[v0.5.52] — Admin Correctness & Permissions

[nagarjuna-tella]

v0.5.52 hardens the built-in admin interface.

The pattern is the same as the last two releases: find the places where behavior was inconsistent, undocumented, or silently wrong — and fix them. v0.5.50 did this for migrations. v0.5.51 did it for primitive field validation. v0.5.52 does it for the admin layer.

This is not an admin features release. The list view, permissions, bulk actions, CSRF handling, and M2M saves all existed before. This release makes them work correctly.

---

What Changed

Admin mounting is now consistent

The admin docs and implementation previously had multiple mounting patterns that produced different behavior. This release settles on one supported path:

from aksara.contrib.admin import include_admin
include_admin(app)

Custom prefixes work:

include_admin(app, prefix="/manage")

Multi-site routing and namespacing are now more predictable when you have multiple admin sites registered.

---

CSRF cookies now follow the mounted prefix

If your admin is mounted at /manage, the CSRF cookie path is now /manage. Previously it was hardcoded to /admin regardless of where the admin was actually mounted. Forms on custom-prefixed admin sites would break CSRF validation silently.

---

Permission enforcement is now consistent

Admin permission handling had gaps across different views. They're closed:

• Site permission classes are now honored during login, not just after
• Model and module permissions are applied on the admin index and app index pages — previously these checks were inconsistently applied
• Object-level permissions are checked before bulk actions run
• Custom permission hooks can now be safely async
• Session lookup failures are logged instead of silently swallowed

The practical effect: what a user is allowed to do in the admin is now the same regardless of which view they're accessing.

---

Bulk actions check object-level permissions

Previously, a user with model-level access could execute bulk actions on any selected objects, even ones they shouldn't be able to modify individually.

Now bulk actions run object-level permission checks before acting on each selected object. Objects the user cannot access are skipped or denied explicitly — not silently included.

---

M2M saves are transactional

Many-to-many save handling had two problems:

1. Invalid related IDs were silently ignored — the relation would save partially without telling you
2. The relation was cleared before new IDs were validated, so an invalid selection could leave the relation empty

Both are fixed. Related IDs are validated before any mutation. The update is transactional — if any ID is invalid, the relation is not touched.

---

Readonly fields are enforced on create and update

A crafted POST could previously set readonly fields by including them explicitly in fields or fieldsets. They were readonly in the UI but not enforced server-side.

Readonly fields are now rejected on both create and update paths.

---

Boolean checkboxes render correctly

A saved False value was being converted to the non-empty string "False" before the template rendered it. Non-empty strings are truthy in Python, so the checkbox rendered as checked even though the stored value was False.

Fixed. Saved False renders as unchecked.

---

Admin list view is usable on real tables

The list view has been expanded with what you'd expect from a real admin:

• Search
• Pagination
• List filters with bounded choice loading — no more loading every option for a column with 10,000 distinct values
• Actions
• Configurable clickable columns
• Ordering
• Safer "show all" behavior

---

AksaraFilterBackend is now the preferred name

DjangoFilterBackend was a placeholder name from early development. The preferred name is now AksaraFilterBackend.

DjangoFilterBackend remains available as a compatibility alias — existing imports won't break:

from aksara.api.filters import AksaraFilterBackend  # preferred
from aksara.api.filters import DjangoFilterBackend   # still works
assert DjangoFilterBackend is AksaraFilterBackend    # same object

---

Compatibility

These changes may affect existing admin customizations:

If you have...	What to check
Custom admin prefix	CSRF cookie path has changed — verify forms work
Custom permission classes	Now applied during login, not just after
Bulk actions	Now check object-level permissions — some objects may be skipped
M2M fields in admin forms	Invalid IDs now surface as errors instead of being ignored
Readonly fields	Now enforced server-side — crafted POSTs can no longer bypass them
DjangoFilterBackend imports	Still works, no action needed

For most users: include_admin(app) and everything works as documented.

---

Documentation

The admin docs have been significantly refreshed to match the actual implementation. Previous docs referenced app.mount("/admin", admin) which was never a supported pattern. Updated areas:

• Admin setup and site configuration
• Custom prefixes and multi-site routing
• CSRF behavior and warnings
• Admin vs Studio — when to use each
• Permissions and async permission patterns
• Object-level bulk action safety
• Readonly field behavior
• Actions, filters, widgets, pagination
• Branding and template customization

---

Validation

• Full suite: passing
• Admin test suite: passing
• Security test suite: passing
• Diagnostics test suite: passing
• MkDocs strict build: passing
• pip-audit: passing, no known vulnerabilities

---

Install

pip install aksara-framework==0.5.52

---

What's Next

The foundation-hardening work continues. After migrations (v0.5.50), primitive fields (v0.5.51), and admin (v0.5.52), the remaining ORM correctness items are next:

• filter(field=None) → IS NULL semantics
• FK alias filtering and reverse FK filter consistency
• bulk_create / write-path consistency with save()
• Relation DDL safety

---

Aksara is pre-1.0. This release improves admin correctness and permissions but does not constitute an external audit or production-readiness claim.

---

This discussion was created from the release [v0.5.52] — Admin Correctness & Permissions.