django-dg-core 1.0.0__tar.gz

django_dg_core-1.0.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+.venv/
+*.egg-info/
+dist/
+build/
+.env
+*.sqlite3
+.DS_Store
+
+# The example project
+example/db.sqlite3
+example/media/
+
+# Jasper's own instructions for agents
+CLAUDE.local.md

django_dg_core-1.0.0/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog of django-dg-core
+
+## 1.0.0 (2026-11-07)
+
+The first release: the one MCP endpoint for every installed DataGroceries app, the checks on every way in
+(registered token packages and the project's own DRF authentication, with the `401` that points MCP
+clients at their authorization server), people as a Django permission per app and one `People` class,
+notifications by email and Slack with fallback, each in its person's language, @-mentions of the people
+of an area, what names something of one app in another's text, what the apps' REST APIs share, DataGroceries'
+own layout with its assets, a switch between the apps and a language switch, Markdown rendering and the
+Markdown editor, with writing help each app adds to, and references between apps, which may be relative
+to what the text belongs to (and for a page of its own, such as a wiki page, anchors on its headings for
+a table of contents), attachments each app keeps in a table of its own and serves so that no file runs as
+a page, English and Dutch, one URL include, and system checks. Django 5.2 LTS and 6.x, Python 3.11 and
+newer.

django_dg_core-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jasper Cramwinckel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_dg_core-1.0.0/PKG-INFO

@@ -0,0 +1,64 @@
+Metadata-Version: 2.5
+Name: django-dg-core
+Version: 1.0.0
+Summary: What the DataGroceries apps share: one MCP endpoint for all of them, people, notifications, and the checks on every way in.
+Project-URL: Homepage, https://github.com/datagroceries/django-dg
+Project-URL: Source, https://github.com/datagroceries/django-dg
+Project-URL: Documentation, https://github.com/datagroceries/django-dg/blob/main/docs/integrating.md
+Project-URL: Changelog, https://github.com/datagroceries/django-dg/blob/main/packages/django-dg-core/CHANGELOG.md
+Author: Jasper Cramwinckel
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai agents,claude,django,mcp,model context protocol
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Requires-Python: >=3.11
+Requires-Dist: django-simple-history
+Requires-Dist: django>=5.2
+Requires-Dist: djangorestframework
+Requires-Dist: markdown
+Requires-Dist: nh3
+Requires-Dist: pymdown-extensions
+Requires-Dist: requests
+Description-Content-Type: text/markdown
+
+# django-dg-core
+
+What the [DataGroceries](https://github.com/datagroceries/django-dg) apps share. You do not install it on its own: every DataGroceries
+app, such as [django-dg-board](https://pypi.org/project/django-dg-board/), brings it along.
+
+- **One MCP endpoint for every installed app** (`dg/mcp`). Each app registers its tools; an agent
+  connects once and gets them all. A tool runs the app's own REST view, so the API and the tools follow
+  the same rules. Stateless, over plain HTTP, so it runs on any WSGI server.
+- **The checks on every way in.** Core issues no tokens: it lets in whatever the project and the DataGroceries
+  packages register (personal tokens and the Claude connector's OAuth from
+  [django-dg-connect](https://pypi.org/project/django-dg-connect/), or the project's own DRF
+  authentication), and on every request checks that the person may still use the app and that the
+  token covers it. A request without credentials gets a `401` that tells MCP clients where to sign in.
+- **People.** Who may use an app is a Django permission; how DataGroceries names people, their @-handles,
+  their email address and their image come from one class a project may subclass. No assumptions about
+  the user model.
+- **Notifications** by email, Slack, or Slack with email as fallback, once the change is committed.
+- **A layout of its own**, with Bootstrap and Bootstrap Icons in the package, so the apps' pages work in
+  any project; override one template to show them in yours.
+- **Markdown**, rendered and sanitised the same way in every app (GitHub's lists, tables, task lists),
+  with the Markdown editor, and **references between apps**: an app registers what it recognises in text,
+  such as the board's ticket keys, and every app's Markdown links it while that app is installed.
+- **One URL include** for every app, and **system checks** that say what a project still has to add.
+
+Django 5.2 LTS and 6.x, Python 3.11 and newer. How to install the apps, and every setting, is in
+[docs/integrating.md](https://github.com/datagroceries/django-dg/blob/main/docs/integrating.md).
+
+MIT licensed.

django_dg_core-1.0.0/README.md

@@ -0,0 +1,28 @@
+# django-dg-core
+
+What the [DataGroceries](https://github.com/datagroceries/django-dg) apps share. You do not install it on its own: every DataGroceries
+app, such as [django-dg-board](https://pypi.org/project/django-dg-board/), brings it along.
+
+- **One MCP endpoint for every installed app** (`dg/mcp`). Each app registers its tools; an agent
+  connects once and gets them all. A tool runs the app's own REST view, so the API and the tools follow
+  the same rules. Stateless, over plain HTTP, so it runs on any WSGI server.
+- **The checks on every way in.** Core issues no tokens: it lets in whatever the project and the DataGroceries
+  packages register (personal tokens and the Claude connector's OAuth from
+  [django-dg-connect](https://pypi.org/project/django-dg-connect/), or the project's own DRF
+  authentication), and on every request checks that the person may still use the app and that the
+  token covers it. A request without credentials gets a `401` that tells MCP clients where to sign in.
+- **People.** Who may use an app is a Django permission; how DataGroceries names people, their @-handles,
+  their email address and their image come from one class a project may subclass. No assumptions about
+  the user model.
+- **Notifications** by email, Slack, or Slack with email as fallback, once the change is committed.
+- **A layout of its own**, with Bootstrap and Bootstrap Icons in the package, so the apps' pages work in
+  any project; override one template to show them in yours.
+- **Markdown**, rendered and sanitised the same way in every app (GitHub's lists, tables, task lists),
+  with the Markdown editor, and **references between apps**: an app registers what it recognises in text,
+  such as the board's ticket keys, and every app's Markdown links it while that app is installed.
+- **One URL include** for every app, and **system checks** that say what a project still has to add.
+
+Django 5.2 LTS and 6.x, Python 3.11 and newer. How to install the apps, and every setting, is in
+[docs/integrating.md](https://github.com/datagroceries/django-dg/blob/main/docs/integrating.md).
+
+MIT licensed.

django_dg_core-1.0.0/pyproject.toml

@@ -0,0 +1,48 @@
+[project]
+name = "django-dg-core"
+version = "1.0.0"
+description = "What the DataGroceries apps share: one MCP endpoint for all of them, people, notifications, and the checks on every way in."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+authors = [{ name = "Jasper Cramwinckel" }]
+keywords = ["django", "mcp", "model context protocol", "ai agents", "claude"]
+dependencies = [
+    "Django>=5.2",
+    "django-simple-history",
+    "djangorestframework",
+    "markdown",
+    "nh3",
+    "pymdown-extensions",
+    "requests",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Web Environment",
+    "Framework :: Django",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Framework :: Django :: 6.1",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Internet :: WWW/HTTP :: Dynamic Content",
+]
+
+[project.urls]
+Homepage = "https://github.com/datagroceries/django-dg"
+Source = "https://github.com/datagroceries/django-dg"
+Documentation = "https://github.com/datagroceries/django-dg/blob/main/docs/integrating.md"
+Changelog = "https://github.com/datagroceries/django-dg/blob/main/packages/django-dg-core/CHANGELOG.md"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/datagroceries"]

django_dg_core-1.0.0/src/datagroceries/core/api.py

@@ -0,0 +1,30 @@
+"""What the DataGroceries apps' REST APIs share: checking a request's body, a page form's errors as the API's, and
+a person as the APIs show them."""
+
+from rest_framework.exceptions import ValidationError
+
+from datagroceries.core import people
+
+
+def validated(serializer_class, request, **kwargs) -> dict:
+    """The request body, checked by `serializer_class`, refusing fields it does not know."""
+    serializer = serializer_class(data=request.data, **kwargs)
+    unknown = sorted(set(request.data) - set(serializer.fields))
+    if unknown:
+        raise ValidationError({'unknown_fields': unknown})
+    serializer.is_valid(raise_exception=True)
+    return serializer.validated_data
+
+
+def form_errors(form) -> ValidationError:
+    """A page form's errors as a 400; errors not tied to a field come under "detail"."""
+    errors = form.errors.get_json_data()
+    return ValidationError(
+        {('detail' if name == '__all__' else name): [e['message'] for e in field] for name, field in errors.items()},
+    )
+
+
+def person(user) -> dict | None:
+    """A person as the APIs show them: by their handle, as @-mentions name them, with their email address
+    beside it when they have one."""
+    return {'name': people.name(user), 'handle': people.handle(user), 'email': people.email(user)} if user else None

django_dg_core-1.0.0/src/datagroceries/core/apps.py

@@ -0,0 +1,17 @@
+from django.apps import AppConfig
+
+
+class CoreConfig(AppConfig):
+    name = 'datagroceries.core'
+    label = 'dg_core'
+    verbose_name = 'DataGroceries'
+    default_auto_field = 'django.db.models.BigAutoField'
+
+    def ready(self):
+        from datagroceries.core import (
+            checks,  # noqa: F401 - registers the system checks
+            markdown,
+        )
+        from datagroceries.core.mentions import Mentions
+
+        markdown.register(Mentions)

django_dg_core-1.0.0/src/datagroceries/core/areas.py

@@ -0,0 +1,39 @@
+"""The areas of the DataGroceries apps that agents reach: one per app, such as the board.
+
+An app registers its area in its AppConfig.ready(). An area is a token scope, the Django permission
+that lets someone use it (datagroceries.core.people), a sentence for the agent about it, and its MCP tools; and,
+for the switch between the apps at the top of every page, the URL name of its start page and an icon. A
+token opens an area only while its user still may use it, so losing that right ends it on every token
+at once.
+"""
+
+import dataclasses
+
+from django.core.exceptions import ImproperlyConfigured
+
+from datagroceries.core import people
+
+
+@dataclasses.dataclass(frozen=True)
+class Area:
+    scope: str
+    label: str
+    permission: str
+    instructions: str
+    tools: tuple = ()
+    home: str = ''
+    icon: str = ''
+
+
+AREAS: dict[str, Area] = {}
+
+
+def register(area: Area):
+    if area.scope in AREAS:
+        raise ImproperlyConfigured(f'The area {area.scope!r} is registered twice.')
+    AREAS[area.scope] = area
+
+
+def scopes_for(user) -> list[str]:
+    """The scopes `user` may use now, in the order their apps registered them."""
+    return [scope for scope in AREAS if people.may_use(user, scope)]

django_dg_core-1.0.0/src/datagroceries/core/attachments.py

@@ -0,0 +1,92 @@
+"""Files people attach, as every DataGroceries app keeps them: each app has a table of its own, on `Attachment`,
+saying what a file belongs to, and serves the files with `serve`, only to those who may use the app.
+
+Images pasted or dropped into the Markdown editor go to the app's upload address, which answers with
+`editor_upload`.
+"""
+
+import pathlib
+
+from django.conf import settings
+from django.db import models
+from django.http import FileResponse, JsonResponse
+from django.utils import timezone
+from django.utils.text import slugify
+
+MAX_BYTES = 20 * 1024 * 1024
+# What is shown in the page; anything else is a download.
+INLINE_CONTENT_TYPES = ('image/png', 'image/jpeg', 'image/gif', 'image/webp')
+
+
+def upload_to(attachment, filename: str) -> str:
+    return f'{attachment._meta.app_label}/{timezone.now():%Y/%m}/{filename}'
+
+
+class Attachment(models.Model):
+    """A file, in the default storage. The app serves it only to its people (`serve`), so the storage must
+    not publish it at an address of its own."""
+
+    INLINE_CONTENT_TYPES = INLINE_CONTENT_TYPES
+
+    file = models.FileField(upload_to=upload_to)
+    name = models.CharField(max_length=255)
+    content_type = models.CharField(max_length=100)
+    size = models.PositiveBigIntegerField()
+    uploaded_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.PROTECT, related_name='+')
+    uploaded_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        abstract = True
+        ordering = ('uploaded_at', 'id')
+
+    def __str__(self):
+        return self.name
+
+    @property
+    def is_image(self) -> bool:
+        return self.content_type in INLINE_CONTENT_TYPES
+
+    @property
+    def url_name(self) -> str:
+        """The file's name for the end of its address. The Markdown editor inserts an upload as an image only
+        when its address ends in an image extension; slugified, so no space or bracket breaks a link."""
+        path = pathlib.PurePath(self.name)
+        return f'{slugify(path.stem) or "file"}{path.suffix.lower()}'
+
+    @classmethod
+    def from_upload(cls, upload, user, **fields):
+        """A new attachment of the uploaded file, by `user`, with the app's own `fields`."""
+        return cls.objects.create(
+            file=upload,
+            name=upload.name,
+            content_type=upload.content_type or 'application/octet-stream',
+            size=upload.size,
+            uploaded_by=user,
+            **fields,
+        )
+
+
+def serve(attachment: Attachment) -> FileResponse:
+    """The file. Only known image types are shown inline; anything else (HTML, SVG, ...) is a download, so
+    an uploaded file can never run as a page on this site."""
+    response = FileResponse(
+        attachment.file.open('rb'),
+        content_type=attachment.content_type if attachment.is_image else 'application/octet-stream',
+        as_attachment=not attachment.is_image,
+        filename=attachment.name,
+    )
+    response['X-Content-Type-Options'] = 'nosniff'
+    return response
+
+
+def editor_upload(request, create) -> JsonResponse:
+    """The answer to an image the Markdown editor uploads, in the form EasyMDE expects. `create(upload)`
+    keeps the image and returns its Attachment."""
+    upload = request.FILES.get('image')
+    if upload is None:
+        return JsonResponse({'error': 'noFileGiven'}, status=400)
+    if upload.size > MAX_BYTES:
+        return JsonResponse({'error': 'fileTooLarge'}, status=400)
+    if upload.content_type not in INLINE_CONTENT_TYPES:
+        return JsonResponse({'error': 'typeNotAllowed'}, status=400)
+    return JsonResponse({'data': {'filePath': create(upload).get_absolute_url()}})

django_dg_core-1.0.0/src/datagroceries/core/authentication.py

@@ -0,0 +1,128 @@
+"""How a program gets into the DataGroceries apps' API and MCP endpoint. Core checks credentials and never issues
+them (docs/decisions.md); every way in lands on the same check, `opens`.
+
+The ways in, in order:
+
+1. Those of DataGroceries packages that issue tokens, such as django-dg-connect's OAuth for the Claude
+   connector and its personal tokens: they `register` here, as apps register their areas.
+2. The host project's own, the DRF authentication classes listed in `DG_AUTHENTICATION_CLASSES`:
+   its own tokens, JWT, anything DRF can check.
+
+Whatever let a request in, it reaches an area only while its user may use it, and only if the token,
+when it carries scopes, covers it. A request let in without credentials gets a 401 that points at the
+protected resource metadata (RFC 9728), which names the authorization server, so an MCP client given
+only the endpoint's address finds where to sign in.
+"""
+
+from collections.abc import Callable
+
+from django.conf import settings
+from django.dispatch import receiver
+from django.http import Http404, JsonResponse
+from django.urls import reverse
+from django.utils import translation
+from django.utils.module_loading import import_string
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.permissions import BasePermission
+from simple_history.models import HistoricalRecords
+from simple_history.signals import pre_create_historical_record
+
+from datagroceries.core import areas, history
+
+# What DataGroceries packages that issue tokens registered (`register`).
+_ways_in: list[type] = []
+_authorization_servers: list[Callable] = []
+
+
+def register(authentication_class: type, authorization_server: Callable | None = None):
+    """For a DataGroceries package that issues tokens: its DRF authentication class, and a function that takes the
+    request and returns the URL of its authorization server, if it has one."""
+    _ways_in.append(authentication_class)
+    if authorization_server:
+        _authorization_servers.append(authorization_server)
+
+
+def authorization_server(request) -> str | None:
+    """Where an MCP client signs in: the project's own authorization server, `DG_AUTHORIZATION_SERVER`,
+    or a registered one."""
+    if url := getattr(settings, 'DG_AUTHORIZATION_SERVER', None):
+        return url
+    return _authorization_servers[0](request) if _authorization_servers else None
+
+
+class NoWayIn(BaseAuthentication):
+    """Lets nobody in. Always last, so that without any other way in a request still gets a 401 that says
+    where to sign in, not DRF's 403."""
+
+    def authenticate(self, request):
+        return None
+
+
+class DataGroceriesAuthentication:
+    """For an APIView: every way in, and a 401 that says where to sign in."""
+
+    def get_authenticators(self):
+        extra = getattr(settings, 'DG_AUTHENTICATION_CLASSES', ())
+        return [*(cls() for cls in _ways_in), *(import_string(path)() for path in extra), NoWayIn()]
+
+    def dispatch(self, request, *args, **kwargs):
+        # In English whatever the project's language: the API and the tools are for programs and agents,
+        # and its error messages come from the same forms and models as the pages'.
+        with history.recording(request), translation.override('en'):
+            return super().dispatch(request, *args, **kwargs)
+
+    def get_authenticate_header(self, request):
+        if authorization_server(request):
+            return f'Bearer resource_metadata="{request.build_absolute_uri(reverse("dg_core:resource_metadata"))}"'
+        return 'Bearer'
+
+
+def opens(request, scope: str) -> bool:
+    """Whether the request reaches the area `scope`: its user may use it, and the token, if it carries a
+    `scope` (space-separated area names, as OAuth tokens and DataGroceries' personal tokens have), covers it."""
+    if not request.user.is_authenticated or scope not in areas.scopes_for(request.user):
+        return False
+    # A page's request, signed in with a session, has no `auth`, and so no token to narrow it.
+    granted = getattr(getattr(request, 'auth', None), 'scope', None)
+    return not isinstance(granted, str) or scope in granted.split()
+
+
+class HasTokenScope(BasePermission):
+    """Lets in requests that reach the view's area, `token_scope` (opens)."""
+
+    message = 'This token does not open this part of the API, or you no longer have access to it.'
+
+    def has_permission(self, request, view):  # type: ignore[override]
+        return opens(request, view.token_scope)
+
+
+def resource_metadata(request):
+    """The protected resource metadata of the MCP endpoint (RFC 9728): what it is, and where to sign in
+    for it. There is none while nothing issues tokens for the Claude connector."""
+    server = authorization_server(request)
+    if not server:
+        raise Http404('No authorization server.')
+    return JsonResponse(
+        {
+            'resource': request.build_absolute_uri(reverse('dg_core:mcp')),
+            'authorization_servers': [server],
+            'scopes_supported': list(areas.AREAS),
+            'bearer_methods_supported': ['header'],
+            'resource_name': 'DataGroceries',
+        }
+    )
+
+
+@receiver(pre_create_historical_record)
+def mark_token_changes(sender, history_instance, **kwargs):
+    """Changes made with a token say so in their history: "via Claude Code on my laptop" for a token with a
+    name, "via Claude" for an OAuth token, after its app, or "via API" for a token of the project's own.
+
+    DRF sets the token on the Django request, which datagroceries.core.history keeps for the request.
+    """
+    request = getattr(HistoricalRecords.context, 'request', None)
+    token = getattr(request, 'auth', None)
+    if token is not None and not history_instance.history_change_reason:
+        application = getattr(token, 'application', None)
+        name = getattr(token, 'name', None) or getattr(application, 'name', None) or 'API'
+        history_instance.history_change_reason = f'via {name}'

django_dg_core-1.0.0/src/datagroceries/core/backlinks.py

@@ -0,0 +1,40 @@
+"""What names something of one app in another app's text: the wiki pages that name a ticket, shown on the
+ticket. An app that keeps text registers a `Source` from its AppConfig.ready(); an app shows what names
+one of its things with `find`, so neither knows the other.
+"""
+
+import dataclasses
+import typing
+
+from datagroceries.core.authentication import opens
+
+
+@dataclasses.dataclass(frozen=True)
+class Backlink:
+    title: str
+    url: str
+
+
+@dataclasses.dataclass(frozen=True)
+class Source:
+    """Text of the area `scope`. `find(name)` gives the places in it that name `name` as a word, such as
+    "T-123", outside code; `label` says what they are, as "Wiki pages"."""
+
+    scope: str
+    label: str
+    find: typing.Callable[[str], list[Backlink]]
+
+
+SOURCES: list[Source] = []
+
+
+def register(source: Source):
+    if source not in SOURCES:
+        SOURCES.append(source)
+
+
+def find(request, name: str) -> list[tuple[Source, list[Backlink]]]:
+    """The places that name `name`, in the areas the request reaches (its user may use them, and its token,
+    if any, opens them), by source; sources without any are left out."""
+    found = [(source, source.find(name)) for source in SOURCES if opens(request, source.scope)]
+    return [(source, places) for source, places in found if places]

django_dg_core-1.0.0/src/datagroceries/core/checks.py

@@ -0,0 +1,118 @@
+"""System checks: what `manage.py check` tells whoever installs DataGroceries is still missing. Each message says
+what to do."""
+
+from django.conf import settings
+from django.contrib.auth.models import Permission
+from django.core import checks
+from django.core.exceptions import ImproperlyConfigured
+from django.db import DatabaseError
+from django.db.models import Q
+from django.shortcuts import resolve_url
+from django.urls import NoReverseMatch, Resolver404, resolve, reverse
+
+from datagroceries.core import areas, notifications
+
+REQUIRED_APPS = ('rest_framework', 'simple_history')
+CONTEXT_PROCESSORS = (
+    'django.template.context_processors.request',
+    'django.contrib.auth.context_processors.auth',
+    'django.contrib.messages.context_processors.messages',
+)
+
+
+@checks.register
+def check_apps(app_configs, **kwargs):
+    return [
+        checks.Error(
+            f"DataGroceries needs '{app}' in INSTALLED_APPS.", hint=f"Add '{app}' to INSTALLED_APPS.", id='dg.E001'
+        )
+        for app in REQUIRED_APPS
+        if app not in settings.INSTALLED_APPS
+    ]
+
+
+@checks.register
+def check_templates(app_configs, **kwargs):
+    processors = {
+        processor
+        for engine in settings.TEMPLATES
+        if engine['BACKEND'] == 'django.template.backends.django.DjangoTemplates'
+        for processor in engine.get('OPTIONS', {}).get('context_processors', [])
+    }
+    return [
+        checks.Error(
+            f"The DataGroceries pages need the context processor '{processor}'.",
+            hint="Add it to OPTIONS['context_processors'] of the DjangoTemplates engine in TEMPLATES.",
+            id='dg.E002',
+        )
+        for processor in CONTEXT_PROCESSORS
+        if processor not in processors
+    ]
+
+
+@checks.register
+def check_urls(app_configs, **kwargs):
+    try:
+        reverse('dg_core:mcp')
+    except NoReverseMatch:
+        return [
+            checks.Warning(
+                "DataGroceries' pages and its MCP endpoint are not in the URLs.",
+                hint="Add path('dg/', include('datagroceries.urls')) to the project's urlpatterns.",
+                id='dg.W001',
+            )
+        ]
+    try:
+        resolve(resolve_url(settings.LOGIN_URL))
+    except (Resolver404, NoReverseMatch):
+        return [
+            checks.Warning(
+                f'LOGIN_URL ({settings.LOGIN_URL}) leads nowhere, so people who are not signed in cannot sign in '
+                'to the DataGroceries pages.',
+                hint="Set LOGIN_URL to the project's sign-in page, such as 'admin:login'.",
+                id='dg.W002',
+            )
+        ]
+    return []
+
+
+@checks.register
+def check_people(app_configs, **kwargs):
+    """An app that only superusers may use was most likely installed a moment ago."""
+    found = []
+    for area in areas.AREAS.values():
+        app_label, codename = area.permission.split('.')
+        try:
+            granted = (
+                Permission.objects.filter(content_type__app_label=app_label, codename=codename)
+                .filter(Q(group__isnull=False) | Q(user__isnull=False))
+                .exists()
+            )
+        except DatabaseError:  # not migrated yet
+            return []
+        if not granted:
+            found.append(
+                checks.Warning(
+                    f'Only superusers may use {area.label} yet.',
+                    hint=f'Grant the permission "{area.permission}" to a group in the admin, and put people in it.',
+                    id='dg.W003',
+                )
+            )
+    return found
+
+
+@checks.register
+def check_notifications(app_configs, **kwargs):
+    try:
+        order = notifications.channels()
+    except ImproperlyConfigured as error:
+        return [checks.Error(str(error), hint="For example ['email'], or ['slack', 'email'].", id='dg.E003')]
+    if 'slack' in order and not getattr(settings, 'DG_SLACK_BOT_TOKEN', ''):
+        return [
+            checks.Error(
+                'DG_NOTIFICATIONS includes Slack, but DG_SLACK_BOT_TOKEN is not set.',
+                hint='Set it to the token of a Slack bot with the scopes users:read.email and chat:write.',
+                id='dg.E004',
+            )
+        ]
+    return []