tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

Tutor (prompt tutor-v3-stepwise-plain): plain text instead of LaTeX/markdown,
with rag/services/mathtext.py converting whatever still slips through; full
step-by-step solutions with a check before the final answer; three tones by
grade; the last 6 messages of the conversation go to the model and follow-ups
are no longer served from another user's cache; book solutions the checker
disputes are kept out of the context; a questionId gives the tutor the
practice question and the student's wrong answer. /api/health reports when
the AI credit runs out. rag_model_benchmark compares chat models on verified
book problems (run on the server; credit ran out mid-run).

Map: only lessons that have questions count toward finishing an island,
lessonIds[0] / nextLessonId is always the next lesson to play, and a finished
island stays finished. The Seyar characters (sigma/delta/pi) are seeded.

Audit fixes, each reproduced before fixing:
- the plan is stored on the order, so paying a monthly order after starting
  a yearly checkout no longer grants a year
- opening checkout no longer demotes an active subscription; renewals extend
  from the current expiry; expired subscriptions are not reported active
- one discount code per order and only before the gateway; a 100% code
  completes the purchase; lost Zarinpal confirmations are re-verified
- the unused /api/payment/webhook "mark paid" endpoint is removed
- XP counts only answers recorded on the server
- 6-digit OTP, each code dies after 5 wrong guesses; POST /api/auth/logout
- a guest who signs up keeps their account and progress (test phones excluded)
- affiliate commission on the first real payment; guests excluded
- parents with several children no longer get a 500
- SQLite runs transactions IMMEDIATE, since it ignores select_for_update
- admin login is rate-limited; display names drop phone numbers and links;
  userQuestion is capped at 2000 characters
- server-side heart enforcement exists behind HEARTS_ENFORCED (off until the
  frontend handles 403 no_hearts)

Not done on purpose: rotating the server's secret key and moving to Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

subscription/services.py

@@ -19,24 +19,37 @@ def has_unlimited_hearts(user_id: int) -> bool:
     ).exists()
 
 
-def activate_subscription(subscription_id: int):
+def activate_subscription(subscription_id: int, plan_id: int | None = None):
     """
-    بعد از تایید پرداخت (payment webhook) صدا زده می‌شود؛ اشتراک را active
-    می‌کند و expires_at را بر اساس Plan.duration_days محاسبه می‌کند.
-    مستقل از caller اتمیک است چون از چند جا (payment webhook، bazaar verify) صدا زده می‌شود.
+    بعد از تاییدِ پرداخت صدا زده می‌شود (کال‌بکِ زرین‌پال، تاییدِ بازار).
+
+    - پلن از *سفارشِ پرداخت‌شده* می‌آید (`plan_id`)، نه از Subscription؛ پلنِ
+      روی Subscription با شروعِ خریدِ دیگری عوض می‌شد (باگِ «ماهانه بده، سالانه
+      بگیر»). سفارش‌های قدیمیِ بی‌plan_id همان رفتارِ قبلی را دارند.
+    - تمدید از تاریخِ انقضای فعلی حساب می‌شود، نه از امروز؛ پیش‌تر تمدیدِ زودتر
+      از موعد روزهای باقی‌مانده را پاک می‌کرد.
     """
+    from .models import Plan
+
     with transaction.atomic():
         try:
             subscription = Subscription.objects.select_for_update().get(pk=subscription_id)
         except Subscription.DoesNotExist:
             return None
-
         old_status = subscription.status
-        duration_days = subscription.plan.duration_days if subscription.plan else 30
+        plan = Plan.objects.filter(pk=plan_id).first() if plan_id else None
+        plan = plan or subscription.plan
+        duration_days = plan.duration_days if plan else 30
+        now = timezone.now()
+        still_running = (
+            old_status == 'active' and subscription.expires_at is not None
+            and subscription.expires_at > now
+        )
+        start = subscription.expires_at if still_running else now
         subscription.status = 'active'
-        subscription.expires_at = timezone.now() + timezone.timedelta(days=duration_days)
-        subscription.save(update_fields=['status', 'expires_at'])
-
+        subscription.plan = plan
+        subscription.expires_at = start + timezone.timedelta(days=duration_days)
+        subscription.save(update_fields=['status', 'plan', 'expires_at'])
         status_changed.send(
             sender='subscription.Subscription', object_id=subscription.id,
             old_status=old_status, new_status='active',

subscription/views.py

@@ -10,7 +10,7 @@ from rest_framework.throttling import ScopedRateThrottle
 from rest_framework.views import APIView
 
 from payment.models import Order
-from payment.services import create_order
+from payment.services import create_order, reconcile_user_orders
 
 from .models import Plan, Subscription
 from .serializers import (
@@ -19,6 +19,7 @@ from .serializers import (
     PurchaseResponseSerializer,
     SubscriptionStatusResponseSerializer,
 )
+from .services import has_unlimited_hearts
 
 
 class GuestAwarePurchaseThrottle(ScopedRateThrottle):
@@ -128,7 +129,17 @@ class PurchaseView(APIView):
                 'order_id': prior_subscription.order_id,
             }
 
-        if existing_order is not None:
+        # اشتراکِ فعال با باز کردنِ صفحه‌ی خرید دست نمی‌خورد. پیش‌تر وضعیتش
+        # همین‌جا «pending» می‌شد و کاربرِ پولی اگر خرید را تمام نمی‌کرد
+        # مزیتش را از دست می‌داد. پلن و تمدید از خودِ سفارش می‌آیند
+        # (activate_subscription)، پس لازم نیست Subscription الان عوض شود.
+        currently_active = prior_subscription is not None and has_unlimited_hearts(user.id)
+
+        if currently_active:
+            subscription = prior_subscription
+            subscription_is_new = False
+            prior_snapshot = None
+        elif existing_order is not None:
             # Retry path: leave an existing subscription untouched, only
             # create one if it's genuinely missing.
             if prior_subscription is None:
@@ -158,6 +169,7 @@ class PurchaseView(APIView):
                 currency=plan.currency,
                 subscription_id=subscription.id,
                 idempotency_key=idempotency_key,
+                plan_id=plan.id,
             )
         except Exception:
             # Guard by pk+status+plan_id+order_id+version so this cleanup only
@@ -178,7 +190,7 @@ class PurchaseView(APIView):
                     Subscription.objects.filter(**guard).update(**prior_snapshot)
             raise
 
-        if subscription.order_id != order.id:
+        if subscription.order_id != order.id and not currently_active:
             with transaction.atomic():
                 subscription.order_id = order.id
                 subscription.save(update_fields=['order_id'])
@@ -194,9 +206,13 @@ class SubscriptionStatusView(APIView):
 
     @extend_schema(responses=SubscriptionStatusResponseSerializer, tags=['Subscription (subscription)'])
     def get(self, request):
+        # پرداختی که تأییدش در کال‌بک گم شده، اینجا دوباره سنجیده می‌شود.
+        reconcile_user_orders(request.user.id)
         subscription = Subscription.objects.filter(user_id=request.user.id).first()
         data = {
-            'active': bool(subscription and subscription.status == 'active'),
+            # وضعیتِ «active» با گذشتِ تاریخ خودبه‌خود عوض نمی‌شود؛ همان شرطی که
+            # قلبِ نامحدود را می‌دهد ملاک است، وگرنه اشتراکِ منقضی «فعال» دیده می‌شد.
+            'active': has_unlimited_hearts(request.user.id),
             'planId': str(subscription.plan_id) if subscription and subscription.plan_id else None,
             'expiresAt': subscription.expires_at if subscription else None,
         }