Admin: per-user activity file (logins, logouts, orders) with CSV export

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

accounts/tests_user_activity.py

@@ -0,0 +1,41 @@
+"""پرونده‌ی کاربر در ادمین: ترتیب، CSV، و دسترسی."""
+from django.test import TestCase
+from django.utils import timezone
+
+from accounts.models import LoginEvent, User
+from payment.models import Order
+
+
+class UserActivityTests(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(phone='09121117001', name='علی')
+        LoginEvent.objects.create(event='login_ok', user_id=self.user.id, phone=self.user.phone, ip='203.0.113.9')
+        Order.objects.create(user_id=self.user.id, amount=45000, plan_title='بسته ۲۰', idempotency_key='k1', status='paid')
+        from django.contrib.auth.models import User as AuthUser
+        self.admin = AuthUser.objects.create_superuser('boss', 'b@x.ir', 'pw')
+        self.client.force_login(self.admin)
+
+    def test_page_lists_login_and_order(self):
+        r = self.client.get(f'/admin/accounts/user/{self.user.id}/activity/')
+        self.assertEqual(r.status_code, 200)
+        body = r.content.decode()
+        self.assertIn('ورود موفق', body)
+        self.assertIn('بسته ۲۰', body)
+        self.assertIn('45000 IRT', body)
+
+    def test_csv_has_bom_and_rows(self):
+        r = self.client.get(f'/admin/accounts/user/{self.user.id}/activity/?format=csv')
+        text = r.content.decode('utf-8')
+        self.assertTrue(text.startswith(''))
+        self.assertIn('203.0.113.9', text)
+        self.assertEqual(len(text.strip().splitlines()), 4)  # سرستون + ثبت‌نام + ورود + سفارش
+
+    def test_view_only_staff_without_order_permission_is_refused(self):
+        from django.contrib.auth.models import Permission, User as AuthUser
+        s = AuthUser.objects.create_user('sup', 's@x.ir', 'pw', is_staff=True)
+        s.user_permissions.add(Permission.objects.get(codename='view_user', content_type__app_label='accounts'))
+        self.client.force_login(s)
+        self.assertEqual(self.client.get(f'/admin/accounts/user/{self.user.id}/activity/').status_code, 403)
+
+    def test_unknown_user_is_404(self):
+        self.assertEqual(self.client.get('/admin/accounts/user/999999/activity/').status_code, 404)