bazaar: a pack bought through Bazaar now gives its credits; verify reports the real order status

Bazaar orders are only created through POST /api/payment/orders, which
took no planId, so a pack order had plan_id=None: Bazaar verified the
purchase, the order became paid, and grant_pack never ran. The endpoint
now takes planId (rejected when unknown) and snapshots the plan title.
The verify response also returned the pre-payment status ('pending')
because apply_order_payment_result updates its own copy of the order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/views.py

@@ -7,6 +7,7 @@ from django.utils.html import escape
 from django.shortcuts import get_object_or_404
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, extend_schema
+from rest_framework.exceptions import ValidationError
 from rest_framework.permissions import AllowAny, IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.throttling import ScopedRateThrottle
@@ -99,6 +100,14 @@ class CreateOrderView(APIView):
         serializer.is_valid(raise_exception=True)
         v = serializer.validated_data
 
+        plan = None
+        if v.get('planId'):
+            from subscription.models import Plan
+
+            plan = Plan.objects.filter(pk=v['planId']).first() if str(v['planId']).isdigit() else None
+            if plan is None:
+                raise ValidationError({'planId': 'پلنی با این شناسه وجود ندارد.'})
+
         order, payment_url = create_order(
             user_id=int(v['userId']),
             amount=v['amount'],
@@ -107,6 +116,8 @@ class CreateOrderView(APIView):
             idempotency_key=request.headers.get('Idempotency-Key'),
             provider=v.get('provider') or 'gateway',
             bazaar_product_sku=v.get('bazaarProductSku') or '',
+            plan_id=plan.id if plan else None,
+            plan_title=plan.title if plan else '',
         )
         data = {
             'orderId': str(order.id), 'status': order.status,
@@ -336,6 +347,9 @@ class BazaarVerifyPurchaseView(APIView):
                 new_status=new_status,
                 event='bazaar_verify',
             )
+        # apply_order_payment_result سفارش را از نو می‌خواند و همان را عوض می‌کند؛ این نمونه هنوز
+        # وضعیتِ پیش از پرداخت را دارد. بدونِ این، پاسخ «pending» بود درحالی‌که سفارش «paid» شده بود.
+        order.refresh_from_db(fields=['status'])
 
         data = {'orderId': str(order.id), 'status': order.status, 'valid': result.is_valid}
         return Response(BazaarVerifyResponseSerializer(data).data)