fix payement link and gallery image

apps/tickets/sharing_views.py

@@ -3,6 +3,8 @@ import mimetypes
 
 from django.conf import settings
 from django.contrib import messages
+from django.db import transaction
+from django.utils import timezone
 from django.core.exceptions import PermissionDenied, ValidationError
 from django.http import FileResponse, JsonResponse
 from django.shortcuts import get_object_or_404, redirect
@@ -11,10 +13,12 @@ from django.views.decorators.http import require_GET, require_POST
 
 from apps.attachments.delivery import signed_media_redirect
 from apps.attachments.models import Attachment
-from .models import MessageShare, Ticket
+from .models import MessageShare, Ticket, TicketReadState
+from .policies import TicketPolicy
+from apps.messaging.read_receipts import message_read_ids
 from .staff_conversation import received_messages, unread_shares, visible_messages
 from .sharing import mark_share_opened, revoke_staff_share
-from .views import staff_required
+from .views import staff_required, mark_messages_read
 
 
 def received_message_share(request, share_id):
@@ -66,18 +70,26 @@ def shared_message(request, share_id):
 @staff_required
 @require_POST
 @never_cache
+@transaction.atomic
 def read_shared_messages(request, public_id):
-    ticket = get_object_or_404(Ticket, public_id=public_id)
+    ticket = get_object_or_404(Ticket.objects.select_for_update(), public_id=public_id)
     allowed = visible_messages(ticket, request.user)
-    ids = request.POST.getlist("message_ids")[:100]
-    # Filter strings without parsing attacker-controlled UUIDs in the ORM.
-    visible = {str(value) for value in allowed.values_list("public_id", flat=True)}
-    accepted = set(ids) & visible
+    try:
+        ids = message_read_ids(request)
+    except ValidationError:
+        return JsonResponse({"ok": False, "error": "invalid_message_ids"}, status=400)
+    acknowledged = list(allowed.filter(public_id__in=ids, deleted_at__isnull=True))
+    mark_messages_read(acknowledged, request.user)
+    accepted = [item.public_id for item in acknowledged]
     grants = received_messages(request.user, ticket).filter(message__public_id__in=accepted)
     for grant in grants:
         if grant.first_viewed_at is None:
             mark_share_opened(grant, request.user)
-    return JsonResponse({"unread_shares": unread_shares(request.user)})
+    latest = allowed.filter(deleted_at__isnull=True).order_by('-created_at', '-pk').first()
+    if latest and latest.public_id in accepted and TicketPolicy.can_view(request.user, ticket):
+        TicketReadState.objects.update_or_create(ticket=ticket, user=request.user,
+            defaults={'last_read_at': timezone.now(), 'last_read_message': latest})
+    return JsonResponse({"unread_shares": unread_shares(request.user), "read_ids": [str(value) for value in accepted]})
 
 
 @staff_required