Merge origin/dev into feature/telegram-flood-hardening

backend/bot/app/web/admin_api.py

@@ -9,6 +9,7 @@ from bot.app.web.admin_api_impl import (
     backups as _backups,
     broadcast as _broadcast,
     common as _common,
+    health as _health,
     logs as _logs,
     panel as _panel,
     payments as _payments,
@@ -28,6 +29,7 @@ _MODULES = (
     _runtime,
     _auth,
     _common,
+    _health,
     _stats,
     _users,
     _payments,

backend/bot/app/web/admin_api_impl/broadcast.py

@@ -1,5 +1,165 @@
 # ruff: noqa: F401,F403,F405,I001
 from ._runtime import *  # noqa: F403,F405
+from .common import _panel_user_connection_activity
+
+import asyncio
+from collections import defaultdict
+
+from bot.utils.ttl_cache import AsyncTTLCache
+
+
+BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED = "active_never_connected"
+BROADCAST_TARGETS = {
+    "all",
+    "active",
+    "inactive",
+    "expired",
+    "never",
+    BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED,
+}
+PANEL_ACTIVITY_LOOKUP_CONCURRENCY = 10
+_ADMIN_BROADCAST_AUDIENCE_COUNT_CACHES: Dict[tuple[int, int], AsyncTTLCache] = {}
+
+
+def _resolve_panel_service(request: web.Request) -> Any:
+    subscription_service = request.app.get("subscription_service")
+    return getattr(subscription_service, "panel_service", None)
+
+
+async def _active_subscription_panel_uuids_by_user(
+    session: AsyncSession,
+) -> Dict[int, List[str]]:
+    now = datetime.now(timezone.utc)
+    stmt = (
+        select(Subscription.user_id, Subscription.panel_user_uuid)
+        .join(User, Subscription.user_id == User.user_id)
+        .where(
+            User.is_banned == False,
+            Subscription.is_active == True,
+            Subscription.end_date > now,
+            Subscription.panel_user_uuid.is_not(None),
+            Subscription.panel_user_uuid != "",
+        )
+        .order_by(Subscription.user_id.asc(), Subscription.end_date.desc())
+    )
+    result = await session.execute(stmt)
+
+    grouped: Dict[int, List[str]] = defaultdict(list)
+    seen: Dict[int, set[str]] = defaultdict(set)
+    for user_id, panel_uuid in result.all():
+        user_id_int = int(user_id)
+        panel_uuid_str = str(panel_uuid or "").strip()
+        if panel_uuid_str and panel_uuid_str not in seen[user_id_int]:
+            grouped[user_id_int].append(panel_uuid_str)
+            seen[user_id_int].add(panel_uuid_str)
+    return dict(grouped)
+
+
+async def _panel_connection_status(panel_service: Any, panel_uuid: str) -> str:
+    try:
+        panel_user = await panel_service.get_user_by_uuid(panel_uuid)
+    except Exception as exc:
+        logger.warning("Failed to fetch panel user activity uuid=%s: %s", panel_uuid, exc)
+        return "unknown"
+    activity = _panel_user_connection_activity(panel_user)
+    return str(activity.get("status") or "unknown")
+
+
+async def _user_ids_with_active_subscription_never_connected(
+    session: AsyncSession,
+    panel_service: Any,
+) -> List[int]:
+    panel_uuids_by_user = await _active_subscription_panel_uuids_by_user(session)
+    semaphore = asyncio.Semaphore(PANEL_ACTIVITY_LOOKUP_CONCURRENCY)
+
+    async def lookup(panel_uuid: str) -> str:
+        async with semaphore:
+            return await _panel_connection_status(panel_service, panel_uuid)
+
+    panel_uuids = list(
+        dict.fromkeys(
+            panel_uuid
+            for user_panel_uuids in panel_uuids_by_user.values()
+            for panel_uuid in user_panel_uuids
+        )
+    )
+    statuses_by_uuid = dict(
+        zip(
+            panel_uuids,
+            await asyncio.gather(*(lookup(uuid) for uuid in panel_uuids)),
+        )
+    )
+
+    user_ids: List[int] = []
+    for user_id, panel_uuids in panel_uuids_by_user.items():
+        statuses = [statuses_by_uuid.get(panel_uuid, "unknown") for panel_uuid in panel_uuids]
+        if statuses and all(status == "never" for status in statuses):
+            user_ids.append(user_id)
+    return user_ids
+
+
+def _admin_broadcast_audience_counts_cache(settings: Settings) -> Optional[AsyncTTLCache]:
+    ttl_seconds = int(
+        getattr(settings, "ADMIN_BROADCAST_AUDIENCE_COUNTS_CACHE_TTL_SECONDS", 30) or 0
+    )
+    if ttl_seconds <= 0:
+        return None
+    cache_key = (id(settings), ttl_seconds)
+    cache = _ADMIN_BROADCAST_AUDIENCE_COUNT_CACHES.get(cache_key)
+    if cache is None:
+        cache = AsyncTTLCache(
+            ttl_seconds=ttl_seconds,
+            settings=settings,
+            namespace="admin:broadcast_audience_counts",
+        )
+        _ADMIN_BROADCAST_AUDIENCE_COUNT_CACHES[cache_key] = cache
+    return cache
+
+
+async def _load_broadcast_audience_counts(
+    settings: Settings,
+    async_session_factory: sessionmaker,
+    panel_service: Any,
+) -> Dict[str, Optional[int]]:
+    cache = _admin_broadcast_audience_counts_cache(settings)
+    if cache is None:
+        return await _load_broadcast_audience_counts_uncached(
+            async_session_factory,
+            panel_service,
+        )
+    cache_key = "with-panel" if panel_service is not None else "without-panel"
+    return await cache.get_or_load(
+        cache_key,
+        lambda: _load_broadcast_audience_counts_uncached(
+            async_session_factory,
+            panel_service,
+        ),
+    )
+
+
+async def _load_broadcast_audience_counts_uncached(
+    async_session_factory: sessionmaker,
+    panel_service: Any,
+) -> Dict[str, Optional[int]]:
+    async with async_session_factory() as session:
+        counts: Dict[str, Optional[int]] = {
+            "all": await user_dal.count_all_active_users_for_broadcast(session),
+            "active": await user_dal.count_users_with_active_subscription_for_broadcast(session),
+            "inactive": await user_dal.count_users_without_active_subscription_for_broadcast(
+                session
+            ),
+            "expired": await user_dal.count_users_with_expired_subscription_for_broadcast(session),
+            "never": await user_dal.count_users_without_any_subscription_for_broadcast(session),
+            BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED: None,
+        }
+        if panel_service is not None:
+            counts[BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED] = len(
+                await _user_ids_with_active_subscription_never_connected(
+                    session,
+                    panel_service,
+                )
+            )
+    return counts
 
 
 async def admin_broadcast_route(request: web.Request) -> web.Response:
@@ -9,7 +169,7 @@ async def admin_broadcast_route(request: web.Request) -> web.Response:
     target = str(payload.get("target") or "all").strip().lower()
     if not text:
         return _error(400, "empty_text")
-    if target not in {"all", "active", "inactive", "expired", "never"}:
+    if target not in BROADCAST_TARGETS:
         target = "all"
 
     queue_manager = get_queue_manager()
@@ -18,7 +178,15 @@ async def admin_broadcast_route(request: web.Request) -> web.Response:
 
     async_session_factory: sessionmaker = request.app["async_session_factory"]
     async with async_session_factory() as session:
-        if target == "active":
+        if target == BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED:
+            panel_service = _resolve_panel_service(request)
+            if panel_service is None:
+                return _error(503, "panel_service_unavailable")
+            user_ids = await _user_ids_with_active_subscription_never_connected(
+                session,
+                panel_service,
+            )
+        elif target == "active":
             user_ids = await user_dal.get_user_ids_with_active_subscription(session)
         elif target == "inactive":
             user_ids = await user_dal.get_user_ids_without_active_subscription(session)
@@ -62,14 +230,13 @@ async def admin_broadcast_audience_counts_route(request: web.Request) -> web.Res
     """Return how many users each broadcast audience currently resolves to."""
     _require_admin_user_id(request)
 
+    settings: Settings = request.app["settings"]
     async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        counts = {
-            "all": len(await user_dal.get_all_active_user_ids_for_broadcast(session)),
-            "active": len(await user_dal.get_user_ids_with_active_subscription(session)),
-            "inactive": len(await user_dal.get_user_ids_without_active_subscription(session)),
-            "expired": len(await user_dal.get_user_ids_with_expired_subscription(session)),
-            "never": len(await user_dal.get_user_ids_without_any_subscription(session)),
-        }
+    panel_service = _resolve_panel_service(request)
+    counts = await _load_broadcast_audience_counts(
+        settings,
+        async_session_factory,
+        panel_service,
+    )
 
     return _ok({"counts": counts})

backend/bot/app/web/admin_api_impl/common.py

@@ -22,6 +22,175 @@ async def _read_json(request: web.Request) -> Dict[str, Any]:
         return {}
 
 
+_PANEL_LAST_CONNECTED_KEYS = (
+    "onlineAt",
+    "online_at",
+    "lastSeenAt",
+    "last_seen_at",
+    "lastConnectedAt",
+    "last_connected_at",
+    "lastConnectionAt",
+    "last_connection_at",
+)
+_PANEL_CONNECTION_MARKER_KEYS = (
+    *_PANEL_LAST_CONNECTED_KEYS,
+    "firstConnectedAt",
+    "first_connected_at",
+    "lastConnectedNodeUuid",
+    "last_connected_node_uuid",
+)
+_PANEL_CONNECTION_MARKER_OBJECT_KEYS = ("lastConnectedNode", "last_connected_node")
+_PANEL_TRAFFIC_OBJECT_KEYS = ("userTraffic", "user_traffic", "traffic", "trafficStats")
+_PANEL_TRAFFIC_USED_KEYS = (
+    "lifetimeUsedTrafficBytes",
+    "lifetime_used_traffic_bytes",
+    "usedTrafficBytes",
+    "used_traffic_bytes",
+    "trafficUsedBytes",
+    "traffic_used_bytes",
+    "downloadBytes",
+    "download_bytes",
+    "uploadBytes",
+    "upload_bytes",
+)
+
+
+def _panel_user_payload(panel_user_data: Any) -> Dict[str, Any]:
+    if not isinstance(panel_user_data, dict):
+        return {}
+    response = panel_user_data.get("response")
+    if isinstance(response, dict) and not any(
+        key in panel_user_data
+        for key in ("uuid", "shortUuid", "subscriptionUrl", "userTraffic", "status")
+    ):
+        return response
+    return panel_user_data
+
+
+def _coerce_panel_datetime(value: Any) -> Optional[str]:
+    if value is None or value is False:
+        return None
+    if isinstance(value, datetime):
+        return value.isoformat()
+    if isinstance(value, (int, float)):
+        if value <= 0:
+            return None
+        seconds = float(value) / 1000.0 if value > 10_000_000_000 else float(value)
+        try:
+            return datetime.fromtimestamp(seconds, tz=timezone.utc).isoformat()
+        except (OSError, OverflowError, ValueError):
+            return None
+    text = str(value).strip()
+    if not text or text.lower() in {"0", "null", "none", "never"}:
+        return None
+    if text.isdigit():
+        return _coerce_panel_datetime(int(text))
+    try:
+        parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return parsed.isoformat()
+
+
+def _coerce_panel_int(value: Any) -> Optional[int]:
+    try:
+        if value is None or value == "":
+            return None
+        return int(float(value))
+    except (TypeError, ValueError):
+        return None
+
+
+def _panel_nested_dicts(panel_user: Dict[str, Any], keys: Tuple[str, ...]) -> List[Dict[str, Any]]:
+    out: List[Dict[str, Any]] = []
+    for key in keys:
+        value = panel_user.get(key)
+        if isinstance(value, dict):
+            out.append(value)
+    return out
+
+
+def _panel_user_connection_containers(panel_user: Dict[str, Any]) -> List[Dict[str, Any]]:
+    traffic_containers = _panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)
+    marker_containers = _panel_nested_dicts(
+        panel_user,
+        _PANEL_CONNECTION_MARKER_OBJECT_KEYS,
+    )
+    for traffic_container in traffic_containers:
+        marker_containers.extend(
+            _panel_nested_dicts(traffic_container, _PANEL_CONNECTION_MARKER_OBJECT_KEYS)
+        )
+    return [panel_user, *traffic_containers, *marker_containers]
+
+
+def _panel_user_last_connected_at(panel_user_data: Any) -> Optional[str]:
+    panel_user = _panel_user_payload(panel_user_data)
+    if not panel_user:
+        return None
+    for container in _panel_user_connection_containers(panel_user):
+        for key in _PANEL_LAST_CONNECTED_KEYS:
+            connected_at = _coerce_panel_datetime(container.get(key))
+            if connected_at:
+                return connected_at
+    return None
+
+
+def _panel_user_positive_traffic_bytes(panel_user: Dict[str, Any]) -> bool:
+    containers = [panel_user, *_panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)]
+    for container in containers:
+        for key in _PANEL_TRAFFIC_USED_KEYS:
+            value = _coerce_panel_int(container.get(key))
+            if value is not None and value > 0:
+                return True
+    return False
+
+
+def _panel_user_has_connection_marker(panel_user: Dict[str, Any]) -> bool:
+    for container in _panel_user_connection_containers(panel_user):
+        for key in _PANEL_CONNECTION_MARKER_KEYS:
+            if key in container:
+                return True
+    for container in [panel_user, *_panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)]:
+        for key in _PANEL_CONNECTION_MARKER_OBJECT_KEYS:
+            if key in container:
+                return True
+    return False
+
+
+def _panel_user_has_connected_marker_value(panel_user: Dict[str, Any]) -> bool:
+    for container in _panel_user_connection_containers(panel_user):
+        for key in (*_PANEL_LAST_CONNECTED_KEYS, "firstConnectedAt", "first_connected_at"):
+            if _coerce_panel_datetime(container.get(key)):
+                return True
+        for key in ("lastConnectedNodeUuid", "last_connected_node_uuid"):
+            if str(container.get(key) or "").strip():
+                return True
+    for container in [panel_user, *_panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)]:
+        for key in _PANEL_CONNECTION_MARKER_OBJECT_KEYS:
+            marker = container.get(key)
+            if isinstance(marker, dict) and any(
+                str(value or "").strip() for value in marker.values()
+            ):
+                return True
+            if marker and not isinstance(marker, dict):
+                return True
+    return False
+
+
+def _panel_user_connection_activity(panel_user_data: Any) -> Dict[str, Any]:
+    panel_user = _panel_user_payload(panel_user_data)
+    last_connected_at = _panel_user_last_connected_at(panel_user)
+    if not panel_user:
+        return {"status": "unknown", "last_connected_at": None}
+    if last_connected_at or _panel_user_positive_traffic_bytes(panel_user):
+        return {"status": "connected", "last_connected_at": last_connected_at}
+    if _panel_user_has_connected_marker_value(panel_user):
+        return {"status": "connected", "last_connected_at": last_connected_at}
+    if _panel_user_has_connection_marker(panel_user):
+        return {"status": "never", "last_connected_at": None}
+    return {"status": "unknown", "last_connected_at": None}
+
+
 def _serialize_user(user: User) -> Dict[str, Any]:
     return {
         "user_id": int(user.user_id),

backend/bot/app/web/admin_api_impl/health.py

@@ -0,0 +1,19 @@
+# ruff: noqa: F401,F403,F405,I001
+from datetime import datetime, timezone
+
+from ._runtime import *  # noqa: F403,F405
+from .auth import _require_admin_user_id
+from .common import _ok
+from bot.services.config_health_service import collect_config_alerts
+
+
+async def admin_health_route(request: web.Request) -> web.Response:
+    _require_admin_user_id(request)
+    refresh = str(request.query.get("refresh", "")).strip().lower() in {"1", "true", "yes"}
+    alerts = await collect_config_alerts(request, refresh=refresh)
+    return _ok(
+        {
+            "alerts": alerts,
+            "checked_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )

backend/bot/app/web/admin_api_impl/routes.py

@@ -6,6 +6,7 @@ def setup_admin_routes(app: web.Application) -> None:
     router = app.router
     router.add_get("/api/admin/me", admin_me_route)
     router.add_get("/api/admin/stats", admin_stats_route)
+    router.add_get("/api/admin/health", admin_health_route)
 
     router.add_get("/api/admin/users", admin_users_list_route)
     router.add_get("/api/admin/users/{user_id:-?\\d+}", admin_user_detail_route)

backend/bot/app/web/admin_api_impl/themes.py

@@ -25,7 +25,6 @@ WEBAPP_UPLOADED_LOGO_DIR = Path(__file__).resolve().parents[5] / "data" / "webap
 WEBAPP_UPLOADED_LOGO_PATH = "/webapp-uploaded-logo"
 WEBAPP_FAVICON_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-logo" / "favicons"
 WEBAPP_FAVICON_PATH = "/webapp-favicon"
-WEBAPP_EMOJI_CACHE_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-emoji"
 WEBAPP_FAVICON_SIZES = (16, 32, 48, 180, 192, 512)
 WEBAPP_LOGO_UPLOAD_CONTENT_TYPES = {
     ".gif": "image/gif",
@@ -171,14 +170,6 @@ def prune_unused_appearance_assets(settings: Settings) -> None:
             except OSError:
                 logger.warning("Failed to remove unused webapp favicon set %s", path, exc_info=True)
 
-    # Emoji logos were removed; purge any leftover animated-emoji cache files.
-    for path in WEBAPP_EMOJI_CACHE_DIR.glob("*.512.*"):
-        if path.is_file():
-            try:
-                path.unlink()
-            except OSError:
-                logger.warning("Failed to remove unused webapp emoji asset %s", path, exc_info=True)
-
 
 async def _persist_appearance_upload(
     request: web.Request,

backend/bot/app/web/admin_api_impl/users.py

@@ -5,6 +5,7 @@ from .common import (
     _build_admin_webapp_referral_link,
     _error,
     _ok,
+    _panel_user_connection_activity,
     _premium_traffic_list_payload,
     _read_json,
     _serialize_payment,
@@ -836,7 +837,13 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
     # imports into their VPN client. May be missing if the user has never
     # been provisioned on the panel.
     subscription_url: Optional[str] = None
-    panel_uuid = getattr(user, "panel_user_uuid", None)
+    last_vpn_connected_at: Optional[str] = None
+    vpn_connection_status = "unknown"
+    panel_uuid = getattr(user, "panel_user_uuid", None) or getattr(
+        active_sub,
+        "panel_user_uuid",
+        None,
+    )
     if panel_uuid:
         subscription_service = request.app.get("subscription_service")
         panel_service = getattr(subscription_service, "panel_service", None)
@@ -845,9 +852,12 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
                 panel_data = await panel_service.get_user_by_uuid(panel_uuid)
                 if panel_data:
                     subscription_url = panel_data.get("subscriptionUrl") or None
+                    vpn_activity = _panel_user_connection_activity(panel_data)
+                    vpn_connection_status = str(vpn_activity.get("status") or "unknown")
+                    last_vpn_connected_at = vpn_activity.get("last_connected_at")
             except Exception as exc_panel:  # pragma: no cover
                 logger.warning(
-                    "Failed to fetch subscriptionUrl for user %s (uuid=%s): %s",
+                    "Failed to fetch panel details for user %s (uuid=%s): %s",
                     target_id,
                     panel_uuid,
                     exc_panel,
@@ -869,6 +879,8 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
             "recent_payments": [_serialize_payment(p) for p in recent_payments],
             "log_count": int(log_count or 0),
             "subscription_url": subscription_url,
+            "last_vpn_connected_at": last_vpn_connected_at,
+            "vpn_connection_status": vpn_connection_status,
             "referral": {
                 "code": referral_code,
                 "bot_link": referral_bot_link,

backend/bot/app/web/admin_settings_manifest.py

@@ -348,6 +348,16 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "Английская версия текста на этапе оплаты.",
         subsection="checkout",
     ),
+    SettingField(
+        "PAYMENT_REQUEST_TIMEOUT_SECONDS",
+        "float",
+        "payments",
+        "Таймаут запроса к провайдеру",
+        "Максимальное общее время одного API-запроса к платёжному провайдеру, в секундах.",
+        optional=False,
+        min=1,
+        subsection="checkout",
+    ),
     # ─── Payment providers (toggles) ───────────────────────────────
     # Common
     SettingField("STARS_ENABLED", "bool", "payments", "Telegram Stars", subsection="common"),
@@ -811,10 +821,11 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "bool",
         "system",
         "Анонимная статистика установки",
-        "Раз в сутки отправляет обезличенный сигнал: версия, ОС, локаль и число "
-        "пользователей в виде диапазона. Без персональных данных, токенов и "
-        "доменов. Помогает понять число активных установок и какие версии "
-        "используются. Можно отключить здесь без перезапуска.",
+        "Раз в сутки отправляет обезличенный сигнал: версия, маркер образа "
+        "official/custom, ОС, локаль и число пользователей в виде диапазона. Без персональных "
+        "данных, токенов и доменов. Помогает понять число активных установок, какие "
+        "версии используются и долю изменённых сборок. Можно отключить здесь без "
+        "перезапуска.",
     ),
 ]
 

backend/bot/app/web/templates/subscription_webapp.html

@@ -22,7 +22,7 @@
       sizes="180x180"
       href="/apple-touch-icon-precomposed.png"
     />
-    <title>/minishop</title>
+    <title>Subscription</title>
     <link rel="stylesheet" href="/subscription_webapp.css" />
     <style>
       .app-boot-fallback {

backend/bot/app/web/themes/ascii/style.css

@@ -168,6 +168,7 @@
 .theme-key-ascii .admin-toolbar-card,
 .theme-key-ascii .admin-table-card,
 .theme-key-ascii .admin-panel-dash-card,
+.theme-key-ascii .admin-config-alerts,
 .theme-key-ascii .admin-select-trigger,
 .theme-key-ascii .admin-select-content,
 .theme-key-ascii .admin-cn-card[data-slot="card"],
@@ -199,7 +200,8 @@
 .theme-key-ascii .admin-tabs-trigger,
 .theme-key-ascii .admin-revenue-period-btn,
 .theme-key-ascii .admin-mobile-toggle,
-.theme-key-ascii .admin-nav-item {
+.theme-key-ascii .admin-nav-item,
+.theme-key-ascii .admin-config-alert-link {
   border: 1px solid #ffffff;
   border-radius: 0;
   background: #000000;
@@ -216,7 +218,8 @@
 .theme-key-ascii .admin-nav-item:hover,
 .theme-key-ascii .admin-tabs-trigger:hover,
 .theme-key-ascii .admin-revenue-period-btn:hover,
-.theme-key-ascii .bottom-nav button:hover {
+.theme-key-ascii .bottom-nav button:hover,
+.theme-key-ascii .admin-config-alert-link:hover {
   background: #ffffff;
   color: #000000;
 }
@@ -393,6 +396,58 @@
   color: #000000;
 }
 
+/* ---------- Admin health config alerts ---------- */
+
+.theme-key-ascii .admin-config-alerts {
+  position: relative;
+  padding-left: 18px;
+  color: #ffffff;
+}
+
+.theme-key-ascii .admin-config-alerts::before {
+  content: "!";
+  position: absolute;
+  top: 11px;
+  left: 7px;
+  color: #ffffff;
+  font-family: var(--font-mono);
+  font-weight: 700;
+}
+
+.theme-key-ascii .admin-config-alerts-error {
+  border-color: #ff5555;
+  color: #ffaaaa;
+}
+
+.theme-key-ascii .admin-config-alerts-error::before {
+  color: #ff5555;
+}
+
+.theme-key-ascii .admin-config-alert-dot {
+  width: auto;
+  height: auto;
+  border-radius: 0;
+  background: transparent;
+  color: currentColor;
+  transform: none;
+}
+
+.theme-key-ascii .admin-config-alert-dot::before {
+  content: ">";
+  font-family: var(--font-mono);
+}
+
+.theme-key-ascii .admin-config-alert-error .admin-config-alert-dot {
+  background: transparent;
+  color: #ff5555;
+}
+
+.theme-key-ascii .admin-config-alert-link {
+  padding: 1px 7px;
+  font-family: var(--font-mono);
+  opacity: 1;
+}
+
 /* ---------- New webapp surfaces: support, purchase info, password login ---------- */
 
 .theme-key-ascii .trial-offer-card,

backend/bot/app/web/themes/ascii/theme.json

@@ -9,7 +9,7 @@
   "use_primary_accent": false,
   "use_in_admin": true,
   "css_file": "style.css",
-  "assets_version": 6,
+  "assets_version": 7,
   "tokens": {
     "color_scheme": "dark",
     "style_preset": "ascii"

backend/bot/app/web/themes/light/style.css

@@ -252,6 +252,27 @@ body:has(.theme-key-light) .install-platform-item[data-selected] {
   box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 14%, transparent);
 }
 
+/* Admin health config alerts */
+
+.theme-key-light .admin-config-alerts {
+  border-color: color-mix(in srgb, var(--warning) 38%, var(--admin-border));
+  background: color-mix(in srgb, var(--warning) 9%, #ffffff);
+  box-shadow: 0 8px 20px rgba(15, 23, 42, 0.06);
+}
+
+.theme-key-light .admin-config-alerts-error {
+  border-color: color-mix(in srgb, var(--danger) 38%, var(--admin-border));
+  background: color-mix(in srgb, var(--danger) 8%, #ffffff);
+}
+
+.theme-key-light .admin-config-alert-link {
+  background: rgba(255, 255, 255, 0.58);
+}
+
+.theme-key-light .admin-config-alert-link:hover {
+  background: #ffffff;
+}
+
 /* Telegram notifications banner: keep the warm warning tint but swap the
  * dark-theme inset bevel for the soft drop shadow the other light cards use. */
 .theme-key-light .telegram-notifications-card {

backend/bot/app/web/themes/light/theme.json

@@ -9,7 +9,7 @@
   "use_primary_accent": true,
   "use_in_admin": true,
   "css_file": "style.css",
-  "assets_version": 5,
+  "assets_version": 6,
   "tokens": {
     "color_scheme": "light"
   }

backend/bot/app/web/themes/windows95/style.css

@@ -1267,6 +1267,59 @@ body:has(.theme-key-windows95) .install-platform-item[data-selected] {
     inset -1px -1px 0 #dfdfdf;
 }
 
+/* Admin health config alerts */
+
+.theme-key-windows95 .admin-config-alerts {
+  border: 2px solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  background: #ffffcc;
+  color: #000000;
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+}
+
+.theme-key-windows95 .admin-config-alerts-error {
+  border-color: #ffffff #404040 #404040 #ffffff;
+  background: #f7d6d6;
+  color: #000000;
+}
+
+.theme-key-windows95 .admin-config-alert-dot {
+  border-radius: 0;
+  background: #808000;
+  box-shadow:
+    1px 1px 0 #ffffff,
+    -1px -1px 0 #404040;
+}
+
+.theme-key-windows95 .admin-config-alert-error .admin-config-alert-dot {
+  background: #800000;
+}
+
+.theme-key-windows95 .admin-config-alert-link {
+  border: 2px solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  border-radius: 0;
+  background: #c0c0c0;
+  color: #000000;
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+  opacity: 1;
+}
+
+.theme-key-windows95 .admin-config-alert-link:hover {
+  background: #dfdfdf;
+}
+
+.theme-key-windows95 .admin-config-alert-link:active {
+  border-color: #404040 #ffffff #ffffff #404040;
+  box-shadow:
+    inset 1px 1px 0 #808080,
+    inset -1px -1px 0 #dfdfdf;
+}
+
 .theme-key-windows95 input::placeholder,
 .theme-key-windows95 textarea::placeholder,
 .theme-key-windows95 .input::placeholder,

backend/bot/app/web/themes/windows95/theme.json

@@ -9,7 +9,7 @@
   "use_primary_accent": false,
   "use_in_admin": true,
   "css_file": "style.css",
-  "assets_version": 13,
+  "assets_version": 14,
   "tokens": {
     "color_scheme": "light",
     "style_preset": "win95"

backend/bot/app/web/web_server.py

@@ -1,13 +1,17 @@
 import asyncio
+import functools
 import hmac
 import logging
+from typing import Awaitable, Callable, Optional
 
 from aiogram import Bot, Dispatcher
 from aiogram.webhook.aiohttp_server import SimpleRequestHandler, setup_application
 from aiohttp import web
+from aiohttp.web_log import AccessLogger, KeyMethod
 from sqlalchemy.orm import sessionmaker
 
 from bot.payment_providers import iter_provider_specs, iter_service_keys
+from bot.utils.request_security import request_client_ip
 from config.settings import Settings
 
 
@@ -18,6 +22,39 @@ class SecureSimpleRequestHandler(SimpleRequestHandler):
         return hmac.compare_digest(telegram_secret_token, self.secret_token)
 
 
+class TrustedProxyAccessLogger(AccessLogger):
+    """Aiohttp access logger that respects trusted X-Forwarded-For headers."""
+
+    def compile_format(self, log_format):
+        methods = []
+        for atom in self.FORMAT_RE.findall(log_format):
+            if atom[1] == "":
+                format_key = self.LOG_FORMAT_MAP[atom[0]]
+                method = getattr(type(self), f"_format_{atom[0]}", None)
+                if method is None:
+                    method = getattr(AccessLogger, f"_format_{atom[0]}")
+                methods.append(KeyMethod(format_key, method))
+            else:
+                format_key = (self.LOG_FORMAT_MAP[atom[2]], atom[1])
+                method = getattr(type(self), f"_format_{atom[2]}", None)
+                if method is None:
+                    method = getattr(AccessLogger, f"_format_{atom[2]}")
+                methods.append(KeyMethod(format_key, functools.partial(method, atom[1])))
+
+        compiled = self.FORMAT_RE.sub(r"%s", log_format)
+        compiled = self.CLEANUP_RE.sub(r"%\1", compiled)
+        return compiled, methods
+
+    @staticmethod
+    def _format_a(request, response, time):
+        if request is None:
+            return "-"
+        settings = request.app.get("settings") if hasattr(request, "app") else None
+        trusted_proxies = getattr(settings, "trusted_proxies", None)
+        client_ip = request_client_ip(request, trusted_proxies=trusted_proxies)
+        return client_ip or "-"
+
+
 def _inject_shared_instances(
     app: web.Application,
     dp: Dispatcher,
@@ -48,6 +85,8 @@ async def build_and_start_web_app(
     bot: Bot,
     settings: Settings,
     async_session_factory: sessionmaker,
+    *,
+    after_webhooks_started: Optional[Callable[[], Awaitable[None]]] = None,
 ):
     app = web.Application()
     _inject_shared_instances(app, dp, bot, settings, async_session_factory)
@@ -110,7 +149,7 @@ async def build_and_start_web_app(
 
     runners = []
 
-    webhooks_runner = web.AppRunner(app)
+    webhooks_runner = web.AppRunner(app, access_log_class=TrustedProxyAccessLogger)
     await webhooks_runner.setup()
     runners.append(webhooks_runner)
     site = web.TCPSite(
@@ -123,6 +162,8 @@ async def build_and_start_web_app(
     logging.info(
         f"AIOHTTP server started on http://{settings.WEB_SERVER_HOST}:{settings.WEB_SERVER_PORT}"
     )
+    if after_webhooks_started is not None:
+        await after_webhooks_started()
 
     if settings.WEBAPP_ENABLED:
         from bot.app.web.subscription_webapp import create_subscription_webapp_application
@@ -133,7 +174,10 @@ async def build_and_start_web_app(
             settings,
             async_session_factory,
         )
-        subscription_runner = web.AppRunner(subscription_app)
+        subscription_runner = web.AppRunner(
+            subscription_app,
+            access_log_class=TrustedProxyAccessLogger,
+        )
         await subscription_runner.setup()
         runners.append(subscription_runner)
         subscription_site = web.TCPSite(

backend/bot/app/web/webapp/account.py

@@ -11,9 +11,20 @@ from .common import _invalidate_webapp_user_caches
 from .telegram_notifications import _probe_telegram_notifications_for_user_id
 
 
+def _email_auth_enabled(settings: Settings) -> bool:
+    return bool(getattr(settings, "email_auth_configured", True))
+
+
+def _email_auth_not_configured_response() -> web.Response:
+    return _json_error(503, "email_auth_not_configured", "Email auth is not configured")
+
+
 async def account_email_request_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
     settings: Settings = request.app["settings"]
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     payload = await _read_json(request)
     email_payload, validation_error = _validate_model_payload(WebAppEmailPayload, payload)
     if validation_error:
@@ -40,6 +51,10 @@ async def account_email_request_route(request: web.Request) -> web.Response:
 
 async def account_email_verify_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
+    settings: Settings = request.app["settings"]
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     rate_limit_response = await _enforce_webapp_rate_limit(
         request,
         user_id=user_id,
@@ -55,7 +70,6 @@ async def account_email_verify_route(request: web.Request) -> web.Response:
     email = email_payload.email
     code = str(email_payload.code or "")
     email_service: EmailAuthService = request.app["email_auth_service"]
-    settings: Settings = request.app["settings"]
     async_session_factory: sessionmaker = request.app["async_session_factory"]
     merge_notice: Optional[Dict[str, Any]] = None
     source_panel_uuid: Optional[str] = None
@@ -210,6 +224,9 @@ async def account_email_verify_route(request: web.Request) -> web.Response:
 async def account_password_request_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
     settings: Settings = request.app["settings"]
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     async_session_factory: sessionmaker = request.app["async_session_factory"]
 
     async with async_session_factory() as session:
@@ -232,6 +249,10 @@ async def account_password_request_route(request: web.Request) -> web.Response:
 
 async def account_password_confirm_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
+    settings = request.app.get("settings")
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     payload = await _read_json(request)
     password_payload, validation_error = _validate_model_payload(WebAppSetPasswordPayload, payload)
     if validation_error:

backend/bot/app/web/webapp/assets.py

@@ -18,6 +18,8 @@ _GZIP_BODY_CACHE: Dict[str, bytes] = {}
 _ASSET_NAME_CACHE: Dict[tuple[str, str], tuple[float, str]] = {}
 _I18N_PAYLOAD_CACHE: Dict[tuple[int, str, tuple[tuple[str, int, int], ...]], Dict[str, Any]] = {}
 _ASSET_NAME_CACHE_TTL_SECONDS = 30.0
+WEBAPP_HTML_CACHE_CONTROL = "no-store, no-cache, must-revalidate, max-age=0"
+WEBAPP_LEGACY_ASSET_CACHE_CONTROL = "no-store, no-cache, must-revalidate, max-age=0"
 
 
 async def health_route(request: web.Request) -> web.Response:
@@ -48,7 +50,7 @@ async def _css_asset_route(request: web.Request, *, base_name: str) -> web.Respo
         allow_precompressed=bool(asset_hash),
     )
     response.headers["Cache-Control"] = (
-        "public, max-age=31536000, immutable" if asset_hash else "no-cache"
+        "public, max-age=31536000, immutable" if asset_hash else WEBAPP_LEGACY_ASSET_CACHE_CONTROL
     )
     return response
 
@@ -382,11 +384,15 @@ async def webapp_current_favicon_route(request: web.Request) -> web.Response:
     favicon_url = _resolve_webapp_favicon_url(settings, _resolve_webapp_logo_url(settings))
     digest = _webapp_generated_favicon_digest(favicon_url)
     if digest:
-        return _webapp_favicon_file_response(digest, target_filename)
+        response = _webapp_favicon_file_response(digest, target_filename)
+        response.headers["Cache-Control"] = "no-cache"
+        return response
 
     redirect_url = _webapp_redirectable_favicon_url(favicon_url, target_filename)
     if redirect_url:
-        raise web.HTTPFound(location=redirect_url)
+        redirect = web.HTTPFound(location=redirect_url)
+        redirect.headers["Cache-Control"] = "no-cache"
+        raise redirect
 
     raise web.HTTPNotFound(text="webapp_favicon_not_found")
 
@@ -897,7 +903,7 @@ async def _js_asset_route(request: web.Request, *, base_name: str) -> web.Respon
         strip_dev_mock=not asset_hash,
     )
     response.headers["Cache-Control"] = (
-        "public, max-age=31536000, immutable" if asset_hash else "no-cache"
+        "public, max-age=31536000, immutable" if asset_hash else WEBAPP_LEGACY_ASSET_CACHE_CONTROL
     )
     return response
 
@@ -1136,9 +1142,11 @@ async def index_route(request: web.Request) -> web.Response:
     bootstrap = _build_webapp_bootstrap_payload(request)
     config = bootstrap["config"]
     html = _strip_marked_block(html, DEV_MOCK_START_MARKER, DEV_MOCK_END_MARKER)
+    css_asset_name = _resolve_webapp_css_asset_name()
+    js_asset_name = _resolve_webapp_js_asset_name()
     html = html.replace(
         'href="/subscription_webapp.css"',
-        f'href="/{_resolve_webapp_css_asset_name()}"',
+        f'href="/{css_asset_name}"',
         1,
     )
     initial_theme_markup = _initial_theme_head_markup(request, initial_theme, primary_color)
@@ -1165,7 +1173,7 @@ async def index_route(request: web.Request) -> web.Response:
     )
     html = html.replace(
         WEBAPP_JS_PLACEHOLDER,
-        f'<script src="/{_resolve_webapp_js_asset_name()}" defer></script>',
+        f'<script src="/{js_asset_name}" defer></script>',
     )
     brand_asset_url = cached["logo_url"]
     if brand_asset_url:
@@ -1178,7 +1186,9 @@ async def index_route(request: web.Request) -> web.Response:
             1,
         )
     response = web.Response(text=html, content_type="text/html", charset="utf-8")
-    response.headers["Cache-Control"] = "no-cache"
+    response.headers["Cache-Control"] = WEBAPP_HTML_CACHE_CONTROL
+    response.headers["Pragma"] = "no-cache"
+    response.headers["Expires"] = "0"
     return response
 
 
@@ -1444,10 +1454,15 @@ def _resolve_webapp_js_asset_name() -> str:
 
 
 def _resolve_webapp_admin_js_asset_name() -> str:
-    # The admin bundle is lazy-loaded from the already running Mini App. In
-    # deployments where nginx serves static files in front of aiohttp, stale
-    # hashed admin filenames can 404 even though the runtime build asset exists.
-    return _set_cached_asset_name("admin-js", "subscription_webapp_admin.js")
+    # The admin bundle is lazy-loaded from the already running Mini App. It now
+    # ships content-hashed alongside the main bundle (same build, deterministic
+    # hashes, served immutable), so iOS WebViews fetch fresh admin assets on every
+    # deploy. The App.svelte loader falls back to the bare runtime build name if a
+    # hashed asset ever 404s.
+    return _resolve_hashed_js_asset_name(
+        kind="admin-js",
+        base_name="subscription_webapp_admin",
+    )
 
 
 def _resolve_hashed_js_asset_name(*, kind: str, base_name: str) -> str:
@@ -1466,7 +1481,7 @@ def _resolve_hashed_js_asset_name(*, kind: str, base_name: str) -> str:
     if minified_assets:
         minified_assets.sort(reverse=True)
         return _set_cached_asset_name(kind, minified_assets[0][1])
-    return _set_cached_asset_name(kind, f"{base_name}.js")
+    return _set_cached_asset_name(kind, _stable_asset_name_with_version(f"{base_name}.js"))
 
 
 def _resolve_webapp_css_asset_name() -> str:
@@ -1477,9 +1492,11 @@ def _resolve_webapp_css_asset_name() -> str:
 
 
 def _resolve_webapp_admin_css_asset_name() -> str:
-    # Keep the lazy-loaded admin stylesheet on the stable build filename for
-    # the same reason as the JS bundle above.
-    return _set_cached_asset_name("admin-css", "subscription_webapp_admin.css")
+    # Content-hashed and immutable, same rationale as the admin JS bundle above.
+    return _resolve_hashed_css_asset_name(
+        kind="admin-css",
+        base_name="subscription_webapp_admin",
+    )
 
 
 def _resolve_hashed_css_asset_name(*, kind: str, base_name: str) -> str:
@@ -1498,7 +1515,19 @@ def _resolve_hashed_css_asset_name(*, kind: str, base_name: str) -> str:
     if hashed_assets:
         hashed_assets.sort(reverse=True)
         return _set_cached_asset_name(kind, hashed_assets[0][1])
-    return _set_cached_asset_name(kind, f"{base_name}.css")
+    return _set_cached_asset_name(kind, _stable_asset_name_with_version(f"{base_name}.css"))
+
+
+def _stable_asset_name_with_version(filename: str) -> str:
+    path = ASSET_DIR / filename
+    try:
+        stat = path.stat()
+    except OSError:
+        return filename
+
+    raw_version = f"{filename}:{int(stat.st_mtime_ns)}:{int(stat.st_size)}"
+    version = hashlib.sha256(raw_version.encode("utf-8")).hexdigest()[:8]
+    return f"{filename}?v={version}"
 
 
 def _get_cached_asset_name(kind: str) -> Optional[str]:

backend/bot/app/web/webapp/auth.py

@@ -1497,6 +1497,10 @@ async def _grant_referral_welcome_bonus_if_eligible(
         return None
 
     subscription_service: SubscriptionService = request.app["subscription_service"]
+    default_tariff_key = None
+    tariffs_config = getattr(settings, "tariffs_config", None)
+    if tariffs_config:
+        default_tariff_key = getattr(tariffs_config, "default_tariff", None)
     try:
         if await subscription_service.has_active_subscription(session, int(user.user_id)):
             return None
@@ -1508,6 +1512,7 @@ async def _grant_referral_welcome_bonus_if_eligible(
         int(user.user_id),
         referral_welcome_days,
         reason="referral_welcome_bonus",
+        tariff_key=default_tariff_key,
     )
 
 

backend/bot/app/web/webapp/billing.py

@@ -1068,28 +1068,44 @@ async def _create_subscription_payment(
                 "payment_amount_below_minimum",
                 "Payment amount is below the provider minimum",
             )
-        return await provider_spec.create_webapp_payment(
-            WebAppPaymentContext(
-                request=request,
-                session=session,
-                user_id=user_id,
-                method=method,
-                months=months,
-                price=price,
-                stars_price=stars_price,
-                currency=payment_currency,
-                description=description,
-                sale_mode=sale_mode,
-                traffic_gb=traffic_gb,
-                hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
-                hwid_valid_from=hwid_quote.get("valid_from") if hwid_quote else None,
-                hwid_valid_until=hwid_quote.get("valid_until") if hwid_quote else None,
-                hwid_pricing_period_months=hwid_quote.get("pricing_period_months")
-                if hwid_quote
-                else None,
-                hwid_proration_ratio=hwid_quote.get("proration_ratio") if hwid_quote else None,
-                hwid_full_price=hwid_quote.get("full_price") if hwid_quote else None,
-            )
+        payment_context = WebAppPaymentContext(
+            request=request,
+            session=session,
+            user_id=user_id,
+            method=method,
+            months=months,
+            price=price,
+            stars_price=stars_price,
+            currency=payment_currency,
+            description=description,
+            sale_mode=sale_mode,
+            traffic_gb=traffic_gb,
+            hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+            hwid_valid_from=hwid_quote.get("valid_from") if hwid_quote else None,
+            hwid_valid_until=hwid_quote.get("valid_until") if hwid_quote else None,
+            hwid_pricing_period_months=hwid_quote.get("pricing_period_months")
+            if hwid_quote
+            else None,
+            hwid_proration_ratio=hwid_quote.get("proration_ratio") if hwid_quote else None,
+            hwid_full_price=hwid_quote.get("full_price") if hwid_quote else None,
         )
+        if provider_spec.reuse_webapp_payment:
+            from bot.payment_providers.shared import reusable_webapp_payment_response
+
+            try:
+                reusable_response = await reusable_webapp_payment_response(
+                    payment_context,
+                    provider_spec,
+                )
+            except Exception:
+                logger.exception(
+                    "Failed to verify reusable payment: user_id=%s provider=%s",
+                    user_id,
+                    provider_spec.provider_key,
+                )
+                reusable_response = None
+            if reusable_response is not None:
+                return reusable_response
+        return await provider_spec.create_webapp_payment(payment_context)
 
     return _json_error(400, "payment_unavailable", "Payment method unavailable")

backend/bot/handlers/user/start.py

@@ -658,12 +658,17 @@ async def start_command_handler(
                 )
                 if referred_by_user_id and referral_welcome_days > 0:
                     try:
+                        default_tariff_key = None
+                        tariffs_config = getattr(settings, "tariffs_config", None)
+                        if tariffs_config:
+                            default_tariff_key = getattr(tariffs_config, "default_tariff", None)
                         referral_bonus_end_date = (
                             await subscription_service.extend_active_subscription_days(
                                 session,
                                 user_id,
                                 referral_welcome_days,
                                 reason="referral_welcome_bonus",
+                                tariff_key=default_tariff_key,
                             )
                         )
                         if referral_bonus_end_date:

backend/bot/handlers/user/subscription/core.py

@@ -22,7 +22,7 @@ from bot.keyboards.inline.user_keyboards import (
     get_tariff_packages_keyboard,
     get_tariff_periods_keyboard,
     sale_mode_with_callback_context,
-    subscription_options_callback,
+    tariff_purchase_back_callback,
 )
 from bot.middlewares.i18n import JsonI18n
 from bot.services.panel_api_service import PanelApiService
@@ -303,7 +303,7 @@ async def select_tariff_callback(
         current_lang,
         i18n,
         settings,
-        back_callback=subscription_options_callback(callback_context),
+        back_callback=tariff_purchase_back_callback(callback_context),
         callback_context=callback_context,
     )
     text = _tariff_purchase_text(tariff, current_lang, i18n, settings)

backend/bot/keyboards/inline/user_keyboards.py

@@ -71,6 +71,12 @@ def subscription_options_callback(context: Optional[str]) -> str:
     return "main_action:bot_subscribe" if context == BOT_MENU_CONTEXT else "main_action:subscribe"
 
 
+def tariff_purchase_back_callback(context: Optional[str]) -> str:
+    if context == BOT_MENU_CONTEXT:
+        return "main_action:bot_interface"
+    return subscription_options_callback(context)
+
+
 def payment_methods_back_callback(
     value: str, sale_mode: str = "subscription", price: Optional[float] = None
 ) -> str:

backend/bot/main_bot.py

@@ -91,12 +91,9 @@ async def register_all_routers(dp: Dispatcher, settings: Settings):
     logging.info("All application routers registered.")
 
 
-async def on_startup_configured(dispatcher: Dispatcher):
+async def configure_telegram_webhook(dispatcher: Dispatcher) -> None:
     bot: Bot = dispatcher["bot_instance"]
     settings: Settings = dispatcher["settings"]
-    i18n_instance: JsonI18n = dispatcher["i18n_instance"]
-
-    logging.info("STARTUP: on_startup_configured executing...")
 
     telegram_webhook_url_to_set = settings.WEBHOOK_BASE_URL
     if telegram_webhook_url_to_set:
@@ -152,6 +149,14 @@ async def on_startup_configured(dispatcher: Dispatcher):
         )
         raise SystemExit("WEBHOOK_BASE_URL is required. Polling mode is disabled.")
 
+
+async def on_startup_configured(dispatcher: Dispatcher):
+    bot: Bot = dispatcher["bot_instance"]
+    settings: Settings = dispatcher["settings"]
+    i18n_instance: JsonI18n = dispatcher["i18n_instance"]
+
+    logging.info("STARTUP: on_startup_configured executing...")
+
     if settings.SUBSCRIPTION_MINI_APP_URL:
 
         async def _configure_mini_app_menu() -> None:
@@ -331,8 +336,17 @@ async def run_bot(settings_param: Settings):
         _yk_path,
     )
 
+    async def _after_webhooks_started() -> None:
+        await configure_telegram_webhook(dp)
+
     async def web_server_task():
-        await build_and_start_web_app(dp, bot, settings_param, local_async_session_factory)
+        await build_and_start_web_app(
+            dp,
+            bot,
+            settings_param,
+            local_async_session_factory,
+            after_webhooks_started=_after_webhooks_started,
+        )
 
     main_tasks = [asyncio.create_task(web_server_task(), name="AIOHTTPServerTask")]
 

backend/bot/payment_providers/base.py

@@ -127,6 +127,7 @@ ServiceFactory = Callable[[ServiceFactoryContext], Any]
 WebhookPathGetter = Callable[[Any], str]
 WebhookRoute = Callable[[Any], Awaitable[Any]]
 WebAppPaymentFactory = Callable[[WebAppPaymentContext], Awaitable[Any]]
+ReusableWebAppPaymentResolver = Callable[[WebAppPaymentContext, Any], Awaitable[Optional[str]]]
 CurrencySupportResolver = Callable[[Any], Optional[Sequence[str]]]
 PaymentAmountResolver = Callable[[Any, Any, Any], bool]
 PaymentMinimumResolver = Callable[[Any, Any], Optional[Mapping[str, Any]]]
@@ -180,6 +181,7 @@ class PaymentProviderSpec:
     webhook_route: Optional[WebhookRoute] = None
     webhook_requires_base_url: bool = False
     create_webapp_payment: Optional[WebAppPaymentFactory] = None
+    reuse_webapp_payment: Optional[ReusableWebAppPaymentResolver] = None
     requires_configured_service: bool = True
     price_source: str = "rub"
     emoji: str = "💳"

backend/bot/payment_providers/freekassa.py

@@ -53,11 +53,14 @@ from .shared import (
     notify_service_unavailable,
     parse_payment_callback,
     payment_failed,
+    payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
     post_json_request,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
+    safe_callback_answer,
 )
 
 _LOG = "freekassa"
@@ -153,7 +156,7 @@ class FreeKassaService(HttpClientMixin):
         self.default_currency: str = default_payment_currency_code_for_settings(settings).upper()
 
         self.api_base_url: str = "https://api.fk.life/v1"
-        self._init_http_client(total_timeout=15)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         self._nonce_lock = asyncio.Lock()
         self._last_nonce = int(time.time() * 1000)
 
@@ -253,6 +256,62 @@ class FreeKassaService(HttpClientMixin):
             is_success=lambda status, data: status == 200 and (data or {}).get("type") == "success",
         )
 
+    async def get_orders(
+        self,
+        *,
+        payment_id: int,
+        order_status: Optional[int] = None,
+    ) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        payload: Dict[str, Any] = {
+            "shopId": int(self.shop_id),
+            "nonce": await self._generate_nonce(),
+            "paymentId": str(payment_id),
+        }
+        if order_status is not None:
+            payload["orderStatus"] = int(order_status)
+        payload["signature"] = self._sign_payload(payload)
+
+        session = await self._get_session()
+        return await post_json_request(
+            session,
+            f"{self.api_base_url}/orders",
+            body=payload,
+            log_prefix="FreeKassa get_orders",
+            is_success=lambda status, data: status == 200 and (data or {}).get("type") == "success",
+        )
+
+    async def try_reuse_pending_order(self, payment: Any) -> Optional[str]:
+        order_hash = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        if not order_hash:
+            return None
+
+        success, response_data = await self.get_orders(
+            payment_id=payment.payment_id,
+            order_status=0,
+        )
+        if not success:
+            return None
+
+        for order in response_data.get("orders") or []:
+            if not isinstance(order, dict):
+                continue
+            try:
+                is_new = int(order.get("status", -1)) == 0
+            except (TypeError, ValueError):
+                continue
+            if not is_new:
+                continue
+            if str(order.get("merchant_order_id") or "") != str(payment.payment_id):
+                continue
+            fk_order_id = str(order.get("fk_order_id") or "").strip()
+            if fk_order_id:
+                payment_url = (self.config.PAYMENT_URL or "https://pay.freekassa.net/").rstrip("/")
+                return f"{payment_url}/form/{fk_order_id}/{order_hash}"
+        return None
+
     async def _generate_nonce(self) -> int:
         async with self._nonce_lock:
             candidate = int(time.time() * 1000)
@@ -513,6 +572,39 @@ async def pay_fk_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="freekassa",
+        pending_status="pending_freekassa",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await freekassa_service.try_reuse_pending_order(reusable_payment)
+        if reusable_url:
+            await safe_callback_answer(callback)
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -625,6 +717,14 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: FreeKassaService = ctx.request.app.get("freekassa_service")
+    if not service or not service.configured:
+        return None
+
+    return await service.try_reuse_pending_order(payment)
+
+
 _PRESENTATION_MANIFEST = tuple(
     ProviderManifestField(
         key=key,
@@ -772,6 +872,7 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/freekassa",
     webhook_route=freekassa_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=FreeKassaConfig,
     presentation_class=FreeKassaPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,

backend/bot/payment_providers/heleket.py

@@ -3,6 +3,7 @@ import hashlib
 import hmac
 import json
 import logging
+import time
 from collections import OrderedDict
 from typing import Any, Dict, List, Optional, Tuple
 
@@ -54,10 +55,12 @@ from .shared import (
     notify_user_payment_failed,
     parse_payment_callback,
     payment_failed,
+    payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
 )
 
 router = Router(name="user_subscription_payments_heleket_router")
@@ -243,7 +246,7 @@ class HeleketService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=20)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning(
                 "HeleketService initialized but not fully configured. Payments disabled."
@@ -372,6 +375,70 @@ class HeleketService(HttpClientMixin):
             logging.exception("Heleket create_payment_link: request failed.")
             return False, {"message": str(exc)}
 
+    async def get_payment_info(self, payment_uuid: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        payment_uuid = str(payment_uuid or "").strip()
+        if not payment_uuid:
+            return False, {"message": "missing_payment_uuid"}
+
+        body = {"uuid": payment_uuid}
+        headers = {
+            "merchant": self.merchant_id,
+            "sign": _compute_signature(body, self.api_key),
+            "Content-Type": "application/json",
+        }
+        session = await self._get_session()
+        try:
+            async with session.post(
+                f"{self.base_url}/v1/payment/info",
+                data=_serialize_for_signature(body).encode("utf-8"),
+                headers=headers,
+            ) as response:
+                response_data = await response.json(content_type=None)
+                state = response_data.get("state") if isinstance(response_data, dict) else None
+                if response.status != 200 or state != 0:
+                    logging.warning(
+                        "Heleket get_payment_info failed: uuid=%s status=%s body=%s",
+                        payment_uuid,
+                        response.status,
+                        response_data,
+                    )
+                    return False, {"status": response.status, "message": response_data}
+                result = response_data.get("result") or {}
+                return isinstance(result, dict), result
+        except Exception as exc:
+            logging.exception("Heleket get_payment_info request failed: uuid=%s", payment_uuid)
+            return False, {"message": str(exc)}
+
+    async def try_reuse_pending_payment(self, payment: Any) -> Optional[str]:
+        payment_uuid = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        if not payment_uuid:
+            return None
+
+        success, data = await self.get_payment_info(payment_uuid)
+        if not success or not isinstance(data, dict):
+            return None
+        status = str(data.get("payment_status") or data.get("status") or "").lower()
+        if status != "check" or bool(data.get("is_final")):
+            return None
+        if str(data.get("uuid") or "") != payment_uuid:
+            return None
+        if str(data.get("order_id") or "") != str(payment.payment_id):
+            return None
+        try:
+            expired_at = int(data.get("expired_at") or 0)
+        except (TypeError, ValueError):
+            return None
+        if expired_at and expired_at <= int(time.time()):
+            return None
+        return (
+            str(data.get("url") or "").strip()
+            or str(getattr(payment, "provider_payment_url", None) or "").strip()
+            or None
+        )
+
     def _verify_signature(self, payload: Dict[str, Any]) -> bool:
         received = payload.get("sign")
         if not isinstance(received, str) or not received:
@@ -612,6 +679,38 @@ async def pay_heleket_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="heleket",
+        pending_status="pending_heleket",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await heleket_service.try_reuse_pending_payment(reusable_payment)
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -684,6 +783,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: HeleketService = ctx.request.app.get("heleket_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_payment(payment)
+
+
 async def heleket_webhook_route(request: web.Request) -> web.Response:
     service: HeleketService = request.app["heleket_service"]
     return await service.webhook_route(request)
@@ -887,6 +993,7 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/heleket",
     webhook_route=heleket_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     emoji="🪙",
     config_class=HeleketConfig,
     presentation_class=HeleketPresentation,

backend/bot/payment_providers/paykilla.py

@@ -546,7 +546,7 @@ class PaykillaService(HttpClientMixin):
         self._exchange_rate_cache: Dict[tuple[str, str], tuple[float, Decimal]] = {}
         self._currency_cache: tuple[float, List[Dict[str, Any]]] = (0, [])
 
-        self._init_http_client(total_timeout=20)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning(
                 "PaykillaService initialized but not fully configured. Payments disabled."
@@ -586,6 +586,12 @@ class PaykillaService(HttpClientMixin):
         query, signature = _sign_query(timestamp_ms, recv_window_ms, self.secret_key)
         return f"{self.base_url}/api/v2/invoice?{query}&signature={signature}"
 
+    def _signed_invoice_details_url(self, invoice_id: str) -> str:
+        timestamp_ms = int(time.time() * 1000)
+        recv_window_ms = int(self.config.RECV_WINDOW_MS)
+        query, signature = _sign_query(timestamp_ms, recv_window_ms, self.secret_key)
+        return f"{self.base_url}/api/v2/invoice/{invoice_id}?{query}&signature={signature}"
+
     def _signed_currency_url(self) -> str:
         timestamp_ms = int(time.time() * 1000)
         recv_window_ms = int(self.config.RECV_WINDOW_MS)
@@ -661,8 +667,7 @@ class PaykillaService(HttpClientMixin):
                     return cached_data
                 if response.status != 200 or not isinstance(response_data, list):
                     logging.warning(
-                        "Paykilla currency metadata request failed "
-                        "(status=%s, body=%s)",
+                        "Paykilla currency metadata request failed (status=%s, body=%s)",
                         response.status,
                         response_data,
                     )
@@ -887,6 +892,64 @@ class PaykillaService(HttpClientMixin):
             logging.exception("Paykilla create_payment_link: request failed.")
             return False, {"message": str(exc)}
 
+    async def get_invoice_details(self, invoice_id: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        invoice_id = str(invoice_id or "").strip()
+        if not invoice_id:
+            return False, {"message": "missing_invoice_id"}
+
+        headers = {
+            "X-API-KEY": self.api_key,
+            "Content-Type": "application/json",
+        }
+        session = await self._get_session()
+        try:
+            async with session.get(
+                self._signed_invoice_details_url(invoice_id),
+                headers=headers,
+            ) as response:
+                response_text = await response.text()
+                try:
+                    response_data = json.loads(response_text) if response_text else {}
+                except json.JSONDecodeError:
+                    logging.error("Paykilla get_invoice_details: invalid JSON: %s", response_text)
+                    return False, {
+                        "status": response.status,
+                        "message": "invalid_json",
+                        "raw": response_text,
+                    }
+                invoice = _response_invoice_data(response_data)
+                if response.status != 200 or not first_value(invoice, "id"):
+                    logging.warning(
+                        "Paykilla get_invoice_details failed: id=%s status=%s body=%s",
+                        invoice_id,
+                        response.status,
+                        response_data,
+                    )
+                    return False, {"status": response.status, "message": response_data}
+                return True, invoice
+        except Exception as exc:
+            logging.exception("Paykilla get_invoice_details request failed: id=%s", invoice_id)
+            return False, {"message": str(exc)}
+
+    async def try_reuse_pending_invoice(self, payment: Any) -> Optional[str]:
+        invoice_id = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        if not invoice_id:
+            return None
+
+        success, data = await self.get_invoice_details(invoice_id)
+        if not success:
+            return None
+        if str(first_value(data, "id") or "") != invoice_id:
+            return None
+        if str(data.get("clientOrderId") or "") != str(payment.payment_id):
+            return None
+        if str(data.get("status") or "").strip().upper() != "PROCESSING":
+            return None
+        return f"{self.widget_url}/{invoice_id}"
+
     def _webhook_url_for_request(self, request: web.Request) -> Optional[str]:
         configured = self.config.full_webhook_url(getattr(self.settings, "WEBHOOK_BASE_URL", None))
         if configured:
@@ -1260,6 +1323,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: PaykillaService = ctx.request.app.get("paykilla_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_invoice(payment)
+
+
 async def paykilla_webhook_route(request: web.Request) -> web.Response:
     service: PaykillaService = request.app["paykilla_service"]
     return await service.webhook_route(request)
@@ -1571,6 +1641,7 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/paykilla",
     webhook_route=paykilla_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     emoji="",
     config_class=PaykillaConfig,
     presentation_class=PaykillaPresentation,

backend/bot/payment_providers/platega.py

@@ -55,6 +55,7 @@ from .shared import (
     post_json_request,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
     safe_callback_answer,
 )
 
@@ -157,7 +158,7 @@ class PlategaService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=20)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning(
                 "PlategaService initialized but not fully configured. Payments disabled."
@@ -282,6 +283,69 @@ class PlategaService(HttpClientMixin):
             log_prefix="Platega create_transaction",
         )
 
+    async def get_transaction(self, transaction_id: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        transaction_id = str(transaction_id or "").strip()
+        if not transaction_id:
+            return False, {"message": "missing_transaction_id"}
+
+        session = await self._get_session()
+        try:
+            async with session.get(
+                f"{self.base_url}/transaction/{transaction_id}",
+                headers=self._auth_headers,
+            ) as response:
+                data = await response.json(content_type=None)
+                if response.status != 200 or not isinstance(data, dict):
+                    logging.warning(
+                        "Platega get_transaction failed: id=%s status=%s body=%s",
+                        transaction_id,
+                        response.status,
+                        data,
+                    )
+                    return False, {"status": response.status, "message": data}
+                return True, data
+        except Exception as exc:
+            logging.exception("Platega get_transaction request failed: id=%s", transaction_id)
+            return False, {"message": str(exc)}
+
+    async def try_reuse_pending_transaction(
+        self,
+        payment: Any,
+        *,
+        user_id: int,
+        sale_mode: str,
+        variant: str,
+    ) -> Optional[str]:
+        transaction_id = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        payment_url = str(getattr(payment, "provider_payment_url", None) or "").strip()
+        if not transaction_id or not payment_url:
+            return None
+
+        success, data = await self.get_transaction(transaction_id)
+        if not success or str(data.get("status") or "").upper() != "PENDING":
+            return None
+        if str(data.get("id") or "") != transaction_id:
+            return None
+
+        try:
+            payload = json.loads(str(data.get("payload") or ""))
+        except (TypeError, ValueError, json.JSONDecodeError):
+            return None
+        expected = {
+            "payment_db_id": str(payment.payment_id),
+            "user_id": str(user_id),
+            "sale_mode": str(sale_mode),
+            "platega_variant": str(variant),
+        }
+        if not isinstance(payload, dict) or any(
+            str(payload.get(key) or "") != value for key, value in expected.items()
+        ):
+            return None
+        return payment_url
+
     async def webhook_route(self, request: web.Request) -> web.Response:
         if not self.configured:
             return web.Response(status=503, text="platega_disabled")
@@ -519,6 +583,43 @@ async def pay_platega_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="platega",
+        pending_status="pending_platega",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await platega_service.try_reuse_pending_transaction(
+            reusable_payment,
+            user_id=callback.from_user.id,
+            sale_mode=parts.sale_mode,
+            variant=platega_variant,
+        )
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -549,7 +650,6 @@ async def pay_platega_callback_handler(
     )
     transaction_id = first_value(response_data, "transactionId", "id")
     redirect_url = first_value(response_data, "redirect", "url", "paymentUrl")
-    provider_status = str((response_data or {}).get("status") or payment_record.status)
     # Platega requires *both* a transaction id and a redirect url to count as a
     # usable payment — neither field is sufficient on its own. Skipping the
     # persistence step when the redirect is missing matches the pre-refactor
@@ -566,7 +666,6 @@ async def pay_platega_callback_handler(
         api_success=success,
         payment_url=redirect_url,
         provider_payment_id=persistable_id,
-        new_status=provider_status if persistable_id else None,
         log_prefix=_LOG,
     )
 
@@ -652,7 +751,6 @@ async def _create_webapp_payment(ctx: WebAppPaymentContext, variant: str) -> web
             first_value(response_data, "redirect", "url", "paymentUrl") if success else None
         ),
         provider_payment_id=first_value(response_data, "transactionId", "id"),
-        new_status=str((response_data or {}).get("status") or payment.status),
         log_prefix="Platega",
     )
 
@@ -665,6 +763,19 @@ async def create_crypto_webapp_payment(ctx: WebAppPaymentContext) -> web.Respons
     return await _create_webapp_payment(ctx, "platega_crypto")
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: PlategaService = ctx.request.app.get("platega_service")
+    if not service or not service.configured:
+        return None
+    variant = "crypto" if ctx.method == "platega_crypto" else "sbp"
+    return await service.try_reuse_pending_transaction(
+        payment,
+        user_id=ctx.user_id,
+        sale_mode=ctx.sale_mode,
+        variant=variant,
+    )
+
+
 def _platega_presentation_manifest(subsection: str, default_icon: str, prefix: str) -> tuple:
     return tuple(
         ProviderManifestField(
@@ -819,6 +930,7 @@ SBP_SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/platega",
     webhook_route=platega_webhook_route,
     create_webapp_payment=create_sbp_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=PlategaConfig,
     presentation_class=PlategaSbpPresentation,
     manifest_fields=_CONFIG_MANIFEST
@@ -851,6 +963,7 @@ CRYPTO_SPEC = PaymentProviderSpec(
     service_key="platega_service",
     callback_prefix="pay_platega_crypto",
     create_webapp_payment=create_crypto_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=PlategaConfig,
     presentation_class=PlategaCryptoPresentation,
     manifest_fields=_platega_presentation_manifest("Platega", "Bitcoin", "PLATEGA_CRYPTO"),

backend/bot/payment_providers/severpay.py

@@ -51,11 +51,13 @@ from .shared import (
     notify_user_payment_failed,
     parse_payment_callback,
     payment_failed,
+    payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
     post_json_request,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
 )
 
 _LOG = "severpay"
@@ -136,7 +138,7 @@ class SeverPayService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=15)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
 
         if not self.configured:
             logging.warning(
@@ -248,6 +250,48 @@ class SeverPayService(HttpClientMixin):
             return True, response_data.get("data") or response_data
         return False, response_data
 
+    async def get_payment(self, provider_payment_id: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        provider_payment_id = str(provider_payment_id or "").strip()
+        if not provider_payment_id:
+            return False, {"message": "missing_payment_id"}
+
+        identifier: Dict[str, Any]
+        if provider_payment_id.isdigit():
+            identifier = {"id": int(provider_payment_id)}
+        else:
+            identifier = {"uid": provider_payment_id}
+
+        session = await self._get_session()
+        success, response_data = await post_json_request(
+            session,
+            f"{self.base_url}/payin/get",
+            body=self._build_signed_body(identifier),
+            log_prefix="SeverPay get_payment",
+            is_success=lambda status, data: status == 200 and bool((data or {}).get("status")),
+        )
+        if success:
+            return True, response_data.get("data") or response_data
+        return False, response_data
+
+    async def try_reuse_pending_payment(self, payment: Any) -> Optional[str]:
+        provider_payment_id = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        payment_url = str(getattr(payment, "provider_payment_url", None) or "").strip()
+        if not provider_payment_id or not payment_url:
+            return None
+
+        success, data = await self.get_payment(provider_payment_id)
+        if not success or str(data.get("status") or "").lower() not in {"new", "process"}:
+            return None
+        returned_ids = {str(data.get("id") or ""), str(data.get("uid") or "")}
+        if provider_payment_id not in returned_ids:
+            return None
+        if str(data.get("order_id") or "") != str(payment.payment_id):
+            return None
+        return payment_url
+
     async def webhook_route(self, request: web.Request) -> web.Response:
         if not self.configured:
             return web.json_response({"status": False, "msg": "severpay_disabled"}, status=503)
@@ -465,6 +509,38 @@ async def pay_severpay_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="severpay",
+        pending_status="pending_severpay",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await severpay_service.try_reuse_pending_payment(reusable_payment)
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -552,6 +628,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: SeverPayService = ctx.request.app.get("severpay_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_payment(payment)
+
+
 _PRESENTATION_MANIFEST = tuple(
     ProviderManifestField(
         key=key,
@@ -677,6 +760,7 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/severpay",
     webhook_route=severpay_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=SeverPayConfig,
     presentation_class=SeverPayPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,

backend/bot/payment_providers/shared/__init__.py

@@ -42,6 +42,7 @@ from .common import (
     payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
+    reusable_webapp_payment_response,
     sale_mode_base,
     sale_mode_is_hwid_devices,
     sale_mode_is_traffic,
@@ -117,6 +118,7 @@ __all__ = [
     "payment_link_message_text",
     "payment_link_response",
     "payment_record_amounts",
+    "reusable_webapp_payment_response",
     "payment_units_for_activation",
     "payment_unavailable",
     "post_json_request",

backend/bot/payment_providers/shared/callbacks.py

@@ -285,6 +285,7 @@ async def safe_store_provider_payment_id(
     payment: Payment,
     *,
     provider_payment_id: str,
+    provider_payment_url: Optional[str] = None,
     new_status: Optional[str] = None,
     log_prefix: str,
 ) -> bool:
@@ -300,6 +301,7 @@ async def safe_store_provider_payment_id(
             payment.payment_id,
             str(provider_payment_id),
             new_status or payment.status,
+            provider_payment_url=provider_payment_url,
         )
         await session.commit()
         return True
@@ -354,11 +356,12 @@ async def render_link_or_fail(
     payment as ``failed_creation``. Every link-style provider used to inline
     this same sequence.
     """
-    if api_success and provider_payment_id:
+    if api_success and provider_payment_id and payment_url:
         await safe_store_provider_payment_id(
             session,
             payment,
             provider_payment_id=provider_payment_id,
+            provider_payment_url=payment_url,
             new_status=new_status,
             log_prefix=log_prefix,
         )

backend/bot/payment_providers/shared/common.py

@@ -315,6 +315,45 @@ async def create_webapp_payment_record(
     )
 
 
+async def reusable_webapp_payment_response(
+    ctx: WebAppPaymentContext,
+    provider_spec: Any,
+    *,
+    since_minutes: Optional[int] = None,
+) -> Optional[web.Response]:
+    resolver = getattr(provider_spec, "reuse_webapp_payment", None)
+    if resolver is None:
+        return None
+
+    amounts = payment_record_amounts(
+        months=ctx.months,
+        sale_mode=ctx.sale_mode,
+        traffic_gb=ctx.traffic_gb,
+        hwid_device_count=ctx.hwid_device_count,
+    )
+    payment = await payment_dal.find_recent_pending_provider_payment(
+        ctx.session,
+        user_id=ctx.user_id,
+        provider=provider_spec.provider_key,
+        pending_status=provider_spec.pending_status,
+        amount=ctx.price,
+        currency=ctx.currency,
+        sale_mode=ctx.sale_mode,
+        months=amounts.months,
+        purchased_gb=amounts.purchased_gb,
+        purchased_hwid_devices=amounts.purchased_hwid_devices,
+        tariff_key=amounts.tariff_key,
+        since_minutes=since_minutes,
+    )
+    if payment is None:
+        return None
+
+    payment_url = await resolver(ctx, payment)
+    if not payment_url:
+        return None
+    return payment_link_response(payment_url=payment_url, payment_id=payment.payment_id)
+
+
 async def mark_payment_failed_creation(session: AsyncSession, payment_id: int) -> None:
     await payment_dal.update_payment_status_by_db_id(session, payment_id, "failed_creation")
     await session.commit()

backend/bot/payment_providers/shared/http_client.py

@@ -1,12 +1,16 @@
 from __future__ import annotations
 
+import asyncio
 import json
 import logging
-from typing import Any, Callable, Dict, Mapping, Optional, Tuple
+from typing import Any, Callable, Dict, List, Mapping, Optional, Set, Tuple, Union
 
-from aiohttp import ClientSession, ClientTimeout
+from aiohttp import ClientError, ClientSession, ClientTimeout, TraceConfig
 
 SuccessCheck = Callable[[int, Any], bool]
+TimeoutSource = Union[float, Callable[[], float]]
+_TRANSPORT_ATTEMPTS = 2
+_DEFAULT_TIMEOUT_SECONDS = 20.0
 
 
 def http_ok(status: int, _body: Any) -> bool:
@@ -14,6 +18,29 @@ def http_ok(status: int, _body: Any) -> bool:
     return status == 200
 
 
+def _trace_request_ctx(trace_config_ctx: Any) -> Optional[dict]:
+    ctx = getattr(trace_config_ctx, "trace_request_ctx", None)
+    return ctx if isinstance(ctx, dict) else None
+
+
+async def _mark_request_headers_sent(session, trace_config_ctx, params) -> None:
+    ctx = _trace_request_ctx(trace_config_ctx)
+    if ctx is not None:
+        ctx["headers_sent"] = True
+
+
+def _payment_trace_config() -> TraceConfig:
+    trace_config = TraceConfig()
+    trace_config.on_request_headers_sent.append(_mark_request_headers_sent)
+    return trace_config
+
+
+def _should_retry_transport_error(exc: Exception, trace_ctx: Mapping[str, Any]) -> bool:
+    if trace_ctx.get("headers_sent"):
+        return False
+    return isinstance(exc, (asyncio.TimeoutError, ClientError, OSError))
+
+
 async def post_json_request(
     session: ClientSession,
     url: str,
@@ -29,34 +56,47 @@ async def post_json_request(
     returns ``(False, {"status": ..., "message": ..., "raw": ...?})`` so callers
     can decide what to do (typically: mark the payment as ``failed_creation``).
     """
-    try:
-        async with session.post(
-            url,
-            json=body,
-            headers=dict(headers) if headers else None,
-        ) as response:
-            response_text = await response.text()
-            try:
-                response_data = json.loads(response_text) if response_text else {}
-            except json.JSONDecodeError:
-                logging.error("%s: invalid JSON response: %s", log_prefix, response_text)
-                return False, {
-                    "status": response.status,
-                    "message": "invalid_json",
-                    "raw": response_text,
-                }
-            if not is_success(response.status, response_data):
-                logging.error(
-                    "%s: API returned error (status=%s, body=%s)",
+    for attempt in range(1, _TRANSPORT_ATTEMPTS + 1):
+        trace_ctx: dict[str, Any] = {"headers_sent": False}
+        try:
+            async with session.post(
+                url,
+                json=body,
+                headers=dict(headers) if headers else None,
+                trace_request_ctx=trace_ctx,
+            ) as response:
+                response_text = await response.text()
+                try:
+                    response_data = json.loads(response_text) if response_text else {}
+                except json.JSONDecodeError:
+                    logging.error("%s: invalid JSON response: %s", log_prefix, response_text)
+                    return False, {
+                        "status": response.status,
+                        "message": "invalid_json",
+                        "raw": response_text,
+                    }
+                if not is_success(response.status, response_data):
+                    logging.error(
+                        "%s: API returned error (status=%s, body=%s)",
+                        log_prefix,
+                        response.status,
+                        response_data,
+                    )
+                    return False, {"status": response.status, "message": response_data}
+                return True, response_data
+        except Exception as exc:
+            if attempt < _TRANSPORT_ATTEMPTS and _should_retry_transport_error(exc, trace_ctx):
+                logging.warning(
+                    "%s: transport failed before request headers were sent; retrying (%s/%s): %s",  # noqa: E501
                     log_prefix,
-                    response.status,
-                    response_data,
+                    attempt + 1,
+                    _TRANSPORT_ATTEMPTS,
+                    exc,
                 )
-                return False, {"status": response.status, "message": response_data}
-            return True, response_data
-    except Exception as exc:
-        logging.exception("%s: request failed.", log_prefix)
-        return False, {"message": str(exc)}
+                continue
+            logging.exception("%s: request failed.", log_prefix)
+            return False, {"message": str(exc)}
+    return False, {"message": "request_failed"}
 
 
 def first_value(data: Optional[Mapping[str, Any]], *keys: str) -> Optional[str]:
@@ -76,20 +116,69 @@ class HttpClientMixin:
     Each subclass calls ``self._init_http_client(total_timeout=...)`` from
     ``__init__`` and inherits ``_get_session`` / ``close``. The session is
     created on first use and recreated transparently if it was closed.
+
+    ``total_timeout`` may be a callable so the timeout follows runtime
+    settings changes (admin overrides apply in-process without a restart).
+    When the value changes, the next request gets a fresh session; the old
+    session stays open until its own in-flight requests cannot outlive it.
+
+    Provider API calls are traced so callers can retry transport failures only
+    when aiohttp has not sent request headers yet.
     """
 
-    _timeout: ClientTimeout
+    _timeout_source: TimeoutSource
     _session: Optional[ClientSession]
+    _stale_sessions: List[ClientSession]
+    _session_cleanup_tasks: Set["asyncio.Task[None]"]
 
-    def _init_http_client(self, *, total_timeout: float = 20.0) -> None:
-        self._timeout = ClientTimeout(total=total_timeout)
+    def _init_http_client(self, *, total_timeout: TimeoutSource = _DEFAULT_TIMEOUT_SECONDS) -> None:
+        self._timeout_source = total_timeout
         self._session = None
+        self._stale_sessions = []
+        self._session_cleanup_tasks = set()
+
+    def _current_timeout_seconds(self) -> float:
+        source = self._timeout_source
+        try:
+            seconds = float(source() if callable(source) else source)
+        except Exception:
+            return _DEFAULT_TIMEOUT_SECONDS
+        return seconds if seconds > 0 else _DEFAULT_TIMEOUT_SECONDS
 
     async def _get_session(self) -> ClientSession:
-        if self._session is None or self._session.closed:
-            self._session = ClientSession(timeout=self._timeout)
-        return self._session
+        timeout_seconds = self._current_timeout_seconds()
+        session = self._session
+        if session is not None and not session.closed and session.timeout.total != timeout_seconds:
+            self._session = None
+            self._stale_sessions.append(session)
+            task = asyncio.create_task(self._close_stale_session(session))
+            self._session_cleanup_tasks.add(task)
+            task.add_done_callback(self._session_cleanup_tasks.discard)
+            session = None
+        if session is None or session.closed:
+            session = ClientSession(
+                timeout=ClientTimeout(total=timeout_seconds),
+                trace_configs=[_payment_trace_config()],
+            )
+            self._session = session
+        return session
+
+    async def _close_stale_session(self, session: ClientSession) -> None:
+        # Any request started on this session is bound by its total timeout,
+        # so after that long it is safe to close without cutting one off.
+        await asyncio.sleep((session.timeout.total or _DEFAULT_TIMEOUT_SECONDS) + 1.0)
+        if session in self._stale_sessions:
+            self._stale_sessions.remove(session)
+        if not session.closed:
+            await session.close()
 
     async def close(self) -> None:
-        if self._session and not self._session.closed:
-            await self._session.close()
+        for task in list(self._session_cleanup_tasks):
+            task.cancel()
+        self._session_cleanup_tasks.clear()
+        sessions = [self._session, *self._stale_sessions]
+        self._session = None
+        self._stale_sessions = []
+        for session in sessions:
+            if session and not session.closed:
+                await session.close()

backend/bot/payment_providers/shared/webapp.py

@@ -39,13 +39,16 @@ async def finalize_webapp_link_payment(
             log_prefix="Wata",
         )
     """
-    if api_success and provider_payment_id:
+    # Reuse logic needs both a provider id and a redirect URL; persisting only
+    # the id creates orphan records that match find_recent but fail verification.
+    if api_success and provider_payment_id and payment_url:
         try:
             await payment_dal.update_provider_payment_and_status(
                 session,
                 payment.payment_id,
                 str(provider_payment_id),
                 new_status or payment.status,
+                provider_payment_url=payment_url,
             )
             await session.commit()
         except Exception:

backend/bot/payment_providers/wata.py

@@ -54,7 +54,6 @@ from .shared import (
     notify_user_payment_failed,
     parse_payment_callback,
     payment_failed,
-    payment_link_response,
     payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
@@ -63,7 +62,6 @@ from .shared import (
     render_link_or_fail,
     render_payment_link,
     safe_callback_answer,
-    sale_mode_base,
 )
 
 router = Router(name="user_subscription_payments_wata_router")
@@ -206,7 +204,7 @@ class WataService(HttpClientMixin):
         self._default_return_url = default_return_url
         self._cached_public_key_pem = None  # populated by webhook on first verify
 
-        self._init_http_client(total_timeout=10)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning("WataService initialized but not fully configured. Payments disabled.")
 
@@ -361,6 +359,19 @@ class WataService(HttpClientMixin):
         if not success or not isinstance(data, dict):
             return None
 
+        returned_ids = {
+            str(data.get("id") or "").strip(),
+            str(data.get("paymentLinkId") or "").strip(),
+            str(data.get("payment_link_id") or "").strip(),
+        }
+        returned_ids.discard("")
+        if returned_ids and provider_payment_id not in returned_ids:
+            return None
+
+        order_id = first_value(data, "orderId", "order_id")
+        if order_id is not None and str(order_id) != str(payment.payment_id):
+            return None
+
         status = _normalized_wata_status(data) or str(data.get("status") or "").strip().lower()
         if status and status not in _WATA_LINK_OPENED_STATUSES:
             return None
@@ -889,17 +900,15 @@ async def pay_wata_callback_handler(
     payment_description = describe_payment(translator, parts)
 
     reuse_amounts = payment_record_amounts(months=parts.months, sale_mode=parts.sale_mode)
-    months_for_lookup = (
-        reuse_amounts.months if sale_mode_base(parts.sale_mode) == "subscription" else None
-    )
     reusable_payment = await payment_dal.find_recent_pending_provider_payment(
         session,
         user_id=callback.from_user.id,
         provider="wata",
         pending_status="pending_wata",
         amount=parts.price,
+        currency=currency_code,
         sale_mode=parts.sale_mode,
-        months=months_for_lookup,
+        months=reuse_amounts.months,
         purchased_gb=reuse_amounts.purchased_gb,
         purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
         tariff_key=reuse_amounts.tariff_key,
@@ -974,45 +983,6 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
 
     currency = ctx.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
 
-    reuse_amounts = payment_record_amounts(
-        months=ctx.months,
-        sale_mode=ctx.sale_mode,
-        traffic_gb=ctx.traffic_gb,
-        hwid_device_count=ctx.hwid_device_count,
-    )
-    months_for_lookup = (
-        reuse_amounts.months if sale_mode_base(ctx.sale_mode) == "subscription" else None
-    )
-    try:
-        reusable_payment = await payment_dal.find_recent_pending_provider_payment(
-            ctx.session,
-            user_id=ctx.user_id,
-            provider="wata",
-            pending_status="pending_wata",
-            amount=ctx.price,
-            sale_mode=ctx.sale_mode,
-            months=months_for_lookup,
-            purchased_gb=reuse_amounts.purchased_gb,
-            purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
-            tariff_key=reuse_amounts.tariff_key,
-            since_minutes=service.payment_link_ttl_minutes,
-        )
-    except Exception:
-        logging.exception("Wata WebApp: lookup of reusable payment failed")
-        reusable_payment = None
-
-    if reusable_payment is not None:
-        try:
-            reusable_url = await service.try_reuse_pending_link(reusable_payment)
-        except Exception:
-            logging.exception("Wata WebApp: failed to verify reusable link")
-            reusable_url = None
-        if reusable_url:
-            return payment_link_response(
-                payment_url=reusable_url,
-                payment_id=reusable_payment.payment_id,
-            )
-
     try:
         payment = await create_webapp_payment_record(
             ctx,
@@ -1044,6 +1014,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: WataService = ctx.request.app.get("wata_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_link(payment)
+
+
 async def wata_webhook_route(request: web.Request) -> web.Response:
     service: WataService = request.app["wata_service"]
     return await service.webhook_route(request)
@@ -1204,6 +1181,7 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/wata",
     webhook_route=wata_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=WataConfig,
     presentation_class=WataPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,

backend/bot/payment_providers/yookassa.py

@@ -382,6 +382,10 @@ class YooKassaService:
                         "title": pm_title,
                         "card_last4": last4_val,
                     }
+                confirmation = getattr(payment_info_yk, "confirmation", None)
+                confirmation_url = (
+                    getattr(confirmation, "confirmation_url", None) if confirmation else None
+                )
                 return {
                     "id": payment_info_yk.id,
                     "status": payment_info_yk.status,
@@ -399,6 +403,7 @@ class YooKassaService:
                     and hasattr(payment_info_yk.captured_at, "isoformat")
                     else None,
                     "payment_method": pm_payload,
+                    "confirmation_url": confirmation_url,
                     "test_mode": getattr(payment_info_yk, "test", None),
                 }
             else:
@@ -1603,7 +1608,7 @@ async def _initiate_yk_payment(
             await payment_dal.update_payment_status_by_db_id(
                 session,
                 payment_db_id=db_payment_record.payment_id,
-                new_status=payment_response_yk.get("status", "pending"),
+                new_status="pending_yookassa",
                 yk_payment_id=payment_response_yk.get("id"),
             )
             if selected_method_internal_id is not None:
@@ -1671,12 +1676,11 @@ async def _initiate_yk_payment(
         return True
 
     if payment_response_yk and payment_method_id:
-        status_to_store = payment_response_yk.get("status", "pending")
         try:
             await payment_dal.update_payment_status_by_db_id(
                 session,
                 payment_db_id=db_payment_record.payment_id,
-                new_status=status_to_store,
+                new_status="pending_yookassa",
                 yk_payment_id=payment_response_yk.get("id"),
             )
             if selected_method_internal_id is not None:
@@ -2928,7 +2932,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         await payment_dal.update_payment_status_by_db_id(
             ctx.session,
             payment.payment_id,
-            response.get("status", "pending"),
+            "pending_yookassa",
             yk_payment_id=response.get("id"),
         )
         await ctx.session.commit()
@@ -2939,6 +2943,36 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         return payment_failed()
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: YooKassaService = ctx.request.app.get("yookassa_service")
+    if not service or not service.configured:
+        return None
+
+    provider_payment_id = str(
+        getattr(payment, "yookassa_payment_id", None)
+        or getattr(payment, "provider_payment_id", None)
+        or ""
+    ).strip()
+    if not provider_payment_id:
+        return None
+
+    info = await service.get_payment_info(provider_payment_id)
+    if not info or str(info.get("status") or "").strip().lower() != "pending":
+        return None
+    if bool(info.get("paid")):
+        return None
+
+    metadata = info.get("metadata") or {}
+    expected_metadata = {
+        "user_id": str(ctx.user_id),
+        "payment_db_id": str(payment.payment_id),
+        "sale_mode": str(ctx.sale_mode),
+    }
+    if any(str(metadata.get(key) or "") != value for key, value in expected_metadata.items()):
+        return None
+    return str(info.get("confirmation_url") or "").strip() or None
+
+
 _PRESENTATION_MANIFEST = tuple(
     ProviderManifestField(
         key=key,
@@ -3073,6 +3107,7 @@ SPEC = PaymentProviderSpec(
     webhook_route=yookassa_webhook_route,
     webhook_requires_base_url=True,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=YooKassaConfig,
     presentation_class=YooKassaPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,

backend/bot/services/config_health_service.py

@@ -0,0 +1,511 @@
+"""Detect common deployment misconfigurations for the admin panel.
+
+Each check returns :class:`ConfigAlert` items the admin UI renders as
+banners on the dashboard and inside the affected sections. Local checks
+(filesystem, settings flags) run on every request; network checks
+(Telegram webhook, Remnawave panel) are cached for a couple of minutes so
+the dashboard stays fast and external APIs are not hammered.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import time
+import uuid
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from bot.utils.request_security import ip_in_allowlist
+
+logger = logging.getLogger(__name__)
+
+APP_ROOT = Path(__file__).resolve().parents[3]
+
+NETWORK_CHECKS_TTL_SECONDS = 120.0
+NETWORK_CHECK_TIMEOUT_SECONDS = 8.0
+_WEBHOOK_ERROR_RECENT_SECONDS = 3600
+_WEBHOOK_PENDING_THRESHOLD = 50
+
+SEVERITY_ERROR = "error"
+SEVERITY_WARNING = "warning"
+
+# Admin section ids the frontend routes alerts to.
+SECTION_SETTINGS = "settings"
+SECTION_PAYMENTS = "payments"
+SECTION_BACKUPS = "backups"
+SECTION_TARIFFS = "tariffs"
+SECTION_APPEARANCE = "appearance"
+SECTION_TRANSLATIONS = "translations"
+SECTION_USERS = "users"
+
+_DATA_DIR_SECTIONS = (
+    SECTION_BACKUPS,
+    SECTION_TARIFFS,
+    SECTION_APPEARANCE,
+    SECTION_TRANSLATIONS,
+    SECTION_SETTINGS,
+)
+
+# Every message key an alert can carry. Tests assert each has
+# ``admin_health_<key>`` entries in both locale files.
+ALL_MESSAGE_KEYS = (
+    "data_dir_missing",
+    "data_dir_not_writable",
+    "backups_dir_not_writable",
+    "tariffs_config_invalid",
+    "locale_overrides_invalid",
+    "subscription_page_config_invalid",
+    "provider_not_configured",
+    "provider_webhook_needs_base_url",
+    "no_payment_methods",
+    "mini_app_url_missing",
+    "mini_app_url_not_https",
+    "redis_not_configured",
+    "smtp_incomplete",
+    "proxy_not_trusted",
+    "bot_token_invalid",
+    "telegram_api_error",
+    "telegram_webhook_missing",
+    "telegram_webhook_mismatch",
+    "telegram_webhook_error",
+    "telegram_webhook_pending",
+    "panel_api_not_configured",
+    "panel_api_unreachable",
+)
+
+
+@dataclass(frozen=True)
+class ConfigAlert:
+    id: str
+    severity: str
+    sections: Tuple[str, ...]
+    params: Dict[str, Any] = field(default_factory=dict)
+    # Locale key suffix; defaults to ``id``. Per-provider alerts carry ids
+    # like ``provider_not_configured:wata`` but share one message key.
+    message_key: Optional[str] = None
+
+    def as_payload(self) -> Dict[str, Any]:
+        return {
+            "id": self.id,
+            "severity": self.severity,
+            "sections": list(self.sections),
+            "message_key": self.message_key or self.id,
+            "params": dict(self.params),
+        }
+
+
+# ─── Filesystem checks ─────────────────────────────────────────────
+
+
+def _dir_is_writable(path: Path) -> bool:
+    probe = path / f".health-probe-{uuid.uuid4().hex}.tmp"
+    try:
+        probe.write_text("ok", encoding="utf-8")
+        probe.unlink()
+        return True
+    except OSError:
+        try:
+            probe.unlink()
+        except OSError:
+            pass
+        return False
+
+
+def _resolve_data_path(value: str) -> Path:
+    path = Path(value)
+    return path if path.is_absolute() else APP_ROOT / path
+
+
+def data_dir_alerts(settings: Any, app_root: Path = APP_ROOT) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+    data_dir = app_root / "data"
+    if not data_dir.is_dir():
+        return [
+            ConfigAlert(
+                id="data_dir_missing",
+                severity=SEVERITY_ERROR,
+                sections=_DATA_DIR_SECTIONS,
+                params={"path": str(data_dir)},
+            )
+        ]
+    if not _dir_is_writable(data_dir):
+        alerts.append(
+            ConfigAlert(
+                id="data_dir_not_writable",
+                severity=SEVERITY_ERROR,
+                sections=_DATA_DIR_SECTIONS,
+                params={"path": str(data_dir)},
+            )
+        )
+
+    backup_dir = _resolve_data_path(str(getattr(settings, "BACKUP_DIR", "") or "data/backups"))
+    if backup_dir.is_dir() and not _dir_is_writable(backup_dir):
+        alerts.append(
+            ConfigAlert(
+                id="backups_dir_not_writable",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_BACKUPS,),
+                params={"path": str(backup_dir)},
+            )
+        )
+    return alerts
+
+
+def config_file_alerts(settings: Any) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+
+    tariffs_path = _resolve_data_path(
+        str(getattr(settings, "TARIFFS_CONFIG_PATH", "") or "data/tariffs.json")
+    )
+    if tariffs_path.is_file():
+        try:
+            from config.tariffs_config import load_tariffs_config
+
+            load_tariffs_config(tariffs_path)
+        except Exception as exc:
+            alerts.append(
+                ConfigAlert(
+                    id="tariffs_config_invalid",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_TARIFFS,),
+                    params={"path": str(tariffs_path), "error": str(exc)[:300]},
+                )
+            )
+
+    locale_overrides_path = APP_ROOT / "data" / "locales-overrides.json"
+    if locale_overrides_path.is_file():
+        try:
+            json.loads(locale_overrides_path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            alerts.append(
+                ConfigAlert(
+                    id="locale_overrides_invalid",
+                    severity=SEVERITY_WARNING,
+                    sections=(SECTION_TRANSLATIONS,),
+                    params={"path": str(locale_overrides_path), "error": str(exc)[:300]},
+                )
+            )
+
+    try:
+        from config.subscription_guides_config import (
+            SubscriptionGuidesConfigError,
+            subscription_guides_admin_config_json,
+        )
+
+        try:
+            subscription_guides_admin_config_json(settings)
+        except SubscriptionGuidesConfigError as exc:
+            alerts.append(
+                ConfigAlert(
+                    id="subscription_page_config_invalid",
+                    severity=SEVERITY_WARNING,
+                    sections=(SECTION_SETTINGS,),
+                    params={"error": str(exc)[:300]},
+                )
+            )
+    except Exception:  # pragma: no cover - defensive import guard
+        logger.exception("Subscription guides config check failed unexpectedly")
+
+    return alerts
+
+
+# ─── Settings checks ───────────────────────────────────────────────
+
+
+def payment_provider_alerts(settings: Any, app: Any) -> List[ConfigAlert]:
+    from bot.payment_providers import iter_provider_specs
+
+    alerts: List[ConfigAlert] = []
+    any_enabled = False
+    seen_services: set = set()
+    for spec in iter_provider_specs():
+        try:
+            enabled = spec.is_effectively_enabled(settings)
+        except Exception:  # pragma: no cover - provider config errors
+            logger.exception("Provider %s enabled check failed", spec.id)
+            continue
+        if not enabled:
+            continue
+        any_enabled = True
+        if spec.service_key in seen_services:
+            continue
+        if spec.service_key:
+            seen_services.add(spec.service_key)
+        if not spec.is_service_configured(app):
+            alerts.append(
+                ConfigAlert(
+                    id=f"provider_not_configured:{spec.id}",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_SETTINGS,),
+                    params={"provider": spec.label},
+                    message_key="provider_not_configured",
+                )
+            )
+        if spec.webhook_requires_base_url and not getattr(settings, "WEBHOOK_BASE_URL", None):
+            alerts.append(
+                ConfigAlert(
+                    id=f"provider_webhook_needs_base_url:{spec.id}",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_SETTINGS,),
+                    params={"provider": spec.label},
+                    message_key="provider_webhook_needs_base_url",
+                )
+            )
+    if not any_enabled:
+        alerts.append(
+            ConfigAlert(
+                id="no_payment_methods",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS, SECTION_PAYMENTS),
+            )
+        )
+    return alerts
+
+
+def settings_alerts(settings: Any) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+
+    mini_app_url = str(getattr(settings, "SUBSCRIPTION_MINI_APP_URL", "") or "").strip()
+    if not mini_app_url:
+        alerts.append(
+            ConfigAlert(
+                id="mini_app_url_missing",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+    elif not mini_app_url.lower().startswith("https://"):
+        alerts.append(
+            ConfigAlert(
+                id="mini_app_url_not_https",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS,),
+                params={"url": mini_app_url},
+            )
+        )
+
+    if not getattr(settings, "REDIS_URL", None):
+        alerts.append(
+            ConfigAlert(
+                id="redis_not_configured",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+
+    smtp_partial = any(
+        getattr(settings, key, None)
+        for key in ("SMTP_USERNAME", "SMTP_PASSWORD", "SMTP_FROM_EMAIL")
+    )
+    if smtp_partial and not getattr(settings, "email_auth_configured", False):
+        alerts.append(
+            ConfigAlert(
+                id="smtp_incomplete",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+
+    return alerts
+
+
+def proxy_alerts(request: Any, settings: Any) -> List[ConfigAlert]:
+    """Warn when the admin request itself came through an untrusted proxy.
+
+    In that case provider webhooks with IP allowlists will see the proxy
+    address instead of the real sender and may reject valid callbacks.
+    """
+    headers = getattr(request, "headers", None) or {}
+    forwarded = headers.get("X-Forwarded-For")
+    remote = getattr(request, "remote", None)
+    if not forwarded or not remote:
+        return []
+    if ip_in_allowlist(remote, getattr(settings, "trusted_proxies", None)):
+        return []
+    return [
+        ConfigAlert(
+            id="proxy_not_trusted",
+            severity=SEVERITY_WARNING,
+            sections=(SECTION_SETTINGS,),
+            params={"remote": str(remote)},
+        )
+    ]
+
+
+# ─── Network checks (cached) ───────────────────────────────────────
+
+
+async def telegram_alerts(bot: Any, settings: Any) -> List[ConfigAlert]:
+    if bot is None:
+        return []
+    try:
+        info = await asyncio.wait_for(bot.get_webhook_info(), timeout=NETWORK_CHECK_TIMEOUT_SECONDS)
+    except Exception as exc:
+        if exc.__class__.__name__ in {"TelegramUnauthorizedError", "TelegramNotFound"}:
+            return [
+                ConfigAlert(
+                    id="bot_token_invalid",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_SETTINGS,),
+                )
+            ]
+        return [
+            ConfigAlert(
+                id="telegram_api_error",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"error": str(exc)[:300]},
+            )
+        ]
+
+    alerts: List[ConfigAlert] = []
+    actual_url = str(getattr(info, "url", "") or "")
+    base_url = str(getattr(settings, "WEBHOOK_BASE_URL", "") or "").rstrip("/")
+    expected_url = (
+        f"{base_url}{getattr(settings, 'telegram_webhook_path', '/tg/webhook')}" if base_url else ""
+    )
+    if not actual_url:
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_missing",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+    elif expected_url and actual_url != expected_url:
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_mismatch",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"actual": actual_url, "expected": expected_url},
+            )
+        )
+
+    pending = int(getattr(info, "pending_update_count", 0) or 0)
+    last_error_date = getattr(info, "last_error_date", None)
+    last_error_ts: Optional[float] = None
+    if last_error_date is not None:
+        last_error_ts = (
+            last_error_date.timestamp()
+            if hasattr(last_error_date, "timestamp")
+            else float(last_error_date)
+        )
+    if (
+        pending > 0
+        and last_error_ts
+        and (time.time() - last_error_ts) < _WEBHOOK_ERROR_RECENT_SECONDS
+    ):
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_error",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"error": str(getattr(info, "last_error_message", "") or "")[:300]},
+            )
+        )
+
+    if pending > _WEBHOOK_PENDING_THRESHOLD:
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_pending",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"count": pending},
+            )
+        )
+    return alerts
+
+
+async def panel_alerts(panel_service: Any, settings: Any) -> List[ConfigAlert]:
+    if not getattr(settings, "PANEL_API_URL", None) or not getattr(settings, "PANEL_API_KEY", None):
+        return [
+            ConfigAlert(
+                id="panel_api_not_configured",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS, SECTION_USERS, SECTION_TARIFFS),
+            )
+        ]
+    if panel_service is None:
+        return []
+    try:
+        stats = await asyncio.wait_for(
+            panel_service.get_system_stats(), timeout=NETWORK_CHECK_TIMEOUT_SECONDS
+        )
+    except Exception as exc:
+        logger.debug("Panel health check failed: %s", exc)
+        stats = None
+    if stats is None:
+        return [
+            ConfigAlert(
+                id="panel_api_unreachable",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS, SECTION_USERS),
+                params={"url": str(getattr(settings, "PANEL_API_URL", "") or "")},
+            )
+        ]
+    return []
+
+
+# ─── Aggregation ───────────────────────────────────────────────────
+
+_network_cache: Dict[int, Tuple[float, List[ConfigAlert]]] = {}
+_network_cache_lock = asyncio.Lock()
+
+
+def local_alerts(request: Any, settings: Any, app: Any) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+    for collect in (
+        lambda: data_dir_alerts(settings),
+        lambda: config_file_alerts(settings),
+        lambda: payment_provider_alerts(settings, app),
+        lambda: settings_alerts(settings),
+        lambda: proxy_alerts(request, settings),
+    ):
+        try:
+            alerts.extend(collect())
+        except Exception:  # pragma: no cover - one broken check must not hide others
+            logger.exception("Config health check failed")
+    return alerts
+
+
+async def network_alerts(app: Any, settings: Any, *, refresh: bool = False) -> List[ConfigAlert]:
+    cache_key = id(settings)
+    now = time.monotonic()
+    if not refresh:
+        cached = _network_cache.get(cache_key)
+        if cached and (now - cached[0]) < NETWORK_CHECKS_TTL_SECONDS:
+            return cached[1]
+
+    async with _network_cache_lock:
+        if not refresh:
+            cached = _network_cache.get(cache_key)
+            if cached and (time.monotonic() - cached[0]) < NETWORK_CHECKS_TTL_SECONDS:
+                return cached[1]
+
+        results = await asyncio.gather(
+            telegram_alerts(app.get("bot"), settings),
+            panel_alerts(app.get("panel_service"), settings),
+            return_exceptions=True,
+        )
+        alerts: List[ConfigAlert] = []
+        for result in results:
+            if isinstance(result, BaseException):
+                logger.exception("Network config health check failed", exc_info=result)
+                continue
+            alerts.extend(result)
+        _network_cache[cache_key] = (time.monotonic(), alerts)
+        return alerts
+
+
+async def collect_config_alerts(request: Any, *, refresh: bool = False) -> List[Dict[str, Any]]:
+    app = request.app
+    settings = app["settings"]
+    alerts = local_alerts(request, settings, app)
+    alerts.extend(await network_alerts(app, settings, refresh=refresh))
+    order = {SEVERITY_ERROR: 0, SEVERITY_WARNING: 1}
+    alerts.sort(key=lambda alert: (order.get(alert.severity, 2), alert.id))
+    return [alert.as_payload() for alert in alerts]

backend/bot/services/email_templates.py

@@ -10,14 +10,13 @@ copy goes through the shared `JsonI18n` instance so translations live in
 from __future__ import annotations
 
 import html
+import io
 import re
 from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING, Optional, Sequence, Tuple
 from urllib.parse import urlsplit
 
-from config.webapp_themes_config import effective_webapp_theme_accent
-
 if TYPE_CHECKING:
     from bot.middlewares.i18n import JsonI18n
     from config.settings import Settings
@@ -44,6 +43,7 @@ _LOGO_CONTENT_TYPES = {
     ".svg": "image/svg+xml",
     ".webp": "image/webp",
 }
+_EMAIL_LOGO_PNG_FALLBACK_EXTENSIONS = {".ico", ".webp"}
 
 
 @dataclass(frozen=True)
@@ -82,6 +82,8 @@ def _theme_accent(settings: Settings) -> str:
         catalog = getattr(settings, "webapp_themes_catalog", None)
         if catalog is None:
             return primary
+        from config.webapp_themes_config import effective_webapp_theme_accent
+
         return _safe_color(effective_webapp_theme_accent(catalog, primary))
     except Exception:
         return primary
@@ -129,6 +131,8 @@ def _inline_uploaded_logo(settings: Settings) -> Optional[EmailInlineImage]:
     if not body or len(body) > _WEBAPP_LOGO_MAX_BYTES:
         return None
 
+    content_type, body = _email_logo_payload(filename, content_type, body)
+
     return EmailInlineImage(
         content_id=_EMAIL_LOGO_CONTENT_ID,
         content_type=content_type,
@@ -136,6 +140,40 @@ def _inline_uploaded_logo(settings: Settings) -> Optional[EmailInlineImage]:
     )
 
 
+def _email_logo_payload(filename: str, content_type: str, body: bytes) -> Tuple[str, bytes]:
+    suffix = Path(filename).suffix.lower()
+    if suffix not in _EMAIL_LOGO_PNG_FALLBACK_EXTENSIONS:
+        return content_type, body
+
+    png_body = _static_raster_logo_to_png(body)
+    if png_body and len(png_body) <= _WEBAPP_LOGO_MAX_BYTES:
+        return "image/png", png_body
+    return content_type, body
+
+
+def _static_raster_logo_to_png(body: bytes) -> Optional[bytes]:
+    try:
+        from PIL import Image, ImageOps, UnidentifiedImageError
+    except ImportError:
+        return None
+
+    try:
+        with Image.open(io.BytesIO(body)) as image:
+            image.seek(0)
+            if getattr(image, "is_animated", False):
+                return None
+            source = ImageOps.exif_transpose(image).convert("RGBA")
+    except (OSError, UnidentifiedImageError, ValueError, EOFError):
+        return None
+
+    if source.width < 1 or source.height < 1 or source.width > 8192 or source.height > 8192:
+        return None
+
+    output = io.BytesIO()
+    source.save(output, format="PNG", optimize=True)
+    return output.getvalue()
+
+
 def _email_logo(settings: Settings) -> Tuple[Optional[str], Tuple[EmailInlineImage, ...]]:
     inline_logo = _inline_uploaded_logo(settings)
     if inline_logo:
@@ -198,7 +236,7 @@ def _layout(
         logo_block = (
             f'<img src="{html.escape(logo_url, quote=True)}" width="64" height="64" '
             f'alt="" style="display:block;border:0;outline:none;text-decoration:none;'
-            f'border-radius:16px;">'
+            f'border-radius:16px;background:transparent;background-color:transparent;">'
         )
 
     layout_html = f"""<!DOCTYPE html>

backend/bot/services/notification_service.py

@@ -237,11 +237,12 @@ class NotificationService:
         text: str,
         path: str,
         fallback_url: str,
+        web_app_button: bool = True,
     ) -> InlineKeyboardButton:
         webapp_url = self._support_webapp_url(path)
-        if webapp_url:
+        if webapp_url and web_app_button:
             return InlineKeyboardButton(text=text, web_app=WebAppInfo(url=webapp_url))
-        return InlineKeyboardButton(text=text, url=fallback_url)
+        return InlineKeyboardButton(text=text, url=webapp_url or fallback_url)
 
     def _support_text(self, language: Optional[str], key: str, fallback: str) -> str:
         if not self.i18n:
@@ -316,7 +317,14 @@ class NotificationService:
             return enabled
         return self._coerce_bool_setting(raw_value, enabled)
 
-    def _support_keyboard(self, ticket, user, *, admin: bool = True) -> InlineKeyboardMarkup:
+    def _support_keyboard(
+        self,
+        ticket,
+        user,
+        *,
+        admin: bool = True,
+        web_app_buttons: bool = True,
+    ) -> InlineKeyboardMarkup:
         ticket_path = (
             f"/admin/support/{ticket.ticket_id}" if admin else f"/support/{ticket.ticket_id}"
         )
@@ -326,6 +334,7 @@ class NotificationService:
                     text="Открыть тикет",
                     path=ticket_path,
                     fallback_url=self._support_ticket_url(ticket.ticket_id, admin=admin),
+                    web_app_button=web_app_buttons,
                 )
             ]
         ]
@@ -342,12 +351,35 @@ class NotificationService:
                         text="Карточка пользователя",
                         path=user_card_path,
                         fallback_url=self._support_ticket_url(ticket.ticket_id, admin=True),
+                        web_app_button=web_app_buttons,
                     )
                 )
             if profile_row:
                 rows.append(profile_row)
         return InlineKeyboardMarkup(inline_keyboard=rows)
 
+    def _support_log_thread_id(self) -> Optional[int]:
+        return getattr(self.settings, "LOG_SUPPORT_THREAD_ID", None)
+
+    def _support_thread_is_configured(self) -> bool:
+        return bool(getattr(self.settings, "LOG_CHAT_ID", None) and self._support_log_thread_id())
+
+    async def _send_admin_support_telegram(
+        self,
+        message: str,
+        *,
+        admin_markup: InlineKeyboardMarkup,
+        log_markup: InlineKeyboardMarkup,
+    ) -> None:
+        thread_id = self._support_log_thread_id()
+        if not self._support_thread_is_configured():
+            await self._send_to_admins(message, reply_markup=admin_markup)
+        await self._send_to_log_channel(
+            message,
+            thread_id=thread_id,
+            reply_markup=log_markup,
+        )
+
     def _support_user_keyboard(self, ticket, user) -> InlineKeyboardMarkup:
         button_text = self._support_text(
             getattr(user, "language_code", None),
@@ -415,12 +447,12 @@ class NotificationService:
             f"статус: {hd.quote(str(snapshot.get('panel_status') or '—'))}\n\n"
             f"<b>Текст обращения</b>\n{hd.quote(preview)}"
         )
-        keyboard = self._support_keyboard(ticket, user, admin=True)
-        await self._send_to_admins(message, reply_markup=keyboard)
-        await self._send_to_log_channel(
+        admin_keyboard = self._support_keyboard(ticket, user, admin=True)
+        log_keyboard = self._support_keyboard(ticket, user, admin=True, web_app_buttons=False)
+        await self._send_admin_support_telegram(
             message,
-            thread_id=getattr(self.settings, "LOG_SUPPORT_THREAD_ID", None),
-            reply_markup=keyboard,
+            admin_markup=admin_keyboard,
+            log_markup=log_keyboard,
         )
         await self._send_admin_support_email(
             render_support_new_ticket_admin,
@@ -456,13 +488,13 @@ class NotificationService:
             f"💬 <b>Ответ пользователя в тикете #{ticket.ticket_id}</b>\n"
             f"{hd.quote(user_display)}{unread_line}\n\n{hd.quote(preview)}"
         )
-        keyboard = self._support_keyboard(ticket, user, admin=True)
         if send_telegram and getattr(self.settings, "LOG_SUPPORT", True):
-            await self._send_to_admins(text, reply_markup=keyboard)
-            await self._send_to_log_channel(
+            admin_keyboard = self._support_keyboard(ticket, user, admin=True)
+            log_keyboard = self._support_keyboard(ticket, user, admin=True, web_app_buttons=False)
+            await self._send_admin_support_telegram(
                 text,
-                thread_id=getattr(self.settings, "LOG_SUPPORT_THREAD_ID", None),
-                reply_markup=keyboard,
+                admin_markup=admin_keyboard,
+                log_markup=log_keyboard,
             )
         if send_email:
             await self._send_admin_support_email(

backend/bot/services/promo_code_service.py

@@ -87,12 +87,17 @@ class PromoCodeService:
             return False, _("promo_code_already_used_by_user", code=code_display)
 
         bonus_days = promo_data.bonus_days
+        default_tariff_key = None
+        tariffs_config = getattr(self.settings, "tariffs_config", None)
+        if tariffs_config:
+            default_tariff_key = getattr(tariffs_config, "default_tariff", None)
 
         new_end_date = await self.subscription_service.extend_active_subscription_days(
             session=session,
             user_id=user_id,
             bonus_days=bonus_days,
             reason=f"promo code {applied_code}",
+            tariff_key=default_tariff_key,
         )
 
         if new_end_date:

backend/bot/services/subscription_service_impl/lifecycle.py

@@ -783,6 +783,7 @@ class SubscriptionLifecycleMixin:
         bonus_days: int,
         reason: str = "bonus",
         extend_hwid_devices: bool = True,
+        tariff_key: Optional[str] = None,
     ) -> Optional[datetime]:
         reason_lower = (reason or "").lower()
         apply_main_traffic_limit = any(
@@ -809,6 +810,17 @@ class SubscriptionLifecycleMixin:
         preserve_tariff_limits = bool(
             active_sub and active_sub.tariff_key and self._tariffs_config()
         )
+        bonus_tariff = None
+        if not active_sub and tariff_key and self._tariffs_config():
+            try:
+                bonus_tariff = self._resolve_tariff(tariff_key)
+            except Exception:
+                logging.warning(
+                    "Unable to resolve bonus tariff %s for user %s.",
+                    tariff_key,
+                    user_id,
+                    exc_info=True,
+                )
         if not active_sub or not active_sub.end_date:
             logging.info(
                 f"No active subscription found for user {user_id}. Creating new one for {bonus_days} days."  # noqa: E501
@@ -818,10 +830,16 @@ class SubscriptionLifecycleMixin:
 
             # Apply main traffic limit for admin/referral/promo bonuses, fallback to trial limit otherwise  # noqa: E501
             traffic_limit = (
-                self.settings.user_traffic_limit_bytes
+                self._traffic_limit_for_period_tariff(bonus_tariff)
+                if bonus_tariff
+                else self.settings.user_traffic_limit_bytes
                 if apply_main_traffic_limit
                 else self.settings.trial_traffic_limit_bytes
             )
+            premium_baseline_bytes = bonus_tariff.premium_monthly_bytes if bonus_tariff else 0
+            base_hwid_limit = (
+                self._base_hwid_limit_for_tariff(bonus_tariff) if bonus_tariff else None
+            )
 
             bonus_sub_payload = {
                 "user_id": user_id,
@@ -834,6 +852,21 @@ class SubscriptionLifecycleMixin:
                 "status_from_panel": "ACTIVE_BONUS",
                 "traffic_limit_bytes": traffic_limit,
                 "auto_renew_enabled": False,
+                "tariff_key": bonus_tariff.key if bonus_tariff else None,
+                "tier_baseline_bytes": bonus_tariff.monthly_bytes if bonus_tariff else None,
+                "topup_balance_bytes": 0,
+                "regular_bonus_bytes": 0,
+                "regular_unlimited_override": False,
+                "premium_baseline_bytes": premium_baseline_bytes,
+                "premium_topup_balance_bytes": 0,
+                "premium_topup_used_bytes": 0,
+                "premium_used_bytes": 0,
+                "premium_is_limited": False,
+                "premium_period_start_at": None,
+                "period_start_at": None,
+                "is_throttled": False,
+                "hwid_device_limit": base_hwid_limit,
+                "extra_hwid_devices": 0,
                 # Registration/referral bonus grants are short-lived, like a
                 # trial: only warn a few hours before they end, not days ahead.
                 "suppress_early_expiry_notifications": True,
@@ -886,13 +919,35 @@ class SubscriptionLifecycleMixin:
             panel_update_payload = self._build_panel_update_payload(
                 expire_at=new_end_date_obj,
                 traffic_limit_bytes=(
-                    self.settings.user_traffic_limit_bytes
+                    updated_sub_model.traffic_limit_bytes
+                    if bonus_tariff
+                    else self.settings.user_traffic_limit_bytes
                     if apply_main_traffic_limit and not preserve_tariff_limits
                     else None
                 ),
+                traffic_limit_strategy=(
+                    "MONTH"
+                    if bonus_tariff and bonus_tariff.billing_model == "period"
+                    else self.settings.USER_TRAFFIC_STRATEGY
+                    if bonus_tariff
+                    else None
+                ),
+                hwid_device_limit=(
+                    self._effective_hwid_limit(updated_sub_model.hwid_device_limit, 0)
+                    if bonus_tariff
+                    else None
+                ),
                 include_uuid=False,
                 include_default_squads=False,
             )
+            if bonus_tariff:
+                panel_update_payload["activeInternalSquads"] = self._panel_squads_for_tariff(
+                    bonus_tariff
+                )
+                if self.settings.parsed_user_external_squad_uuid:
+                    panel_update_payload["externalSquadUuid"] = (
+                        self.settings.parsed_user_external_squad_uuid
+                    )
 
             panel_update_success = await self.panel_service.update_user_details_on_panel(
                 panel_uuid,

backend/bot/services/telemetry_worker.py

@@ -29,7 +29,12 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import sessionmaker
 
 from bot.infra.redis import redis_lock
-from bot.utils.app_version import resolve_app_version, resolve_app_version_tag
+from bot.utils.app_version import (
+    resolve_app_version,
+    resolve_app_version_tag,
+    resolve_build_provenance,
+    resolve_image_modified,
+)
 from config.settings import Settings
 from db.dal import app_settings_dal, user_dal
 
@@ -169,11 +174,15 @@ class TelemetryWorker:
 
         version = resolve_app_version()
         version_tag = resolve_app_version_tag()
+        build_provenance = resolve_build_provenance()
+        image_modified = resolve_image_modified()
         # Person properties (``$set``) snapshot the latest state per install, so
         # "version breakdown" in PostHog is a person-property breakdown.
         person_props = {
             "app_version": version,
             "app_version_tag": version_tag,
+            "build_provenance": build_provenance,
+            "image_modified": image_modified,
             "os": platform.system().lower() or "unknown",
             "arch": platform.machine().lower() or "unknown",
             "python_version": platform.python_version(),

backend/bot/utils/app_version.py

@@ -6,6 +6,9 @@ the runtime container agree on the value:
     REMNAWAVE_MINISHOP_VERSION env > .build-version file > live ``git describe``
     > ``dev+unknown``
 
+Build provenance is intentionally separate from the version: official release
+automation stamps official images, while local/fork builds default to custom.
+
 The same value powers the admin sidebar (web process) and the anonymous
 telemetry beacon (worker process), so "active installs" and version
 breakdowns line up across both.
@@ -24,6 +27,16 @@ from typing import Optional
 APP_ROOT = Path(__file__).resolve().parents[3]
 
 _APP_VERSION_CACHE: Optional[str] = None
+_APP_BUILD_PROVENANCE_CACHE: Optional[str] = None
+
+BUILD_PROVENANCE_OFFICIAL = "official"
+BUILD_PROVENANCE_CUSTOM = "custom"
+BUILD_PROVENANCE_UNKNOWN = "unknown"
+_BUILD_PROVENANCE_VALUES = {
+    BUILD_PROVENANCE_OFFICIAL,
+    BUILD_PROVENANCE_CUSTOM,
+    BUILD_PROVENANCE_UNKNOWN,
+}
 
 
 def _run_git_command(*args: str) -> str:
@@ -87,6 +100,29 @@ def _read_build_file(name: str) -> str:
         return ""
 
 
+def _normalize_build_provenance(raw: str) -> str:
+    value = str(raw or "").strip().lower()
+    if not value:
+        return ""
+    aliases = {
+        "true": BUILD_PROVENANCE_OFFICIAL,
+        "1": BUILD_PROVENANCE_OFFICIAL,
+        "yes": BUILD_PROVENANCE_OFFICIAL,
+        "upstream": BUILD_PROVENANCE_OFFICIAL,
+        "release": BUILD_PROVENANCE_OFFICIAL,
+        "false": BUILD_PROVENANCE_CUSTOM,
+        "0": BUILD_PROVENANCE_CUSTOM,
+        "no": BUILD_PROVENANCE_CUSTOM,
+        "fork": BUILD_PROVENANCE_CUSTOM,
+        "modified": BUILD_PROVENANCE_CUSTOM,
+        "local": BUILD_PROVENANCE_CUSTOM,
+    }
+    value = aliases.get(value, value)
+    if value in _BUILD_PROVENANCE_VALUES:
+        return value
+    return BUILD_PROVENANCE_CUSTOM
+
+
 def resolve_app_version() -> str:
     """Full version string (cached), e.g. ``v3.4.6+gabc1234``."""
     global _APP_VERSION_CACHE
@@ -124,3 +160,28 @@ def resolve_app_version_tag() -> str:
     if tag:
         return tag
     return resolve_app_version()
+
+
+def resolve_build_provenance() -> str:
+    """Low-cardinality image provenance: ``official``, ``custom`` or ``unknown``."""
+    global _APP_BUILD_PROVENANCE_CACHE
+    if _APP_BUILD_PROVENANCE_CACHE:
+        return _APP_BUILD_PROVENANCE_CACHE
+
+    env_value = _normalize_build_provenance(os.getenv("REMNAWAVE_MINISHOP_BUILD_PROVENANCE", ""))
+    if env_value:
+        _APP_BUILD_PROVENANCE_CACHE = env_value
+        return env_value
+
+    build_value = _normalize_build_provenance(_read_build_file(".build-provenance"))
+    if build_value:
+        _APP_BUILD_PROVENANCE_CACHE = build_value
+        return build_value
+
+    _APP_BUILD_PROVENANCE_CACHE = BUILD_PROVENANCE_CUSTOM
+    return _APP_BUILD_PROVENANCE_CACHE
+
+
+def resolve_image_modified() -> bool:
+    """True for non-official builds, including forks and local rebuilds."""
+    return resolve_build_provenance() != BUILD_PROVENANCE_OFFICIAL

backend/bot/utils/request_security.py

@@ -34,12 +34,26 @@ def _parse_ip(value: Optional[str]) -> Optional[ipaddress._BaseAddress]:
         return None
 
 
-def _last_forwarded_ip(header_value: str) -> Optional[str]:
+def _forwarded_ips(header_value: str) -> list[ipaddress._BaseAddress]:
     candidates = [item.strip() for item in header_value.split(",") if item.strip()]
-    if not candidates:
-        return None
-    candidate = candidates[-1]
-    return candidate if _parse_ip(candidate) is not None else None
+    parsed: list[ipaddress._BaseAddress] = []
+    for candidate in candidates:
+        parsed_ip = _parse_ip(candidate)
+        if parsed_ip is not None:
+            parsed.append(parsed_ip)
+    return parsed
+
+
+def _forwarded_client_ip(
+    forwarded_ips: Sequence[ipaddress._BaseAddress],
+    trusted_networks: Sequence[ipaddress._BaseNetwork],
+) -> Optional[str]:
+    for forwarded_ip in reversed(forwarded_ips):
+        if not any(forwarded_ip in network for network in trusted_networks):
+            return str(forwarded_ip)
+    if forwarded_ips:
+        return str(forwarded_ips[0])
+    return None
 
 
 def request_client_ip(
@@ -48,20 +62,21 @@ def request_client_ip(
     trusted_proxies: Optional[Sequence[str] | str] = None,
 ) -> Optional[str]:
     remote_ip = _parse_ip(request.remote or "")
-    forwarded_for = request.headers.get("X-Forwarded-For", "")
+    forwarded_ips = _forwarded_ips(request.headers.get("X-Forwarded-For", ""))
 
-    if remote_ip and forwarded_for:
+    if remote_ip and forwarded_ips:
         trusted_networks = parse_ip_entries(trusted_proxies)
         if any(remote_ip in network for network in trusted_networks):
-            forwarded_ip = _last_forwarded_ip(forwarded_for)
+            forwarded_ip = _forwarded_client_ip(forwarded_ips, trusted_networks)
             if forwarded_ip:
                 return forwarded_ip
 
     if remote_ip:
         return str(remote_ip)
 
-    forwarded_ip = _last_forwarded_ip(forwarded_for)
-    return forwarded_ip
+    if forwarded_ips:
+        return str(forwarded_ips[-1])
+    return None
 
 
 def ip_in_allowlist(

backend/config/settings.py

@@ -138,6 +138,17 @@ DEFAULT_DISPOSABLE_EMAIL_DOMAINS = "\n".join(
     ]
 )
 
+DEFAULT_TRUSTED_PROXIES = ",".join(
+    [
+        "127.0.0.1",
+        "::1",
+        "10.0.0.0/8",
+        "172.16.0.0/12",
+        "192.168.0.0/16",
+        "fc00::/7",
+    ]
+)
+
 
 class DBSettings(BaseModel):
     user: str
@@ -215,6 +226,7 @@ class Settings(BaseSettings):
     ADMIN_PANEL_STATS_CACHE_TTL_SECONDS: int = Field(default=15)
     ADMIN_DB_STATS_CACHE_TTL_SECONDS: int = Field(default=5)
     ADMIN_USERS_LIST_CACHE_TTL_SECONDS: int = Field(default=3)
+    ADMIN_BROADCAST_AUDIENCE_COUNTS_CACHE_TTL_SECONDS: int = Field(default=30)
     PROFILE_SYNC_CACHE_TTL_SECONDS: int = Field(default=900)
     PANEL_SYNC_LIFETIME_TRAFFIC_MIN_INTERVAL_SECONDS: int = Field(default=3600)
     PANEL_SYNC_LIFETIME_TRAFFIC_MIN_DELTA_BYTES: int = Field(default=104857600)
@@ -309,7 +321,7 @@ class Settings(BaseSettings):
 
     WEBHOOK_BASE_URL: Optional[str] = None
     TRUSTED_PROXIES: Optional[str] = Field(
-        default="127.0.0.1,::1",
+        default=DEFAULT_TRUSTED_PROXIES,
         description="Comma-separated list of reverse proxy IPs or CIDRs trusted to forward X-Forwarded-For.",  # noqa: E501
     )
 
@@ -331,6 +343,11 @@ class Settings(BaseSettings):
         default=DEFAULT_SUBSCRIPTION_PURCHASE_DESCRIPTION_EN,
         description="English subscription description shown before purchase/renewal options.",
     )
+    PAYMENT_REQUEST_TIMEOUT_SECONDS: float = Field(
+        default=20,
+        ge=1,
+        description="Maximum total time for one payment provider API request, in seconds.",
+    )
 
     MONTH_1_ENABLED: bool = Field(default=True, alias="1_MONTH_ENABLED")
     MONTH_3_ENABLED: bool = Field(default=True, alias="3_MONTHS_ENABLED")
@@ -1251,9 +1268,10 @@ class Settings(BaseSettings):
     TELEMETRY_ENABLED: bool = Field(
         default=True,
         description=(
-            "Send an anonymous daily install heartbeat (version, OS, locale, "
-            "user-count range). No personal data. Opt out here, via the web "
-            "admin, or by clearing TELEMETRY_ENDPOINT/TELEMETRY_API_KEY."
+            "Send an anonymous daily install heartbeat (version, official/custom "
+            "image provenance, OS, locale, user-count range). No personal data. "
+            "Opt out here, via the web admin, or by clearing "
+            "TELEMETRY_ENDPOINT/TELEMETRY_API_KEY."
         ),
     )
     TELEMETRY_ENDPOINT: str = Field(

backend/config/webapp_themes_config.py

@@ -372,6 +372,7 @@ def _builtin_theme_assets_need_refresh(key: str, target_dir: Path) -> bool:
             or ".theme-key-light.app-shell" not in style
             or "Install guide theme surfaces" not in style
             or "Admin controls: range sliders and sortable rows" not in style
+            or "Admin health config alerts" not in style
         )
     if key == "ascii":
         return (
@@ -383,6 +384,7 @@ def _builtin_theme_assets_need_refresh(key: str, target_dir: Path) -> bool:
             or "New webapp surfaces: support, purchase info, password login" not in style
             or "Install guide theme surfaces" not in style
             or "Admin controls: range sliders and sortable rows" not in style
+            or "Admin health config alerts" not in style
         )
     if key != "windows95":
         return False
@@ -407,6 +409,7 @@ def _builtin_theme_assets_need_refresh(key: str, target_dir: Path) -> bool:
         or "New webapp surfaces: support, purchase info, password login" not in style
         or "Install guide theme surfaces" not in style
         or "Admin controls: range sliders and sortable rows" not in style
+        or "Admin health config alerts" not in style
         or any(not (target_dir / "icons" / icon).exists() for icon in required_icons)
     )
 

backend/db/dal/payment_dal.py

@@ -1,7 +1,7 @@
 import logging
 from typing import Any, Dict, List, Optional
 
-from sqlalchemy import Date, and_, case, cast, func
+from sqlalchemy import Date, and_, case, cast, func, or_
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.future import select
 from sqlalchemy.orm import joinedload, selectinload
@@ -116,31 +116,41 @@ async def find_recent_pending_provider_payment(
     provider: str,
     pending_status: str,
     amount: float,
+    currency: Optional[str],
     sale_mode: Optional[str],
     months: Optional[int],
     purchased_gb: Optional[float],
     purchased_hwid_devices: Optional[int],
     tariff_key: Optional[str] = None,
-    since_minutes: int = 60,
+    since_minutes: Optional[int] = None,
 ) -> Optional[Payment]:
     """Return the most recent pending payment matching the given tariff parameters.
 
     Used to reuse an existing provider payment link instead of creating a new one
-    on repeated user clicks. Only payments with a populated ``provider_payment_id``
-    are returned — without it, there's no link to reuse.
+    on repeated user clicks. A generic or provider-specific payment id must be
+    populated so the caller can verify the remote payment link.
+
+    Status matching is case-insensitive and also accepts the generic ``pending``
+    alias so legacy rows (e.g. Platega ``PENDING`` or YooKassa ``pending``) stay
+    reusable after provider APIs overwrite the internal pending status.
     """
     from datetime import datetime, timedelta, timezone
 
-    cutoff = datetime.now(timezone.utc) - timedelta(minutes=max(1, since_minutes))
-
     conditions = [
         Payment.user_id == user_id,
         Payment.provider == provider,
-        Payment.status == pending_status,
-        Payment.provider_payment_id.isnot(None),
-        Payment.created_at >= cutoff,
+        func.lower(Payment.status).in_(tuple({str(pending_status).lower(), "pending"})),
+        or_(
+            Payment.provider_payment_id.isnot(None),
+            Payment.yookassa_payment_id.isnot(None),
+        ),
         func.abs(Payment.amount - float(amount)) < 0.01,
     ]
+    if since_minutes is not None:
+        cutoff = datetime.now(timezone.utc) - timedelta(minutes=max(1, since_minutes))
+        conditions.append(Payment.created_at >= cutoff)
+    if currency is not None:
+        conditions.append(func.upper(Payment.currency) == str(currency).strip().upper())
     if sale_mode is not None:
         conditions.append(Payment.sale_mode == sale_mode)
     if tariff_key is not None:
@@ -238,12 +248,18 @@ async def count_user_succeeded_payments(
 
 
 async def update_provider_payment_and_status(
-    session: AsyncSession, payment_db_id: int, provider_payment_id: str, new_status: str
+    session: AsyncSession,
+    payment_db_id: int,
+    provider_payment_id: str,
+    new_status: str,
+    provider_payment_url: Optional[str] = None,
 ) -> Optional[Payment]:
     payment = await get_payment_by_db_id(session, payment_db_id)
     if payment:
         payment.status = new_status
         payment.provider_payment_id = provider_payment_id
+        if provider_payment_url:
+            payment.provider_payment_url = provider_payment_url
         payment.updated_at = func.now()
         await session.flush()
         await session.refresh(payment)

backend/db/dal/user_dal.py

@@ -715,6 +715,12 @@ async def get_all_active_user_ids_for_broadcast(session: AsyncSession) -> List[i
     return result.scalars().all()
 
 
+async def count_all_active_users_for_broadcast(session: AsyncSession) -> int:
+    stmt = select(func.count(User.user_id)).where(User.is_banned == False)
+    result = await session.execute(stmt)
+    return int(result.scalar_one() or 0)
+
+
 async def get_all_users_with_panel_uuid(session: AsyncSession) -> List[User]:
     stmt = select(User).where(User.panel_user_uuid.is_not(None))
     result = await session.execute(stmt)
@@ -890,6 +896,27 @@ async def get_user_ids_with_active_subscription(session: AsyncSession) -> List[i
     return result.scalars().all()
 
 
+async def count_users_with_active_subscription_for_broadcast(session: AsyncSession) -> int:
+    """Count non-banned users who have any active subscription."""
+    from datetime import datetime, timezone
+
+    now = datetime.now(timezone.utc)
+
+    stmt = (
+        select(func.count(func.distinct(Subscription.user_id)))
+        .join(User, Subscription.user_id == User.user_id)
+        .where(
+            and_(
+                User.is_banned == False,
+                Subscription.is_active == True,
+                Subscription.end_date > now,
+            )
+        )
+    )
+    result = await session.execute(stmt)
+    return int(result.scalar_one() or 0)
+
+
 async def get_user_ids_without_active_subscription(session: AsyncSession) -> List[int]:
     """Return non-banned user IDs who do NOT have any active subscription."""
     from datetime import datetime, timezone
@@ -919,6 +946,20 @@ async def get_user_ids_without_active_subscription(session: AsyncSession) -> Lis
     return result.scalars().all()
 
 
+async def count_users_without_active_subscription_for_broadcast(session: AsyncSession) -> int:
+    """Count non-banned users who do NOT have any active subscription."""
+    from datetime import datetime, timezone
+
+    now = datetime.now(timezone.utc)
+
+    stmt = select(func.count(User.user_id)).where(
+        User.is_banned == False,
+        ~_active_subscription_exists_for_user(now),
+    )
+    result = await session.execute(stmt)
+    return int(result.scalar_one() or 0)
+
+
 async def get_user_ids_without_any_subscription(session: AsyncSession) -> List[int]:
     """Return non-banned user IDs who never had any subscription or trial.
 
@@ -942,6 +983,24 @@ async def get_user_ids_without_any_subscription(session: AsyncSession) -> List[i
     return result.scalars().all()
 
 
+async def count_users_without_any_subscription_for_broadcast(session: AsyncSession) -> int:
+    """Count non-banned users who never had any subscription or trial."""
+    any_sub = aliased(Subscription)
+
+    stmt = (
+        select(func.count(User.user_id))
+        .outerjoin(any_sub, any_sub.user_id == User.user_id)
+        .where(
+            and_(
+                User.is_banned == False,
+                any_sub.user_id.is_(None),
+            )
+        )
+    )
+    result = await session.execute(stmt)
+    return int(result.scalar_one() or 0)
+
+
 def _expired_subscription_exists_for_user(now: datetime):
     expired_subs = aliased(Subscription)
     normalized_status = func.lower(func.coalesce(expired_subs.status_from_panel, ""))
@@ -988,6 +1047,20 @@ async def count_users_with_expired_subscription(session: AsyncSession) -> int:
     return int(result.scalar_one() or 0)
 
 
+async def count_users_with_expired_subscription_for_broadcast(session: AsyncSession) -> int:
+    """Count non-banned users with an expired subscription and no active one."""
+    from datetime import datetime, timezone
+
+    now = datetime.now(timezone.utc)
+    stmt = select(func.count(User.user_id)).where(
+        User.is_banned == False,
+        _expired_subscription_exists_for_user(now),
+        ~_active_subscription_exists_for_user(now),
+    )
+    result = await session.execute(stmt)
+    return int(result.scalar_one() or 0)
+
+
 async def get_user_ids_with_expired_subscription(session: AsyncSession) -> List[int]:
     """Return non-banned user IDs with an expired subscription and no active one."""
     from datetime import datetime, timezone

backend/db/migrator.py

@@ -1155,6 +1155,13 @@ def _migration_0035_add_subscription_promo_expiry_flag(connection: Connection) -
         )
 
 
+def _migration_0036_add_provider_payment_url(connection: Connection) -> None:
+    inspector = inspect(connection)
+    columns: Set[str] = {col["name"] for col in inspector.get_columns("payments")}
+    if "provider_payment_url" not in columns:
+        connection.execute(text("ALTER TABLE payments ADD COLUMN provider_payment_url VARCHAR"))
+
+
 MIGRATIONS: List[Migration] = [
     Migration(
         id="0001_add_channel_subscription_fields",
@@ -1342,6 +1349,11 @@ MIGRATIONS: List[Migration] = [
         description="Suppress multi-day expiry reminders for trial and bonus subscriptions",
         upgrade=_migration_0035_add_subscription_promo_expiry_flag,
     ),
+    Migration(
+        id="0036_add_provider_payment_url",
+        description="Persist provider payment links for reusable pending payments",
+        upgrade=_migration_0036_add_provider_payment_url,
+    ),
 ]
 
 

backend/db/models.py

@@ -203,6 +203,7 @@ class Payment(Base):
     user_id = Column(BigInteger, ForeignKey("users.user_id"), nullable=False, index=True)
     yookassa_payment_id = Column(String, unique=True, index=True, nullable=True)
     provider_payment_id = Column(String, unique=True, nullable=True)
+    provider_payment_url = Column(String, nullable=True)
     provider = Column(String, nullable=False, default="yookassa", index=True)
     idempotence_key = Column(String, unique=True, nullable=True)
     amount = Column(Float, nullable=False)