From 84f96f90c836e15910fd78829df076b9d1762382 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Sat, 7 Mar 2026 20:20:56 -0500 Subject: [PATCH] fix remaining MPS-14/15/16 audit gaps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Skip discovery ring reforge for non-production shops (MPS-14) - Block settings POST when trial expired, except environment and bucket settings needed for onboarding (MPS-15) - BYOB upload enforcement is a soft prompt (trial tip in settings) rather than hard block — new users need to upload during trial --- make_post_sell/models/shop.py | 9 ++++++++- make_post_sell/views/shop.py | 10 ++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/make_post_sell/models/shop.py b/make_post_sell/models/shop.py index 1d04f39..f553d76 100644 --- a/make_post_sell/models/shop.py +++ b/make_post_sell/models/shop.py @@ -840,7 +840,14 @@ def compute_discovery_ring(shop): def reforge_discovery_ring(shop): - """Compute and store the discovery ring on the shop (synchronous).""" + """Compute and store the discovery ring on the shop (synchronous). + + Non-production shops (MPS-14) get an empty ring — they are excluded + from public discovery. + """ + if shop.environment is not None and shop.is_non_production: + shop.discovery_ring = [] + return [] ring = compute_discovery_ring(shop) shop.discovery_ring = ring return ring diff --git a/make_post_sell/views/shop.py b/make_post_sell/views/shop.py index 551e847..9c6c987 100644 --- a/make_post_sell/views/shop.py +++ b/make_post_sell/views/shop.py @@ -487,6 +487,16 @@ def shop_settings(request): ) if request.method == "POST": + # MPS-15: Block settings changes when trial expired, except + # environment-settings and bucket-settings (needed for onboarding) + allowed_when_expired = ("environment-settings", "bucket-settings") + if shop.is_trial_expired and form_section not in allowed_when_expired: + request.session.flash(( + "Your 21-day trial has expired. Choose a plan to continue editing settings.", + "error", + )) + return HTTPFound(f"/s/{shop.id}/settings") + # Handle shop settings form if form_section == "shop-settings": if name != shop.name: