Zareian 947f946909 Question packs removed at the root; all subscriptions 4 assistant questions a day; Bazaar is subscription-only ...

- subscription.0017/0018, payment.0013: pack plans deleted, QuestionCredit/HeartsPass models and Plan.kind /
  question_credits / hearts_days / Order.question_credits / hearts_days dropped. The only paid pack order was the
  company owner's test account (user 26).
- Assistant: no credit spending; quota is the daily cap only (free 2, every plan 4, gift subscription 4).
- Bazaar: verify_purchase is subscription-only (no inapp guess), start/purchase responses lose productType,
  verify refuses an order without a subscription. A paid order with no subscription now logs ERROR.
- Removed POST /api/payment/orders (internal; no caller). Its permission tests stay.
- Pack-based tests rewritten on subscriptions (refund, security, Bazaar token); pack-only test files deleted.
- docs: profit table for 4/day on both payment routes plus free users; handbook, operations, CLAUDE.md current.
949 tests green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-12 20:33:38 +03:30

..

management

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

migrations

Postgres connection pool, clean 503 under overload, time indexes, 4 workers

2026-10-11 20:21:35 +03:30

templates

Add campaigns/ Add supervisor/ Add messaging features/ Separate SMS

2026-08-25 03:39:41 +03:30

__init__.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

activity.py

User activity file includes failed logins matched by phone

2026-10-08 12:41:06 +03:30

admin.py

Admin: per-user activity file (logins, logouts, orders) with CSV export

2026-10-08 12:17:11 +03:30

apps.py

optional short-TTL cache for the auth user row

2026-08-30 08:46:11 +03:30

authentication.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

jalali.py

Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable

2026-10-05 09:34:42 +03:30

models.py

Postgres connection pool, clean 503 under overload, time indexes, 4 workers

2026-10-11 20:21:35 +03:30

phone.py

Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable

2026-10-05 09:34:42 +03:30

public_id.py

public user IDs, plans priced by tutor cost, age-based tutor tone, self-service account deletion

2026-10-02 06:10:17 +03:30

receivers.py

optional short-TTL cache for the auth user row

2026-08-30 08:46:11 +03:30

schema.py

Remove guest login: every user registers with a phone number

2026-10-05 17:38:18 +03:30

serializers.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

services.py

Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

2026-10-05 04:52:25 +03:30

signals.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_audit_fixes.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_birth_date.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_delete_account.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_delete_users.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_login_events.py

Postgres support (DB_* env), LoginEvent audit table, Choice.value 300, deploy.sh pg_dump backup

2026-10-08 11:48:48 +03:30

tests_otp_limits.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_security_review.py

Question packs removed at the root; all subscriptions 4 assistant questions a day; Bazaar is subscription-only

2026-10-12 20:33:38 +03:30

tests_user_activity.py

User activity file includes failed logins matched by phone

2026-10-08 12:41:06 +03:30

tests.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

urls.py

Remove guest login: every user registers with a phone number

2026-10-05 17:38:18 +03:30

views.py

Postgres connection pool, clean 503 under overload, time indexes, 4 workers

2026-10-11 20:21:35 +03:30