Zareian e3abd675db let Bazaar verification find out whether a SKU is a one-time product or a subscription ...

Nobody has told us how the plans are defined in the Bazaar panel. The
verify view always asked the in-app endpoint, so a subscription SKU would
get "Product is not found" and a 503. verify_purchase now defaults to
is_subscription=None: in-app first, and on that exact answer the same SKU
is asked as a subscription. A wrong package name still raises at once.

Seen against the live Bazaar API with a fake SKU and token only; no real
purchase has gone through it yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-30 12:31:51 +03:30

..

management

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

migrations

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

__init__.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

admin.py

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

apps.py

Initial commit - clean project structure

2026-08-18 16:48:15 +03:30

bazaar.py

let Bazaar verification find out whether a SKU is a one-time product or a subscription

2026-09-30 12:31:51 +03:30

models.py

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

permissions.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

serializers.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

services.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

tests_audit_fixes.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

tests_bazaar_oauth.py

let Bazaar verification find out whether a SKU is a one-time product or a subscription

2026-09-30 12:31:51 +03:30

tests.py

send the Bazaar access token without "Bearer" and cap its cache at an hour

2026-09-26 22:12:20 +03:30

urls.py

tutor answers step by step in plain text, islands finish, and the audit's money and login holes are closed

2026-09-25 06:24:13 +03:30

views.py

let the Bazaar verify URL double as the OAuth redirect URI

2026-09-26 21:30:44 +03:30

zarinpal.py

harden OTP for real SMS and close the second audit round

2026-09-25 12:28:06 +03:30