Zareian
a973c41db2
- Admin: refund/cancel/mark-resolved/Bazaar-link actions need change permission; question and curriculum import need add/delete; content browser needs view_question; guest device ids are shown to superusers only. - Accounts: registering a guest's phone revokes the guest's earlier sessions; self-deletion keeps Redemption, UserOffer and the phone's OTP rows; the public demo guest cannot be deleted (DEMO_GUEST_DEVICE_IDS); display-name contact filter covers any separator and social handles. - Payment: callback without Authority is 400; a second Bazaar purchase on a paid order is 409; orders snapshot credits/hearts/days at creation (payment.0011). - Assistant: a broken diagram no longer makes a streamed answer free; a late off-topic marker refuses the answer (not stored, not cached); a disconnect saves the partial answer; only KNOWN_COLLECTIONS are searched. - Infra: secret-key file is created atomically (workers no longer split keys); no default INTERNAL_SERVICE_KEY; Kavenegar key and Bazaar token kept out of error logs; Swagger/ReDoc pinned; schema throttled; docker compose bound to 127.0.0.1; non-ASCII digit ids are 400; ticket text capped at 5000. - docs/security-before-production.md: remaining open items 24-31 and the guard tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
707 B
Plaintext
24 lines
707 B
Plaintext
venv/
|
||
__pycache__/
|
||
*.pyc
|
||
db.sqlite3
|
||
.DS_Store
|
||
.env
|
||
|
||
# کتابهای درسی: خودِ PDFها در گیت نمیآیند (حجیماند)
|
||
data/textbooks/*
|
||
!data/textbooks/README.md
|
||
|
||
# کلیدِ امضای تولیدشدهی خودکار (هرگز کامیت نشود)
|
||
.django_secret_key*
|
||
|
||
# خروجیِ collectstatic — تولیدی است، در هر دیپلوی از نو ساخته میشود.
|
||
staticfiles/
|
||
|
||
# نسخهی پشتیبانِ تغییرهای دستیِ روی سرور که deploy.sh کنار میگذارد.
|
||
.deploy-backups/
|
||
|
||
# دیتابیسِ فایلیِ تستها (config/settings.py → DATABASES.TEST)
|
||
.test-db.sqlite3*
|
||
tools/fake_openai_requests.jsonl
|