fix(discovery): lier la continuation aux critères et au viewer

.github/workflows/ci.yml

@@ -244,8 +244,11 @@ jobs:
         run: >-
           python manage.py test
           opportunities.tests
+          opportunities.test_public_source_knowledge
           services.test_task32_opportunities
           services.test_task32_concurrency
+          services.test_owner_relations
+          services.test_native_start_api
       - name: Run Payments and Services T33 PostgreSQL tests
         if: ${{ matrix.shard == 'commerce' }}
         run: >-
@@ -262,6 +265,7 @@ jobs:
           capacity.test_access_bridge
           capacity.test_concurrency
           commerce.tests
+          commerce.test_offer_price_facts
           commerce.test_order_edge_cases
           transport.tests
           transport.test_task25_booking

.github/workflows/mobile-android-build.yml

@@ -1,4 +1,5 @@
 name: Mobile Android Build
+run-name: "Mobile DEV APK - ${{ github.head_ref || github.ref_name }}"
 
 on:
   pull_request:
@@ -58,11 +59,25 @@ jobs:
           git diff --exit-code -- pubspec.lock
       - name: Generate Dart sources
         run: dart run build_runner build --delete-conflicting-outputs
+      - name: Validate remote DEV API
+        run: |
+          set -euo pipefail
+          jq -e '
+            .MAKOLO_ENVIRONMENT == "dev"
+            and (.MAKOLO_API_BASE_URL | type == "string"
+                 and test("^https://[^/]+/?$"))
+            and (.MAKOLO_API_BASE_URL | test(
+              "^https://(localhost|127\\.0\\.0\\.1|10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|[^/]*\\.local)([:/]|$)";
+              "i"
+            ) | not)
+          ' config/dev.json > /dev/null
+          echo "DEV build configured for a remote HTTPS API."
       - name: Build Android debug
         run: flutter build apk --debug --flavor dev --dart-define-from-file=config/dev.json
       - name: Upload DEV APK
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: makolo-dev-debug-apk
+          name: makolo-dev-debug-apk-${{ github.event.pull_request.head.sha || github.sha }}
           path: mobile/build/app/outputs/flutter-apk/app-dev-debug.apk
           if-no-files-found: error
+          retention-days: 14

accounts/api/public_profile_views.py

@@ -0,0 +1,47 @@
+"""Minimal public Profile projection derived from the canonical Passeport.
+
+This endpoint neither grants authority nor exposes the private Profile.
+"""
+from django.contrib.auth import get_user_model
+from django.shortcuts import get_object_or_404
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from core.api.projections import projection_envelope
+from sharing.passport import PASSPORT_PUBLIC, build_profile_passport
+
+
+class PublicProfileAPIView(APIView):
+    permission_classes = [AllowAny]
+
+    def get(self, request, profile_id):
+        user = get_object_or_404(
+            get_user_model().objects.filter(
+                is_active=True,
+                profile__public_profile=True,
+                profile__searchable=True,
+            ),
+            pk=profile_id,
+        )
+        # The public Passeport remains the owner of this representation.
+        identity = build_profile_passport(
+            user, variant=PASSPORT_PUBLIC,
+        ).identity
+        response = Response(projection_envelope(
+            projection="accounts.public-profile",
+            scope="public",
+            data={
+                "profile": {
+                    "kind": "profile",
+                    "id": str(user.pk),
+                    "name": identity["name"],
+                    "avatar_url": identity["avatar_url"],
+                    "headline": identity["headline"],
+                    "bio": identity["bio"],
+                    "location": identity["location"],
+                },
+            },
+        ))
+        response["Cache-Control"] = "public, max-age=60"
+        return response

accounts/api/urls.py

@@ -3,6 +3,7 @@
 from rest_framework.routers import DefaultRouter
 from rest_framework_simplejwt.views import TokenRefreshView
 
+from .public_profile_views import PublicProfileAPIView
 from .views import (
     AccountDeleteAPIView,
     IdentifierAvailabilityAPIView,
@@ -25,6 +26,7 @@
 router.register(r"users", UserViewSet, basename="users")
 
 urlpatterns = [
+    path("public-profiles/<uuid:profile_id>/", PublicProfileAPIView.as_view(), name="public-profile"),
     path("auth/register/", RegisterAPIView.as_view(), name="register"),
     path(
         "auth/identifier/availability/",

accounts/test_public_profile_api.py

@@ -0,0 +1,54 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase
+
+from accounts.models import UserProfile
+
+
+class PublicProfileAPITests(TestCase):
+    def setUp(self):
+        self.owner = get_user_model().objects.create_user(
+            username="native-public-owner",
+            first_name="Amina",
+            last_name="Test",
+            bio="Présentation publique",
+            phone="+243999000111",
+            email="private-profile@example.test",
+        )
+        self.profile = UserProfile.objects.create(
+            user=self.owner,
+            public_profile=True,
+            searchable=True,
+            city="Lubumbashi",
+            address="Ne jamais exposer",
+        )
+        self.url = f"/api/v1/accounts/public-profiles/{self.owner.pk}/"
+
+    def test_anonymous_sees_only_canonical_public_identity(self):
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 200)
+        profile = response.json()["data"]["profile"]
+        self.assertEqual(profile["kind"], "profile")
+        self.assertEqual(profile["id"], str(self.owner.pk))
+        self.assertEqual(profile["name"], "Amina Test")
+        self.assertEqual(profile["bio"], "Présentation publique")
+        self.assertNotIn("email", profile)
+        self.assertNotIn("phone", profile)
+        self.assertNotIn("address", profile)
+
+    def test_private_unsearchable_or_inactive_profiles_are_not_exposed(self):
+        for changes in (
+            {"public_profile": False},
+            {"searchable": False},
+        ):
+            self.profile.public_profile = True
+            self.profile.searchable = True
+            for field, value in changes.items():
+                setattr(self.profile, field, value)
+            self.profile.save()
+            self.assertEqual(self.client.get(self.url).status_code, 404)
+        self.profile.public_profile = True
+        self.profile.searchable = True
+        self.profile.save()
+        self.owner.is_active = False
+        self.owner.save(update_fields=["is_active"])
+        self.assertEqual(self.client.get(self.url).status_code, 404)

commerce/native_activity_checkout_api.py

@@ -0,0 +1,204 @@
+"""Activity-level Commerce checkout, without a universal Journey start."""
+from django.core.exceptions import ValidationError as DomainValidationError
+from django.db import transaction
+from django.http import Http404
+from django.shortcuts import get_object_or_404
+from rest_framework import status
+from rest_framework.exceptions import NotAuthenticated, ValidationError
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from accounts.models import UserProfile
+from activities.models import Activity, ActivityStatus, ActivityVisibility, Occurrence, OccurrenceStatus
+from commerce.models import CommerceOrder, Offer, PaymentMode
+from commerce.selectors import currently_available_offers
+from commerce.services import create_order, confirm_order
+from events.models import Event
+from groups.selectors import eligible_activity_ids_for_profile
+from journeys.models import Journey, JourneyStatus, WorkflowKind
+from journeys.services import create_journey
+from organizations.models import SpaceLifecycle
+from payments.obligation_services import create_commerce_payment_obligation
+
+from .native_checkout_api import ACTIVE_ORDER_STATUSES, CommerceCheckoutInput, _order_payload
+
+
+def public_activity_for_commerce(actor, activity_id, *, lock=False):
+    qs = Activity.objects.filter(
+        pk=activity_id, status=ActivityStatus.PUBLISHED,
+        visibility=ActivityVisibility.PUBLIC,
+    ).select_related("space", "owner_profile")
+    if lock:
+        qs = qs.select_for_update()
+    activity = get_object_or_404(qs)
+    if (
+        activity.pk not in eligible_activity_ids_for_profile(actor, [activity.pk])
+        or Event.objects.filter(activity=activity).exists()
+    ):
+        raise Http404
+    if activity.space_id:
+        space = activity.space
+        visible = (
+            space.public_profile and space.searchable
+            and space.lifecycle == SpaceLifecycle.ACTIVE
+            and space.verification_status != "suspended"
+        )
+    else:
+        visible = UserProfile.objects.filter(
+            user_id=activity.owner_profile_id,
+            public_profile=True, searchable=True, user__is_active=True,
+        ).exists()
+    if not visible:
+        raise Http404
+    return activity
+
+
+def activity_offer_choices(activity):
+    """Published Offer, Occurrence and Capacity facts; never infer from price."""
+    occurrences = list(
+        Occurrence.objects.filter(
+            activity=activity, status=OccurrenceStatus.SCHEDULED,
+        ).order_by("start_at", "pk")[:50]
+    )
+    rows = []
+    for occurrence in occurrences or [None]:
+        for offer in currently_available_offers(
+            activity=activity, occurrence=occurrence,
+        ).prefetch_related("payment_options"):
+            if not offer.is_currently_available:
+                continue
+            # after_approval requires a separately approved owner Journey.
+            modes = [mode for mode in offer.allowed_payment_modes
+                     if mode != PaymentMode.AFTER_APPROVAL]
+            if not modes:
+                continue
+            rows.append({
+                "id": str(offer.pk),
+                "occurrence_id": str(occurrence.pk) if occurrence else None,
+                "occurrence_label": (
+                    occurrence.label or str(occurrence.start_at or "")
+                    if occurrence else ""
+                ),
+                "label": offer.name,
+                "unit_price": str(offer.unit_price),
+                "currency": offer.currency,
+                "min_quantity": offer.min_quantity,
+                "max_quantity": offer.max_quantity,
+                "payment_modes": modes,
+                "default_payment_mode": offer.payment_mode if offer.payment_mode in modes else modes[0],
+            })
+    return rows
+
+
+def active_activity_order(actor, activity):
+    if not getattr(actor, "is_authenticated", False):
+        return None
+    return CommerceOrder.objects.filter(
+        buyer=actor, journey__activity=activity,
+        status__in=ACTIVE_ORDER_STATUSES,
+    ).order_by("-created_at", "-pk").first()
+
+
+class ActivityCommerceCheckoutAPIView(APIView):
+    """Atomically create a Purchase Journey and owner-confirmed CommerceOrder."""
+    permission_classes = [AllowAny]
+
+    def get(self, request, activity_id):
+        activity = public_activity_for_commerce(request.user, activity_id)
+        existing = active_activity_order(request.user, activity)
+        offers = activity_offer_choices(activity) if existing is None else []
+        response = Response({
+            "activity": {"id": str(activity.pk), "title": activity.title},
+            "journey_id": None,
+            "can_order": bool(offers),
+            "existing_order": _order_payload(existing) if existing else None,
+            "offers": offers,
+        })
+        response["Cache-Control"] = "private, no-store"
+        return response
+
+    @transaction.atomic
+    def post(self, request, activity_id):
+        if not getattr(request.user, "is_authenticated", False):
+            raise NotAuthenticated()
+        serializer = CommerceCheckoutInput(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        data = serializer.validated_data
+        activity = public_activity_for_commerce(request.user, activity_id, lock=True)
+        occurrence_id = data.get("occurrence_id")
+        occurrence = (
+            get_object_or_404(Occurrence, pk=occurrence_id, activity=activity,
+                              status=OccurrenceStatus.SCHEDULED)
+            if occurrence_id else None
+        )
+        key = data["idempotency_key"].strip()
+        prior = CommerceOrder.objects.filter(idempotency_key=key).first()
+        if prior is not None:
+            lines = list(prior.items.values("offer_id", "quantity"))
+            if (
+                prior.buyer_id != request.user.pk
+                or prior.journey.activity_id != activity.pk
+                or prior.journey.occurrence_id != (occurrence.pk if occurrence else None)
+                or prior.payment_mode != data["payment_mode"]
+                or len(lines) != 1
+                or lines[0]["offer_id"] != data["offer_id"]
+                or lines[0]["quantity"] != data["quantity"]
+            ):
+                raise ValidationError({"idempotency_key": "Cette référence concerne une autre demande."})
+            result = Response(_order_payload(prior))
+            result["Cache-Control"] = "private, no-store"
+            return result
+        existing = active_activity_order(request.user, activity)
+        if existing is not None:
+            result = Response({
+                "detail": "Une commande existe déjà.",
+                "existing_order": _order_payload(existing),
+            }, status=status.HTTP_409_CONFLICT)
+            result["Cache-Control"] = "private, no-store"
+            return result
+        context_id = str(occurrence.pk) if occurrence else None
+        matching = next((
+            row for row in activity_offer_choices(activity)
+            if row["id"] == str(data["offer_id"])
+            and row["occurrence_id"] == context_id
+            and data["payment_mode"] in row["payment_modes"]
+        ), None)
+        if matching is None:
+            raise ValidationError({"offer_id": "Cette offre n’est plus disponible."})
+        try:
+            # An unfinished personal purchase Journey is the same domain
+            # context, not a reason to create a duplicate one.
+            journey = (
+                Journey.objects.select_for_update(of=("self",))
+                .filter(
+                    initiated_by=request.user, beneficiary=request.user,
+                    activity=activity, occurrence=occurrence,
+                    workflow=WorkflowKind.PURCHASE,
+                    status=JourneyStatus.DRAFT,
+                )
+                .order_by("-created_at", "-pk")
+                .first()
+            )
+            if journey is None:
+                journey = create_journey(
+                    initiated_by=request.user, beneficiary=request.user,
+                    activity=activity, occurrence=occurrence,
+                    workflow=WorkflowKind.PURCHASE,
+                )
+            order = create_order(
+                journey=journey, buyer=request.user,
+                selections=[{"offer": Offer.objects.get(pk=data["offer_id"]),
+                             "quantity": data["quantity"]}],
+                payment_mode=data["payment_mode"],
+                idempotency_key=key,
+            )
+            if order.total > 0 and order.payment_mode == PaymentMode.UPFRONT:
+                create_commerce_payment_obligation(commerce_order=order, actor=request.user)
+            if order.total == 0 and order.payment_mode == PaymentMode.NONE:
+                confirm_order(order=order, actor=request.user)
+        except DomainValidationError as exc:
+            raise ValidationError({"detail": exc.messages}) from exc
+        response = Response(_order_payload(order), status=status.HTTP_201_CREATED)
+        response["Cache-Control"] = "private, no-store"
+        return response

commerce/native_api_urls.py

@@ -0,0 +1,11 @@
+from django.urls import path
+
+from .native_checkout_api import PersonalCommerceCheckoutAPIView
+from .native_activity_checkout_api import ActivityCommerceCheckoutAPIView
+
+app_name = "commerce_api"
+
+urlpatterns = [
+    path("activities/<uuid:activity_id>/checkout/", ActivityCommerceCheckoutAPIView.as_view(), name="activity-checkout"),
+    path("journeys/<uuid:journey_id>/checkout/", PersonalCommerceCheckoutAPIView.as_view(), name="journey-checkout"),
+]