Zareian 7d81d193bd Scheduled Postgres backup, restore check, backup warnings in health, payment result logging ...

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-10-08 17:32:06 +03:30

..

management

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

migrations

Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

2026-10-05 04:52:25 +03:30

__init__.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

admin.py

Security review: staff admin lockdown, unicode-safe login/phone/grade inputs, demo guest not upgradable, home cache not floodable

2026-10-05 09:34:42 +03:30

apps.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

bazaar.py

Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

2026-10-05 04:52:25 +03:30

models.py

Security review fixes: admin permissions, guest sessions, payment edge cases, assistant leaks

2026-10-05 04:52:25 +03:30

permissions.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

serializers.py

admin: cancel a pending order, refund a paid one

2026-10-02 22:37:30 +03:30

services.py

Scheduled Postgres backup, restore check, backup warnings in health, payment result logging

2026-10-08 17:32:06 +03:30

tests_audit_fixes.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_bazaar_oauth.py

let Bazaar verification find out whether a SKU is a one-time product or a subscription

2026-09-30 12:31:51 +03:30

tests_bazaar_pack.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_invoices.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_refund.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests_security_review.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

tests.py

Remove the guest system entirely: no is_guest/device_id, no guest throttles, phone login is the only way in

2026-10-05 18:20:10 +03:30

urls.py

senior's post-demo changes: parent report in the student's own account, Jalali birth date, invoices, math-only tutor, priced quotas

2026-10-02 02:38:43 +03:30

views.py

Scheduled Postgres backup, restore check, backup warnings in health, payment result logging

2026-10-08 17:32:06 +03:30

zarinpal.py

harden OTP for real SMS and close the second audit round

2026-09-25 12:28:06 +03:30