fix payement link and gallery image

apps/payments/access.py

@@ -1,10 +1,10 @@
 """A payment link never authenticates a user or grants access to their whole account."""
 import hashlib
-import secrets
 import uuid
 from datetime import timedelta
 
 from django.conf import settings
+from django.db import IntegrityError, transaction
 from django.db.models import Q
 from django.contrib.auth.views import redirect_to_login
 from django.core.exceptions import PermissionDenied
@@ -13,6 +13,7 @@ from django.shortcuts import get_object_or_404, render
 from django.urls import reverse
 from django.utils import timezone
 from apps.core.session_access import grant_scoped_session_access
+from apps.accounts.models import TicketMagicLink
 
 from . import policies
 from .models import PaymentAccessLink, PaymentNotice
@@ -30,11 +31,17 @@ def issue_payment_link(*, notice=None, receipt=None):
         raise ValueError('Payment link requires a notice or receipt')
     if receipt is not None:
         notice = receipt.notice
-    token = secrets.token_urlsafe(32)
-    link = PaymentAccessLink.objects.create(customer=target.customer, notice=notice, receipt=receipt,
-        token_hash=token_digest(token),
-        expires_at=timezone.now() + timedelta(days=settings.PAYMENT_LINK_TTL_DAYS))
-    return link, settings.PUBLIC_BASE_URL + reverse('payments:open_link', args=[token])
+    for attempt in range(5):
+        token = TicketMagicLink.generate_secure_token(10)
+        try:
+            with transaction.atomic():
+                link = PaymentAccessLink.objects.create(customer=target.customer, notice=notice, receipt=receipt,
+                    token_hash=token_digest(token),
+                    expires_at=timezone.now() + timedelta(days=settings.PAYMENT_LINK_TTL_DAYS))
+            return link, settings.PUBLIC_BASE_URL.rstrip('/') + reverse('payment_short_link', args=[token])
+        except IntegrityError:
+            if attempt == 4:
+                raise RuntimeError('عدم موفقیت در تولید لینک یکتای پرداخت.')
 
 
 def active_links():

apps/payments/forms.py

@@ -81,7 +81,7 @@ class ReceiptForm(forms.Form):
     paid_day = forms.ChoiceField(label='روز', choices=[('', 'روز')] + [(str(i), str(i)) for i in range(1, 32)])
     paid_month = forms.ChoiceField(label='ماه', choices=[('', 'ماه')] + list(zip(map(str, range(1, 13)), ['فروردین','اردیبهشت','خرداد','تیر','مرداد','شهریور','مهر','آبان','آذر','دی','بهمن','اسفند'])))
     paid_year = forms.ChoiceField(label='سال')
-    receipt_image = forms.FileField(label='تصویر فیش')
+    receipt_image = forms.FileField(label='تصویر فیش', widget=forms.ClearableFileInput(attrs={'accept': 'image/*'}))
     tracking_number = forms.CharField(label='شماره پیگیری (اختیاری)', max_length=100, required=False)
     description = forms.CharField(label='توضیحات (اختیاری)', required=False, widget=forms.Textarea)
     submission_key = forms.UUIDField(widget=forms.HiddenInput)

apps/payments/link_views.py

@@ -15,7 +15,8 @@ from .models import PaymentAccessLink
 @never_cache
 @require_http_methods(['GET', 'POST'])
 def open_link(request, token):
-    link = access.active_links().filter(token_hash=access.token_digest(token)).first() if re.fullmatch(r'[A-Za-z0-9_-]{43}', token) else None
+    # Keep previously issued long links valid until their original expiry/revocation.
+    link = access.active_links().filter(token_hash=access.token_digest(token)).first() if re.fullmatch(r'(?:[a-z0-9]{10}|[A-Za-z0-9_-]{43})', token) else None
     if link is None:
         return access.unavailable_link(request)
     if request.user.is_authenticated and request.user.pk != link.customer_id: