fix payement link and gallery image

tests/test_payment_links.py

@@ -1,5 +1,6 @@
 """Permanent regressions for SMS payment capabilities; no real SMS is sent."""
 import uuid
+import re
 from datetime import timedelta
 from urllib.parse import urlsplit
 
@@ -10,7 +11,7 @@ from django.test import Client
 from django.urls import reverse
 from django.utils import timezone
 
-from apps.accounts.models import User
+from apps.accounts.models import TicketMagicLink, User
 from apps.core.models import SiteBranding
 from apps.notifications.models import NotificationJob, SMSTemplate
 from apps.payments import services
@@ -40,6 +41,9 @@ def test_sms_link_is_temporary_reusable_and_does_not_log_in(case, client, settin
     notice_sms = PaymentNotification.objects.get(job=job)
     url = notice_sms.context['payment_link']
     token = urlsplit(url).path.rstrip('/').rsplit('/', 1)[-1]
+    assert urlsplit(url).path == f'/p/{token}/'
+    assert re.fullmatch(r'[a-z0-9]{10}', token)
+    assert url in notice_sms.rendered_body
     assert notice_sms.access_link.token_hash == token_digest(token)
     assert notice_sms.access_link.expires_at > timezone.now() + timedelta(days=2)
     first_body = notice_sms.rendered_body
@@ -55,6 +59,52 @@ def test_sms_link_is_temporary_reusable_and_does_not_log_in(case, client, settin
     assert notice_sms.access_link.view_count == 2
 
 
+def test_short_payment_link_retries_collision_without_breaking_transaction(case, client, monkeypatch):
+    tokens = iter(['ac26i9raoz', 'ac26i9raoz', 'lfp694raup'])
+    monkeypatch.setattr(TicketMagicLink, 'generate_secure_token', lambda length: next(tokens))
+    first, _ = issue_payment_link(notice=case['notice'])
+    second, url = issue_payment_link(notice=case['notice'])
+    assert first.pk != second.pk
+    assert urlsplit(url).path == '/p/lfp694raup/'
+    assert PaymentAccessLink.objects.count() == 2
+    assert client.get('/p/lfp694raup/', follow=True).status_code == 200
+
+
+def test_payment_link_collision_retries_are_bounded(case, monkeypatch):
+    monkeypatch.setattr(TicketMagicLink, 'generate_secure_token', lambda length: 'ac26i9raoz')
+    issue_payment_link(notice=case['notice'])
+    with pytest.raises(RuntimeError, match='لینک یکتای پرداخت'):
+        issue_payment_link(notice=case['notice'])
+    assert PaymentAccessLink.objects.count() == 1
+
+
+def test_legacy_long_payment_link_keeps_scope_and_expiry(case, client):
+    token = 'x_NAEA8ptOXu5msNYgNNpCM8vyWh6_VAhELPs5q8C2U'
+    link = PaymentAccessLink.objects.create(customer=case['customer'], notice=case['notice'],
+        token_hash=token_digest(token), expires_at=timezone.now() + timedelta(days=1))
+    path = reverse('payments:open_link', args=[token])
+    response = client.get(path, follow=True)
+    assert response.status_code == 200
+    assert client.session[SESSION_KEY] == link.pk
+    assert '_auth_user_id' not in client.session
+    PaymentAccessLink.objects.filter(pk=link.pk).update(expires_at=timezone.now() - timedelta(seconds=1))
+    assert client.get(path).status_code == 410
+
+
+@pytest.mark.parametrize('via_link', [False, True])
+def test_receipt_picker_accepts_gallery_images_without_camera_capture(case, client, via_link):
+    if via_link:
+        open_notice(client, case)
+    else:
+        client.force_login(case['customer'])
+    response = client.get(reverse('payments:receipt_new'), {'notice': case['notice'].public_id})
+    assert response.status_code == 200
+    widget = response.context['form'].fields['receipt_image'].widget
+    assert widget.attrs['accept'] == 'image/*'
+    assert 'capture' not in widget.attrs
+    assert 'accept="image/*"' in response.content.decode()
+
+
 def test_public_notice_preserves_copy_warning_and_database_signature(case, client):
     branding = SiteBranding.load()
     branding.developer_credit_text = 'امضای توسعه‌دهنده از دیتابیس'