tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

accounts/views.py

@@ -6,6 +6,7 @@ import uuid
 from django.conf import settings
 from django.core.cache import cache
 from django.db import transaction
+from django.db.models import F
 from django.utils import timezone
 from drf_spectacular.utils import extend_schema
 from rest_framework import status
@@ -14,7 +15,7 @@ from rest_framework.response import Response
 from rest_framework.throttling import ScopedRateThrottle
 from rest_framework.views import APIView
 
-from .authentication import issue_access_token
+from .authentication import invalidate_user_cache, issue_access_token
 from .models import OTPCode, Profile, Session, User
 from .services import OTPDeliveryError, send_otp_sms
 from .serializers import (
@@ -22,6 +23,8 @@ from .serializers import (
     GuestSessionResponseSerializer,
     LoginRequestSerializer,
     LoginResponseSerializer,
+    LogoutRequestSerializer,
+    LogoutResponseSerializer,
     ProfileResponseSerializer,
     RefreshRequestSerializer,
     RefreshResponseSerializer,
@@ -207,7 +210,9 @@ class RequestOTPView(APIView):
         # فقط آخرین کد صادرشده معتبر است.
         OTPCode.objects.filter(phone=phone, is_used=False).update(is_used=True)
 
-        code = f'{secrets.randbelow(10000):04d}'
+        # ۶ رقم: با ۴ رقم و محدودیتِ تلاشِ per-worker، گرفتنِ حسابِ یک نفرِ مشخص
+        # روزی چند درصد شانس داشت. فرانت تا ۶ رقم را می‌پذیرد.
+        code = f'{secrets.randbelow(1_000_000):06d}'
         OTPCode.objects.create(
             phone=phone,
             code=code,
@@ -300,12 +305,24 @@ class LoginView(APIView):
                     valid = True
 
             if not valid:
+                _count_failed_attempt(phone)
                 return Response({'detail': 'کد OTP نامعتبر یا منقضی‌شده است.'}, status=status.HTTP_400_BAD_REQUEST)
 
-            user, created = User.objects.get_or_create(
-                phone=phone,
-                defaults={'is_guest': False, 'name': ''},
-            )
+            user = User.objects.filter(phone=phone).first()
+            created = False
+            guest = _upgradable_guest(request, phone) if user is None else None
+            if guest is not None:
+                # مهمانی که ثبت‌نام می‌کند همان کاربر می‌ماند: امتیاز، استریک،
+                # جزیره‌ها و گفتگوها همه با همین user_id ذخیره شده‌اند. پیش‌تر یک
+                # کاربرِ تازه و خالی ساخته می‌شد و پیشرفتِ مهمان جا می‌ماند.
+                guest.phone = phone
+                guest.save(update_fields=['phone'])
+                user, created = guest, True
+            elif user is None:
+                user, created = User.objects.get_or_create(
+                    phone=phone,
+                    defaults={'is_guest': False, 'name': ''},
+                )
             if user.is_guest:
                 user.is_guest = False
                 user.save(update_fields=['is_guest'])
@@ -336,6 +353,58 @@ class LoginView(APIView):
         return Response(LoginResponseSerializer(data).data)
 
 
+def _count_failed_attempt(phone: str) -> None:
+    """حدسِ غلط روی کدهای فعالِ این شماره؛ کدی که به سقف برسد باطل می‌شود."""
+    active = OTPCode.objects.filter(phone=phone, is_used=False, expires_at__gte=timezone.now())
+    active.update(failed_attempts=F('failed_attempts') + 1)
+    active.filter(failed_attempts__gte=settings.OTP_MAX_FAILED_ATTEMPTS).update(is_used=True)
+
+
+def _upgradable_guest(request, phone: str):
+    """
+    مهمانی که با توکنِ خودش درخواستِ ورود داده و این شماره هنوز حسابی ندارد.
+
+    شماره‌های TEST_LOGIN_PHONES عمداً کنار گذاشته می‌شوند: حساب‌های دمو با
+    همین شماره‌ها ساخته شده‌اند و ورودِ آزمایشی نباید حسابِ مهمانِ دمو
+    (`frontend-test-device`) را به یک شماره تبدیل کند.
+    """
+    if phone in settings.TEST_LOGIN_PHONES:
+        return None
+    user = getattr(request, 'user', None)
+    if user is None or not getattr(user, 'is_authenticated', False) or not user.is_guest:
+        return None
+    return User.objects.filter(pk=user.pk, is_guest=True, phone__isnull=True).first()
+
+
+class LogoutView(APIView):
+    """
+    POST /api/auth/logout — خروج از حساب.
+
+    refreshTokenِ این دستگاه (اگر فرستاده شود) باطل می‌شود و همه‌ی access
+    tokenهای صادرشده تا این لحظه رد می‌شوند. دستگاه‌های دیگر با refreshِ
+    خودشان بی‌صدا توکنِ تازه می‌گیرند؛ فقط همین دستگاه بیرون می‌ماند.
+    """
+
+    permission_classes = [IsAuthenticated]
+
+    @extend_schema(
+        request=LogoutRequestSerializer, responses=LogoutResponseSerializer,
+        tags=['Identity & Profile (accounts)'],
+    )
+    def post(self, request):
+        serializer = LogoutRequestSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        refresh_token = serializer.validated_data.get('refreshToken') or ''
+        with transaction.atomic():
+            if refresh_token:
+                Session.objects.filter(
+                    user_id=request.user.id, refresh_token=refresh_token,
+                ).update(revoked=True)
+            User.objects.filter(pk=request.user.id).update(tokens_valid_after=timezone.now())
+        invalidate_user_cache(request.user.id)
+        return Response(LogoutResponseSerializer({'success': True}).data)
+
+
 class RefreshTokenView(APIView):
     """POST /api/auth/refresh — تمدید توکن"""