---
title: "1.24.6 — Packaged portal-mojo Admin with coordinated source sessions"
description: "django-mojo 1.24.6 replaces the experimental handwritten Admin v2 with the packaged portal-mojo application while preserving the existing Admin. The new Portal automatically uses same-origin APIs, is linked from the legacy sidebar, and coordinates short-lived source sessions across tabs and logout r…"
date: "2026-09-09"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-6/"
---

django-mojo 1.24.6 replaces the experimental handwritten Admin v2 with the packaged portal-mojo application while preserving the existing Admin. The new Portal automatically uses same-origin APIs, is linked from the legacy sidebar, and coordinates short-lived source sessions across tabs and logout races. No migration or Node/npm installation is required.

### Added

- Django distributions now include the portal-mojo Admin at the configured Admin path plus `/v2/`, with an **Open Portal** link in the existing Admin sidebar.
- Source-session issuance now returns the effective expiry duration and timestamp, bounded by both the configured lifetime and access-token expiry.
- Release builds validate the Portal artifact across the source tree, wheel, source distribution, rebuilt wheel, and isolated installation before publication.

### Changed

- The independently maintained handwritten Admin v2 is replaced by the reproducible portal-mojo artifact; the existing Admin remains the default route.
- The packaged Portal derives its API base from the deployment origin and uses same-origin `/api/...` requests without legacy endpoint configuration.

### Fixed

- Expired or malformed browser credentials no longer prevent a fresh Admin sign-in from replacing the dead session.
- Admin sign-out now reaches the literal revocation endpoint instead of being shadowed by the private-asset route.
- Concurrent issuance and logout across legacy Admin, the access gate, Portal, and multiple tabs can no longer restore an obsolete source session.

### Security

- Packaged Admin files are served only from a validated allowlist behind the short-lived source-session gate; provenance metadata is included in distributions but is not web-deliverable.
- Cross-tab coordination uses an exclusive browser lock and nonsecret generation tombstones; credentials are never copied into coordination storage or messages.

### Upgrade notes

- No database migration or frontend build is required. Node and npm are producer-only dependencies and are not needed by installed Django applications.