djust 1.0.0rc15 Release Notes

@permission_required event handlers no longer raise SynchronousOnlyOperation (#1648). Sibling of #1638: the per-event handler-permission check (_validate_event_security) called check_handler_permission synchronously from an async def. For a handler decorated with @permission_required, that calls user.has_perms(), which under Django's default ModelBackend queries the DB for a non-superuser — raising SynchronousOnlyOperation in the event loop (and, unlike the object-permission path, with no fail-closed catch, so it propagated). The call is now wrapped in sync_to_async, mirroring #1638 and the mount path.
live_redirect to a different view now mounts the correct target (#1647). The client's resolveViewPath() falls back to the current container's dj-view — the source view — when window.djust._routeMap is empty, which is the default for apps using plain Django path() URLconfs (no live_session()). The server trusted that client-supplied class in the live_redirect_mount frame, instantiated the source view against the destination URL's request, and raised "Failed to load view. Please refresh the page." handle_live_redirect_mount now resolves the destination view server-side from the URL via Django's URL dispatcher and overrides the client-supplied view when the URL maps to a djust LiveView (falling back to the client value otherwise, so live_session() route maps are unaffected). live_session() is no longer a hidden prerequisite for live_redirect across plain path() URLconfs.

djust 1.0.0rc15

Fixed