Zareian 7d205caa79 send the Bazaar access token without "Bearer" and cap its cache at an hour ...

Tried against the real Bazaar API on 2026-09-26 after the first live
authorization: "Authorization: Bearer <t>" gets 403 "Access token is not
valid", the bare token is accepted, even though token_type says Bearer.
The refresh grant also returned expires_in=3600000, which the old code
would have cached for ~41 days; the TTL is now capped at one hour and
401/403 clear it.

404 invalid_value (wrong package or SKU) is our misconfiguration, so it
now raises 503 instead of failing the user's order; only error=not_found
means "not purchased", as Bazaar's docs say.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-26 22:12:20 +03:30

..

management

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

migrations

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

__init__.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

admin.py

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

apps.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

bazaar.py

send the Bazaar access token without "Bearer" and cap its cache at an hour

2026-09-26 22:12:20 +03:30

models.py

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

permissions.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

serializers.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

services.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

tests_audit_fixes.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

tests_bazaar_oauth.py

send the Bazaar access token without "Bearer" and cap its cache at an hour

2026-09-26 22:12:20 +03:30

tests.py

send the Bazaar access token without "Bearer" and cap its cache at an hour

2026-09-26 22:12:20 +03:30

urls.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

views.py

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

zarinpal.py

harden OTP for real SMS and close the second audit round

2026-09-25 12:28:06 +03:30