Visitor hostel v1

[Lakshmipriya272]

Brief description of what is fixed or changed

• Refactored the Visitor Hostel module into an API-first structure with expanded view logic, serializers, and URL routing.
• Added new security, performance, and service layers (RBAC, optimized serializers, selectors, services, and middleware).
• Introduced management commands, migrations, and tests to support booking/billing workflows, audit handling, and data integrity.

[vikrantwiz02]

Critical

• api/secure_views.py is 473 lines of dead code — SecureActiveBookingsApiView and the other views defined there are never imported in urls.py. None of this code runs. Either wire it up or remove it; shipping inert "secure" replacements creates a false sense of hardened endpoints.

• security/middleware.py defines VHSecurityMiddleware but it is not registered in settings/common.py MIDDLEWARE — the class is completely inert. All the authentication validation and rate-limiting logic inside it never executes against any request.

• VHSecurityPolicy in security/settings.py defines rate limits, session timeouts, and IP-allow rules as class attributes, but nothing reads or enforces them — the values sit unused. This is not security; it is documentation formatted as code.

• services.py uses from Fusion import settings — this is the wrong import pattern and may resolve differently depending on the Python path. Use from django.conf import settings to get Django's settings object reliably.

Should Not Be Committed

• api/views_backup.py — a 41-line file that begins with # Quick fix: ActiveBookingsApiView without meal indicators. Backup files must not be committed; use git branches or stash for this purpose.

[vikrantwiz02]

Backup file committed to the repository. The comment on line 3 (# Quick fix: ActiveBookingsApiView without meal indicators) confirms this is a workaround copy, not production code. Use git branches or git stash instead of committing backup files.

[vikrantwiz02]

VHSecurityMiddleware is defined here but is not added to the MIDDLEWARE list in settings/common.py. The middleware never runs — all the authentication validation, rate-limiting, and security logging inside it is completely bypassed for every request.

[vikrantwiz02]

473 lines of view implementations that are never imported in urls.py and therefore never reachable. Dead code at this scale is a maintenance burden and gives a misleading impression of improved security. Either wire these views into the URL configuration or remove this file.

[vikrantwiz02]

from Fusion import settings is not the standard Django pattern and may resolve incorrectly depending on the Python path. Use from django.conf import settings instead, which is guaranteed to return the active Django settings object.

[vikrantwiz02]

VHSecurityPolicy defines rate limits, session timeouts, and allowed IPs as class attributes, but nothing in the codebase reads or enforces these values. Defining security policies as unused constants provides no actual protection. These should either be wired into the middleware/views or removed to avoid giving a false impression of enforced security.