Django Controller
Implement endpoint transport around approved DTO, Mapper, Service, security, and API contracts.
Required Context
Read AGENTS.md, docs/architecture/api-contract.md, docs/architecture/security-contract.md, docs/architecture/backend-implementation-contract.md, docs/architecture/backend-contract-manifest.json, .codex/references/dto-controller-policy.md, .codex/references/mapping-policy.md, .codex/references/backend-security.md, and .codex/references/module-documentation.md.
Require an approved implementation contract. Stop if route, method, actor, permission, payload, status, or error behavior is unresolved.
Workflow
- Select the manifest endpoint ID(s) assigned to one exact Controller class and declare their route, method, authentication, permissions, and throttling.
- Instantiate and validate the request DTO.
- Invoke the explicit request-to-Service Mapper.
- Resolve and call the Service through the composition boundary.
- Map only approved domain/application errors to HTTP responses.
- Map the Service result to a response DTO and construct the response.
- Add a meaningful opening module docstring and focused API, permission, and response-shape tests.
- Confirm project URL configuration imports this exact Controller class at the contracted path and that it implements no HTTP method absent from the manifest.
- Add every exact endpoint
test_* function named by the manifest.
Boundaries
- Do not import ORM Models or call Repositories directly.
- Do not open transactions, build queries, enforce business branching, or call integrations.
- Do not define payload fields or perform field-by-field mapping in the Controller.
- Do not expose sensitive fields outside the approved response DTO.
- Prefer one use-case Controller. Share a resource Controller only for explicitly contracted same-route methods; do not retain unrelated aggregate or duplicate unused Controller modules.
Finish only when the Controller contains endpoint transport alone and tests prove DTO, permission, status, error, and response contracts.
1---2name: django-controller3description: Implement approved thin Django or DRF API Controllers and route wiring. Use when declaring endpoints, applying authentication or permissions, validating DTO-defined payloads, invoking Services through composition, mapping expected errors, or constructing HTTP responses. Do not use for business rules, ORM access, Repository calls, or Controller-local payload schemas.4---56# Django Controller78Implement endpoint transport around approved DTO, Mapper, Service, security, and API contracts.910## Required Context1112Read `AGENTS.md`, `docs/architecture/api-contract.md`, `docs/architecture/security-contract.md`, `docs/architecture/backend-implementation-contract.md`, `docs/architecture/backend-contract-manifest.json`, `.codex/references/dto-controller-policy.md`, `.codex/references/mapping-policy.md`, `.codex/references/backend-security.md`, and `.codex/references/module-documentation.md`.1314Require an approved implementation contract. Stop if route, method, actor, permission, payload, status, or error behavior is unresolved.1516## Workflow17181. Select the manifest endpoint ID(s) assigned to one exact Controller class and declare their route, method, authentication, permissions, and throttling.192. Instantiate and validate the request DTO.203. Invoke the explicit request-to-Service Mapper.214. Resolve and call the Service through the composition boundary.225. Map only approved domain/application errors to HTTP responses.236. Map the Service result to a response DTO and construct the response.247. Add a meaningful opening module docstring and focused API, permission, and response-shape tests.258. Confirm project URL configuration imports this exact Controller class at the contracted path and that it implements no HTTP method absent from the manifest.269. Add every exact endpoint `test_*` function named by the manifest.2728## Boundaries2930- Do not import ORM Models or call Repositories directly.31- Do not open transactions, build queries, enforce business branching, or call integrations.32- Do not define payload fields or perform field-by-field mapping in the Controller.33- Do not expose sensitive fields outside the approved response DTO.34- Prefer one use-case Controller. Share a resource Controller only for explicitly contracted same-route methods; do not retain unrelated aggregate or duplicate unused Controller modules.3536Finish only when the Controller contains endpoint transport alone and tests prove DTO, permission, status, error, and response contracts.
viniciusjsdev