tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

affiliate/serializers.py

@@ -4,6 +4,9 @@ from rest_framework import serializers
 class AffiliateMeResponseSerializer(serializers.Serializer):
     referralCode = serializers.CharField()
     commissionRate = serializers.FloatField()
+    referredCount = serializers.IntegerField(help_text='کاربرهایی که کدِ شما را ثبت کرده‌اند.')
+    paidCount = serializers.IntegerField(help_text='از میانِ آن‌ها، کسانی که واقعاً پرداخت کرده‌اند.')
+    totalCommission = serializers.IntegerField(help_text='جمعِ پورسانتِ پرداخت‌های واقعی (تومان).')
 
 
 class TrackRequestSerializer(serializers.Serializer):

affiliate/services.py

@@ -0,0 +1,43 @@
+"""
+پورسانتِ معرف: فقط روی پرداختِ واقعی، فقط یک بار برای هر کاربرِ معرفی‌شده.
+
+تا ۲۰۲۶-۰۹-۲۵ هیچ کدی Conversion را از «pending» جلو نمی‌برد و پورسانتی
+حساب نمی‌شد؛ برنامه‌ی معرفی فقط یک جدولِ ثبت بود. حالا اولین سفارشِ
+پرداخت‌شده‌ی کاربرِ معرفی‌شده Conversion را `paid` می‌کند و
+`commission_amount = مبلغِ پرداختی × commission_rate` را ثبت می‌کند.
+پرداختِ خودِ پورسانت به معرف (تسویه) هنوز دستی و از پنلِ ادمین است.
+
+ثبت‌نام یا ورودِ مهمان هیچ پورسانتی نمی‌سازد؛ فقط پول جابه‌جا شدنِ واقعی.
+"""
+import logging
+
+from django.db import transaction
+
+from .models import Conversion
+
+logger = logging.getLogger(__name__)
+
+
+def record_paid_order(order) -> Conversion | None:
+    """از apply_order_payment_result صدا زده می‌شود، داخلِ همان تراکنش."""
+    if not order.amount:
+        return None
+    try:
+        with transaction.atomic():
+            conversion = (
+                Conversion.objects.select_for_update()
+                .select_related('affiliate_account')
+                .filter(referred_user_id=order.user_id, status='pending')
+                .first()
+            )
+            if conversion is None:
+                return None
+            rate = conversion.affiliate_account.commission_rate or 0
+            conversion.status = 'paid'
+            conversion.order_id = order.id
+            conversion.commission_amount = int(order.amount * rate)
+            conversion.save(update_fields=['status', 'order_id', 'commission_amount'])
+            return conversion
+    except Exception:  # noqa: BLE001 — پورسانت نباید تاییدِ پرداختِ خودِ کاربر را خراب کند
+        logger.exception('affiliate: ثبتِ پورسانتِ سفارش %s شکست خورد', order.id)
+        return None

affiliate/views.py

@@ -1,6 +1,6 @@
 from django.shortcuts import get_object_or_404
 from drf_spectacular.utils import extend_schema
-from rest_framework.exceptions import ValidationError
+from rest_framework.exceptions import PermissionDenied, ValidationError
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.throttling import ScopedRateThrottle
@@ -41,6 +41,16 @@ class GuestAwareAffiliateThrottle(ScopedRateThrottle):
         return self.cache_format % {'scope': self.scope, 'ident': ident}
 
 
+def _reject_guest(user):
+    """
+    مهمان نه کدِ معرف می‌گیرد نه معرفی‌شده حساب می‌شود: حسابِ مهمان با هر
+    deviceId تازه ساخته می‌شود، پس شمردنش فقط آمار را باد می‌کرد. بعد از ورود
+    با شماره، همان کاربر (با همان پیشرفت) می‌تواند کد را ثبت کند.
+    """
+    if getattr(user, 'is_guest', False):
+        raise PermissionDenied('برنامه‌ی معرفی بعد از ورود با شماره‌ی موبایل فعال می‌شود.')
+
+
 class AffiliateMeView(APIView):
     """GET /api/affiliate/me — حساب و کد ارجاع کاربر"""
 
@@ -48,9 +58,16 @@ class AffiliateMeView(APIView):
 
     @extend_schema(responses=AffiliateMeResponseSerializer, tags=['Affiliate (affiliate)'])
     def get(self, request):
+        _reject_guest(request.user)
         account, _ = AffiliateAccount.objects.get_or_create(user_id=request.user.id)
-
-        data = {'referralCode': account.referral_code, 'commissionRate': account.commission_rate}
+        paid = account.conversions.filter(status='paid')
+        data = {
+            'referralCode': account.referral_code,
+            'commissionRate': account.commission_rate,
+            'referredCount': account.conversions.count(),
+            'paidCount': paid.count(),
+            'totalCommission': sum(paid.values_list('commission_amount', flat=True)),
+        }
         return Response(AffiliateMeResponseSerializer(data).data)
 
 
@@ -83,7 +100,7 @@ class TrackConversionView(APIView):
         serializer = TrackRequestSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         v = serializer.validated_data
-
+        _reject_guest(request.user)
         account = get_object_or_404(AffiliateAccount, referral_code=v['referralCode'])
         referred_user_id = request.user.id