django-rules

Django Rules for Cursor: ORM, Permissions and Migrations

Install

Install the native export at .cursor/rules/django-rules.mdc. Copy that export, not this catalog file. Catalog fields such as tools and author are for presets.dev. Install one skill file per name. Cursor, GitHub Copilot, Codex, Antigravity CLI, and Devin can all read .agents/skills, so a second copy with the same name collides.

Django Rules for Cursor: ORM, Permissions and Migrations

File-scoped Cursor rule for Django. It attaches when a matching file is in context.

Updated for Django 6.1.3, Nov 2026

Do not upgrade dependencies or the framework version unless the task asks.

Project shape

An app owns its models, forms, and views. A view checks permission, validates input, and calls a function or a model method. Business rules do not pile up in the view. Settings come from environment-backed settings, not a new hardcoded secret.

Use the project's auth decorators or mixins. A class-based view and a function view follow the one the app already uses.

ORM

select_related and prefetch_related match the template or serializer that walks relations. A loop that queries per row is an N+1. Assert the query count in a test when the project already does that.

A queryset is filtered before it is evaluated. Do not list(Model.objects.all()) and filter in Python. QuerySet.update() is SQL. It does not call save() and it does not send signals. QuerySet.delete() does send pre_delete and post_delete, including for rows Django cascades in Python. It does not call your model's delete() method, so an override there does not run. A database ON DELETE CASCADE is separate: the database removes the row and Django does not send a signal for that child. If the override must run, iterate instances and call delete() on each.

Note.objects.filter(tenant=tenant).delete()  # signals fire, Note.delete() does not
for note in Note.objects.filter(tenant=tenant):
    note.delete()  # the override runs