feat: add Django backend skeleton

2026-04-28 11:23:51 +02:00
parent 65a36a72e0
commit d8da268a53
27 changed files with 237 additions and 21 deletions
--- a/docs/security-notes.md
+++ b/docs/security-notes.md
@@ -80,6 +80,7 @@ Required controls:
 - check-in verification preview and confirmation require authenticated staff or admin users;
 - staff permissions should separate content management from operational check-in when practical;
 - public APIs must not allow clients to set protected fields such as reservation status, token values, or check-in state.
+- CORS must allow only configured Angular frontend origins through `CORS_ALLOWED_ORIGINS`.

 ## Input Validation