Django Interview Questions Answered — ORM, Views, Middleware & More

# ─── models.py ───────────────────────────────────────────────────────────────
# The Model owns the data AND the business rules around that data.
# Notice: the discount calculation lives HERE, not in the view or template.
from django.db import models

class Product(models.Model):
    name = models.CharField(max_length=200)
    base_price = models.DecimalField(max_digits=8, decimal_places=2)
    is_on_sale = models.BooleanField(default=False)

    def discounted_price(self):
        """Business logic belongs in the model — fat models, thin views."""
        if self.is_on_sale:
            return self.base_price * 0.80  # 20% discount
        return self.base_price

    def __str__(self):
        return f"{self.name} (£{self.discounted_price():.2f})"


# ─── views.py ────────────────────────────────────────────────────────────────
# The View is a thin coordinator: fetch data, pass to template. Nothing more.
from django.shortcuts import render
from .models import Product

def product_list(request):
    # QuerySet is lazy — no DB hit yet, just a description of the query
    on_sale_products = Product.objects.filter(is_on_sale=True)

    # DB hit happens HERE when Django evaluates the QuerySet for the template
    context = {
        'products': on_sale_products,  # passed to the template by name
    }
    return render(request, 'shop/product_list.html', context)


# ─── shop/product_list.html (Template) ───────────────────────────────────────
# Templates are dumb on purpose — only presentation, no business logic.
# {% for product in products %}
#     <p>{{ product.name }} — {{ product.discounted_price }}</p>
# {% empty %}
#     <p>No sales on right now.</p>
# {% endfor %}

from django.db import models

# ─── models.py ───────────────────────────────────────────────────────────────
class Author(models.Model):
    name = models.CharField(max_length=100)

    def __str__(self):
        return self.name

class Book(models.Model):
    title = models.CharField(max_length=200)
    author = models.ForeignKey(Author, on_delete=models.CASCADE,
                               related_name='books')
    published_year = models.IntegerField()

    def __str__(self):
        return self.title


# ─── views.py ────────────────────────────────────────────────────────────────
from django.shortcuts import render
from .models import Book

# ❌ THE N+1 PROBLEM — fires 1 + N database queries
def book_list_slow(request):
    books = Book.objects.all()        # Query 1: SELECT * FROM book
    for book in books:
        # Each access to book.author fires a NEW query:
        # Query 2: SELECT * FROM author WHERE id=1
        # Query 3: SELECT * FROM author WHERE id=2  ... and so on
        print(book.author.name)       # 💥 N additional queries
    return render(request, 'books/list.html', {'books': books})


# ✅ THE FIX — select_related() for ForeignKey (SQL JOIN, 1 query total)
def book_list_fast(request):
    # Django generates: SELECT book.*, author.* FROM book
    #                   INNER JOIN author ON book.author_id = author.id
    books = Book.objects.select_related('author').all()

    for book in books:
        # author data is already in memory — ZERO extra queries here
        print(book.author.name)       # ✅ No additional DB hit

    return render(request, 'books/list.html', {'books': books})


# ✅ prefetch_related() for reverse FK / ManyToMany (2 queries, not N+1)
def author_list_with_books(request):
    # Query 1: SELECT * FROM author
    # Query 2: SELECT * FROM book WHERE author_id IN (1, 2, 3, ...)
    # Django then stitches the results together in Python memory
    authors = Author.objects.prefetch_related('books').all()

    for author in authors:
        # author.books.all() uses the prefetched cache — no extra query
        book_titles = [book.title for book in author.books.all()]
        print(f"{author.name}: {book_titles}")

    return render(request, 'books/authors.html', {'authors': authors})


# ─── LAZY EVALUATION DEMO ────────────────────────────────────────────────────
def queryset_laziness_demo():
    # Step 1: No DB hit — just builds a query object
    recent_books = Book.objects.filter(published_year__gte=2020)

    # Step 2: Still no DB hit — chaining is free
    recent_books = recent_books.order_by('-published_year')

    # Step 3: DB hit happens HERE — list() forces evaluation
    book_list = list(recent_books)
    # SQL fired: SELECT * FROM book WHERE published_year >= 2020
    #            ORDER BY published_year DESC

    print(f"Fetched {len(book_list)} books with a single query")
    return book_list

# ─── middleware.py ───────────────────────────────────────────────────────────
import time
import logging
from django.http import JsonResponse

logger = logging.getLogger(__name__)


class RequestTimingMiddleware:
    """
    Logs how long each request takes and adds an X-Response-Time header.
    This is the MODERN Django middleware pattern (callable class).
    """

    def __init__(self, get_response):
        # Called ONCE when the server starts — good place for one-time setup
        self.get_response = get_response
        logger.info("RequestTimingMiddleware initialised")

    def __call__(self, request):
        # ── INBOUND: code here runs BEFORE the view ──────────────────────────
        request_start_time = time.monotonic()  # monotonic = immune to clock drift

        # Hand off to the next middleware / view in the chain
        response = self.get_response(request)

        # ── OUTBOUND: code here runs AFTER the view ──────────────────────────
        elapsed_ms = (time.monotonic() - request_start_time) * 1000

        # Add timing info to every response header — useful for API clients
        response['X-Response-Time'] = f"{elapsed_ms:.2f}ms"

        logger.info(
            f"{request.method} {request.path} completed in {elapsed_ms:.2f}ms"
        )

        return response


class ApiKeyMiddleware:
    """
    Validates API key for /api/ routes only.
    Demonstrates short-circuiting — returning early WITHOUT calling the view.
    """
    VALID_API_KEYS = {'prod-key-abc123', 'staging-key-xyz789'}  # Use DB in real life

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        # Only enforce on /api/ routes — leave admin and frontend alone
        if request.path.startswith('/api/'):
            api_key = request.headers.get('X-API-Key', '')

            if api_key not in self.VALID_API_KEYS:
                # Short-circuit: return 401 WITHOUT calling the view at all
                return JsonResponse(
                    {'error': 'Invalid or missing API key'},
                    status=401
                )

        # Key is valid (or not an API route) — proceed normally
        response = self.get_response(request)
        return response


# ─── settings.py ─────────────────────────────────────────────────────────────
MIDDLEWARE = [
    # Execution order: top → bottom on request, bottom → top on response
    'django.middleware.security.SecurityMiddleware',      # Layer 1 in/out
    'django.contrib.sessions.middleware.SessionMiddleware',  # Layer 2 in/out
    'django.middleware.common.CommonMiddleware',          # Layer 3 in/out
    'django.middleware.csrf.CsrfViewMiddleware',          # Layer 4 in/out
    'django.contrib.auth.middleware.AuthenticationMiddleware',  # Layer 5 in/out
    'myapp.middleware.RequestTimingMiddleware',           # Layer 6 in/out (custom)
    'myapp.middleware.ApiKeyMiddleware',                  # Layer 7 in/out (custom)
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

# ─── models.py ───────────────────────────────────────────────────────────────
from django.db import models
from django.contrib.auth.models import User

class UserProfile(models.Model):
    """Extended user data — classic use case for post_save signal."""
    user = models.OneToOneField(User, on_delete=models.CASCADE,
                                related_name='profile')
    bio = models.TextField(blank=True)
    avatar_url = models.URLField(blank=True)

    def __str__(self):
        return f"Profile({self.user.username})"


# ─── signals.py ──────────────────────────────────────────────────────────────
# ✅ GOOD signal use case: UserProfile lives in a different app to User.
# We can't (shouldn't) modify Django's built-in User.save() directly.
# A signal lets us react to User creation without touching the User model.
from django.db.models.signals import post_save
from django.dispatch import receiver
from .models import UserProfile

@receiver(post_save, sender=User)
def create_user_profile_on_registration(sender, instance, created, **kwargs):
    """
    Fires automatically after EVERY User.save().
    'created' is True only when a NEW row was inserted — not on updates.
    """
    if created:
        # Only create the profile once, when the User is first created
        UserProfile.objects.create(user=instance)
        print(f"✅ Profile auto-created for new user: {instance.username}")


# ─── apps.py ─────────────────────────────────────────────────────────────────
# CRITICAL: signals must be imported so Django discovers the @receiver decorator
from django.apps import AppConfig

class AccountsConfig(AppConfig):
    name = 'accounts'

    def ready(self):
        # This import triggers the @receiver decorators to register themselves
        import accounts.signals  # noqa: F401 — import for side effects


# ─── CONTRAST: direct call (better for same-app logic) ───────────────────────
# ❌ DON'T use a signal for this — it's all within the same app
# and the logic is tightly coupled to the view anyway.

# BAD: signal-based order confirmation email (same app, obscure flow)
# @receiver(post_save, sender=Order)
# def send_order_email(sender, instance, created, **kwargs):
#     if created:
#         send_email(instance.customer_email, 'Your order is confirmed')

# ✅ GOOD: explicit call in the view — the flow is readable and testable
from django.shortcuts import redirect
from .models import Order
from .email_service import send_order_confirmation_email

def checkout_complete(request):
    order = Order.objects.create(
        customer=request.user,
        total=request.session.get('cart_total', 0)
    )
    # Explicit call — any developer reading this immediately knows what happens
    send_order_confirmation_email(order)
    return redirect('order_detail', pk=order.pk)