---
title: "1.23.0 — API-first Admin Security and verified fleet firewall state"
description: "django-mojo 1.23.0 adds a dedicated Admin Security workspace and exact-host firewall verification without breaking established REST administration. Authorized users and validated per-user API keys retain their existing global permissions, group credentials get exact-group read access, legacy rules k…"
date: "2026-09-05"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-23-0/"
---

django-mojo 1.23.0 adds a dedicated Admin Security workspace and exact-host firewall verification without breaking established REST administration. Authorized users and validated per-user API keys retain their existing global permissions, group credentials get exact-group read access, legacy rules keep working, and administrators can inspect complete operational evidence. Fresh reauthentication is deployment-configured and off by default; only actual authentication secrets are hidden.

### Added

- Dedicated Admin Security workspace and REST endpoints for cases, incidents, events, policies, IPSets, recommendations, action schemas, and firewall state. They add no CORS or request-origin restriction.
- Checked job execution targets one compatible runner per hostname and returns incarnation-correlated `verified`, `partial`, or `unknown` results.
- Optional governed policy actions provide atomic typed validation, server-owned markers, revision binding, and explicit activation while legacy policy APIs remain available.

### Changed

- Interactive users and validated per-user `UserAPIKey` credentials use their existing global security permissions. Group API keys and group-scoped tokens can read only evidence belonging to their exact authenticated group.
- Authorized detail responses retain operational addresses, CIDRs, commands, handler paths, errors, metadata, and raw evidence. Large fields use bounded signed pagination; only authentication secrets are scrubbed.
- Security mutation freshness follows the deployment's `FRESH_AUTH_WINDOW` / `FRESH_AUTH_ENFORCE` policy and defaults to off. Proven machine credentials do not require interactive reauthentication.
- Firewall and IPSet state now records durable desired generations and exact-host observations. Incomplete delivery remains pending and is never reported as success.

### Fixed

- Markerless legacy RuleSets and Rules retain permissioned generic REST CRUD and continue executing with their established regexes and handlers.
- RuleSet, recommendation, ticket, IPSet, and Assistant approvals reject stale revisions and preserve recoverable state after ambiguous dispatch.
- Policy reparenting and replacement now use consistent transactional locking, preventing stale revisions and direct-save replacement deadlocks.

### Security

- Token refresh accepts only genuine refresh tokens; access, OAuth/MCP, per-user API-key, group-token, and account API-key credentials cannot be exchanged into ordinary bearer sessions.
- Governed policy markers are immutable and server-owned, and malformed reserved markers fail closed.
- Admin Security action audits retain non-secret server-authored credential provenance without exposing tokens or signing material.

### Upgrade notes

- Apply migrations before serving traffic. Existing firewall-touched or whitelisted IP rows and legacy IPSets become pending because earlier best-effort broadcasts are not proof of current fleet state.
- Run at least one checked-protocol job engine on every intended hostname before relying on checked firewall actions, then synchronize pending IPSets and firewall state.
- Invalid or IPv6 firewall targets and malformed, reserved, oversized, or excessively large legacy IPSets are quarantined for operator repair; valid sibling rows continue reconciling.
- No RuleSet/Rule migration is required. Existing management clients may keep using the legacy-compatible endpoints and adopt governed actions only when they want the stronger workflow.