tomevault-io Quick Reference
| Topic | File |
|---|---|
| QuerySet lazy eval, N+1, transactions | orm.md |
| Request handling, middleware, context | views.md |
| Validation, CSRF, file uploads | forms.md |
| Migrations, signals, managers | models.md |
| XSS, CSRF, SQL injection, auth | security.md |
| Async views, ORM in async, channels | async.md |
Critical Rules
- QuerySets are lazy — iterating twice hits DB twice, use
list()to cache select_relatedfor FK/O2O,prefetch_relatedfor M2M — or N+1 queriesupdate()skipssave()— no signals fire, noauto_nowupdateF()for atomic updates —F('count') + 1avoids race conditionsget()raisesDoesNotExistorMultipleObjectsReturned— usefilter().first()for safeDEBUG=FalserequiresALLOWED_HOSTS— 400 Bad Request without it- Forms need
{% csrf_token %}— or 403 Forbidden on POST auto_nowcan't be overridden — usedefault=timezone.nowif need manual setexclude(field=None)excludes NULL — usefilter(field__isnull=True)for NULL- Circular imports in models — use string reference:
ForeignKey('app.Model') transaction.atomic()doesn't catch exceptions — errors still propagatesync_to_asyncfor ORM in async views — ORM is sync-only
Source: clawic/skills — distributed by TomeVault.