Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas: - Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker - Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes - Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic - Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe - Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support - Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping - Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing - Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 22:29:14 -06:00
parent 63b57a83ab
commit c80c66c2e5
58 changed files with 3363 additions and 1049 deletions
--- a/generator/tests/test_exercise_family_dedup.py
+++ b/generator/tests/test_exercise_family_dedup.py
@@ -0,0 +1,63 @@
+from django.contrib.auth.models import User
+from django.test import TestCase
+
+from exercise.models import Exercise
+from generator.models import UserPreference
+from generator.services.exercise_selector import (
+    ExerciseSelector,
+    extract_movement_families,
+)
+from registered_user.models import RegisteredUser
+
+
+class TestExerciseFamilyDedup(TestCase):
+    def setUp(self):
+        django_user = User.objects.create_user(
+            username='family_dedup_user',
+            password='testpass123',
+        )
+        registered_user = RegisteredUser.objects.create(
+            user=django_user,
+            first_name='Family',
+            last_name='Dedup',
+        )
+        self.preference = UserPreference.objects.create(
+            registered_user=registered_user,
+            days_per_week=4,
+            fitness_level=2,
+        )
+
+    def test_high_pull_maps_to_clean_family(self):
+        clean_pull_families = extract_movement_families('Barbell Clean Pull')
+        high_pull_families = extract_movement_families('Barbell High Pull')
+
+        self.assertIn('clean', clean_pull_families)
+        self.assertIn('clean', high_pull_families)
+
+    def test_high_pull_blocked_when_clean_family_already_used(self):
+        high_pull = Exercise.objects.create(
+            name='Barbell High Pull',
+            movement_patterns='lower pull,lower pull - hip hinge',
+            muscle_groups='glutes,hamstrings,traps',
+            is_reps=True,
+            is_duration=False,
+            is_weight=True,
+            is_compound=True,
+            exercise_tier='secondary',
+            complexity_rating=3,
+            difficulty_level='intermediate',
+        )
+        selector = ExerciseSelector(self.preference)
+        selector.used_movement_families['clean'] = 1
+
+        selected = selector._weighted_pick(
+            Exercise.objects.filter(pk=high_pull.pk),
+            Exercise.objects.none(),
+            count=1,
+        )
+
+        self.assertEqual(
+            selected,
+            [],
+            'High-pull variant should be blocked when clean family is already used.',
+        )