fix payment

tests/test_payment_links.py

@@ -31,6 +31,71 @@ def open_notice(client, case):
     return link
 
 
+def test_customer_shares_short_link_once_without_sending_sms(case, client):
+    endpoint = reverse('payments:notice_share_link', args=[case['notice'].public_id])
+    client.force_login(case['customer'])
+    jobs = NotificationJob.objects.count()
+    assert client.get(endpoint).status_code == 405
+    response = client.post(endpoint)
+    assert response.status_code == 200
+    assert response['Cache-Control'] == 'private, no-store'
+    url = response.json()['url']
+    assert re.fullmatch(r'/p/[a-z0-9]{10}/', urlsplit(url).path)
+    assert client.post(endpoint).json()['url'] == url
+    assert PaymentAccessLink.objects.count() == 1
+    assert NotificationJob.objects.count() == jobs
+    recipient = Client()
+    page = recipient.get(urlsplit(url).path, follow=True)
+    assert page.status_code == 200
+    assert case['notice'].number in page.content.decode()
+    assert '_auth_user_id' not in recipient.session
+    assert recipient.post(endpoint).json()['url'] == url
+
+
+def test_anonymous_share_reuses_original_expiry_and_revocation(case, client):
+    link, url = issue_payment_link(notice=case['notice'])
+    endpoint = reverse('payments:notice_share_link', args=[case['notice'].public_id])
+    client.get(urlsplit(url).path, follow=True)
+    before = link.expires_at
+    assert client.post(endpoint).json()['url'] == url
+    link.refresh_from_db()
+    assert link.expires_at == before
+    assert PaymentAccessLink.objects.count() == 1
+    link.revoked_at = timezone.now()
+    link.save(update_fields=['revoked_at'])
+    assert client.post(endpoint).status_code == 410
+    assert PaymentAccessLink.objects.count() == 1
+
+
+def test_share_link_checks_owner_scope_and_csrf(case, client):
+    endpoint = reverse('payments:notice_share_link', args=[case['notice'].public_id])
+    other = User.objects.create_user(username='other-share-owner', account_type='CUSTOMER')
+    client.force_login(other)
+    assert client.post(endpoint).status_code == 404
+    client.force_login(case['creator'])
+    assert client.post(endpoint).status_code == 403
+    csrf_client = Client(enforce_csrf_checks=True)
+    csrf_client.force_login(case['customer'])
+    assert csrf_client.post(endpoint).status_code == 403
+    open_notice(client := Client(), case)
+    outside = services.issue_notice(case['creator'], {'customer': case['customer'], 'account': case['account'],
+        'subject': 'اعلامیه خارج از لینک اشتراک', 'amount': 100, 'deposit_id': '00044'})
+    assert client.post(reverse('payments:notice_share_link', args=[outside.public_id])).status_code == 404
+
+
+@pytest.mark.parametrize('with_identifier', [False, True])
+def test_full_copy_mentions_required_identifier_only_when_present(case, client, with_identifier):
+    from apps.payments.models import PaymentNotice
+    PaymentNotice.objects.filter(pk=case['notice'].pk).update(deposit_id='۰۰۰۱۲۳' if with_identifier else '')
+    client.force_login(case['customer'])
+    response = client.get(reverse('payments:notice_detail', args=[case['notice'].public_id]))
+    text = response.context['notice'].copy_text
+    assert ('وارد کردن شناسه واریز هنگام پرداخت الزامی و اجباری است' in text) == with_identifier
+    assert ('شناسه واریز: 123' in text) == with_identifier
+    assert 'شماره حساب: 000123456' in text
+    assert 'کپی لینک کوتاه این صفحه برای ارسال به دیگران' in response.content.decode()
+
+
 def test_sms_link_is_temporary_reusable_and_does_not_log_in(case, client, settings):
     settings.PAYMENT_LINK_TTL_DAYS = 3
     job = NotificationJob.objects.get(event_type='PAYMENT_NOTICE_CREATED')
@@ -112,7 +177,7 @@ def test_public_notice_preserves_copy_warning_and_database_signature(case, clien
     open_notice(client, case)
     response = client.get(reverse('payments:notice_detail', args=[case['notice'].public_id]))
     html = response.content.decode()
-    assert 'data-copy="000123"' in html
+    assert 'data-copy="123"' in html
     assert 'کپی کامل اطلاعات' in html and 'pay-deposit-required' in html
     assert case['account'].name in html
     assert 'نام حساب: ' + case['account'].name in response.context['notice'].copy_text