Money review: Bazaar rejection no longer burns the purchase token, read-only order admin, pack grant from order snapshot

- Bazaar verify: a rejected token is not stored on the order or the failed transaction, so the
  same purchase can still pay the right order; a refunded order refuses a new token (409).
- OrderAdmin: every field read-only, no add/delete; Transaction admin read-only.
- grant_pack uses the order's snapshot when the plan was deleted, logs ERROR when nothing is granted.
- Pay link: authority is stored only if the order amount did not change during PaymentRequest.
- PlanAdmin accepts only IRT (the app always renders toman).
- reconcile_pending_order logs unexpected exceptions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

payment/tests_security_review.py

@@ -118,3 +118,112 @@ class BazaarSecondTokenOnPaidOrderTests(_Base):
                                   {'orderId': r2.json()['orderId'], 'purchaseToken': 'TOKEN-2'}, format='json')
         self.assertEqual(fresh.json()['status'], 'paid')
         self.assertEqual(credit_balance(self.user.id), 40)
+
+
+@override_settings(BAZAAR_PISHKHAN_API_SECRET='x', BAZAAR_PACKAGE_NAME='com.example')
+class BazaarRejectedVerifyDoesNotBurnTokenTests(_Base):
+    """ردِ بازار (not_found) توکن را روی تراکنشِ «failed» ثبت می‌کرد و قیدِ یکتا همان خرید را برای همیشه می‌سوزاند."""
+
+    def setUp(self):
+        super().setUp()
+        Plan.objects.filter(pk=self.pack.pk).update(bazaar_sku='sec-p20')
+        self.big = Plan.objects.filter(kind='pack').exclude(pk=self.pack.pk).order_by('-price').first()
+        Plan.objects.filter(pk=self.big.pk).update(bazaar_sku='sec-pbig')
+
+    def verify(self, order_id, token, result):
+        with patch('payment.bazaar.verify_purchase', return_value=result):
+            return self.app.post('/api/payment/bazaar/verify', {'orderId': str(order_id), 'purchaseToken': token},
+                                 format='json')
+
+    def test_same_order_after_a_rejection(self):
+        order = self.pack_order(paymentMethod='bazaar')
+        self.verify(order.id, 'TOK-A', BazaarPurchaseResult(is_valid=False, raw={'error': 'not_found'}))
+        r = self.verify(order.id, 'TOK-A', BazaarPurchaseResult(is_valid=True, purchase_state=0))
+        self.assertEqual(r.json()['status'], 'paid')
+        self.assertEqual(credit_balance(self.user.id), 20)
+
+    def test_token_sent_with_the_wrong_order_still_pays_the_right_one(self):
+        small = self.pack_order(paymentMethod='bazaar')
+        big = self.app.post('/api/subscription/purchase', {'planId': str(self.big.id), 'paymentMethod': 'bazaar'},
+                            format='json').json()['orderId']
+        self.verify(big, 'TOK-S', BazaarPurchaseResult(is_valid=False, raw={'error': 'not_found'}))
+        r = self.verify(small.id, 'TOK-S', BazaarPurchaseResult(is_valid=True, purchase_state=0))
+        self.assertEqual(r.json()['status'], 'paid')
+        self.assertEqual(credit_balance(self.user.id), 20)
+        self.assertEqual(Order.objects.get(pk=big).status, 'failed')
+
+    def test_refunded_order_refuses_a_new_token(self):
+        from .services import refund_order
+
+        order = self.pack_order(paymentMethod='bazaar')
+        self.verify(order.id, 'TOK-1', BazaarPurchaseResult(is_valid=True, purchase_state=0))
+        refund_order(Order.objects.get(pk=order.pk))
+        r = self.verify(order.id, 'TOK-2', BazaarPurchaseResult(is_valid=True, purchase_state=0))
+        self.assertEqual(r.status_code, 409)
+        self.assertEqual(Order.objects.get(pk=order.pk).status, 'refunded')
+        self.assertFalse(Transaction.objects.filter(gateway_ref_id='TOK-2').exists())
+
+
+class OrderAdminMoneyFieldsReadOnlyTests(_Base):
+    """اجازه‌ی change (لازمِ لغو/بازپرداخت) فرمِ سفارش را هم باز می‌کرد: مبلغ و تعدادِ سوالِ سفارش ویرایش‌شدنی بود."""
+
+    def setUp(self):
+        super().setUp()
+        from django.contrib.auth.models import Permission
+
+        staff = get_user_model().objects.create_user('ops', 'ops@example.com', 'pw-for-tests-only', is_staff=True)
+        group = Group.objects.create(name='ops-sec')
+        group.permissions.set(Permission.objects.filter(
+            content_type__app_label='payment',
+            codename__in=['view_order', 'change_order', 'delete_order', 'add_order',
+                          'view_transaction', 'change_transaction', 'delete_transaction', 'add_transaction']))
+        staff.groups.add(group)
+        self.client.force_login(staff)
+
+    def test_amount_and_credits_cannot_be_edited(self):
+        order = self.pack_order()
+        data = {'amount': 1000, 'question_credits': 100000, 'user_id': order.user_id,
+                'transactions-TOTAL_FORMS': 0, 'transactions-INITIAL_FORMS': 0,
+                'transactions-MIN_NUM_FORMS': 0, 'transactions-MAX_NUM_FORMS': 1000}
+        self.client.post(f'/admin/payment/order/{order.pk}/change/', data)
+        order.refresh_from_db()
+        self.assertEqual((order.amount, order.question_credits), (self.pack.price, 20))
+        page = self.client.get(f'/admin/payment/order/{order.pk}/change/')
+        self.assertNotContains(page, 'name="amount"')
+
+    def test_orders_and_transactions_are_not_deleted_or_added_from_the_panel(self):
+        order = self.pack_order()
+        apply_order_payment_result(order=order, gateway='zarinpal', gateway_ref_id='DEL-1', new_status='paid', event='t')
+        self.client.post(f'/admin/payment/order/{order.pk}/delete/', {'post': 'yes'})
+        txn = Transaction.objects.get(gateway_ref_id='DEL-1')
+        self.client.post(f'/admin/payment/transaction/{txn.pk}/delete/', {'post': 'yes'})
+        self.assertTrue(Order.objects.filter(pk=order.pk).exists())
+        self.assertTrue(Transaction.objects.filter(pk=txn.pk).exists())
+        self.assertEqual(self.client.get('/admin/payment/order/add/').status_code, 403)
+        self.assertEqual(self.client.get('/admin/payment/transaction/add/').status_code, 403)
+
+
+class DiscountDuringPaymentRequestTests(_Base):
+    """کدِ تخفیفی که وسطِ PaymentRequest ثبت شود، authority را با مبلغِ قبلی روی سفارشِ ارزان‌تر می‌نشاند."""
+
+    def test_authority_matches_the_final_amount(self):
+        from .zarinpal import ZarinpalRequestResult
+
+        DiscountCode.objects.create(code='SECHALF', type='percent', value=50, max_uses=5)
+        r = self.app.post('/api/subscription/purchase', {'planId': str(self.pack.id)}, format='json')
+        order_id, pay_url = r.json()['orderId'], r.json()['paymentUrl']
+        requested = []
+
+        def fake_request(order):
+            requested.append(order.amount)
+            if len(requested) == 1:  # کاربر در تبِ دیگر همان لحظه کد را می‌زند
+                self.app.post('/api/discount/redeem', {'code': 'SECHALF', 'orderId': order_id}, format='json')
+            return ZarinpalRequestResult(authority=f'A-{len(requested)}', payment_url='x')
+
+        with patch('payment.zarinpal.request_payment', side_effect=fake_request):
+            resp = APIClient().get('/api/' + pay_url.split('/api/', 1)[1])
+        order = Order.objects.get(pk=order_id)
+        self.assertEqual(resp.status_code, 302)
+        self.assertEqual(order.amount, self.pack.price // 2)
+        self.assertEqual(requested, [self.pack.price, self.pack.price // 2])
+        self.assertEqual(order.gateway_authority, 'A-2')