feat: add community contribution ranks

apps/payments/tests/integration/test_payments.py

@@ -135,3 +135,82 @@ class TestPaymentsAPIIntegrationTests:
         settings.ZARINPAL_STARTPAY = 'https://zarinpal/start/'
         settings.ZARINPAL_VERIFY_URL = 'https://zarinpal/verify'
         settings.ZARINPAL_CALLBACK_URL = 'https://frontend/callback'
+
+
+@pytest.mark.django_db
+@pytest.mark.integration
+def test_my_payments_are_user_scoped_and_omit_gateway_identifiers(client, user_factory, auth_headers, event_factory):
+    current_user = user_factory(username="payment_history_owner")
+    other_user = user_factory(username="payment_history_other")
+    own_event = event_factory(slug="payment-history-own", title="My workshop")
+    other_event = event_factory(slug="payment-history-other", title="Someone else's workshop")
+    Payment.objects.create(
+        user=current_user,
+        event=own_event,
+        base_amount=120000,
+        discount_amount=20000,
+        amount=100000,
+        status=Payment.OrderStatusChoices.PAID,
+        authority="internal-authority-owner",
+        ref_id="internal-reference-owner",
+        card_pan="6037-****-****-1234",
+        card_hash="internal-card-hash",
+    )
+    Payment.objects.create(
+        user=other_user,
+        event=other_event,
+        base_amount=50000,
+        amount=50000,
+        status=Payment.OrderStatusChoices.PENDING,
+        authority="internal-authority-other",
+    )
+
+    response = client.get("/api/payments/me", **auth_headers(current_user))
+    assert response.status_code == 200, response.content
+    payload = response.json()
+    assert len(payload) == 1
+    assert payload[0]["event"]["title"] == own_event.title
+    assert payload[0]["amount"] == 100000
+    assert payload[0]["discount_amount"] == 20000
+    assert payload[0]["status"] == "paid"
+    assert set(payload[0]) == {"event", "base_amount", "discount_amount", "amount", "status", "created_at", "paid_at"}
+    assert "internal-authority-owner" not in response.content.decode()
+    assert "internal-reference-owner" not in response.content.decode()
+    assert "internal-card-hash" not in response.content.decode()
+
+    assert client.get("/api/payments/me").status_code == 401
+
+
+@pytest.mark.django_db
+@pytest.mark.integration
+def test_my_payments_pagination_is_user_scoped(client, user_factory, auth_headers, event_factory):
+    current_user = user_factory(username="payment_paging_owner")
+    other_user = user_factory(username="payment_paging_other")
+    event = event_factory(slug="payment-paging-event")
+    for index in range(12):
+        Payment.objects.create(
+            user=current_user,
+            event=event,
+            base_amount=1000 + index,
+            amount=1000 + index,
+            status=Payment.OrderStatusChoices.PAID,
+        )
+    Payment.objects.create(
+        user=other_user,
+        event=event,
+        base_amount=9000,
+        amount=9000,
+        status=Payment.OrderStatusChoices.PAID,
+    )
+
+    first_page = client.get("/api/payments/me/paginated", {"page": 1}, **auth_headers(current_user))
+    second_page = client.get("/api/payments/me/paginated", {"page": 2}, **auth_headers(current_user))
+
+    assert first_page.status_code == 200, first_page.content
+    assert first_page.json()["count"] == 12
+    assert first_page.json()["page_size"] == 10
+    assert first_page.json()["total_pages"] == 2
+    assert len(first_page.json()["results"]) == 10
+    assert len(second_page.json()["results"]) == 2
+    assert all(item["event"]["slug"] == event.slug for item in first_page.json()["results"])
+    assert "authority" not in first_page.json()["results"][0]