Resolves critical AttributeError in free cart checkout when coupons are applied.
- Fix cart discount calculation cache invalidation in coupon.py
- Add template null safety for active_card in cart_checkout.j2
- Add comprehensive regression test for free cart coupon flow
- Document full defect hunt process in journal.rst
All 87 tests pass. Fixes production crashes during free cart checkout.
- Add test_cart_checkout_logic_with_none_stripe_user_shop to prevent regression
- Tests the exact scenario that caused production AttributeError
- Validates both old buggy code would crash and new fixed code works
- Covers edge case where stripe_user_shop is None in cart checkout
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add null check for stripe_user_shop before accessing active_card property
- Prevents AttributeError: 'NoneType' object has no attribute 'active_card'
- Handle case where stripe_user_shop is None in cart checkout flow
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Replace deprecated .decode("base64") with base64.b64decode() in short_id_to_bytes function
- Add import base64 to meta.py
- Add comprehensive unit tests for short_id_to_bytes and id_to_uuid functions
- Prevents AttributeError: 'str' object has no attribute 'decode' errors
- Resolves bad gateway authentication issues when accessing URLs with short IDs
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Create virtual environment for twine operations instead of system-wide installs
- Use python3 -m build instead of deprecated setup.py commands
- Resolves PEP 668 externally-managed-environment restrictions in CI
This update enhances product file security by automatically managing S3 object ACLs based on product visibility settings:
- Added get_s3_acl_for_file_key() method to determine appropriate ACL per file type and visibility
- Added update_s3_acls() method to batch update all product file permissions
- Added set_visibility() method that updates visibility and synchronizes S3 ACLs
- Updated product edit view to use new ACL-aware visibility setting
- Added comprehensive unit tests covering all visibility scenarios
- Created migration script to fix existing product S3 ACLs
Security model:
- Private products: All files (product, preview, thumbnails) are private
- Public/unlisted products: Product files remain private, public files (previews/thumbnails) are public-read
- All product downloads continue to use presigned URLs for access control
