feat: implement django silk for api performance monitoring and profiling

[ngovinh2k2]

What?

Implement django silk for API performance monitoring and profiling

Why?

How?

Testing?

• Functional Testing
• Security
• Performance
• Error Handling
• Code Quality
• Documentation
• Database
• Deployment
• Final Review

Anything Else?

[gemini-code-assist]

Code Review

This pull request integrates the django-silk profiling tool into the project for development environments, adding the package to requirements.txt, configuring the middleware and settings in settings.py, and exposing the console URL in urls.py. The review feedback recommends disabling Silk during test runs to avoid performance and database issues, enabling authentication/authorization for the Silk console to secure sensitive profiling data, and removing the SILKY_INTERCEPT_PERCENT setting to resolve a configuration conflict and ensure all API requests are profiled during local development.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Issue: Silk Enabled During Test Runs

If the test suite is executed (e.g., via python manage.py test), the environment variable ENV will likely default to "dev", which enables Django Silk.

Running Silk during tests has several negative impacts:

1. Performance: It significantly slows down the test suite by intercepting and saving every request and database query.
2. Database Integrity: It attempts to write to the database, which can cause issues if the test database is not fully migrated or if tests are run in parallel.
3. Isolation: It can pollute test runs and cause unexpected side effects.

Recommendation

Disable Silk when running tests by checking sys.argv.

Suggested change

	SILK_ENABLED = os.getenv("ENV", "dev").lower() == "dev"
	import sys
	SILK_ENABLED = os.getenv("ENV", "dev").lower() == "dev" and "test" not in sys.argv

[gemini-code-assist]

Security Risk: Unprotected Silk Console

Setting both SILKY_AUTHENTICATION and SILKY_AUTHORISATION to False allows anyone to access the Silk profiling console at /silk/console/ without logging in.

Even in a development environment, if this service is deployed to a shared or public development/staging server, this exposes sensitive information including:

• Database queries (SQL) and execution times.
• Request and response headers (which may contain auth tokens or session cookies).
• Request and response bodies.

Recommendation

Enable authentication and authorization by default, or make them configurable via environment variables so that only authenticated staff/superusers can access the profiling data.

Suggested change

	SILKY_AUTHENTICATION = False
	SILKY_AUTHORISATION = False
	SILKY_AUTHENTICATION = True
	SILKY_AUTHORISATION = True

[gemini-code-assist]

Configuration Conflict & Usability Issue

1. Mutual Exclusivity: In Django Silk, SILKY_INTERCEPT_PERCENT and SILKY_INTERCEPT_FUNC are mutually exclusive. Defining both can lead to unexpected behavior or one overriding the other.
2. Usability in Dev: Setting SILKY_INTERCEPT_PERCENT = 10 means only 10% of requests are intercepted. In a local development environment, developers expect 100% of their requests to be profiled so they can debug and analyze them reliably. A 10% rate will make debugging extremely confusing as most requests will be silently ignored.

Recommendation

Remove SILKY_INTERCEPT_PERCENT to rely entirely on SILKY_INTERCEPT_FUNC (which will intercept 100% of the matching /api/ requests).

Suggested change

	SILKY_META = True
	SILKY_INTERCEPT_PERCENT = 10
	SILKY_MAX_RECORDED_REQUESTS_CHECK_PERCENT = 10
	SILKY_META = True
	SILKY_MAX_RECORDED_REQUESTS_CHECK_PERCENT = 10