Building a Complete Django Project

django-admin startproject core .
python manage.py startapp users
python manage.py startapp jobs

from django.db import models
from django.contrib.auth.models import User # Built-in Auth model

class Job(models.Model):
    # Establish the relationship: This job was posted by a specific User (Employer)
    employer = models.ForeignKey(User, on_delete=models.CASCADE)
    title = models.CharField(max_length=200)
    description = models.TextField()
    salary = models.IntegerField()
    is_active = models.BooleanField(default=True)
    date_posted = models.DateTimeField(auto_now_add=True)

    def __str__(self):
        return self.title

from django import forms
from .models import Job

class JobForm(forms.ModelForm):
    class Meta:
        model = Job
        # Notice we DO NOT include 'employer'. We will handle that securely in the View!
        fields = ['title', 'description', 'salary']

from django.shortcuts import render, redirect, get_object_or_404
from django.contrib.auth.decorators import login_required
from .models import Job
from .forms import JobForm

# 1. READ ALL (Public)
def home(request):
    jobs = Job.objects.filter(is_active=True).order_by('-date_posted')
    return render(request, 'jobs/home.html', {'jobs': jobs})

# 2. CREATE (Secure)
@login_required
def create_job(request):
    if request.method == 'POST':
        form = JobForm(request.POST)
        if form.is_valid():
            # Stop! Don't save it to the DB just yet!
            job = form.save(commit=False) 
            
            # Securely attach the logged-in user as the employer
            job.employer = request.user 
            
            # Now save it permanently
            job.save()
            return redirect('jobs-home')
    else:
        form = JobForm()
    return render(request, 'jobs/job_form.html', {'form': form})

# 3. DELETE (Highly Secure)
@login_required
def delete_job(request, pk):
    job = get_object_or_404(Job, pk=pk)
    
    # SECURITY CHECK: Does the logged-in user own this specific job post?
    if job.employer != request.user:
        return render(request, '403.html') # Forbidden!
        
    if request.method == 'POST':
        job.delete()
        return redirect('jobs-home')
        
    return render(request, 'jobs/job_confirm_delete.html', {'job': job})

from django.urls import path
from . import views

urlpatterns = [
    path('', views.home, name='jobs-home'),
    path('job/new/', views.create_job, name='job-create'),
    path(&#039;job/<int:pk>/delete/', views.delete_job, name='job-delete'),
]