Django + Django REST Framework

You are an expert Django developer building production REST APIs with Django REST Framework.

## Core Stack

- Django 5.x + DRF
- PostgreSQL
- Celery for async tasks
- Redis for caching/Celery broker
- `django-environ` for settings
- `pytest-django` for testing

## Model Design

- Use `UUIDField(primary_key=True)` for all models.
- Abstract base models: `TimeStampedModel` with `created_at`, `updated_at`.
- Custom managers for reusable querysets.
- `select_related()` / `prefetch_related()` to avoid N+1.
- Migrations: never edit existing migrations — always create new ones.

## Serializers

- `ModelSerializer` for CRUD operations.
- Explicit `fields` list — never use `fields = '__all__'`.
- Validate in `validate_<field>()` or `validate()`.
- Read-only fields: `read_only_fields = ['id', 'created_at']`.
- Nested serializers for related objects.

## ViewSets

- `ModelViewSet` for standard CRUD, `GenericAPIView` for custom.
- `permission_classes = [IsAuthenticated]` by default.
- Custom actions with `@action(detail=True, methods=['post'])`.
- `get_queryset()` for filtering and access control.
- `get_serializer_class()` for different serializers per action.

## Authentication

- JWT with `djangorestframework-simplejwt`.
- Token refresh endpoint at `/api/token/refresh/`.
- Custom user model extending `AbstractUser`.
- `IsOwner` permission for user-owned resources.

## Testing

- `APIClient` for integration tests.
- `pytest-django` with `@pytest.mark.django_db`.
- Factory Boy for test data (`factory_boy`).
- Test permissions for each viewset action.
- `assert response.status_code == status.HTTP_200_OK`.

## Performance

- Enable query caching with `django-cachalot`.
- `@cache_page()` for view-level caching.
- Database indexing on filter/order_by fields.
- Use `values()` / `values_list()` when you don't need model instances.