keep the Referer on the redirect to Zarinpal so StartPay accepts our domain

A test payment on 2026-10-01 stopped at StartPay with "access from this
domain is not allowed". The app opens /api/payment/orders/{id}/pay, which
302s to Zarinpal, and that response carried Django's default
Referrer-Policy: same-origin, so the browser dropped the Referer on the
cross-site hop and Zarinpal could not see tadrisino2.ir. Only this view now
sends strict-origin-when-cross-origin (origin only, no path or query);
every other response keeps same-origin.

Not yet confirmed by a second real attempt in a browser.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/tests.py

@@ -484,6 +484,22 @@ class PaymentRedirectViewTests(TestCase):
             idempotency_key='pay-view-order-1',
         )
 
+    @override_settings(
+        ZARINPAL_MERCHANT_ID='merchant-xyz', ZARINPAL_CALLBACK_URL='https://api.example.com/cb',
+        ZARINPAL_STARTPAY_BASE='https://www.zarinpal.com/pg/StartPay',
+    )
+    @patch('payment.views.zarinpal.request_payment')
+    def test_redirect_keeps_the_referrer_origin_for_zarinpal(self, mock_request_payment):
+        # با same-origin (پیش‌فرضِ جنگو) مرورگر Referer را روی ریدایرکت به
+        # زرین‌پال حذف می‌کرد و StartPay «دسترسی از این دامنه مجاز نمی‌باشد» می‌داد.
+        mock_request_payment.return_value = zarinpal.ZarinpalRequestResult(
+            authority='A-ref', payment_url='https://www.zarinpal.com/pg/StartPay/A-ref',
+        )
+        response = self.client.get(f'/api/payment/orders/{self.order.id}/pay')
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response['Referrer-Policy'], 'strict-origin-when-cross-origin')
+        self.assertEqual(self.client.get('/api/health')['Referrer-Policy'], 'same-origin')
+
     @override_settings(ZARINPAL_MERCHANT_ID='', ZARINPAL_CALLBACK_URL='')
     def test_unconfigured_gateway_returns_503(self):
         response = self.client.get(f'/api/payment/orders/{self.order.id}/pay')