Bài 36: Best Practices & Code Organization

Project Structure

Recommended Structure

project_name/├── project_name/              # Project configuration│   ├── __init__.py│   ├── settings/             # Split settings│   │   ├── __init__.py│   │   ├── base.py          # Base settings│   │   ├── development.py   # Dev settings│   │   ├── production.py    # Production settings│   │   └── testing.py       # Test settings│   ├── urls.py│   ├── wsgi.py│   └── asgi.py├── apps/                     # Django apps│   ├── __init__.py│   ├── users/│   ├── products/│   └── orders/├── core/                     # Core utilities│   ├── __init__.py│   ├── models.py            # Abstract base models│   ├── managers.py          # Custom managers│   ├── mixins.py            # Reusable mixins│   ├── decorators.py        # Custom decorators│   ├── utils.py             # Utility functions│   └── validators.py        # Custom validators├── templates/│   ├── base.html│   ├── includes/│   └── emails/├── static/│   ├── css/│   ├── js/│   └── images/├── media/├── locale/                   # Translations├── docs/                     # Documentation├── tests/                    # Test suite├── scripts/                  # Management scripts├── requirements/             # Split requirements│   ├── base.txt│   ├── development.txt│   ├── production.txt│   └── testing.txt├── docker/                   # Docker configs│   ├── Dockerfile│   ├── docker-compose.yml│   └── nginx/├── .env.example├── .gitignore├── manage.py└── README.md

Split Settings

# project_name/settings/base.py"""Base settings for all environments"""from pathlib import Pathfrom decouple import config BASE_DIR = Path(__file__).resolve().parent.parent.parent SECRET_KEY = config('SECRET_KEY') # Application definitionINSTALLED_APPS = [    # Django apps    'django.contrib.admin',    'django.contrib.auth',    'django.contrib.contenttypes',    'django.contrib.sessions',    'django.contrib.messages',    'django.contrib.staticfiles',        # Third-party apps    'rest_framework',    'crispy_forms',    'crispy_bootstrap5',        # Local apps    'apps.users',    'apps.products',    'apps.orders',    'core',] MIDDLEWARE = [    'django.middleware.security.SecurityMiddleware',    'whitenoise.middleware.WhiteNoiseMiddleware',    'django.contrib.sessions.middleware.SessionMiddleware',    'django.middleware.common.CommonMiddleware',    'django.middleware.csrf.CsrfViewMiddleware',    'django.contrib.auth.middleware.AuthenticationMiddleware',    'django.contrib.messages.middleware.MessageMiddleware',    'django.middleware.clickjacking.XFrameOptionsMiddleware',] ROOT_URLCONF = 'project_name.urls' TEMPLATES = [    {        'BACKEND': 'django.template.backends.django.DjangoTemplates',        'DIRS': [BASE_DIR / 'templates'],        'APP_DIRS': True,        'OPTIONS': {            'context_processors': [                'django.template.context_processors.debug',                'django.template.context_processors.request',                'django.contrib.auth.context_processors.auth',                'django.contrib.messages.context_processors.messages',            ],        },    },] # Database (to be overridden in environment-specific settings)DATABASES = {} # Password validationAUTH_PASSWORD_VALIDATORS = [    {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},    {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator'},    {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},    {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},] # InternationalizationLANGUAGE_CODE = 'en-us'TIME_ZONE = 'Asia/Ho_Chi_Minh'USE_I18N = TrueUSE_TZ = True # Static filesSTATIC_URL = '/static/'STATIC_ROOT = BASE_DIR / 'staticfiles'STATICFILES_DIRS = [BASE_DIR / 'static'] # Media filesMEDIA_URL = '/media/'MEDIA_ROOT = BASE_DIR / 'media' # Default primary key field typeDEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'

# project_name/settings/development.py"""Development settings"""from .base import * DEBUG = TrueALLOWED_HOSTS = ['localhost', '127.0.0.1'] # DatabaseDATABASES = {    'default': {        'ENGINE': 'django.db.backends.postgresql',        'NAME': config('DB_NAME', default='dev_db'),        'USER': config('DB_USER', default='postgres'),        'PASSWORD': config('DB_PASSWORD', default='postgres'),        'HOST': config('DB_HOST', default='localhost'),        'PORT': config('DB_PORT', default='5432'),    }} # Email backend for developmentEMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' # Django Debug ToolbarINSTALLED_APPS += ['debug_toolbar']MIDDLEWARE += ['debug_toolbar.middleware.DebugToolbarMiddleware']INTERNAL_IPS = ['127.0.0.1'] # Disable template cachingTEMPLATES[0]['OPTIONS']['debug'] = True # LoggingLOGGING = {    'version': 1,    'disable_existing_loggers': False,    'handlers': {        'console': {            'class': 'logging.StreamHandler',        },    },    'root': {        'handlers': ['console'],        'level': 'DEBUG',    },}

# project_name/settings/production.py"""Production settings"""from .base import *import dj_database_url DEBUG = FalseALLOWED_HOSTS = config('ALLOWED_HOSTS', cast=lambda v: [s.strip() for s in v.split(',')]) # DatabaseDATABASES = {    'default': dj_database_url.config(        default=config('DATABASE_URL'),        conn_max_age=600,        ssl_require=True    )} # Security settingsSECURE_SSL_REDIRECT = TrueSESSION_COOKIE_SECURE = TrueCSRF_COOKIE_SECURE = TrueSECURE_HSTS_SECONDS = 31536000SECURE_HSTS_INCLUDE_SUBDOMAINS = TrueSECURE_HSTS_PRELOAD = TrueSECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') # Static files with WhiteNoiseSTATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage' # EmailEMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'EMAIL_HOST = config('EMAIL_HOST')EMAIL_PORT = config('EMAIL_PORT', cast=int)EMAIL_USE_TLS = config('EMAIL_USE_TLS', cast=bool)EMAIL_HOST_USER = config('EMAIL_HOST_USER')EMAIL_HOST_PASSWORD = config('EMAIL_HOST_PASSWORD') # LoggingLOGGING = {    'version': 1,    'disable_existing_loggers': False,    'formatters': {        'verbose': {            'format': '{levelname} {asctime} {module} {message}',            'style': '{',        },    },    'handlers': {        'file': {            'level': 'ERROR',            'class': 'logging.FileHandler',            'filename': BASE_DIR / 'logs' / 'error.log',            'formatter': 'verbose',        },    },    'root': {        'handlers': ['file'],        'level': 'ERROR',    },}

Abstract Base Models

# core/models.py"""Abstract base models for reusability"""from django.db import modelsfrom django.utils.text import slugifyfrom django.contrib.auth.models import User class TimeStampedModel(models.Model):    """Abstract model with created_at and updated_at fields"""    created_at = models.DateTimeField(auto_now_add=True)    updated_at = models.DateTimeField(auto_now=True)        class Meta:        abstract = True class SoftDeleteModel(models.Model):    """Abstract model with soft delete functionality"""    is_deleted = models.BooleanField(default=False)    deleted_at = models.DateTimeField(null=True, blank=True)        class Meta:        abstract = True        def delete(self, using=None, keep_parents=False):        """Soft delete"""        from django.utils import timezone        self.is_deleted = True        self.deleted_at = timezone.now()        self.save()        def hard_delete(self):        """Permanently delete"""        super().delete() class PublishableModel(models.Model):    """Abstract model for publishable content"""    STATUS_CHOICES = [        ('draft', 'Draft'),        ('published', 'Published'),        ('archived', 'Archived'),    ]        status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='draft')    published_at = models.DateTimeField(null=True, blank=True)        class Meta:        abstract = True        def publish(self):        """Publish the content"""        from django.utils import timezone        self.status = 'published'        if not self.published_at:            self.published_at = timezone.now()        self.save() class SlugModel(models.Model):    """Abstract model with auto-generated slug"""    slug = models.SlugField(max_length=200, unique=True)        class Meta:        abstract = True        def save(self, *args, **kwargs):        if not self.slug and hasattr(self, 'get_slug_source'):            self.slug = self.generate_unique_slug(self.get_slug_source())        super().save(*args, **kwargs)        def generate_unique_slug(self, source):        """Generate unique slug"""        slug = slugify(source)        unique_slug = slug        num = 1        while self.__class__.objects.filter(slug=unique_slug).exists():            unique_slug = f'{slug}-{num}'            num += 1        return unique_slug class UserOwnedModel(models.Model):    """Abstract model for user-owned content"""    user = models.ForeignKey(User, on_delete=models.CASCADE)        class Meta:        abstract = True

Custom Managers

# core/managers.py"""Custom model managers"""from django.db import modelsfrom django.utils import timezone class PublishedManager(models.Manager):    """Manager for published objects"""    def get_queryset(self):        return super().get_queryset().filter(            status='published',            published_at__lte=timezone.now()        ) class ActiveManager(models.Manager):    """Manager for active objects"""    def get_queryset(self):        return super().get_queryset().filter(is_active=True) class SoftDeleteManager(models.Manager):    """Manager that excludes soft-deleted objects"""    def get_queryset(self):        return super().get_queryset().filter(is_deleted=False) # Usage in models:# class Article(TimeStampedModel, PublishableModel):#     objects = models.Manager()  # Default manager#     published = PublishedManager()  # Custom manager#     #     # Now you can use: Article.published.all()

Mixins

# core/mixins.py"""Reusable view mixins"""from django.contrib.auth.mixins import LoginRequiredMixinfrom django.core.exceptions import PermissionDeniedfrom django.shortcuts import get_object_or_404 class UserOwnershipMixin:    """Mixin to ensure user owns the object"""    def dispatch(self, request, *args, **kwargs):        obj = self.get_object()        if obj.user != request.user and not request.user.is_staff:            raise PermissionDenied("You don't have permission to access this object.")        return super().dispatch(request, *args, **kwargs) class AjaxRequiredMixin:    """Mixin to ensure request is AJAX"""    def dispatch(self, request, *args, **kwargs):        if not request.headers.get('X-Requested-With') == 'XMLHttpRequest':            raise PermissionDenied("This view only accepts AJAX requests.")        return super().dispatch(request, *args, **kwargs) class FormMessageMixin:    """Mixin to add success/error messages to forms"""    success_message = None    error_message = None        def form_valid(self, form):        if self.success_message:            from django.contrib import messages            messages.success(self.request, self.success_message)        return super().form_valid(form)        def form_invalid(self, form):        if self.error_message:            from django.contrib import messages            messages.error(self.request, self.error_message)        return super().form_invalid(form) class PaginationMixin:    """Mixin for consistent pagination"""    paginate_by = 10        def get_paginate_by(self, queryset):        """Allow overriding pagination via query param"""        return self.request.GET.get('per_page', self.paginate_by)

Custom Decorators

# core/decorators.py"""Custom decorators"""from functools import wrapsfrom django.http import JsonResponsefrom django.core.exceptions import PermissionDenied def ajax_required(f):    """Decorator to ensure view only accepts AJAX requests"""    @wraps(f)    def wrapped(request, *args, **kwargs):        if not request.headers.get('X-Requested-With') == 'XMLHttpRequest':            return JsonResponse({'error': 'AJAX request required'}, status=400)        return f(request, *args, **kwargs)    return wrapped def owner_required(model):    """Decorator to ensure user owns the object"""    def decorator(f):        @wraps(f)        def wrapped(request, *args, **kwargs):            from django.shortcuts import get_object_or_404            obj_id = kwargs.get('pk') or kwargs.get('id')            obj = get_object_or_404(model, pk=obj_id)            if obj.user != request.user and not request.user.is_staff:                raise PermissionDenied("You don't own this object.")            return f(request, *args, **kwargs)        return wrapped    return decorator def admin_or_owner_required(f):    """Decorator to ensure user is admin or owner"""    @wraps(f)    def wrapped(request, *args, **kwargs):        if not request.user.is_staff:            obj = kwargs.get('object')            if hasattr(obj, 'user') and obj.user != request.user:                raise PermissionDenied("You don't have permission.")        return f(request, *args, **kwargs)    return wrapped

Security Best Practices

Environment Variables

# Use python-decouple for environment variablesfrom decouple import config SECRET_KEY = config('SECRET_KEY')DEBUG = config('DEBUG', default=False, cast=bool)ALLOWED_HOSTS = config('ALLOWED_HOSTS', cast=lambda v: [s.strip() for s in v.split(',')])DATABASE_URL = config('DATABASE_URL')

Password Security

# settings.pyAUTH_PASSWORD_VALIDATORS = [    {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},    {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': {'min_length': 10}},    {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'},    {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'},] # Custom password validator# core/validators.pyfrom django.core.exceptions import ValidationErrorimport re class PasswordComplexityValidator:    """Ensure password has uppercase, lowercase, digit, and special char"""    def validate(self, password, user=None):        if not re.search(r'[A-Z]', password):            raise ValidationError("Password must contain an uppercase letter.")        if not re.search(r'[a-z]', password):            raise ValidationError("Password must contain a lowercase letter.")        if not re.search(r'[0-9]', password):            raise ValidationError("Password must contain a digit.")        if not re.search(r'[!@#$%^&*(),.?":{}|<>]', password):            raise ValidationError("Password must contain a special character.")        def get_help_text(self):        return "Password must contain uppercase, lowercase, digit, and special character."

CSRF Protection

# Ensure CSRF token in all forms{% csrf_token %} # For AJAX requests// JavaScriptfunction getCookie(name) {    let cookieValue = null;    if (document.cookie && document.cookie !== '') {        const cookies = document.cookie.split(';');        for (let i = 0; i < cookies.length; i++) {            const cookie = cookies[i].trim();            if (cookie.substring(0, name.length + 1) === (name + '=')) {                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));                break;            }        }    }    return cookieValue;} const csrftoken = getCookie('csrftoken'); fetch(url, {    method: 'POST',    headers: {        'X-CSRFToken': csrftoken,        'Content-Type': 'application/json',    },    body: JSON.stringify(data)});

SQL Injection Prevention

# GOOD - Use ORMusers = User.objects.filter(username=username) # GOOD - Use parameterized queries if raw SQL neededfrom django.db import connectioncursor = connection.cursor()cursor.execute("SELECT * FROM users WHERE username = %s", [username]) # BAD - Never do this!# cursor.execute(f"SELECT * FROM users WHERE username = '{username}'")

XSS Prevention

<!-- Django auto-escapes by default -->{{ user_input }} <!-- To render HTML (be careful!)-->{{ user_input|safe }} <!-- Mark as safe in Python -->from django.utils.safestring import mark_safesafe_html = mark_safe("<p>Safe HTML</p>")

Performance Optimization

Database Query Optimization

# BAD - N+1 queries problemfor product in Product.objects.all():    print(product.category.name)  # Extra query per product! # GOOD - Use select_related for ForeignKeyproducts = Product.objects.select_related('category', 'brand').all()for product in products:    print(product.category.name)  # No extra queries! # GOOD - Use prefetch_related for ManyToManyproducts = Product.objects.prefetch_related('tags', 'images').all()for product in products:    for tag in product.tags.all():  # No extra queries!        print(tag.name) # Use only() and defer() to limit fieldsproducts = Product.objects.only('id', 'name', 'price')  # Only fetch these fieldsproducts = Product.objects.defer('description')  # Fetch all except description

Caching

# settings.pyCACHES = {    'default': {        'BACKEND': 'django.core.cache.backends.redis.RedisCache',        'LOCATION': 'redis://127.0.0.1:6379/1',    }} # Cache entire viewfrom django.views.decorators.cache import cache_page @cache_page(60 * 15)  # Cache for 15 minutesdef product_list(request):    products = Product.objects.all()    return render(request, 'products/list.html', {'products': products}) # Cache template fragment{% load cache %}{% cache 500 sidebar %}    <!-- Expensive sidebar rendering -->{% endcache %} # Low-level cache APIfrom django.core.cache import cache # Set cachecache.set('my_key', 'my_value', 300)  # 5 minutes # Get cachevalue = cache.get('my_key')if value is None:    value = expensive_computation()    cache.set('my_key', value, 300) # Delete cachecache.delete('my_key')

Database Indexing

# models.pyclass Product(models.Model):    name = models.CharField(max_length=200, db_index=True)  # Single index        class Meta:        indexes = [            models.Index(fields=['category', 'status']),  # Composite index            models.Index(fields=['-created_at']),  # Descending index        ]

Testing Best Practices

# tests/test_models.pyfrom django.test import TestCasefrom apps.products.models import Product, Category class ProductModelTest(TestCase):    """Test Product model"""        @classmethod    def setUpTestData(cls):        """Set up non-modified objects used by all test methods"""        cls.category = Category.objects.create(name='Electronics')        cls.product = Product.objects.create(            name='Test Product',            category=cls.category,            price=100,            stock=10        )        def test_product_creation(self):        """Test product is created correctly"""        self.assertEqual(self.product.name, 'Test Product')        self.assertEqual(self.product.price, 100)        def test_slug_generation(self):        """Test slug is auto-generated"""        self.assertEqual(self.product.slug, 'test-product')        def test_get_absolute_url(self):        """Test get_absolute_url method"""        url = self.product.get_absolute_url()        self.assertEqual(url, f'/products/{self.product.slug}/') # tests/test_views.pyfrom django.test import TestCase, Clientfrom django.urls import reversefrom django.contrib.auth.models import User class ProductViewTest(TestCase):    """Test product views"""        def setUp(self):        """Set up for each test"""        self.client = Client()        self.user = User.objects.create_user(            username='testuser',            password='testpass123'        )        def test_product_list_view(self):        """Test product list view"""        response = self.client.get(reverse('products:product_list'))        self.assertEqual(response.status_code, 200)        self.assertTemplateUsed(response, 'products/product_list.html')        def test_product_create_requires_login(self):        """Test product create requires authentication"""        response = self.client.get(reverse('products:product_create'))        self.assertEqual(response.status_code, 302)  # Redirect to login        def test_product_create_authenticated(self):        """Test authenticated user can access create page"""        self.client.login(username='testuser', password='testpass123')        response = self.client.get(reverse('products:product_create'))        self.assertEqual(response.status_code, 200)

Code Quality Tools

Pre-commit Hooks

# .pre-commit-config.yamlrepos:  - repo: https://github.com/pre-commit/pre-commit-hooks    rev: v4.4.0    hooks:      - id: trailing-whitespace      - id: end-of-file-fixer      - id: check-yaml      - id: check-added-large-files    - repo: https://github.com/psf/black    rev: 23.3.0    hooks:      - id: black        language_version: python3.11    - repo: https://github.com/pycqa/flake8    rev: 6.0.0    hooks:      - id: flake8        args: ['--max-line-length=100']    - repo: https://github.com/pycqa/isort    rev: 5.12.0    hooks:      - id: isort

Requirements Organization

# requirements/base.txtDjango==5.0.1psycopg2-binary==2.9.9python-decouple==3.8Pillow==10.1.0 # requirements/development.txt-r base.txtdjango-debug-toolbar==4.2.0ipython==8.18.1black==23.12.1flake8==6.1.0isort==5.13.2 # requirements/production.txt-r base.txtgunicorn==21.2.0whitenoise==6.6.0dj-database-url==2.1.0 # requirements/testing.txt-r base.txtpytest==7.4.3pytest-django==4.7.0coverage==7.3.3factory-boy==3.3.0

Bài Tập

Exercise 1: Refactor Project

Task: Refactor existing project với best practices:

# Requirements:# 1. Split settings (base, dev, prod)# 2. Create abstract base models# 3. Implement custom managers# 4. Add mixins to views# 5. Create utility functions# 6. Add proper error handling# 7. Implement logging# 8. Add comprehensive tests

Exercise 2: Security Audit

Task: Security checklist:

# Requirements:# 1. Check all environment variables# 2. Verify ALLOWED_HOSTS is set correctly# 3. Enable HTTPS in production# 4. Implement rate limiting# 5. Add CORS headers if needed# 6. Check all user inputs are validated# 7. Verify no secrets in code# 8. Run security check: python manage.py check --deploy

Tổng Kết

Checklist Hoàn Chỉnh Project

✅ Project Structure  ✅ Split settings  ✅ Organized apps structure  ✅ Core utilities  ✅ Split requirements ✅ Code Quality  ✅ Abstract base models  ✅ Custom managers  ✅ Reusable mixins  ✅ DRY principle  ✅ Type hints  ✅ Docstrings ✅ Security  ✅ Environment variables  ✅ HTTPS enabled  ✅ CSRF protection  ✅ SQL injection prevention  ✅ XSS prevention  ✅ Strong passwords ✅ Performance  ✅ Query optimization  ✅ Caching strategy  ✅ Database indexing  ✅ Static file compression ✅ Testing  ✅ Model tests  ✅ View tests  ✅ Form tests  ✅ >80% coverage ✅ Documentation  ✅ README.md  ✅ API documentation  ✅ Setup instructions  ✅ Deployment guide ✅ Deployment  ✅ Docker setup  ✅ CI/CD pipeline  ✅ Monitoring  ✅ Backups

Kết Luận

Chúc mừng bạn đã hoàn thành Django Basic Course! 🎉

Bạn đã học được:

✅ Django fundamentals (models, views, templates, forms)
✅ Advanced features (class-based views, middleware, signals)
✅ Authentication & Authorization
✅ Database optimization
✅ Docker deployment
✅ 2 comprehensive projects (News/Blog + E-commerce)
✅ Best practices & code organization

Next Steps:

Django Advanced: REST APIs, Celery, WebSockets
Django + React: Full-stack development
Microservices: Django microservices architecture
DevOps: CI/CD, Kubernetes, monitoring

Keep coding! 🚀

Tài Liệu Tham Khảo

Previous: Bài 35.4: E-commerce Completion | Next: Bài 37: Practices 🎓

#code-organization

Best Practices & Code Organization