Zareian
645baf846b
- /api/payment/orders/{id}/pay requires the short-lived signature that paymentUrl carries;
without it (or with another order's) it is the same 404 as an unknown order
- Session.refresh_token stores the SHA-256 of the token; migration accounts.0007 hashes the
existing rows so tokens clients already hold keep working
- /api/leaderboard requires a token (guests have one); names of children were scrapable
- RAG mock only for `manage.py test`, not any command with an argument named "test"
- tools/loadtest: user factory, load generator, fake GapGPT+Qdrant, with method notes
- security-before-production.md lists only open items; closed ones become a guards table
with the tests that hold them. Comments describe current behaviour, not history
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
1.1 KiB
Plaintext
26 lines
1.1 KiB
Plaintext
Django==5.2.17
|
|
djangorestframework==3.18.0
|
|
drf-spectacular==0.30.0
|
|
django-cors-headers==4.9.0
|
|
requests==2.33.1
|
|
redis==5.2.1
|
|
python-dotenv==1.2.2
|
|
whitenoise==6.11.0
|
|
# سرور با همین اجرا می‌شود (یونیتِ systemd آن را از venv صدا می‌زند؛ تنظیمات در gunicorn.conf.py).
|
|
gunicorn==26.2.0
|
|
# وابستگیِ غیرمستقیمِ requests و qdrant-client؛ نسخه‌های پایین‌تر آسیب‌پذیریِ شناخته‌شده دارند
|
|
# (GHSA-8988-9cw3-xx77، GHSA-vxq7-64xx-v4gw، GHSA-gh4c-6fx4-qh6g).
|
|
urllib3>=2.8.0
|
|
|
|
# RAG / AI tutor (اپ rag). کلاینت‌ها lazy import می‌شن؛ نبودِ این‌ها فقط
|
|
# مسیرِ RAG رو از کار می‌ندازه، نه بقیه‌ی پروژه رو.
|
|
openai>=1.40,<3
|
|
qdrant-client>=1.12
|
|
|
|
# فقط برای ingestِ PDF (اختیاری). pdf2image به poppler سیستمی نیاز داره
|
|
# (macOS: brew install poppler). نبودشون فقط endpointِ /api/rag/ingest/pdf
|
|
# رو با خطای صریح از کار می‌ندازه.
|
|
pymupdf>=1.24
|
|
pdf2image>=1.17
|
|
pillow>=10
|