Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

superset/helpers.py

@@ -12,15 +12,26 @@ def get_first_up_superset(workout):
         return first_up_superset
 
 def get_first_up_superset_exercise(superset):
+    try:
+        exercise = Exercise.objects.get(name="First Up")
+    except Exercise.DoesNotExist:
+        exercise = None
+
+    if exercise is None:
+        return None
+
     first_up_superset_exercise = SupersetExercise()
-    first_up_superset_exercise.exercise = Exercise.objects.get(name="First Up")
+    first_up_superset_exercise.exercise = exercise
     first_up_superset_exercise.duration = 15
     first_up_superset_exercise.order = 1
-    first_up_superset_exercise.exercise.side = "Chill"
-    first_up_superset_exercise.exercise.joints_used = ""
-    first_up_superset_exercise.exercise.movement_patterns = ""
-    first_up_superset_exercise.exercise.equipment_required = ""
-    first_up_superset_exercise.exercise.muscle_groups = ""
+    # Build overrides as a dict instead of mutating the ORM object in memory
+    first_up_superset_exercise._display_overrides = {
+        'side': 'Chill',
+        'joints_used': '',
+        'movement_patterns': '',
+        'equipment_required': '',
+        'muscle_groups': '',
+    }
     if superset is not None:
         first_up_superset_exercise.superset = superset
-    return first_up_superset_exercise
+    return first_up_superset_exercise

superset/models.py

@@ -14,9 +14,9 @@ class Superset(models.Model):
       related_name='superset_workout'
     )
 
-    rounds = models.IntegerField(max_length=3, blank=False, null=False)
-    order = models.IntegerField(max_length=3, blank=False, null=False)
-    estimated_time = models.FloatField(max_length=255, blank=True, null=True)
+    rounds = models.IntegerField(blank=False, null=False)
+    order = models.IntegerField(blank=False, null=False)
+    estimated_time = models.FloatField(blank=True, null=True)
     rest_between_rounds = models.IntegerField(default=45, help_text='Rest between rounds in seconds')
 
     def __str__(self):
@@ -39,10 +39,10 @@ class SupersetExercise(models.Model):
       related_name='superset_exercises'
     )
 
-    weight = models.IntegerField(null=True, blank=True, max_length=4)
-    reps = models.IntegerField(null=True, blank=True, max_length=4)
-    duration = models.IntegerField(null=True, blank=True, max_length=4)
-    order = models.IntegerField(max_length=3, blank=False, null=False)
+    weight = models.IntegerField(null=True, blank=True)
+    reps = models.IntegerField(null=True, blank=True)
+    duration = models.IntegerField(null=True, blank=True)
+    order = models.IntegerField(blank=False, null=False)
    
     def __str__(self):
         return self.superset.workout.name + " -- " + self.exercise.name

superset/serializers.py

@@ -2,33 +2,33 @@ from rest_framework import serializers
 from .models import *
 from exercise.models import Exercise
 from exercise.serializers import ExerciseSerializer
-import uuid
 
 class SupersetExerciseSerializer(serializers.ModelSerializer):
     exercise = serializers.SerializerMethodField()
     unique_id = serializers.SerializerMethodField()
-    
+
     class Meta:
         model = SupersetExercise
         fields = '__all__'
-    
-    def get_exercise(self, obj): 
+
+    def get_exercise(self, obj):
         data = ExerciseSerializer(obj.exercise, many=False).data
         return data
-    
-    def get_unique_id(self, obj): 
-        return str(uuid.uuid4())
+
+    def get_unique_id(self, obj):
+        return f"{obj.pk}-{obj.superset_id}" if hasattr(obj, 'superset_id') else str(obj.pk)
 
 class SupersetSerializer(serializers.ModelSerializer):
     exercises = serializers.SerializerMethodField()
-    
+
     class Meta:
         model = Superset
         fields = '__all__'
-    
+
     def get_exercises(self, obj):
         if obj.pk is None:
             return []
-        objs = SupersetExercise.objects.filter(superset=obj).order_by('order')
+        # Use prefetched data if available via superset_exercises related manager
+        objs = obj.superset_exercises.all().order_by('order')
         data = SupersetExerciseSerializer(objs, many=True).data
         return data