1.24.6 — Packaged portal-mojo Admin with coordinated source sessions

2026-09-09

django-mojo 1.24.6 replaces the experimental handwritten Admin v2 with the packaged portal-mojo application while preserving the existing Admin. The new Portal automatically uses same-origin APIs, is linked from the legacy sidebar, and coordinates short-lived source sessions across tabs and logout races. No migration or Node/npm installation is required.

Added

• Django distributions now include the portal-mojo Admin at the configured Admin path plus /v2/, with an Open Portal link in the existing Admin sidebar.
• Source-session issuance now returns the effective expiry duration and timestamp, bounded by both the configured lifetime and access-token expiry.
• Release builds validate the Portal artifact across the source tree, wheel, source distribution, rebuilt wheel, and isolated installation before publication.

Changed

• The independently maintained handwritten Admin v2 is replaced by the reproducible portal-mojo artifact; the existing Admin remains the default route.
• The packaged Portal derives its API base from the deployment origin and uses same-origin /api/... requests without legacy endpoint configuration.

Fixed

• Expired or malformed browser credentials no longer prevent a fresh Admin sign-in from replacing the dead session.
• Admin sign-out now reaches the literal revocation endpoint instead of being shadowed by the private-asset route.
• Concurrent issuance and logout across legacy Admin, the access gate, Portal, and multiple tabs can no longer restore an obsolete source session.

Security

• Packaged Admin files are served only from a validated allowlist behind the short-lived source-session gate; provenance metadata is included in distributions but is not web-deliverable.
• Cross-tab coordination uses an exclusive browser lock and nonsecret generation tombstones; credentials are never copied into coordination storage or messages.

Upgrade notes

• No database migration or frontend build is required. Node and npm are producer-only dependencies and are not needed by installed Django applications.