Pegasus update. Version 2026.6.2.5

Author: czue

.claude/skills/resolve-pegasus-conflicts/SKILL.md

@@ -24,10 +24,15 @@ First, determine what the user needs help with by checking their current state:
 The user has already run `git merge <main branch>` and has conflicts to resolve. Help them resolve the conflicts using these strategies:
 
 #### Database Migrations
-- **Strategy**: Discard Pegasus migration changes, keep the user's changes
-- **Reason**: Migration files should be regenerated, not merged
-- **Action**: For conflicted migration files, accept theirs (the user's version from main), then run `./manage.py makemigrations` after all conflicts are resolved
-- **Git command**: `git checkout --theirs <migration-file>` for each conflicted migration
+
+**Principle**: When main/local and Pegasus disagree about a migration, main/local wins. Main's migration files typically reflect what the local DB (and prod) have already applied, so that history is the baseline you protect. When a Pegasus migration *conflicts with or duplicates* something main has already applied, you should drop Pegasus's version in favour of main's, then run `./manage.py makemigrations` to re-express any genuine change as a clean forward diff (the change lives in the merged models, so makemigrations re-derives it).
+
+- **On a conflict**: For conflicted migration files, accept the user's version from main with `git checkout --theirs <migration-file>`, then run `./manage.py makemigrations` after all conflicts are resolved.
+- **Watch for silent (conflict-free) migration changes — this is easy to miss**: Pegasus regenerates its own auto-generated migrations and sometimes **renames** them (e.g. `0002_customuser_language...` → `0002_customuser_customer...`). A rename is a delete-on-one-side + add-on-the-other, which git merges with **no conflict markers** — so it slips through silently and leaves you with a duplicate/competing migration the conflict step never flagged. After merging, always diff the migration dirs against main to catch this:
+  ```
+  git diff --name-status main HEAD -- '*/migrations/*.py'
+  ```
+  Treat any `R` (rename) the same as a conflict: restore main's file (`git checkout main -- <file>`), delete Pegasus's regenerated copy (`git rm <file>`), then `./manage.py makemigrations` to regenerate the forward diff cleanly. Brand-new app migrations (all `A`, e.g. a freshly added `ecommerce` app) are fine — keep those as-is.
 - **djstripe migration references**: If djstripe was upgraded, check if app migrations reference old djstripe migrations that no longer exist (see the "djstripe 2.10 upgrade" section below).
 
 #### Dependency Lock Files (uv.lock, requirements.txt, package-lock.json)
@@ -75,12 +80,28 @@ After all conflicts are resolved and the merge is complete, run the verification
 
 1. **Frontend install + build**: `npm install && npm run build`
 2. **Python dependency sync**: `uv sync`
-3. **Migrations**: `./manage.py makemigrations` then `./manage.py migrate`
+3. **Migrations**: `./manage.py makemigrations` then `./manage.py migrate`. If `migrate` fails partway, see "Recovering from a partial migration" below.
 4. **Tests**: `./manage.py test`
 5. **Ruff format + lint**: `make ruff` (auto-formats and auto-fixes lint issues)
 
 Commit any pending changes produced by the steps above (e.g. new migrations, formatting fixes) with a clear message. Docker users can substitute `make upgrade` for the build/migrate steps.
 
+### Recovering from a partial migration
+
+`migrate` commits each migration separately, so a failure partway through can leave earlier migrations applied while a later one fails — the DB is now in a half-migrated state that no longer matches its starting baseline. The local dev DB is typically kept at the same migration state as production, so it matters that you put it back. For Pegasus's schema-only, reversible migrations this is straightforward to undo.
+
+1. **See what actually applied — check, don't theorize.** Surprising schema (tables/columns you didn't expect) is far more likely to be something *you just applied* than pre-existing cruft. Confirm with timestamps:
+   ```
+   ./manage.py dbshell -- -c "SELECT app, name, applied FROM django_migrations ORDER BY applied DESC LIMIT 20;"
+   ```
+   The recent timestamps are what this run applied.
+2. **Reverse them** back to the last good state, in reverse-dependency order (unapply the app that *depends on* another before the one it depends on):
+   ```
+   ./manage.py migrate <app> <last_good_migration>   # or `zero` to unapply an app entirely
+   ```
+3. **If the reverse errors loudly** (e.g. `IrreversibleError` — a data migration with no reverse defined), stop and raise to a human rather than forcing it. Don't pre-gate on `atomic = False` or side effects; just attempt the reverse and let it fail loudly if it can't. (If a forward op already dropped data, that loss happened on apply — reversing won't recover it, and that's also a human escalation.)
+4. Once back at a clean baseline, fix the offending migration (see "Database Migrations" above — usually a Pegasus rename/duplicate), then re-run `./manage.py migrate` and confirm the full chain applies cleanly from the baseline.
+
 ### Pushing
 
 If everything above passed, the default is to push so the user can open a PR:

apps/users/migrations/0002_alter_customuser_avatar.py

@@ -1,4 +1,4 @@
-# Generated by Django 6.0.5 on 2026-06-22 08:29
+# Generated by Django 6.0.5 on 2026-07-22 14:31
 
 import apps.users.helpers
 import apps.users.models

apps/users/tests/test_helpers.py

@@ -0,0 +1,34 @@
+from django.core.exceptions import ValidationError
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.test import SimpleTestCase
+
+from apps.users.helpers import validate_profile_picture
+
+MAX_FILE_SIZE = 5242880  # 5 MB, mirrors the limit in validate_profile_picture
+
+
+def _image_file(name, size=10):
+    return SimpleUploadedFile(name, b"x" * size)
+
+
+class ValidateProfilePictureTest(SimpleTestCase):
+    def test_valid_extensions(self):
+        for name in ["photo.jpg", "photo.jpeg", "photo.png", "photo.tif", "photo.tiff", "photo.webp", "photo.bmp"]:
+            with self.subTest(name=name):
+                validate_profile_picture(_image_file(name))  # should not raise
+
+    def test_extension_check_is_case_insensitive(self):
+        validate_profile_picture(_image_file("photo.JPG"))
+        validate_profile_picture(_image_file("photo.PnG"))
+
+    def test_invalid_extensions(self):
+        for name in ["photo.gif", "photo.svg", "script.exe", "photo", "photo.jpg.txt"]:
+            with self.subTest(name=name), self.assertRaises(ValidationError):
+                validate_profile_picture(_image_file(name))
+
+    def test_file_at_size_limit_is_allowed(self):
+        validate_profile_picture(_image_file("photo.jpg", size=MAX_FILE_SIZE))
+
+    def test_file_over_size_limit_is_rejected(self):
+        with self.assertRaises(ValidationError):
+            validate_profile_picture(_image_file("photo.jpg", size=MAX_FILE_SIZE + 1))

apps/users/tests/test_user_model.py

@@ -0,0 +1,57 @@
+from allauth.account.models import EmailAddress
+from django.test import SimpleTestCase, TestCase
+
+from apps.users.models import CustomUser
+
+
+class DisplayNameTest(SimpleTestCase):
+    def test_uses_full_name_when_set(self):
+        user = CustomUser(first_name="Ada", last_name="Lovelace", email="ada@example.com")
+        self.assertEqual(user.get_display_name(), "Ada Lovelace")
+
+    def test_falls_back_to_email(self):
+        user = CustomUser(email="ada@example.com", username="ada-username")
+        self.assertEqual(user.get_display_name(), "ada@example.com")
+
+    def test_falls_back_to_username_without_email(self):
+        user = CustomUser(username="ada-username")
+        self.assertEqual(user.get_display_name(), "ada-username")
+
+    def test_str_includes_name_and_email(self):
+        user = CustomUser(first_name="Ada", last_name="Lovelace", email="ada@example.com")
+        self.assertEqual(str(user), "Ada Lovelace <ada@example.com>")
+
+
+class GravatarTest(SimpleTestCase):
+    def test_gravatar_id_is_md5_of_email(self):
+        user = CustomUser(email="test@example.com")
+        self.assertEqual(user.gravatar_id, "55502f40dc8b7c769880b10874abc9d0")
+
+    def test_gravatar_id_normalizes_case_and_whitespace(self):
+        self.assertEqual(
+            CustomUser(email=" TEST@Example.com ").gravatar_id,
+            CustomUser(email="test@example.com").gravatar_id,
+        )
+
+    def test_avatar_url_falls_back_to_gravatar(self):
+        user = CustomUser(email="test@example.com")
+        self.assertEqual(
+            user.avatar_url,
+            "https://www.gravatar.com/avatar/55502f40dc8b7c769880b10874abc9d0?s=128&d=identicon",
+        )
+
+
+class HasVerifiedEmailTest(TestCase):
+    def test_verified_email(self):
+        user = CustomUser.objects.create(username="a@example.com", email="a@example.com")
+        EmailAddress.objects.create(user=user, email="a@example.com", verified=True, primary=True)
+        self.assertTrue(user.has_verified_email)
+
+    def test_unverified_email(self):
+        user = CustomUser.objects.create(username="b@example.com", email="b@example.com")
+        EmailAddress.objects.create(user=user, email="b@example.com", verified=False, primary=True)
+        self.assertFalse(user.has_verified_email)
+
+    def test_no_email_records(self):
+        user = CustomUser.objects.create(username="c@example.com", email="c@example.com")
+        self.assertFalse(user.has_verified_email)

apps/utils/tests/__init__.py

@@ -0,0 +1,27 @@
+from django.contrib.sites.models import Site
+from django.test import TestCase
+
+from apps.web.meta import absolute_url, get_protocol, get_server_root
+
+
+class MetaUrlTest(TestCase):
+    def setUp(self):
+        site = Site.objects.get_current()
+        site.domain = "example.com"
+        site.save()
+        Site.objects.clear_cache()
+
+    def tearDown(self):
+        Site.objects.clear_cache()
+
+    def test_get_protocol(self):
+        self.assertEqual(get_protocol(is_secure=False), "http")
+        self.assertEqual(get_protocol(is_secure=True), "https")
+
+    def test_get_server_root(self):
+        self.assertEqual(get_server_root(is_secure=True), "https://example.com")
+        self.assertEqual(get_server_root(is_secure=False), "http://example.com")
+
+    def test_absolute_url(self):
+        self.assertEqual(absolute_url("/dashboard/", is_secure=True), "https://example.com/dashboard/")
+        self.assertEqual(absolute_url("/dashboard/", is_secure=False), "http://example.com/dashboard/")

apps/web/tests/test_meta.py

@@ -6,7 +6,7 @@ cli:
   template_directory: templates
   use_teams: false
 default_context:
-  _pegasus_version: 2026.6.2
+  _pegasus_version: 2026.6.2.5
   api_framework: drf
   author_name: Cory Zue
   bundler: vite