Zareian
39247f6d53
- remove the family app from the root (separate parent accounts, invite codes, parental settings); progress.0006 drops its tables, permissions and migration history, and Profile.parent_phone, the two family notification types and ?userId= on /api/progress/nodes go with it - GET /api/user/weekly-report: last 7 days next to the 7 before (estimated minutes, questions, accuracy, islands, tutor questions) for the "parent report" page - profile birthDate in Jalali (accounts/jalali.py), ages 5-99, birthYear derived from it - GET /api/payment/invoices; orders now snapshot list price and plan title - tutor answers only math: server pre-filter, scope rule in the prompt (tutor-v11), refusal marker replaced with fixed text; self-harm gets a help line instead - streamed answers now record token usage (it was always 0) - daily tutor quota: AI_DAILY_QUOTA_FREE (default 3) vs Plan.ai_daily_quota - delete_users management command for wiping test accounts across every app - docs/ai-cost-and-guardrails.md: measured cost per question and guardrail results Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
154 lines
7.0 KiB
Python
154 lines
7.0 KiB
Python
"""
|
||
حساب، ورود و چند موردِ دیگر از بازبینیِ ۲۰۲۶-۰۹-۲۵.
|
||
"""
|
||
import time
|
||
from unittest.mock import patch
|
||
|
||
from django.core.cache import cache
|
||
from django.test import TestCase, override_settings
|
||
from rest_framework.test import APIClient
|
||
|
||
from accounts.authentication import issue_access_token
|
||
from accounts.models import OTPCode, User
|
||
from content.models import Choice, Grade, Lesson, Node, Question, Unit
|
||
from progress.models import UserHearts, UserStats
|
||
|
||
|
||
def _client(user):
|
||
client = APIClient()
|
||
client.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(user.id)}')
|
||
return client
|
||
|
||
|
||
class LogoutTests(TestCase):
|
||
def setUp(self):
|
||
cache.clear()
|
||
|
||
def test_logout_kills_the_current_token_and_its_refresh(self):
|
||
guest = APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': 'dev-out'},
|
||
format='json').json()
|
||
client = APIClient()
|
||
client.credentials(HTTP_AUTHORIZATION=f'Bearer {guest["token"]}')
|
||
self.assertEqual(client.get('/api/user/profile').status_code, 200)
|
||
|
||
time.sleep(1.1) # زمانِ توکن ثانیهای است؛ توکن باید پیش از خروج صادر شده باشد
|
||
response = client.post('/api/auth/logout', {'refreshToken': guest['refreshToken']}, format='json')
|
||
self.assertEqual(response.status_code, 200)
|
||
|
||
self.assertEqual(client.get('/api/user/profile').status_code, 401)
|
||
refreshed = APIClient().post('/api/auth/refresh', {'refreshToken': guest['refreshToken']}, format='json')
|
||
self.assertEqual(refreshed.status_code, 401)
|
||
|
||
# ورودِ دوباره کار میکند
|
||
again = APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': 'dev-out'},
|
||
format='json').json()
|
||
fresh = APIClient()
|
||
fresh.credentials(HTTP_AUTHORIZATION=f'Bearer {again["token"]}')
|
||
self.assertEqual(fresh.get('/api/user/profile').status_code, 200)
|
||
|
||
|
||
@override_settings(DEBUG=True, OTP_REQUEST_PHONE_COOLDOWN_SECONDS=0)
|
||
class OtpTests(TestCase):
|
||
def setUp(self):
|
||
cache.clear()
|
||
|
||
def _request(self, phone, code='123456'):
|
||
with patch('accounts.views.secrets.randbelow', return_value=int(code)), \
|
||
patch('accounts.views.send_otp_sms'):
|
||
APIClient().post('/api/auth/otp/request', {'phone': phone}, format='json')
|
||
|
||
def test_a_code_dies_after_five_wrong_guesses(self):
|
||
phone = '09121234001'
|
||
self._request(phone)
|
||
for guess in ('000001', '000002', '000003', '000004', '000005'):
|
||
APIClient().post('/api/auth/login', {'phone': phone, 'otp': guess}, format='json')
|
||
self.assertTrue(OTPCode.objects.get(phone=phone).is_used)
|
||
right = APIClient().post('/api/auth/login', {'phone': phone, 'otp': '123456'}, format='json')
|
||
self.assertEqual(right.status_code, 400)
|
||
|
||
|
||
@override_settings(DEBUG=True, OTP_REQUEST_PHONE_COOLDOWN_SECONDS=0,
|
||
TEST_LOGIN_PHONES={'09120000101': '4321'})
|
||
class GuestSignupKeepsProgressTests(TestCase):
|
||
def setUp(self):
|
||
cache.clear()
|
||
guest = APIClient().post('/api/auth/session', {'type': 'guest', 'deviceId': 'dev-up'},
|
||
format='json').json()
|
||
self.guest_id = int(guest['userId'])
|
||
UserStats.objects.create(user_id=self.guest_id, xp=120)
|
||
self.client = APIClient()
|
||
self.client.credentials(HTTP_AUTHORIZATION=f'Bearer {guest["token"]}')
|
||
|
||
def _login(self, phone, otp):
|
||
return self.client.post('/api/auth/login', {'phone': phone, 'otp': otp}, format='json')
|
||
|
||
def test_the_guest_becomes_the_registered_user(self):
|
||
with patch('accounts.views.secrets.randbelow', return_value=654321), \
|
||
patch('accounts.views.send_otp_sms'):
|
||
self.client.post('/api/auth/otp/request', {'phone': '09121234002'}, format='json')
|
||
body = self._login('09121234002', '654321').json()
|
||
|
||
self.assertEqual(int(body['userId']), self.guest_id)
|
||
user = User.objects.get(pk=self.guest_id)
|
||
self.assertEqual((user.phone, user.is_guest), ('09121234002', False))
|
||
self.assertEqual(UserStats.objects.get(user_id=self.guest_id).xp, 120)
|
||
|
||
def test_an_existing_account_is_not_merged(self):
|
||
existing = User.objects.create(phone='09121234003', is_guest=False)
|
||
with patch('accounts.views.secrets.randbelow', return_value=111222), \
|
||
patch('accounts.views.send_otp_sms'):
|
||
self.client.post('/api/auth/otp/request', {'phone': '09121234003'}, format='json')
|
||
body = self._login('09121234003', '111222').json()
|
||
self.assertEqual(int(body['userId']), existing.id)
|
||
self.assertTrue(User.objects.get(pk=self.guest_id).is_guest)
|
||
|
||
def test_demo_test_phones_never_absorb_a_guest(self):
|
||
body = self._login('09120000101', '4321').json()
|
||
self.assertNotEqual(int(body['userId']), self.guest_id)
|
||
self.assertTrue(User.objects.get(pk=self.guest_id).is_guest)
|
||
|
||
|
||
class DisplayNameTests(TestCase):
|
||
def test_contact_details_are_stripped_from_the_name(self):
|
||
user = User.objects.create(phone='09121234004', is_guest=False)
|
||
body = _client(user).patch('/api/user/profile', {'name': 'سارا 0912 345 6789 @sara'},
|
||
format='json').json()
|
||
self.assertEqual(body['name'], 'سارا')
|
||
|
||
|
||
class HeartsTests(TestCase):
|
||
def setUp(self):
|
||
cache.clear()
|
||
grade = Grade.objects.create(title='پایه نهم', icon='', color='')
|
||
node = Node.objects.create(unit=Unit.objects.create(grade=grade, title='ف', order=1), title='ن', order=1)
|
||
self.question = Question.objects.create(lesson=Lesson.objects.create(node=node, title='د'),
|
||
type='multiple_choice', prompt='؟')
|
||
self.right = Choice.objects.create(question=self.question, value='۱', is_correct=True)
|
||
self.user = User.objects.create(phone='09121234005', is_guest=False)
|
||
UserHearts.objects.create(user_id=self.user.id, current_hearts=0)
|
||
|
||
def _answer(self):
|
||
return _client(self.user).post(f'/api/questions/{self.question.id}/answer',
|
||
{'selectedOptionId': self.right.id}, format='json')
|
||
|
||
def test_off_by_default_so_the_current_app_keeps_working(self):
|
||
self.assertEqual(self._answer().status_code, 200)
|
||
|
||
@override_settings(HEARTS_ENFORCED=True)
|
||
def test_when_enforced_no_hearts_means_no_answer(self):
|
||
response = self._answer()
|
||
self.assertEqual(response.status_code, 403)
|
||
self.assertEqual(response.json()['code'], 'no_hearts')
|
||
|
||
|
||
class AdminLoginThrottleTests(TestCase):
|
||
def setUp(self):
|
||
cache.clear()
|
||
|
||
@override_settings(ADMIN_LOGIN_MAX_ATTEMPTS=3)
|
||
def test_password_guessing_is_capped(self):
|
||
codes = [self.client.post('/admin/login/', {'username': 'a', 'password': 'b'}).status_code
|
||
for _ in range(4)]
|
||
self.assertEqual(codes[-1], 429)
|
||
self.assertNotEqual(codes[0], 429)
|