Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas: - Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker - Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes - Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic - Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe - Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support - Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping - Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing - Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 22:29:14 -06:00
parent 63b57a83ab
commit c80c66c2e5
58 changed files with 3363 additions and 1049 deletions
--- a/generator/tests/test_modality_guardrails.py
+++ b/generator/tests/test_modality_guardrails.py
@@ -0,0 +1,103 @@
+from django.contrib.auth.models import User
+from django.test import TestCase
+
+from exercise.models import Exercise
+from generator.models import UserPreference
+from generator.services.exercise_selector import ExerciseSelector
+from registered_user.models import RegisteredUser
+
+
+class TestModalityGuardrails(TestCase):
+    def setUp(self):
+        django_user = User.objects.create_user(
+            username='modality_guardrails_user',
+            password='testpass123',
+        )
+        registered_user = RegisteredUser.objects.create(
+            user=django_user,
+            first_name='Modality',
+            last_name='Guardrails',
+        )
+        self.preference = UserPreference.objects.create(
+            registered_user=registered_user,
+            days_per_week=4,
+            fitness_level=2,
+        )
+
+    def test_rep_mode_excludes_duration_only_exercises(self):
+        duration_only = Exercise.objects.create(
+            name="Dumbbell Waiter's Carry",
+            movement_patterns='core,core - carry',
+            muscle_groups='core,deltoids,upper back',
+            equipment_required='Dumbbell',
+            is_weight=True,
+            is_duration=True,
+            is_reps=False,
+            is_compound=True,
+            exercise_tier='secondary',
+            difficulty_level='intermediate',
+            complexity_rating=3,
+        )
+        reps_ex = Exercise.objects.create(
+            name='2 Kettlebell Clean and Press',
+            movement_patterns='upper push - vertical, upper push, lower pull',
+            muscle_groups='deltoids,triceps,glutes',
+            equipment_required='Kettlebell',
+            is_weight=True,
+            is_duration=False,
+            is_reps=True,
+            is_compound=True,
+            exercise_tier='secondary',
+            difficulty_level='intermediate',
+            complexity_rating=3,
+        )
+
+        selector = ExerciseSelector(self.preference)
+        picked = selector.select_exercises(
+            muscle_groups=[],
+            count=2,
+            is_duration_based=False,
+        )
+        picked_ids = {e.pk for e in picked}
+
+        self.assertIn(reps_ex.pk, picked_ids)
+        self.assertNotIn(duration_only.pk, picked_ids)
+
+    def test_working_selection_excludes_static_stretch_patterns(self):
+        static_stretch = Exercise.objects.create(
+            name='Supine Pec Stretch - T',
+            movement_patterns='mobility - static, static stretch, cool down',
+            muscle_groups='chest,shoulders',
+            equipment_required='None',
+            is_weight=False,
+            is_duration=True,
+            is_reps=False,
+            is_compound=False,
+            exercise_tier='accessory',
+            difficulty_level='beginner',
+            complexity_rating=1,
+        )
+        valid_reps = Exercise.objects.create(
+            name='Barbell Clean Pull',
+            movement_patterns='upper pull,hip hinge',
+            muscle_groups='upper back,hamstrings,glutes',
+            equipment_required='Barbell',
+            is_weight=True,
+            is_duration=False,
+            is_reps=True,
+            is_compound=True,
+            exercise_tier='primary',
+            difficulty_level='intermediate',
+            complexity_rating=3,
+        )
+
+        selector = ExerciseSelector(self.preference)
+        picked = selector.select_exercises(
+            muscle_groups=[],
+            count=2,
+            is_duration_based=False,
+        )
+        picked_ids = {e.pk for e in picked}
+
+        self.assertIn(valid_reps.pk, picked_ids)
+        self.assertNotIn(static_stretch.pk, picked_ids)