Transcript: Django Admin

Hello, and welcome to another episode of Django Chat. In this episode, we're going to be talking

about the Django Admin, what it is and how to use it. I'm Will Vincent and joined as

always by Carlton Gibson. Hi, Carlton.

Hello, Will.

So let's get into it. This is one of the questions we get a lot from beginners who just want

to understand how should they use the Django Admin. So maybe since you're the Django fellow,

what's the history? Why does Django have this beautiful admin app that many other web frameworks

okay there's a absolutely awesome question um it predates my use of django so i got into django in

the early days and it's always had the angle the admin and the ang the admin was like this just

the the hang the hangman what's that the admin was always like django admin squashed into one word

the admin was always like this super killer feature it's like so you define some model

classes and then with like about four lines of code you had this beautiful um crud interface

where you get a form you could edit the instances you could create things in the database it was

just amazing it's always been there so i i guess it's been there from the birth of django and from

the lawrence world journal i guess the the story is they needed a interface for the back end for

the news team to be able to create news articles themselves and so the admin was born from that i

suppose that's the story i've heard and i think the thing is is that now because a lot of times

people ask, well, can I can I can or should I use the admin in that capacity going forward? So let's

say you built a newspaper site today. And I would say you could, but you probably shouldn't. So

generally speaking, the admin is abused and asked to do too much. And we'll talk about, you know,

there is a point where you should just make your own custom pages. But the admin is, you know,

super helpful, I think, especially to beginners, because there's two ways to go in and do cred

stuff, you can go into the Django shell, which I think a lot of experienced Django developers maybe

you find faster. Like a Python, you just command line, you know exactly what you're doing. But for

beginners, having a graphical interface is fantastic. And so I always recommend people

play around with the admin first rather than the shell, though eventually you'll use both.

You say beginners. Let me just say straight up right now, I use the admin all the time. There

isn't a single project that I work on where I don't create a model and then immediately

create an admin for it and i may not use that admin for for the whole life of the project because

the model might get too complicated whatever but i always when i'm creating a model create an admin

because it's so little work and then you've got this interface and to be honest yeah i can go in

the shell but if i have to create a date time or something like that it's much easier to use the

you know the the little javascript gooey thing where i can select the date from the calendar

picker than it is to import date time date time date time what was the format wow yeah well if

we're both confessing i almost always use the admin too i mean occasionally i use the shell

if i'm feeling you know like i want to flex my developer muscles but i almost always use the

admin so that's so that's the first thing to mention so if you're brand new to django uh

there's an admin.py file that is created whenever you run start app command to create a new app and

with three or four lines of code it's in the docs we'll link to it you can have it appear in the

admin but apps will not appear automatically in the admin so in the same way you have to add the

apps to the installed app setting and settings.py file if you want them in the admin which you do

you should add them to the admin.py file and then you can do lots of stuff from there there's lots

of ways you can customize it um i was just looking through last night i mean the docs

per usual cover it all but it's just an overwhelming amount of stuff yeah and therein

lies the problem of the admin so at every almost at every point in the history of django it seems

somebody's come along with a good idea say oh let's add this model option to you know this

option to model admin and it's been added and it's been added and it's been added until it's

overwhelming and you know i'm very much of the the opinion that we we need a kind of a moratorium on

new features in the admin we need to kind of hold off close down some of the bugs maybe even simplify

and deprecate some of the existing features and then maybe we can make the admin more powerful

than it is but it's super powerful it's just that it's so hard to remember the api you have to go to

the docs and look it up.

Yeah, yeah, I do.

And yeah, I mean, model admin fields exclude.

I think actually in 2.1, there's a new option around permissions, right?

Because you can add action level permissions settings.

I believe that was added in 2.1.

Yeah, well, that tied in with the view.

So this...

for um the whole history of the project um it's you've always had change at least change

permissions um if you could if you could view a model in the admin and you could change it you

might not be able to add or delete but you could you could alter but now there's a view only

permission um right so you so you could be like a read-only user of the admin so why might that

be useful well maybe i don't know you've got um a board of stakeholders who they want to be able to

look at the data in the database, but you don't really want them to be able to edit anything

because, well, they have no idea what they're doing. Well, you can give them view-only permission

so that they can look at it, but they can't break anything. They can't have anything.

Yeah. And that's a perfect example of when you get into the subjective choice of when do you

eject from the admin. I mean, even with those permissions, for me to give someone non-technical

access to the admin, I feel a little squirrely about that. But yeah, you just maybe step along

And then when you feel like you need to do too much with the admin, you should make your own pages, basically.

Yeah, like you can override the templates and then you can inject.

Yeah, I was going to say, you can do the templates, you can do a lot.

Don't replace them, override them.

Yeah, and you can inject like a little extra widget of your own using, you know, none of this is super well documented.

So if you go down this path, then you need to be looking at the source, you need to be looking at the docs,

you need to be going into the templates and seeing where the extension points are.

that could be much better documented it could be you know a series of blog posts or something like

that but you when you find yourself um what's the making a herculean effort you know when you're

doing far too much that you know it's much easier than to just create a plain vanilla django view

that does your thing rather than trying to force it into the admin well yeah so that and that brings

up so you were telling me the other day you were fighting with the django admin and it won again

what was that particular case where you were fighting with the admin i was so there was a

regression introduced in in some commit i can't remember the exact commit whereby the um when you

added a new inline with the add button to add a model an inline form the the javascript event

handlers weren't correctly attached and that was because we'd moved from using jquery to vanilla

javascript and there was some reason why the event handlers weren't copied across in the new

way as they were in the old way anyway doesn't really matter i had to write a unit test for this

and in the end i got the unit test going using selenium and it was all very fine and good but

it took a long time and a lot of effort and you you know my tweet was about how the django admin

had won again because if you do try and get into the nullies and you do try and customize it too

much or you do try and write unit tests for the javascript on it you will find that it it's it's

complicated it's super powerful it's super mature um it's it's experienced over its lifetime lots

of feature growths that perhaps a little bit too much and that means it's complex and any software

which is complex takes time to tackle and wasn't there a number of years ago there was a proposal

to kind of redo it from scratch and it was estimated the cost would be over a million dollars

do i have that right i think maybe there's a blog post on that because you know it's a perpetual

thing well people say why can't we just do it differently it's like well because it's it's a

beast yeah no i mean you couldn't read you essentially couldn't now rewrite it i mean

there was an admin to effort i do and they did really well and they got really far but in the

end you you're never going to reach feature parity because it's got 10 years of edge cases

worked in and it's super right that's what it's super good and it's super powerful and it's and

you can do a lot with it and it has got extension points it's not that you can't you know do

anything to extend it but you're never going to replace that effort in an open source project so

unless, you know, AM Big Megacorp comes along and says, we're going to fund it to the tune of a

million bucks, which they're never going to do. It won't be replaced. Yeah. So appreciate for what

it is and don't try to make it what it's not. But let's start. So some specifics when you're

working with the admin, it has search. And actually, if you go in the source code, that's

an interesting place. You can see a basic search implementation. This is the other thing, right?

When you say go in the source, go in the source and have a look. So it's got filters, right? So

that you can have filters down the side, which enable you to be filtered by models. It's a great

source of like oh there has here's how i'd implement a filter no i looked i looked there

for inspiration for sure yeah well it also there are things you can do around speeding up the

admin. So Jacinda Kelly, who I think we'll have on as a guest soon, who's the CTO of Doctor on

Demand, gave a talk at PyCon I attended talking about ways to speed up the admin. Because if you

have a big, big project, you're going to be waiting on your admin. And that's a case where

you go, well, is it the admin? Is it my queries? Often it's your queries. But it can and is used

in very powerful ways when you have massive, massive data sets. And there's a whole bunch

of talks too if you look at past DjangoCon

PyCons about customizing

the admin. So actually one thing I want to ask you Carlton

is so there's an option to do an

admin documentation generator

that I have never done myself.

What's the use

case for that? I mean it sounds nice

but the fact that I haven't heard about it makes me think maybe

it's not widely used. No I

don't think it is widely used. I have to like okay

so I've half played with this years

ago didn't really get very far with it

and never looked at it again and every so often

every six months I go through

the docs i'm not oh yeah admin docs i should really take the the time to work that out i think

that's quite powerful so that will create from your source code kind of browsable reference

documentation which that just sounds brilliant and all you've got to do is especially when you're

dealing with jingo rest framework where that you know a big part of what you're doing is the

automated documentation and and you know well you're overseeing the switch you know to swagger

what i mean is like your your um your your um classes so you're like python classes your model

classes your your view classes you get some api like reference api documentation i don't mean like

api in terms of something that um another computer would call over a remote service not that kind of

api i mean api is in the software api as in what you program right right internal yeah it's a good

distinction to make yeah okay so you also are aware of it but not i haven't heard of someone

going nuts with it no he's on my list of something where i think oh i really should check that out

Because it's kind of there, and I suspect it's quite useful.

But to be honest, in all my time, I've never really looked at it more than half a thing where I didn't know what I was doing, and I didn't get it working very well, and I never tried again.

Perhaps I'll try again over the next few weeks and come back to you.

Yeah, that applies to so many things.

So one thing we should mention is hardening the admin.

So there's articles on this.

We'll link to a couple.

But there are some – it is a security concern because – so here's a number of things you should do.

And actually, Andrew Pinkham, who wrote Django Unleashed, someone I've talked with at length about the admin, he actually just removes it entirely on new projects.

Now, he knows what he's doing, so I'm not sure if I recommend that approach.

But to deal with these security things, he doesn't even use the admin at all.

He's pure Django shell.

He's hardcore.

What I would suggest regular people do is, in order at a minimum, change the URL so you can go into the path.

Don't have it be slash admin because people can and will search and try to force their way into your Django project.

You can make it use even more powerful passwords.

There's a number of ways and third-party packages to force greater level of password protection.

You can do two-factor auth.

you can get have fun with it and use um django admin honeypot which is a third-party package

which will let you track and see who is trying to get into slash admin on your site um of course

you should use ssl um that's really the basics that the top thing is don't have it at slash admin

you know take take a second and don't have it at slash admin um before you put it out in the wild

the thing i don't know you want to add to that yeah well the thing i do is um i make i configure

my reverse proxy so normally i use nginx um i configure it to only allow um access to the

admin from localhost or from 127.0.0 from the loopback address and then and then i use that's

a good idea and then i use an ssh tunnel to tunnel into my server and so that i can access

the admin so you have to have ssh access to the server and then um you can only you access the

the admin via a an ssh tunnel and it means essentially the only people who can access

the admin are those with ssh access to the server so i do that um right right so that yeah that

wouldn't work in like a newspaper context if you're using no no but then you could what might

work in that context is doing it something like something like via an intranet so you only have a

from a host which is exposed on the intranet so you know presumably um and people use vpns now

don't they um so you you might have to vpn into the the the internal network and then you can

access the the admin from there but some kind of network level controls where it's i can you know

the the the shh tunnel example is not very complicated if you nag me i can put that into

a gist or something yeah i mean the point is is on a large app you need to think about security

and the admin is is one of those but fundamentally it shouldn't feel that hard you know you should

basically you should add it for all your apps do a little bit of customization you can control the

layout when you're really fighting with it take a moment to think about whether you should try to

force the admin to do it versus just create your own custom pages like that would be the quick

takeaway but you should use it and again yeah and don't feel bad about using it versus the django

shell i mean you and i both prefer and predominantly use it so don't feel like you're not a real django

a developer because you use the admin but like you know you can't like i don't know let's say

you've created a blog post app right and you're writing your blog but you can't write your blog

post in the shell well you could yeah i know i mean there are people who could but i couldn't

yeah well why bother yeah um all right well so this i think that's really it this was meant to

be a short episode because we get this question a lot and i think there's just confusion around

it and people fighting with it and kind of wondering what's what's the lay of the land

among developers on how to use it.

But that's the quick take.

You should use it.

It's a fantastic feature.

When you use other frameworks,

you're going to go,

where is the admin?

Because it's really nice.

One thing I do is like,

so say I have no idea

how my model is going to look finally,

but I've got two or three fields,

which I'm sure of.

Okay, let me create the two or three fields,

create the admin,

start playing with it locally,

creating some records,

starting adding the right kind of data.

And then I can start creating

a couple of views around that

and see, oh, look, I'm missing a field.

and so i can write a migration to add the field and then i can add a few more records in this

admin and it enables me to kind of iteratively develop my model and my views and the api that

will wrap around those and even if i'm not going to use the admin in production it's a nice

development tool as i'm going along and for me i just love it i love it yeah and that's the other

thing too is that most people start with the models and you can spend quite a bit of time on

that and to have a graphical way to look at them and play with them is nice because you know i

always view it as that's that's sort of like the top of the waterfall and then the views and the

templates and urls that kind of that just naturally flows from the models but you have to get your

models right first and i do the same thing i'll i'll play around with the models and figure out

the relationships in the admin for quite a while before i do all the rest of it because that's

really the the backbone of any project yeah and you don't have to deploy this stuff to a web

application if you need a little note-taking app for some project you can work on you can just

create a start app stop start project start app um you know my my project i'm working on quick

model bam bam bam quick admin and there you are you've got a little admin ui that took you 20

minutes to put together yeah no and that's better than an excel spreadsheet right where you're

trying to enter data in a spreadsheet yeah and when i teach you know i i start with let's just

do the models in the admin and it's there and then we'll get to as i said the views the urls

and the templates, because internalizing that takes a while. But it really is all about the

models. I mean, if you ask any, again, another point, if you ask any professional developer

thinking about a project, the first thing I'm thinking about is I'm trying to whiteboard what

the model structure is, because that's the heart of everything. And at some point, actually, I'd

like to do a video series and just whiteboard how almost every website is the same. Facebook,

Twitter, Pinterest, Instagram, they all are crud with auth and a foreign key and either a one to

many or a many to many and you can certainly prototype them entirely with that yeah i mean

going through and just saying give me a website give me a complicated website i'm going to show

you how it's fits into that pattern 99 of the time that's another great uh learning approach

to people trying to internalize and get wrap their head around the structure of web apps

yeah and there you are and being able to wrap a gooey around that in five seconds is useful

yeah yeah so all right that's it we will be back as we will be back with future episodes and as

ever if you have feedback you can reach us at jango chat.com we're on twitter at chat jango

and we'll see you next time bye carl bye