavigationItem(UnfoldNavigationItem):
             app="payments",      # Extension name
             model="payment",     # Model name
         )
-        # Generates: /admin/cfg_payments/payment/
+        # Generates: <admin prefix>cfg_payments/payment/
     """
 
     # Extension shortcut: app + model -> auto-generates admin URL
@@ -43,7 +43,9 @@ class NavigationItem(UnfoldNavigationItem):
             from django_cfg.modules.django_unfold.utils import auto_resolve_url
             return auto_resolve_url(self.link)
         if self.app and self.model:
-            return f"/admin/{APP_LABEL_PREFIX}{self.app}/{self.model}/"
+            from django_cfg.core.admin_access import get_admin_prefix
+
+            return f"{get_admin_prefix()}{APP_LABEL_PREFIX}{self.app}/{self.model}/"
         return "#"
 
     def get_link_for_unfold(self):

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/extensions/configs/apps/base/settings.py

@@ -74,7 +74,9 @@ class BaseExtensionSettings(BaseModel):
         Returns:
             Admin changelist URL (e.g., "/admin/cfg_payments/payment/")
         """
-        return f"/admin/{self.full_app_label}/{model}/"
+        from django_cfg.core.admin_access import get_admin_prefix
+
+        return f"{get_admin_prefix()}{self.full_app_label}/{model}/"
 
     # Features
     admin_enabled: bool = Field(default=True, description="Enable admin interface")

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/management/commands/superuser.py

@@ -238,7 +238,12 @@ class Command(InteractiveCommand):
         """Show next steps after creating superuser"""
         self.stdout.write(self.style.SUCCESS('\n🎉 Next Steps:'))
         self.stdout.write('1. 🚀 Start your Django server: python manage.py runserver')
-        self.stdout.write('2. 🌐 Visit Django admin: http://localhost:8000/admin/')
+        from django_cfg.core.admin_access import get_admin_prefix, get_mounted_admin_prefix
+
+        if get_mounted_admin_prefix() is not None:
+            self.stdout.write(f'2. 🌐 Visit Django admin: http://localhost:8000{get_admin_prefix()}')
+        else:
+            self.stdout.write('2. 🌐 The admin is disabled (admin_access.enabled=False)')
         self.stdout.write('3. 🔑 Login with your superuser credentials')
         self.stdout.write('4. ⚙️  Configure your application settings')
         self.stdout.write('5. 📚 Read the Django Config Toolkit documentation')

django_cfg-2.3.334/src/django_cfg/middleware/admin_access.py

@@ -0,0 +1,52 @@
+"""Answer 404 for the admin surface when it is closed to the caller.
+
+Two cases, both silent (404, never 403: do not reveal that the route exists):
+
+- `admin_access.enabled` is False: nothing under the admin prefix is served,
+  even if a project still hard-codes `path("admin/", ...)`.
+- `admin_access.allowed_networks` is set: only those networks get through.
+
+Defence in depth. The primary control belongs at the proxy (Traefik,
+Cloudflare). The caller IP is `REMOTE_ADDR`, which `RealIPMiddleware` rewrites
+from CF-Connecting-IP / X-Forwarded-For; those headers are only trustworthy
+when the app is reachable through the proxy alone.
+
+The builder adds this middleware only when it can act, so a default project's
+MIDDLEWARE is unchanged.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+from typing import Callable, Optional
+
+from django.http import Http404, HttpRequest, HttpResponse
+
+from django_cfg.core.admin_access import get_admin_access, is_guarded_path
+
+
+def client_ip(request: HttpRequest):
+    """`REMOTE_ADDR` as an address object (IPv4-mapped IPv6 unwrapped), or None."""
+    raw = request.META.get("REMOTE_ADDR", "")
+    try:
+        ip = ipaddress.ip_address(raw.strip())
+    except ValueError:
+        return None
+    return ip.ipv4_mapped or ip if ip.version == 6 else ip
+
+
+class AdminAccessMiddleware:
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        access = get_admin_access()
+        if (not access.enabled or access.allowed_networks) and is_guarded_path(request.path):
+            if not access.enabled or not self._allowed(request, access.networks):
+                raise Http404
+        return self.get_response(request)
+
+    @staticmethod
+    def _allowed(request: HttpRequest, networks) -> bool:
+        ip = client_ip(request)
+        return ip is not None and any(ip in network for network in networks)

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/middleware/admin_notifications.py

@@ -18,6 +18,7 @@ from django.contrib.auth.signals import user_logged_in
 from django.dispatch import receiver
 from django.utils import timezone
 
+from django_cfg.core.admin_access import is_admin_path
 from django_cfg.modules.django_telegram import DjangoTelegram
 
 logger = logging.getLogger(__name__)
@@ -36,7 +37,7 @@ def notify_admin_login_success(sender, request, user, **kwargs):
     Send Telegram notification on successful admin panel login.
 
     Triggers only for:
-    - Requests to /admin/ paths
+    - Requests under the admin prefix (`admin_access.path`)
     - Users with staff or superuser permissions
 
     Notification includes:
@@ -52,7 +53,7 @@ def notify_admin_login_success(sender, request, user, **kwargs):
         **kwargs: Additional signal arguments
     """
     # Only monitor admin panel logins
-    if not request or not request.path.startswith('/admin/'):
+    if not request or not is_admin_path(request.path):
         return
 
     # Only monitor staff/superuser access
@@ -109,7 +110,7 @@ try:
             **kwargs: Additional signal arguments
         """
         # Only monitor admin panel
-        if not request or not request.path.startswith('/admin/'):
+        if not request or not is_admin_path(request.path):
             return
 
         # Handle missing credentials
@@ -151,7 +152,7 @@ try:
             **kwargs: Additional signal arguments
         """
         # Only monitor admin panel
-        if not request or not request.path.startswith('/admin/'):
+        if not request or not is_admin_path(request.path):
             return
 
         # Handle missing credentials

{django_cfg-2.3.332 → django_cfg-2.3.334}/src/django_cfg/middleware/authentication.py

@@ -68,6 +68,9 @@ def _patch_drf_authenticate():
 
         self._not_authenticated()
 
+    if getattr(DRFRequest._authenticate, "_django_cfg_jwt_aware", False):
+        return  # already applied (module import and AppConfig.ready() both call this)
+    _jwt_aware_authenticate._django_cfg_jwt_aware = True  # type: ignore[attr-defined]
     DRFRequest._authenticate = _jwt_aware_authenticate  # type: ignore[method-assign]
 
 
@@ -75,7 +78,7 @@ def _patch_drf_authenticate():
 # This module is always imported by DRF before the first request because
 # 'django_cfg.middleware.authentication.JWTAuthenticationWithLastLogin' is in
 # DEFAULT_AUTHENTICATION_CLASSES — DRF imports it on first authenticate() call.
-# The patch is idempotent: re-running it is safe (replaces the same method again).
+# The patch is idempotent: a marker on the patched method makes a second call a no-op.
 # DjangoCfgConfig.ready() also calls it for even earlier application.
 _patch_drf_authenticate()