# Django: safe manage.py commands and destructive operations

allowlists:
  commands:
    # ── Django: safe manage.py commands (read-only/inspection) ─────
    - { command: "python manage.py check", trust: minimal }
    - { command: "python manage.py showmigrations", trust: minimal }
    - { command: "python manage.py diffsettings", trust: minimal }
    - { command: "python manage.py sqlmigrate", trust: minimal }
    - { command: "python manage.py sqlflush", trust: minimal }
    - { command: "python manage.py sqlsequencereset", trust: minimal }
    - { command: "python manage.py inspectdb", trust: minimal }
    # ── Django: common dev commands ───────────────────────────────────
    - { command: "python manage.py test", trust: standard, reason: "Runs Django tests" }
    - { command: "python manage.py makemigrations", trust: standard, reason: "Creates Django database migration files" }
    - { command: "python manage.py runserver", trust: standard, reason: "Starts the Django development server" }
    - { command: "python manage.py startapp", trust: standard, reason: "Creates a new Django application" }
    - { command: "python manage.py startproject", trust: standard, reason: "Creates a new Django project" }
    - { command: "python manage.py dumpdata", trust: standard, reason: "Exports Django database data as JSON" }
    - { command: "python manage.py makemessages", trust: standard, reason: "Extracts translatable strings for i18n" }
    - { command: "python manage.py compilemessages", trust: standard, reason: "Compiles translation message files" }
    # ── Django: python3 variants (read-only/inspection) ───────────────
    - { command: "python3 manage.py check", trust: minimal }
    - { command: "python3 manage.py showmigrations", trust: minimal }
    - { command: "python3 manage.py diffsettings", trust: minimal }
    - { command: "python3 manage.py sqlmigrate", trust: minimal }
    - { command: "python3 manage.py sqlflush", trust: minimal }
    - { command: "python3 manage.py sqlsequencereset", trust: minimal }
    - { command: "python3 manage.py inspectdb", trust: minimal }
    # ── Django: python3 common dev commands ──────────────────────────
    - { command: "python3 manage.py test", trust: standard, reason: "Runs Django tests" }
    - { command: "python3 manage.py makemigrations", trust: standard, reason: "Creates Django database migration files" }
    - { command: "python3 manage.py runserver", trust: standard, reason: "Starts the Django development server" }
    - { command: "python3 manage.py startapp", trust: standard, reason: "Creates a new Django application" }
    - { command: "python3 manage.py startproject", trust: standard, reason: "Creates a new Django project" }
    - { command: "python3 manage.py dumpdata", trust: standard, reason: "Exports Django database data as JSON" }
    - { command: "python3 manage.py makemessages", trust: standard, reason: "Extracts translatable strings for i18n" }
    - { command: "python3 manage.py compilemessages", trust: standard, reason: "Compiles translation message files" }
    # ── Django: uv run variants (read-only/inspection) ────────────────
    - { command: "uv run python manage.py check", trust: minimal }
    - { command: "uv run python manage.py showmigrations", trust: minimal }
    - { command: "uv run python manage.py diffsettings", trust: minimal }
    - { command: "uv run python manage.py sqlmigrate", trust: minimal }
    - { command: "uv run python manage.py sqlflush", trust: minimal }
    - { command: "uv run python manage.py sqlsequencereset", trust: minimal }
    - { command: "uv run python manage.py inspectdb", trust: minimal }
    # ── Django: uv run common dev commands ────────────────────────────
    - { command: "uv run python manage.py test", trust: standard, reason: "Runs Django tests" }
    - { command: "uv run python manage.py makemigrations", trust: standard, reason: "Creates Django database migration files" }
    - { command: "uv run python manage.py migrate", trust: standard, reason: "Applies Django database migrations" }
    - { command: "uv run python manage.py runserver", trust: standard, reason: "Starts the Django development server" }
    - { command: "uv run python manage.py startapp", trust: standard, reason: "Creates a new Django application" }
    - { command: "uv run python manage.py startproject", trust: standard, reason: "Creates a new Django project" }
    - { command: "uv run python manage.py dumpdata", trust: standard, reason: "Exports Django database data as JSON" }
    - { command: "uv run python manage.py makemessages", trust: standard, reason: "Extracts translatable strings for i18n" }
    - { command: "uv run python manage.py compilemessages", trust: standard, reason: "Compiles translation message files" }
    # ── Django: uv run python3 variants (read-only/inspection) ────────
    - { command: "uv run python3 manage.py check", trust: minimal }
    - { command: "uv run python3 manage.py showmigrations", trust: minimal }
    - { command: "uv run python3 manage.py diffsettings", trust: minimal }
    - { command: "uv run python3 manage.py sqlmigrate", trust: minimal }
    - { command: "uv run python3 manage.py sqlflush", trust: minimal }
    - { command: "uv run python3 manage.py sqlsequencereset", trust: minimal }
    - { command: "uv run python3 manage.py inspectdb", trust: minimal }
    # ── Django: uv run python3 common dev commands ───────────────────
    - { command: "uv run python3 manage.py test", trust: standard, reason: "Runs Django tests" }
    - { command: "uv run python3 manage.py makemigrations", trust: standard, reason: "Creates Django database migration files" }
    - { command: "uv run python3 manage.py migrate", trust: standard, reason: "Applies Django database migrations" }
    - { command: "uv run python3 manage.py runserver", trust: standard, reason: "Starts the Django development server" }
    - { command: "uv run python3 manage.py startapp", trust: standard, reason: "Creates a new Django application" }
    - { command: "uv run python3 manage.py startproject", trust: standard, reason: "Creates a new Django project" }
    - { command: "uv run python3 manage.py dumpdata", trust: standard, reason: "Exports Django database data as JSON" }
    - { command: "uv run python3 manage.py makemessages", trust: standard, reason: "Extracts translatable strings for i18n" }
    - { command: "uv run python3 manage.py compilemessages", trust: standard, reason: "Compiles translation message files" }

rules:
  # ============================================================
  # HIGH: Django destructive operations
  # ============================================================
  - id: django-migrate
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["migrate"]
    decision: ask
    reason: "Django migrate modifies database schema"

  - id: django-flush
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["flush"]
    decision: ask
    reason: "Django flush deletes all data from database"

  - id: django-loaddata
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["loaddata"]
    decision: ask
    reason: "Django loaddata modifies database content"

  - id: django-createsuperuser
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["createsuperuser"]
    decision: ask
    reason: "Django createsuperuser creates admin user"

  - id: django-changepassword
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["changepassword"]
    decision: ask
    reason: "Django changepassword modifies user credentials"

  - id: django-clearsessions
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["clearsessions"]
    decision: ask
    reason: "Django clearsessions deletes session data"

  - id: django-dbshell
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["dbshell"]
    decision: ask
    reason: "Django dbshell provides direct database access"

  - id: django-shell
    level: high
    match:
      command:
        any_of: [python, python3]
      args:
        any_of: ["manage.py", "*/manage.py"]
      flags:
        any_of: ["shell", "shell_plus"]
    decision: ask
    reason: "Django shell provides arbitrary code execution"

  # ── Django: uv run variants ───────────────────────────────────
  - id: uv-django-flush
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["flush"]
    decision: ask
    reason: "Django flush deletes all data from database"

  - id: uv-django-loaddata
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["loaddata"]
    decision: ask
    reason: "Django loaddata modifies database content"

  - id: uv-django-createsuperuser
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["createsuperuser"]
    decision: ask
    reason: "Django createsuperuser creates admin user"

  - id: uv-django-changepassword
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["changepassword"]
    decision: ask
    reason: "Django changepassword modifies user credentials"

  - id: uv-django-clearsessions
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["clearsessions"]
    decision: ask
    reason: "Django clearsessions deletes session data"

  - id: uv-django-dbshell
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["dbshell"]
    decision: ask
    reason: "Django dbshell provides direct database access"

  - id: uv-django-shell
    level: high
    match:
      command: uv
      args:
        any_of: ["run"]
      flags:
        any_of: ["shell", "shell_plus"]
    decision: ask
    reason: "Django shell provides arbitrary code execution"
