add payment_link and banks

apps/accounts/magic_access.py

@@ -1,4 +1,5 @@
 from django.utils import timezone
+from apps.core.session_access import grant_scoped_session_access
 
 from .models import TicketMagicLink
 
@@ -8,10 +9,7 @@ MAGIC_LINK_SESSION_KEY = "ticket_magic_link_id"
 
 def grant_ticket_magic_access(request, link):
     """Grant an anonymous session access to exactly one ticket until link expiry."""
-    request.session.cycle_key()
-    request.session[MAGIC_LINK_SESSION_KEY] = link.pk
-    remaining = max(1, int((link.expires_at - timezone.now()).total_seconds()))
-    request.session.set_expiry(remaining)
+    grant_scoped_session_access(request, MAGIC_LINK_SESSION_KEY, link.pk, link.expires_at)
 
 
 def get_ticket_magic_access(request, ticket=None):

apps/accounts/views.py

@@ -2,8 +2,11 @@ from django.contrib import messages
 from django.conf import settings
 from django.contrib.auth import login, logout
 from django.shortcuts import get_object_or_404, redirect, render
+from django.utils.http import url_has_allowed_host_and_scheme
+from django.urls import reverse
 from django.utils import timezone
 from django.views.decorators.http import require_GET, require_http_methods, require_POST
+from django.views.decorators.cache import never_cache
 from .forms import CustomerPasswordLoginForm, CustomerProfileForm, MobileForm, OTPForm, StaffLoginForm
 from apps.customers.models import CustomerProfile
 from django.contrib.auth.decorators import login_required
@@ -16,9 +19,22 @@ import logging
 
 logger = logging.getLogger(__name__)
 
+def _remember_destination(request):
+    target = request.GET.get("next", "")
+    if target and target.startswith(("/chaharsu/", "/tickets/")) and url_has_allowed_host_and_scheme(target, allowed_hosts={request.get_host()}, require_https=request.is_secure()):
+        request.session["next"] = target
+
+
+def _login_destination(request):
+    target = request.session.pop("next", "")
+    if target.startswith(("/chaharsu/", "/tickets/")) and url_has_allowed_host_and_scheme(target, allowed_hosts={request.get_host()}, require_https=request.is_secure()):
+        return target
+    return "staff_tickets:list" if request.user.account_type == User.AccountType.STAFF else "payments:home"
+
+
 def _authenticated_home(request):
     if not request.user.is_authenticated: return None
-    return redirect("staff_tickets:list" if request.user.account_type==User.AccountType.STAFF else "tickets:list")
+    return redirect("staff_tickets:list" if request.user.account_type==User.AccountType.STAFF else "payments:home")
 
 @require_GET
 def home(request):
@@ -27,6 +43,7 @@ def home(request):
 
 @require_http_methods(["GET", "POST"])
 def customer_login(request):
+    _remember_destination(request)
     if response:=_authenticated_home(request): return response
     form = MobileForm(request.POST or None)
     if request.method == "POST" and form.is_valid():
@@ -60,18 +77,19 @@ def verify_otp(request):
             if not user.is_active: form.add_error(None, "حساب شما غیرفعال است.")
             else:
                 login(request, user, backend="django.contrib.auth.backends.ModelBackend")
-                return redirect(request.session.pop("next", "tickets:list"))
+                return redirect(_login_destination(request))
         else: form.add_error("code", "کد نامعتبر یا منقضی است.")
     return render(request, "accounts/otp.html", {"form": form, "mobile": challenge.mobile})
 
 @require_http_methods(["GET","POST"])
 def customer_password_login(request):
+    _remember_destination(request)
     if response:=_authenticated_home(request): return response
     form=CustomerPasswordLoginForm(request.POST or None)
     if request.method=="POST" and form.is_valid():
         user=form.authenticate(request)
         if user and user.is_active:
-            login(request,user); return redirect(request.session.pop("next","tickets:list"))
+            login(request,user); return redirect(_login_destination(request))
         form.add_error(None,"شماره موبایل یا رمز عبور صحیح نیست.")
     return render(request,"accounts/customer_password_login.html",{"form":form})
 
@@ -106,17 +124,30 @@ def logout_view(request):
     response["Cache-Control"]="no-store"
     return response
 
+@never_cache
+@require_http_methods(["GET", "POST"])
 def consume_magic_link(request, token):
     link = TicketMagicLink.objects.select_related("customer", "ticket").filter(token_hash=TicketMagicLink.digest(token)).first()
-    if not link or link.revoked_at or link.expires_at <= timezone.now():
+    if not link or link.revoked_at or link.expires_at <= timezone.now() or not link.customer.is_active:
         request.session["next"] = f"/tickets/{link.ticket.public_id}/" if link else "/tickets/"
         messages.error(request, "این لینک منقضی شده یا اشتباه است. لطفاً با شماره موبایل خود وارد شوید تا بتوانید پیام‌ها را ببینید.")
-        return redirect("accounts:login")
-    if request.user.is_authenticated:
-        if request.user.pk != link.customer_id:
-            from django.core.exceptions import PermissionDenied
-            raise PermissionDenied
-    else:
+        response = redirect("accounts:login")
+        response["Referrer-Policy"] = "no-referrer"
+        return response
+    if request.user.is_authenticated and request.user.pk != link.customer_id:
+        confirmed = (
+            request.method == "POST"
+            and request.POST.get("action") == "logout_and_open"
+            and request.POST.get("account_id") == str(request.user.pk)
+        )
+        if not confirmed:
+            response = render(request, "accounts/magic_link_confirmation.html")
+            # Same-origin form submissions need an Origin for Django CSRF checks.
+            response["Referrer-Policy"] = "same-origin"
+            return response
+        # Logout flushes the old session; grant access only in the new one.
+        logout(request)
+    if not request.user.is_authenticated:
         grant_ticket_magic_access(request, link)
     ip_address = request.META.get("REMOTE_ADDR")
     user_agent = request.META.get("HTTP_USER_AGENT", "")[:500]