---
title: "1.10.0 — Built-in Admin control plane and durable platform operations"
description: "Django-MOJO 1.10 adds a workflow-centered Admin portal for people, WebApps, domains and DNS, activity, setup, and platform health, backed by resumable onboarding and UUID-owned deployment evidence. It also hardens fresh-auth boundaries, secret handling, and the first upgrade from 1.9."
date: "2026-08-10"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-10-0/"
---

Django-MOJO 1.10 adds a workflow-centered Admin portal for people, WebApps, domains and DNS, activity, setup, and platform health, backed by resumable onboarding and UUID-owned deployment evidence. It also hardens fresh-auth boundaries, secret handling, and the first upgrade from 1.9.

### Breaking

- `POST /api/edge/webapp/link_key` now requires a recent interactive login plus an explicit action and client-generated UUID operation ID; credentials are revealed only once.
- `POST /api/dnsman/registrar/purchase` now requires a recent interactive login and typed domain and price confirmation matching the quote.
- Edge node scripts and direct `deploy_status set` callers must pass the Platform deployment UUID; a narrow bridge covers the first upgrade from 1.9.

### Added

- Added a private built-in Admin portal for Dashboard, People, Web Apps, Domains & DNS, Platform, and Activity, delivered from the installed wheel.
- Added durable, resumable System Setup for installation identity, AWS services, DNS, hosting, and readiness.
- Added guided WebApp onboarding across application identity, domains and DNS, GitHub workflow, deployment-key custody, and public verification.
- Added UUID-owned Platform deployment history with frozen fleet rosters, per-runner evidence, retry and convergence controls, and stale-callback protection.
- Added searchable Activity views for logs, events, incidents, and tickets, plus complete User and Group administration.

### Changed

- Domains & DNS is now a first-class Admin destination beside Web Apps; certificates remain an automatic implementation detail.
- Platform health now presents permission-filtered summaries and keeps raw bounded evidence behind explicit details.
- AWS setup automates credentials, storage, monitoring, and DNS convergence while leaving SES production-access requests user-controlled.

### Fixed

- Added a compatibility bridge so an existing 1.9 canary can report status after installing the UUID-aware framework.
- Hardened setup recovery, fleet roster discovery, public probing, DNS hierarchy depth, provider retries, and concurrent test isolation.

### Security

- Admin source files require a short-lived Redis-backed interactive session, and unauthenticated asset requests fail closed.
- Fresh-auth and machine-session denials now protect domain purchases, deployment-key custody, protected settings, and deployment recovery.
- Secrets and raw provider or process errors are scrubbed from Admin responses, durable evidence, incidents, and request logging.

### Upgrade notes

- Apply the new account, AWS, DNS, Edge, and incident migrations before using the new Admin and deployment workflows.
- For the default `/admin/` path, mount `mojo.urls` at the root with `REST_AUTO_PREFIX=True`; legacy projects mounted only beneath `/api/` will expose the portal beneath that prefix.
- Update existing WebApp key and registrar purchase clients to the new confirmation and idempotency contracts before upgrading.