1.10.0 — Built-in Admin control plane and durable platform operations

2026-08-10

Django-MOJO 1.10 adds a workflow-centered Admin portal for people, WebApps, domains and DNS, activity, setup, and platform health, backed by resumable onboarding and UUID-owned deployment evidence. It also hardens fresh-auth boundaries, secret handling, and the first upgrade from 1.9.

Breaking

• POST /api/edge/webapp/link_key now requires a recent interactive login plus an explicit action and client-generated UUID operation ID; credentials are revealed only once.
• POST /api/dnsman/registrar/purchase now requires a recent interactive login and typed domain and price confirmation matching the quote.
• Edge node scripts and direct deploy_status set callers must pass the Platform deployment UUID; a narrow bridge covers the first upgrade from 1.9.

Added

• Added a private built-in Admin portal for Dashboard, People, Web Apps, Domains & DNS, Platform, and Activity, delivered from the installed wheel.
• Added durable, resumable System Setup for installation identity, AWS services, DNS, hosting, and readiness.
• Added guided WebApp onboarding across application identity, domains and DNS, GitHub workflow, deployment-key custody, and public verification.
• Added UUID-owned Platform deployment history with frozen fleet rosters, per-runner evidence, retry and convergence controls, and stale-callback protection.
• Added searchable Activity views for logs, events, incidents, and tickets, plus complete User and Group administration.

Changed

• Domains & DNS is now a first-class Admin destination beside Web Apps; certificates remain an automatic implementation detail.
• Platform health now presents permission-filtered summaries and keeps raw bounded evidence behind explicit details.
• AWS setup automates credentials, storage, monitoring, and DNS convergence while leaving SES production-access requests user-controlled.

Fixed

• Added a compatibility bridge so an existing 1.9 canary can report status after installing the UUID-aware framework.
• Hardened setup recovery, fleet roster discovery, public probing, DNS hierarchy depth, provider retries, and concurrent test isolation.

Security

• Admin source files require a short-lived Redis-backed interactive session, and unauthenticated asset requests fail closed.
• Fresh-auth and machine-session denials now protect domain purchases, deployment-key custody, protected settings, and deployment recovery.
• Secrets and raw provider or process errors are scrubbed from Admin responses, durable evidence, incidents, and request logging.

Upgrade notes

• Apply the new account, AWS, DNS, Edge, and incident migrations before using the new Admin and deployment workflows.
• For the default /admin/ path, mount mojo.urls at the root with REST_AUTO_PREFIX=True; legacy projects mounted only beneath /api/ will expose the portal beneath that prefix.
• Update existing WebApp key and registrar purchase clients to the new confirmation and idempotency contracts before upgrading.