fix: connect button disappeard in web app

Previously the connect button in post-payment messages and in 'My subscription' section opened the mini app (personal cabinet) when SUBSCRIPTION_MINI_APP_URL was set, ignoring the actual subscription URL. Now the real subscription URL is preferred, with the mini app used only as a fallback.

.dockerignore

@@ -5,6 +5,13 @@
 .gitattributes
 LICENSE
 README.md
+.env
+.env.*
+!.env.example
+scratch_*.py
+*.local.*
+node_modules/
+.git/
 
 
 # CI
@@ -17,6 +24,12 @@ docker-compose.yml
 Dockerfile
 .docker
 .dockerignore
+tmp/
+
+# WebApp build artifacts (regenerated inside Docker)
+bot/app/web/templates/subscription_webapp.css
+bot/app/web/templates/subscription_webapp.js
+bot/app/web/templates/subscription_webapp.min.*.js
 
 # Byte-compiled / optimized / DLL files
 **/__pycache__/

.env.example

@@ -3,9 +3,9 @@ BOT_TOKEN=your_bot_token_here                                                 #
 ADMIN_IDS=comma_separated_admin_ids                                           # Your telegram ID
 
 # PostgreSQL Database Connection Settings
-POSTGRES_USER=postgres                                                        # Database user name
-POSTGRES_PASSWORD=postgres                                                    # Database password
-POSTGRES_HOST=remnawave-tg-shop-db                                            # Database container name
+POSTGRES_USER=                                                               # Required: database user name
+POSTGRES_PASSWORD=                                                           # Required: database password
+POSTGRES_HOST=remnawave-minishop-db                                           # Database container name
 POSTGRES_PORT=5432                                                            # Port
 POSTGRES_DB=postgres                                                          # Database name
 
@@ -17,7 +17,9 @@ DEFAULT_CURRENCY_SYMBOL="RUB"                                                 #
 SUPPORT_LINK=https://t.me/your_support_link                                   # Link to the support chat
 SERVER_STATUS_URL=https://status.yourdomain.tld/status/your_service           # Link to the server status page
 TERMS_OF_SERVICE_URL=https://example.com/tos                                  # Link to the terms of service
-SUBSCRIPTION_MINI_APP_URL=                                                    # URL of the subscription mini-app 
+PRIVACY_POLICY_URL=https://example.com/privacy                                # Link to the privacy policy
+USER_AGREEMENT_URL=https://example.com/user-agreement                          # Link to the user agreement
+SUBSCRIPTION_MINI_APP_URL=                                                    # Public URL of the subscription Mini App, e.g. https://app.yourdomain.tld/
 START_COMMAND_DESCRIPTION=                                                    # Description of the /start command
 DISABLE_WELCOME_MESSAGE=                                                      # Disable the welcome message
 MY_DEVICES_SECTION_ENABLED=False                                              # Enable the My Devices section in the subscription menu
@@ -29,17 +31,52 @@ REQUIRED_CHANNEL_LINK=https://t.me/your_channel                               #
 
 # Webhook Base URL (used for Telegram and payment providers)
 WEBHOOK_BASE_URL=https://webhooks.yourdomain.tld
+TRUSTED_PROXIES=127.0.0.1,::1                                                 # Reverse proxies trusted for X-Forwarded-For
+
+# Subscription Mini App (same container, separate port)
+WEBAPP_ENABLED=True                                                           # Run Mini App HTTP server
+WEBAPP_SERVER_HOST=0.0.0.0                                                    # Internal listen host
+WEBAPP_SERVER_PORT=8081                                                       # Internal/published Mini App port
+WEBAPP_TITLE="/minishop"                                                   # Mini App title
+WEBAPP_PRIMARY_COLOR="#00fe7a"                                                # Main UI color
+WEBAPP_LOGO_URL=                                                                    # Optional logo URL; if empty the emoji below is used
+WEBAPP_LOGO_EMOJI="🫥"                                                              # Emoji logo fallback shown in the header and login screen
+WEBAPP_SESSION_SECRET=                                                        # Optional: HMAC secret for webapp sessions; generated if empty
+WEBHOOK_SECRET_TOKEN=                                                         # Optional: Telegram webhook secret token; generated if empty
+WEBAPP_SESSION_TTL_SECONDS=86400                                              # Web App session lifetime (24h)
+WEBAPP_AUTH_MAX_AGE_SECONDS=86400                                             # Max Telegram initData age
+WEBAPP_LOGIN_TOKEN_TTL_SECONDS=600                                            # External browser login link lifetime
+TELEGRAM_OAUTH_CLIENT_ID=                                                     # Telegram Web Login Client ID from BotFather; defaults to bot ID from BOT_TOKEN
+TELEGRAM_OAUTH_CLIENT_SECRET=                                                 # Optional Telegram Web Login Client Secret; reserved for full OIDC code flow
+TELEGRAM_OAUTH_REQUEST_ACCESS=write                                           # Optional comma-separated permissions: write,phone; empty = OpenID profile only
+
+# Email login and account linking via SMTP (Brevo SMTP relay defaults)
+SMTP_HOST=smtp-relay.brevo.com                                               # SMTP server
+SMTP_PORT=587                                                                # Brevo recommends 587 with STARTTLS
+SMTP_FALLBACK_PORTS=2525,465                                                 # Tried after SMTP_PORT; 465 uses SSL automatically
+SMTP_TIMEOUT_SECONDS=30                                                      # Per SMTP connection/send attempt timeout
+SMTP_USERNAME=                                                               # Brevo SMTP login
+SMTP_PASSWORD=                                                               # Brevo SMTP key/password
+SMTP_FROM_EMAIL=                                                             # Verified sender email
+SMTP_FROM_NAME=                                                              # Optional sender name
+SMTP_STARTTLS=True                                                           # Use STARTTLS on SMTP_PORT
+SMTP_USE_SSL=False                                                           # Use SSL wrapper, usually only for port 465
+EMAIL_CODE_TTL_SECONDS=600                                                   # Email verification code lifetime
+EMAIL_CODE_RESEND_SECONDS=60                                                 # Minimum delay between code sends
+EMAIL_CODE_MAX_ATTEMPTS=5                                                    # Max attempts per code
+BRUTE_FORCE_MAX_FAILURES=5                                                   # Max failed code attempts in the throttle window
+BRUTE_FORCE_WINDOW_SECONDS=900                                               # Rolling window used to count failures
+BRUTE_FORCE_LOCK_SECONDS=1800                                                # Temporary lockout duration after too many failures
 
 # Payment Method Toggles
 YOOKASSA_ENABLED=True                                                         # Turn on YOOKASSA
 FREEKASSA_ENABLED=True                                                        # Turn on FreeKassa
 STARS_ENABLED=True                                                            # Turn on STARS
-TRIBUTE_ENABLED=True                                                          # Turn on TRIBUTE
 CRYPTOPAY_ENABLED=True                                                        # Turn on CRYPTOPAY
 PLATEGA_ENABLED=False                                                         # Turn on PLATEGA
 SEVERPAY_ENABLED=False                                                        # Turn on SeverPay
-# Order of payment methods (top to bottom). Supported: severpay, freekassa, platega, yookassa, tribute, stars, cryptopay
-PAYMENT_METHODS_ORDER=severpay,yookassa,cryptopay,freekassa,platega,tribute,stars
+# Order of payment methods (top to bottom). Supported: severpay, freekassa, platega, yookassa, stars, cryptopay
+PAYMENT_METHODS_ORDER=severpay,yookassa,cryptopay,freekassa,platega,stars
 
 # YooKassa Payment Gateway Configuration
 YOOKASSA_SHOP_ID=your_shop_id                                                 # Your store ID in YooKassa
@@ -53,6 +90,8 @@ YOOKASSA_AUTOPAYMENTS_REQUIRE_CARD_BINDING=True                               #
 # Nalogo (self-employed receipts)
 NALOGO_INN=your_inn                                                           # INN for nalog.ru
 NALOGO_PASSWORD=your_nalogo_password                                          # Password for nalog.ru
+NALOGO_RECEIPT_NAME_SUBSCRIPTION=subscription {months} months                 # Receipt name for time-based subscriptions ({months} = duration)
+NALOGO_RECEIPT_NAME_TRAFFIC=traffic package {gb} GB                           # Receipt name for traffic packages ({gb} = traffic amount)
 
 # FreeKassa Payment Gateway Configuration
 FREEKASSA_MERCHANT_ID=your_shop_id                                            # Your shop ID in FreeKassa
@@ -60,6 +99,7 @@ FREEKASSA_API_KEY=your_api_key                                                #
 FREEKASSA_SECOND_SECRET=your_second_secret                                    # Secret word #2 (used to verify notifications)
 FREEKASSA_PAYMENT_IP=                                                         # Public IP address reported to FreeKassa
 FREEKASSA_PAYMENT_METHOD_ID=44                                                # Payment method ID, you can get it from https://merchant.freekassa.net/settings/currencies
+FREEKASSA_TRUSTED_IPS=168.119.157.136,168.119.60.227,178.154.197.79,51.250.54.238 # FreeKassa webhook source IP allowlist
 
 # CryptoBot Payment Gateway Configuration
 CRYPTOPAY_TOKEN=                                                              # API token for CryptoPay
@@ -71,7 +111,11 @@ CRYPTOPAY_ASSET=RUB                                                           #
 PLATEGA_BASE_URL=https://app.platega.io                                       # Base API URL
 PLATEGA_MERCHANT_ID=                                                          # Your MerchantId from Platega
 PLATEGA_SECRET=                                                               # API secret from Platega
-PLATEGA_PAYMENT_METHOD=2                                                      # Payment method ID (2=SBP QR, 10=RU cards, 12=International, 13=Crypto)
+PLATEGA_PAYMENT_METHOD=2                                                      # Legacy method ID; fallback for the SBP button when PLATEGA_SBP_METHOD stays default
+PLATEGA_SBP_ENABLED=False                                                     # Show a separate "Pay via SBP" Platega button
+PLATEGA_CRYPTO_ENABLED=False                                                  # Show a separate "Pay with crypto" Platega button
+PLATEGA_SBP_METHOD=2                                                          # Platega method ID for SBP QR (default 2)
+PLATEGA_CRYPTO_METHOD=13                                                      # Platega method ID for crypto (default 13)
 PLATEGA_RETURN_URL=                                                           # Optional: redirect after successful payment (defaults to bot link)
 PLATEGA_FAILED_URL=                                                           # Optional: redirect after failed/cancelled payment (defaults to return URL)
 
@@ -82,31 +126,22 @@ SEVERPAY_TOKEN=                                                               #
 SEVERPAY_RETURN_URL=                                                          # Optional: redirect URL after payment (defaults to bot link)
 SEVERPAY_LIFETIME_MINUTES=                                                    # Optional: payment link lifetime in minutes (30-4320, leave empty for default)
 
-# Tribute Payment Gateway Configuration
-TRIBUTE_API_KEY=                                                              # API key for verifying Tribute webhook signatures
-TRIBUTE_SKIP_NOTIFICATIONS=True                                               # Skip renewal notifications for Tribute payments
-TRIBUTE_SKIP_CANCELLATION_NOTIFICATIONS=False                                 # Skip cancellation notifications for Tribute payments
-
 # Subscription Options. Specify cost parameters or payment links here.
 1_MONTH_ENABLED=True
 RUB_PRICE_1_MONTH=150
 STARS_PRICE_1_MONTH=0
-TRIBUTE_LINK_1_MONTH=
 
 3_MONTHS_ENABLED=True
 RUB_PRICE_3_MONTHS=300
 STARS_PRICE_3_MONTHS=0
-TRIBUTE_LINK_3_MONTHS=
 
 6_MONTHS_ENABLED=True
 RUB_PRICE_6_MONTHS=500
 STARS_PRICE_6_MONTHS=0
-TRIBUTE_LINK_6_MONTHS=
 
 12_MONTHS_ENABLED=True
 RUB_PRICE_12_MONTHS=900
 STARS_PRICE_12_MONTHS=0
-TRIBUTE_LINK_12_MONTHS=
 
 # Traffic Packages (enables traffic sale mode when set)
 TRAFFIC_PACKAGES=10:199,50:799                                                # Format: "<GB>:<price>", comma-separated
@@ -120,6 +155,7 @@ SUBSCRIPTION_NOTIFY_DAYS_BEFORE=3                                             #
 
 
 REFERRAL_ONE_BONUS_PER_REFEREE=False                                          # Give a bonus only once per referee
+REFERRAL_WELCOME_BONUS_DAYS=3                                                 # Welcome bonus for newly registered user from referral link
 LEGACY_REFS=true                                                              # Allow ref_<tg_id> links. Leave unset/true unless you want to disable old links
 # Referral Bonus Days
 # Bonus for the inviting user

.github/workflows/dev-docker-build.yml

@@ -1,68 +0,0 @@
-name: Build and Push Dev Docker Image
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-    branches:
-      - dev
-
-env:
-  GHCR_REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  DOCKERHUB_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Log in to GitHub Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.GHCR_REGISTRY }}
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Log in to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-    - name: Extract metadata (tags, labels) for Docker
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: |
-          ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
-          ${{ env.DOCKERHUB_IMAGE }}
-        tags: |
-          type=ref,event=branch
-          type=ref,event=pr
-          type=sha,prefix={{branch}}-
-        flavor: |
-          latest=false
-
-    - name: Build and push Docker image
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
-
-    - name: Image digest
-      run: echo ${{ steps.meta.outputs.digest }}

.github/workflows/docker-publish.yml

@@ -1,56 +0,0 @@
-name: Build and Publish multi-arch Docker Image
-
-on:
-  push:
-    branches:
-      - main
-    tags:
-      - 'v*.*.*'
-    paths-ignore:
-      - 'README.md'
-
-env:
-  GHCR_IMAGE: ghcr.io/${{ github.repository }}
-  DOCKERHUB_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Set up QEMU (для эмуляции arm64 на x86)
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push multi-arch Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ${{ env.GHCR_IMAGE }}:latest
-            ${{ env.GHCR_IMAGE }}:${{ github.ref_name }}
-            ${{ env.DOCKERHUB_IMAGE }}:latest
-            ${{ env.DOCKERHUB_IMAGE }}:${{ github.ref_name }}

.gitignore

@@ -3,6 +3,19 @@ bot_database.sqlite3
 
 # Игнорировать файлы окружения
 .env
+.env.*
+!.env.example
+scratch_*.py
+*.local.*
+node_modules/
+.git/
+
+# WebApp build artifacts (regenerated by `npm run build:webapp` / Docker build)
+bot/app/web/templates/subscription_webapp.css
+bot/app/web/templates/subscription_webapp.js
+bot/app/web/templates/subscription_webapp.min.*.js
+tmp
+.claude
 
 # Игнорировать кэш Python
 __pycache__/
@@ -17,3 +30,5 @@ __pycache__/
 locales/ru_backup.json
 locales/en_backup.json
 db/models_old.py
+config/tariffs.json
+docker-compose-dev.yml

Caddyfile

@@ -0,0 +1,10 @@
+# Replace the example domains below with your real webhook and Mini App hostnames.
+webhook.domain.com {
+	encode zstd gzip
+	reverse_proxy remnawave-minishop:{$WEB_SERVER_PORT:8080}
+}
+
+app.domain.com {
+	encode zstd gzip
+	reverse_proxy remnawave-minishop:{$WEBAPP_SERVER_PORT:8081}
+}

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-slim AS builder
+FROM python:3.12-slim AS python-builder
 
 WORKDIR /app
 
@@ -7,14 +7,49 @@ COPY requirements.txt .
 RUN --mount=type=cache,target=/root/.cache/pip \
     pip install --no-cache-dir -r requirements.txt
 
+
+FROM node:22-slim AS webapp-builder
+
+WORKDIR /webapp
+
+COPY package.json package-lock.json* ./
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f package-lock.json ]; then npm ci; else npm install; fi
+
+COPY bot/app/web/frontend ./bot/app/web/frontend
+COPY bot/app/web/templates ./bot/app/web/templates
+COPY scripts/build_subscription_webapp_js.mjs ./scripts/build_subscription_webapp_js.mjs
+
+RUN npm run build:webapp
+
+
 FROM python:3.12-slim
 
 WORKDIR /app
- 
-COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+
+LABEL org.opencontainers.image.source="https://github.com/3252a8/remnawave-minishop"
+
+RUN useradd -u 10001 -m appuser
+
+COPY --from=python-builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
 
 COPY . .
 
+# Replace template assets with freshly built ones
+RUN rm -f bot/app/web/templates/subscription_webapp.css \
+          bot/app/web/templates/subscription_webapp.js \
+          bot/app/web/templates/subscription_webapp.min.*.js
+COPY --from=webapp-builder /webapp/bot/app/web/templates/subscription_webapp.css \
+                           bot/app/web/templates/subscription_webapp.css
+COPY --from=webapp-builder /webapp/bot/app/web/templates/subscription_webapp.js \
+                           bot/app/web/templates/subscription_webapp.js
+COPY --from=webapp-builder /webapp/bot/app/web/templates/subscription_webapp.min.*.js \
+                           bot/app/web/templates/
+
 RUN rm -rf /root/.cache
 
+RUN mkdir -p /app/logs /app/data && chown -R appuser:appuser /app/logs /app/data
+
+USER appuser
+
 CMD ["python", "main.py"]

README.md

@@ -1,17 +1,21 @@
-# Telegram-бот для продажи подписок Remnawave
+# Remnawave Minishop
 
-Этот Telegram-бот предназначен для автоматизации продажи и управления подписками для панели **Remnawave**. Он интегрируется с API Remnawave для управления пользователями и подписками, а также использует различные платежные системы для приема платежей.
+Remnawave Minishop — это Telegram-бот **и** Web App (Mini App) для автоматизации продажи и управления подписками панели **Remnawave**. Бот закрывает сценарий покупки, продления и работы с поддержкой прямо в чате, а Web App в едином интерфейсе показывает ссылку подключения, остаток времени, трафик, оплату и устройства, поддерживая вход через Telegram Mini Apps `initData`, новый Telegram OAuth / OpenID Connect Login и одноразовый код по email. Под капотом — интеграция с API Remnawave для управления пользователями и подписками и набор платёжных шлюзов для приёма платежей.
+
+> 🍴 **Это глубоко переработанный форк [kavore/remnawave-tg-shop](https://github.com/kavore/remnawave-tg-shop).** Здесь добавлены полноценный Web App / Mini App, вход по email и многое другое. Возможна миграция.
 
 ## ✨ Ключевые возможности
 
 ### Для пользователей:
 -   **Регистрация и выбор языка:** Поддержка русского и английского языков.
 -   **Просмотр подписки:** Пользователи могут видеть статус своей подписки, дату окончания и ссылку на конфигурацию.
+-   **Web App (Mini App):** отдельный веб-интерфейс для просмотра ссылки подключения, остатка времени и оплаты подписки.
+-   **Вход по email:** вход и регистрация в Web App по коду из письма, а также привязка email и Telegram к одному аккаунту.
 -   **Мои устройства:** Опциональный раздел для просмотра и отключения подключенных устройств (активируется через переменную `MY_DEVICES_SECTION_ENABLED`).
 -   **Пробная подписка:** Система пробных подписок для новых пользователей (активируется вручную по кнопке).
 -   **Промокоды:** Возможность применять промокоды для получения скидок или бонусных дней.
 -   **Реферальная программа:** Пользователи могут приглашать друзей и получать за это бонусные дни подписки.
-    -   **Оплата:** Поддержка оплаты через YooKassa, FreeKassa (REST API), Platega, SeverPay, CryptoPay и Telegram Stars.
+-   **Оплата:** Поддержка оплаты через YooKassa, FreeKassa (REST API), Platega, SeverPay, CryptoPay и Telegram Stars.
 
 ### Для администраторов:
 -   **Защищенная админ-панель:** Доступ только для администраторов, указанных в `ADMIN_IDS`.
@@ -45,12 +49,12 @@
 
 1.  **Клонируйте репозиторий:**
     ```bash
-    git clone https://github.com/machka-pasla/remnawave-tg-shop
-    cd remnawave-tg-shop
+    git clone https://github.com/3252a8/remnawave-minishop
+    cd remnawave-minishop
     ```
 
 2.  **Создайте и настройте файл `.env`:**
-    Скопируйте `env.example` в `.env` и заполните своими данными.
+    Скопируйте `.env.example` в `.env` и заполните своими данными.
     ```bash
     cp .env.example .env
     nano .env 
@@ -66,8 +70,32 @@
     | `ADMIN_IDS` | **Обязательно.** ID администраторов в Telegram через запятую. | `12345678,98765432` |
     | `DEFAULT_LANGUAGE` | Язык по умолчанию для новых пользователей. | `ru` |
     | `SUPPORT_LINK` | (Опционально) Ссылка на поддержку. | `https://t.me/your_support` |
-    | `SUBSCRIPTION_MINI_APP_URL` | (Опционально) URL Mini App для показа подписки. | `https://t.me/your_bot/app` |
+    | `PRIVACY_POLICY_URL` | (Опционально) Ссылка на политику конфиденциальности, показывается внизу Web App. | `https://example.com/privacy` |
+    | `USER_AGREEMENT_URL` | (Опционально) Ссылка на пользовательское соглашение, показывается внизу Web App. | `https://example.com/agreement` |
+    | `SUBSCRIPTION_MINI_APP_URL` | (Опционально) Публичный URL Mini App для показа подписки. Если задан, кнопка «Моя подписка» откроет Web App. | `https://app.domain.com/` |
+    | `WEBAPP_ENABLED` | Включить Web App в том же контейнере, но на отдельном порту. | `true` |
+    | `WEBAPP_SERVER_PORT` | Внутренний порт Web App. | `8081` |
+    | `WEBAPP_TITLE` | Заголовок Web App. | `Моя подписка` |
+    | `WEBAPP_PRIMARY_COLOR` | Основной цвет Web App. | `#00fe7a` |
+    | `WEBAPP_LOGO_URL` | (Опционально) URL логотипа Web App. Если значение пустое, логотип не показывается вообще; если задано, он отображается в шапке и на экране логина. | `https://domain.com/logo.png` |
+    | `TELEGRAM_OAUTH_CLIENT_ID` | Client ID для нового Telegram OAuth / OpenID Connect Login из BotFather. Если пусто, используется числовой ID из `BOT_TOKEN`. | `1234567890` |
+    | `TELEGRAM_OAUTH_CLIENT_SECRET` | Client Secret из BotFather для Telegram OAuth Authorization Code Flow. | `tg_oauth_secret` |
+    | `TELEGRAM_OAUTH_REQUEST_ACCESS` | Дополнительные разрешения Telegram Login через запятую: `write`, `phone`. Пустое значение запрашивает только OpenID profile. | `write` |
+    | `SMTP_HOST` | SMTP-сервер для кодов входа по email. Для Brevo: `smtp-relay.brevo.com`. | `smtp-relay.brevo.com` |
+    | `SMTP_PORT` | SMTP-порт. Для Brevo обычно используется 587 с STARTTLS. | `587` |
+    | `SMTP_FALLBACK_PORTS` | Дополнительные SMTP-порты через запятую. Пробуются после `SMTP_PORT`; порт `465` автоматически используется через SSL. Для Brevo удобно оставить `2525,465`. | `2525,465` |
+    | `SMTP_TIMEOUT_SECONDS` | Timeout для каждой SMTP-попытки подключения и отправки. | `30` |
+    | `SMTP_USERNAME` / `SMTP_PASSWORD` | Логин и SMTP key/password из Brevo. Если не заданы вместе с `SMTP_FROM_EMAIL`, вход по email скрывается. | `user@smtp-brevo.com` |
+    | `SMTP_FROM_EMAIL` / `SMTP_FROM_NAME` | Подтвержденный отправитель и отображаемое имя отправителя для писем с кодом. | `no-reply@example.com` |
+    | `EMAIL_CODE_TTL_SECONDS` | Срок действия кода подтверждения email. | `600` |
+    | `EMAIL_CODE_RESEND_SECONDS` | Минимальная пауза между отправками кода на один email. | `60` |
+    | `EMAIL_CODE_MAX_ATTEMPTS` | Максимум попыток на один конкретный код. | `5` |
+    | `BRUTE_FORCE_MAX_FAILURES` | Максимум неудачных попыток в окне защиты от перебора. | `5` |
+    | `BRUTE_FORCE_WINDOW_SECONDS` | Длительность окна, в котором считаются неудачные попытки. | `900` |
+    | `BRUTE_FORCE_LOCK_SECONDS` | Время временной блокировки после превышения лимита. | `1800` |
     | `MY_DEVICES_SECTION_ENABLED` | Включить раздел «Мои устройства» в меню подписки (`true`/`false`). | `false` |
+    | `WEBAPP_SESSION_SECRET` | (Опционально) HMAC-секрет для подписи сессий Web App. Если пусто — генерируется при старте, но тогда сессии станут невалидными после перезапуска контейнера. Для прода задайте явно. | `см. раздел «Генерация секретов»` |
+    | `WEBHOOK_SECRET_TOKEN` | (Опционально) Secret token для проверки подлинности вебхуков Telegram. Если пусто — генерируется при старте. Для прода задайте явно, чтобы значение пережило рестарт. | `см. раздел «Генерация секретов»` |
     | `REQUIRED_CHANNEL_ID` | (Опционально) ID канала, на который пользователь должен подписаться перед использованием. Оставьте пустым, если проверка не нужна. | `-1001234567890` |
     | `REQUIRED_CHANNEL_LINK` | (Опционально) Публичная ссылка или invite на канал для кнопки «Проверить подписку». | `https://t.me/your_channel` |
     </details>
@@ -77,13 +105,15 @@
 
     | Переменная | Описание |
     | --- | --- |
-    | `WEBHOOK_BASE_URL`| **Обязательно.** Базовый URL для вебхуков, например `https://your.domain.com`. |
-    | `WEB_SERVER_HOST` | Хост для веб-сервера. | `0.0.0.0` |
-    | `WEB_SERVER_PORT` | Порт для веб-сервера. | `8080` |
+    | `WEBHOOK_BASE_URL` | **Обязательно.** Базовый URL для вебхуков, например `https://your.domain.com`. |
+    | `WEB_SERVER_HOST` | Хост для веб-сервера (по умолчанию `0.0.0.0`). |
+    | `WEB_SERVER_PORT` | Порт для веб-сервера (по умолчанию `8080`). |
+    | `WEBAPP_SERVER_HOST` | Хост отдельного веб-сервера Mini App (по умолчанию `0.0.0.0`). |
+    | `WEBAPP_SERVER_PORT` | Порт отдельного веб-сервера Mini App (по умолчанию `8081`). |
     | `PAYMENT_METHODS_ORDER` | (Опционально) Порядок отображения кнопок оплаты через запятую. Поддерживаемые ключи: `severpay`, `freekassa`, `platega`, `yookassa`, `stars`, `cryptopay`. Первый будет сверху. |
     | `YOOKASSA_ENABLED` | Включить/выключить YooKassa (`true`/`false`). |
     | `YOOKASSA_SHOP_ID` | ID вашего магазина в YooKassa. |
-    | `YOOKASSA_SECRET_KEY`| Секретный ключ магазина YooKassa. |
+    | `YOOKASSA_SECRET_KEY` | Секретный ключ магазина YooKassa. |
     | `YOOKASSA_AUTOPAYMENTS_ENABLED` | Включить автопродление (сохранение карт, автосписания, управление способами оплаты). |
     | `YOOKASSA_AUTOPAYMENTS_REQUIRE_CARD_BINDING` | Требовать обязательную привязку карты при оплате с автосписанием. Установите `false`, чтобы пользователю показывался чекбокс «Сохранить карту». |
     | `NALOGO_INN` | ИНН для авторизации в nalog.ru (самозанятый). |
@@ -98,12 +128,12 @@
     | `FREEKASSA_PAYMENT_IP` | Внешний IP вашего сервера, который будет передаваться в запрос оплаты. |
     | `FREEKASSA_PAYMENT_METHOD_ID` | ID метода оплаты через магазин FreeKassa. По умолчанию `44`. |
     | `STARS_ENABLED` | Включить/выключить Telegram Stars (`true`/`false`). |
-    | `PLATEGA_ENABLED`| Включить/выключить Platega (`true`/`false`). |
-    | `PLATEGA_MERCHANT_ID`| MerchantId из личного кабинета Platega. |
-    | `PLATEGA_SECRET`| API секрет для запросов Platega. |
-    | `PLATEGA_PAYMENT_METHOD`| ID способа оплаты (2 — SBP QR, 10 — РФ карты, 12 — международные карты, 13 — crypto). |
-    | `PLATEGA_RETURN_URL`| (Опционально) URL редиректа после успешной оплаты. По умолчанию ссылка на бота. |
-    | `PLATEGA_FAILED_URL`| (Опционально) URL редиректа при ошибке/отмене. По умолчанию как `PLATEGA_RETURN_URL`. |
+    | `PLATEGA_ENABLED` | Включить/выключить Platega (`true`/`false`). |
+    | `PLATEGA_MERCHANT_ID` | MerchantId из личного кабинета Platega. |
+    | `PLATEGA_SECRET` | API секрет для запросов Platega. |
+    | `PLATEGA_PAYMENT_METHOD` | ID способа оплаты (2 — SBP QR, 10 — РФ карты, 12 — международные карты, 13 — crypto). |
+    | `PLATEGA_RETURN_URL` | (Опционально) URL редиректа после успешной оплаты. По умолчанию ссылка на бота. |
+    | `PLATEGA_FAILED_URL` | (Опционально) URL редиректа при ошибке/отмене. По умолчанию как `PLATEGA_RETURN_URL`. |
     | `SEVERPAY_ENABLED` | Включить/выключить SeverPay (`true`/`false`). |
     | `SEVERPAY_MID` | MID магазина в SeverPay. |
     | `SEVERPAY_TOKEN` | Секрет/токен для подписи запросов SeverPay. |
@@ -113,13 +143,11 @@
     </details>
 
     <details>
-    <summary><b>Настройки подписок</b></summary>
+    <summary><b>Настройки тарифов</b></summary>
 
-    Для каждого периода (1, 3, 6, 12 месяцев) можно настроить доступность и цены:
-    - `1_MONTH_ENABLED`: `true` или `false`
-    - `RUB_PRICE_1_MONTH`: Цена в рублях
-    - `STARS_PRICE_1_MONTH`: Цена в Telegram Stars
-    Аналогичные переменные есть для `3_MONTHS`, `6_MONTHS`, `12_MONTHS`.
+    Бот умеет продавать **подписку на срок** (1/3/6/12 мес.) или **пакеты трафика** (`TRAFFIC_PACKAGES=10:199,50:799`). Эти режимы взаимоисключающие — наличие непустой `TRAFFIC_PACKAGES` (или `STARS_TRAFFIC_PACKAGES`) автоматически переключает бот в режим продажи трафика.
+
+    Полное описание обоих режимов, переменных, что происходит при покупке, как ведут себя автопродление, реф-бонусы и триал — вынесено в [docs/tariffs.md](docs/tariffs.md).
     </details>
 
     <details>
@@ -148,71 +176,389 @@
     | `TRIAL_TRAFFIC_LIMIT_GB`| Лимит трафика для пробного периода в ГБ. |
     </details>
 
-3.  **Запустите контейнеры:**
+3.  **Сгенерируйте секреты (рекомендуется):**
+
+    Переменные `WEBAPP_SESSION_SECRET` и `WEBHOOK_SECRET_TOKEN` могут быть пустыми — тогда они автоматически сгенерируются при каждом старте контейнера. Однако в проде это означает, что после рестарта все сессии Web App станут невалидными, а Telegram придётся перерегистрировать webhook. Поэтому для боевого окружения задайте оба значения вручную.
+
+    Сгенерировать криптостойкие значения можно одной из команд:
+
+    ```bash
+    # вариант 1 — Python (есть в любом окружении с Python 3)
+    python -c "import secrets; print(secrets.token_urlsafe(32))"
+
+    # вариант 2 — openssl
+    openssl rand -base64 32 | tr -d '=+/' | cut -c1-43
+
+    # вариант 3 — /dev/urandom (Linux/macOS)
+    head -c 32 /dev/urandom | base64 | tr -d '=+/' | cut -c1-43
+    ```
+
+    Запустите команду дважды и подставьте полученные значения в `.env`:
+
+    ```env
+    WEBAPP_SESSION_SECRET=<первое_значение>
+    WEBHOOK_SECRET_TOKEN=<второе_значение>
+    ```
+
+    > ⚠️ Не используйте одно и то же значение для обеих переменных и не коммитьте `.env` в git.
+
+4.  **Запустите контейнеры:**
     ```bash
     docker compose up -d
     ```
-    Эта команда скачает образ и запустит сервис в фоновом режиме.
+    Эта команда соберёт образ из `Dockerfile` (Python + сборка Web App на Node) и запустит сервис в фоновом режиме. Если нужен запуск из готового образа GHCR — используйте `docker-compose-remote-server.yml`.
 
-4.  **Настройка вебхуков (Обязательно):**
+5.  **Настройка вебхуков (Обязательно):**
     Вебхуки являются **обязательным** компонентом для работы бота, так как они используются для получения уведомлений от платежных систем (YooKassa, FreeKassa, CryptoPay, Platega, SeverPay) и панели Remnawave.
 
     Вам понадобится обратный прокси (например, Nginx) для обработки HTTPS-трафика и перенаправления запросов на контейнер с ботом.
 
     **Пути для перенаправления:**
-    -   `https://<ваш_домен>/webhook/yookassa` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/yookassa`
-    -   `https://<ваш_домен>/webhook/freekassa` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/freekassa`
-    -   `https://<ваш_домен>/webhook/platega` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/platega`
-    -   `https://<ваш_домен>/webhook/severpay` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/severpay`
-    -   `https://<ваш_домен>/webhook/cryptopay` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/cryptopay`
-    -   `https://<ваш_домен>/webhook/panel` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/panel`
+    -   `https://<ваш_домен>/webhook/yookassa` → `http://remnawave-minishop:<WEB_SERVER_PORT>/webhook/yookassa`
+    -   `https://<ваш_домен>/webhook/freekassa` → `http://remnawave-minishop:<WEB_SERVER_PORT>/webhook/freekassa`
+    -   `https://<ваш_домен>/webhook/platega` → `http://remnawave-minishop:<WEB_SERVER_PORT>/webhook/platega`
+    -   `https://<ваш_домен>/webhook/severpay` → `http://remnawave-minishop:<WEB_SERVER_PORT>/webhook/severpay`
+    -   `https://<ваш_домен>/webhook/cryptopay` → `http://remnawave-minishop:<WEB_SERVER_PORT>/webhook/cryptopay`
+    -   `https://<ваш_домен>/webhook/panel` → `http://remnawave-minishop:<WEB_SERVER_PORT>/webhook/panel`
     -   **Для Telegram:** Бот автоматически установит вебхук, если в `.env` указан `WEBHOOK_BASE_URL`. Путь будет `https://<ваш_домен>/<BOT_TOKEN>`.
 
-    Где `remnawave-tg-shop` — это имя сервиса из `docker-compose.yml`, а `<WEB_SERVER_PORT>` — порт, указанный в `.env`.
+    Где `remnawave-minishop` — это имя сервиса из `docker-compose.yml`, а `<WEB_SERVER_PORT>` — порт, указанный в `.env`.
 
-5.  **Просмотр логов:**
+    **Отдельный порт Web App:**
+    -   `https://<домен_web_app>/` → `http://remnawave-minishop:<WEBAPP_SERVER_PORT>/`
+
+    Web App не должен проксироваться на `WEB_SERVER_PORT`: этот порт оставьте для Telegram, платежных и Remnawave webhooks.
+
+6.  **Просмотр логов:**
     ```bash
-    docker compose logs -f remnawave-tg-shop
+    docker compose logs -f remnawave-minishop
     ```
 
     > 💡 Если включена проверка подписки на канал (`REQUIRED_CHANNEL_ID`), добавьте бота администратором в этот канал. Пользователь увидит кнопку «Проверить подписку», и, после первого успешного подтверждения, дальнейшие действия блокироваться не будут.
 
+### Настройка Web App / Mini App
+
+Web App запускается в том же контейнере, что и бот, но слушает отдельный порт `WEBAPP_SERVER_PORT` (по умолчанию `8081`). Внутри Telegram пользователь авторизуется через Telegram Mini Apps `initData`; если страницу открыть вне Telegram, используется новый Telegram OAuth / OpenID Connect Authorization Code Flow с PKCE, callback `/auth/telegram/callback`, `nonce` и серверной проверкой `id_token` по JWKS Telegram. Старый Login Widget больше не используется в UI. Также доступен вход по email через одноразовый код из письма, если настроен SMTP: после отправки письма код вводится в отдельном модальном окне подтверждения. После успешного входа страница обновляет данные сразу, без сообщений боту.
+
+1.  Укажите в `.env` публичный URL Web App и порт:
+
+    ```env
+    WEBAPP_ENABLED=True
+    WEBAPP_SERVER_HOST=0.0.0.0
+    WEBAPP_SERVER_PORT=8081
+    SUBSCRIPTION_MINI_APP_URL=https://app.domain.com/
+    WEBAPP_TITLE="Моя подписка"
+    WEBAPP_PRIMARY_COLOR="#00fe7a"
+    WEBAPP_LOGO_URL=
+    TELEGRAM_OAUTH_CLIENT_ID=<client-id-из-botfather>
+    TELEGRAM_OAUTH_CLIENT_SECRET=<client-secret-из-botfather>
+    TELEGRAM_OAUTH_REQUEST_ACCESS=write
+    SMTP_HOST=smtp-relay.brevo.com
+    SMTP_PORT=587
+    SMTP_FALLBACK_PORTS=2525,465
+    SMTP_USERNAME=<brevo-smtp-login>
+    SMTP_PASSWORD=<brevo-smtp-key>
+    SMTP_FROM_EMAIL=no-reply@domain.com
+    ```
+
+    Если основной порт не отвечает, отправка письма автоматически пробует fallback-порты из `SMTP_FALLBACK_PORTS`. Для Brevo типичная схема: `587` с STARTTLS, затем `2525`, затем `465` через SSL.
+
+2.  Убедитесь, что `docker-compose.yml` публикует порт Web App:
+
+    ```yaml
+    ports:
+      - 127.0.0.1:8080:8080
+      - 127.0.0.1:${WEBAPP_SERVER_PORT:-8081}:${WEBAPP_SERVER_PORT:-8081}
+    ```
+
+3.  Проксируйте отдельный домен или location на порт Web App:
+
+    ```nginx
+    upstream remnawave-minishop-webapp {
+        server remnawave-minishop:8081;
+    }
+
+    server {
+        server_name app.domain.com;
+        listen 443 ssl;
+        http2 on;
+
+        ssl_certificate "/etc/nginx/ssl/app_fullchain.pem";
+        ssl_certificate_key "/etc/nginx/ssl/app_privkey.key";
+
+        location / {
+            proxy_pass http://remnawave-minishop-webapp;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+    ```
+
+4.  В BotFather настройте бота, Mini App и Telegram OAuth Login:
+
+    - `@BotFather` → `/mybots` → выберите бота.
+    - **Bot Settings → Domain**: укажите домен без протокола и пути, например `app.domain.com`.
+    - **Bot Settings → Mini Apps**: задайте URL Mini App, например `https://app.domain.com/`.
+    - **Bot Settings → Web Login**: если BotFather показывает кнопку `Switch to OpenID Connect Login`, нажмите ее.
+    - **Bot Settings → Web Login**: скопируйте Client ID и Client Secret в `TELEGRAM_OAUTH_CLIENT_ID` и `TELEGRAM_OAUTH_CLIENT_SECRET`.
+    - **Web Login → Allowed URLs**: добавьте:
+      `https://app.domain.com/`
+      `https://app.domain.com/auth/telegram/callback`
+    - `TELEGRAM_OAUTH_REQUEST_ACCESS=write` разрешает боту написать пользователю после логина. Если дополнительные разрешения не нужны, оставьте переменную пустой.
+
+5.  Перезапустите контейнер:
+
+    ```bash
+    docker compose up -d --build
+    ```
+
+После этого кнопка «Личный кабинет» в меню бота откроет Web App. Рядом доступна кнопка «Бот-меню» для открытия расширенного интерфейса в чате без команды `/tg`, но основной сценарий управления подпиской удобнее проходить в личном кабинете. Web App показывает текущую ссылку подключения, остаток времени, трафик, оплату и блок аккаунта. Пользователь может привязать email к Telegram-аккаунту через код из письма или привязать Telegram к email-аккаунту через Telegram OAuth Login. После привязки вход работает обоими способами.
+
+Реферальные ссылки доступны в двух форматах: Telegram deep-link `https://t.me/<bot>?start=ref_u<code>` и Web App ссылка с query-параметром `ref=u<code>`. Web App учитывает `ref`, `start`, `start_param` и Telegram Mini Apps `start_param`, сохраняет найденный параметр до авторизации и передаёт его в Telegram OAuth и email-вход, чтобы регистрация корректно привязалась к пригласившему.
+
+Для email-регистраций пользователь в панели Remnawave создается с анонимным username вида `em_<referral_code>`; email добавляется в описание пользователя панели и, если API панели принимает поле email, передается отдельным полем. Для Telegram-регистраций сохраняется существующая схема `tg_<telegram_id>`.
+
+## Подробная инструкция для развертывания на сервере с панелью Remnawave
+
+### 1. Клонирование репозитория
+
+```bash
+git clone https://github.com/3252a8/remnawave-minishop && cd remnawave-minishop
+```
+
+### 2. Настройка переменных окружения
+
+```bash
+cp .env.example .env && nano .env
+```
+
+**Обязательные поля для заполнения:**
+- `BOT_TOKEN` - токен телеграмм бота, например, `234567890:ABC-DEF1234ghIkl-zyx57W2v1u123ew11`
+- `ADMIN_IDS` - TG ID администраторов, например, `12345678,98765432` и т.д. (через запятую без пробелов)
+- `WEBHOOK_BASE_URL` - Обязательно. Базовый URL для вебхуков, например `https://webhook.domain.com`
+- `PANEL_API_URL` - URL API вашей панели Remnawave (например, `http://remnawave:3000/api` или `https://panel.domain.com/api`)
+- `PANEL_API_KEY` - API ключ для доступа к панели (генерируется из UI-интерфейса панели)
+- `PANEL_WEBHOOK_SECRET` - Секретный ключ для проверки вебхуков от панели (берётся из `.env` самой панели)
+- `USER_SQUAD_UUIDS` - ID отрядов для новых пользователей
+
+### 3. Настройка Reverse Proxy (Nginx)
+
+Перейдите в директорию конфигурации Nginx панели Remnawave:
+
+```bash
+cd /opt/remnawave/nginx && nano nginx.conf
+```
+
+Добавьте в `nginx.conf` следующую конфигурацию:
+
+```nginx
+upstream remnawave-minishop {
+    server remnawave-minishop:8080;
+}
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    "" close;
+}
+
+server {
+    server_name webhook.domain.com; # Домен для отправки Webhook'ов
+    listen 443 ssl;
+    http2 on;
+
+    ssl_certificate "/etc/nginx/ssl/webhook_fullchain.pem";
+    ssl_certificate_key "/etc/nginx/ssl/webhook_privkey.key";
+    ssl_trusted_certificate "/etc/nginx/ssl/webhook_fullchain.pem";
+
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_send_timeout 60s;
+    proxy_read_timeout 60s;
+    proxy_intercept_errors on;
+    error_page 400 404 500 502 @redirect;
+
+    location / {
+        proxy_pass http://remnawave-minishop$request_uri;
+    }
+
+    location @redirect {
+        return 404;
+    }
+}
+```
+
+### 4. Выпуск SSL-сертификата для домена webhook
+
+Убедитесь, что установлены необходимые компоненты, а также откройте 80 порт:
+
+```bash
+sudo apt-get install cron socat
+curl https://get.acme.sh | sh -s email=EMAIL && source ~/.bashrc
+ufw allow 80/tcp && ufw reload
+```
+
+Выпустите сертификат:
+
+```bash
+acme.sh --set-default-ca --server letsencrypt
+acme.sh --issue --standalone -d 'webhook.domain.com' \
+  --key-file /opt/remnawave/nginx/webhook_privkey.key \
+  --fullchain-file /opt/remnawave/nginx/webhook_fullchain.pem
+```
+
+### 5. Добавление сертификатов в Docker Compose Nginx
+
+Отредактируйте `docker-compose.yml` панели Nginx:
+
+```bash
+cd /opt/remnawave/nginx && nano docker-compose.yml
+```
+
+Добавьте две строки в секцию `volumes`:
+
+```yaml
+services:
+    remnawave-nginx:
+        image: nginx:1.26
+        container_name: remnawave-nginx
+        hostname: remnawave-nginx
+        volumes:
+            - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+            - ./fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro
+            - ./privkey.key:/etc/nginx/ssl/privkey.key:ro
+            - ./subdomain_fullchain.pem:/etc/nginx/ssl/subdomain_fullchain.pem:ro
+            - ./subdomain_privkey.key:/etc/nginx/ssl/subdomain_privkey.key:ro
+            - ./webhook_fullchain.pem:/etc/nginx/ssl/webhook_fullchain.pem:ro     # Добавьте эту строку
+            - ./webhook_privkey.key:/etc/nginx/ssl/webhook_privkey.key:ro         # Добавьте эту строку
+        restart: always
+        ports:
+            - '0.0.0.0:443:443'
+        networks:
+            - remnawave-network
+
+networks:
+    remnawave-network:
+        name: remnawave-network
+        driver: bridge
+        external: true
+```
+
+### 6. Запуск бота и перезапуск Nginx
+
+Запустите бота:
+
+```bash
+cd /root/remnawave-minishop && docker compose up -d && docker compose logs -f -t
+```
+
+Перезапустите Nginx:
+
+```bash
+cd /opt/remnawave/nginx && docker compose down && docker compose up -d && docker compose logs -f -t
+```
+
 ## 🐳 Docker
 
-Файлы `Dockerfile` и `docker-compose.yml` уже настроены для сборки и запуска проекта. `docker-compose.yml` использует готовый образ с GitHub Container Registry, но вы можете раскомментировать `build: .` для локальной сборки.
+Файлы `Dockerfile` и `docker-compose.yml` уже настроены для локальной сборки и запуска проекта.
 
-Для автоматической публикации образов настроены GitHub Actions (`.github/workflows`). По умолчанию образы пушатся в GitHub Container Registry и Docker Hub. Добавьте в Secrets репозитория значения `DOCKERHUB_USERNAME` и `DOCKERHUB_TOKEN` (персональный access token или пароль для Docker Hub), чтобы загрузка в Docker Hub работала корректно.
+Если нужен запуск из готового образа, используйте `docker-compose-remote-server.yml` как шаблон и укажите свой `image:` вместо локальной сборки. По умолчанию он тянет `ghcr.io/3252a8/remnawave-minishop:latest`, а для закрепления версии можно задать `IMAGE_TAG=3.1.0`.
+
+В GHCR доступны теги `3.1.0` и `latest`.
+
+Чтобы использовать сохранённый образ, можно запустить:
+```bash
+IMAGE_TAG=3.1.0 docker compose -f docker-compose-remote-server.yml up -d
+```
+
+### Вариант с Caddy
+
+Если нужен reverse proxy на Caddy, используйте `docker-compose-caddy.yml` вместе с `Caddyfile`. Это удобный вариант, когда хочется, чтобы Caddy сам выпускал TLS-сертификаты и проксировал и webhook'и, и Mini App без ручной настройки Nginx.
+
+В этой схеме:
+- Caddy публикует наружу `80` и `443`.
+- Бот остается доступным только внутри docker-сети.
+- `WEBHOOK_BASE_URL` должен указывать на домен вебхуков, а `SUBSCRIPTION_MINI_APP_URL` - на домен Mini App.
+
+Пример `Caddyfile`:
+
+```caddyfile
+webhook.domain.com {
+    encode zstd gzip
+    reverse_proxy remnawave-minishop:{$WEB_SERVER_PORT:8080}
+}
+
+app.domain.com {
+    encode zstd gzip
+    reverse_proxy remnawave-minishop:{$WEBAPP_SERVER_PORT:8081}
+}
+```
+
+Что нужно поменять под себя:
+- заменить `webhook.domain.com` и `app.domain.com` на свои домены;
+- убедиться, что в `.env` заданы `WEBHOOK_BASE_URL=https://webhook.domain.com` и `SUBSCRIPTION_MINI_APP_URL=https://app.domain.com/`;
+- при необходимости скорректировать `WEB_SERVER_PORT` и `WEBAPP_SERVER_PORT`, если они отличаются от стандартных `8080` и `8081`.
+- в BotFather укажите домен Mini App через `/setdomain`, чтобы он совпадал с `SUBSCRIPTION_MINI_APP_URL`.
+
+Запуск:
+
+```bash
+docker compose -f docker-compose-caddy.yml up -d --build
+```
+
+После этого Caddy сам выпустит сертификаты и будет проксировать webhook'и на порт `8080`, а Mini App - на `8081`.
+
+## 🔄 Миграция с `remnawave-tg-shop` на `remnawave-minishop`
+
+Короткая инструкция, автоматический запуск helper'а из `raw` и ручной вариант переноса вынесены в отдельный документ: [docs/migration-to-minishop.md](docs/migration-to-minishop.md).
 
 ## 📁 Структура проекта
 
 ```
 .
 ├── bot/
-│   ├── filters/          # Пользовательские фильтры Aiogram
-│   ├── handlers/         # Обработчики сообщений и колбэков
-│   ├── keyboards/        # Клавиатуры
-│   ├── middlewares/      # Промежуточные слои (i18n, проверка бана)
-│   ├── services/         # Бизнес-логика (платежи, API панели)
-│   ├── states/           # Состояния FSM
-│   └── main_bot.py       # Основная логика бота
+│   ├── app/                          # Сборка приложения (фабрики, контроллеры, Web App)
+│   │   ├── controllers/              # Запуск Aiogram dispatcher
+│   │   ├── factories/                # Фабрики сервисов (платежи, панель и т.д.)
+│   │   └── web/                      # Web App / Mini App (сервер, аутентификация, шаблоны)
+│   ├── filters/                      # Пользовательские фильтры Aiogram
+│   ├── handlers/                     # Обработчики сообщений и колбэков (admin/, user/)
+│   ├── keyboards/                    # Клавиатуры
+│   ├── middlewares/                  # Промежуточные слои (i18n, проверка бана и т.д.)
+│   ├── services/                     # Бизнес-логика (платёжные шлюзы, API панели, email и т.д.)
+│   ├── states/                       # Состояния FSM (admin/user)
+│   ├── utils/                        # Вспомогательные утилиты
+│   ├── routers.py                    # Регистрация всех роутеров Aiogram
+│   └── main_bot.py                   # Основная логика бота
 ├── config/
-│   └── settings.py       # Настройки Pydantic
+│   └── settings.py                   # Настройки Pydantic
 ├── db/
-│   ├── dal/              # Слой доступа к данным (DAL)
-│   ├── database_setup.py # Настройка БД
-│   └── models.py         # Модели SQLAlchemy
-├── locales/              # Файлы локализации (ru, en)
-├── .env.example          # Пример файла с переменными окружения
-├── Dockerfile            # Инструкции для сборки Docker-образа
-├── docker-compose.yml    # Файл для оркестрации контейнеров
-├── requirements.txt      # Зависимости Python
-└── main.py               # Точка входа в приложение
+│   ├── dal/                          # Слой доступа к данным (DAL)
+│   ├── database_setup.py             # Настройка БД и подключения
+│   ├── migrator.py                   # Миграции схемы при старте
+│   └── models.py                     # Модели SQLAlchemy
+├── locales/                          # Файлы локализации (ru.json, en.json)
+├── scripts/                          # Сборка JS Web App, обновление копий Telegram JS и миграционный helper
+├── tests/                            # Pytest-тесты
+├── .env.example                      # Пример файла с переменными окружения
+├── Caddyfile                         # Пример конфигурации Caddy
+├── Dockerfile                        # Multi-stage сборка (Python + Node для Web App)
+├── docker-compose.yml                # Локальная сборка и запуск
+├── docker-compose-caddy.yml          # Запуск с Caddy в качестве reverse proxy
+├── docker-compose-remote-server.yml  # Запуск из готового образа GHCR
+├── package.json                      # Frontend-зависимости (Tailwind, esbuild) и сборка Web App
+├── requirements.txt                  # Зависимости Python
+└── main.py                           # Точка входа в приложение
 ```
 
-## 🔮 Планы на будущее
-
--   Расширенные типы промокодов (например, скидки в процентах).
-
 ## ❤️ Поддержка
-- Карты РФ и зарубежные: [Tribute](https://t.me/tribute/app?startapp=dqdg)
-- Crypto: `USDT TRC-20 TT3SqBbfU4vYm6SUwUVNZsy278m2xbM4GE`
+- Crypto: `USDT/Other ERC-20 0xeD506D44aae634fEc0E01C8835744fBedb7B2a44 (Ethereum/Polygon/Gnosis)`

bot/app/factories/build_services.py

@@ -14,7 +14,7 @@ from bot.services.panel_webhook_service import PanelWebhookService
 from bot.services.freekassa_service import FreeKassaService
 from bot.services.platega_service import PlategaService
 from bot.services.severpay_service import SeverPayService
-from bot.services.nalogo_service import NalogoService
+from bot.services.lknpd_service import LknpdService
 
 
 def build_core_services(
@@ -73,9 +73,10 @@ def build_core_services(
         bot_username_for_default_return=bot_username_for_default_return,
         settings_obj=settings,
     )
-    nalogo_service = NalogoService(
-        settings.NALOGO_INN,
-        settings.NALOGO_PASSWORD,
+    lknpd_service = LknpdService(
+        settings.LKNPD_INN,
+        settings.LKNPD_PASSWORD,
+        api_url=settings.LKNPD_API_URL,
     )
 
     # Wire services that depend on each other
@@ -97,7 +98,7 @@ def build_core_services(
         "freekassa_service": freekassa_service,
         "panel_webhook_service": panel_webhook_service,
         "yookassa_service": yookassa_service,
-        "nalogo_service": nalogo_service,
+        "lknpd_service": lknpd_service,
         "platega_service": platega_service,
         "severpay_service": severpay_service,
     }

bot/app/web/frontend/src/PreviewBoard.svelte

@@ -0,0 +1,217 @@
+<script>
+  import {
+    ArrowRight,
+    CheckCircle2,
+    Circle,
+    Copy,
+    Crown,
+    Database,
+    Download,
+    Gift,
+    Globe2,
+    LockKeyhole,
+    Mail,
+    RefreshCw,
+    Repeat2,
+    Send,
+    Ticket,
+    UserRound,
+    Zap,
+  } from "lucide-svelte";
+
+  import Button from "./lib/components/ui/button.svelte";
+  import Card from "./lib/components/ui/card.svelte";
+  import BackTitle from "./preview/BackTitle.svelte";
+  import PhoneFrame from "./preview/PhoneFrame.svelte";
+  import PreviewMethods from "./preview/PreviewMethods.svelte";
+  import PreviewNav from "./preview/PreviewNav.svelte";
+
+  export let config = {};
+  export let mockData = {};
+
+  const title = config.title || "/minishop";
+  const logoEmoji = config.logoEmoji || "🫥";
+  const plans = mockData.plans || [];
+  const sub = mockData.subscription || {};
+  const methods = mockData.payment_methods || [];
+  const user = mockData.user || {};
+  const tariffs = [
+    ["subscription", "Подписка", "Безлимитный трафик", "Идеально для постоянного использования", Zap],
+    ["traffic", "Трафик", "Пакеты гигабайт", "Платите только за нужный объем", Database],
+    ["premium", "Премиум", "Максимальная скорость", "Приоритетные серверы и поддержка", Crown],
+  ];
+  const traffic = [
+    [20, 290],
+    [50, 590],
+    [100, 990],
+    [300, 2190],
+  ];
+  const settingsRows = [
+    [Globe2, "Язык интерфейса", "Русский"],
+    [Send, "Привязка Telegram", user.telegram_linked ? `@${user.username || "username"}` : "Не привязан"],
+    [Mail, "Привязка почты", user.email || "Не привязана"],
+    [UserRound, "Выйти", "Завершить сессию"],
+  ];
+  const previewTelegramName = user.first_name || (user.username ? `@${user.username}` : "Telegram не привязан");
+  const previewEmail = user.email || "Почта не привязана";
+  const previewTelegramId = user.telegram_id ? `TG ID ${user.telegram_id}` : "TG ID не привязан";
+  const previewAvatar = user.telegram_photo_url || "";
+
+  function money(value) {
+    return `${value} ₽`;
+  }
+</script>
+
+<div class="preview-board" style={`--accent: ${config.primaryColor || "#00fe7a"};`}>
+  <PhoneFrame number="1" label="Главный экран">
+    <main class="home-layout">
+      <div class="login-brand home-brand">
+        <div class="brand-mark brand-mark-xl"><span>{logoEmoji}</span></div>
+        <h1>{title}</h1>
+      </div>
+      <div class="home-bottom">
+        <Card class="status-card">
+          <div class="sub-status">
+            <CheckCircle2 size={23} />
+            <div><h2>Подписка активна</h2><p>до {sub.end_date_text}</p></div>
+          </div>
+        </Card>
+        <Card>
+          <div class="traffic-top"><span>Использовано трафика</span><strong>{sub.traffic_used} из {sub.traffic_limit}</strong></div>
+          <div class="progress"><span style="width: 18%"></span></div>
+          <div class="traffic-percent">18%</div>
+        </Card>
+        <div class="action-stack">
+          <Button class="wide"><Download size={17} />Установить и настроить</Button>
+          <Button variant="secondary" class="wide"><RefreshCw size={17} />Продлить</Button>
+          <Button variant="secondary" class="wide"><Repeat2 size={17} />Сменить тариф</Button>
+        </div>
+      </div>
+      <PreviewNav active="home" />
+    </main>
+  </PhoneFrame>
+
+  <PhoneFrame number="2" label="Выбор тарифа">
+    <div class="preview-header"><div class="brand-row"><div class="brand-mark"><span>{logoEmoji}</span></div><strong>{title}</strong></div></div>
+    <div class="tariff-list">
+      {#each tariffs as tariff, index}
+        <div class:active={index === 0} class="select-card">
+          <span class="select-icon"><svelte:component this={tariff[4]} size={24} /></span>
+          <span><strong>{tariff[1]}</strong><small>{tariff[2]}</small><em>{tariff[3]}</em></span>
+          {#if index === 0}<CheckCircle2 size={21} />{:else}<Circle size={21} />{/if}
+        </div>
+      {/each}
+    </div>
+    <Button class="wide bottom-action">Далее <ArrowRight size={17} /></Button>
+  </PhoneFrame>
+
+  <PhoneFrame number="3" label="Оплата тарифа — подписка" wide>
+    <BackTitle title="Подписка" subtitle="Выберите срок подписки" />
+    <div class="period-grid">
+      {#each plans as plan, index}
+        <div class:active={index === 1} class="period-card">
+          <strong>{plan.title}</strong><span>{money(plan.price)}</span><small>{money(Math.round(plan.price / plan.months))}/мес</small>
+          {#if index === 1}<CheckCircle2 size={18} />{/if}
+        </div>
+      {/each}
+    </div>
+    <Card class="total-card"><span>Итого<br /><small>К оплате</small></span><strong>790 ₽</strong></Card>
+    <PreviewMethods {methods} />
+    <Button class="wide bottom-action">Оплатить 790 ₽ <LockKeyhole size={16} /></Button>
+  </PhoneFrame>
+
+  <PhoneFrame number="4" label="Оплата тарифа — трафик" wide>
+    <BackTitle title="Трафик" subtitle="Выберите пакет трафика" />
+    <div class="period-grid">
+      {#each traffic as pack, index}
+        <div class:active={index === 2} class="period-card">
+          <strong>{pack[0]} ГБ</strong><span>{money(pack[1])}</span><small>{money(Math.round(pack[1] / pack[0]))}/ГБ</small>
+          {#if index === 2}<CheckCircle2 size={18} />{/if}
+        </div>
+      {/each}
+    </div>
+    <Card class="total-card"><span>Итого<br /><small>К оплате</small></span><strong>990 ₽</strong></Card>
+    <PreviewMethods {methods} />
+    <Button class="wide bottom-action">Оплатить 990 ₽ <LockKeyhole size={16} /></Button>
+  </PhoneFrame>
+
+  <PhoneFrame number="5" label="Смена тарифа">
+    <BackTitle title="Смена тарифа" subtitle="Остаток 12 дней будет пересчитан" />
+    <div class="tariff-list compact">
+      <div class="select-card"><span><strong>Подписка</strong><small>Безлимитный трафик</small></span><em>Доплата 190 ₽</em><Circle size={20} /></div>
+      <div class="select-card active"><span><strong>Трафик</strong><small>Пакеты гигабайт</small></span><em>Доплата не требуется</em><CheckCircle2 size={20} /></div>
+      <div class="select-card"><span><strong>Премиум</strong><small>Максимальная скорость</small></span><em>Доплата 390 ₽</em><Circle size={20} /></div>
+    </div>
+    <Button class="wide bottom-action">Далее <ArrowRight size={17} /></Button>
+    <div class="preview-modal">
+      <Repeat2 size={30} />
+      <strong>Сменить тариф без доплаты?</strong>
+      <p>Остаток 12 дней будет пересчитан по новому тарифу.</p>
+      <Button>Да, сменить</Button>
+      <Button variant="secondary">Отмена</Button>
+    </div>
+  </PhoneFrame>
+
+  <PhoneFrame number="6" label="Пригласить друга">
+    <div class="preview-header"><div class="brand-row"><div class="brand-mark"><span>{logoEmoji}</span></div><strong>{title}</strong></div></div>
+    <Card>
+      <div class="card-label">Ваша реферальная ссылка</div>
+      <div class="copy-row"><code>https://minishop.app/ref/ABCD1234</code><Button>Копировать <Copy size={16} /></Button></div>
+    </Card>
+    <Card class="bonus-card">
+      <Gift size={42} /><div><span>Ваш бонус</span><strong>+7 дней за каждого друга</strong><p>Друг получит +3 дня к подписке.</p></div>
+    </Card>
+    <Button variant="outline" class="wide"><Ticket size={18} />Активировать промокод</Button>
+  </PhoneFrame>
+
+  <PhoneFrame number="7" label="Настройки">
+    <div class="preview-header"><div class="brand-row"><div class="brand-mark"><span>{logoEmoji}</span></div><strong>{title}</strong></div></div>
+    <Card class="settings-profile">
+      <div class="settings-avatar">
+        {#if previewAvatar}
+          <img src={previewAvatar} alt="Аватар пользователя" />
+        {:else}
+          <UserRound size={27} />
+        {/if}
+      </div>
+      <div class="settings-profile-meta">
+        <strong>{previewTelegramName}</strong>
+        <small>{previewEmail}</small>
+        <small>{previewTelegramId}</small>
+      </div>
+    </Card>    <div class="settings-list">
+      {#each settingsRows as row}
+        <div class="settings-row">
+          <svelte:component this={row[0]} size={20} />
+          <span><strong>{row[1]}</strong><small>{row[2]}</small></span>
+          <ArrowRight size={16} />
+        </div>
+      {/each}
+    </div>
+  </PhoneFrame>
+
+  <PhoneFrame number="8" label="Логин" wide>
+    <div class="login-brand small">
+      <div class="brand-mark brand-mark-xl"><span>{logoEmoji}</span></div>
+      <h1>{title}</h1><p>Войдите в свой аккаунт</p>
+    </div>
+    <Card class="auth-card">
+      <div class="field-label">Вход по email</div>
+      <div class="auth-email-stack"><div class="input muted">Email</div><Button class="wide"><Mail size={17} />Войти по почте</Button></div>
+      <div class="or-line"><span></span>или<span></span></div>
+      <Button variant="telegram" class="wide telegram-login-button">
+        <span class="telegram-login-text"><Send size={17} />Войти через телеграм</span>
+      </Button>
+    </Card>
+  </PhoneFrame>
+
+  <PhoneFrame number="9" label="Подтверждение по коду" wide>
+    <BackTitle title="Подтверждение по email" subtitle="Мы отправили код на user@example.com" />
+    <div class="otp-slots static">{#each [1, 2, 3, 4, 5, 6] as digit}<span>{digit}</span>{/each}</div>
+    <Button class="wide bottom-action">Подтвердить</Button>
+    <button class="link-button"><RefreshCw size={15} />Отправить код повторно (00:45)</button>
+  </PhoneFrame>
+</div>
+
+
+

bot/app/web/frontend/src/lib/components/ui/button.svelte

@@ -0,0 +1,38 @@
+<script>
+  import { cn } from "../../utils.js";
+
+  export let type = "button";
+  export let variant = "default";
+  export let size = "default";
+  export let disabled = false;
+  export let href = "";
+  export let onclick = undefined;
+  let className = "";
+  export { className as class };
+
+  const variants = {
+    default: "btn btn-primary",
+    secondary: "btn btn-secondary",
+    outline: "btn btn-outline",
+    ghost: "btn btn-ghost",
+    telegram: "btn btn-telegram",
+    icon: "btn btn-icon",
+  };
+
+  const sizes = {
+    default: "",
+    sm: "btn-sm",
+    lg: "btn-lg",
+    icon: "btn-square",
+  };
+</script>
+
+{#if href}
+  <a class={cn(variants[variant], sizes[size], className)} {href} on:click={onclick} {...$$restProps}>
+    <slot />
+  </a>
+{:else}
+  <button class={cn(variants[variant], sizes[size], className)} {type} {disabled} on:click={onclick} {...$$restProps}>
+    <slot />
+  </button>
+{/if}

bot/app/web/frontend/src/lib/components/ui/card.svelte

@@ -0,0 +1,12 @@
+<script>
+  import { cn } from "../../utils.js";
+
+  export let active = false;
+  export let compact = false;
+  let className = "";
+  export { className as class };
+</script>
+
+<section class={cn("card", active && "card-active", compact && "card-compact", className)}>
+  <slot />
+</section>

bot/app/web/frontend/src/lib/components/ui/dialog.svelte

@@ -0,0 +1,31 @@
+<script>
+  import { X } from "lucide-svelte";
+  import { cn } from "../../utils.js";
+  import Button from "./button.svelte";
+
+  export let open = false;
+  export let title = "";
+  export let description = "";
+  export let closeLabel = "Close";
+  export let onclose = () => {};
+  let className = "";
+  export { className as class };
+</script>
+
+{#if open}
+  <div class="dialog" role="dialog" aria-modal="true" aria-label={title}>
+    <button class="dialog-backdrop" type="button" aria-label={closeLabel} on:click={onclose}></button>
+    <section class={cn("dialog-card", className)}>
+      <div class="dialog-head">
+        <div>
+          {#if title}<h2>{title}</h2>{/if}
+          {#if description}<p>{description}</p>{/if}
+        </div>
+        <Button variant="icon" size="icon" onclick={onclose} aria-label={closeLabel}>
+          <X size={18} />
+        </Button>
+      </div>
+      <slot />
+    </section>
+  </div>
+{/if}

bot/app/web/frontend/src/lib/components/ui/input.svelte

@@ -0,0 +1,29 @@
+<script>
+  import { cn } from "../../utils.js";
+
+  export let value = "";
+  export let type = "text";
+  export let placeholder = "";
+  export let inputmode = undefined;
+  export let maxlength = undefined;
+  export let autocomplete = undefined;
+  export let disabled = false;
+  let className = "";
+  export { className as class };
+</script>
+
+<input
+  bind:value
+  class={cn("input", className)}
+  on:keydown
+  on:input
+  on:focus
+  on:blur
+  {type}
+  {placeholder}
+  {inputmode}
+  {maxlength}
+  {autocomplete}
+  {disabled}
+  {...$$restProps}
+/>

bot/app/web/frontend/src/lib/utils.js

@@ -0,0 +1,6 @@
+import { clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs) {
+  return twMerge(clsx(inputs));
+}

bot/app/web/frontend/src/main.js

@@ -0,0 +1,10 @@
+import { mount } from "svelte";
+
+import App from "./App.svelte";
+import "./styles.css";
+
+const target = document.getElementById("app");
+
+if (target) {
+  mount(App, { target });
+}

bot/app/web/frontend/src/preview/BackTitle.svelte

@@ -0,0 +1,17 @@
+<script>
+  import { ArrowLeft } from "lucide-svelte";
+
+  export let title = "";
+  export let subtitle = "";
+</script>
+
+<header class="screen-head">
+  <button class="btn btn-icon btn-square" type="button" aria-label="Назад">
+    <ArrowLeft size={18} />
+  </button>
+  <div class="center-copy">
+    <h1>{title}</h1>
+    <p>{subtitle}</p>
+  </div>
+  <span></span>
+</header>

bot/app/web/frontend/src/preview/PhoneFrame.svelte

@@ -0,0 +1,12 @@
+<script>
+  export let number = "";
+  export let label = "";
+  export let wide = false;
+</script>
+
+<section class:wide class="preview-phone-wrap">
+  <h2><span>{number}.</span> {label}</h2>
+  <div class="preview-phone">
+    <slot />
+  </div>
+</section>

bot/app/web/frontend/src/preview/PreviewMethods.svelte

@@ -0,0 +1,26 @@
+<script>
+  import { CreditCard, Send, WalletCards } from "lucide-svelte";
+
+  export let methods = [];
+
+  const icons = [CreditCard, Send, WalletCards, WalletCards];
+
+  function note(index) {
+    if (index === 0) return "Visa, Mastercard";
+    if (index === 1) return "Быстро и удобно";
+    if (index === 2) return "USDT, BTC, ETH";
+    return "ЮMoney, СБП и др.";
+  }
+</script>
+
+<div class="method-grid">
+  {#each methods as method, index}
+    <div class:active={index === 1} class="method-card">
+      <svelte:component this={icons[index] || WalletCards} size={18} />
+      <span>
+        <strong>{method.name}</strong>
+        <small>{note(index)}</small>
+      </span>
+    </div>
+  {/each}
+</div>

bot/app/web/frontend/src/preview/PreviewNav.svelte

@@ -0,0 +1,11 @@
+<script>
+  import { Gift, Home, Settings } from "lucide-svelte";
+
+  export let active = "home";
+</script>
+
+<nav class="bottom-nav static">
+  <button class:active={active === "home"} type="button"><Home size={20} /><span>Главная</span></button>
+  <button class:active={active === "invite"} type="button"><Gift size={20} /><span>Пригласить</span></button>
+  <button class:active={active === "settings"} type="button"><Settings size={20} /><span>Настройки</span></button>
+</nav>

bot/app/web/frontend/vite.config.mjs

@@ -0,0 +1,36 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { svelte } from "@sveltejs/vite-plugin-svelte";
+import { defineConfig } from "vite";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const templateDir = path.resolve(__dirname, "../templates");
+
+export default defineConfig({
+  plugins: [svelte()],
+  build: {
+    outDir: templateDir,
+    emptyOutDir: false,
+    minify: false,
+    sourcemap: false,
+    cssCodeSplit: false,
+    lib: {
+      entry: path.resolve(__dirname, "src/main.js"),
+      name: "SubscriptionWebApp",
+      formats: ["iife"],
+      fileName: () => "subscription_webapp.js",
+      cssFileName: "subscription_webapp",
+    },
+    rollupOptions: {
+      output: {
+        assetFileNames: (assetInfo) => {
+          if (assetInfo.name && assetInfo.name.endsWith(".css")) {
+            return "subscription_webapp.css";
+          }
+          return "subscription_webapp.[name][extname]";
+        },
+      },
+    },
+  },
+});

bot/app/web/templates/subscription_webapp.html

@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="ru">
+
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">
+  <meta name="robots" content="noindex, nofollow">
+  <meta name="theme-color" content="#03070b">
+  <link id="app-favicon" rel="icon" href="data:," sizes="any">
+  <title>/minishop</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap" rel="stylesheet">
+  <script src="https://telegram.org/js/telegram-web-app.js"></script>
+  <link rel="stylesheet" href="/subscription_webapp.css">
+</head>
+
+<body>
+  <main id="app"></main>
+
+  <!-- WEBAPP_I18N_SCRIPT -->
+  <!-- WEBAPP_CONFIG_SCRIPT -->
+  <!-- WEBAPP_JS_SCRIPT -->
+  <!-- WEBAPP_DEV_MOCK_START -->
+  <script src="/subscription_webapp.js" defer></script>
+  <!-- WEBAPP_DEV_MOCK_END -->
+</body>
+
+</html>

bot/app/web/web_server.py

@@ -1,5 +1,7 @@
+import hmac
 import asyncio
 import logging
+
 from aiohttp import web
 from aiogram import Bot, Dispatcher
 from aiogram.webhook.aiohttp_server import SimpleRequestHandler, setup_application
@@ -8,22 +10,28 @@ from sqlalchemy.orm import sessionmaker
 from config.settings import Settings
 
 
-async def build_and_start_web_app(
+class SecureSimpleRequestHandler(SimpleRequestHandler):
+    def verify_secret(self, telegram_secret_token: str, bot: Bot) -> bool:
+        if not self.secret_token:
+            return False
+        return hmac.compare_digest(telegram_secret_token, self.secret_token)
+
+
+def _inject_shared_instances(
+    app: web.Application,
     dp: Dispatcher,
     bot: Bot,
     settings: Settings,
     async_session_factory: sessionmaker,
-):
-    app = web.Application()
+) -> None:
     app["bot"] = bot
     app["dp"] = dp
     app["settings"] = settings
     app["async_session_factory"] = async_session_factory
-    # Inject shared instances used by webhook handlers
     app["i18n"] = dp.get("i18n_instance")
     for key in (
         "yookassa_service",
-        "nalogo_service",
+        "lknpd_service",
         "subscription_service",
         "referral_service",
         "panel_service",
@@ -34,17 +42,35 @@ async def build_and_start_web_app(
         "platega_service",
         "severpay_service",
     ):
-        # Access dispatcher workflow_data directly to avoid sequence protocol issues
         if hasattr(dp, "workflow_data") and key in dp.workflow_data:  # type: ignore
             app[key] = dp.workflow_data[key]  # type: ignore
 
+
+async def build_and_start_web_app(
+    dp: Dispatcher,
+    bot: Bot,
+    settings: Settings,
+    async_session_factory: sessionmaker,
+):
+    app = web.Application()
+    _inject_shared_instances(app, dp, bot, settings, async_session_factory)
+
+    async def _healthcheck(request: web.Request) -> web.Response:
+        return web.json_response({"status": "ok"})
+
+    app.router.add_get("/healthz", _healthcheck)
+
     setup_application(app, dp, bot=bot)
 
     telegram_uses_webhook_mode = bool(settings.WEBHOOK_BASE_URL)
 
     if telegram_uses_webhook_mode:
-        telegram_webhook_path = f"/{settings.BOT_TOKEN}"
-        app.router.add_post(telegram_webhook_path, SimpleRequestHandler(dispatcher=dp, bot=bot))
+        telegram_webhook_path = settings.telegram_webhook_path
+        SecureSimpleRequestHandler(
+            dispatcher=dp,
+            bot=bot,
+            secret_token=settings.WEBHOOK_SECRET_TOKEN,
+        ).register(app, path=telegram_webhook_path)
         logging.info(
             f"Telegram webhook route configured at: [POST] {telegram_webhook_path} (relative to base URL)"
         )
@@ -87,10 +113,13 @@ async def build_and_start_web_app(
         app.router.add_post(panel_path, panel_webhook_route)
         logging.info(f"Panel webhook route configured at: [POST] {panel_path}")
 
-    web_app_runner = web.AppRunner(app)
-    await web_app_runner.setup()
+    runners = []
+
+    webhooks_runner = web.AppRunner(app)
+    await webhooks_runner.setup()
+    runners.append(webhooks_runner)
     site = web.TCPSite(
-        web_app_runner,
+        webhooks_runner,
         host=settings.WEB_SERVER_HOST,
         port=settings.WEB_SERVER_PORT,
     )
@@ -100,5 +129,35 @@ async def build_and_start_web_app(
         f"AIOHTTP server started on http://{settings.WEB_SERVER_HOST}:{settings.WEB_SERVER_PORT}"
     )
 
-    # Run until cancelled
-    await asyncio.Event().wait()
+    if settings.WEBAPP_ENABLED:
+        from bot.app.web.subscription_webapp import create_subscription_webapp_application
+
+        subscription_app = create_subscription_webapp_application(
+            dp,
+            bot,
+            settings,
+            async_session_factory,
+        )
+        subscription_runner = web.AppRunner(subscription_app)
+        await subscription_runner.setup()
+        runners.append(subscription_runner)
+        subscription_site = web.TCPSite(
+            subscription_runner,
+            host=settings.WEBAPP_SERVER_HOST,
+            port=settings.WEBAPP_SERVER_PORT,
+        )
+        await subscription_site.start()
+        logging.info(
+            "Subscription WebApp server started on http://%s:%s",
+            settings.WEBAPP_SERVER_HOST,
+            settings.WEBAPP_SERVER_PORT,
+        )
+
+    try:
+        await asyncio.Event().wait()
+    finally:
+        for runner in reversed(runners):
+            try:
+                await runner.cleanup()
+            except Exception as cleanup_error:
+                logging.warning("Failed to cleanup aiohttp runner: %s", cleanup_error)

bot/app/web/webapp_auth.py

@@ -0,0 +1,368 @@
+import base64
+import asyncio
+import hashlib
+import hmac
+import json
+import logging
+import secrets
+import time
+from typing import Any, Dict, Optional
+from urllib.parse import parse_qsl
+
+from config.settings import Settings
+
+logger = logging.getLogger(__name__)
+
+# 5 minutes clock skew tolerance for Telegram clients
+TELEGRAM_CLOCK_SKEW_SECONDS = 300
+TELEGRAM_OAUTH_ISSUER = "https://oauth.telegram.org"
+TELEGRAM_OAUTH_JWKS_URL = "https://oauth.telegram.org/.well-known/jwks.json"
+TELEGRAM_OAUTH_ALGORITHMS = ["RS256", "ES256", "EdDSA"]
+
+
+def _urlsafe_b64encode(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+
+
+def _urlsafe_b64decode(raw: str) -> bytes:
+    padded = raw + ("=" * (-len(raw) % 4))
+    return base64.urlsafe_b64decode(padded.encode("ascii"))
+
+
+def _session_secret(settings: Settings) -> bytes:
+    return hmac.new(
+        settings.WEBAPP_SESSION_SECRET.encode("utf-8"),
+        b"remnawave-tg-shop-webapp-session",
+        hashlib.sha256,
+    ).digest()
+
+
+def create_webapp_session_token(settings: Settings, user_id: int) -> str:
+    now = int(time.time())
+    payload = {
+        "sub": int(user_id),
+        "iat": now,
+        "exp": now + max(60, int(settings.WEBAPP_SESSION_TTL_SECONDS)),
+    }
+    payload_part = _urlsafe_b64encode(
+        json.dumps(payload, separators=(",", ":")).encode("utf-8")
+    )
+    signature = hmac.new(
+        _session_secret(settings),
+        payload_part.encode("ascii"),
+        hashlib.sha256,
+    ).digest()
+    return f"{payload_part}.{_urlsafe_b64encode(signature)}"
+
+
+def verify_webapp_session_token(settings: Settings, token: str) -> Optional[int]:
+    if not token or "." not in token:
+        return None
+
+    try:
+        payload_part, signature_part = token.split(".", 1)
+        expected_signature = hmac.new(
+            _session_secret(settings),
+            payload_part.encode("ascii"),
+            hashlib.sha256,
+        ).digest()
+        received_signature = _urlsafe_b64decode(signature_part)
+        if not hmac.compare_digest(expected_signature, received_signature):
+            return None
+
+        payload = json.loads(_urlsafe_b64decode(payload_part).decode("utf-8"))
+        if int(payload.get("exp", 0)) < int(time.time()):
+            return None
+        return int(payload["sub"])
+    except Exception as exc:
+        logger.debug("Failed to verify webapp session token: %s", exc)
+        return None
+
+
+def create_telegram_oauth_nonce(settings: Settings, *, ttl_seconds: int = 600) -> str:
+    now = int(time.time())
+    payload = {
+        "n": secrets.token_urlsafe(24),
+        "iat": now,
+        "exp": now + max(60, int(ttl_seconds)),
+    }
+    payload_part = _urlsafe_b64encode(
+        json.dumps(payload, separators=(",", ":")).encode("utf-8")
+    )
+    signature = hmac.new(
+        _session_secret(settings),
+        f"telegram-oauth-nonce.{payload_part}".encode("ascii"),
+        hashlib.sha256,
+    ).digest()
+    return f"{payload_part}.{_urlsafe_b64encode(signature)}"
+
+
+def verify_telegram_oauth_nonce(settings: Settings, nonce: str) -> bool:
+    if not nonce or "." not in nonce:
+        return False
+
+    try:
+        payload_part, signature_part = nonce.split(".", 1)
+        expected_signature = hmac.new(
+            _session_secret(settings),
+            f"telegram-oauth-nonce.{payload_part}".encode("ascii"),
+            hashlib.sha256,
+        ).digest()
+        received_signature = _urlsafe_b64decode(signature_part)
+        if not hmac.compare_digest(expected_signature, received_signature):
+            return False
+
+        payload = json.loads(_urlsafe_b64decode(payload_part).decode("utf-8"))
+        now = int(time.time())
+        if int(payload.get("exp", 0)) < now:
+            return False
+        if int(payload.get("iat", 0)) > now + TELEGRAM_CLOCK_SKEW_SECONDS:
+            return False
+        return bool(payload.get("n"))
+    except Exception as exc:
+        logger.debug("Failed to verify Telegram OAuth nonce: %s", exc)
+        return False
+
+
+def create_signed_telegram_oauth_state(
+    settings: Settings,
+    payload: Dict[str, Any],
+    *,
+    ttl_seconds: int = 600,
+) -> str:
+    now = int(time.time())
+    state_payload = {
+        **payload,
+        "iat": now,
+        "exp": now + max(60, int(ttl_seconds)),
+    }
+    payload_part = _urlsafe_b64encode(
+        json.dumps(state_payload, separators=(",", ":")).encode("utf-8")
+    )
+    signature = hmac.new(
+        _session_secret(settings),
+        f"telegram-oauth-state.{payload_part}".encode("ascii"),
+        hashlib.sha256,
+    ).digest()
+    return f"{payload_part}.{_urlsafe_b64encode(signature)}"
+
+
+def verify_signed_telegram_oauth_state(
+    settings: Settings,
+    state: str,
+) -> Optional[Dict[str, Any]]:
+    if not state or "." not in state:
+        return None
+
+    try:
+        payload_part, signature_part = state.split(".", 1)
+        expected_signature = hmac.new(
+            _session_secret(settings),
+            f"telegram-oauth-state.{payload_part}".encode("ascii"),
+            hashlib.sha256,
+        ).digest()
+        received_signature = _urlsafe_b64decode(signature_part)
+        if not hmac.compare_digest(expected_signature, received_signature):
+            return None
+
+        payload = json.loads(_urlsafe_b64decode(payload_part).decode("utf-8"))
+        now = int(time.time())
+        if int(payload.get("exp", 0)) < now:
+            return None
+        if int(payload.get("iat", 0)) > now + TELEGRAM_CLOCK_SKEW_SECONDS:
+            return None
+        return payload
+    except Exception as exc:
+        logger.debug("Failed to verify Telegram OAuth state: %s", exc)
+        return None
+
+
+async def validate_telegram_oauth_id_token(
+    id_token: str,
+    *,
+    client_id: int,
+    expected_nonce: str,
+    max_age_seconds: int,
+) -> Optional[Dict[str, Any]]:
+    """Validate Telegram OIDC ID token and return a Telegram-like user payload."""
+
+    if not id_token or not client_id or not expected_nonce:
+        return None
+
+    try:
+        import jwt
+        from jwt import PyJWKClient
+    except Exception as exc:
+        logger.error(
+            "PyJWT is not installed; Telegram OAuth ID token validation is unavailable: %s",
+            exc,
+        )
+        return None
+
+    try:
+        jwks_client = PyJWKClient(TELEGRAM_OAUTH_JWKS_URL)
+        signing_key = await asyncio.to_thread(
+            jwks_client.get_signing_key_from_jwt,
+            id_token,
+        )
+        claims = await asyncio.to_thread(
+            jwt.decode,
+            id_token,
+            signing_key.key,
+            algorithms=TELEGRAM_OAUTH_ALGORITHMS,
+            audience=str(client_id),
+            issuer=TELEGRAM_OAUTH_ISSUER,
+            leeway=TELEGRAM_CLOCK_SKEW_SECONDS,
+            options={"require": ["exp", "iat", "iss", "aud"]},
+        )
+
+        if not hmac.compare_digest(str(claims.get("nonce") or ""), expected_nonce):
+            logger.warning("Telegram OAuth nonce mismatch.")
+            return None
+
+        now = int(time.time())
+        issued_at = int(claims.get("iat") or 0)
+        max_age = max(60, int(max_age_seconds))
+        if issued_at > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - issued_at > max_age:
+            logger.warning("Telegram OAuth ID token is stale.")
+            return None
+
+        telegram_id_raw = claims.get("id")
+        if not telegram_id_raw:
+            return None
+        telegram_id = int(telegram_id_raw)
+
+        full_name = str(claims.get("name") or "").strip()
+        first_name = str(claims.get("given_name") or "").strip()
+        last_name = str(claims.get("family_name") or "").strip()
+        if full_name and not first_name:
+            name_parts = full_name.split(None, 1)
+            first_name = name_parts[0]
+            if len(name_parts) > 1 and not last_name:
+                last_name = name_parts[1]
+
+        return {
+            "id": telegram_id,
+            "username": claims.get("preferred_username") or claims.get("username"),
+            "first_name": first_name or full_name or "Telegram",
+            "last_name": last_name,
+            "photo_url": claims.get("picture"),
+            "language_code": claims.get("locale"),
+        }
+    except Exception as exc:
+        logger.warning("Failed to validate Telegram OAuth ID token: %s", exc)
+        return None
+
+
+def validate_telegram_webapp_init_data(
+    init_data: str,
+    bot_token: str,
+    *,
+    max_age_seconds: int,
+) -> Optional[Dict[str, Any]]:
+    """Validate Telegram Mini App initData and return the trusted user payload."""
+
+    try:
+        parsed_data = dict(parse_qsl(init_data or "", keep_blank_values=True))
+        received_hash = parsed_data.pop("hash", None)
+        if not received_hash:
+            return None
+
+        data_check_string = "\n".join(
+            f"{key}={value}" for key, value in sorted(parsed_data.items())
+        )
+        secret_key = hmac.new(
+            b"WebAppData",
+            bot_token.encode("utf-8"),
+            hashlib.sha256,
+        ).digest()
+        calculated_hash = hmac.new(
+            secret_key,
+            data_check_string.encode("utf-8"),
+            hashlib.sha256,
+        ).hexdigest()
+        if not hmac.compare_digest(calculated_hash, received_hash):
+            logger.warning("Telegram WebApp initData hash mismatch.")
+            return None
+
+        auth_date_raw = parsed_data.get("auth_date")
+        if auth_date_raw:
+            auth_date = int(auth_date_raw)
+            now = int(time.time())
+            max_age = max(60, int(max_age_seconds))
+            if auth_date > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - auth_date > max_age:
+                logger.warning("Telegram WebApp initData auth_date is stale.")
+                return None
+
+        user_json = parsed_data.get("user")
+        if not user_json:
+            return None
+        user_data = json.loads(user_json)
+        if not user_data.get("id"):
+            return None
+        if parsed_data.get("start_param"):
+            user_data["start_param"] = parsed_data.get("start_param")
+        return user_data
+    except Exception as exc:
+        logger.warning("Failed to validate Telegram WebApp initData: %s", exc)
+        return None
+
+
+def validate_telegram_login_widget_data(
+    auth_data: Any,
+    bot_token: str,
+    *,
+    max_age_seconds: int,
+) -> Optional[Dict[str, Any]]:
+    """Validate Telegram Login Widget data and return the trusted user payload."""
+
+    try:
+        if isinstance(auth_data, str):
+            parsed_data = dict(parse_qsl(auth_data or "", keep_blank_values=True))
+        elif isinstance(auth_data, dict):
+            parsed_data = {
+                str(key): str(value)
+                for key, value in auth_data.items()
+                if value is not None
+            }
+        else:
+            return None
+
+        received_hash = str(parsed_data.pop("hash", "") or "")
+        if not received_hash:
+            return None
+
+        data_check_string = "\n".join(
+            f"{key}={value}" for key, value in sorted(parsed_data.items())
+        )
+        secret_key = hashlib.sha256(bot_token.encode("utf-8")).digest()
+        calculated_hash = hmac.new(
+            secret_key,
+            data_check_string.encode("utf-8"),
+            hashlib.sha256,
+        ).hexdigest()
+        if not hmac.compare_digest(calculated_hash, received_hash):
+            logger.warning("Telegram Login Widget hash mismatch.")
+            return None
+
+        auth_date_raw = parsed_data.get("auth_date")
+        if auth_date_raw:
+            auth_date = int(auth_date_raw)
+            now = int(time.time())
+            max_age = max(60, int(max_age_seconds))
+            if auth_date > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - auth_date > max_age:
+                logger.warning("Telegram Login Widget auth_date is stale.")
+                return None
+
+        user_id_raw = parsed_data.get("id")
+        if not user_id_raw:
+            return None
+        int(user_id_raw)
+
+        if not parsed_data.get("first_name"):
+            return None
+
+        return parsed_data
+    except Exception as exc:
+        logger.warning("Failed to validate Telegram Login Widget data: %s", exc)
+        return None

bot/handlers/admin/common.py

@@ -141,6 +141,9 @@ async def admin_panel_actions_callback_handler(
         from . import payments as admin_payments_handlers
         await admin_payments_handlers.view_payments_handler(
             callback, i18n_data, settings, session)
+    elif action == "user_ratings":
+        await admin_stats_handlers.show_user_ratings_handler(
+            callback, i18n_data, settings, session)
     elif action == "ads":
         from . import ads as admin_ads_handlers
         await admin_ads_handlers.show_ads_menu(callback, settings, i18n_data, session)

bot/handlers/admin/logs_admin.py

@@ -23,6 +23,7 @@ from bot.middlewares.i18n import JsonI18n
 
 router = Router(name="admin_logs_router")
 USERNAME_REGEX = re.compile(r"^[a-zA-Z0-9_]{5,32}$")
+EMAIL_REGEX = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
 
 
 async def display_logs_menu(callback: types.CallbackQuery, i18n_data: dict,
@@ -225,12 +226,14 @@ async def process_user_id_for_logs_handler(message: types.Message,
     input_text = message.text.strip() if message.text else ""
     user_model_for_logs: Optional[User] = None
 
-    if input_text.isdigit():
+    if input_text.isdigit() or (input_text.startswith("-") and input_text[1:].isdigit()):
         try:
             user_model_for_logs = await user_dal.get_user_by_id(
                 session, int(input_text))
         except ValueError:
             pass
+    elif EMAIL_REGEX.match(input_text):
+        user_model_for_logs = await user_dal.get_user_by_email(session, input_text)
     elif input_text.startswith("@") and USERNAME_REGEX.match(input_text[1:]):
         user_model_for_logs = await user_dal.get_user_by_username(
             session, input_text[1:])
@@ -245,7 +248,7 @@ async def process_user_id_for_logs_handler(message: types.Message,
     target_user_id = user_model_for_logs.user_id
     user_display_name = user_model_for_logs.first_name or (
         f"@{user_model_for_logs.username}"
-        if user_model_for_logs.username else f"ID {target_user_id}")
+        if user_model_for_logs.username else (user_model_for_logs.email or f"ID {target_user_id}"))
 
     logs_models = await message_log_dal.get_user_message_logs(
         session, target_user_id, settings.LOGS_PAGE_SIZE, 0)
@@ -292,7 +295,7 @@ async def view_user_logs_paginated_handler(callback: types.CallbackQuery,
 
     user_display_name = user_model_for_logs.first_name or (
         f"@{user_model_for_logs.username}"
-        if user_model_for_logs.username else f"ID {target_user_id}")
+        if user_model_for_logs.username else (user_model_for_logs.email or f"ID {target_user_id}"))
 
     logs_models = await message_log_dal.get_user_message_logs(
         session, target_user_id, settings.LOGS_PAGE_SIZE,

bot/handlers/admin/statistics.py

@@ -2,6 +2,7 @@ import logging
 from aiogram import Router, F, types
 from typing import Optional, Dict, List
 from datetime import datetime
+import html
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from config.settings import Settings
@@ -10,12 +11,44 @@ from db.dal import user_dal, payment_dal, panel_sync_dal
 from db.models import Payment, PanelSyncStatus
 from bot.services.panel_api_service import PanelApiService
 
-from bot.keyboards.inline.admin_keyboards import get_back_to_admin_panel_keyboard
+from bot.keyboards.inline.admin_keyboards import (
+    get_back_to_admin_panel_keyboard,
+    get_back_to_user_management_keyboard,
+)
 from bot.middlewares.i18n import JsonI18n
 
 router = Router(name="admin_statistics_router")
 
 
+def _format_rating_user_label(user_row: Dict[str, object],
+                              bot_username: Optional[str] = None) -> str:
+    user_id = int(user_row.get("user_id", 0) or 0)
+    username = user_row.get("username")
+    first_name = user_row.get("first_name")
+    user_id_text = str(user_id)
+    user_id_html = html.escape(user_id_text)
+
+    if bot_username:
+        safe_bot_username = html.escape(bot_username)
+        user_id_html = (
+            f'<a href="https://t.me/{safe_bot_username}?start=admin_user_{user_id_text}">'
+            f"{user_id_html}</a>"
+        )
+
+    parts: List[str] = []
+    if username:
+        parts.append(f"@{html.escape(str(username))}")
+    elif first_name:
+        parts.append(html.escape(str(first_name)))
+
+    if not parts:
+        parts.append(f"ID {user_id_html}")
+    else:
+        parts.append(f"(ID {user_id_html})")
+
+    return " ".join(parts)
+
+
 async def show_statistics_handler(callback: types.CallbackQuery,
                                   i18n_data: dict, settings: Settings,
                                   session: AsyncSession):
@@ -255,3 +288,104 @@ async def show_statistics_handler(callback: types.CallbackQuery,
                         reply_markup=get_back_to_admin_panel_keyboard(
                             current_lang, i18n))
                 break
+
+
+async def show_user_ratings_handler(
+    callback: types.CallbackQuery,
+    i18n_data: dict,
+    settings: Settings,
+    session: AsyncSession,
+):
+    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
+    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
+    if not i18n or not callback.message:
+        await callback.answer("Error displaying ratings.", show_alert=True)
+        return
+    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
+
+    await callback.answer()
+
+    top_limit = 10
+    bot_username: Optional[str] = None
+    try:
+        me = await callback.bot.get_me()
+        bot_username = me.username
+    except Exception as e_get_me:
+        logging.warning("Failed to resolve bot username for ratings links: %s",
+                        e_get_me)
+
+    traffic_top = await user_dal.get_top_users_by_traffic_used(session, limit=top_limit)
+    lifetime_traffic_top = await user_dal.get_top_users_by_lifetime_traffic_used(
+        session, limit=top_limit
+    )
+    invited_top = await user_dal.get_top_users_by_referrals_count(session, limit=top_limit)
+    revenue_top = await user_dal.get_top_users_by_referral_revenue(session, limit=top_limit)
+
+    text_parts: List[str] = [
+        _("admin_user_ratings_header", top_limit=top_limit),
+        "",
+        f"<b>{_('admin_user_ratings_traffic_month_title')}</b>",
+    ]
+
+    if traffic_top:
+        for idx, row in enumerate(traffic_top, start=1):
+            traffic_gb = float(row.get("traffic_used_bytes") or 0) / (1024**3)
+            text_parts.append(
+                _(
+                    "admin_user_ratings_traffic_item",
+                    rank=idx,
+                    user=_format_rating_user_label(row, bot_username),
+                    traffic_gb=f"{traffic_gb:.2f}",
+                )
+            )
+    else:
+        text_parts.append(_("admin_user_ratings_empty"))
+
+    text_parts.extend(["", f"<b>{_('admin_user_ratings_traffic_lifetime_title')}</b>"])
+    if lifetime_traffic_top:
+        for idx, row in enumerate(lifetime_traffic_top, start=1):
+            traffic_gb = float(row.get("lifetime_used_traffic_bytes") or 0) / (1024**3)
+            text_parts.append(
+                _(
+                    "admin_user_ratings_traffic_item",
+                    rank=idx,
+                    user=_format_rating_user_label(row, bot_username),
+                    traffic_gb=f"{traffic_gb:.2f}",
+                )
+            )
+    else:
+        text_parts.append(_("admin_user_ratings_empty"))
+
+    text_parts.extend(["", f"<b>{_('admin_user_ratings_invited_title')}</b>"])
+    if invited_top:
+        for idx, row in enumerate(invited_top, start=1):
+            text_parts.append(
+                _(
+                    "admin_user_ratings_invited_item",
+                    rank=idx,
+                    user=_format_rating_user_label(row, bot_username),
+                    invited_count=int(row.get("invited_count") or 0),
+                )
+            )
+    else:
+        text_parts.append(_("admin_user_ratings_empty"))
+
+    text_parts.extend(["", f"<b>{_('admin_user_ratings_revenue_title')}</b>"])
+    if revenue_top:
+        for idx, row in enumerate(revenue_top, start=1):
+            text_parts.append(
+                _(
+                    "admin_user_ratings_revenue_item",
+                    rank=idx,
+                    user=_format_rating_user_label(row, bot_username),
+                    revenue=f"{float(row.get('referral_revenue') or 0):.2f}",
+                )
+            )
+    else:
+        text_parts.append(_("admin_user_ratings_empty"))
+
+    await callback.message.edit_text(
+        "\n".join(text_parts),
+        reply_markup=get_back_to_user_management_keyboard(current_lang, i18n),
+        parse_mode="HTML",
+    )

bot/handlers/admin/sync_admin.py

@@ -18,6 +18,108 @@ from bot.middlewares.i18n import JsonI18n
 router = Router(name="admin_sync_router")
 
 
+def _normalize_panel_email(value: Optional[str]) -> Optional[str]:
+    email = (value or "").strip().lower()
+    return email or None
+
+
+def _extract_lifetime_used_traffic_bytes(panel_user_data: dict) -> Optional[int]:
+    user_traffic = panel_user_data.get("userTraffic") or {}
+    raw_value = (
+        user_traffic.get("lifetimeUsedTrafficBytes")
+        if isinstance(user_traffic, dict)
+        else None
+    )
+    if raw_value is None:
+        raw_value = panel_user_data.get("lifetimeUsedTrafficBytes")
+
+    try:
+        if raw_value is None:
+            return None
+        return int(raw_value)
+    except (TypeError, ValueError):
+        return None
+
+
+async def _bind_panel_email_to_user(
+    session: AsyncSession,
+    *,
+    existing_user,
+    email_from_panel: Optional[str],
+    panel_uuid: str,
+) -> tuple[object, bool]:
+    """Bind panel email to a local user without violating the unique email index.
+
+    Panel email is treated as verified because it comes from the operator-managed
+    panel. If the same email already belongs to an email-only local account for
+    this panel user, merge that account into the Telegram/local user.
+    """
+    if not email_from_panel:
+        return existing_user, False
+
+    if existing_user.email == email_from_panel:
+        if not existing_user.email_verified_at:
+            existing_user.email_verified_at = datetime.now(timezone.utc)
+            return existing_user, True
+        return existing_user, False
+
+    user_with_email = await user_dal.get_user_by_email(session, email_from_panel)
+    if user_with_email and user_with_email.user_id != existing_user.user_id:
+        can_merge_email_identity = (
+            not user_with_email.telegram_id
+            and user_with_email.panel_user_uuid in (None, panel_uuid)
+            and (not existing_user.email or existing_user.email == email_from_panel)
+        )
+        if can_merge_email_identity:
+            try:
+                merged_user = await user_dal.merge_users(
+                    session,
+                    source_user_id=user_with_email.user_id,
+                    target_user_id=existing_user.user_id,
+                )
+                if not merged_user.email:
+                    merged_user.email = email_from_panel
+                if not merged_user.email_verified_at:
+                    merged_user.email_verified_at = datetime.now(timezone.utc)
+                logging.info(
+                    "Merged email-only user %s into user %s while binding panel email %s for panel UUID %s.",
+                    user_with_email.user_id,
+                    merged_user.user_id,
+                    email_from_panel,
+                    panel_uuid,
+                )
+                return merged_user, True
+            except Exception as merge_error:
+                logging.warning(
+                    "Could not merge email-only user %s into user %s for panel email %s: %s",
+                    user_with_email.user_id,
+                    existing_user.user_id,
+                    email_from_panel,
+                    merge_error,
+                )
+                return existing_user, False
+
+        logging.warning(
+            "Panel email %s for panel UUID %s is already linked to local user %s; "
+            "skipping email binding for user %s.",
+            email_from_panel,
+            panel_uuid,
+            user_with_email.user_id,
+            existing_user.user_id,
+        )
+        return existing_user, False
+
+    existing_user.email = email_from_panel
+    existing_user.email_verified_at = datetime.now(timezone.utc)
+    logging.info(
+        "Bound panel email %s to local user %s for panel UUID %s.",
+        email_from_panel,
+        existing_user.user_id,
+        panel_uuid,
+    )
+    return existing_user, True
+
+
 async def perform_sync(
     panel_service: PanelApiService,
     session: AsyncSession,
@@ -76,6 +178,7 @@ async def perform_sync(
                     "shortUuid"
                 )
                 telegram_id_from_panel = panel_user_dict.get("telegramId")
+                email_from_panel = _normalize_panel_email(panel_user_dict.get("email"))
 
                 if not panel_uuid:
                     sync_errors.append(f"Panel user missing UUID: {panel_user_dict}")
@@ -93,15 +196,20 @@ async def perform_sync(
 
                 # First, try to find by telegram ID if available
                 if telegram_id_from_panel:
-                    existing_user = await user_dal.get_user_by_id(
+                    existing_user = await user_dal.get_user_by_telegram_id(
                         session, telegram_id_from_panel
                     )
+                    if not existing_user:
+                        existing_user = await user_dal.get_user_by_id(
+                            session, telegram_id_from_panel
+                        )
                     if existing_user:
                         logging.debug(
                             f"Found user by telegramId {telegram_id_from_panel}"
                         )
 
-                # If not found by telegram ID, try to find by panel UUID
+                # If not found by telegram ID, try to find by panel UUID.
+                # The panel UUID is the strongest local link for subscription sync.
                 if not existing_user:
                     existing_user = await user_dal.get_user_by_panel_uuid(
                         session, panel_uuid
@@ -119,6 +227,15 @@ async def perform_sync(
                                 f"TelegramId mismatch: panel={telegram_id_from_panel}, local={existing_user.user_id}"
                             )
 
+                # Finally, fall back to email. This mainly catches panel users that
+                # were first imported as email-only identities.
+                if not existing_user and email_from_panel:
+                    existing_user = await user_dal.get_user_by_email(
+                        session, email_from_panel
+                    )
+                    if existing_user:
+                        logging.debug(f"Found user by email {email_from_panel}")
+
                 if not existing_user:
                     users_not_found_in_db += 1
                     if telegram_id_from_panel:
@@ -126,6 +243,13 @@ async def perform_sync(
                         try:
                             user_data = {
                                 "user_id": telegram_id_from_panel,
+                                "telegram_id": telegram_id_from_panel,
+                                "email": email_from_panel,
+                                "email_verified_at": (
+                                    datetime.now(timezone.utc)
+                                    if email_from_panel
+                                    else None
+                                ),
                                 "username": None,  # Username will be updated when user interacts with bot
                                 "first_name": None,  # Panel doesn't provide this info
                                 "last_name": None,  # Panel doesn't provide this info
@@ -154,6 +278,28 @@ async def perform_sync(
                                 f"Error creating user {telegram_id_from_panel}: {e_create}"
                             )
                             continue
+                    elif email_from_panel:
+                        try:
+                            new_user, was_created = await user_dal.create_email_user(
+                                session,
+                                email=email_from_panel,
+                                language_code="ru",
+                            )
+                            new_user.panel_user_uuid = panel_uuid
+                            if was_created:
+                                users_created += 1
+                                logging.info(
+                                    f"Created new email user {new_user.user_id} from panel sync with UUID {panel_uuid}"
+                                )
+                            existing_user = new_user
+                        except Exception as e_create_email:
+                            sync_errors.append(
+                                f"Error creating email user {email_from_panel}: {str(e_create_email)}"
+                            )
+                            logging.error(
+                                f"Error creating email user {email_from_panel}: {e_create_email}"
+                            )
+                            continue
                     else:
                         logging.debug(
                             f"Panel user with UUID {panel_uuid} (no telegramId) not found in local DB - skipping"
@@ -175,16 +321,39 @@ async def perform_sync(
                     logging.info(
                         f"Updated panel UUID for user {actual_user_id}: {panel_uuid}"
                     )
+                existing_user, email_was_bound = await _bind_panel_email_to_user(
+                    session,
+                    existing_user=existing_user,
+                    email_from_panel=email_from_panel,
+                    panel_uuid=panel_uuid,
+                )
+                if email_was_bound:
+                    user_was_updated = True
+                if (
+                    telegram_id_from_panel
+                    and existing_user.telegram_id != telegram_id_from_panel
+                ):
+                    existing_user.telegram_id = telegram_id_from_panel
+                    user_was_updated = True
+
+                lifetime_used = _extract_lifetime_used_traffic_bytes(panel_user_dict)
+                if (
+                    lifetime_used is not None
+                    and existing_user.lifetime_used_traffic_bytes != lifetime_used
+                ):
+                    existing_user.lifetime_used_traffic_bytes = lifetime_used
+                    user_was_updated = True
 
                 # Ensure panel description contains Telegram fields
                 try:
                     if panel_uuid and existing_user:
                         description_text = "\n".join(
-                            [
+                            line for line in [
+                                existing_user.email or "",
                                 existing_user.username or "",
                                 existing_user.first_name or "",
                                 existing_user.last_name or "",
-                            ]
+                            ] if line
                         )
                         # Update description only when it differs from the current one on panel
                         current_panel_description = (
@@ -196,7 +365,11 @@ async def perform_sync(
                             and desired_description != current_panel_description
                         ):
                             await panel_service.update_user_details_on_panel(
-                                panel_uuid, {"description": description_text}
+                                panel_uuid, {
+                                    "description": description_text,
+                                    **({"email": existing_user.email} if existing_user.email else {}),
+                                    **({"telegramId": existing_user.telegram_id} if existing_user.telegram_id else {}),
+                                }
                             )
                 except Exception as e_desc:
                     logging.warning(

bot/handlers/admin/user_management.py

@@ -31,6 +31,45 @@ from bot.utils.telegram_markup import (
 
 router = Router(name="admin_user_management_router")
 USERNAME_REGEX = re.compile(r"^[a-zA-Z0-9_]{5,32}$")
+EMAIL_REGEX = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
+
+
+def _format_traffic_period(strategy: Optional[str], get_text: Callable[..., str]) -> Optional[str]:
+    if not strategy:
+        return None
+    strategy_upper = str(strategy).upper()
+    key_map = {
+        "MONTH": "traffic_period_month",
+        "WEEK": "traffic_period_week",
+        "DAY": "traffic_period_day",
+        "NO_RESET": "traffic_period_no_reset",
+    }
+    label_key = key_map.get(strategy_upper)
+    return get_text(label_key) if label_key else strategy_upper
+
+
+def _format_used_with_period(get_text: Callable[..., str], used_display: str, period_label: Optional[str]) -> str:
+    if not period_label:
+        return used_display
+    return get_text("traffic_used_with_period", traffic_used=used_display, traffic_period=period_label)
+
+
+async def _find_user_by_admin_input(
+    session: AsyncSession,
+    input_text: str,
+) -> Optional[User]:
+    if input_text.isdigit() or (input_text.startswith("-") and input_text[1:].isdigit()):
+        try:
+            return await user_dal.get_user_by_id(session, int(input_text))
+        except ValueError:
+            return None
+    if EMAIL_REGEX.match(input_text):
+        return await user_dal.get_user_by_email(session, input_text)
+    if input_text.startswith("@") and USERNAME_REGEX.match(input_text[1:]):
+        return await user_dal.get_user_by_username(session, input_text[1:])
+    if USERNAME_REGEX.match(input_text):
+        return await user_dal.get_user_by_username(session, input_text)
+    return None
 
 
 async def users_list_handler(callback: types.CallbackQuery,
@@ -230,6 +269,10 @@ async def format_user_card(user: User, session: AsyncSession,
     card_parts.append(f"{_('admin_user_id_label')} {hcode(str(user.user_id))}")
     card_parts.append(f"{_('admin_user_name_label')} {hcode(user_name)}")
     card_parts.append(f"{_('admin_user_username_label')} {hcode(username_display)}")
+    if user.email:
+        card_parts.append(f"{_('admin_user_email_label')} {hcode(user.email)}")
+    if user.telegram_id and int(user.telegram_id) != int(user.user_id):
+        card_parts.append(f"{_('admin_user_telegram_id_label')} {hcode(str(user.telegram_id))}")
     card_parts.append(f"{_('admin_user_language_label')} {hcode(user.language_code or na_value)}")
     card_parts.append(f"{_('admin_user_registration_label')} {hcode(registration_date)}")
     
@@ -263,10 +306,22 @@ async def format_user_card(user: User, session: AsyncSession,
             
             traffic_limit = subscription_details.get('traffic_limit_bytes')
             traffic_used = subscription_details.get('traffic_used_bytes')
-            if traffic_limit and traffic_used is not None:
-                traffic_limit_gb = traffic_limit / (1024**3)
-                traffic_used_gb = traffic_used / (1024**3)
-                card_parts.append(f"{_('admin_user_traffic_label')} {hcode(f'{traffic_used_gb:.2f}GB / {traffic_limit_gb:.2f}GB')}")
+            traffic_strategy = subscription_details.get('traffic_limit_strategy')
+            period_label = _format_traffic_period(traffic_strategy, _)
+            if traffic_used is not None or traffic_limit is not None:
+                used_display = _("traffic_na")
+                if traffic_used is not None:
+                    traffic_used_gb = traffic_used / (1024**3)
+                    used_display = f"{traffic_used_gb:.2f}GB"
+                used_display = _format_used_with_period(_, used_display, period_label)
+
+                if traffic_limit:
+                    traffic_limit_gb = traffic_limit / (1024**3)
+                    limit_display = f"{traffic_limit_gb:.2f}GB"
+                else:
+                    limit_display = _("traffic_unlimited")
+
+                card_parts.append(f"{_('admin_user_traffic_label')} {hcode(f'{used_display} / {limit_display}')}")
         else:
             card_parts.append(f"{_('admin_user_subscription_label')} {hcode(_('admin_user_subscription_none'))}")
     except Exception as e:
@@ -329,18 +384,7 @@ async def process_user_search_handler(message: types.Message, state: FSMContext,
     _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
 
     input_text = message.text.strip() if message.text else ""
-    user_model: Optional[User] = None
-
-    # Try to find user by ID or username
-    if input_text.isdigit():
-        try:
-            user_model = await user_dal.get_user_by_id(session, int(input_text))
-        except ValueError:
-            pass
-    elif input_text.startswith("@") and USERNAME_REGEX.match(input_text[1:]):
-        user_model = await user_dal.get_user_by_username(session, input_text[1:])
-    elif USERNAME_REGEX.match(input_text):
-        user_model = await user_dal.get_user_by_username(session, input_text)
+    user_model = await _find_user_by_admin_input(session, input_text)
 
     if not user_model:
         await message.answer(_(
@@ -1145,18 +1189,7 @@ async def process_ban_user_handler(message: types.Message, state: FSMContext,
     _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
 
     input_text = message.text.strip() if message.text else ""
-    user_model: Optional[User] = None
-
-    # Try to find user by ID or username
-    if input_text.isdigit():
-        try:
-            user_model = await user_dal.get_user_by_id(session, int(input_text))
-        except ValueError:
-            pass
-    elif input_text.startswith("@") and USERNAME_REGEX.match(input_text[1:]):
-        user_model = await user_dal.get_user_by_username(session, input_text[1:])
-    elif USERNAME_REGEX.match(input_text):
-        user_model = await user_dal.get_user_by_username(session, input_text)
+    user_model = await _find_user_by_admin_input(session, input_text)
 
     if not user_model:
         await message.answer(_(
@@ -1212,18 +1245,7 @@ async def process_unban_user_handler(message: types.Message, state: FSMContext,
     _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
 
     input_text = message.text.strip() if message.text else ""
-    user_model: Optional[User] = None
-
-    # Try to find user by ID or username
-    if input_text.isdigit():
-        try:
-            user_model = await user_dal.get_user_by_id(session, int(input_text))
-        except ValueError:
-            pass
-    elif input_text.startswith("@") and USERNAME_REGEX.match(input_text[1:]):
-        user_model = await user_dal.get_user_by_username(session, input_text[1:])
-    elif USERNAME_REGEX.match(input_text):
-        user_model = await user_dal.get_user_by_username(session, input_text)
+    user_model = await _find_user_by_admin_input(session, input_text)
 
     if not user_model:
         await message.answer(_(

bot/handlers/user/payment.py

@@ -18,19 +18,29 @@ from bot.services.subscription_service import SubscriptionService
 from bot.services.referral_service import ReferralService
 from bot.services.panel_api_service import PanelApiService
 from bot.services.yookassa_service import YooKassaService
-from bot.services.nalogo_service import NalogoService
+from bot.services.lknpd_service import LknpdService
 from bot.middlewares.i18n import JsonI18n
 from config.settings import Settings
 from bot.services.notification_service import NotificationService
 from bot.keyboards.inline.user_keyboards import get_connect_and_main_keyboard
 from bot.utils.text_sanitizer import sanitize_display_name, username_for_display
 from bot.utils.config_link import prepare_config_links
+from bot.utils.request_security import ip_in_allowlist, request_client_ip
 
 payment_processing_lock = asyncio.Lock()
 
 YOOKASSA_EVENT_PAYMENT_SUCCEEDED = 'payment.succeeded'
 YOOKASSA_EVENT_PAYMENT_CANCELED = 'payment.canceled'
 YOOKASSA_EVENT_PAYMENT_WAITING_FOR_CAPTURE = 'payment.waiting_for_capture'
+YOOKASSA_WEBHOOK_ALLOWED_IPS = [
+    "185.71.76.0/27",
+    "185.71.77.0/27",
+    "77.75.153.0/25",
+    "77.75.156.11",
+    "77.75.156.35",
+    "77.75.154.128/25",
+    "2a02:5180::/32",
+]
 
 
 async def process_successful_payment(session: AsyncSession, bot: Bot,
@@ -39,7 +49,7 @@ async def process_successful_payment(session: AsyncSession, bot: Bot,
                                      panel_service: PanelApiService,
                                      subscription_service: SubscriptionService,
                                      referral_service: ReferralService,
-                                     nalogo_service: Optional[NalogoService] = None):
+                                     lknpd_service: Optional[LknpdService] = None):
     metadata = payment_info_from_webhook.get("metadata", {})
     user_id_str = metadata.get("user_id")
     subscription_months_str = metadata.get("subscription_months")
@@ -161,9 +171,9 @@ async def process_successful_payment(session: AsyncSession, bot: Bot,
                 session,
                 payment_db_id,
             )
-        should_send_nalogo_receipt = bool(
-            nalogo_service
-            and nalogo_service.configured
+        should_send_lknpd_receipt = bool(
+            lknpd_service
+            and lknpd_service.configured
             and payment_info_from_webhook.get("paid") is True
             and payment_info_from_webhook.get("status") == "succeeded"
             and payment_before_update
@@ -278,15 +288,15 @@ async def process_successful_payment(session: AsyncSession, bot: Bot,
         traffic_label = (
             str(int(traffic_amount_gb)) if float(traffic_amount_gb).is_integer() else f"{traffic_amount_gb:g}"
         )
-        if should_send_nalogo_receipt:
+        if should_send_lknpd_receipt:
             receipt_item_name = payment_info_from_webhook.get("description")
             if not receipt_item_name:
                 if sale_mode == "traffic":
-                    receipt_item_name = f"Remnawave traffic package {traffic_label} GB"
+                    receipt_item_name = settings.LKNPD_RECEIPT_NAME_TRAFFIC.format(gb=traffic_label)
                 else:
-                    receipt_item_name = f"Remnawave subscription {int(subscription_months)} months"
+                    receipt_item_name = settings.LKNPD_RECEIPT_NAME_SUBSCRIPTION.format(months=int(subscription_months))
             try:
-                await nalogo_service.create_income_receipt(
+                await lknpd_service.create_income_receipt(
                     item_name=receipt_item_name,
                     amount=payment_value,
                     quantity=1.0,
@@ -294,7 +304,7 @@ async def process_successful_payment(session: AsyncSession, bot: Bot,
                 )
             except Exception:
                 logging.exception(
-                    "Failed to send Nalogo receipt for payment %s",
+                    "Failed to send LKNPD receipt for payment %s",
                     yk_payment_id_from_hook,
                 )
         config_link_display, connect_button_url = await prepare_config_links(
@@ -473,17 +483,21 @@ async def yookassa_webhook_route(request: web.Request):
         subscription_service: SubscriptionService = request.app[
             'subscription_service']
         referral_service: ReferralService = request.app['referral_service']
-        nalogo_service: Optional[NalogoService] = request.app.get('nalogo_service')
+        lknpd_service: Optional[LknpdService] = request.app.get('lknpd_service')
         async_session_factory: sessionmaker = request.app[
             'async_session_factory']
-    except KeyError as e_app_ctx:
-        logging.error(
-            f"KeyError accessing app context in yookassa_webhook_route: {e_app_ctx}.",
-            exc_info=True)
+    except KeyError:
+        logging.exception(
+            "KeyError accessing app context in yookassa_webhook_route.")
         return web.Response(
             status=500,
             text="Internal Server Error: Missing app context component")
 
+    client_ip = request_client_ip(request, trusted_proxies=settings.trusted_proxies)
+    if not ip_in_allowlist(client_ip, YOOKASSA_WEBHOOK_ALLOWED_IPS):
+        logging.warning("YooKassa webhook denied from unauthorized IP source.")
+        return web.Response(status=403)
+
     try:
         event_json = await request.json()
 
@@ -567,7 +581,7 @@ async def yookassa_webhook_route(request: web.Request):
                                 session, bot, payment_dict_for_processing,
                                 i18n_instance, settings, panel_service,
                                 subscription_service, referral_service,
-                                nalogo_service)
+                                lknpd_service)
                             await session.commit()
                         else:
                             logging.warning(
@@ -658,23 +672,20 @@ async def yookassa_webhook_route(request: web.Request):
                                             logging.exception("Failed to cancel bind-only payment auth")
                             except Exception:
                                 logging.exception("Failed to handle bind-only waiting_for_capture webhook")
-                except Exception as e_webhook_db_processing:
+                except Exception:
                     await session.rollback()
-                    logging.error(
-                        f"Error processing YooKassa webhook event '{notification_object.event}' "
-                        f"for YK Payment ID {payment_dict_for_processing.get('id')} in DB transaction: {e_webhook_db_processing}",
-                        exc_info=True)
+                    logging.exception(
+                        "Error processing YooKassa webhook event '%s' for YK Payment ID %s in DB transaction.",
+                        notification_object.event,
+                        payment_dict_for_processing.get('id'))
                     return web.Response(
-                        status=200, text="ok_internal_processing_error_logged")
+                        status=500, text="internal_processing_error")
 
         return web.Response(status=200, text="ok")
 
     except json.JSONDecodeError:
         logging.error("YooKassa Webhook: Invalid JSON received.")
         return web.Response(status=400, text="bad_request_invalid_json")
-    except Exception as e_general_webhook:
-        logging.error(
-            f"YooKassa Webhook general processing error: {e_general_webhook}",
-            exc_info=True)
-        return web.Response(status=200,
-                            text="ok_general_internal_error_logged")
+    except Exception:
+        logging.exception("YooKassa Webhook general processing error.")
+        return web.Response(status=500, text="internal_error")

bot/handlers/user/promo_user.py

@@ -4,7 +4,6 @@ from aiogram import Router, F, types, Bot
 from aiogram.fsm.context import FSMContext
 from typing import Optional
 from sqlalchemy.ext.asyncio import AsyncSession
-from aiogram.utils.markdown import hcode
 
 from config.settings import Settings
 from bot.states.user_states import UserPromoStates
@@ -16,6 +15,7 @@ from bot.keyboards.inline.user_keyboards import (
 )
 from datetime import datetime
 from bot.middlewares.i18n import JsonI18n
+from bot.utils.callback_answer import safe_answer_callback
 
 from .start import send_main_menu
 
@@ -31,34 +31,46 @@ MAX_PROMO_CODE_INPUT_LENGTH = 100
 
 async def prompt_promo_code_input(callback: types.CallbackQuery,
                                   state: FSMContext, i18n_data: dict,
-                                  settings: Settings, session: AsyncSession):
+                                  settings: Settings, session: AsyncSession,
+                                  back_callback: str = "main_action:back_to_main"):
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
     if not i18n:
-        await callback.answer("Language service error.", show_alert=True)
+        await safe_answer_callback(callback, "Language service error.", show_alert=True)
         return
     _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
 
     if not callback.message:
         logging.error(
             "CallbackQuery has no message in prompt_promo_code_input")
-        await callback.answer(_("error_occurred_processing_request"),
-                              show_alert=True)
+        await safe_answer_callback(
+            callback,
+            _("error_occurred_processing_request"),
+            show_alert=True,
+        )
         return
 
     try:
         await callback.message.edit_text(
             text=_(key="promo_code_prompt"),
-            reply_markup=get_back_to_main_menu_markup(current_lang, i18n))
+            reply_markup=get_back_to_main_menu_markup(
+                current_lang,
+                i18n,
+                callback_data=back_callback,
+            ))
     except Exception as e_edit:
         logging.warning(
             f"Failed to edit message for promo prompt: {e_edit}. Sending new one."
         )
         await callback.message.answer(
             text=_(key="promo_code_prompt"),
-            reply_markup=get_back_to_main_menu_markup(current_lang, i18n))
+            reply_markup=get_back_to_main_menu_markup(
+                current_lang,
+                i18n,
+                callback_data=back_callback,
+            ))
 
-    await callback.answer()
+    await safe_answer_callback(callback)
     await state.set_state(UserPromoStates.waiting_for_promo_code)
     logging.info(
         f"User {callback.from_user.id} entered state UserPromoStates.waiting_for_promo_code. "
@@ -119,46 +131,41 @@ async def process_promo_code_input(message: types.Message, state: FSMContext,
             except Exception as e:
                 logging.error(f"Failed to send suspicious promo notification: {e}")
 
-        response_to_user_text = _("promo_code_not_found",
-                                  code=hcode(code_input.upper()))
-        reply_markup = get_back_to_main_menu_markup(current_lang, i18n)
+    success, result = await promo_code_service.apply_promo_code(
+        session, user.id, code_input, current_lang)
+    if success:
+        await session.commit()
+        logging.info(
+            f"Promo code '{code_input}' successfully applied for user {user.id}."
+        )
+
+        new_end_date = result if isinstance(result, datetime) else None
+        active = await subscription_service.get_active_subscription_details(session, user.id)
+        config_link_display = active.get("config_link") if active else None
+        connect_button_url = active.get("connect_button_url") if active else None
+        config_link_text = config_link_display or _("config_link_not_available")
+
+        response_to_user_text = _(
+            "promo_code_applied_success_full",
+            end_date=(new_end_date.strftime("%d.%m.%Y %H:%M:%S") if new_end_date else "N/A"),
+            config_link=config_link_text,
+        )
+        reply_markup = get_connect_and_main_keyboard(
+            current_lang,
+            i18n,
+            settings,
+            config_link_display,
+            connect_button_url=connect_button_url,
+        )
     else:
-
-        success, result = await promo_code_service.apply_promo_code(
-            session, user.id, code_input, current_lang)
-        if success:
-            await session.commit()
-            logging.info(
-                f"Promo code '{code_input}' successfully applied for user {user.id}."
-            )
-
-            new_end_date = result if isinstance(result, datetime) else None
-            active = await subscription_service.get_active_subscription_details(session, user.id)
-            config_link_display = active.get("config_link") if active else None
-            connect_button_url = active.get("connect_button_url") if active else None
-            config_link_text = config_link_display or _("config_link_not_available")
-
-            response_to_user_text = _(
-                "promo_code_applied_success_full",
-                end_date=(new_end_date.strftime("%d.%m.%Y %H:%M:%S") if new_end_date else "N/A"),
-                config_link=config_link_text,
-            )
-            reply_markup = get_connect_and_main_keyboard(
-                current_lang,
-                i18n,
-                settings,
-                config_link_display,
-                connect_button_url=connect_button_url,
-            )
-        else:
-            await session.rollback()
-            logging.info(
-                f"Promo code '{code_input}' application failed for user {user.id}. Reason: {result}"
-            )
-            response_to_user_text = result
-            reply_markup = get_back_to_main_menu_markup(
-                current_lang, i18n
-            )
+        await session.commit()
+        logging.info(
+            f"Promo code '{code_input}' application failed for user {user.id}. Reason: {result}"
+        )
+        response_to_user_text = result
+        reply_markup = get_back_to_main_menu_markup(
+            current_lang, i18n
+        )
 
     await message.answer(
         response_to_user_text,
@@ -181,7 +188,7 @@ async def cancel_promo_input_via_button(
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
     if not i18n:
         logging.error("i18n missing in cancel_promo_input_via_button")
-        await callback.answer("Language error", show_alert=True)
+        await safe_answer_callback(callback, "Language error", show_alert=True)
         return
 
     logging.info(
@@ -200,5 +207,8 @@ async def cancel_promo_input_via_button(
     else:
 
         _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-        await callback.answer(_("promo_input_cancelled_short"),
-                              show_alert=False)
+        await safe_answer_callback(
+            callback,
+            _("promo_input_cancelled_short"),
+            show_alert=False,
+        )

bot/handlers/user/referral.py

@@ -2,22 +2,23 @@ import logging
 from aiogram import Router, F, types, Bot
 from aiogram.filters import Command
 from typing import Optional, Union
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from config.settings import Settings
+from db.dal import user_dal
 from bot.services.referral_service import ReferralService
 
-from bot.keyboards.inline.user_keyboards import get_back_to_main_menu_markup
 from bot.middlewares.i18n import JsonI18n
 
 router = Router(name="user_referral_router")
 
 
-async def referral_command_handler(event: Union[types.Message,
-                                                types.CallbackQuery],
+async def referral_command_handler(event: Union[types.Message, types.CallbackQuery],
                                    settings: Settings, i18n_data: dict,
                                    referral_service: ReferralService, bot: Bot,
-                                   session: AsyncSession):
+                                   session: AsyncSession,
+                                   back_callback: str = "main_action:back_to_main"):
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
 
@@ -95,17 +96,35 @@ async def referral_command_handler(event: Union[types.Message,
         bonus_details_str = "\n".join(bonus_info_parts) if bonus_info_parts else _(
             "referral_no_bonuses_configured")
 
-    # Get referral statistics
     referral_stats = await referral_service.get_referral_stats(session, inviter_user_id)
 
+    webapp_referral_link = await _generate_webapp_referral_link(
+        session,
+        settings,
+        inviter_user_id,
+    )
+    webapp_link_section = (
+        _(
+            "referral_webapp_link_line",
+            webapp_referral_link=webapp_referral_link,
+        )
+        if webapp_referral_link
+        else ""
+    )
+
     text = _("referral_program_info_new",
              referral_link=referral_link,
+             webapp_link_section=webapp_link_section,
              bonus_details=bonus_details_str,
              invited_count=referral_stats["invited_count"],
              purchased_count=referral_stats["purchased_count"])
 
     from bot.keyboards.inline.user_keyboards import get_referral_link_keyboard
-    reply_markup_val = get_referral_link_keyboard(current_lang, i18n)
+    reply_markup_val = get_referral_link_keyboard(
+        current_lang,
+        i18n,
+        back_callback=back_callback,
+    )
 
     if isinstance(event, types.Message):
         await event.answer(text,
@@ -140,7 +159,7 @@ async def referral_action_handler(callback: types.CallbackQuery, settings: Setti
             bot_info = await bot.get_me()
             bot_username = bot_info.username
             if not bot_username:
-                await callback.answer("Ошибка получения имени бота", show_alert=True)
+                await callback.answer(_("error_generating_referral_link"), show_alert=True)
                 return
 
             inviter_user_id = callback.from_user.id
@@ -154,16 +173,67 @@ async def referral_action_handler(callback: types.CallbackQuery, settings: Setti
                 )
                 await callback.answer(_("error_generating_referral_link"), show_alert=True)
                 return
-            
-            friend_message = _("referral_friend_message", referral_link=referral_link)
-            
+
+            webapp_referral_link = await _generate_webapp_referral_link(
+                session,
+                settings,
+                inviter_user_id,
+            )
+            if webapp_referral_link:
+                friend_message = _(
+                    "referral_friend_message_with_webapp",
+                    referral_link=referral_link,
+                    webapp_referral_link=webapp_referral_link,
+                )
+            else:
+                friend_message = _("referral_friend_message", referral_link=referral_link)
+
             await callback.message.answer(
                 friend_message,
                 disable_web_page_preview=True
             )
-            
+
         except Exception as e:
             logging.error(f"Error in referral share message: {e}")
-            await callback.answer("Произошла ошибка", show_alert=True)
-        
+            await callback.answer(_("error_occurred_try_again"), show_alert=True)
+
     await callback.answer()
+
+
+def _build_webapp_referral_link(base_url: Optional[str], referral_code: Optional[str]) -> Optional[str]:
+    if not base_url or not referral_code:
+        return None
+    parts = urlsplit(base_url)
+    query = dict(parse_qsl(parts.query, keep_blank_values=True))
+    query["ref"] = f"u{referral_code}"
+    return urlunsplit(
+        (
+            parts.scheme,
+            parts.netloc,
+            parts.path or "/",
+            urlencode(query),
+            parts.fragment,
+        )
+    )
+
+
+async def _generate_webapp_referral_link(
+    session: AsyncSession,
+    settings: Settings,
+    inviter_user_id: int,
+) -> Optional[str]:
+    if not settings.SUBSCRIPTION_MINI_APP_URL:
+        return None
+    db_user = await user_dal.get_user_by_id(session, inviter_user_id)
+    referral_code = await user_dal.ensure_referral_code(session, db_user) if db_user else None
+    return _build_webapp_referral_link(
+        settings.SUBSCRIPTION_MINI_APP_URL,
+        referral_code,
+    )
+
+
+@router.message(Command("referral"))
+async def referral_command_message_handler(message: types.Message, settings: Settings, 
+                                          i18n_data: dict, referral_service: ReferralService, 
+                                          bot: Bot, session: AsyncSession):
+    await referral_command_handler(message, settings, i18n_data, referral_service, bot, session)

bot/handlers/user/start.py

@@ -14,8 +14,10 @@ from db.models import User
 
 from bot.keyboards.inline.user_keyboards import (
     get_main_menu_inline_keyboard,
+    get_bot_interface_inline_keyboard,
     get_language_selection_keyboard,
     get_channel_subscription_keyboard,
+    get_information_links_keyboard,
 )
 from bot.services.subscription_service import SubscriptionService
 from bot.services.panel_api_service import PanelApiService
@@ -24,10 +26,29 @@ from bot.services.promo_code_service import PromoCodeService
 from config.settings import Settings
 from bot.middlewares.i18n import JsonI18n
 from bot.utils.text_sanitizer import sanitize_username, sanitize_display_name
-
+from bot.utils.callback_answer import safe_answer_callback
 router = Router(name="user_start_router")
 
 
+async def should_show_trial_button(
+        settings: Settings,
+        subscription_service: SubscriptionService,
+        session: AsyncSession,
+        user_id: int) -> bool:
+    if not settings.TRIAL_ENABLED:
+        return False
+
+    if hasattr(subscription_service, 'has_had_any_subscription') and callable(
+            getattr(subscription_service, 'has_had_any_subscription')):
+        return not await subscription_service.has_had_any_subscription(
+            session, user_id)
+
+    logging.error(
+        "Method has_had_any_subscription is missing in SubscriptionService!"
+    )
+    return False
+
+
 async def send_main_menu(target_event: Union[types.Message,
                                              types.CallbackQuery],
                          settings: Settings,
@@ -60,18 +81,8 @@ async def send_main_menu(target_event: Union[types.Message,
 
     _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
 
-    show_trial_button_in_menu = False
-    if settings.TRIAL_ENABLED:
-        if hasattr(
-                subscription_service, 'has_had_any_subscription') and callable(
-                    getattr(subscription_service, 'has_had_any_subscription')):
-            if not await subscription_service.has_had_any_subscription(
-                    session, user_id):
-                show_trial_button_in_menu = True
-        else:
-            logging.error(
-                "Method has_had_any_subscription is missing in SubscriptionService for send_main_menu!"
-            )
+    show_trial_button_in_menu = await should_show_trial_button(
+        settings, subscription_service, session, user_id)
 
     text = _(key="main_menu_greeting", user_name=user_full_name)
     reply_markup = get_main_menu_inline_keyboard(current_lang, i18n, settings,
@@ -89,8 +100,11 @@ async def send_main_menu(target_event: Union[types.Message,
             f"send_main_menu: target_message_obj is None for event from user {user_id}."
         )
         if isinstance(target_event, types.CallbackQuery):
-            await target_event.answer(_("error_displaying_menu"),
-                                      show_alert=True)
+            await safe_answer_callback(
+                target_event,
+                _("error_displaying_menu"),
+                show_alert=True,
+            )
         return
 
     try:
@@ -100,10 +114,7 @@ async def send_main_menu(target_event: Union[types.Message,
             await target_message_obj.answer(text, reply_markup=reply_markup)
 
         if isinstance(target_event, types.CallbackQuery):
-            try:
-                await target_event.answer()
-            except Exception:
-                pass
+            await safe_answer_callback(target_event)
     except Exception as e_send_edit:
         logging.warning(
             f"Failed to send/edit main menu (user: {user_id}, is_edit: {is_edit}): {type(e_send_edit).__name__} - {e_send_edit}."
@@ -116,11 +127,77 @@ async def send_main_menu(target_event: Union[types.Message,
                     f"Also failed to send new main menu message for user {user_id}: {e_send_new}"
                 )
         if isinstance(target_event, types.CallbackQuery):
+            await safe_answer_callback(
+                target_event,
+                _("error_occurred_try_again") if is_edit else None,
+            )
+
+
+async def send_bot_interface_menu(
+        target_event: Union[types.Message, types.CallbackQuery],
+        settings: Settings,
+        i18n_data: dict,
+        subscription_service: SubscriptionService,
+        session: AsyncSession,
+        is_edit: bool = False):
+    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
+    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
+
+    if not i18n:
+        logging.error("i18n_instance missing in send_bot_interface_menu.")
+        return
+
+    user_id = target_event.from_user.id
+    show_trial_button_in_menu = await should_show_trial_button(
+        settings, subscription_service, session, user_id)
+
+    text = i18n.gettext(current_lang, "bot_interface_menu_title")
+    if settings.SUBSCRIPTION_MINI_APP_URL:
+        text = (
+            f"{text}\n\n"
+            f"{i18n.gettext(current_lang, 'bot_interface_menu_webapp_hint')}"
+        )
+    reply_markup = get_bot_interface_inline_keyboard(
+        current_lang, i18n, settings, show_trial_button_in_menu)
+
+    target_message_obj: Optional[types.Message] = None
+    if isinstance(target_event, types.Message):
+        target_message_obj = target_event
+    elif isinstance(target_event, types.CallbackQuery) and target_event.message:
+        target_message_obj = target_event.message
+
+    if not target_message_obj:
+        logging.error(
+            "send_bot_interface_menu: target_message_obj is None for user %s.",
+            user_id,
+        )
+        return
+
+    try:
+        if is_edit:
+            await target_message_obj.edit_text(text, reply_markup=reply_markup)
+        else:
+            await target_message_obj.answer(text, reply_markup=reply_markup)
+
+        if isinstance(target_event, types.CallbackQuery):
+            await safe_answer_callback(target_event)
+    except Exception as e_send_edit:
+        logging.warning(
+            "Failed to send/edit bot interface menu (user: %s, is_edit: %s): %s - %s.",
+            user_id,
+            is_edit,
+            type(e_send_edit).__name__,
+            e_send_edit,
+        )
+        if is_edit:
             try:
-                await target_event.answer(
-                    _("error_occurred_try_again") if is_edit else None)
-            except Exception:
-                pass
+                await target_message_obj.answer(text, reply_markup=reply_markup)
+            except Exception as e_send_new:
+                logging.error(
+                    "Also failed to send new bot interface menu for user %s: %s",
+                    user_id,
+                    e_send_new,
+                )
 
 
 async def ensure_required_channel_subscription(
@@ -304,16 +381,21 @@ async def ensure_required_channel_subscription(
 @router.message(CommandStart())
 @router.message(CommandStart(magic=F.args.regexp(r"^ref_((?:[uU][A-Za-z0-9]{9})|(?:[A-Za-z0-9]{9})|\d+)$").as_("ref_match")))
 @router.message(CommandStart(magic=F.args.regexp(r"^promo_(\w+)$").as_("promo_match")))
-@router.message(CommandStart(magic=F.args.regexp(r"^(?!ref_|promo_)([A-Za-z0-9_\-]{2,64})$").as_("ad_param_match")))
+@router.message(CommandStart(magic=F.args.regexp(r"^admin_user_(\d+)$").as_("admin_user_match")))
+@router.message(CommandStart(magic=F.args.regexp(r"^page_ref$").as_("page_ref_match")))
+@router.message(CommandStart(magic=F.args.regexp(r"^(?!ref_|promo_|admin_user_|page_ref$|webapp_auth_)([A-Za-z0-9_\-]{2,64})$").as_("ad_param_match")))
 async def start_command_handler(message: types.Message,
                                 state: FSMContext,
                                 settings: Settings,
                                 i18n_data: dict,
                                 subscription_service: SubscriptionService,
+                                referral_service: ReferralService,
                                 session: AsyncSession,
                                 ref_match: Optional[re.Match] = None,
                                 promo_match: Optional[re.Match] = None,
-                                ad_param_match: Optional[re.Match] = None):
+                                page_ref_match: Optional[re.Match] = None,
+                                ad_param_match: Optional[re.Match] = None,
+                                admin_user_match: Optional[re.Match] = None):
     await state.clear()
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
@@ -323,8 +405,61 @@ async def start_command_handler(message: types.Message,
     user = message.from_user
     user_id = user.id
 
+    if admin_user_match and user_id in settings.ADMIN_IDS:
+        target_user_id = int(admin_user_match.group(1))
+        target_user = await user_dal.get_user_by_id(session, target_user_id)
+        if not target_user:
+            await message.answer(
+                _("admin_user_not_found", input=hd.quote(str(target_user_id)))
+            )
+            return
+
+        try:
+            from bot.handlers.admin.user_management import (
+                format_user_card,
+                get_user_card_keyboard,
+                _send_with_profile_link_fallback,
+            )
+
+            referral_service = ReferralService(
+                settings, subscription_service, message.bot, i18n
+            )
+            user_card_text = await format_user_card(
+                target_user,
+                session,
+                subscription_service,
+                i18n,
+                current_lang,
+                referral_service,
+            )
+            keyboard = get_user_card_keyboard(
+                target_user.user_id,
+                i18n,
+                current_lang,
+                target_user.referred_by_id,
+            )
+
+            await _send_with_profile_link_fallback(
+                message.answer,
+                text=user_card_text,
+                markup=keyboard.as_markup(),
+                user_id=target_user.user_id,
+                parse_mode="HTML",
+            )
+            return
+        except Exception as e_admin_card:
+            logging.error(
+                "Failed to open admin user card via deep-link for %s: %s",
+                target_user_id,
+                e_admin_card,
+                exc_info=True,
+            )
+            await message.answer(_("admin_user_card_error"))
+            return
+
     referred_by_user_id: Optional[int] = None
     promo_code_to_apply: Optional[str] = None
+    should_open_referral_from_start = False
     ad_start_param: Optional[str] = None
 
     if ref_match:
@@ -348,6 +483,9 @@ async def start_command_handler(message: types.Message,
     elif promo_match:
         promo_code_to_apply = promo_match.group(1)
         logging.info(f"User {user_id} started with promo code: {promo_code_to_apply}")
+    elif page_ref_match:
+        should_open_referral_from_start = True
+        logging.info(f"User {user_id} started with page_ref deep-link.")
     elif ad_param_match:
         ad_start_param = ad_param_match.group(1)
         logging.info(f"User {user_id} started with ad start param: {ad_start_param}")
@@ -357,6 +495,7 @@ async def start_command_handler(message: types.Message,
     sanitized_last_name = sanitize_display_name(user.last_name)
 
     db_user = await user_dal.get_user_by_id(session, user_id)
+    is_existing_user = db_user is not None
     if not db_user:
         user_data_to_create = {
             "user_id": user_id,
@@ -386,6 +525,50 @@ async def start_command_handler(message: types.Message,
                     f"New user {user_id} added to session. Referred by: {referred_by_user_id or 'N/A'}."
                 )
 
+                # Auto-grant referral welcome bonus to newly registered referred users.
+                referral_welcome_days = max(
+                    0, int(getattr(settings, "REFERRAL_WELCOME_BONUS_DAYS", 0) or 0)
+                )
+                if referred_by_user_id and referral_welcome_days > 0:
+                    try:
+                        referral_bonus_end_date = await subscription_service.extend_active_subscription_days(
+                            session,
+                            user_id,
+                            referral_welcome_days,
+                            reason="referral_welcome_bonus",
+                        )
+                        if referral_bonus_end_date:
+                            await session.commit()
+                            logging.info(
+                                "Referral welcome bonus applied: user %s got %s days, new end date %s.",
+                                user_id,
+                                referral_welcome_days,
+                                referral_bonus_end_date.isoformat(),
+                            )
+                            await message.answer(
+                                _(
+                                    "referral_welcome_bonus_applied",
+                                    days=referral_welcome_days,
+                                    end_date=referral_bonus_end_date.strftime("%d.%m.%Y %H:%M:%S"),
+                                ),
+                                parse_mode="HTML",
+                            )
+                        else:
+                            await session.rollback()
+                            logging.warning(
+                                "Referral welcome bonus was not applied for user %s (referred by %s).",
+                                user_id,
+                                referred_by_user_id,
+                            )
+                    except Exception as referral_bonus_error:
+                        await session.rollback()
+                        logging.error(
+                            "Failed to apply referral welcome bonus for user %s: %s",
+                            user_id,
+                            referral_bonus_error,
+                            exc_info=True,
+                        )
+
                 # Send notification about new user registration
                 try:
                     from bot.services.notification_service import NotificationService
@@ -458,8 +641,12 @@ async def start_command_handler(message: types.Message,
                                                       db_user):
         return
 
+    open_referral_page_for_existing_user = (
+        should_open_referral_from_start and is_existing_user
+    )
+
     # Send welcome message if not disabled
-    if not settings.DISABLE_WELCOME_MESSAGE:
+    if not settings.DISABLE_WELCOME_MESSAGE and not open_referral_page_for_existing_user:
         await message.answer(_(key="welcome", user_name=hd.quote(user.full_name)))
 
     # Auto-apply promo code if provided via start parameter
@@ -506,14 +693,22 @@ async def start_command_handler(message: types.Message,
                 # Don't show main menu if promo was successfully applied
                 return
             else:
-                await session.rollback()
+                await session.commit()
                 logging.warning(f"Failed to auto-apply promo code '{promo_code_to_apply}' for user {user_id}: {result}")
+                await message.answer(str(result), parse_mode="HTML")
                 # Continue to show main menu if promo failed
 
         except Exception as e:
             logging.error(f"Error auto-applying promo code '{promo_code_to_apply}' for user {user_id}: {e}")
             await session.rollback()
 
+    if open_referral_page_for_existing_user:
+        from . import referral as user_referral_handlers
+        await user_referral_handlers.referral_command_handler(
+            message, settings, i18n_data, referral_service, message.bot, session
+        )
+        return
+
     await send_main_menu(message,
                          settings,
                          i18n_data,
@@ -522,6 +717,31 @@ async def start_command_handler(message: types.Message,
                          is_edit=False)
 
 
+@router.message(Command("tg"))
+async def tg_interface_command_handler(message: types.Message,
+                                       state: FSMContext,
+                                       settings: Settings,
+                                       i18n_data: dict,
+                                       subscription_service: SubscriptionService,
+                                       session: AsyncSession):
+    await state.clear()
+
+    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
+    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
+    db_user = await user_dal.get_user_by_id(session, message.from_user.id)
+    if not await ensure_required_channel_subscription(message, settings, i18n,
+                                                      current_lang, session,
+                                                      db_user):
+        return
+
+    await send_bot_interface_menu(message,
+                                  settings,
+                                  i18n_data,
+                                  subscription_service,
+                                  session,
+                                  is_edit=False)
+
+
 @router.callback_query(F.data == "channel_subscription:verify")
 async def verify_channel_subscription_callback(
         callback: types.CallbackQuery,
@@ -560,8 +780,11 @@ async def verify_channel_subscription_callback(
                                                 welcome_text)
 
     try:
-        await callback.answer(_(key="channel_subscription_verified_success"),
-                              show_alert=True)
+        await safe_answer_callback(
+            callback,
+            _(key="channel_subscription_verified_success"),
+            show_alert=True,
+        )
     except Exception:
         pass
 
@@ -579,6 +802,7 @@ async def language_command_handler(
     event: Union[types.Message, types.CallbackQuery],
     i18n_data: dict,
     settings: Settings,
+    back_callback: str = "main_action:back_to_main",
 ):
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
@@ -586,13 +810,21 @@ async def language_command_handler(
                                            ) if i18n else key
 
     text_to_send = _(key="choose_language")
-    reply_markup = get_language_selection_keyboard(i18n, current_lang)
+    reply_markup = get_language_selection_keyboard(
+        i18n,
+        current_lang,
+        back_callback=back_callback,
+    )
 
     target_message_obj = event.message if isinstance(
         event, types.CallbackQuery) else event
     if not target_message_obj:
         if isinstance(event, types.CallbackQuery):
-            await event.answer(_("error_occurred_try_again"), show_alert=True)
+            await safe_answer_callback(
+                event,
+                _("error_occurred_try_again"),
+                show_alert=True,
+            )
         return
 
     if isinstance(event, types.CallbackQuery):
@@ -603,7 +835,7 @@ async def language_command_handler(
             except Exception:
                 await target_message_obj.answer(text_to_send,
                                                 reply_markup=reply_markup)
-        await event.answer()
+        await safe_answer_callback(event)
     else:
         await target_message_obj.answer(text_to_send,
                                         reply_markup=reply_markup)
@@ -615,15 +847,22 @@ async def select_language_callback_handler(
         subscription_service: SubscriptionService, session: AsyncSession):
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
     if not i18n or not callback.message:
-        await callback.answer("Service error or message context lost.",
-                              show_alert=True)
+        await safe_answer_callback(
+            callback,
+            "Service error or message context lost.",
+            show_alert=True,
+        )
         return
 
     try:
-        lang_code = callback.data.split("_")[2]
+        lang_payload = callback.data.split("_", 2)[2]
+        lang_code, _, return_target = lang_payload.partition(":")
     except IndexError:
-        await callback.answer("Error processing language selection.",
-                              show_alert=True)
+        await safe_answer_callback(
+            callback,
+            "Error processing language selection.",
+            show_alert=True,
+        )
         return
 
     user_id = callback.from_user.id
@@ -634,25 +873,37 @@ async def select_language_callback_handler(
 
             i18n_data["current_language"] = lang_code
             _ = lambda key, **kwargs: i18n.gettext(lang_code, key, **kwargs)
-            await callback.answer(_(key="language_set_alert"))
+            await safe_answer_callback(callback, _(key="language_set_alert"))
             logging.info(
                 f"User {user_id} language updated to {lang_code} in session.")
         else:
-            await callback.answer("Could not set language.", show_alert=True)
+            await safe_answer_callback(
+                callback,
+                "Could not set language.",
+                show_alert=True,
+            )
             return
     except Exception as e_lang_update:
 
         logging.error(
             f"Error updating lang for user {user_id}: {e_lang_update}",
             exc_info=True)
-        await callback.answer("Error setting language.", show_alert=True)
+        await safe_answer_callback(callback, "Error setting language.", show_alert=True)
         return
-    await send_main_menu(callback,
-                         settings,
-                         i18n_data,
-                         subscription_service,
-                         session,
-                         is_edit=True)
+    if return_target == "bot":
+        await send_bot_interface_menu(callback,
+                                      settings,
+                                      i18n_data,
+                                      subscription_service,
+                                      session,
+                                      is_edit=True)
+    else:
+        await send_main_menu(callback,
+                             settings,
+                             i18n_data,
+                             subscription_service,
+                             session,
+                             is_edit=True)
 
 
 @router.callback_query(F.data.startswith("main_action:"))
@@ -664,22 +915,48 @@ async def main_action_callback_handler(
     action = callback.data.split(":")[1]
     user_id = callback.from_user.id
 
+    if action in {"back_to_main", "back_to_main_keep", "bot_interface"}:
+        await state.clear()
+
     from . import subscription as user_subscription_handlers
     from . import referral as user_referral_handlers
     from . import promo_user as user_promo_handlers
     from . import trial_handler as user_trial_handlers
 
     if not callback.message:
-        await callback.answer("Error: message context lost.", show_alert=True)
+        await safe_answer_callback(
+            callback,
+            "Error: message context lost.",
+            show_alert=True,
+        )
         return
 
     if action == "subscribe":
         await user_subscription_handlers.display_subscription_options(
             callback, i18n_data, settings, session)
+    elif action == "bot_subscribe":
+        await user_subscription_handlers.display_subscription_options(
+            callback,
+            i18n_data,
+            settings,
+            session,
+            back_callback="main_action:bot_interface",
+        )
     elif action == "my_subscription":
         await user_subscription_handlers.my_subscription_command_handler(
             callback, i18n_data, settings, panel_service, subscription_service,
             session, bot)
+    elif action == "bot_my_subscription":
+        await user_subscription_handlers.my_subscription_command_handler(
+            callback,
+            i18n_data,
+            settings,
+            panel_service,
+            subscription_service,
+            session,
+            bot,
+            back_callback="main_action:bot_interface",
+        )
     elif action == "my_devices":
         await user_subscription_handlers.my_devices_command_handler(
             callback, i18n_data, settings, panel_service, subscription_service,
@@ -687,15 +964,91 @@ async def main_action_callback_handler(
     elif action == "referral":
         await user_referral_handlers.referral_command_handler(
             callback, settings, i18n_data, referral_service, bot, session)
+    elif action == "bot_referral":
+        await user_referral_handlers.referral_command_handler(
+            callback,
+            settings,
+            i18n_data,
+            referral_service,
+            bot,
+            session,
+            back_callback="main_action:bot_interface",
+        )
     elif action == "apply_promo":
         await user_promo_handlers.prompt_promo_code_input(
             callback, state, i18n_data, settings, session)
+    elif action == "bot_apply_promo":
+        await user_promo_handlers.prompt_promo_code_input(
+            callback,
+            state,
+            i18n_data,
+            settings,
+            session,
+            back_callback="main_action:bot_interface",
+        )
     elif action == "request_trial":
         await user_trial_handlers.request_trial_confirmation_handler(
             callback, settings, i18n_data, subscription_service, session)
     elif action == "language":
 
         await language_command_handler(callback, i18n_data, settings)
+    elif action == "bot_language":
+        await language_command_handler(
+            callback,
+            i18n_data,
+            settings,
+            back_callback="main_action:bot_interface",
+        )
+    elif action == "bot_interface":
+        await send_bot_interface_menu(callback,
+                                      settings,
+                                      i18n_data,
+                                      subscription_service,
+                                      session,
+                                      is_edit=True)
+    elif action in {"info", "bot_info"}:
+        i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
+        current_lang = i18n_data.get("current_language",
+                                     settings.DEFAULT_LANGUAGE)
+        if not i18n:
+            await safe_answer_callback(
+                callback,
+                "Language service error.",
+                show_alert=True,
+            )
+            return
+        _ = lambda key, **kwargs: i18n.gettext(
+            current_lang, key, **kwargs) if i18n else key
+
+        privacy_url = settings.PRIVACY_POLICY_URL
+        user_agreement_url = settings.USER_AGREEMENT_URL or settings.TERMS_OF_SERVICE_URL
+
+        if not privacy_url and not user_agreement_url:
+            await safe_answer_callback(
+                callback,
+                _("error_occurred_try_again"),
+                show_alert=True,
+            )
+            return
+
+        reply_markup = get_information_links_keyboard(
+            current_lang,
+            i18n,
+            privacy_url,
+            user_agreement_url,
+            back_callback=(
+                "main_action:bot_interface"
+                if callback.data == "main_action:bot_info"
+                else "main_action:back_to_main"
+            ),
+        )
+        try:
+            await callback.message.edit_text(_(key="info_links_message"),
+                                             reply_markup=reply_markup)
+        except Exception:
+            await callback.message.answer(_(key="info_links_message"),
+                                          reply_markup=reply_markup)
+        await safe_answer_callback(callback)
     elif action == "back_to_main":
         await send_main_menu(callback,
                              settings,
@@ -713,5 +1066,9 @@ async def main_action_callback_handler(
     else:
         i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
         _ = lambda key, **kwargs: i18n.gettext(
-            i18n_data.get("current_language"), key, **kw) if i18n else key
-        await callback.answer(_("main_menu_unknown_action"), show_alert=True)
+            i18n_data.get("current_language"), key, **kwargs) if i18n else key
+        await safe_answer_callback(
+            callback,
+            _("main_menu_unknown_action"),
+            show_alert=True,
+        )

bot/handlers/user/subscription/core.py

@@ -39,7 +39,13 @@ def _hwid_callback_token(hwid: Optional[str]) -> str:
     return hashlib.sha256(hwid_str.encode()).hexdigest()[:32]
 
 
-async def display_subscription_options(event: Union[types.Message, types.CallbackQuery], i18n_data: dict, settings: Settings, session: AsyncSession):
+async def display_subscription_options(
+    event: Union[types.Message, types.CallbackQuery],
+    i18n_data: dict,
+    settings: Settings,
+    session: AsyncSession,
+    back_callback: str = "main_action:back_to_main",
+):
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
 
@@ -75,11 +81,20 @@ async def display_subscription_options(event: Union[types.Message, types.Callbac
     if options:
         text_content = get_text("select_traffic_package") if traffic_mode else get_text("select_subscription_period")
         reply_markup = get_subscription_options_keyboard(
-            options, currency_symbol_val, current_lang, i18n, traffic_mode=traffic_mode
+            options,
+            currency_symbol_val,
+            current_lang,
+            i18n,
+            traffic_mode=traffic_mode,
+            back_callback=back_callback,
         )
     else:
         text_content = get_text("no_subscription_options_available")
-        reply_markup = get_back_to_main_menu_markup(current_lang, i18n)
+        reply_markup = get_back_to_main_menu_markup(
+            current_lang,
+            i18n,
+            callback_data=back_callback,
+        )
 
     target_message_obj = event.message if isinstance(event, types.CallbackQuery) else event
     if not target_message_obj:
@@ -116,6 +131,7 @@ async def my_subscription_command_handler(
     subscription_service: SubscriptionService,
     session: AsyncSession,
     bot: Bot,
+    back_callback: str = "main_action:back_to_main",
 ):
     target = event.message if isinstance(event, types.CallbackQuery) else event
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
@@ -139,7 +155,11 @@ async def my_subscription_command_handler(
         buy_button = InlineKeyboardButton(
             text=get_text("menu_subscribe_inline"), callback_data="main_action:subscribe"
         )
-        back_markup = get_back_to_main_menu_markup(current_lang, i18n)
+        back_markup = get_back_to_main_menu_markup(
+            current_lang,
+            i18n,
+            callback_data=back_callback,
+        )
 
         kb = InlineKeyboardMarkup(inline_keyboard=[[buy_button], *back_markup.inline_keyboard])
 
@@ -172,10 +192,30 @@ async def my_subscription_command_handler(
         except Exception:
             pass
         return str(val)
+    def _format_traffic_period(strategy: Optional[str]) -> Optional[str]:
+        if not strategy:
+            return None
+        strategy_upper = str(strategy).upper()
+        key_map = {
+            "MONTH": "traffic_period_month",
+            "WEEK": "traffic_period_week",
+            "DAY": "traffic_period_day",
+            "NO_RESET": "traffic_period_no_reset",
+        }
+        label_key = key_map.get(strategy_upper)
+        return get_text(label_key) if label_key else strategy_upper
+
+    def _format_used_with_period(used_display: str, period_label: Optional[str]) -> str:
+        if not period_label:
+            return used_display
+        return get_text("traffic_used_with_period", traffic_used=used_display, traffic_period=period_label)
+
+    period_label = _format_traffic_period(active.get("traffic_limit_strategy"))
+    period_label = period_label or get_text("traffic_period_unknown")
 
     if traffic_mode:
         limit_display = _fmt_gb(active.get("traffic_limit_bytes"))
-        used_display = _fmt_gb(active.get("traffic_used_bytes"))
+        used_display = _format_used_with_period(_fmt_gb(active.get("traffic_used_bytes")), period_label)
         remaining_display = get_text("traffic_na")
         try:
             limit_val = active.get("traffic_limit_bytes") or 0
@@ -191,6 +231,7 @@ async def my_subscription_command_handler(
             traffic_limit=limit_display,
             traffic_used=used_display,
             traffic_left=remaining_display,
+            traffic_period=period_label,
             config_link=config_link_value,
         )
     else:
@@ -202,34 +243,41 @@ async def my_subscription_command_handler(
             config_link=config_link_value,
             traffic_limit=(f"{active['traffic_limit_bytes'] / 2**30:.2f} GB" if active.get("traffic_limit_bytes") else get_text("traffic_unlimited")),
             traffic_used=(
-                f"{active['traffic_used_bytes'] / 2**30:.2f} GB" if active.get("traffic_used_bytes") is not None else get_text("traffic_na")
+                _format_used_with_period(
+                    f"{active['traffic_used_bytes'] / 2**30:.2f} GB" if active.get("traffic_used_bytes") is not None else get_text("traffic_na"),
+                    period_label,
+                )
             ),
+            traffic_period=period_label,
         )
 
-    base_markup = get_back_to_main_menu_markup(current_lang, i18n)
+    base_markup = get_back_to_main_menu_markup(
+        current_lang,
+        i18n,
+        callback_data=back_callback,
+    )
     kb = base_markup.inline_keyboard
     try:
         local_sub = await subscription_dal.get_active_subscription_by_user_id(session, event.from_user.id)
         # Build rows to prepend above the base "back" markup
         prepend_rows = []
 
-        # 1) Mini-app connect button on top if enabled, otherwise fall back to config link URL
-        if settings.SUBSCRIPTION_MINI_APP_URL:
+        # 1) Connect button: prefer the actual subscription URL; fall back to mini-app
+        cfg_link_val = connect_button_url or config_link_display
+        if cfg_link_val:
+            prepend_rows.append([
+                InlineKeyboardButton(
+                    text=get_text("connect_button"),
+                    url=cfg_link_val,
+                )
+            ])
+        elif settings.SUBSCRIPTION_MINI_APP_URL:
             prepend_rows.append([
                 InlineKeyboardButton(
                     text=get_text("connect_button"),
                     web_app=WebAppInfo(url=settings.SUBSCRIPTION_MINI_APP_URL),
                 )
             ])
-        else:
-            cfg_link_val = connect_button_url or config_link_display
-            if cfg_link_val:
-                prepend_rows.append([
-                    InlineKeyboardButton(
-                        text=get_text("connect_button"),
-                        url=cfg_link_val,
-                    )
-                ])
 
         if settings.MY_DEVICES_SECTION_ENABLED:
             max_devices_value = active.get("max_devices")

bot/handlers/user/subscription/payments_platega.py

@@ -14,7 +14,11 @@ from db.dal import payment_dal
 router = Router(name="user_subscription_payments_platega_router")
 
 
-@router.callback_query(F.data.startswith("pay_platega:"))
+@router.callback_query(
+    F.data.startswith("pay_platega_sbp:")
+    | F.data.startswith("pay_platega_crypto:")
+    | F.data.startswith("pay_platega:")
+)
 async def pay_platega_callback_handler(
     callback: types.CallbackQuery,
     settings: Settings,
@@ -22,6 +26,29 @@ async def pay_platega_callback_handler(
     platega_service: PlategaService,
     session: AsyncSession,
 ):
+    callback_prefix, _, _ = (callback.data or "").partition(":")
+    if callback_prefix == "pay_platega_crypto":
+        platega_method_id = settings.PLATEGA_CRYPTO_METHOD
+        platega_variant = "crypto"
+        if not settings.PLATEGA_CRYPTO_ENABLED:
+            try:
+                await callback.answer()
+            except Exception:
+                pass
+            return
+    elif callback_prefix == "pay_platega_sbp":
+        platega_method_id = settings.platega_sbp_method_resolved
+        platega_variant = "sbp"
+        if not settings.PLATEGA_SBP_ENABLED:
+            try:
+                await callback.answer()
+            except Exception:
+                pass
+            return
+    else:
+        # Legacy callback (pre-split): keep working as SBP
+        platega_method_id = settings.platega_sbp_method_resolved
+        platega_variant = "sbp"
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
     get_text = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs) if i18n else key
@@ -103,6 +130,7 @@ async def pay_platega_callback_handler(
             "user_id": user_id,
             "months": months,
             "sale_mode": sale_mode,
+            "platega_variant": platega_variant,
         }
     )
 
@@ -114,6 +142,7 @@ async def pay_platega_callback_handler(
         currency=currency_code,
         description=payment_description,
         payload=payload_meta,
+        payment_method=platega_method_id,
     )
 
     if success:

bot/keyboards/inline/admin_keyboards.py

@@ -64,10 +64,12 @@ def get_user_management_keyboard(i18n_instance, lang: str) -> InlineKeyboardMark
                    callback_data="admin_action:users_search_prompt")
     builder.button(text=_(key="admin_ban_management_section"),
                    callback_data="admin_section:ban_management")
+    builder.button(text=_(key="admin_user_ratings_button"),
+                   callback_data="admin_action:user_ratings")
     
     builder.button(text=_(key="back_to_admin_panel_button"),
                    callback_data="admin_action:main")
-    builder.adjust(2, 1, 1)
+    builder.adjust(2, 2, 1)
     return builder.as_markup()
 
 
@@ -266,6 +268,8 @@ def get_banned_users_keyboard(banned_users: List[User], current_page: int,
             user_display_parts.append(user_row.first_name)
         if user_row.username:
             user_display_parts.append(f"(@{user_row.username})")
+        elif user_row.email:
+            user_display_parts.append(f"({user_row.email})")
         if not user_display_parts:
             user_display_parts.append(f"ID: {user_row.user_id}")
 
@@ -319,6 +323,8 @@ def get_users_list_keyboard(users: List[User], current_page: int,
         user_display_parts = []
         if user.username:
             user_display_parts.append(f"@{user.username}")
+        elif user.email:
+            user_display_parts.append(user.email)
         user_display_parts.append(f"ID: {user.user_id}")
         if user.first_name:
             user_display_parts.append(f"- {user.first_name}")
@@ -460,3 +466,21 @@ def get_back_to_admin_panel_keyboard(lang: str,
     builder.button(text=_(key="back_to_admin_panel_button"),
                    callback_data="admin_action:main")
     return builder.as_markup()
+
+
+def get_back_to_stats_monitoring_keyboard(lang: str,
+                                          i18n_instance) -> InlineKeyboardMarkup:
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    builder = InlineKeyboardBuilder()
+    builder.button(text=_(key="back_to_stats_monitoring_button"),
+                   callback_data="admin_section:stats_monitoring")
+    return builder.as_markup()
+
+
+def get_back_to_user_management_keyboard(lang: str,
+                                         i18n_instance) -> InlineKeyboardMarkup:
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    builder = InlineKeyboardBuilder()
+    builder.button(text=_(key="back_to_user_management_button"),
+                   callback_data="admin_section:user_management")
+    return builder.as_markup()

bot/keyboards/inline/user_keyboards.py

@@ -13,32 +13,82 @@ def get_main_menu_inline_keyboard(
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
     builder = InlineKeyboardBuilder()
 
+    if settings.SUBSCRIPTION_MINI_APP_URL:
+        builder.row(
+            InlineKeyboardButton(
+                text=_(key="menu_personal_account_button"),
+                web_app=WebAppInfo(url=settings.SUBSCRIPTION_MINI_APP_URL),
+            )
+        )
+    else:
+        builder.row(
+            InlineKeyboardButton(
+                text=_(key="menu_personal_account_button"),
+                callback_data="main_action:my_subscription",
+            )
+        )
+
+    builder.row(
+        InlineKeyboardButton(text=_(key="menu_bot_interface_button"),
+                             callback_data="main_action:bot_interface"))
+
+    if settings.SUPPORT_LINK:
+        builder.row(
+            InlineKeyboardButton(text=_(key="menu_support_button"),
+                                 url=settings.SUPPORT_LINK))
+
+    user_agreement_url = settings.USER_AGREEMENT_URL or settings.TERMS_OF_SERVICE_URL
+    if settings.PRIVACY_POLICY_URL or user_agreement_url:
+        builder.row(
+            InlineKeyboardButton(text=_(key="menu_info_button"),
+                                 callback_data="main_action:info"))
+
+    return builder.as_markup()
+
+
+def get_bot_interface_inline_keyboard(
+        lang: str,
+        i18n_instance,
+        settings: Settings,
+        show_trial_button: bool = False) -> InlineKeyboardMarkup:
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    builder = InlineKeyboardBuilder()
+
     if show_trial_button and settings.TRIAL_ENABLED:
         builder.row(
             InlineKeyboardButton(text=_(key="menu_activate_trial_button"),
                                  callback_data="main_action:request_trial"))
 
+    if settings.SUBSCRIPTION_MINI_APP_URL:
+        builder.row(
+            InlineKeyboardButton(
+                text=_(key="menu_personal_account_button"),
+                web_app=WebAppInfo(url=settings.SUBSCRIPTION_MINI_APP_URL),
+            )
+        )
+
     builder.row(
         InlineKeyboardButton(text=_(key="menu_subscribe_inline"),
-                             callback_data="main_action:subscribe"))
+                             callback_data="main_action:bot_subscribe"))
     builder.row(
         InlineKeyboardButton(
             text=_(key="menu_my_subscription_inline"),
-            callback_data="main_action:my_subscription",
+            callback_data="main_action:bot_my_subscription",
         )
     )
 
     referral_button = InlineKeyboardButton(
         text=_(key="menu_referral_inline"),
-        callback_data="main_action:referral")
+        callback_data="main_action:bot_referral")
     promo_button = InlineKeyboardButton(
         text=_(key="menu_apply_promo_button"),
-        callback_data="main_action:apply_promo")
-    builder.row(referral_button, promo_button)
+        callback_data="main_action:bot_apply_promo")
+    builder.row(referral_button)
+    builder.row(promo_button)
 
     language_button = InlineKeyboardButton(
         text=_(key="menu_language_settings_inline"),
-        callback_data="main_action:language")
+        callback_data="main_action:bot_language")
     status_button_list = []
     if settings.SERVER_STATUS_URL:
         status_button_list.append(
@@ -55,25 +105,54 @@ def get_main_menu_inline_keyboard(
             InlineKeyboardButton(text=_(key="menu_support_button"),
                                  url=settings.SUPPORT_LINK))
 
-    if settings.TERMS_OF_SERVICE_URL:
+    user_agreement_url = settings.USER_AGREEMENT_URL or settings.TERMS_OF_SERVICE_URL
+    if settings.PRIVACY_POLICY_URL or user_agreement_url:
         builder.row(
-            InlineKeyboardButton(text=_(key="menu_terms_button"),
-                                 url=settings.TERMS_OF_SERVICE_URL))
+            InlineKeyboardButton(text=_(key="menu_info_button"),
+                                 callback_data="main_action:bot_info"))
+
+    builder.row(
+        InlineKeyboardButton(text=_(key="back_to_main_menu_button"),
+                             callback_data="main_action:back_to_main"))
 
     return builder.as_markup()
 
 
+def get_information_links_keyboard(
+        lang: str,
+        i18n_instance,
+        privacy_policy_url: Optional[str],
+        user_agreement_url: Optional[str],
+        back_callback: str = "main_action:back_to_main") -> InlineKeyboardMarkup:
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    builder = InlineKeyboardBuilder()
+    if privacy_policy_url:
+        builder.row(
+            InlineKeyboardButton(text=_(key="privacy_policy_button"),
+                                 url=privacy_policy_url))
+    if user_agreement_url:
+        builder.row(
+            InlineKeyboardButton(text=_(key="user_agreement_button"),
+                                 url=user_agreement_url))
+    builder.row(
+        InlineKeyboardButton(text=_(key="back_to_main_menu_button"),
+                             callback_data=back_callback))
+    return builder.as_markup()
+
+
 def get_language_selection_keyboard(i18n_instance,
-                                    current_lang: str) -> InlineKeyboardMarkup:
+                                    current_lang: str,
+                                    back_callback: str = "main_action:back_to_main") -> InlineKeyboardMarkup:
     _ = lambda key, **kwargs: i18n_instance.gettext(current_lang, key, **kwargs
                                                     )
+    callback_suffix = ":bot" if back_callback == "main_action:bot_interface" else ""
     builder = InlineKeyboardBuilder()
     builder.button(text=f"🇬🇧 English {'✅' if current_lang == 'en' else ''}",
-                   callback_data="set_lang_en")
+                   callback_data=f"set_lang_en{callback_suffix}")
     builder.button(text=f"🇷🇺 Русский {'✅' if current_lang == 'ru' else ''}",
-                   callback_data="set_lang_ru")
+                   callback_data=f"set_lang_ru{callback_suffix}")
     builder.button(text=_(key="back_to_main_menu_button"),
-                   callback_data="main_action:back_to_main")
+                   callback_data=back_callback)
     builder.adjust(1)
     return builder.as_markup()
 
@@ -92,7 +171,8 @@ def get_trial_confirmation_keyboard(lang: str,
 
 def get_subscription_options_keyboard(subscription_options: Dict[
     float, Optional[float]], currency_symbol_val: str, lang: str,
-                                      i18n_instance, traffic_mode: bool = False) -> InlineKeyboardMarkup:
+                                      i18n_instance, traffic_mode: bool = False,
+                                      back_callback: str = "main_action:back_to_main") -> InlineKeyboardMarkup:
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
     builder = InlineKeyboardBuilder()
     def _format_gb(val: float) -> str:
@@ -119,7 +199,7 @@ def get_subscription_options_keyboard(subscription_options: Dict[
         builder.adjust(1)
     builder.row(
         InlineKeyboardButton(text=_(key="back_to_main_menu_button"),
-                             callback_data="main_action:back_to_main"))
+                             callback_data=back_callback))
     return builder.as_markup()
 
 
@@ -133,6 +213,14 @@ def get_payment_method_keyboard(months: int, price: float,
         return str(int(val)) if float(val).is_integer() else f"{val:g}"
     value_str = _format_value(months)
     mode_suffix = f":{sale_mode}"
+    import logging as _kbd_logging
+    _kbd_logging.info(
+        "payment_method_keyboard build: order=%s | platega_enabled=%s sbp=%s crypto=%s",
+        settings.payment_methods_order,
+        settings.PLATEGA_ENABLED,
+        settings.PLATEGA_SBP_ENABLED,
+        settings.PLATEGA_CRYPTO_ENABLED,
+    )
     for method in settings.payment_methods_order:
         if method == "severpay" and getattr(settings, "SEVERPAY_ENABLED", False):
             builder.button(
@@ -144,10 +232,15 @@ def get_payment_method_keyboard(months: int, price: float,
                 text=_("pay_with_sbp_button"),
                 callback_data=f"pay_fk:{value_str}:{price}{mode_suffix}",
             )
-        elif method == "platega" and settings.PLATEGA_ENABLED:
+        elif method == "platega_sbp" and settings.PLATEGA_ENABLED and settings.PLATEGA_SBP_ENABLED:
             builder.button(
-                text=_("pay_with_platega_button"),
-                callback_data=f"pay_platega:{value_str}:{price}{mode_suffix}",
+                text=_("pay_with_platega_sbp_button"),
+                callback_data=f"pay_platega_sbp:{value_str}:{price}{mode_suffix}",
+            )
+        elif method == "platega_crypto" and settings.PLATEGA_ENABLED and settings.PLATEGA_CRYPTO_ENABLED:
+            builder.button(
+                text=_("pay_with_platega_crypto_button"),
+                callback_data=f"pay_platega_crypto:{value_str}:{price}{mode_suffix}",
             )
         elif method == "yookassa" and settings.YOOKASSA_ENABLED:
             builder.button(
@@ -290,13 +383,14 @@ def get_yk_saved_cards_keyboard(
 
 
 def get_referral_link_keyboard(lang: str,
-                               i18n_instance) -> InlineKeyboardMarkup:
+                               i18n_instance,
+                               back_callback: str = "main_action:back_to_main") -> InlineKeyboardMarkup:
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
     builder = InlineKeyboardBuilder()
     builder.button(text=_(key="referral_share_message_button"),
                    callback_data="referral_action:share_message")
     builder.button(text=_(key="back_to_main_menu_button"),
-                   callback_data="main_action:back_to_main")
+                   callback_data=back_callback)
     builder.adjust(1)
     return builder.as_markup()
 
@@ -382,17 +476,17 @@ def get_connect_and_main_keyboard(
     builder = InlineKeyboardBuilder()
     button_target = connect_button_url or config_link
 
-    if settings.SUBSCRIPTION_MINI_APP_URL:
+    if button_target:
+        builder.row(
+            InlineKeyboardButton(text=_("connect_button"), url=button_target)
+        )
+    elif settings.SUBSCRIPTION_MINI_APP_URL:
         builder.row(
             InlineKeyboardButton(
                 text=_("connect_button"),
                 web_app=WebAppInfo(url=settings.SUBSCRIPTION_MINI_APP_URL),
             )
         )
-    elif button_target:
-        builder.row(
-            InlineKeyboardButton(text=_("connect_button"), url=button_target)
-        )
     else:
         builder.row(
             InlineKeyboardButton(

bot/main_bot.py

@@ -40,6 +40,12 @@ from bot.handlers.admin.sync_admin import perform_sync
 from bot.utils.message_queue import init_queue_manager
 
 
+def redact_token(value: str, token: Optional[str]) -> str:
+    if not value or not token:
+        return value
+    return value.replace(token, "***")
+
+
 async def register_all_routers(dp: Dispatcher, settings: Settings):
     dp.include_router(build_root_router(settings))
     logging.info("All application routers registered.")
@@ -59,52 +65,48 @@ async def on_startup_configured(dispatcher: Dispatcher):
     telegram_webhook_url_to_set = settings.WEBHOOK_BASE_URL
     if telegram_webhook_url_to_set:
         full_telegram_webhook_url = (
-            f"{str(telegram_webhook_url_to_set).rstrip('/')}/{settings.BOT_TOKEN}"
+            f"{str(telegram_webhook_url_to_set).rstrip('/')}{settings.telegram_webhook_path}"
         )
 
         logging.info(
-            f"STARTUP: Attempting to set Telegram webhook to: {full_telegram_webhook_url if full_telegram_webhook_url != 'ERROR_URL_TOKEN_DETECTED' else 'HIDDEN DUE TO TOKEN'}"
+            "STARTUP: Attempting to set Telegram webhook to: %s",
+            redact_token(full_telegram_webhook_url, settings.BOT_TOKEN),
         )
 
-        if full_telegram_webhook_url != "ERROR_URL_TOKEN_DETECTED":
-            try:
-                current_webhook_info = await bot.get_webhook_info()
-                logging.info(
-                    f"STARTUP: Current Telegram webhook info BEFORE setting: {current_webhook_info.model_dump_json(exclude_none=True, indent=2)}"
-                )
-
-                set_success = await bot.set_webhook(
-                    url=full_telegram_webhook_url,
-                    drop_pending_updates=True,
-                    allowed_updates=dispatcher.resolve_used_update_types(),
-                )
-                if set_success:
-                    logging.info(
-                        f"STARTUP: bot.set_webhook to {full_telegram_webhook_url} returned SUCCESS (True)."
-                    )
-                else:
-                    logging.error(
-                        f"STARTUP: bot.set_webhook to {full_telegram_webhook_url} returned FAILURE (False)."
-                    )
-
-                new_webhook_info = await bot.get_webhook_info()
-                logging.info(
-                    f"STARTUP: Telegram Webhook info AFTER setting: {new_webhook_info.model_dump_json(exclude_none=True, indent=2)}"
-                )
-                if not new_webhook_info.url:
-                    logging.error(
-                        "STARTUP: CRITICAL - Telegram Webhook URL is EMPTY after set attempt. Check bot token and URL validity."
-                    )
-
-            except Exception as e_setwebhook:
-                logging.error(
-                    f"STARTUP: EXCEPTION during set/get Telegram webhook: {e_setwebhook}",
-                    exc_info=True,
-                )
-        else:
-            logging.error(
-                "STARTUP: Skipped setting Telegram webhook due to security or configuration error."
+        try:
+            current_webhook_info = await bot.get_webhook_info()
+            logging.info(
+                f"STARTUP: Current Telegram webhook info BEFORE setting: {current_webhook_info.model_dump_json(exclude_none=True, indent=2)}"
             )
+
+            set_success = await bot.set_webhook(
+                url=full_telegram_webhook_url,
+                secret_token=settings.WEBHOOK_SECRET_TOKEN,
+                drop_pending_updates=True,
+                allowed_updates=dispatcher.resolve_used_update_types(),
+            )
+            if set_success:
+                logging.info(
+                    "STARTUP: bot.set_webhook to %s returned SUCCESS (True).",
+                    redact_token(full_telegram_webhook_url, settings.BOT_TOKEN),
+                )
+            else:
+                logging.error(
+                    "STARTUP: bot.set_webhook to %s returned FAILURE (False).",
+                    redact_token(full_telegram_webhook_url, settings.BOT_TOKEN),
+                )
+
+            new_webhook_info = await bot.get_webhook_info()
+            logging.info(
+                f"STARTUP: Telegram Webhook info AFTER setting: {new_webhook_info.model_dump_json(exclude_none=True, indent=2)}"
+            )
+            if not new_webhook_info.url:
+                logging.error(
+                    "STARTUP: CRITICAL - Telegram Webhook URL is EMPTY after set attempt. Check bot token and URL validity."
+                )
+
+        except Exception:
+            logging.exception("STARTUP: EXCEPTION during set/get Telegram webhook.")
     else:
         logging.error(
             "STARTUP: WEBHOOK_BASE_URL not set in environment. Webhook mode is required. Exiting."
@@ -115,7 +117,7 @@ async def on_startup_configured(dispatcher: Dispatcher):
         try:
             menu_text = i18n_instance.gettext(
                 settings.DEFAULT_LANGUAGE,
-                "menu_my_subscription_inline",
+                "menu_personal_account_button",
             )
             await bot.set_chat_menu_button(
                 menu_button=MenuButtonWebApp(
@@ -127,27 +129,31 @@ async def on_startup_configured(dispatcher: Dispatcher):
             logging.info(
                 "STARTUP: Mini app domain registered and default menu button restored."
             )
-        except Exception as e:
-            logging.error(
-                f"STARTUP: Failed to register mini app domain: {e}", exc_info=True
-            )
+        except Exception:
+            logging.exception("STARTUP: Failed to register mini app domain.")
 
-    if settings.START_COMMAND_DESCRIPTION:
-        try:
-            await bot.set_my_commands([
-                BotCommand(command="start", description=settings.START_COMMAND_DESCRIPTION)
-            ])
-            logging.info("STARTUP: /start command description set.")
-        except Exception as e:
-            logging.error(f"STARTUP: Failed to set bot commands: {e}", exc_info=True)
+    try:
+        bot_commands = [
+            BotCommand(command="tg", description="Интерфейс в боте"),
+        ]
+        if settings.START_COMMAND_DESCRIPTION:
+            bot_commands.insert(
+                0,
+                BotCommand(command="start",
+                           description=settings.START_COMMAND_DESCRIPTION),
+            )
+        await bot.set_my_commands(bot_commands)
+        logging.info("STARTUP: bot command descriptions set.")
+    except Exception:
+        logging.exception("STARTUP: Failed to set bot commands.")
 
     # Initialize message queue manager
     try:
         queue_manager = init_queue_manager(bot)
         dispatcher["queue_manager"] = queue_manager
         logging.info("STARTUP: Message queue manager initialized")
-    except Exception as e:
-        logging.error(f"STARTUP: Failed to initialize message queue manager: {e}", exc_info=True)
+    except Exception:
+        logging.exception("STARTUP: Failed to initialize message queue manager.")
 
     # Automatic sync on startup
     try:
@@ -166,8 +172,8 @@ async def on_startup_configured(dispatcher: Dispatcher):
         else:
             logging.warning(f"STARTUP: Automatic sync completed with issues. Status: {sync_result.get('status', 'unknown')}")
             
-    except Exception as e:
-        logging.error(f"STARTUP: Failed to run automatic sync: {e}", exc_info=True)
+    except Exception:
+        logging.exception("STARTUP: Failed to run automatic sync.")
 
     logging.info("STARTUP: Bot on_startup_configured completed.")
 
@@ -201,7 +207,7 @@ async def on_shutdown_configured(dispatcher: Dispatcher):
         "freekassa_service",
         "panel_webhook_service",
         "yookassa_service",
-        "nalogo_service",
+        "lknpd_service",
         "promo_code_service",
         "stars_service",
         "subscription_service",
@@ -243,8 +249,14 @@ async def run_bot(settings_param: Settings):
     actual_bot_username = "your_bot_username"
     try:
         bot_info = await bot.get_me()
-        actual_bot_username = bot_info.username
-        logging.info(f"Bot username resolved: @{actual_bot_username}")
+        if bot_info.username:
+            actual_bot_username = bot_info.username
+            dp["bot_username"] = actual_bot_username
+            logging.info(f"Bot username resolved: @{actual_bot_username}")
+        else:
+            logging.warning(
+                "Bot username is empty; Telegram Login Widget will be unavailable."
+            )
     except Exception as e:
         logging.error(
             f"Failed to get bot info (e.g., for YooKassa default URL): {e}. Using fallback: {actual_bot_username}"

bot/middlewares/profile_sync.py

@@ -22,13 +22,17 @@ class ProfileSyncMiddleware(BaseMiddleware):
 
         if session and tg_user:
             try:
-                db_user = await user_dal.get_user_by_id(session, tg_user.id)
+                db_user = await user_dal.get_user_by_telegram_id(session, tg_user.id)
+                if not db_user:
+                    db_user = await user_dal.get_user_by_id(session, tg_user.id)
                 if db_user:
                     update_payload: Dict[str, Any] = {}
                     sanitized_username = sanitize_username(tg_user.username)
                     sanitized_first_name = sanitize_display_name(tg_user.first_name)
                     sanitized_last_name = sanitize_display_name(tg_user.last_name)
 
+                    if db_user.telegram_id != tg_user.id:
+                        update_payload["telegram_id"] = tg_user.id
                     if db_user.username != sanitized_username:
                         update_payload["username"] = sanitized_username
                     if db_user.first_name != sanitized_first_name:
@@ -37,7 +41,7 @@ class ProfileSyncMiddleware(BaseMiddleware):
                         update_payload["last_name"] = sanitized_last_name
 
                     if update_payload:
-                        await user_dal.update_user(session, tg_user.id, update_payload)
+                        await user_dal.update_user(session, db_user.user_id, update_payload)
                         logging.info(
                             f"ProfileSyncMiddleware: Updated user {tg_user.id} profile fields: {list(update_payload.keys())}"
                         )
@@ -47,13 +51,20 @@ class ProfileSyncMiddleware(BaseMiddleware):
                             panel_service = data.get("panel_service")
                             if panel_service and db_user.panel_user_uuid:
                                 description_text = "\n".join([
+                                    db_user.email or "",
                                     username_for_display(tg_user.username, with_at=False) if sanitized_username is not None else "",
                                     sanitized_first_name or "",
                                     sanitized_last_name or "",
                                 ]).strip()
+                                panel_payload = {
+                                    "description": description_text,
+                                    "telegramId": tg_user.id,
+                                }
+                                if db_user.email:
+                                    panel_payload["email"] = db_user.email
                                 await panel_service.update_user_details_on_panel(
                                     db_user.panel_user_uuid,
-                                    {"description": description_text},
+                                    panel_payload,
                                 )
                         except Exception as e_upd_desc:
                             logging.warning(

bot/services/crypto_pay_service.py

@@ -1,5 +1,7 @@
+import hashlib
 import logging
 import json
+import hmac
 from typing import Optional
 
 from aiogram import Bot
@@ -19,6 +21,8 @@ from db.dal import payment_dal, user_dal
 from bot.utils.text_sanitizer import sanitize_display_name, username_for_display
 from bot.utils.config_link import prepare_config_links
 
+logger = logging.getLogger(__name__)
+
 
 class CryptoPayService:
     def __init__(
@@ -38,6 +42,7 @@ class CryptoPayService:
         self.async_session_factory = async_session_factory
         self.subscription_service = subscription_service
         self.referral_service = referral_service
+        self.token = token
         if token:
             net = Networks.TEST_NET if str(network).lower() == "testnet" else Networks.MAIN_NET
             self.client = AioCryptoPay(token=token, network=net)
@@ -65,6 +70,7 @@ class CryptoPayService:
         amount: float,
         description: str,
         sale_mode: str = "subscription",
+        url_kind: str = "bot",
     ) -> Optional[str]:
         if not self.configured or not self.client:
             logging.error("CryptoPayService not configured")
@@ -116,16 +122,22 @@ class CryptoPayService:
                     str(invoice.status),
                 )
                 await session.commit()
-            except Exception as e_db_update:
+            except Exception:
                 await session.rollback()
-                logging.error(
-                    f"Failed to update cryptopay payment record {payment_record.payment_id}: {e_db_update}",
-                    exc_info=True,
+                logging.exception(
+                    "Failed to update cryptopay payment record %s.",
+                    payment_record.payment_id,
                 )
                 return None
+            if url_kind == "web":
+                return (
+                    getattr(invoice, "web_app_invoice_url", None)
+                    or getattr(invoice, "mini_app_invoice_url", None)
+                    or invoice.bot_invoice_url
+                )
             return invoice.bot_invoice_url
-        except Exception as e:
-            logging.error(f"CryptoPay invoice creation failed: {e}", exc_info=True)
+        except Exception:
+            logging.exception("CryptoPay invoice creation failed.")
             return None
 
     async def _invoice_paid_handler(self, update: Update, app: web.Application):
@@ -140,8 +152,8 @@ class CryptoPayService:
             payment_db_id = int(meta["payment_db_id"])
             sale_mode = meta.get("sale_mode") or ("traffic" if self.settings.traffic_sale_mode else "subscription")
             traffic_gb = float(meta.get("traffic_gb")) if meta.get("traffic_gb") else months
-        except Exception as e:
-            logging.error(f"Failed to parse CryptoPay payload: {e}")
+        except Exception:
+            logging.exception("Failed to parse CryptoPay payload.")
             return
 
         async_session_factory: sessionmaker = app["async_session_factory"]
@@ -179,9 +191,9 @@ class CryptoPayService:
                         skip_if_active_before_payment=False,
                     )
                 await session.commit()
-            except Exception as e:
+            except Exception:
                 await session.rollback()
-                logging.error(f"Failed to process CryptoPay invoice: {e}", exc_info=True)
+                logging.exception("Failed to process CryptoPay invoice.")
                 return
 
             db_user = await user_dal.get_user_by_id(session, user_id)
@@ -242,8 +254,8 @@ class CryptoPayService:
                     parse_mode="HTML",
                     disable_web_page_preview=True,
                 )
-            except Exception as e:
-                logging.error(f"Failed to send CryptoPay success message: {e}")
+            except Exception:
+                logging.exception("Failed to send CryptoPay success message.")
 
             # Send notification about payment
             try:
@@ -258,12 +270,30 @@ class CryptoPayService:
                     payment_provider="crypto_pay",
                     username=user.username if user else None
                 )
-            except Exception as e:
-                logging.error(f"Failed to send crypto_pay payment notification: {e}")
+            except Exception:
+                logging.exception("Failed to send crypto_pay payment notification.")
+
+    def _validate_webhook_signature(self, raw_body: bytes, signature: str) -> bool:
+        if not self.token:
+            return False
+
+        expected_signature = hmac.new(
+            hashlib.sha256(self.token.encode("utf-8")).digest(),
+            raw_body,
+            hashlib.sha256,
+        ).hexdigest()
+        if not hmac.compare_digest(expected_signature, signature or ""):
+            logger.error("CryptoPay signature mismatch")
+            return False
+        return True
 
     async def webhook_route(self, request: web.Request) -> web.Response:
         if not self.configured or not self.client:
             return web.Response(status=503, text="cryptopay_disabled")
+        raw_body = await request.read()
+        signature = request.headers.get("crypto-pay-api-signature", "")
+        if not self._validate_webhook_signature(raw_body, signature):
+            return web.Response(status=401)
         return await self.client.get_updates(request)
 
 

bot/services/email_auth_service.py

@@ -0,0 +1,605 @@
+import asyncio
+import hashlib
+import hmac
+import logging
+import re
+import secrets
+import smtplib
+import ssl
+from dataclasses import dataclass
+from datetime import datetime, timezone, timedelta
+from email.message import EmailMessage
+from email.utils import formataddr
+from typing import Optional
+
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from config.settings import Settings
+from db.dal import security_dal
+from db.models import EmailVerificationCode
+from bot.services.email_templates import EmailContent, render_login_code
+
+logger = logging.getLogger(__name__)
+
+EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
+
+
+@dataclass(frozen=True)
+class SmtpAttempt:
+    port: int
+    use_ssl: bool
+    starttls: bool
+
+
+@dataclass(frozen=True)
+class EmailCodeRequestResult:
+    ok: bool
+    error: Optional[str] = None
+    retry_after: Optional[int] = None
+
+
+@dataclass(frozen=True)
+class EmailCodeVerifyResult:
+    ok: bool
+    error: Optional[str] = None
+    retry_after: Optional[int] = None
+
+
+@dataclass(frozen=True)
+class EmailMagicVerifyResult:
+    ok: bool
+    error: Optional[str] = None
+    email: Optional[str] = None
+    purpose: Optional[str] = None
+    target_user_id: Optional[int] = None
+
+
+def normalize_email(value: str) -> str:
+    return (value or "").strip().lower()
+
+
+def is_valid_email(value: str) -> bool:
+    email = normalize_email(value)
+    return bool(email and len(email) <= 254 and EMAIL_RE.match(email))
+
+
+def _email_throttle_identifier(email: str, purpose: str, target_user_id: Optional[int]) -> str:
+    target_part = "none" if target_user_id is None else str(target_user_id)
+    return f"{purpose}:{target_part}:{email}"
+
+
+class EmailAuthService:
+    def __init__(self, settings: Settings):
+        self.settings = settings
+
+    def _smtp_attempts(self) -> list[SmtpAttempt]:
+        attempts: list[SmtpAttempt] = []
+        primary_port = int(self.settings.SMTP_PORT)
+
+        for port in self.settings.smtp_ports_to_try:
+            if port == primary_port:
+                use_ssl = bool(self.settings.SMTP_USE_SSL or port == 465)
+                starttls = bool(self.settings.SMTP_STARTTLS and not use_ssl)
+            else:
+                use_ssl = port == 465
+                starttls = bool(self.settings.SMTP_STARTTLS and not use_ssl)
+            attempts.append(SmtpAttempt(port=port, use_ssl=use_ssl, starttls=starttls))
+
+        return attempts or [
+            SmtpAttempt(
+                port=primary_port,
+                use_ssl=bool(self.settings.SMTP_USE_SSL or primary_port == 465),
+                starttls=bool(
+                    self.settings.SMTP_STARTTLS
+                    and not self.settings.SMTP_USE_SSL
+                    and primary_port != 465
+                ),
+            )
+        ]
+
+    def _hash_code(self, email: str, purpose: str, code: str) -> str:
+        secret = hmac.new(
+            self.settings.BOT_TOKEN.encode("utf-8"),
+            b"remnawave-tg-shop-email-code",
+            hashlib.sha256,
+        ).digest()
+        payload = f"{purpose}:{email}:{code}".encode("utf-8")
+        return hmac.new(secret, payload, hashlib.sha256).hexdigest()
+
+    def _hash_magic_token(self, token: str) -> str:
+        secret = hmac.new(
+            self.settings.BOT_TOKEN.encode("utf-8"),
+            b"remnawave-tg-shop-email-magic",
+            hashlib.sha256,
+        ).digest()
+        return hmac.new(secret, token.encode("utf-8"), hashlib.sha256).hexdigest()
+
+    def _build_magic_link(self, *, token: str, purpose: str) -> Optional[str]:
+        base_url = (self.settings.SUBSCRIPTION_MINI_APP_URL or "").strip()
+        if not base_url:
+            return None
+        from urllib.parse import urlencode, urlsplit, urlunsplit
+
+        parsed = urlsplit(base_url)
+        if parsed.scheme not in ("http", "https") or not parsed.netloc:
+            return None
+        params = {"login_token": token}
+        if purpose and purpose != "login":
+            params["login_purpose"] = purpose
+        existing_query = parsed.query
+        new_query = urlencode(params)
+        merged_query = f"{existing_query}&{new_query}" if existing_query else new_query
+        return urlunsplit((parsed.scheme, parsed.netloc, parsed.path, merged_query, parsed.fragment))
+
+    async def request_code(
+        self,
+        session: AsyncSession,
+        *,
+        email: str,
+        purpose: str,
+        language_code: str,
+        target_user_id: Optional[int] = None,
+    ) -> EmailCodeRequestResult:
+        normalized_email = normalize_email(email)
+        if not self.settings.email_auth_configured:
+            return EmailCodeRequestResult(ok=False, error="email_auth_not_configured")
+        if not is_valid_email(normalized_email):
+            return EmailCodeRequestResult(ok=False, error="invalid_email")
+
+        now = datetime.now(timezone.utc)
+        throttle = await security_dal.check_throttle(
+            session,
+            scope=security_dal.EMAIL_CODE_VERIFY_SCOPE,
+            identifier=_email_throttle_identifier(normalized_email, purpose, target_user_id),
+            now=now,
+        )
+        if throttle.locked:
+            return EmailCodeRequestResult(
+                ok=False,
+                error="rate_limited",
+                retry_after=throttle.retry_after,
+            )
+
+        latest_code = await self._get_latest_code(
+            session,
+            email=normalized_email,
+            purpose=purpose,
+            target_user_id=target_user_id,
+        )
+        if latest_code and latest_code.created_at:
+            created_at = latest_code.created_at
+            if created_at.tzinfo is None:
+                created_at = created_at.replace(tzinfo=timezone.utc)
+            resend_after = max(1, int(self.settings.EMAIL_CODE_RESEND_SECONDS))
+            elapsed = int((now - created_at).total_seconds())
+            if elapsed < resend_after and latest_code.consumed_at is None:
+                return EmailCodeRequestResult(
+                    ok=False,
+                    error="rate_limited",
+                    retry_after=resend_after - elapsed,
+                )
+
+        await session.execute(
+            update(EmailVerificationCode)
+            .where(
+                EmailVerificationCode.email == normalized_email,
+                EmailVerificationCode.purpose == purpose,
+                EmailVerificationCode.target_user_id == target_user_id,
+                EmailVerificationCode.status == "active",
+                EmailVerificationCode.consumed_at.is_(None),
+            )
+            .values(status="superseded")
+        )
+
+        code = f"{secrets.randbelow(1_000_000):06d}"
+        magic_token = secrets.token_urlsafe(32)
+        magic_link = self._build_magic_link(token=magic_token, purpose=purpose)
+        code_model = EmailVerificationCode(
+            email=normalized_email,
+            code_hash=self._hash_code(normalized_email, purpose, code),
+            magic_token_hash=self._hash_magic_token(magic_token) if magic_link else None,
+            purpose=purpose,
+            target_user_id=target_user_id,
+            expires_at=now + timedelta(seconds=max(60, int(self.settings.EMAIL_CODE_TTL_SECONDS))),
+            status="active",
+        )
+        session.add(code_model)
+        await session.flush()
+
+        await self._send_code_email(
+            email=normalized_email,
+            code=code,
+            language_code=language_code,
+            magic_link=magic_link,
+        )
+        return EmailCodeRequestResult(ok=True)
+
+    async def verify_code(
+        self,
+        session: AsyncSession,
+        *,
+        email: str,
+        purpose: str,
+        code: str,
+        target_user_id: Optional[int] = None,
+    ) -> EmailCodeVerifyResult:
+        normalized_email = normalize_email(email)
+        normalized_code = re.sub(r"\D", "", code or "")
+        if not is_valid_email(normalized_email):
+            return EmailCodeVerifyResult(ok=False, error="invalid_code")
+
+        now = datetime.now(timezone.utc)
+        throttle_identifier = _email_throttle_identifier(
+            normalized_email,
+            purpose,
+            target_user_id,
+        )
+        throttle = await security_dal.check_throttle(
+            session,
+            scope=security_dal.EMAIL_CODE_VERIFY_SCOPE,
+            identifier=throttle_identifier,
+            now=now,
+        )
+        if throttle.locked:
+            return EmailCodeVerifyResult(
+                ok=False,
+                error="rate_limited",
+                retry_after=throttle.retry_after,
+            )
+
+        latest_code = await self._get_latest_code(
+            session,
+            email=normalized_email,
+            purpose=purpose,
+            target_user_id=target_user_id,
+        )
+        if not latest_code or latest_code.consumed_at is not None:
+            return EmailCodeVerifyResult(ok=False, error="invalid_code")
+
+        expires_at = latest_code.expires_at
+        if expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=timezone.utc)
+        if expires_at < now:
+            return EmailCodeVerifyResult(ok=False, error="expired_code")
+
+        max_attempts = max(1, int(self.settings.EMAIL_CODE_MAX_ATTEMPTS))
+        if int(latest_code.attempts or 0) >= max_attempts:
+            return EmailCodeVerifyResult(ok=False, error="too_many_attempts")
+
+        if len(normalized_code) != 6:
+            latest_code.attempts = int(latest_code.attempts or 0) + 1
+            throttle_result = await security_dal.record_throttle_failure(
+                session,
+                scope=security_dal.EMAIL_CODE_VERIFY_SCOPE,
+                identifier=throttle_identifier,
+                max_failures=self.settings.BRUTE_FORCE_MAX_FAILURES,
+                window_seconds=self.settings.BRUTE_FORCE_WINDOW_SECONDS,
+                lock_seconds=self.settings.BRUTE_FORCE_LOCK_SECONDS,
+                now=now,
+            )
+            await session.flush()
+            if throttle_result.locked:
+                return EmailCodeVerifyResult(
+                    ok=False,
+                    error="rate_limited",
+                    retry_after=throttle_result.retry_after,
+                )
+            if int(latest_code.attempts or 0) >= max_attempts:
+                return EmailCodeVerifyResult(ok=False, error="too_many_attempts")
+            return EmailCodeVerifyResult(ok=False, error="invalid_code")
+
+        expected_hash = self._hash_code(normalized_email, purpose, normalized_code)
+        if not hmac.compare_digest(expected_hash, latest_code.code_hash):
+            latest_code.attempts = int(latest_code.attempts or 0) + 1
+            throttle_result = await security_dal.record_throttle_failure(
+                session,
+                scope=security_dal.EMAIL_CODE_VERIFY_SCOPE,
+                identifier=throttle_identifier,
+                max_failures=self.settings.BRUTE_FORCE_MAX_FAILURES,
+                window_seconds=self.settings.BRUTE_FORCE_WINDOW_SECONDS,
+                lock_seconds=self.settings.BRUTE_FORCE_LOCK_SECONDS,
+                now=now,
+            )
+            await session.flush()
+            if throttle_result.locked:
+                return EmailCodeVerifyResult(
+                    ok=False,
+                    error="rate_limited",
+                    retry_after=throttle_result.retry_after,
+                )
+            return EmailCodeVerifyResult(ok=False, error="invalid_code")
+
+        latest_code.consumed_at = now
+        await security_dal.clear_throttle_state(
+            session,
+            scope=security_dal.EMAIL_CODE_VERIFY_SCOPE,
+            identifier=throttle_identifier,
+        )
+        await session.flush()
+        return EmailCodeVerifyResult(ok=True)
+
+    async def _get_latest_code(
+        self,
+        session: AsyncSession,
+        *,
+        email: str,
+        purpose: str,
+        target_user_id: Optional[int],
+    ) -> Optional[EmailVerificationCode]:
+        stmt = (
+            select(EmailVerificationCode)
+            .where(
+                EmailVerificationCode.email == email,
+                EmailVerificationCode.purpose == purpose,
+                EmailVerificationCode.target_user_id == target_user_id,
+                EmailVerificationCode.status == "active",
+                EmailVerificationCode.consumed_at.is_(None),
+            )
+            .order_by(EmailVerificationCode.created_at.desc())
+            .limit(1)
+        )
+        result = await session.execute(stmt)
+        return result.scalar_one_or_none()
+
+    async def verify_magic_token(
+        self,
+        session: AsyncSession,
+        *,
+        token: str,
+        purpose: str,
+        target_user_id: Optional[int] = None,
+    ) -> EmailMagicVerifyResult:
+        if not token:
+            return EmailMagicVerifyResult(ok=False, error="invalid_token")
+
+        token_hash = self._hash_magic_token(token)
+        now = datetime.now(timezone.utc)
+        stmt = (
+            select(EmailVerificationCode)
+            .where(
+                EmailVerificationCode.magic_token_hash == token_hash,
+                EmailVerificationCode.purpose == purpose,
+                EmailVerificationCode.target_user_id == target_user_id,
+                EmailVerificationCode.status == "active",
+                EmailVerificationCode.consumed_at.is_(None),
+            )
+            .limit(1)
+        )
+        result = await session.execute(stmt)
+        record = result.scalar_one_or_none()
+        if not record:
+            return EmailMagicVerifyResult(ok=False, error="invalid_token")
+
+        expires_at = record.expires_at
+        if expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=timezone.utc)
+        if expires_at < now:
+            return EmailMagicVerifyResult(ok=False, error="expired_token")
+
+        record.consumed_at = now
+        throttle_identifier = _email_throttle_identifier(
+            record.email,
+            purpose,
+            target_user_id,
+        )
+        await security_dal.clear_throttle_state(
+            session,
+            scope=security_dal.EMAIL_CODE_VERIFY_SCOPE,
+            identifier=throttle_identifier,
+        )
+        await session.flush()
+        return EmailMagicVerifyResult(
+            ok=True,
+            email=record.email,
+            purpose=record.purpose,
+            target_user_id=record.target_user_id,
+        )
+
+    async def _send_code_email(
+        self,
+        *,
+        email: str,
+        code: str,
+        language_code: str,
+        magic_link: Optional[str] = None,
+    ) -> None:
+        await asyncio.to_thread(
+            self._send_code_email_sync,
+            email=email,
+            code=code,
+            language_code=language_code,
+            magic_link=magic_link,
+        )
+
+    async def send_custom_email(
+        self,
+        *,
+        email: str,
+        subject: str,
+        body: str,
+        html_body: Optional[str] = None,
+    ) -> None:
+        await asyncio.to_thread(
+            self._send_custom_email_sync,
+            email=email,
+            subject=subject,
+            body=body,
+            html_body=html_body,
+        )
+
+    async def send_rendered_email(
+        self,
+        *,
+        email: str,
+        content: EmailContent,
+    ) -> None:
+        await self.send_custom_email(
+            email=email,
+            subject=content.subject,
+            body=content.text,
+            html_body=content.html,
+        )
+
+    def _send_code_email_sync(
+        self,
+        *,
+        email: str,
+        code: str,
+        language_code: str,
+        magic_link: Optional[str] = None,
+    ) -> None:
+        content = render_login_code(
+            self.settings,
+            code=code,
+            language_code=language_code,
+            magic_link=magic_link,
+        )
+
+        message = EmailMessage()
+        message["Subject"] = content.subject
+        message["From"] = formataddr(
+            (
+                self.settings.SMTP_FROM_NAME or self.settings.WEBAPP_TITLE,
+                self.settings.SMTP_FROM_EMAIL or "",
+            )
+        )
+        message["To"] = email
+        message.set_content(content.text)
+        message.add_alternative(content.html, subtype="html")
+
+        context = ssl.create_default_context()
+        smtp_host = self.settings.SMTP_HOST
+        timeout = max(5, int(self.settings.SMTP_TIMEOUT_SECONDS))
+        attempts = self._smtp_attempts()
+        last_error: Optional[BaseException] = None
+
+        for attempt_number, attempt in enumerate(attempts, start=1):
+            try:
+                self._send_message_via_smtp(
+                    message=message,
+                    smtp_host=smtp_host,
+                    smtp_port=attempt.port,
+                    timeout=timeout,
+                    context=context,
+                    use_ssl=attempt.use_ssl,
+                    starttls=attempt.starttls,
+                )
+                logger.info(
+                    "Email verification code sent to %s via %s:%s",
+                    email,
+                    smtp_host,
+                    attempt.port,
+                )
+                return
+            except (OSError, smtplib.SMTPException, TimeoutError) as exc:
+                last_error = exc
+                log_level = logging.WARNING if attempt_number < len(attempts) else logging.ERROR
+                logger.log(
+                    log_level,
+                    "SMTP send attempt %s/%s failed via %s:%s (ssl=%s, starttls=%s): %s",
+                    attempt_number,
+                    len(attempts),
+                    smtp_host,
+                    attempt.port,
+                    attempt.use_ssl,
+                    attempt.starttls,
+                    exc,
+                )
+
+        if last_error:
+            raise last_error
+
+    def _send_custom_email_sync(
+        self,
+        *,
+        email: str,
+        subject: str,
+        body: str,
+        html_body: Optional[str] = None,
+    ) -> None:
+        message = EmailMessage()
+        message["Subject"] = subject
+        message["From"] = formataddr(
+            (
+                self.settings.SMTP_FROM_NAME or self.settings.WEBAPP_TITLE,
+                self.settings.SMTP_FROM_EMAIL or "",
+            )
+        )
+        message["To"] = email
+        message.set_content(body)
+        if html_body:
+            message.add_alternative(html_body, subtype="html")
+
+        context = ssl.create_default_context()
+        smtp_host = self.settings.SMTP_HOST
+        timeout = max(5, int(self.settings.SMTP_TIMEOUT_SECONDS))
+        attempts = self._smtp_attempts()
+        last_error: Optional[BaseException] = None
+
+        for attempt_number, attempt in enumerate(attempts, start=1):
+            try:
+                self._send_message_via_smtp(
+                    message=message,
+                    smtp_host=smtp_host,
+                    smtp_port=attempt.port,
+                    timeout=timeout,
+                    context=context,
+                    use_ssl=attempt.use_ssl,
+                    starttls=attempt.starttls,
+                )
+                logger.info(
+                    "Custom email sent to %s via %s:%s",
+                    email,
+                    smtp_host,
+                    attempt.port,
+                )
+                return
+            except (OSError, smtplib.SMTPException, TimeoutError) as exc:
+                last_error = exc
+                log_level = logging.WARNING if attempt_number < len(attempts) else logging.ERROR
+                logger.log(
+                    log_level,
+                    "SMTP send attempt %s/%s failed for custom email via %s:%s (ssl=%s, starttls=%s): %s",
+                    attempt_number,
+                    len(attempts),
+                    smtp_host,
+                    attempt.port,
+                    attempt.use_ssl,
+                    attempt.starttls,
+                    exc,
+                )
+
+        if last_error:
+            raise last_error
+
+    def _send_message_via_smtp(
+        self,
+        *,
+        message: EmailMessage,
+        smtp_host: str,
+        smtp_port: int,
+        timeout: int,
+        context: ssl.SSLContext,
+        use_ssl: bool,
+        starttls: bool,
+    ) -> None:
+        if use_ssl:
+            with smtplib.SMTP_SSL(
+                smtp_host,
+                smtp_port,
+                context=context,
+                timeout=timeout,
+            ) as smtp:
+                smtp.ehlo()
+                smtp.login(self.settings.SMTP_USERNAME, self.settings.SMTP_PASSWORD)
+                smtp.send_message(message)
+            return
+
+        with smtplib.SMTP(smtp_host, smtp_port, timeout=timeout) as smtp:
+            smtp.ehlo()
+            if starttls:
+                smtp.starttls(context=context)
+                smtp.ehlo()
+            smtp.login(self.settings.SMTP_USERNAME, self.settings.SMTP_PASSWORD)
+            smtp.send_message(message)

bot/services/email_templates.py

@@ -0,0 +1,484 @@
+"""Branded HTML email templates that mirror the subscription Mini App look.
+
+The web app uses a dark theme with a configurable accent colour
+(`WEBAPP_PRIMARY_COLOR`) and an optional logo (`WEBAPP_LOGO_URL`). The same
+accent + logo are reused here so emails feel like part of the product. All
+copy goes through the shared `JsonI18n` instance so translations live in
+``locales/<lang>.json`` next to the rest of the bot strings.
+"""
+
+from __future__ import annotations
+
+import html
+import re
+from dataclasses import dataclass
+from typing import Optional, Sequence, Tuple
+from urllib.parse import urlsplit
+
+from bot.middlewares.i18n import JsonI18n, get_i18n_instance
+from config.settings import Settings
+
+
+_BG = "#05070a"
+_CARD_BG = "#0e1116"
+_BORDER = "#1a1f27"
+_TEXT = "#e6e9ef"
+_TEXT_MUTED = "#9aa3b2"
+_TEXT_DIM = "#5d6573"
+_DEFAULT_ACCENT = "#00fe7a"
+_HEX_RE = re.compile(r"^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$")
+
+
+@dataclass(frozen=True)
+class EmailContent:
+    subject: str
+    text: str
+    html: str
+
+
+def _safe_color(value: Optional[str]) -> str:
+    if not value:
+        return _DEFAULT_ACCENT
+    candidate = value.strip()
+    if _HEX_RE.match(candidate):
+        return candidate
+    return _DEFAULT_ACCENT
+
+
+def _public_logo_url(settings: Settings) -> Optional[str]:
+    """Email recipients can't reach the in-app /webapp-logo proxy, so the
+    raw https URL from the env is used directly. Anything else is dropped."""
+    raw = (settings.WEBAPP_LOGO_URL or "").strip()
+    if not raw:
+        return None
+    parsed = urlsplit(raw)
+    if parsed.scheme != "https" or not parsed.hostname:
+        return None
+    return raw
+
+
+def _brand_title(settings: Settings) -> str:
+    title = (settings.WEBAPP_TITLE or "").strip()
+    return title or "Subscription"
+
+
+def _normalize_lang(language_code: Optional[str], settings: Settings) -> str:
+    return (language_code or settings.DEFAULT_LANGUAGE or "ru").split("-")[0]
+
+
+def _resolve_i18n(i18n: Optional[JsonI18n]) -> JsonI18n:
+    return i18n or get_i18n_instance()
+
+
+def _t_html(i18n: JsonI18n, lang: str, key: str, **kwargs) -> str:
+    """Translate for HTML context: format args are HTML-escaped, the
+    translated template itself is treated as already-safe HTML (locale files
+    are author-controlled and may include simple inline tags like <strong>)."""
+    safe_kwargs = {k: html.escape(str(v)) for k, v in kwargs.items()}
+    return i18n.gettext(lang, key, **safe_kwargs)
+
+
+def _t_text(i18n: JsonI18n, lang: str, key: str, **kwargs) -> str:
+    return i18n.gettext(lang, key, **kwargs)
+
+
+def _layout(
+    *,
+    settings: Settings,
+    preheader: str,
+    heading: str,
+    intro_html: str,
+    body_html: str,
+    footer_html: str,
+) -> str:
+    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    brand_title = html.escape(_brand_title(settings))
+    logo_url = _public_logo_url(settings)
+    logo_block = ""
+    if logo_url:
+        logo_block = (
+            f'<img src="{html.escape(logo_url, quote=True)}" width="64" height="64" '
+            f'alt="" style="display:block;border:0;outline:none;text-decoration:none;'
+            f'border-radius:16px;">'
+        )
+
+    return f"""<!DOCTYPE html>
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="dark">
+<meta name="supported-color-schemes" content="dark">
+<title>{html.escape(heading)}</title>
+</head>
+<body style="margin:0;padding:0;background:{_BG};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:{_TEXT};">
+<div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent;mso-hide:all;">{html.escape(preheader)}</div>
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="background:{_BG};">
+  <tr>
+    <td align="center" style="padding:32px 16px;">
+      <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="max-width:480px;">
+        <tr>
+          <td align="center" style="padding-bottom:24px;">
+            {logo_block}
+            <div style="margin-top:14px;font-family:'JetBrains Mono','SFMono-Regular',Menlo,Consolas,monospace;font-weight:800;font-size:22px;line-height:1.05;color:{accent};letter-spacing:0;">{brand_title}</div>
+          </td>
+        </tr>
+        <tr>
+          <td style="background:{_CARD_BG};border:1px solid {_BORDER};border-radius:18px;padding:28px;">
+            <h1 style="margin:0 0 10px 0;font-size:20px;line-height:1.25;font-weight:700;color:#ffffff;">{html.escape(heading)}</h1>
+            <div style="margin:0 0 20px 0;font-size:14px;line-height:1.55;color:{_TEXT_MUTED};">{intro_html}</div>
+            {body_html}
+          </td>
+        </tr>
+        <tr>
+          <td align="center" style="padding-top:20px;">
+            <div style="font-size:11px;line-height:1.55;color:{_TEXT_DIM};">{footer_html}</div>
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>
+</body>
+</html>
+"""
+
+
+def _info_rows_html(rows: Sequence[Tuple[str, str]]) -> str:
+    if not rows:
+        return ""
+    last = len(rows) - 1
+    cells = []
+    for index, (label, value) in enumerate(rows):
+        border = "" if index == last else f"border-bottom:1px solid {_BORDER};"
+        cells.append(
+            f'<tr>'
+            f'<td style="padding:11px 0;{border}font-size:12px;color:{_TEXT_DIM};text-transform:uppercase;letter-spacing:0.04em;">{html.escape(label)}</td>'
+            f'<td align="right" style="padding:11px 0;{border}font-family:\'JetBrains Mono\',\'SFMono-Regular\',Menlo,Consolas,monospace;font-size:14px;font-weight:600;color:{_TEXT};">{html.escape(value)}</td>'
+            f'</tr>'
+        )
+    return (
+        f'<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" '
+        f'style="margin:0 0 16px 0;background:{_BG};border:1px solid {_BORDER};border-radius:14px;padding:6px 16px;">'
+        + "".join(cells)
+        + "</table>"
+    )
+
+
+def _cta_button_html(*, label: str, url: str, accent: str) -> str:
+    safe_label = html.escape(label)
+    safe_url = html.escape(url, quote=True)
+    # Accent green is light, so contrast text is dark; works for the default and similar light accents.
+    return (
+        f'<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" '
+        f'style="width:100%;margin:22px 0 18px 0;">'
+        f'<tr><td align="center" bgcolor="{accent}" style="background:{accent};border-radius:12px;">'
+        f'<a href="{safe_url}" target="_blank" rel="noopener" '
+        f'style="display:block;width:100%;box-sizing:border-box;padding:15px 22px;'
+        f'font-family:-apple-system,BlinkMacSystemFont,\'Segoe UI\',Roboto,Helvetica,Arial,sans-serif;'
+        f'font-size:15px;font-weight:700;color:#05070a;text-decoration:none;letter-spacing:0.02em;text-align:center;">{safe_label}</a>'
+        f'</td></tr></table>'
+    )
+
+
+def _format_amount(amount: float, currency: str) -> str:
+    rounded = round(float(amount), 2)
+    if rounded.is_integer():
+        body = f"{int(rounded)}"
+    else:
+        body = f"{rounded:.2f}"
+    suffix = (currency or "").strip()
+    return f"{body} {suffix}".strip()
+
+
+def _format_traffic(traffic_gb: Optional[float]) -> str:
+    if traffic_gb is None:
+        return "—"
+    value = float(traffic_gb)
+    return str(int(value)) if value.is_integer() else f"{value:g}"
+
+
+def _format_minutes(seconds: int) -> int:
+    return max(1, int(seconds) // 60)
+
+
+def render_login_code(
+    settings: Settings,
+    *,
+    code: str,
+    language_code: Optional[str],
+    magic_link: Optional[str] = None,
+    i18n: Optional[JsonI18n] = None,
+) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language_code, settings)
+    minutes = _format_minutes(settings.EMAIL_CODE_TTL_SECONDS)
+    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    brand = _brand_title(settings)
+    safe_magic_link = (magic_link or "").strip()
+
+    subject = _t_text(i18n, lang, "email_login_code_subject", code=code)
+    preheader = _t_text(i18n, lang, "email_login_code_preheader", minutes=minutes)
+    heading = _t_text(i18n, lang, "email_login_code_heading")
+    intro = _t_text(i18n, lang, "email_login_code_intro")
+    expiry_html = _t_html(i18n, lang, "email_login_code_expiry_html", minutes=minutes)
+    security = _t_text(i18n, lang, "email_login_code_security")
+    footer = _t_html(i18n, lang, "email_footer_auto", brand=brand)
+    text_lines = [_t_text(i18n, lang, "email_login_code_text", code=code, minutes=minutes)]
+    if safe_magic_link:
+        text_lines.append(
+            _t_text(i18n, lang, "email_login_code_text_magic", url=safe_magic_link)
+        )
+
+    code_block = (
+        f'<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="margin:0 0 18px 0;">'
+        f'<tr><td align="center" style="background:{_BG};border:1px solid {_BORDER};border-radius:14px;padding:22px 16px;">'
+        f'<div style="font-family:\'JetBrains Mono\',\'SFMono-Regular\',Menlo,Consolas,monospace;font-size:36px;line-height:1;font-weight:700;letter-spacing:10px;color:{accent};">'
+        f'{html.escape(code)}'
+        f'</div></td></tr></table>'
+    )
+
+    magic_block = ""
+    if safe_magic_link:
+        cta_label = _t_text(i18n, lang, "email_login_code_magic_cta")
+        divider_label = _t_text(i18n, lang, "email_login_code_magic_or")
+        magic_intro = _t_text(i18n, lang, "email_login_code_magic_intro")
+        magic_hint = _t_text(i18n, lang, "email_login_code_magic_hint")
+        divider_html = (
+            f'<table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="margin:4px 0 14px 0;">'
+            f'<tr>'
+            f'<td width="40%" style="border-bottom:1px solid {_BORDER};font-size:0;line-height:0;">&nbsp;</td>'
+            f'<td align="center" style="padding:0 10px;font-size:11px;letter-spacing:0.08em;text-transform:uppercase;color:{_TEXT_DIM};white-space:nowrap;">{html.escape(divider_label)}</td>'
+            f'<td width="40%" style="border-bottom:1px solid {_BORDER};font-size:0;line-height:0;">&nbsp;</td>'
+            f'</tr></table>'
+        )
+        magic_block = (
+            divider_html
+            + f'<p style="margin:0 0 4px 0;font-size:13px;line-height:1.55;color:{_TEXT_MUTED};text-align:center;">{html.escape(magic_intro)}</p>'
+            + _cta_button_html(label=cta_label, url=safe_magic_link, accent=accent)
+            + f'<p style="margin:0 0 6px 0;font-size:12px;line-height:1.55;color:{_TEXT_DIM};text-align:center;">{html.escape(magic_hint)}</p>'
+        )
+
+    body_html = (
+        code_block
+        + f'<p style="margin:0 0 8px 0;font-size:13px;line-height:1.55;color:{_TEXT_MUTED};">{expiry_html}</p>'
+        + f'<p style="margin:0 0 4px 0;font-size:12px;line-height:1.55;color:{_TEXT_DIM};">{html.escape(security)}</p>'
+        + magic_block
+    )
+
+    rendered = _layout(
+        settings=settings,
+        preheader=preheader,
+        heading=heading,
+        intro_html=html.escape(intro),
+        body_html=body_html,
+        footer_html=footer,
+    )
+    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+
+
+def render_account_merged(
+    settings: Settings,
+    *,
+    language_code: Optional[str],
+    primary_user_id: Optional[int],
+    removed_user_id: Optional[int],
+    final_end_date_text: str,
+    i18n: Optional[JsonI18n] = None,
+) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language_code, settings)
+    brand = _brand_title(settings)
+    primary = "—" if primary_user_id is None else f"#{primary_user_id}"
+    removed = "—" if removed_user_id is None else f"#{removed_user_id}"
+    end_date = final_end_date_text or "—"
+
+    subject = _t_text(i18n, lang, "email_account_merged_subject")
+    preheader = _t_text(i18n, lang, "email_account_merged_preheader")
+    heading = _t_text(i18n, lang, "email_account_merged_heading")
+    intro = _t_text(i18n, lang, "email_account_merged_intro")
+    note = _t_text(i18n, lang, "email_account_merged_note")
+    footer = _t_html(i18n, lang, "email_footer_auto", brand=brand)
+    text = _t_text(
+        i18n,
+        lang,
+        "email_account_merged_text",
+        primary=primary,
+        removed=removed,
+        end_date=end_date,
+    )
+
+    rows = [
+        (_t_text(i18n, lang, "email_account_merged_row_kept"), primary),
+        (_t_text(i18n, lang, "email_account_merged_row_removed"), removed),
+        (_t_text(i18n, lang, "email_account_merged_row_end_date"), end_date),
+    ]
+    body_html = (
+        _info_rows_html(rows)
+        + f'<p style="margin:0;font-size:12px;line-height:1.55;color:{_TEXT_DIM};">{html.escape(note)}</p>'
+    )
+
+    rendered = _layout(
+        settings=settings,
+        preheader=preheader,
+        heading=heading,
+        intro_html=html.escape(intro),
+        body_html=body_html,
+        footer_html=footer,
+    )
+    return EmailContent(subject=subject, text=text, html=rendered)
+
+
+def render_payment_success(
+    settings: Settings,
+    *,
+    language_code: Optional[str],
+    sale_mode: str,
+    months: int,
+    traffic_gb: Optional[float],
+    amount: float,
+    currency: str,
+    end_date_text: str,
+    dashboard_url: Optional[str],
+    provider_label: Optional[str] = None,
+    i18n: Optional[JsonI18n] = None,
+) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language_code, settings)
+    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    brand = _brand_title(settings)
+    is_traffic = sale_mode == "traffic"
+    amount_text = _format_amount(amount, currency)
+    safe_dashboard_url = (dashboard_url or "").strip()
+    end_date = end_date_text or "—"
+    traffic_label = _format_traffic(traffic_gb)
+
+    subject = _t_text(i18n, lang, "email_payment_success_subject")
+    preheader = _t_text(i18n, lang, "email_payment_success_preheader")
+    heading = _t_text(i18n, lang, "email_payment_success_heading")
+    footer_note = _t_text(i18n, lang, "email_payment_success_footer_note")
+    footer = _t_html(i18n, lang, "email_footer_auto", brand=brand)
+    cta_label = _t_text(i18n, lang, "email_payment_success_cta")
+
+    if is_traffic:
+        intro = _t_text(i18n, lang, "email_payment_success_intro_traffic", traffic_gb=traffic_label)
+        period_label = _t_text(i18n, lang, "email_payment_success_row_traffic")
+        period_value = _t_text(i18n, lang, "email_payment_success_traffic_value", traffic_gb=traffic_label)
+        text = _t_text(
+            i18n,
+            lang,
+            "email_payment_success_text_traffic",
+            amount=amount_text,
+            traffic_gb=traffic_label,
+            end_date=end_date,
+        )
+    else:
+        months_int = int(months or 0)
+        intro = _t_text(i18n, lang, "email_payment_success_intro_subscription", months=months_int)
+        period_label = _t_text(i18n, lang, "email_payment_success_row_period")
+        period_value = _t_text(
+            i18n,
+            lang,
+            "email_payment_success_period_value",
+            months=months_int,
+        )
+        text = _t_text(
+            i18n,
+            lang,
+            "email_payment_success_text_subscription",
+            amount=amount_text,
+            months=months_int,
+            end_date=end_date,
+        )
+
+    rows: list[Tuple[str, str]] = [
+        (period_label, period_value),
+        (_t_text(i18n, lang, "email_payment_success_row_amount"), amount_text),
+        (_t_text(i18n, lang, "email_payment_success_row_end_date"), end_date),
+    ]
+    if provider_label:
+        rows.append((_t_text(i18n, lang, "email_payment_success_row_method"), provider_label))
+
+    text_lines = [text]
+    if safe_dashboard_url:
+        text_lines.append(_t_text(i18n, lang, "email_payment_success_text_dashboard", url=safe_dashboard_url))
+
+    body_parts = [_info_rows_html(rows)]
+    if safe_dashboard_url:
+        body_parts.append(_cta_button_html(label=cta_label, url=safe_dashboard_url, accent=accent))
+    body_parts.append(
+        f'<p style="margin:6px 0 0 0;font-size:12px;line-height:1.55;color:{_TEXT_DIM};">{html.escape(footer_note)}</p>'
+    )
+
+    rendered = _layout(
+        settings=settings,
+        preheader=preheader,
+        heading=heading,
+        intro_html=html.escape(intro),
+        body_html="".join(body_parts),
+        footer_html=footer,
+    )
+    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+
+
+def render_subscription_expiring(
+    settings: Settings,
+    *,
+    language_code: Optional[str],
+    days_left: int,
+    end_date_text: str,
+    dashboard_url: Optional[str],
+    i18n: Optional[JsonI18n] = None,
+) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language_code, settings)
+    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    brand = _brand_title(settings)
+    safe_dashboard_url = (dashboard_url or "").strip()
+    days = max(0, int(days_left))
+    end_date = end_date_text or "—"
+
+    if days == 0:
+        suffix = "today"
+    elif days == 1:
+        suffix = "tomorrow"
+    else:
+        suffix = "days"
+
+    subject = _t_text(i18n, lang, f"email_subscription_expiring_subject_{suffix}", days=days)
+    heading = _t_text(i18n, lang, f"email_subscription_expiring_heading_{suffix}", days=days)
+    preheader = _t_text(i18n, lang, f"email_subscription_expiring_preheader_{suffix}", days=days)
+    intro = _t_text(i18n, lang, f"email_subscription_expiring_intro_{suffix}", days=days)
+    note = _t_text(i18n, lang, "email_subscription_expiring_note")
+    footer = _t_html(i18n, lang, "email_footer_auto", brand=brand)
+    cta_label = _t_text(i18n, lang, "email_subscription_expiring_cta")
+
+    rows = [
+        (_t_text(i18n, lang, "email_subscription_expiring_row_days_left"), str(days)),
+        (_t_text(i18n, lang, "email_subscription_expiring_row_end_date"), end_date),
+    ]
+
+    text_lines = [
+        _t_text(i18n, lang, "email_subscription_expiring_text", heading=heading, end_date=end_date),
+    ]
+    if safe_dashboard_url:
+        text_lines.append(
+            _t_text(i18n, lang, "email_subscription_expiring_text_renew", url=safe_dashboard_url)
+        )
+
+    body_parts = [_info_rows_html(rows)]
+    if safe_dashboard_url:
+        body_parts.append(_cta_button_html(label=cta_label, url=safe_dashboard_url, accent=accent))
+    body_parts.append(
+        f'<p style="margin:6px 0 0 0;font-size:12px;line-height:1.55;color:{_TEXT_DIM};">{html.escape(note)}</p>'
+    )
+
+    rendered = _layout(
+        settings=settings,
+        preheader=preheader,
+        heading=heading,
+        intro_html=html.escape(intro),
+        body_html="".join(body_parts),
+        footer_html=footer,
+    )
+    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)

bot/services/freekassa_service.py

@@ -7,6 +7,7 @@ import logging
 import time
 from decimal import Decimal, ROUND_HALF_UP
 from typing import Optional, Dict, Any, Tuple
+from urllib.parse import parse_qsl
 
 from aiohttp import ClientSession, ClientTimeout, web
 from aiogram import Bot
@@ -21,6 +22,7 @@ from bot.services.notification_service import NotificationService
 from db.dal import payment_dal, user_dal
 from bot.utils.text_sanitizer import sanitize_display_name, username_for_display
 from bot.utils.config_link import prepare_config_links
+from bot.utils.request_security import ip_in_allowlist, request_client_ip
 
 
 class FreeKassaService:
@@ -135,7 +137,7 @@ class FreeKassaService:
 
                 return True, response_data
         except Exception as exc:
-            logging.error("FreeKassa create_order: request failed: %s", exc, exc_info=True)
+            logging.exception("FreeKassa create_order: request failed.")
             return False, {"message": str(exc)}
 
     async def _get_session(self) -> ClientSession:
@@ -169,69 +171,59 @@ class FreeKassaService:
 
     def _validate_signature(
         self,
-        merchant_order_id: str,
-        amount: str,
+        raw_body: bytes,
         provided_signature: str,
-        payload: Optional[Dict[str, Any]] = None,
     ) -> bool:
         if not provided_signature:
             return False
+        if not self.second_secret:
+            return False
 
-        if self.shop_id and self.second_secret:
-            signature_source = f"{self.shop_id}:{amount}:{self.second_secret}:{merchant_order_id}"
-            expected_signature = hashlib.md5(signature_source.encode("utf-8")).hexdigest()
-            if expected_signature.lower() == provided_signature.lower():
-                return True
-
-        if self.api_key and payload:
-            items = [
-                (key, value)
-                for key, value in payload.items()
-                if key not in {"signature", "SIGN"} and value is not None
-            ]
-            items.sort(key=lambda pair: pair[0])
-            message = "|".join(str(value) for _, value in items)
-            alt_signature = hmac.new(self.api_key.encode("utf-8"), message.encode("utf-8"), hashlib.sha256).hexdigest()
-            if alt_signature.lower() == provided_signature.lower():
-                return True
-
-        return False
+        expected_signature = hmac.new(
+            self.second_secret.encode("utf-8"),
+            raw_body,
+            hashlib.sha256,
+        ).hexdigest()
+        return hmac.compare_digest(expected_signature, provided_signature)
 
     async def webhook_route(self, request: web.Request) -> web.Response:
         if not self.configured:
             return web.Response(status=503, text="freekassa_disabled")
 
         try:
-            data = await request.post()
-        except Exception as e:
-            logging.error(f"FreeKassa webhook: failed to read POST data: {e}")
+            client_ip = request_client_ip(request, trusted_proxies=self.settings.trusted_proxies)
+            if not ip_in_allowlist(client_ip, self.settings.freekassa_trusted_ips):
+                return web.Response(status=403)
+
+            raw_body = await request.read()
+        except Exception:
+            logging.exception("FreeKassa webhook: failed to read request body.")
             return web.Response(status=400, text="bad_request")
 
-        payload_dict: Dict[str, Any]
-        if data:
-            payload_dict = {str(k): v for k, v in data.items()}
-        else:
+        payload_dict: Dict[str, Any] = {}
+        if raw_body:
             try:
-                json_payload = await request.json()
-                payload_dict = {str(k): v for k, v in json_payload.items()} if isinstance(json_payload, dict) else {}
-                data = json_payload
+                if request.content_type.startswith("application/json"):
+                    decoded_json = json.loads(raw_body.decode("utf-8"))
+                    if isinstance(decoded_json, dict):
+                        payload_dict = {str(k): v for k, v in decoded_json.items()}
+                else:
+                    payload_dict = {
+                        str(key): value
+                        for key, value in parse_qsl(raw_body.decode("utf-8"), keep_blank_values=True)
+                    }
             except Exception:
                 payload_dict = {}
-                data = {}
 
         def _get(key: str, default: Optional[str] = None) -> Optional[str]:
-            if isinstance(data, dict):
-                return data.get(key) or data.get(key.lower()) or default
             return payload_dict.get(key) or payload_dict.get(key.lower()) or default
 
         merchant_id = _get("MERCHANT_ID")
         if merchant_id != self.shop_id:
-            logging.error(f"FreeKassa webhook: merchant mismatch (got {merchant_id})")
-            return web.Response(status=403, text="merchant_mismatch")
+            return web.Response(status=403)
 
         signature = _get("SIGN") or _get("signature")
         if not signature:
-            logging.error("FreeKassa webhook: missing signature")
             return web.Response(status=400, text="missing_signature")
 
         order_id_str = _get("MERCHANT_ORDER_ID") or _get("ORDER_ID") or _get("o")
@@ -239,11 +231,9 @@ class FreeKassaService:
         provider_payment_id = _get("intid") or _get("payment_id") or _get("transaction_id")
 
         if not order_id_str or not amount_str:
-            logging.error("FreeKassa webhook: missing order_id or amount")
             return web.Response(status=400, text="missing_data")
 
-        if not self._validate_signature(order_id_str, amount_str, signature, payload_dict):
-            logging.error("FreeKassa webhook: invalid signature")
+        if not self._validate_signature(raw_body, signature):
             return web.Response(status=403, text="invalid_signature")
 
         try:
@@ -309,9 +299,9 @@ class FreeKassaService:
                     )
 
                 await session.commit()
-            except Exception as e:
+            except Exception:
                 await session.rollback()
-                logging.error(f"FreeKassa webhook: failed to process payment {payment_db_id}: {e}", exc_info=True)
+                logging.exception("FreeKassa webhook: failed to process payment %s.", payment_db_id)
                 return web.Response(status=500, text="processing_error")
 
             db_user = payment.user or await user_dal.get_user_by_id(session, payment.user_id)
@@ -395,8 +385,8 @@ class FreeKassaService:
                     parse_mode="HTML",
                     disable_web_page_preview=True,
                 )
-            except Exception as e:
-                logging.error(f"FreeKassa notification: failed to send message to user {payment.user_id}: {e}")
+            except Exception:
+                logging.exception("FreeKassa notification: failed to send message to user %s.", payment.user_id)
 
             try:
                 notification_service = NotificationService(self.bot, self.settings, self.i18n)
@@ -409,8 +399,8 @@ class FreeKassaService:
                     payment_provider="freekassa",
                     username=db_user.username if db_user else None,
                 )
-            except Exception as e:
-                logging.error(f"FreeKassa notification: failed to notify admins: {e}")
+            except Exception:
+                logging.exception("FreeKassa notification: failed to notify admins.")
 
         return web.Response(text="YES")
 

bot/services/lknpd_client.py

@@ -0,0 +1,321 @@
+"""
+LKNPD API client for self-employed (NPD) tax receipts.
+Custom implementation for lknpd.nalog.ru API.
+"""
+
+import asyncio
+import logging
+import uuid
+from datetime import UTC, datetime
+from decimal import Decimal
+from enum import Enum
+from typing import Any
+
+import httpx
+
+logger = logging.getLogger(__name__)
+
+
+class PaymentType(str, Enum):
+    """Payment type for income registration."""
+    CASH = "CASH"
+    WIRE = "WIRE"
+
+
+class IncomeType(str, Enum):
+    """Income source type."""
+    FROM_INDIVIDUAL = "FROM_INDIVIDUAL"
+    FROM_LEGAL_ENTITY = "FROM_LEGAL_ENTITY"
+    FROM_FOREIGN_AGENCY = "FROM_FOREIGN_AGENCY"
+
+
+class LknpdApiError(Exception):
+    """Base exception for LKNPD API errors."""
+    def __init__(self, message: str, status_code: int | None = None):
+        super().__init__(message)
+        self.status_code = status_code
+
+
+class LknpdAuthError(LknpdApiError):
+    """Authentication error (401)."""
+    pass
+
+
+class LknpdValidationError(LknpdApiError):
+    """Validation error (400)."""
+    pass
+
+
+def _generate_device_id() -> str:
+    """Generate device ID for API requests."""
+    return str(uuid.uuid4()).replace("-", "")[:21].lower()
+
+
+def _format_datetime(dt: datetime) -> str:
+    """Format datetime to ISO/ATOM format with Z suffix."""
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=UTC)
+    elif dt.tzinfo != UTC:
+        dt = dt.astimezone(UTC)
+    return dt.isoformat().replace("+00:00", "Z")
+
+
+class LknpdClient:
+    """
+    Async client for LKNPD (lknpd.nalog.ru) self-employed API.
+
+    Supports:
+    - INN + password authentication
+    - Token refresh
+    - Income registration with proper payment types (CASH/WIRE)
+    """
+
+    DEFAULT_HEADERS = {
+        "Content-Type": "application/json",
+        "Accept": "application/json, text/plain, */*",
+        "Accept-Language": "ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7",
+        "Referrer": "https://lknpd.nalog.ru/auth/login",
+    }
+
+    DEVICE_INFO_TEMPLATE = {
+        "sourceType": "WEB",
+        "appVersion": "1.0.0",
+        "metaDetails": {
+            "userAgent": (
+                "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2) AppleWebKit/537.36 "
+                "(KHTML, like Gecko) Chrome/88.0.4324.192 Safari/537.36"
+            )
+        },
+    }
+
+    def __init__(
+        self,
+        base_url: str = "https://lknpd.nalog.ru/api",
+        timeout: float = 10.0,
+    ):
+        self.base_url = base_url.rstrip("/")
+        self.timeout = timeout
+        self.device_id = _generate_device_id()
+        self._token_data: dict[str, Any] | None = None
+        self._refresh_lock = asyncio.Lock()
+
+    def _get_device_info(self) -> dict[str, Any]:
+        """Get device info with current device ID."""
+        info = self.DEVICE_INFO_TEMPLATE.copy()
+        info["sourceDeviceId"] = self.device_id
+        return info
+
+    async def authenticate(self, inn: str, password: str) -> bool:
+        """
+        Authenticate with INN and password.
+
+        Returns True if authentication was successful.
+        """
+        request_data = {
+            "username": inn,
+            "password": password,
+            "deviceInfo": self._get_device_info(),
+        }
+
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(
+                    f"{self.base_url}/v1/auth/lkfl",
+                    json=request_data,
+                    headers=self.DEFAULT_HEADERS,
+                )
+
+                if response.status_code == 401:
+                    raise LknpdAuthError("Invalid credentials", 401)
+
+                if response.status_code >= 400:
+                    raise LknpdApiError(
+                        f"Authentication failed: {response.text}",
+                        response.status_code,
+                    )
+
+                self._token_data = response.json()
+                logger.info("LKNPD authentication successful")
+                return True
+
+        except httpx.RequestError as e:
+            logger.exception("Network error during authentication")
+            raise LknpdApiError(f"Network error: {e}")
+
+    async def _refresh_token(self) -> bool:
+        """Refresh access token using refresh token."""
+        async with self._refresh_lock:
+            if not self._token_data or "refreshToken" not in self._token_data:
+                return False
+
+            request_data = {
+                "deviceInfo": self._get_device_info(),
+                "refreshToken": self._token_data["refreshToken"],
+            }
+
+            try:
+                async with httpx.AsyncClient(timeout=self.timeout) as client:
+                    response = await client.post(
+                        f"{self.base_url}/v1/auth/token",
+                        json=request_data,
+                        headers=self.DEFAULT_HEADERS,
+                    )
+
+                    if response.status_code != 200:
+                        return False
+
+                    self._token_data = response.json()
+                    logger.info("LKNPD token refreshed")
+                    return True
+
+            except Exception:
+                logger.exception("Token refresh failed")
+                return False
+
+    def _get_auth_headers(self) -> dict[str, str]:
+        """Get authorization headers from current token."""
+        if not self._token_data or "token" not in self._token_data:
+            return {}
+        return {"Authorization": f"Bearer {self._token_data['token']}"}
+
+    async def _request(
+        self,
+        method: str,
+        path: str,
+        json_data: dict[str, Any] | None = None,
+        retry_on_401: bool = True,
+    ) -> httpx.Response:
+        """Make authenticated API request with auto-retry on 401."""
+        headers = {**self.DEFAULT_HEADERS, **self._get_auth_headers()}
+        url = f"{self.base_url}/v1{path}"
+
+        async with httpx.AsyncClient(timeout=self.timeout) as client:
+            response = await client.request(
+                method,
+                url,
+                json=json_data,
+                headers=headers,
+            )
+
+            # Handle 401 with token refresh
+            if response.status_code == 401 and retry_on_401:
+                if await self._refresh_token():
+                    headers = {**self.DEFAULT_HEADERS, **self._get_auth_headers()}
+                    response = await client.request(
+                        method,
+                        url,
+                        json=json_data,
+                        headers=headers,
+                    )
+
+            return response
+
+    @property
+    def is_authenticated(self) -> bool:
+        """Check if client has valid token data."""
+        return self._token_data is not None and "token" in self._token_data
+
+    async def create_income(
+        self,
+        *,
+        name: str,
+        amount: Decimal | float,
+        quantity: Decimal | float | int = 1,
+        payment_type: PaymentType = PaymentType.WIRE,
+        income_type: IncomeType = IncomeType.FROM_INDIVIDUAL,
+        client_inn: str | None = None,
+        client_name: str | None = None,
+        client_phone: str | None = None,
+        operation_time: datetime | None = None,
+    ) -> str | None:
+        """
+        Register income and create receipt.
+
+        Args:
+            name: Service/item description
+            amount: Price per unit
+            quantity: Number of units
+            payment_type: CASH or WIRE (for card/bank payments)
+            income_type: Source type (individual, legal entity, foreign)
+            client_inn: Client's INN (required for legal entities)
+            client_name: Client's display name
+            client_phone: Client's phone number
+            operation_time: Time of operation (defaults to now)
+
+        Returns:
+            Receipt UUID if successful, None otherwise
+        """
+        if not self.is_authenticated:
+            raise LknpdAuthError("Not authenticated")
+
+        # Prepare times
+        now = datetime.now(UTC)
+        op_time = operation_time or now
+
+        # Calculate total
+        amount_decimal = Decimal(str(amount))
+        qty_decimal = Decimal(str(quantity))
+        total = amount_decimal * qty_decimal
+
+        # API expects quantity as integer when it's a whole number
+        qty_value: int | str
+        if qty_decimal == qty_decimal.to_integral_value():
+            qty_value = int(qty_decimal)
+        else:
+            qty_value = str(qty_decimal)
+
+        # Build request
+        request_data = {
+            "operationTime": _format_datetime(op_time),
+            "requestTime": _format_datetime(now),
+            "services": [
+                {
+                    "name": name,
+                    "amount": str(amount_decimal),
+                    "quantity": qty_value,
+                }
+            ],
+            "totalAmount": str(total),
+            "client": {
+                "contactPhone": client_phone,
+                "displayName": client_name,
+                "incomeType": income_type.value,
+                "inn": client_inn,
+            },
+            "paymentType": payment_type.value,
+            "ignoreMaxTotalIncomeRestriction": False,
+        }
+
+        try:
+            response = await self._request("POST", "/income", json_data=request_data)
+
+            if response.status_code == 400:
+                logger.error("LKNPD validation error: %s", response.text)
+                raise LknpdValidationError(response.text, 400)
+
+            if response.status_code == 401:
+                raise LknpdAuthError("Authentication expired", 401)
+
+            if response.status_code >= 400:
+                logger.error(
+                    "LKNPD API error: status=%d body=%s",
+                    response.status_code,
+                    response.text,
+                )
+                raise LknpdApiError(response.text, response.status_code)
+
+            payload = response.json()
+            receipt_uuid = (
+                payload.get("approvedReceiptUuid")
+                or payload.get("receiptUuid")
+                or payload.get("receipt_uuid")
+            )
+
+            if receipt_uuid:
+                logger.info("LKNPD receipt created: %s", receipt_uuid)
+
+            return receipt_uuid
+
+        except httpx.RequestError as e:
+            logger.exception("Network error creating income")
+            raise LknpdApiError(f"Network error: {e}")

bot/services/lknpd_service.py

@@ -0,0 +1,69 @@
+import asyncio
+import logging
+from datetime import datetime
+from typing import Optional
+
+from .lknpd_client import LknpdClient, PaymentType, LknpdApiError
+
+
+class LknpdService:
+    def __init__(
+        self,
+        inn: Optional[str],
+        password: Optional[str],
+        api_url: str = "https://lknpd.nalog.ru/api",
+    ) -> None:
+        self.inn = inn.strip() if inn else None
+        self.password = password
+        self.configured = bool(self.inn and self.password)
+        self._client = LknpdClient(base_url=api_url) if self.configured else None
+        self._auth_lock = asyncio.Lock()
+
+        if not self.configured:
+            logging.warning("LKNPD credentials are missing. Receipt sending disabled.")
+
+    async def _ensure_authenticated(self) -> bool:
+        if not self._client:
+            return False
+
+        async with self._auth_lock:
+            if self._client.is_authenticated:
+                return True
+
+            try:
+                await self._client.authenticate(self.inn, self.password)
+                return True
+            except LknpdApiError:
+                logging.exception("LKNPD authentication failed.")
+                return False
+
+    async def create_income_receipt(
+        self,
+        *,
+        item_name: str,
+        amount: float,
+        quantity: float = 1.0,
+        operation_time: Optional[datetime] = None,
+    ) -> Optional[str]:
+        if not self.configured:
+            return None
+        if not await self._ensure_authenticated():
+            return None
+
+        try:
+            receipt_uuid = await self._client.create_income(
+                name=item_name,
+                amount=amount,
+                quantity=quantity,
+                payment_type=PaymentType.WIRE,
+                operation_time=operation_time,
+            )
+            if not receipt_uuid:
+                logging.info("LKNPD receipt created without a UUID in response.")
+            return receipt_uuid
+        except LknpdApiError:
+            logging.exception("Failed to create LKNPD receipt.")
+            return None
+
+    async def close(self) -> None:
+        return None

bot/services/nalogo_service.py

@@ -1,103 +0,0 @@
-import asyncio
-import logging
-from datetime import datetime
-from decimal import Decimal
-from typing import Optional
-
-from nalogo import Client
-from nalogo.dto.income import (
-    AtomDateTime,
-    IncomeClient,
-    IncomeRequest,
-    IncomeServiceItem,
-    PaymentType,
-)
-
-
-class NalogoService:
-    def __init__(self, inn: Optional[str], password: Optional[str]) -> None:
-        self.inn = inn.strip() if inn else None
-        self.password = password
-        self.configured = bool(self.inn and self.password)
-        self._client = Client() if self.configured else None
-        self._auth_lock = asyncio.Lock()
-
-        if not self.configured:
-            logging.warning("Nalogo credentials are missing. Receipt sending disabled.")
-
-    async def _ensure_authenticated(self) -> bool:
-        if not self._client:
-            return False
-
-        async with self._auth_lock:
-            token_data = await self._client.auth_provider.get_token()
-            if token_data:
-                return True
-
-            try:
-                token_json = await self._client.create_new_access_token(
-                    self.inn,
-                    self.password,
-                )
-                await self._client.authenticate(token_json)
-                logging.info("Nalogo authentication succeeded.")
-                return True
-            except Exception:
-                logging.exception("Nalogo authentication failed.")
-                return False
-
-    async def create_income_receipt(
-        self,
-        *,
-        item_name: str,
-        amount: float,
-        quantity: float = 1.0,
-        client: Optional[IncomeClient] = None,
-        operation_time: Optional[datetime] = None,
-    ) -> Optional[str]:
-        if not self.configured:
-            return None
-        if not await self._ensure_authenticated():
-            return None
-
-        try:
-            service_item = IncomeServiceItem(
-                name=item_name,
-                amount=Decimal(str(amount)),
-                quantity=Decimal(str(quantity)),
-            )
-            total_amount = service_item.get_total_amount()
-            request = IncomeRequest(
-                operation_time=(
-                    AtomDateTime.from_datetime(operation_time)
-                    if operation_time
-                    else AtomDateTime.now()
-                ),
-                request_time=AtomDateTime.now(),
-                services=[service_item],
-                total_amount=str(total_amount),
-                client=client or IncomeClient(),
-                payment_type=PaymentType.ACCOUNT,
-                ignore_max_total_income_restriction=False,
-            )
-            response = await self._client.http_client.post(
-                "/income",
-                json_data=request.model_dump(),
-            )
-            payload = response.json()
-            receipt_uuid = (
-                payload.get("approvedReceiptUuid")
-                or payload.get("receiptUuid")
-                or payload.get("receipt_uuid")
-            )
-            if receipt_uuid:
-                logging.info("Nalogo receipt created: %s", receipt_uuid)
-            else:
-                logging.info("Nalogo receipt created without a UUID in response.")
-            return receipt_uuid
-        except Exception:
-            logging.exception("Failed to create Nalogo receipt.")
-            return None
-
-    async def close(self) -> None:
-        return None

bot/services/notification_service.py

@@ -120,8 +120,8 @@ class NotificationService:
                 logging.error(
                     f"Failed to send notification to log channel {self.settings.LOG_CHAT_ID}: {exc}"
                 )
-            except Exception as e:
-                logging.error(f"Failed to send notification to log channel {self.settings.LOG_CHAT_ID}: {e}")
+            except Exception:
+                logging.exception("Failed to send notification to log channel %s.", self.settings.LOG_CHAT_ID)
             return
         
         try:
@@ -143,8 +143,8 @@ class NotificationService:
             # Queue message for sending (groups are rate limited to 15/minute)
             await queue_manager.send_message(self.settings.LOG_CHAT_ID, **kwargs)
             
-        except Exception as e:
-            logging.error(f"Failed to queue notification to log channel {self.settings.LOG_CHAT_ID}: {e}")
+        except Exception:
+            logging.exception("Failed to queue notification to log channel %s.", self.settings.LOG_CHAT_ID)
     
     async def _send_to_admins(self, message: str):
         """Send message to all admin users using message queue"""
@@ -162,8 +162,8 @@ class NotificationService:
                         parse_mode="HTML",
                         disable_web_page_preview=True
                     )
-                except Exception as e:
-                    logging.error(f"Failed to send notification to admin {admin_id}: {e}")
+                except Exception:
+                    logging.exception("Failed to send notification to admin %s.", admin_id)
             return
         
         for admin_id in self.settings.ADMIN_IDS:
@@ -174,8 +174,8 @@ class NotificationService:
                     parse_mode="HTML",
                     disable_web_page_preview=True
                 )
-            except Exception as e:
-                logging.error(f"Failed to queue notification to admin {admin_id}: {e}")
+            except Exception:
+                logging.exception("Failed to queue notification to admin %s.", admin_id)
     
     async def notify_new_user_registration(self, user_id: int, username: Optional[str] = None, 
                                          first_name: Optional[str] = None, 
@@ -212,7 +212,118 @@ class NotificationService:
         # Send to log channel
         profile_keyboard = self._build_profile_keyboard(_, user_id, referred_by_id)
         await self._send_to_log_channel(message, reply_markup=profile_keyboard)
-    
+
+    async def notify_new_email_user_registration(
+        self,
+        user_id: int,
+        email: str,
+        referred_by_id: Optional[int] = None,
+    ):
+        """Send notification about new user registration via email (Web App)."""
+        if not self.settings.LOG_NEW_USERS:
+            return
+
+        admin_lang = self.settings.DEFAULT_LANGUAGE
+        _ = lambda k, **kw: self.i18n.gettext(admin_lang, k, **kw) if self.i18n else k
+
+        referral_text = ""
+        if referred_by_id:
+            referrer_link = hd.link(str(referred_by_id), f"tg://user?id={referred_by_id}")
+            referral_text = _(
+                "log_referral_suffix",
+                referrer_link=referrer_link,
+            )
+
+        message = _(
+            "log_new_email_user_registration",
+            user_id=user_id,
+            email=hd.quote(email),
+            referral_text=referral_text,
+            timestamp=datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+        )
+
+        # Email users have a synthetic (negative) user_id with no Telegram profile,
+        # so we only attach the referrer button when a real referrer is present.
+        reply_markup: Optional[InlineKeyboardMarkup] = None
+        if referred_by_id and referred_by_id > 0:
+            reply_markup = InlineKeyboardMarkup(inline_keyboard=[[
+                InlineKeyboardButton(
+                    text=_("log_open_referrer_profile_button"),
+                    url=f"tg://user?id={referred_by_id}",
+                )
+            ]])
+
+        await self._send_to_log_channel(message, reply_markup=reply_markup)
+
+    async def notify_account_email_linked(
+        self,
+        user_id: int,
+        email: str,
+        telegram_id: Optional[int] = None,
+        username: Optional[str] = None,
+        first_name: Optional[str] = None,
+    ):
+        """Send notification when an email is linked to a Telegram-created account."""
+        if not self.settings.LOG_NEW_USERS:
+            return
+
+        admin_lang = self.settings.DEFAULT_LANGUAGE
+        _ = lambda k, **kw: self.i18n.gettext(admin_lang, k, **kw) if self.i18n else k
+
+        user_display = self._format_user_display(
+            user_id=telegram_id or user_id,
+            username=username,
+            first_name=first_name,
+        )
+
+        message = _(
+            "log_account_email_linked",
+            user_id=user_id,
+            telegram_id=telegram_id or user_id,
+            user_display=user_display,
+            email=hd.quote(email),
+            timestamp=datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+        )
+
+        reply_markup: Optional[InlineKeyboardMarkup] = None
+        if telegram_id and telegram_id > 0:
+            reply_markup = self._build_profile_keyboard(_, telegram_id)
+
+        await self._send_to_log_channel(message, reply_markup=reply_markup)
+
+    async def notify_account_telegram_linked(
+        self,
+        user_id: int,
+        email: Optional[str],
+        telegram_id: int,
+        username: Optional[str] = None,
+        first_name: Optional[str] = None,
+    ):
+        """Send notification when Telegram is linked to an email-created account."""
+        if not self.settings.LOG_NEW_USERS:
+            return
+
+        admin_lang = self.settings.DEFAULT_LANGUAGE
+        _ = lambda k, **kw: self.i18n.gettext(admin_lang, k, **kw) if self.i18n else k
+
+        user_display = self._format_user_display(
+            user_id=telegram_id,
+            username=username,
+            first_name=first_name,
+        )
+
+        message = _(
+            "log_account_telegram_linked",
+            user_id=user_id,
+            telegram_id=telegram_id,
+            user_display=user_display,
+            email=hd.quote(email or ""),
+            timestamp=datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
+        )
+
+        profile_keyboard = self._build_profile_keyboard(_, telegram_id)
+        await self._send_to_log_channel(message, reply_markup=profile_keyboard)
+
     async def notify_payment_received(self, user_id: int, amount: float, currency: str,
                                     months: int, payment_provider: str, 
                                     username: Optional[str] = None,

bot/services/panel_api_service.py

@@ -174,7 +174,7 @@ class PanelApiService:
                 "message": f"Connection error: {str(e)}"
             }
         except aiohttp.ClientError as e:
-            logging.error(f"Panel API ClientError to {url_for_request}: {e}")
+            logging.exception("Panel API ClientError to %s.", url_for_request)
             return {
                 "error": True,
                 "status_code": -2,

bot/services/panel_webhook_service.py

@@ -9,6 +9,8 @@ from sqlalchemy.orm import sessionmaker
 from typing import Optional
 from config.settings import Settings
 from .panel_api_service import PanelApiService
+from .email_auth_service import EmailAuthService
+from .email_templates import render_subscription_expiring
 from bot.middlewares.i18n import JsonI18n
 from bot.keyboards.inline.user_keyboards import get_subscribe_only_markup, get_autorenew_cancel_keyboard
 from db.dal import user_dal
@@ -26,6 +28,10 @@ class PanelWebhookService:
         self.i18n = i18n
         self.async_session_factory = async_session_factory
         self.panel_service = panel_service
+        if not self.settings.PANEL_WEBHOOK_SECRET:
+            logging.error(
+                "PANEL_WEBHOOK_SECRET is not configured. Panel webhooks will be rejected."
+            )
 
     async def _send_message(
         self,
@@ -40,8 +46,8 @@ class PanelWebhookService:
             await self.bot.send_message(
                 user_id, _(message_key, **kwargs), reply_markup=reply_markup
             )
-        except Exception as e:
-            logging.error(f"Failed to send notification to {user_id}: {e}")
+        except Exception:
+            logging.exception("Failed to send notification to %s", user_id)
 
     async def handle_event(self, event_name: str, user_payload: dict):
         telegram_id = user_payload.get("telegramId")
@@ -54,9 +60,13 @@ class PanelWebhookService:
             return
 
         async with self.async_session_factory() as session:
-            db_user = await user_dal.get_user_by_id(session, user_id)
+            db_user = await user_dal.get_user_by_telegram_id(session, user_id)
+            if not db_user:
+                db_user = await user_dal.get_user_by_id(session, user_id)
+            internal_user_id = db_user.user_id if db_user else user_id
             lang = db_user.language_code if db_user and db_user.language_code else self.settings.DEFAULT_LANGUAGE
             first_name = db_user.first_name or f"User {user_id}" if db_user else f"User {user_id}"
+            user_email = (db_user.email or "").strip() if db_user else ""
 
         markup = get_subscribe_only_markup(lang, self.i18n)
 
@@ -69,7 +79,7 @@ class PanelWebhookService:
                     if subscription_service:
                         async with self.async_session_factory() as session:
                             from db.dal import subscription_dal
-                            sub = await subscription_dal.get_active_subscription_by_user_id(session, user_id)
+                            sub = await subscription_dal.get_active_subscription_by_user_id(session, internal_user_id)
                             if sub and sub.auto_renew_enabled and sub.provider == 'yookassa':
                                 try:
                                     ok = await subscription_service.charge_subscription_renewal(session, sub)
@@ -89,7 +99,7 @@ class PanelWebhookService:
                 if days_left == 2:
                     async with self.async_session_factory() as session:
                         from db.dal import subscription_dal
-                        sub = await subscription_dal.get_active_subscription_by_user_id(session, user_id)
+                        sub = await subscription_dal.get_active_subscription_by_user_id(session, internal_user_id)
                         logging.info(
                             "48h webhook check: user_id=%s sub_found=%s auto_renew=%s provider=%s",
                             user_id,
@@ -115,6 +125,13 @@ class PanelWebhookService:
                     user_name=first_name,
                     end_date=user_payload.get("expireAt", "")[:10],
                 )
+                if days_left == 3 and user_email:
+                    await self._send_subscription_expiring_email(
+                        recipient=user_email,
+                        lang=lang,
+                        days_left=days_left,
+                        end_date_text=user_payload.get("expireAt", "")[:10],
+                    )
         elif event_name == "user.expired":
             if self.settings.SUBSCRIPTION_NOTIFY_ON_EXPIRE:
                 await self._send_message(
@@ -135,17 +152,44 @@ class PanelWebhookService:
                 end_date=user_payload.get("expireAt", "")[:10],
             )
 
+    async def _send_subscription_expiring_email(
+        self,
+        *,
+        recipient: str,
+        lang: str,
+        days_left: int,
+        end_date_text: str,
+    ) -> None:
+        """Best-effort branded reminder; silently no-ops without SMTP config."""
+        if not self.settings.email_auth_configured:
+            return
+        try:
+            content = render_subscription_expiring(
+                self.settings,
+                language_code=lang,
+                days_left=days_left,
+                end_date_text=end_date_text,
+                dashboard_url=(self.settings.SUBSCRIPTION_MINI_APP_URL or "").strip() or None,
+            )
+            email_service = EmailAuthService(self.settings)
+            await email_service.send_rendered_email(email=recipient, content=content)
+        except Exception:
+            logging.exception("Failed to send subscription-expiring email to %s", recipient)
+
     async def handle_webhook(self, raw_body: bytes, signature_header: Optional[str]) -> web.Response:
-        if self.settings.PANEL_WEBHOOK_SECRET:
-            if not signature_header:
-                return web.Response(status=403, text="no_signature")
-            expected_sig = hmac.new(
-                self.settings.PANEL_WEBHOOK_SECRET.encode(),
-                raw_body,
-                hashlib.sha256,
-            ).hexdigest()
-            if not hmac.compare_digest(expected_sig, signature_header):
-                return web.Response(status=403, text="invalid_signature")
+        if not self.settings.PANEL_WEBHOOK_SECRET:
+            return web.Response(status=401, text="unauthorized")
+
+        if not signature_header:
+            return web.Response(status=401, text="unauthorized")
+
+        expected_sig = hmac.new(
+            self.settings.PANEL_WEBHOOK_SECRET.encode(),
+            raw_body,
+            hashlib.sha256,
+        ).hexdigest()
+        if not hmac.compare_digest(expected_sig, signature_header):
+            return web.Response(status=401, text="unauthorized")
 
         try:
             payload = json.loads(raw_body.decode())

bot/services/platega_service.py

@@ -1,3 +1,4 @@
+import hmac
 import json
 import logging
 from decimal import Decimal, ROUND_HALF_UP
@@ -41,6 +42,8 @@ class PlategaService:
         self.merchant_id = settings.PLATEGA_MERCHANT_ID
         self.secret = settings.PLATEGA_SECRET
         self.payment_method = settings.PLATEGA_PAYMENT_METHOD
+        self.sbp_method = settings.platega_sbp_method_resolved
+        self.crypto_method = settings.PLATEGA_CRYPTO_METHOD
         self.return_url = settings.PLATEGA_RETURN_URL or f"https://t.me/{default_return_url}"
         self.failed_url = settings.PLATEGA_FAILED_URL or self.return_url
 
@@ -56,6 +59,14 @@ class PlategaService:
         )
         if not self.configured:
             logging.warning("PlategaService initialized but not fully configured. Payments disabled.")
+        else:
+            logging.info(
+                "PlategaService configured. SBP button: %s (method=%s), Crypto button: %s (method=%s)",
+                "ON" if settings.PLATEGA_SBP_ENABLED else "OFF",
+                self.sbp_method,
+                "ON" if settings.PLATEGA_CRYPTO_ENABLED else "OFF",
+                self.crypto_method,
+            )
 
     async def _get_session(self) -> ClientSession:
         if self._session is None or self._session.closed:
@@ -76,6 +87,7 @@ class PlategaService:
         currency: Optional[str],
         description: str,
         payload: Optional[str] = None,
+        payment_method: Optional[int] = None,
     ) -> Tuple[bool, Dict[str, Any]]:
         if not self.configured:
             logging.error("PlategaService is not configured. Cannot create transaction.")
@@ -84,9 +96,10 @@ class PlategaService:
         session = await self._get_session()
         url = f"{self.base_url}/transaction/process"
         currency_code = (currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper()
+        method_id = int(payment_method if payment_method is not None else self.payment_method)
 
         body: Dict[str, Any] = {
-            "paymentMethod": int(self.payment_method),
+            "paymentMethod": method_id,
             "paymentDetails": {"amount": float(amount), "currency": currency_code},
             "description": description,
             "return": self.return_url,
@@ -96,6 +109,12 @@ class PlategaService:
 
         # Remove optional keys with falsy values to avoid validation errors
         clean_body = {k: v for k, v in body.items() if v not in (None, "")}
+        safe_headers = {
+            "X-MerchantId": self._auth_headers.get("X-MerchantId"),
+            "X-Secret": "***" if self._auth_headers.get("X-Secret") else "",
+            "Content-Type": self._auth_headers.get("Content-Type"),
+        }
+        logging.info("Platega create_transaction request: url=%s headers=%s body=%s", url, safe_headers, clean_body)
 
         try:
             async with session.post(url, json=clean_body, headers=self._auth_headers) as response:
@@ -120,7 +139,7 @@ class PlategaService:
 
                 return True, response_data
         except Exception as exc:
-            logging.error("Platega create_transaction: request failed: %s", exc, exc_info=True)
+            logging.exception("Platega create_transaction: request failed.")
             return False, {"message": str(exc)}
 
     async def webhook_route(self, request: web.Request) -> web.Response:
@@ -129,13 +148,16 @@ class PlategaService:
 
         try:
             data = await request.json()
-        except Exception as exc:
-            logging.error("Platega webhook: failed to parse JSON: %s", exc)
+        except Exception:
+            logging.exception("Platega webhook: failed to parse JSON.")
             return web.Response(status=400, text="bad_request")
 
         header_merchant = request.headers.get("X-MerchantId")
         header_secret = request.headers.get("X-Secret")
-        if header_merchant != self.merchant_id or header_secret != self.secret:
+        if not (
+            hmac.compare_digest(str(header_merchant or ""), str(self.merchant_id or ""))
+            and hmac.compare_digest(str(header_secret or ""), str(self.secret or ""))
+        ):
             logging.error("Platega webhook: invalid auth headers")
             return web.Response(status=403, text="forbidden")
 
@@ -205,9 +227,9 @@ class PlategaService:
                         )
 
                     await session.commit()
-                except Exception as exc:
+                except Exception:
                     await session.rollback()
-                    logging.error("Platega webhook: failed to process payment %s: %s", transaction_id, exc, exc_info=True)
+                    logging.exception("Platega webhook: failed to process payment %s.", transaction_id)
                     return web.Response(status=500, text="processing_error")
 
                 db_user = await user_dal.get_user_by_id(session, payment.user_id)
@@ -286,8 +308,8 @@ class PlategaService:
                         parse_mode="HTML",
                         disable_web_page_preview=True,
                     )
-                except Exception as exc:
-                    logging.error("Platega webhook: failed to notify user %s: %s", payment.user_id, exc)
+                except Exception:
+                    logging.exception("Platega webhook: failed to notify user %s.", payment.user_id)
 
                 try:
                     notification_service = NotificationService(self.bot, self.settings, self.i18n)
@@ -300,8 +322,8 @@ class PlategaService:
                         payment_provider="platega",
                         username=db_user.username if db_user else None,
                     )
-                except Exception as exc:
-                    logging.error("Platega webhook: failed to notify admins: %s", exc)
+                except Exception:
+                    logging.exception("Platega webhook: failed to notify admins.")
 
                 return web.Response(text="ok")
 
@@ -314,9 +336,9 @@ class PlategaService:
                         "canceled",
                     )
                     await session.commit()
-                except Exception as exc:
+                except Exception:
                     await session.rollback()
-                    logging.error("Platega webhook: failed to cancel payment %s: %s", transaction_id, exc)
+                    logging.exception("Platega webhook: failed to cancel payment %s.", transaction_id)
                     return web.Response(status=500, text="processing_error")
 
                 db_user = await user_dal.get_user_by_id(session, payment.user_id)

bot/services/promo_code_service.py

@@ -1,10 +1,12 @@
 import logging
+from html import escape as html_escape
 from datetime import datetime
 from sqlalchemy.ext.asyncio import AsyncSession
 from typing import Optional, Tuple, Dict
 from aiogram import Bot
 
 from config.settings import Settings
+from db.dal import security_dal
 
 from db.dal import promo_code_dal, user_dal
 from db.models import PromoCode, User
@@ -24,6 +26,9 @@ class PromoCodeService:
         self.bot = bot
         self.i18n = i18n
 
+    def _throttle_identifier(self, user_id: int) -> str:
+        return f"user:{int(user_id)}"
+
     async def apply_promo_code(
         self,
         session: AsyncSession,
@@ -32,19 +37,45 @@ class PromoCodeService:
         user_lang: str,
     ) -> Tuple[bool, datetime | str]:
         _ = lambda k, **kw: self.i18n.gettext(user_lang, k, **kw)
-        code_input_upper = code_input.strip().upper()
+        code_input_upper = (code_input or "").strip().upper()[:100]
+        code_display = html_escape(code_input_upper[:100], quote=False)
+        throttle_identifier = self._throttle_identifier(user_id)
+
+        throttle = await security_dal.check_throttle(
+            session,
+            scope=security_dal.PROMO_CODE_APPLY_SCOPE,
+            identifier=throttle_identifier,
+        )
+        if throttle.locked:
+            return False, _(
+                "promo_code_too_many_attempts",
+                seconds=throttle.retry_after or max(1, int(self.settings.BRUTE_FORCE_LOCK_SECONDS)),
+            )
 
         promo_data = await promo_code_dal.get_active_promo_code_by_code_str(
             session, code_input_upper)
 
         if not promo_data:
-            return False, _("promo_code_not_found", code=code_input_upper)
+            throttle_result = await security_dal.record_throttle_failure(
+                session,
+                scope=security_dal.PROMO_CODE_APPLY_SCOPE,
+                identifier=throttle_identifier,
+                max_failures=self.settings.BRUTE_FORCE_MAX_FAILURES,
+                window_seconds=self.settings.BRUTE_FORCE_WINDOW_SECONDS,
+                lock_seconds=self.settings.BRUTE_FORCE_LOCK_SECONDS,
+            )
+            if throttle_result.locked:
+                return False, _(
+                    "promo_code_too_many_attempts",
+                    seconds=throttle_result.retry_after or max(1, int(self.settings.BRUTE_FORCE_LOCK_SECONDS)),
+                )
+            return False, _("promo_code_not_found", code=code_display)
 
         existing_activation = await promo_code_dal.get_user_activation_for_promo(
             session, promo_data.promo_code_id, user_id)
         if existing_activation:
             return False, _("promo_code_already_used_by_user",
-                            code=code_input_upper)
+                            code=code_display)
 
         bonus_days = promo_data.bonus_days
 
@@ -61,6 +92,11 @@ class PromoCodeService:
                 session, promo_data.promo_code_id)
 
             if activation_recorded and promo_incremented:
+                await security_dal.clear_throttle_state(
+                    session,
+                    scope=security_dal.PROMO_CODE_APPLY_SCOPE,
+                    identifier=throttle_identifier,
+                )
                 # Send notification about promo activation
                 try:
                     notification_service = NotificationService(self.bot, self.settings, self.i18n)

bot/services/severpay_service.py

@@ -142,7 +142,7 @@ class SeverPayService:
 
                 return True, response_data.get("data") or response_data
         except Exception as exc:
-            logging.error("SeverPay create_payment: request failed: %s", exc, exc_info=True)
+            logging.exception("SeverPay create_payment: request failed.")
             return False, {"message": str(exc)}
 
     async def webhook_route(self, request: web.Request) -> web.Response:
@@ -151,8 +151,8 @@ class SeverPayService:
 
         try:
             payload = await request.json()
-        except Exception as exc:
-            logging.error("SeverPay webhook: failed to parse JSON: %s", exc)
+        except Exception:
+            logging.exception("SeverPay webhook: failed to parse JSON.")
             return web.json_response({"status": False, "msg": "bad_request"}, status=400)
 
         if not isinstance(payload, dict) or not self._validate_signature(payload):
@@ -223,9 +223,9 @@ class SeverPayService:
                         )
 
                     await session.commit()
-                except Exception as exc:
+                except Exception:
                     await session.rollback()
-                    logging.error("SeverPay webhook: failed to process payment %s: %s", provider_payment_id, exc, exc_info=True)
+                    logging.exception("SeverPay webhook: failed to process payment %s.", provider_payment_id)
                     return web.json_response({"status": False, "msg": "processing_error"}, status=500)
 
                 db_user = payment.user or await user_dal.get_user_by_id(session, payment.user_id)
@@ -304,8 +304,8 @@ class SeverPayService:
                         parse_mode="HTML",
                         disable_web_page_preview=True,
                     )
-                except Exception as exc:
-                    logging.error("SeverPay webhook: failed to notify user %s: %s", payment.user_id, exc)
+                except Exception:
+                    logging.exception("SeverPay webhook: failed to notify user %s.", payment.user_id)
 
                 try:
                     notification_service = NotificationService(self.bot, self.settings, self.i18n)
@@ -318,8 +318,8 @@ class SeverPayService:
                         payment_provider="severpay",
                         username=db_user.username if db_user else None,
                     )
-                except Exception as exc:
-                    logging.error("SeverPay webhook: failed to notify admins: %s", exc)
+                except Exception:
+                    logging.exception("SeverPay webhook: failed to notify admins.")
 
                 return web.json_response({"status": True})
 
@@ -332,9 +332,9 @@ class SeverPayService:
                         "failed",
                     )
                     await session.commit()
-                except Exception as exc:
+                except Exception:
                     await session.rollback()
-                    logging.error("SeverPay webhook: failed to mark payment %s as failed: %s", provider_payment_id, exc)
+                    logging.exception("SeverPay webhook: failed to mark payment %s as failed.", provider_payment_id)
                     return web.json_response({"status": False, "msg": "processing_error"}, status=500)
 
                 db_user = payment.user or await user_dal.get_user_by_id(session, payment.user_id)
@@ -355,9 +355,9 @@ class SeverPayService:
                         "pending_severpay",
                     )
                     await session.commit()
-                except Exception as exc:
+                except Exception:
                     await session.rollback()
-                    logging.error("SeverPay webhook: failed to update pending status for %s: %s", provider_payment_id, exc)
+                    logging.exception("SeverPay webhook: failed to update pending status for %s.", provider_payment_id)
                 return web.json_response({"status": True})
 
             logging.warning("SeverPay webhook: unhandled status '%s' for payment %s", status, provider_payment_id)

bot/services/stars_service.py

@@ -55,7 +55,7 @@ class StarsService:
                 title=description,
                 description=description,
                 payload=payload,
-                provider_token="",
+                provider_token="",  # Required to be empty for Telegram Stars (XTR) per Telegram Bot API.
                 currency="XTR",
                 prices=prices,
             )

bot/services/subscription_service.py

@@ -12,6 +12,8 @@ from db.models import User, Subscription
 
 from config.settings import Settings
 from .panel_api_service import PanelApiService
+from .email_auth_service import EmailAuthService
+from .email_templates import render_payment_success
 
 
 class SubscriptionService:
@@ -55,6 +57,33 @@ class SubscriptionService:
         except Exception:
             return False
 
+    def _extract_panel_traffic_details(
+        self, panel_user_data: Dict[str, Any]
+    ) -> Tuple[Optional[int], Optional[int], Optional[str]]:
+        traffic_stats = panel_user_data.get("userTraffic") or {}
+        used = traffic_stats.get("usedTrafficBytes")
+        if used is None:
+            used = panel_user_data.get("usedTrafficBytes")
+        limit = panel_user_data.get("trafficLimitBytes")
+        strategy = panel_user_data.get("trafficLimitStrategy")
+        if strategy is None:
+            strategy = traffic_stats.get("trafficLimitStrategy")
+        return used, limit, strategy
+
+    def _extract_lifetime_used_traffic(
+        self, panel_user_data: Dict[str, Any]
+    ) -> Optional[int]:
+        traffic_stats = panel_user_data.get("userTraffic") or {}
+        lifetime = traffic_stats.get("lifetimeUsedTrafficBytes")
+        if lifetime is None:
+            lifetime = panel_user_data.get("lifetimeUsedTrafficBytes")
+        try:
+            if lifetime is None:
+                return None
+            return int(lifetime)
+        except (TypeError, ValueError):
+            return None
+
     async def _notify_admin_panel_user_creation_failed(self, user_id: int):
         if not self.bot or not self.i18n or not self.settings.ADMIN_IDS:
             return
@@ -69,6 +98,42 @@ class SubscriptionService:
                     f"Failed to notify admin {admin_id} about panel user creation failure: {e}"
                 )
 
+    def _telegram_id_for_panel(self, db_user: User) -> Optional[int]:
+        if db_user.telegram_id:
+            return int(db_user.telegram_id)
+        if db_user.user_id and int(db_user.user_id) > 0:
+            return int(db_user.user_id)
+        return None
+
+    async def _panel_username_for_user(
+        self, session: AsyncSession, db_user: User
+    ) -> str:
+        telegram_id = self._telegram_id_for_panel(db_user)
+        if telegram_id and int(db_user.user_id) == telegram_id:
+            return f"tg_{telegram_id}"
+        referral_code = await user_dal.ensure_referral_code(session, db_user)
+        return f"em_{referral_code}"
+
+    def _panel_description_for_user(self, db_user: User) -> str:
+        lines = [
+            db_user.email or "",
+            db_user.username or "",
+            db_user.first_name or "",
+            db_user.last_name or "",
+        ]
+        return "\n".join(line for line in lines if line).strip()
+
+    def _panel_identity_payload_for_user(self, db_user: User) -> Dict[str, Any]:
+        payload: Dict[str, Any] = {
+            "description": self._panel_description_for_user(db_user),
+        }
+        telegram_id = self._telegram_id_for_panel(db_user)
+        if telegram_id:
+            payload["telegramId"] = telegram_id
+        if db_user.email:
+            payload["email"] = db_user.email
+        return payload
+
     async def _get_or_create_panel_user_link_details(
         self, session: AsyncSession, user_id: int, db_user: Optional[User] = None
     ) -> Tuple[Optional[str], Optional[str], Optional[str], bool]:
@@ -82,25 +147,45 @@ class SubscriptionService:
             return None, None, None, False
 
         current_local_panel_uuid = db_user.panel_user_uuid
-        panel_username_on_panel_standard = f"tg_{user_id}"
+        panel_username_on_panel_standard = await self._panel_username_for_user(
+            session, db_user
+        )
+        telegram_id_for_panel = self._telegram_id_for_panel(db_user)
 
         panel_user_obj_from_api = None
         panel_user_created_or_linked_now = False
 
-        panel_users_by_tg_id_list = await self.panel_service.get_users_by_filter(
-            telegram_id=user_id
-        )
+        panel_users_by_tg_id_list = None
+        if telegram_id_for_panel:
+            panel_users_by_tg_id_list = await self.panel_service.get_users_by_filter(
+                telegram_id=telegram_id_for_panel
+            )
         if panel_users_by_tg_id_list and len(panel_users_by_tg_id_list) == 1:
             panel_user_obj_from_api = panel_users_by_tg_id_list[0]
             logging.info(
-                f"Found panel user by telegramId {user_id}: UUID {panel_user_obj_from_api.get('uuid')}, Username: {panel_user_obj_from_api.get('username')}"
+                f"Found panel user by telegramId {telegram_id_for_panel}: UUID {panel_user_obj_from_api.get('uuid')}, Username: {panel_user_obj_from_api.get('username')}"
             )
         elif panel_users_by_tg_id_list and len(panel_users_by_tg_id_list) > 1:
             logging.error(
-                f"CRITICAL: Multiple panel users found for telegramId {user_id}. Manual intervention needed."
+                f"CRITICAL: Multiple panel users found for telegramId {telegram_id_for_panel}. Manual intervention needed."
             )
             return None, None, None, False
 
+        if not panel_user_obj_from_api and db_user.email:
+            panel_users_by_email_list = await self.panel_service.get_users_by_filter(
+                email=db_user.email
+            )
+            if panel_users_by_email_list and len(panel_users_by_email_list) == 1:
+                panel_user_obj_from_api = panel_users_by_email_list[0]
+                logging.info(
+                    f"Found panel user by email {db_user.email}: UUID {panel_user_obj_from_api.get('uuid')}, Username: {panel_user_obj_from_api.get('username')}"
+                )
+            elif panel_users_by_email_list and len(panel_users_by_email_list) > 1:
+                logging.error(
+                    f"CRITICAL: Multiple panel users found for email {db_user.email}. Manual intervention needed."
+                )
+                return None, None, None, False
+
         if not panel_user_obj_from_api:
             if current_local_panel_uuid:
 
@@ -119,12 +204,9 @@ class SubscriptionService:
                     )
                     creation_response = await self.panel_service.create_panel_user(
                         username_on_panel=panel_username_on_panel_standard,
-                        telegram_id=user_id,
-                        description="\n".join([
-                            (db_user.username or "") if db_user else "",
-                            (db_user.first_name or "") if db_user else "",
-                            (db_user.last_name or "") if db_user else "",
-                        ]),
+                        telegram_id=telegram_id_for_panel,
+                        email=db_user.email,
+                        description=self._panel_description_for_user(db_user),
                         specific_squad_uuids=self.settings.parsed_user_squad_uuids,
                         external_squad_uuid=self.settings.parsed_user_external_squad_uuid,
                         default_traffic_limit_bytes=self.settings.user_traffic_limit_bytes,
@@ -148,12 +230,9 @@ class SubscriptionService:
                 )
                 creation_response = await self.panel_service.create_panel_user(
                     username_on_panel=panel_username_on_panel_standard,
-                    telegram_id=user_id,
-                    description="\n".join([
-                        (db_user.username or "") if db_user else "",
-                        (db_user.first_name or "") if db_user else "",
-                        (db_user.last_name or "") if db_user else "",
-                    ]),
+                    telegram_id=telegram_id_for_panel,
+                    email=db_user.email,
+                    description=self._panel_description_for_user(db_user),
                     specific_squad_uuids=self.settings.parsed_user_squad_uuids,
                     external_squad_uuid=self.settings.parsed_user_external_squad_uuid,
                     default_traffic_limit_bytes=self.settings.user_traffic_limit_bytes,
@@ -199,7 +278,6 @@ class SubscriptionService:
             )
 
         actual_panel_uuid_from_api = panel_user_obj_from_api.get("uuid")
-        actual_panel_username_from_api = panel_user_obj_from_api.get("username")
         panel_telegram_id_from_api = panel_user_obj_from_api.get("telegramId")
 
         if not actual_panel_uuid_from_api:
@@ -266,24 +344,15 @@ class SubscriptionService:
         if (
             panel_user_obj_from_api
             and current_local_panel_uuid
-            and panel_telegram_id_int != user_id
+            and telegram_id_for_panel
+            and panel_telegram_id_int != telegram_id_for_panel
         ):
             logging.info(
-                f"Panel user {current_local_panel_uuid} has telegramId '{panel_telegram_id_from_api}'. Updating on panel to '{user_id}'."
+                f"Panel user {current_local_panel_uuid} has telegramId '{panel_telegram_id_from_api}'. Updating on panel to '{telegram_id_for_panel}'."
             )
-            # Also set readable description with Telegram fields
             await self.panel_service.update_user_details_on_panel(
                 current_local_panel_uuid,
-                {
-                    "telegramId": user_id,
-                    "description": "\n".join(
-                        [
-                            (db_user.username or "") if db_user else "",
-                            (db_user.first_name or "") if db_user else "",
-                            (db_user.last_name or "") if db_user else "",
-                        ]
-                    ),
-                },
+                self._panel_identity_payload_for_user(db_user),
             )
 
         panel_sub_link_id = panel_user_obj_from_api.get(
@@ -358,6 +427,7 @@ class SubscriptionService:
             "is_active": True,
             "status_from_panel": "TRIAL",
             "traffic_limit_bytes": self.settings.trial_traffic_limit_bytes,
+            "traffic_limit_strategy": self.settings.TRIAL_TRAFFIC_STRATEGY,
             "auto_renew_enabled": False,
         }
         try:
@@ -379,16 +449,10 @@ class SubscriptionService:
             expire_at=end_date,
             status="ACTIVE",
             traffic_limit_bytes=self.settings.trial_traffic_limit_bytes,
+            traffic_limit_strategy=self.settings.TRIAL_TRAFFIC_STRATEGY,
         )
 
-        # Add user description based on Telegram profile
-        panel_update_payload["description"] = "\n".join(
-            [
-                (db_user.username or "") if db_user else "",
-                (db_user.first_name or "") if db_user else "",
-                (db_user.last_name or "") if db_user else "",
-            ]
-        )
+        panel_update_payload.update(self._panel_identity_payload_for_user(db_user))
 
         updated_panel_user = await self.panel_service.update_user_details_on_panel(
             panel_user_uuid, panel_update_payload
@@ -444,9 +508,7 @@ class SubscriptionService:
             return None
 
         panel_user_data = await self.panel_service.get_user_by_uuid(panel_user_uuid) or {}
-        traffic_info = panel_user_data.get("userTraffic") or {}
-        current_limit = panel_user_data.get("trafficLimitBytes")
-        current_used = traffic_info.get("usedTrafficBytes")
+        current_used, current_limit, _ = self._extract_panel_traffic_details(panel_user_data)
 
         active_sub = await subscription_dal.get_active_subscription_by_user_id(
             session, user_id, panel_user_uuid
@@ -500,13 +562,7 @@ class SubscriptionService:
             traffic_limit_strategy="NO_RESET",
         )
 
-        panel_update_payload["description"] = "\n".join(
-            [
-                (db_user.username or "") if db_user else "",
-                (db_user.first_name or "") if db_user else "",
-                (db_user.last_name or "") if db_user else "",
-            ]
-        )
+        panel_update_payload.update(self._panel_identity_payload_for_user(db_user))
 
         updated_panel_user = await self.panel_service.update_user_details_on_panel(
             panel_user_uuid, panel_update_payload
@@ -522,6 +578,16 @@ class SubscriptionService:
         final_subscription_url = updated_panel_user.get("subscriptionUrl")
         final_panel_short_uuid = updated_panel_user.get("shortUuid", panel_short_uuid)
 
+        await self._send_payment_success_email(
+            db_user=db_user,
+            sale_mode="traffic",
+            months=0,
+            traffic_gb=float(traffic_gb),
+            payment_amount=payment_amount,
+            end_date=None,
+            provider=provider,
+        )
+
         return {
             "subscription_id": new_or_updated_sub.subscription_id,
             "end_date": final_end_date,
@@ -670,14 +736,7 @@ class SubscriptionService:
             traffic_limit_bytes=self.settings.user_traffic_limit_bytes,
         )
 
-        # Add user description based on Telegram profile
-        panel_update_payload["description"] = "\n".join(
-            [
-                (db_user.username or "") if db_user else "",
-                (db_user.first_name or "") if db_user else "",
-                (db_user.last_name or "") if db_user else "",
-            ]
-        )
+        panel_update_payload.update(self._panel_identity_payload_for_user(db_user))
 
         updated_panel_user = await self.panel_service.update_user_details_on_panel(
             panel_user_uuid, panel_update_payload
@@ -691,6 +750,16 @@ class SubscriptionService:
         final_subscription_url = updated_panel_user.get("subscriptionUrl")
         final_panel_short_uuid = updated_panel_user.get("shortUuid", panel_short_uuid)
 
+        await self._send_payment_success_email(
+            db_user=db_user,
+            sale_mode="subscription",
+            months=months_int,
+            traffic_gb=None,
+            payment_amount=payment_amount,
+            end_date=final_end_date,
+            provider=provider,
+        )
+
         return {
             "subscription_id": new_or_updated_sub.subscription_id,
             "end_date": final_end_date,
@@ -842,13 +911,22 @@ class SubscriptionService:
             await user_dal.update_user(session, user_id, {"panel_user_uuid": None})
             return None
 
+        panel_lifetime_used = self._extract_lifetime_used_traffic(panel_user_data)
+        if (
+            panel_lifetime_used is not None
+            and db_user.lifetime_used_traffic_bytes != panel_lifetime_used
+        ):
+            await user_dal.update_user(
+                session,
+                user_id,
+                {"lifetime_used_traffic_bytes": panel_lifetime_used},
+            )
+
         if local_active_sub:
             update_payload_local = {}
             panel_status = panel_user_data.get("status", "UNKNOWN").upper()
             panel_expire_at_str = panel_user_data.get("expireAt")
-            traffic_stats = panel_user_data.get("userTraffic") or {}
-            panel_traffic_used = traffic_stats.get("usedTrafficBytes")
-            panel_traffic_limit = panel_user_data.get("trafficLimitBytes")
+            panel_traffic_used, panel_traffic_limit, _ = self._extract_panel_traffic_details(panel_user_data)
             panel_sub_uuid_from_panel = panel_user_data.get(
                 "subscriptionUuid"
             ) or panel_user_data.get("shortUuid")
@@ -901,6 +979,7 @@ class SubscriptionService:
             if panel_user_data.get("expireAt")
             else None
         )
+        panel_traffic_used, panel_traffic_limit, panel_traffic_strategy = self._extract_panel_traffic_details(panel_user_data)
         config_link_raw = panel_user_data.get("subscriptionUrl")
         display_link, connect_button_url = await prepare_config_links(self.settings, config_link_raw)
         hwid_limit = panel_user_data.get("hwidDeviceLimit")
@@ -913,8 +992,9 @@ class SubscriptionService:
             "status_from_panel": panel_user_data.get("status", "UNKNOWN").upper(),
             "config_link": display_link,
             "connect_button_url": connect_button_url,
-            "traffic_limit_bytes": panel_user_data.get("trafficLimitBytes"),
-            "traffic_used_bytes": (panel_user_data.get("userTraffic") or {}).get("usedTrafficBytes"),
+            "traffic_limit_bytes": panel_traffic_limit,
+            "traffic_used_bytes": panel_traffic_used,
+            "traffic_limit_strategy": panel_traffic_strategy,
             "user_bot_username": db_user.username,
             "is_panel_data": True,
             "max_devices": hwid_limit,
@@ -1011,6 +1091,61 @@ class SubscriptionService:
         logging.info(f"Auto-renew initiated for user {sub.user_id} payment_id={resp.get('id')}")
         return True
 
+    _PROVIDER_LABELS = {
+        "yookassa": "YooKassa",
+        "freekassa": "FreeKassa",
+        "platega": "Platega",
+        "severpay": "SeverPay",
+        "cryptopay": "Crypto Pay",
+        "crypto_pay": "Crypto Pay",
+        "stars": "Telegram Stars",
+        "tribute": "Tribute",
+    }
+
+    async def _send_payment_success_email(
+        self,
+        *,
+        db_user: User,
+        sale_mode: str,
+        months: int,
+        traffic_gb: Optional[float],
+        payment_amount: float,
+        end_date: Optional[datetime],
+        provider: str,
+    ) -> None:
+        """Best-effort branded email confirming the payment. No-op if SMTP or
+        the user's email aren't set. Failures are logged and swallowed so the
+        payment flow is never blocked by mail delivery."""
+        if not self.settings.email_auth_configured:
+            return
+        recipient = (db_user.email or "").strip() if db_user else ""
+        if not recipient:
+            return
+
+        end_date_text = end_date.strftime("%Y-%m-%d") if end_date else ""
+        provider_label = self._PROVIDER_LABELS.get((provider or "").lower())
+        dashboard_url = (self.settings.SUBSCRIPTION_MINI_APP_URL or "").strip() or None
+
+        try:
+            content = render_payment_success(
+                self.settings,
+                language_code=db_user.language_code or self.settings.DEFAULT_LANGUAGE,
+                sale_mode=sale_mode,
+                months=int(months or 0),
+                traffic_gb=traffic_gb,
+                amount=float(payment_amount or 0),
+                currency=self.settings.DEFAULT_CURRENCY_SYMBOL,
+                end_date_text=end_date_text,
+                dashboard_url=dashboard_url,
+                provider_label=provider_label,
+            )
+            email_service = EmailAuthService(self.settings)
+            await email_service.send_rendered_email(email=recipient, content=content)
+        except Exception:
+            logging.exception(
+                "Failed to send payment success email to user %s", db_user.user_id
+            )
+
     async def update_last_notification_sent(
         self, session: AsyncSession, user_id: int, subscription_end_date: datetime
     ):

bot/services/yookassa_service.py

@@ -35,9 +35,8 @@ class YooKassaService:
                 self.configured = True
                 logging.info(
                     f"YooKassa SDK configured for shop_id: {shop_id[:5]}...")
-            except Exception as e:
-                logging.error(f"Failed to configure YooKassa SDK: {e}",
-                              exc_info=True)
+            except Exception:
+                logging.exception("Failed to configure YooKassa SDK.")
                 self.configured = False
 
         if configured_return_url:
@@ -161,10 +160,11 @@ class YooKassaService:
                 f"Amount: {amount} {currency}. Metadata: {metadata}. Receipt: {receipt_data_dict}"
             )
 
-            loop = asyncio.get_running_loop()
-            response = await loop.run_in_executor(
-                None, lambda: YooKassaPayment.create(payment_request,
-                                                     idempotence_key))
+            response = await asyncio.to_thread(
+                YooKassaPayment.create,
+                payment_request,
+                idempotence_key,
+            )
 
             logging.info(
                 f"YooKassa Payment.create response: ID={response.id}, Status={response.status}, Paid={response.paid}"
@@ -200,9 +200,8 @@ class YooKassaService:
                 response.test if hasattr(response, 'test') else None,
                 "payment_method": getattr(response, 'payment_method', None),
             }
-        except Exception as e:
-            logging.error(f"YooKassa payment creation failed: {e}",
-                          exc_info=True)
+        except Exception:
+            logging.exception("YooKassa payment creation failed.")
             return None
 
     async def get_payment_info(
@@ -216,9 +215,10 @@ class YooKassaService:
                 f"Fetching payment info from YooKassa for ID: {payment_id_in_yookassa}"
             )
 
-            loop = asyncio.get_running_loop()
-            payment_info_yk = await loop.run_in_executor(
-                None, lambda: YooKassaPayment.find_one(payment_id_in_yookassa))
+            payment_info_yk = await asyncio.to_thread(
+                YooKassaPayment.find_one,
+                payment_id_in_yookassa,
+            )
 
             if payment_info_yk:
                 logging.info(
@@ -264,10 +264,9 @@ class YooKassaService:
                     f"No payment info found in YooKassa for ID: {payment_id_in_yookassa}"
                 )
                 return None
-        except Exception as e:
-            logging.error(
-                f"YooKassa get payment info for {payment_id_in_yookassa} failed: {e}",
-                exc_info=True)
+        except Exception:
+            logging.exception(
+                "YooKassa get payment info for %s failed.", payment_id_in_yookassa)
             return None
 
     async def cancel_payment(self, payment_id_in_yookassa: str) -> bool:
@@ -275,10 +274,9 @@ class YooKassaService:
             logging.error("YooKassa is not configured. Cannot cancel payment.")
             return False
         try:
-            loop = asyncio.get_running_loop()
-            await loop.run_in_executor(None, lambda: YooKassaPayment.cancel(payment_id_in_yookassa))
+            await asyncio.to_thread(YooKassaPayment.cancel, payment_id_in_yookassa)
             logging.info(f"Cancelled YooKassa payment {payment_id_in_yookassa}")
             return True
-        except Exception as e:
-            logging.error(f"Failed to cancel YooKassa payment {payment_id_in_yookassa}: {e}")
+        except Exception:
+            logging.exception("Failed to cancel YooKassa payment %s.", payment_id_in_yookassa)
             return False

bot/utils/callback_answer.py

@@ -0,0 +1,52 @@
+import logging
+from typing import Any
+
+from aiogram.exceptions import TelegramAPIError, TelegramBadRequest
+from aiogram.types import CallbackQuery
+
+
+_EXPIRED_CALLBACK_MARKERS = (
+    "query is too old",
+    "response timeout expired",
+    "query id is invalid",
+)
+
+
+def is_expired_callback_answer_error(error: BaseException) -> bool:
+    if not isinstance(error, TelegramBadRequest):
+        return False
+    message = str(error).lower()
+    return any(marker in message for marker in _EXPIRED_CALLBACK_MARKERS)
+
+
+async def safe_answer_callback(
+    callback: CallbackQuery,
+    *args: Any,
+    **kwargs: Any,
+) -> bool:
+    try:
+        await callback.answer(*args, **kwargs)
+        return True
+    except TelegramBadRequest as error:
+        user_id = getattr(getattr(callback, "from_user", None), "id", "unknown")
+        if is_expired_callback_answer_error(error):
+            logging.info(
+                "Ignored expired callback answer for user %s: %s",
+                user_id,
+                error,
+            )
+            return False
+        logging.warning(
+            "Failed to answer callback query for user %s: %s",
+            user_id,
+            error,
+        )
+        return False
+    except TelegramAPIError as error:
+        user_id = getattr(getattr(callback, "from_user", None), "id", "unknown")
+        logging.warning(
+            "Telegram API error while answering callback query for user %s: %s",
+            user_id,
+            error,
+        )
+        return False

bot/utils/message_queue.py

@@ -82,9 +82,9 @@ class MessageQueue:
                     self.total_failed += 1
                     logging.error(f"Failed to send queued message to {message.chat_id}: {exc}")
                     
-                except Exception as e:
+                except Exception:
                     self.total_failed += 1
-                    logging.error(f"Failed to send queued message to {message.chat_id}: {e}")
+                    logging.exception("Failed to send queued message to %s.", message.chat_id)
                     
         finally:
             self.is_processing = False

bot/utils/request_security.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+import ipaddress
+from typing import Optional, Sequence
+
+from aiohttp import web
+
+
+def parse_ip_entries(raw_values: Optional[Sequence[str] | str]) -> list[ipaddress._BaseNetwork]:
+    if raw_values is None:
+        return []
+    if isinstance(raw_values, str):
+        values = [item.strip() for item in raw_values.split(",")]
+    else:
+        values = [str(item).strip() for item in raw_values]
+
+    parsed: list[ipaddress._BaseNetwork] = []
+    for value in values:
+        if not value:
+            continue
+        try:
+            parsed.append(ipaddress.ip_network(value, strict=False))
+        except ValueError:
+            continue
+    return parsed
+
+
+def _parse_ip(value: Optional[str]) -> Optional[ipaddress._BaseAddress]:
+    if not value:
+        return None
+    try:
+        return ipaddress.ip_address(value.strip())
+    except ValueError:
+        return None
+
+
+def _last_forwarded_ip(header_value: str) -> Optional[str]:
+    candidates = [item.strip() for item in header_value.split(",") if item.strip()]
+    if not candidates:
+        return None
+    candidate = candidates[-1]
+    return candidate if _parse_ip(candidate) is not None else None
+
+
+def request_client_ip(
+    request: web.Request,
+    *,
+    trusted_proxies: Optional[Sequence[str] | str] = None,
+) -> Optional[str]:
+    remote_ip = _parse_ip(request.remote or "")
+    forwarded_for = request.headers.get("X-Forwarded-For", "")
+
+    if remote_ip and forwarded_for:
+        trusted_networks = parse_ip_entries(trusted_proxies)
+        if any(remote_ip in network for network in trusted_networks):
+            forwarded_ip = _last_forwarded_ip(forwarded_for)
+            if forwarded_ip:
+                return forwarded_ip
+
+    if remote_ip:
+        return str(remote_ip)
+
+    forwarded_ip = _last_forwarded_ip(forwarded_for)
+    return forwarded_ip
+
+
+def ip_in_allowlist(ip_value: Optional[str], allowed_entries: Optional[Sequence[str] | str]) -> bool:
+    parsed_ip = _parse_ip(ip_value)
+    if parsed_ip is None:
+        return False
+
+    allowed_networks = parse_ip_entries(allowed_entries)
+    return any(parsed_ip in network for network in allowed_networks)

config/settings.py

@@ -1,8 +1,102 @@
 import logging
-from pydantic_settings import BaseSettings, SettingsConfigDict
-from pydantic import Field, ValidationError, computed_field, field_validator
+import os
+import secrets
 from typing import Optional, List, Dict, Any
 
+from pydantic import BaseModel, Field, ValidationError, computed_field, field_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+def _split_csv(value: Optional[str]) -> List[str]:
+    if not value:
+        return []
+    return [item.strip() for item in value.split(",") if item.strip()]
+
+
+class DBSettings(BaseModel):
+    user: str
+    password: str
+    host: str
+    port: int
+    database: str
+
+
+class PaymentSettings(BaseModel):
+    yookassa_enabled: bool
+    yookassa_shop_id: Optional[str]
+    yookassa_secret_key: Optional[str]
+    yookassa_return_url: Optional[str]
+    yookassa_default_receipt_email: Optional[str]
+    yookassa_vat_code: int
+    yookassa_payment_mode: str
+    yookassa_payment_subject: str
+    yookassa_autopayments_enabled: bool
+    yookassa_autopayments_require_card_binding: bool
+    freekassa_enabled: bool
+    freekassa_merchant_id: Optional[str]
+    freekassa_second_secret: Optional[str]
+    freekassa_api_key: Optional[str]
+    freekassa_payment_ip: Optional[str]
+    freekassa_payment_method_id: Optional[int]
+    freekassa_trusted_ips: List[str]
+    platega_enabled: bool
+    platega_base_url: str
+    platega_merchant_id: Optional[str]
+    platega_secret: Optional[str]
+    platega_payment_method: int
+    platega_sbp_enabled: bool
+    platega_crypto_enabled: bool
+    platega_sbp_method: int
+    platega_crypto_method: int
+    platega_return_url: Optional[str]
+    platega_failed_url: Optional[str]
+    severpay_enabled: bool
+    severpay_mid: Optional[int]
+    severpay_token: Optional[str]
+    severpay_return_url: Optional[str]
+    severpay_base_url: str
+    severpay_lifetime_minutes: Optional[int]
+    cryptopay_enabled: bool
+    cryptopay_token: Optional[str]
+    cryptopay_network: str
+    cryptopay_currency_type: str
+    cryptopay_asset: str
+
+
+class EmailSettings(BaseModel):
+    smtp_host: str
+    smtp_port: int
+    smtp_fallback_ports: Optional[str]
+    smtp_timeout_seconds: int
+    smtp_username: Optional[str]
+    smtp_password: Optional[str]
+    smtp_from_email: Optional[str]
+    smtp_from_name: Optional[str]
+    smtp_starttls: bool
+    smtp_use_ssl: bool
+    email_code_ttl_seconds: int
+    email_code_resend_seconds: int
+    email_code_max_attempts: int
+    brute_force_max_failures: int
+    brute_force_window_seconds: int
+    brute_force_lock_seconds: int
+
+
+class WebAppSettings(BaseModel):
+    title: str
+    primary_color: str
+    logo_url: Optional[str]
+    logo_emoji: str
+    session_ttl_seconds: int
+    session_secret: str
+    webhook_secret_token: str
+    auth_max_age_seconds: int
+    login_token_ttl_seconds: int
+    server_host: str
+    server_port: int
+    enabled: bool
+    trusted_proxies: List[str]
+
 
 class Settings(BaseSettings):
     BOT_TOKEN: str
@@ -11,8 +105,8 @@ class Settings(BaseSettings):
         alias="ADMIN_IDS",
         description="Comma-separated list of admin Telegram User IDs")
 
-    POSTGRES_USER: str = Field(default="user")
-    POSTGRES_PASSWORD: str = Field(default="password")
+    POSTGRES_USER: str = Field(...)
+    POSTGRES_PASSWORD: str = Field(...)
     POSTGRES_HOST: str = Field(default="localhost")
     POSTGRES_PORT: int = Field(default=5432)
     POSTGRES_DB: str = Field(default="vpn_shop_db")
@@ -23,6 +117,8 @@ class Settings(BaseSettings):
     SUPPORT_LINK: Optional[str] = Field(default=None)
     SERVER_STATUS_URL: Optional[str] = Field(default=None)
     TERMS_OF_SERVICE_URL: Optional[str] = Field(default=None)
+    PRIVACY_POLICY_URL: Optional[str] = Field(default=None)
+    USER_AGREEMENT_URL: Optional[str] = Field(default=None)
     REQUIRED_CHANNEL_ID: Optional[int] = Field(
         default=None,
         description="Telegram channel ID the user must join to access the bot")
@@ -46,16 +142,37 @@ class Settings(BaseSettings):
         description="When true, new YooKassa payments in autopay mode force card binding without a user checkbox."
     )
 
-    NALOGO_INN: Optional[str] = Field(
+    LKNPD_INN: Optional[str] = Field(
         default=None,
-        description="INN for nalog.ru (self-employed) authentication"
+        alias="NALOGO_INN",
+        description="INN for lknpd.nalog.ru (self-employed) authentication"
     )
-    NALOGO_PASSWORD: Optional[str] = Field(
+    LKNPD_PASSWORD: Optional[str] = Field(
         default=None,
-        description="Password for nalog.ru (self-employed) authentication"
+        alias="NALOGO_PASSWORD",
+        description="Password for lknpd.nalog.ru (self-employed) authentication"
+    )
+    LKNPD_API_URL: str = Field(
+        default="https://lknpd.nalog.ru/api",
+        alias="NALOGO_API_URL",
+        description="Base URL for LKNPD API (can be overridden for proxies)"
+    )
+    LKNPD_RECEIPT_NAME_SUBSCRIPTION: str = Field(
+        default="subscription {months} months",
+        alias="NALOGO_RECEIPT_NAME_SUBSCRIPTION",
+        description="Receipt item name for time-based subscriptions. Use {months} placeholder for duration."
+    )
+    LKNPD_RECEIPT_NAME_TRAFFIC: str = Field(
+        default="traffic package {gb} GB",
+        alias="NALOGO_RECEIPT_NAME_TRAFFIC",
+        description="Receipt item name for traffic packages. Use {gb} placeholder for traffic amount."
     )
 
     WEBHOOK_BASE_URL: Optional[str] = None
+    TRUSTED_PROXIES: Optional[str] = Field(
+        default="127.0.0.1,::1",
+        description="Comma-separated list of reverse proxy IPs or CIDRs trusted to forward X-Forwarded-For.",
+    )
 
     CRYPTOPAY_TOKEN: Optional[str] = None
     CRYPTOPAY_NETWORK: str = Field(default="mainnet")
@@ -67,7 +184,24 @@ class Settings(BaseSettings):
     PLATEGA_MERCHANT_ID: Optional[str] = None
     PLATEGA_SECRET: Optional[str] = None
     PLATEGA_PAYMENT_METHOD: int = Field(
-        default=2, description="Platega payment method ID (e.g., 2 for SBP QR)"
+        default=2,
+        description="Legacy Platega payment method ID. Used as fallback for PLATEGA_SBP_METHOD when the new field is unset.",
+    )
+    PLATEGA_SBP_ENABLED: bool = Field(
+        default=False,
+        description="Show a separate Platega SBP payment button.",
+    )
+    PLATEGA_CRYPTO_ENABLED: bool = Field(
+        default=False,
+        description="Show a separate Platega crypto payment button.",
+    )
+    PLATEGA_SBP_METHOD: int = Field(
+        default=2,
+        description="Platega method ID for SBP QR (default 2).",
+    )
+    PLATEGA_CRYPTO_METHOD: int = Field(
+        default=13,
+        description="Platega method ID for crypto (default 13).",
     )
     PLATEGA_RETURN_URL: Optional[str] = Field(default=None)
     PLATEGA_FAILED_URL: Optional[str] = Field(default=None)
@@ -80,6 +214,10 @@ class Settings(BaseSettings):
     FREEKASSA_API_KEY: Optional[str] = None
     FREEKASSA_PAYMENT_IP: Optional[str] = None
     FREEKASSA_PAYMENT_METHOD_ID: Optional[int] = None
+    FREEKASSA_TRUSTED_IPS: str = Field(
+        default="168.119.157.136,168.119.60.227,178.154.197.79,51.250.54.238",
+        description="Comma-separated FreeKassa webhook IP allowlist.",
+    )
 
     SEVERPAY_ENABLED: bool = Field(default=False)
     SEVERPAY_MID: Optional[int] = None
@@ -151,6 +289,10 @@ class Settings(BaseSettings):
         default=True,
         description="When true, referral bonuses (for inviter and referee) are applied only once per invited user - on their first successful payment."
     )
+    REFERRAL_WELCOME_BONUS_DAYS: int = Field(
+        default=3,
+        description="Welcome bonus days granted to a newly registered user who joined via referral link.",
+    )
     LEGACY_REFS: bool = Field(
         default=True,
         description="Allow legacy referral links like ref_<telegram_id> to continue working. Defaults to True when unset."
@@ -172,12 +314,68 @@ class Settings(BaseSettings):
     TRIAL_ENABLED: bool = Field(default=True)
     TRIAL_DURATION_DAYS: int = Field(default=3)
     TRIAL_TRAFFIC_LIMIT_GB: Optional[float] = Field(default=5.0)
+    TRIAL_TRAFFIC_STRATEGY: str = Field(default="NO_RESET")
 
     CRYPT4_ENABLED: bool = Field(default=False, description="Enable happ crypt4 encryption for subscription URLs")
     CRYPT4_REDIRECT_URL: Optional[str] = Field(default=None, description="Base redirect URL used for the connect button when crypt4 is enabled")
 
     WEB_SERVER_HOST: str = Field(default="0.0.0.0")
     WEB_SERVER_PORT: int = Field(default=8080)
+
+    WEBAPP_ENABLED: bool = Field(
+        default=True,
+        description="Run the subscription Mini App in the same container on a separate port.",
+    )
+    WEBAPP_SERVER_HOST: str = Field(default="0.0.0.0")
+    WEBAPP_SERVER_PORT: int = Field(default=8081)
+    WEBAPP_TITLE: str = Field(default="Моя подписка")
+    WEBAPP_PRIMARY_COLOR: str = Field(default="#00fe7a")
+    WEBAPP_LOGO_URL: Optional[str] = Field(default=None)
+    WEBAPP_LOGO_EMOJI: str = Field(default="🫥")
+    WEBAPP_SESSION_SECRET: str = Field(default_factory=lambda: secrets.token_urlsafe(32))
+    WEBHOOK_SECRET_TOKEN: str = Field(default_factory=lambda: secrets.token_urlsafe(32))
+    WEBAPP_SESSION_TTL_SECONDS: int = Field(default=24 * 60 * 60)
+    WEBAPP_AUTH_MAX_AGE_SECONDS: int = Field(default=24 * 60 * 60)
+    WEBAPP_LOGIN_TOKEN_TTL_SECONDS: int = Field(default=10 * 60)
+    TELEGRAM_OAUTH_CLIENT_ID: Optional[int] = Field(
+        default=None,
+        description="Telegram Web Login Client ID from BotFather. Defaults to the numeric bot ID from BOT_TOKEN.",
+    )
+    TELEGRAM_OAUTH_CLIENT_SECRET: Optional[str] = Field(
+        default=None,
+        description="Telegram Web Login Client Secret from BotFather. Reserved for full OIDC authorization code integrations.",
+    )
+    TELEGRAM_OAUTH_REQUEST_ACCESS: Optional[str] = Field(
+        default="write",
+        description="Comma-separated Telegram Login permissions to request: write,phone. Leave empty to request only OpenID profile.",
+    )
+
+    SMTP_HOST: str = Field(default="smtp-relay.brevo.com")
+    SMTP_PORT: int = Field(default=587)
+    SMTP_FALLBACK_PORTS: Optional[str] = Field(default="2525,465")
+    SMTP_TIMEOUT_SECONDS: int = Field(default=30)
+    SMTP_USERNAME: Optional[str] = Field(default=None)
+    SMTP_PASSWORD: Optional[str] = Field(default=None)
+    SMTP_FROM_EMAIL: Optional[str] = Field(default=None)
+    SMTP_FROM_NAME: Optional[str] = Field(default=None)
+    SMTP_STARTTLS: bool = Field(default=True)
+    SMTP_USE_SSL: bool = Field(default=False)
+    EMAIL_CODE_TTL_SECONDS: int = Field(default=10 * 60)
+    EMAIL_CODE_RESEND_SECONDS: int = Field(default=60)
+    EMAIL_CODE_MAX_ATTEMPTS: int = Field(default=5)
+    BRUTE_FORCE_MAX_FAILURES: int = Field(
+        default=5,
+        description="Maximum failed code attempts allowed within the throttle window before a temporary lockout is applied.",
+    )
+    BRUTE_FORCE_WINDOW_SECONDS: int = Field(
+        default=15 * 60,
+        description="Rolling window used to count failed email and promo code attempts.",
+    )
+    BRUTE_FORCE_LOCK_SECONDS: int = Field(
+        default=30 * 60,
+        description="Temporary lockout duration applied after too many failed code attempts.",
+    )
+
     LOGS_PAGE_SIZE: int = Field(default=10)
 
     SUBSCRIPTION_MINI_APP_URL: Optional[str] = Field(default=None)
@@ -205,6 +403,103 @@ class Settings(BaseSettings):
     def DATABASE_URL(self) -> str:
         return f"postgresql+asyncpg://{self.POSTGRES_USER}:{self.POSTGRES_PASSWORD}@{self.POSTGRES_HOST}:{self.POSTGRES_PORT}/{self.POSTGRES_DB}"
 
+    @computed_field
+    @property
+    def db_settings(self) -> DBSettings:
+        return DBSettings(
+            user=self.POSTGRES_USER,
+            password=self.POSTGRES_PASSWORD,
+            host=self.POSTGRES_HOST,
+            port=self.POSTGRES_PORT,
+            database=self.POSTGRES_DB,
+        )
+
+    @computed_field
+    @property
+    def payment_settings(self) -> PaymentSettings:
+        return PaymentSettings(
+            yookassa_enabled=self.YOOKASSA_ENABLED,
+            yookassa_shop_id=self.YOOKASSA_SHOP_ID,
+            yookassa_secret_key=self.YOOKASSA_SECRET_KEY,
+            yookassa_return_url=self.YOOKASSA_RETURN_URL,
+            yookassa_default_receipt_email=self.YOOKASSA_DEFAULT_RECEIPT_EMAIL,
+            yookassa_vat_code=self.YOOKASSA_VAT_CODE,
+            yookassa_payment_mode=self.YOOKASSA_PAYMENT_MODE,
+            yookassa_payment_subject=self.YOOKASSA_PAYMENT_SUBJECT,
+            yookassa_autopayments_enabled=self.YOOKASSA_AUTOPAYMENTS_ENABLED,
+            yookassa_autopayments_require_card_binding=self.YOOKASSA_AUTOPAYMENTS_REQUIRE_CARD_BINDING,
+            freekassa_enabled=self.FREEKASSA_ENABLED,
+            freekassa_merchant_id=self.FREEKASSA_MERCHANT_ID,
+            freekassa_second_secret=self.FREEKASSA_SECOND_SECRET,
+            freekassa_api_key=self.FREEKASSA_API_KEY,
+            freekassa_payment_ip=self.FREEKASSA_PAYMENT_IP,
+            freekassa_payment_method_id=self.FREEKASSA_PAYMENT_METHOD_ID,
+            freekassa_trusted_ips=self.freekassa_trusted_ips,
+            platega_enabled=self.PLATEGA_ENABLED,
+            platega_base_url=self.PLATEGA_BASE_URL,
+            platega_merchant_id=self.PLATEGA_MERCHANT_ID,
+            platega_secret=self.PLATEGA_SECRET,
+            platega_payment_method=self.PLATEGA_PAYMENT_METHOD,
+            platega_sbp_enabled=self.PLATEGA_SBP_ENABLED,
+            platega_crypto_enabled=self.PLATEGA_CRYPTO_ENABLED,
+            platega_sbp_method=self.platega_sbp_method_resolved,
+            platega_crypto_method=self.PLATEGA_CRYPTO_METHOD,
+            platega_return_url=self.PLATEGA_RETURN_URL,
+            platega_failed_url=self.PLATEGA_FAILED_URL,
+            severpay_enabled=self.SEVERPAY_ENABLED,
+            severpay_mid=self.SEVERPAY_MID,
+            severpay_token=self.SEVERPAY_TOKEN,
+            severpay_return_url=self.SEVERPAY_RETURN_URL,
+            severpay_base_url=self.SEVERPAY_BASE_URL,
+            severpay_lifetime_minutes=self.SEVERPAY_LIFETIME_MINUTES,
+            cryptopay_enabled=self.CRYPTOPAY_ENABLED,
+            cryptopay_token=self.CRYPTOPAY_TOKEN,
+            cryptopay_network=self.CRYPTOPAY_NETWORK,
+            cryptopay_currency_type=self.CRYPTOPAY_CURRENCY_TYPE,
+            cryptopay_asset=self.CRYPTOPAY_ASSET,
+        )
+
+    @computed_field
+    @property
+    def email_settings(self) -> EmailSettings:
+        return EmailSettings(
+            smtp_host=self.SMTP_HOST,
+            smtp_port=self.SMTP_PORT,
+            smtp_fallback_ports=self.SMTP_FALLBACK_PORTS,
+            smtp_timeout_seconds=self.SMTP_TIMEOUT_SECONDS,
+            smtp_username=self.SMTP_USERNAME,
+            smtp_password=self.SMTP_PASSWORD,
+            smtp_from_email=self.SMTP_FROM_EMAIL,
+            smtp_from_name=self.SMTP_FROM_NAME,
+            smtp_starttls=self.SMTP_STARTTLS,
+            smtp_use_ssl=self.SMTP_USE_SSL,
+            email_code_ttl_seconds=self.EMAIL_CODE_TTL_SECONDS,
+            email_code_resend_seconds=self.EMAIL_CODE_RESEND_SECONDS,
+            email_code_max_attempts=self.EMAIL_CODE_MAX_ATTEMPTS,
+            brute_force_max_failures=self.BRUTE_FORCE_MAX_FAILURES,
+            brute_force_window_seconds=self.BRUTE_FORCE_WINDOW_SECONDS,
+            brute_force_lock_seconds=self.BRUTE_FORCE_LOCK_SECONDS,
+        )
+
+    @computed_field
+    @property
+    def webapp_settings(self) -> WebAppSettings:
+        return WebAppSettings(
+            title=self.WEBAPP_TITLE,
+            primary_color=self.WEBAPP_PRIMARY_COLOR,
+            logo_url=self.WEBAPP_LOGO_URL,
+            logo_emoji=self.WEBAPP_LOGO_EMOJI,
+            session_ttl_seconds=self.WEBAPP_SESSION_TTL_SECONDS,
+            session_secret=self.WEBAPP_SESSION_SECRET,
+            webhook_secret_token=self.WEBHOOK_SECRET_TOKEN,
+            auth_max_age_seconds=self.WEBAPP_AUTH_MAX_AGE_SECONDS,
+            login_token_ttl_seconds=self.WEBAPP_LOGIN_TOKEN_TTL_SECONDS,
+            server_host=self.WEBAPP_SERVER_HOST,
+            server_port=self.WEBAPP_SERVER_PORT,
+            enabled=self.WEBAPP_ENABLED,
+            trusted_proxies=self.trusted_proxies,
+        )
+
     @computed_field
     @property
     def ADMIN_IDS(self) -> List[int]:
@@ -262,6 +557,21 @@ class Settings(BaseSettings):
                 return cleaned
         return None
 
+    @computed_field
+    @property
+    def trusted_proxies(self) -> List[str]:
+        return _split_csv(self.TRUSTED_PROXIES)
+
+    @computed_field
+    @property
+    def freekassa_trusted_ips(self) -> List[str]:
+        return _split_csv(self.FREEKASSA_TRUSTED_IPS)
+
+    @computed_field
+    @property
+    def telegram_webhook_path(self) -> str:
+        return "/tg/webhook"
+
     @computed_field
     @property
     def yookassa_webhook_path(self) -> str:
@@ -481,7 +791,8 @@ class Settings(BaseSettings):
         """
         default_order = [
             "freekassa",
-            "platega",
+            "platega_sbp",
+            "platega_crypto",
             "severpay",
             "yookassa",
             "stars",
@@ -489,12 +800,57 @@ class Settings(BaseSettings):
         ]
         if not self.PAYMENT_METHODS_ORDER:
             return default_order
-        methods = []
+        methods: List[str] = []
         for item in self.PAYMENT_METHODS_ORDER.split(","):
             slug = item.strip().lower()
-            if slug:
-                methods.append(slug)
+            if not slug:
+                continue
+            if slug == "platega":
+                # Legacy slug — expand to the new sub-methods preserving order
+                if "platega_sbp" not in methods:
+                    methods.append("platega_sbp")
+                if "platega_crypto" not in methods:
+                    methods.append("platega_crypto")
+                continue
+            methods.append(slug)
         return methods or default_order
+
+    @computed_field
+    @property
+    def platega_sbp_method_resolved(self) -> int:
+        """SBP method ID, falling back to legacy PLATEGA_PAYMENT_METHOD when SBP-specific value is the default."""
+        if self.PLATEGA_SBP_METHOD != 2:
+            return self.PLATEGA_SBP_METHOD
+        return self.PLATEGA_PAYMENT_METHOD or 2
+
+    @computed_field
+    @property
+    def email_auth_configured(self) -> bool:
+        return bool(
+            self.SMTP_HOST
+            and self.SMTP_PORT
+            and self.SMTP_USERNAME
+            and self.SMTP_PASSWORD
+            and self.SMTP_FROM_EMAIL
+        )
+
+    @computed_field
+    @property
+    def smtp_ports_to_try(self) -> List[int]:
+        ports: List[int] = []
+
+        def add_port(value: Any) -> None:
+            try:
+                port = int(str(value).strip())
+            except (TypeError, ValueError):
+                return
+            if 0 < port <= 65535 and port not in ports:
+                ports.append(port)
+
+        add_port(self.SMTP_PORT)
+        for item in (self.SMTP_FALLBACK_PORTS or "").split(","):
+            add_port(item)
+        return ports
     
     # Logging Configuration
     LOG_LEVEL: str = Field(
@@ -513,6 +869,26 @@ class Settings(BaseSettings):
             return "INFO"
         return v
 
+    @field_validator('POSTGRES_USER', 'POSTGRES_PASSWORD', mode='before')
+    @classmethod
+    def validate_required_db_credentials(cls, v):
+        if isinstance(v, str):
+            v = v.strip()
+        if not v:
+            raise ValueError("must not be empty")
+        return v
+
+    @field_validator('WEBAPP_SESSION_SECRET', 'WEBHOOK_SECRET_TOKEN', mode='before')
+    @classmethod
+    def normalize_webapp_secrets(cls, v):
+        if isinstance(v, str):
+            v = v.strip()
+            if v:
+                return v
+        if v:
+            return v
+        return secrets.token_urlsafe(32)
+
     @field_validator('LOG_CHAT_ID', 'LOG_THREAD_ID', mode='before')
     @classmethod
     def validate_optional_int_fields(cls, v):
@@ -527,6 +903,17 @@ class Settings(BaseSettings):
         'PLATEGA_FAILED_URL',
         'SEVERPAY_RETURN_URL',
         'CRYPT4_REDIRECT_URL',
+        'PRIVACY_POLICY_URL',
+        'USER_AGREEMENT_URL',
+        'SUBSCRIPTION_MINI_APP_URL',
+        'WEBAPP_LOGO_URL',
+        'TELEGRAM_OAUTH_CLIENT_SECRET',
+        'TELEGRAM_OAUTH_REQUEST_ACCESS',
+        'SMTP_USERNAME',
+        'SMTP_PASSWORD',
+        'SMTP_FROM_EMAIL',
+        'SMTP_FROM_NAME',
+        'SMTP_FALLBACK_PORTS',
         mode='before',
     )
     @classmethod
@@ -574,19 +961,27 @@ def get_settings() -> Settings:
                 logging.warning(
                     "CRITICAL: PANEL_API_URL is not set. Panel integration will not work."
                 )
+            if not os.getenv("WEBAPP_SESSION_SECRET"):
+                logging.warning(
+                    "WEBAPP_SESSION_SECRET is not set. A generated secret will be used for this process only."
+                )
+            if not os.getenv("WEBHOOK_SECRET_TOKEN"):
+                logging.warning(
+                    "WEBHOOK_SECRET_TOKEN is not set. A generated secret will be used for this process only."
+                )
             if not _settings_instance.YOOKASSA_SHOP_ID or not _settings_instance.YOOKASSA_SECRET_KEY:
                 logging.warning(
                     "CRITICAL: YooKassa credentials (SHOP_ID or SECRET_KEY) are not set. Payments will not work."
                 )
             if (
-                _settings_instance.NALOGO_INN
-                or _settings_instance.NALOGO_PASSWORD
+                _settings_instance.LKNPD_INN
+                or _settings_instance.LKNPD_PASSWORD
             ) and not (
-                _settings_instance.NALOGO_INN
-                and _settings_instance.NALOGO_PASSWORD
+                _settings_instance.LKNPD_INN
+                and _settings_instance.LKNPD_PASSWORD
             ):
                 logging.warning(
-                    "WARNING: Nalogo credentials are incomplete. Receipt sending will be disabled."
+                    "WARNING: LKNPD credentials are incomplete. Receipt sending will be disabled."
                 )
             if _settings_instance.FREEKASSA_ENABLED:
                 if (

db/dal/__init__.py

@@ -6,6 +6,7 @@ from . import panel_sync_dal
 from . import message_log_dal
 from . import user_billing_dal
 from . import ad_dal
+from . import security_dal
 
 __all__ = (
     "user_dal",
@@ -16,6 +17,7 @@ __all__ = (
     "message_log_dal",
     "user_billing_dal",
     "ad_dal",
+    "security_dal",
 )
 
 

db/dal/security_dal.py

@@ -0,0 +1,160 @@
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+
+from sqlalchemy import case, delete, or_, select
+from sqlalchemy.dialects.postgresql import insert as pg_insert
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from ..models import SecurityThrottle
+
+EMAIL_CODE_VERIFY_SCOPE = "email_code_verify"
+PROMO_CODE_APPLY_SCOPE = "promo_code_apply"
+
+
+@dataclass(frozen=True)
+class ThrottleDecision:
+    locked: bool
+    retry_after: Optional[int] = None
+
+
+def _utc_now(value: Optional[datetime] = None) -> datetime:
+    if value is None:
+        value = datetime.now(timezone.utc)
+    if value.tzinfo is None:
+        return value.replace(tzinfo=timezone.utc)
+    return value.astimezone(timezone.utc)
+
+
+def _retry_after_seconds(locked_until: Optional[datetime], now: datetime) -> Optional[int]:
+    if not locked_until:
+        return None
+    locked_until = _utc_now(locked_until)
+    remaining = int((locked_until - now).total_seconds())
+    return max(1, remaining) if remaining > 0 else None
+
+
+async def get_throttle_state(
+    session: AsyncSession,
+    *,
+    scope: str,
+    identifier: str,
+) -> Optional[SecurityThrottle]:
+    stmt = (
+        select(SecurityThrottle)
+        .where(
+            SecurityThrottle.scope == scope,
+            SecurityThrottle.identifier == identifier,
+        )
+        .limit(1)
+    )
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
+async def check_throttle(
+    session: AsyncSession,
+    *,
+    scope: str,
+    identifier: str,
+    now: Optional[datetime] = None,
+) -> ThrottleDecision:
+    now = _utc_now(now)
+    row = await get_throttle_state(session, scope=scope, identifier=identifier)
+    if not row or not row.locked_until:
+        return ThrottleDecision(locked=False)
+
+    locked_until = _utc_now(row.locked_until)
+    if locked_until <= now:
+        return ThrottleDecision(locked=False)
+
+    return ThrottleDecision(
+        locked=True,
+        retry_after=_retry_after_seconds(locked_until, now),
+    )
+
+
+async def record_throttle_failure(
+    session: AsyncSession,
+    *,
+    scope: str,
+    identifier: str,
+    max_failures: int,
+    window_seconds: int,
+    lock_seconds: int,
+    now: Optional[datetime] = None,
+) -> ThrottleDecision:
+    now = _utc_now(now)
+    max_failures = max(1, int(max_failures))
+    window_seconds = max(1, int(window_seconds))
+    lock_seconds = max(1, int(lock_seconds))
+    window_cutoff = now - timedelta(seconds=window_seconds)
+    lock_until = now + timedelta(seconds=lock_seconds)
+
+    failure_count_expr = case(
+        (
+            or_(
+                SecurityThrottle.window_started_at.is_(None),
+                SecurityThrottle.window_started_at <= window_cutoff,
+            ),
+            1,
+        ),
+        else_=SecurityThrottle.failures + 1,
+    )
+
+    stmt = (
+        pg_insert(SecurityThrottle)
+        .values(
+            scope=scope,
+            identifier=identifier,
+            failures=1,
+            window_started_at=now,
+            last_attempt_at=now,
+            locked_until=lock_until if max_failures <= 1 else None,
+        )
+        .on_conflict_do_update(
+            index_elements=[SecurityThrottle.scope, SecurityThrottle.identifier],
+            set_={
+                "failures": failure_count_expr,
+                "window_started_at": case(
+                    (
+                        or_(
+                            SecurityThrottle.window_started_at.is_(None),
+                            SecurityThrottle.window_started_at <= window_cutoff,
+                        ),
+                        now,
+                    ),
+                    else_=SecurityThrottle.window_started_at,
+                ),
+                "last_attempt_at": now,
+                "locked_until": case(
+                    (failure_count_expr >= max_failures, lock_until),
+                    else_=None,
+                ),
+            },
+        )
+        .returning(SecurityThrottle.locked_until)
+    )
+
+    result = await session.execute(stmt)
+    locked_until = result.scalar_one_or_none()
+    locked_until = _utc_now(locked_until) if locked_until else None
+    if locked_until and locked_until > now:
+        return ThrottleDecision(
+            locked=True,
+            retry_after=_retry_after_seconds(locked_until, now),
+        )
+    return ThrottleDecision(locked=False)
+
+
+async def clear_throttle_state(
+    session: AsyncSession,
+    *,
+    scope: str,
+    identifier: str,
+) -> None:
+    stmt = delete(SecurityThrottle).where(
+        SecurityThrottle.scope == scope,
+        SecurityThrottle.identifier == identifier,
+    )
+    await session.execute(stmt)

db/dal/subscription_dal.py

@@ -130,7 +130,7 @@ async def upsert_subscription(session: AsyncSession,
 
 async def deactivate_other_active_subscriptions(
         session: AsyncSession, panel_user_uuid: str,
-        current_panel_subscription_uuid: Optional[str]):
+        current_panel_subscription_uuid: Optional[str]) -> None:
     stmt = (update(Subscription).where(
         Subscription.panel_user_uuid == panel_user_uuid,
         Subscription.is_active == True,

db/dal/user_dal.py

@@ -5,8 +5,9 @@ from typing import Optional, List, Dict, Any, Tuple
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.future import select
 from sqlalchemy.orm import selectinload
-from sqlalchemy import update, delete, func, and_, or_
-from datetime import datetime, timezone
+from sqlalchemy import update, delete, func, and_, or_, desc
+from sqlalchemy.orm import aliased
+from datetime import datetime, timezone, timedelta
 from sqlalchemy.dialects.postgresql import insert as pg_insert
 
 from ..models import (
@@ -23,6 +24,11 @@ from ..models import (
 REFERRAL_CODE_ALPHABET = string.ascii_uppercase + string.digits
 REFERRAL_CODE_LENGTH = 9
 MAX_REFERRAL_CODE_ATTEMPTS = 25
+MAX_EMAIL_USER_ID_ATTEMPTS = 25
+
+
+class UserMergeConflictError(ValueError):
+    pass
 
 
 def _generate_referral_code_candidate() -> str:
@@ -49,6 +55,14 @@ async def generate_unique_referral_code(session: AsyncSession) -> str:
     raise RuntimeError("Failed to generate a unique referral code after several attempts.")
 
 
+async def generate_unique_email_user_id(session: AsyncSession) -> int:
+    for _ in range(MAX_EMAIL_USER_ID_ATTEMPTS):
+        candidate = -(secrets.randbelow(9_000_000_000_000_000) + 1)
+        if not await get_user_by_id(session, candidate):
+            return candidate
+    raise RuntimeError("Failed to generate a unique email user id after several attempts.")
+
+
 async def ensure_referral_code(session: AsyncSession, user: User) -> str:
     """
     Ensure the provided user has a referral code, generating and persisting it if missing.
@@ -81,6 +95,23 @@ async def get_user_by_username(session: AsyncSession, username: str) -> Optional
     return result.scalar_one_or_none()
 
 
+async def get_user_by_email(session: AsyncSession, email: str) -> Optional[User]:
+    clean_email = (email or "").strip().lower()
+    if not clean_email:
+        return None
+    stmt = select(User).where(func.lower(User.email) == clean_email)
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
+async def get_user_by_telegram_id(
+    session: AsyncSession, telegram_id: int
+) -> Optional[User]:
+    stmt = select(User).where(User.telegram_id == telegram_id)
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
 async def get_user_by_panel_uuid(
     session: AsyncSession, panel_uuid: str
 ) -> Optional[User]:
@@ -134,6 +165,304 @@ async def create_user(session: AsyncSession, user_data: Dict[str, Any]) -> Tuple
     return user, created
 
 
+async def create_email_user(
+    session: AsyncSession,
+    *,
+    email: str,
+    language_code: str,
+    email_verified_at: Optional[datetime] = None,
+    referred_by_id: Optional[int] = None,
+) -> Tuple[User, bool]:
+    normalized_email = (email or "").strip().lower()
+    user_id = await generate_unique_email_user_id(session)
+    return await create_user(
+        session,
+        {
+            "user_id": user_id,
+            "email": normalized_email,
+            "email_verified_at": email_verified_at or datetime.now(timezone.utc),
+            "language_code": language_code,
+            "referred_by_id": referred_by_id,
+            "registration_date": datetime.now(timezone.utc),
+        },
+    )
+
+
+async def _has_active_panel_subscription(
+    session: AsyncSession, user_id: int, panel_user_uuid: str
+) -> bool:
+    stmt = (
+        select(Subscription.subscription_id)
+        .where(
+            Subscription.user_id == user_id,
+            Subscription.panel_user_uuid == panel_user_uuid,
+            Subscription.is_active == True,
+            Subscription.end_date > datetime.now(timezone.utc),
+        )
+        .limit(1)
+    )
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none() is not None
+
+
+async def _get_latest_subscription_for_user(
+    session: AsyncSession,
+    user_id: int,
+    panel_user_uuid: Optional[str] = None,
+    *,
+    active_only: bool = False,
+) -> Optional[Subscription]:
+    stmt = select(Subscription).where(Subscription.user_id == user_id)
+    if panel_user_uuid is not None:
+        stmt = stmt.where(Subscription.panel_user_uuid == panel_user_uuid)
+    if active_only:
+        stmt = stmt.where(
+            Subscription.is_active == True,
+            Subscription.end_date > datetime.now(timezone.utc),
+        )
+    stmt = stmt.order_by(Subscription.end_date.desc(), Subscription.subscription_id.desc()).limit(1)
+    result = await session.execute(stmt)
+    return result.scalar_one_or_none()
+
+
+async def _get_active_subscription_for_user(
+    session: AsyncSession,
+    user_id: int,
+    panel_user_uuid: Optional[str] = None,
+) -> Optional[Subscription]:
+    return await _get_latest_subscription_for_user(
+        session,
+        user_id,
+        panel_user_uuid,
+        active_only=True,
+    )
+
+
+async def merge_users(
+    session: AsyncSession,
+    *,
+    source_user_id: int,
+    target_user_id: int,
+) -> User:
+    """Merge source user data into target user and remove the source row."""
+
+    if source_user_id == target_user_id:
+        target = await get_user_by_id(session, target_user_id)
+        if not target:
+            raise ValueError("Target user not found.")
+        return target
+
+    source = await get_user_by_id(session, source_user_id)
+    target = await get_user_by_id(session, target_user_id)
+    if not source or not target:
+        raise ValueError("Both source and target users are required for merge.")
+
+    if source.email and target.email and source.email != target.email:
+        raise UserMergeConflictError("Both accounts already have different emails.")
+    if (
+        source.telegram_id
+        and target.telegram_id
+        and int(source.telegram_id) != int(target.telegram_id)
+    ):
+        raise UserMergeConflictError("Both accounts already have different Telegram IDs.")
+
+    source_panel_uuid = source.panel_user_uuid
+    target_panel_uuid = target.panel_user_uuid
+    panel_uuid_to_keep = target_panel_uuid or source_panel_uuid
+
+    now = datetime.now(timezone.utc)
+    source_active_sub = await _get_active_subscription_for_user(
+        session, source_user_id, source_panel_uuid
+    )
+    target_active_sub = await _get_active_subscription_for_user(
+        session, target_user_id, target_panel_uuid
+    )
+    target_anchor_sub = target_active_sub
+    if not target_anchor_sub and target_panel_uuid:
+        target_anchor_sub = await _get_latest_subscription_for_user(
+            session, target_user_id, target_panel_uuid
+        )
+    if not target_anchor_sub and not target_panel_uuid:
+        target_anchor_sub = await _get_latest_subscription_for_user(session, target_user_id)
+
+    if (
+        source_active_sub
+        and target_anchor_sub
+        and source_panel_uuid
+        and target_panel_uuid
+        and source_panel_uuid != target_panel_uuid
+    ):
+        source_end = source_active_sub.end_date
+        if source_end.tzinfo is None:
+            source_end = source_end.replace(tzinfo=timezone.utc)
+
+        target_end = target_anchor_sub.end_date
+        if target_end.tzinfo is None:
+            target_end = target_end.replace(tzinfo=timezone.utc)
+
+        source_remaining = max(timedelta(0), source_end - now)
+        if source_remaining > timedelta(0):
+            base_end = target_end if target_end > now else now
+            target_anchor_sub.end_date = base_end + source_remaining
+            target_anchor_sub.last_notification_sent = None
+            target_anchor_sub.is_active = True
+            target_anchor_sub.status_from_panel = "ACTIVE_EXTENDED_BY_MERGE"
+
+        source_active_sub.is_active = False
+        source_active_sub.skip_notifications = True
+        source_active_sub.last_notification_sent = None
+        source_active_sub.status_from_panel = "MERGED_INTO_ACCOUNT"
+    elif (
+        source_active_sub
+        and target_panel_uuid
+        and source_panel_uuid
+        and source_panel_uuid != target_panel_uuid
+        and not target_anchor_sub
+    ):
+        source_active_sub.panel_user_uuid = target_panel_uuid
+        source_active_sub.last_notification_sent = None
+        source_active_sub.status_from_panel = "ACTIVE_EXTENDED_BY_MERGE"
+
+    email_to_move = source.email if source.email and not target.email else None
+    email_verified_at_to_move = (
+        source.email_verified_at
+        if source.email and (not target.email_verified_at or email_to_move)
+        else None
+    )
+    telegram_id_to_move = (
+        source.telegram_id if source.telegram_id and not target.telegram_id else None
+    )
+    referral_code_to_move = (
+        source.referral_code if source.referral_code and not target.referral_code else None
+    )
+
+    if email_to_move:
+        source.email = None
+    if telegram_id_to_move:
+        source.telegram_id = None
+    if referral_code_to_move:
+        source.referral_code = None
+    if email_to_move or source_panel_uuid or telegram_id_to_move or referral_code_to_move:
+        await session.flush()
+
+    if email_to_move:
+        target.email = email_to_move
+    if email_verified_at_to_move and not target.email_verified_at:
+        target.email_verified_at = email_verified_at_to_move
+    if telegram_id_to_move:
+        target.telegram_id = telegram_id_to_move
+    if panel_uuid_to_keep and not target.panel_user_uuid:
+        target.panel_user_uuid = panel_uuid_to_keep
+    if referral_code_to_move:
+        target.referral_code = referral_code_to_move
+
+    for attr in ("username", "first_name", "last_name", "language_code", "telegram_photo_url"):
+        if not getattr(target, attr) and getattr(source, attr):
+            setattr(target, attr, getattr(source, attr))
+    if not target.channel_subscription_verified and source.channel_subscription_verified is not None:
+        target.channel_subscription_verified = source.channel_subscription_verified
+    if not target.channel_subscription_checked_at and source.channel_subscription_checked_at:
+        target.channel_subscription_checked_at = source.channel_subscription_checked_at
+    if not target.channel_subscription_verified_for and source.channel_subscription_verified_for:
+        target.channel_subscription_verified_for = source.channel_subscription_verified_for
+    if source.lifetime_used_traffic_bytes is not None:
+        target.lifetime_used_traffic_bytes = (
+            (target.lifetime_used_traffic_bytes or 0) + source.lifetime_used_traffic_bytes
+        )
+    if not target.referred_by_id and source.referred_by_id != target_user_id:
+        target.referred_by_id = source.referred_by_id
+    if target.referred_by_id == source_user_id:
+        target.referred_by_id = source.referred_by_id
+        if target.referred_by_id == target_user_id:
+            target.referred_by_id = None
+
+    target_method_ids = select(UserPaymentMethod.provider_payment_method_id).where(
+        UserPaymentMethod.user_id == target_user_id
+    )
+    await session.execute(
+        delete(UserPaymentMethod).where(
+            UserPaymentMethod.user_id == source_user_id,
+            UserPaymentMethod.provider_payment_method_id.in_(target_method_ids),
+        )
+    )
+
+    target_promo_ids = select(PromoCodeActivation.promo_code_id).where(
+        PromoCodeActivation.user_id == target_user_id
+    )
+    await session.execute(
+        delete(PromoCodeActivation).where(
+            PromoCodeActivation.user_id == source_user_id,
+            PromoCodeActivation.promo_code_id.in_(target_promo_ids),
+        )
+    )
+
+    target_has_billing = (
+        await session.execute(
+            select(UserBilling.user_id).where(UserBilling.user_id == target_user_id)
+        )
+    ).scalar_one_or_none()
+    if target_has_billing:
+        await session.execute(delete(UserBilling).where(UserBilling.user_id == source_user_id))
+    else:
+        await session.execute(
+            update(UserBilling)
+            .where(UserBilling.user_id == source_user_id)
+            .values(user_id=target_user_id)
+        )
+
+    target_has_attribution = (
+        await session.execute(
+            select(AdAttribution.user_id).where(AdAttribution.user_id == target_user_id)
+        )
+    ).scalar_one_or_none()
+    if target_has_attribution:
+        await session.execute(
+            delete(AdAttribution).where(AdAttribution.user_id == source_user_id)
+        )
+    else:
+        await session.execute(
+            update(AdAttribution)
+            .where(AdAttribution.user_id == source_user_id)
+            .values(user_id=target_user_id)
+        )
+
+    subscription_update_values: Dict[str, Any] = {"user_id": target_user_id}
+    if panel_uuid_to_keep:
+        subscription_update_values["panel_user_uuid"] = panel_uuid_to_keep
+    await session.execute(
+        update(Subscription)
+        .where(Subscription.user_id == source_user_id)
+        .values(**subscription_update_values)
+    )
+    for model in (Payment, PromoCodeActivation, UserPaymentMethod):
+        await session.execute(
+            update(model)
+            .where(model.user_id == source_user_id)
+            .values(user_id=target_user_id)
+        )
+
+    await session.execute(
+        update(MessageLog)
+        .where(MessageLog.user_id == source_user_id)
+        .values(user_id=target_user_id)
+    )
+    await session.execute(
+        update(MessageLog)
+        .where(MessageLog.target_user_id == source_user_id)
+        .values(target_user_id=target_user_id)
+    )
+    await session.execute(
+        update(User)
+        .where(User.referred_by_id == source_user_id)
+        .values(referred_by_id=target_user_id)
+    )
+
+    await session.delete(source)
+    await session.flush()
+    await session.refresh(target)
+    return target
+
+
 async def get_user_by_referral_code(session: AsyncSession, referral_code: str) -> Optional[User]:
     normalized = referral_code.strip().upper()
     if not normalized:
@@ -300,23 +629,22 @@ async def get_user_ids_without_active_subscription(session: AsyncSession) -> Lis
     from datetime import datetime, timezone
     now = datetime.now(timezone.utc)
 
-    # Subquery for users with active subscription
-    active_subs_subq = (
-        select(Subscription.user_id)
-        .where(
-            and_(
-                Subscription.is_active == True,
-                Subscription.end_date > now,
-            )
-        )
-    ).scalar_subquery()
+    active_subs = aliased(Subscription)
 
     stmt = (
         select(User.user_id)
+        .outerjoin(
+            active_subs,
+            and_(
+                active_subs.user_id == User.user_id,
+                active_subs.is_active == True,
+                active_subs.end_date > now,
+            ),
+        )
         .where(
             and_(
                 User.is_banned == False,
-                ~User.user_id.in_(active_subs_subq),
+                active_subs.user_id.is_(None),
             )
         )
     )
@@ -360,3 +688,122 @@ async def delete_user_and_relations(session: AsyncSession, user_id: int) -> bool
     await session.delete(user)
     await session.flush()
     return True
+
+
+async def get_top_users_by_traffic_used(
+    session: AsyncSession,
+    *,
+    limit: int = 10,
+) -> List[Dict[str, Any]]:
+    """Return top users by total used traffic across all subscriptions."""
+    safe_limit = max(1, limit)
+
+    total_traffic_used = func.coalesce(func.sum(Subscription.traffic_used_bytes), 0)
+
+    stmt = (
+        select(
+            User.user_id,
+            User.username,
+            User.first_name,
+            total_traffic_used.label("traffic_used_bytes"),
+        )
+        .join(Subscription, Subscription.user_id == User.user_id, isouter=True)
+        .group_by(User.user_id, User.username, User.first_name)
+        .having(total_traffic_used > 0)
+        .order_by(desc("traffic_used_bytes"), User.user_id.asc())
+        .limit(safe_limit)
+    )
+
+    result = await session.execute(stmt)
+    return [dict(row._mapping) for row in result]
+
+
+async def get_top_users_by_lifetime_traffic_used(
+    session: AsyncSession,
+    *,
+    limit: int = 10,
+) -> List[Dict[str, Any]]:
+    """Return top users by lifetime used traffic from panel data."""
+    safe_limit = max(1, limit)
+    lifetime_used = func.coalesce(User.lifetime_used_traffic_bytes, 0)
+
+    stmt = (
+        select(
+            User.user_id,
+            User.username,
+            User.first_name,
+            lifetime_used.label("lifetime_used_traffic_bytes"),
+        )
+        .where(lifetime_used > 0)
+        .order_by(desc("lifetime_used_traffic_bytes"), User.user_id.asc())
+        .limit(safe_limit)
+    )
+
+    result = await session.execute(stmt)
+    return [dict(row._mapping) for row in result]
+
+
+async def get_top_users_by_referrals_count(
+    session: AsyncSession,
+    *,
+    limit: int = 10,
+) -> List[Dict[str, Any]]:
+    """Return top users by number of invited users."""
+    safe_limit = max(1, limit)
+    referred_user = aliased(User)
+
+    invited_count = func.count(referred_user.user_id)
+
+    stmt = (
+        select(
+            User.user_id,
+            User.username,
+            User.first_name,
+            invited_count.label("invited_count"),
+        )
+        .join(referred_user, referred_user.referred_by_id == User.user_id, isouter=True)
+        .group_by(User.user_id, User.username, User.first_name)
+        .having(invited_count > 0)
+        .order_by(desc("invited_count"), User.user_id.asc())
+        .limit(safe_limit)
+    )
+
+    result = await session.execute(stmt)
+    return [dict(row._mapping) for row in result]
+
+
+async def get_top_users_by_referral_revenue(
+    session: AsyncSession,
+    *,
+    limit: int = 10,
+) -> List[Dict[str, Any]]:
+    """Return top users by total revenue brought by all invited users."""
+    safe_limit = max(1, limit)
+    referred_user = aliased(User)
+
+    referral_revenue = func.coalesce(func.sum(Payment.amount), 0.0)
+
+    stmt = (
+        select(
+            User.user_id,
+            User.username,
+            User.first_name,
+            referral_revenue.label("referral_revenue"),
+        )
+        .join(referred_user, referred_user.referred_by_id == User.user_id, isouter=True)
+        .join(
+            Payment,
+            and_(
+                Payment.user_id == referred_user.user_id,
+                Payment.status == "succeeded",
+            ),
+            isouter=True,
+        )
+        .group_by(User.user_id, User.username, User.first_name)
+        .having(referral_revenue > 0)
+        .order_by(desc("referral_revenue"), User.user_id.asc())
+        .limit(safe_limit)
+    )
+
+    result = await session.execute(stmt)
+    return [dict(row._mapping) for row in result]

db/database_setup.py

@@ -20,6 +20,8 @@ def init_db_connection(settings: Settings) -> sessionmaker:
             settings.DATABASE_URL,
             echo=False,
             pool_pre_ping=True,
+            pool_size=20,
+            max_overflow=10,
         )
 
     local_async_session_factory = async_sessionmaker(

db/migrator.py

@@ -112,6 +112,224 @@ def _migration_0003_normalize_referral_codes(connection: Connection) -> None:
         )
     )
 
+
+def _migration_0004_add_lifetime_used_traffic(connection: Connection) -> None:
+    inspector = inspect(connection)
+    columns: Set[str] = {col["name"] for col in inspector.get_columns("users")}
+    if "lifetime_used_traffic_bytes" in columns:
+        return
+
+    connection.execute(
+        text(
+            "ALTER TABLE users ADD COLUMN lifetime_used_traffic_bytes BIGINT"
+        )
+    )
+
+
+def _migration_0005_add_email_auth_fields(connection: Connection) -> None:
+    inspector = inspect(connection)
+    columns: Set[str] = {col["name"] for col in inspector.get_columns("users")}
+
+    if "email" not in columns:
+        connection.execute(text("ALTER TABLE users ADD COLUMN email VARCHAR"))
+    if "email_verified_at" not in columns:
+        connection.execute(
+            text("ALTER TABLE users ADD COLUMN email_verified_at TIMESTAMPTZ")
+        )
+    if "telegram_id" not in columns:
+        connection.execute(text("ALTER TABLE users ADD COLUMN telegram_id BIGINT"))
+
+    connection.execute(
+        text(
+            """
+            UPDATE users
+            SET telegram_id = user_id
+            WHERE telegram_id IS NULL
+              AND user_id > 0
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_users_email
+            ON users (email)
+            WHERE email IS NOT NULL
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_users_telegram_id
+            ON users (telegram_id)
+            WHERE telegram_id IS NOT NULL
+            """
+        )
+    )
+
+    connection.execute(
+        text(
+            """
+            CREATE TABLE IF NOT EXISTS email_verification_codes (
+                code_id SERIAL PRIMARY KEY,
+                email VARCHAR NOT NULL,
+                code_hash VARCHAR NOT NULL,
+                purpose VARCHAR NOT NULL,
+                target_user_id BIGINT NULL REFERENCES users(user_id),
+                expires_at TIMESTAMPTZ NOT NULL,
+                consumed_at TIMESTAMPTZ NULL,
+                attempts INTEGER NOT NULL DEFAULT 0,
+                created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+            )
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_email_verification_codes_lookup
+            ON email_verification_codes (email, purpose, target_user_id, created_at DESC)
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_email_verification_codes_expires_at
+            ON email_verification_codes (expires_at)
+            """
+        )
+    )
+
+
+def _migration_0006_add_security_throttles(connection: Connection) -> None:
+    connection.execute(
+        text(
+            """
+            CREATE TABLE IF NOT EXISTS security_throttles (
+                throttle_id SERIAL PRIMARY KEY,
+                scope VARCHAR(64) NOT NULL,
+                identifier VARCHAR(512) NOT NULL,
+                failures INTEGER NOT NULL DEFAULT 0,
+                window_started_at TIMESTAMPTZ NULL,
+                locked_until TIMESTAMPTZ NULL,
+                last_attempt_at TIMESTAMPTZ NULL,
+                created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                updated_at TIMESTAMPTZ NULL,
+                CONSTRAINT uq_security_throttles_scope_identifier UNIQUE (scope, identifier)
+            )
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_security_throttles_scope
+            ON security_throttles (scope)
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_security_throttles_locked_until
+            ON security_throttles (locked_until)
+            """
+        )
+    )
+
+
+def _migration_0007_add_telegram_photo_url(connection: Connection) -> None:
+    inspector = inspect(connection)
+    columns: Set[str] = {col["name"] for col in inspector.get_columns("users")}
+    if "telegram_photo_url" in columns:
+        return
+
+    connection.execute(
+        text("ALTER TABLE users ADD COLUMN telegram_photo_url TEXT")
+    )
+
+
+def _migration_0008_add_email_verification_code_status(connection: Connection) -> None:
+    inspector = inspect(connection)
+    columns: Set[str] = {col["name"] for col in inspector.get_columns("email_verification_codes")}
+
+    if "status" not in columns:
+        connection.execute(
+            text(
+                "ALTER TABLE email_verification_codes ADD COLUMN status VARCHAR NOT NULL DEFAULT 'active'"
+            )
+        )
+    else:
+        connection.execute(
+            text(
+                """
+                UPDATE email_verification_codes
+                SET status = 'active'
+                WHERE status IS NULL OR status = ''
+                """
+            )
+        )
+
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_email_verification_codes_status
+            ON email_verification_codes (status)
+            """
+        )
+    )
+
+
+def _migration_0010_add_email_magic_token_hash(connection: Connection) -> None:
+    inspector = inspect(connection)
+    columns: Set[str] = {col["name"] for col in inspector.get_columns("email_verification_codes")}
+
+    if "magic_token_hash" not in columns:
+        connection.execute(
+            text(
+                "ALTER TABLE email_verification_codes ADD COLUMN magic_token_hash VARCHAR"
+            )
+        )
+
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_email_verification_codes_magic_token_hash
+            ON email_verification_codes (magic_token_hash)
+            """
+        )
+    )
+
+
+def _migration_0009_add_composite_indexes(connection: Connection) -> None:
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_subscriptions_is_active_end_date
+            ON subscriptions (is_active, end_date)
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_subscriptions_user_id_is_active
+            ON subscriptions (user_id, is_active)
+            """
+        )
+    )
+    connection.execute(
+        text(
+            """
+            CREATE INDEX IF NOT EXISTS ix_payments_user_id_status
+            ON payments (user_id, status)
+            """
+        )
+    )
+
+
 MIGRATIONS: List[Migration] = [
     Migration(
         id="0001_add_channel_subscription_fields",
@@ -128,6 +346,41 @@ MIGRATIONS: List[Migration] = [
         description="Normalize referral codes to uppercase for consistent lookups",
         upgrade=_migration_0003_normalize_referral_codes,
     ),
+    Migration(
+        id="0004_add_lifetime_used_traffic",
+        description="Store lifetime traffic usage for users",
+        upgrade=_migration_0004_add_lifetime_used_traffic,
+    ),
+    Migration(
+        id="0005_add_email_auth_fields",
+        description="Add email login identities and verification codes",
+        upgrade=_migration_0005_add_email_auth_fields,
+    ),
+    Migration(
+        id="0006_add_security_throttles",
+        description="Add generic lockout tracking for brute-force protection",
+        upgrade=_migration_0006_add_security_throttles,
+    ),
+    Migration(
+        id="0007_add_telegram_photo_url",
+        description="Store Telegram profile photo URLs for linked users",
+        upgrade=_migration_0007_add_telegram_photo_url,
+    ),
+    Migration(
+        id="0008_add_email_verification_code_status",
+        description="Track superseded email verification codes explicitly",
+        upgrade=_migration_0008_add_email_verification_code_status,
+    ),
+    Migration(
+        id="0009_add_composite_indexes",
+        description="Add composite indexes for subscription and payment lookups",
+        upgrade=_migration_0009_add_composite_indexes,
+    ),
+    Migration(
+        id="0010_add_email_magic_token_hash",
+        description="Store hashed magic-link tokens for email login deeplinks",
+        upgrade=_migration_0010_add_email_magic_token_hash,
+    ),
 ]
 
 

db/models.py

@@ -1,4 +1,4 @@
-from sqlalchemy import create_engine, Column, Integer, String, Boolean, DateTime, Float, ForeignKey, UniqueConstraint, Text, BigInteger
+from sqlalchemy import create_engine, Column, Integer, String, Boolean, DateTime, Float, ForeignKey, UniqueConstraint, Text, BigInteger, Index
 from sqlalchemy.orm import relationship, DeclarativeBase
 from sqlalchemy.ext.asyncio import AsyncAttrs
 from sqlalchemy.sql import func
@@ -14,6 +14,10 @@ class User(Base):
 
     user_id = Column(BigInteger, primary_key=True, index=True)
     username = Column(String, nullable=True, index=True)
+    email = Column(String, nullable=True, unique=True, index=True)
+    email_verified_at = Column(DateTime(timezone=True), nullable=True)
+    telegram_id = Column(BigInteger, nullable=True, unique=True, index=True)
+    telegram_photo_url = Column(Text, nullable=True)
     first_name = Column(String, nullable=True)
     last_name = Column(String, nullable=True)
     language_code = Column(String, default="ru")
@@ -25,6 +29,7 @@ class User(Base):
     referred_by_id = Column(BigInteger,
                             ForeignKey("users.user_id"),
                             nullable=True)
+    lifetime_used_traffic_bytes = Column(BigInteger, nullable=True)
     channel_subscription_verified = Column(Boolean, nullable=True)
     channel_subscription_checked_at = Column(DateTime(timezone=True),
                                              nullable=True)
@@ -56,6 +61,10 @@ class User(Base):
 
 class Subscription(Base):
     __tablename__ = "subscriptions"
+    __table_args__ = (
+        Index("ix_subscriptions_is_active_end_date", "is_active", "end_date"),
+        Index("ix_subscriptions_user_id_is_active", "user_id", "is_active"),
+    )
 
     subscription_id = Column(Integer, primary_key=True, autoincrement=True)
     user_id = Column(BigInteger,
@@ -85,8 +94,52 @@ class Subscription(Base):
         return f"<Subscription(id={self.subscription_id}, user_id={self.user_id}, panel_uuid='{self.panel_user_uuid}', ends='{self.end_date}')>"
 
 
+class EmailVerificationCode(Base):
+    __tablename__ = "email_verification_codes"
+
+    code_id = Column(Integer, primary_key=True, autoincrement=True)
+    email = Column(String, nullable=False, index=True)
+    code_hash = Column(String, nullable=False)
+    magic_token_hash = Column(String, nullable=True, index=True)
+    purpose = Column(String, nullable=False, index=True)
+    target_user_id = Column(
+        BigInteger,
+        ForeignKey("users.user_id"),
+        nullable=True,
+        index=True,
+    )
+    expires_at = Column(DateTime(timezone=True), nullable=False, index=True)
+    consumed_at = Column(DateTime(timezone=True), nullable=True)
+    status = Column(String, nullable=False, default="active", index=True)
+    attempts = Column(Integer, nullable=False, default=0)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+    target_user = relationship("User")
+
+
+class SecurityThrottle(Base):
+    __tablename__ = "security_throttles"
+
+    throttle_id = Column(Integer, primary_key=True, autoincrement=True)
+    scope = Column(String(64), nullable=False, index=True)
+    identifier = Column(String(512), nullable=False, index=True)
+    failures = Column(Integer, nullable=False, default=0)
+    window_started_at = Column(DateTime(timezone=True), nullable=True)
+    locked_until = Column(DateTime(timezone=True), nullable=True, index=True)
+    last_attempt_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    updated_at = Column(DateTime(timezone=True), onupdate=func.now(), nullable=True)
+
+    __table_args__ = (
+        UniqueConstraint("scope", "identifier", name="uq_security_throttles_scope_identifier"),
+    )
+
+
 class Payment(Base):
     __tablename__ = "payments"
+    __table_args__ = (
+        Index("ix_payments_user_id_status", "user_id", "status"),
+    )
 
     payment_id = Column(Integer, primary_key=True, autoincrement=True)
     user_id = Column(BigInteger,

docker-compose-caddy.yml

@@ -0,0 +1,59 @@
+services:
+  remnawave-minishop:
+    image: ghcr.io/3252a8/remnawave-minishop:${IMAGE_TAG:-latest}
+    container_name: remnawave-minishop
+    hostname: remnawave-minishop
+    env_file:
+      - .env
+    environment:
+      - TZ=UTC
+    volumes:
+      - ./locales:/app/locales
+    restart: unless-stopped
+    depends_on:
+      remnawave-minishop-db:
+        condition: service_healthy
+
+  remnawave-minishop-db:
+    image: postgres:17
+    container_name: remnawave-minishop-db
+    hostname: remnawave-minishop-db
+    env_file:
+      - .env
+    environment:
+      - TZ=UTC
+    volumes:
+      - remnawave-minishop-db-data:/var/lib/postgresql/data
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  caddy:
+    image: caddy:2-alpine
+    container_name: remnawave-minishop-caddy
+    hostname: remnawave-minishop-caddy
+    environment:
+      - TZ=UTC
+      - WEB_SERVER_PORT=${WEB_SERVER_PORT:-8080}
+      - WEBAPP_SERVER_PORT=${WEBAPP_SERVER_PORT:-8081}
+    depends_on:
+      - remnawave-minishop
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    restart: unless-stopped
+
+volumes:
+  remnawave-minishop-db-data:
+    name: remnawave-minishop-db-data
+  caddy_data:
+    name: remnawave-minishop-caddy-data
+  caddy_config:
+    name: remnawave-minishop-caddy-config

docker-compose-remote-server.yml

@@ -1,12 +1,13 @@
 services:
-  remnawave-tg-shop:
-    image: kavore/remnawave-tg-shop:latest
-    container_name: remnawave-tg-shop
-    hostname: remnawave-tg-shop
+  remnawave-minishop:
+    image: ghcr.io/3252a8/remnawave-minishop:${IMAGE_TAG:-latest}
+    container_name: remnawave-minishop
+    hostname: remnawave-minishop
     env_file:
       - .env
     ports:
       - '127.0.0.1:8080:8080'
+      - '127.0.0.1:${WEBAPP_SERVER_PORT:-8081}:${WEBAPP_SERVER_PORT:-8081}'
     networks:
       - remnawave-network
     environment:
@@ -15,17 +16,17 @@ services:
       - ./locales:/app/locales
     restart: unless-stopped
     depends_on:
-      - remnawave-tg-shop-db
-  remnawave-tg-shop-db:
+      - remnawave-minishop-db
+  remnawave-minishop-db:
     image: postgres:17
-    container_name: remnawave-tg-shop-db
-    hostname: remnawave-tg-shop-db
+    container_name: remnawave-minishop-db
+    hostname: remnawave-minishop-db
     env_file:
       - .env
     environment:
       - TZ=UTC
     volumes:
-      - remnawave-tg-shop-db-data:/var/lib/postgresql/data
+      - remnawave-minishop-db-data:/var/lib/postgresql/data
     networks:
       - remnawave-network
     restart: unless-stopped
@@ -37,5 +38,5 @@ services:
 networks:
   remnawave-network: null
 volumes:
-  remnawave-tg-shop-db-data:
-    name: remnawave-tg-shop-db-data
+  remnawave-minishop-db-data:
+    name: remnawave-minishop-db-data

docker-compose.yml

@@ -1,28 +1,34 @@
 services:
-  remnawave-tg-shop:
-    image: kavore/remnawave-tg-shop:latest
-#    build: .
-    container_name: remnawave-tg-shop
-    hostname: remnawave-tg-shop
+  remnawave-minishop:
+    image: ghcr.io/3252a8/remnawave-minishop:${IMAGE_TAG:-latest}
+    container_name: remnawave-minishop
+    hostname: remnawave-minishop
     env_file:
       - .env
     networks:
       - remnawave-network
-    volumes:
-      - ./locales:/app/locales
     restart: unless-stopped
     depends_on:
-      remnawave-tg-shop-db:
+      remnawave-minishop-db:
         condition: service_healthy
+    ports:
+      - 127.0.0.1:8080:8080
+      - 127.0.0.1:${WEBAPP_SERVER_PORT:-8081}:${WEBAPP_SERVER_PORT:-8081}
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/healthz >/dev/null || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
 
-  remnawave-tg-shop-db:
+  remnawave-minishop-db:
     image: postgres:17
-    container_name: remnawave-tg-shop-db
-    hostname: remnawave-tg-shop-db
+    container_name: remnawave-minishop-db
+    hostname: remnawave-minishop-db
     env_file:
       - .env
     volumes:
-      - remnawave-tg-shop-db-data:/var/lib/postgresql/data
+      - remnawave-minishop-db-data:/var/lib/postgresql/data
     networks:
       - remnawave-network
     restart: unless-stopped
@@ -37,5 +43,5 @@ networks:
     external: true
 
 volumes:
-  remnawave-tg-shop-db-data:
-    name: remnawave-tg-shop-db-data
+  remnawave-minishop-db-data:
+    name: remnawave-minishop-db-data

docs/migration-to-minishop.md

@@ -0,0 +1,150 @@
+# Миграция с `remnawave-tg-shop` на `remnawave-minishop`
+
+Начиная с этой версии контейнеры и тома названы `remnawave-minishop*` вместо `remnawave-tg-shop*`. Старый и новый стеки используют **разные имена томов**, поэтому простой `docker compose up -d` после `git pull` создаст пустую БД. Эта инструкция описывает, как перенести данные.
+
+Есть два пути:
+
+- [Автоматический](#автоматический-способ-через-скрипт) — один скрипт, идемпотентный, проверяет состояние на каждом шаге.
+- [Ручной](#ручной-способ) — команды, которые делает скрипт, если хочется понимать происходящее или выполнить выборочно.
+
+В обоих случаях:
+- старые тома **не удаляются** автоматически — это безопасный бэкап на случай отката;
+- сертификаты Caddy (если используется `docker-compose-caddy.yml`) тоже переносятся, чтобы Let's Encrypt не выписывал их заново и не упереться в rate limit.
+
+## Автоматический способ (через скрипт)
+
+Если helper ещё не лежит у вас локально, запускайте его прямо из `raw` из корня старого репозитория:
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/3252a8/remnawave-minishop/main/scripts/migrate_to_minishop.sh)
+```
+
+> Команда выше рассчитана на `bash` / Git Bash / WSL. Если вы запускаете из PowerShell, удобнее сначала открыть Git Bash.
+
+Если вы уже подтянули новую версию и файл есть локально, можно запускать и так:
+
+```bash
+bash scripts/migrate_to_minishop.sh
+```
+
+По умолчанию скрипт работает с `docker-compose.yml` и переключается на ветку `main`. Можно переопределить через переменные окружения:
+
+| Переменная        | Назначение                                                              | По умолчанию           |
+| ----------------- | ----------------------------------------------------------------------- | ---------------------- |
+| `PROJECT_ROOT`    | Явный путь к корню старого репозитория, если запуск не из него          | текущая директория     |
+| `COMPOSE_FILE`    | Какой compose-файл стартовать в конце                                   | `docker-compose.yml`   |
+| `TARGET_BRANCH`   | На какую ветку переключаться и подтягивать обновления                   | `main`                 |
+| `GIT_REMOTE`     | Какой remote использовать для `fetch`/`pull`                            | `origin`               |
+| `NEW_ORIGIN_URL`  | Если задано и не совпадает с URL выбранного remote — он будет обновлён  | (не меняется)          |
+| `ASSUME_YES`      | `1` — не задавать интерактивных вопросов                                | `0`                    |
+
+Примеры:
+
+```bash
+# Caddy-вариант из raw
+COMPOSE_FILE=docker-compose-caddy.yml \
+  bash <(curl -fsSL https://raw.githubusercontent.com/3252a8/remnawave-minishop/main/scripts/migrate_to_minishop.sh)
+
+# С переключением origin на форк 3252a8
+NEW_ORIGIN_URL=https://github.com/3252a8/remnawave-minishop.git \
+  bash <(curl -fsSL https://raw.githubusercontent.com/3252a8/remnawave-minishop/main/scripts/migrate_to_minishop.sh)
+
+# Без интерактива
+ASSUME_YES=1 \
+  bash <(curl -fsSL https://raw.githubusercontent.com/3252a8/remnawave-minishop/main/scripts/migrate_to_minishop.sh)
+```
+
+Что делает скрипт:
+
+1. **Останавливает текущий стек**: проверяет известные контейнеры старой и новой схемы и останавливает их, если они запущены.
+2. **Переключает `origin`**, если задана переменная `NEW_ORIGIN_URL`, иначе оставляет как есть.
+3. **Подтягивает целевую ветку** (`git fetch` + `git switch` + `git pull --ff-only`). Прерывается, если в рабочем дереве есть незакоммиченные изменения.
+4. **Обновляет `.env`** и правит `POSTGRES_HOST`, если он ещё указывает на старый контейнер.
+5. **Подготавливает новый стек в режиме `--no-start`**, чтобы Compose сам создал тома и не ругался на уже существующий volume.
+6. **Переносит тома** `remnawave-tg-shop-*` → `remnawave-minishop-*` через одноразовый `alpine`-контейнер. Если новый том уже непустой, копирование пропускается.
+7. **Стартует новый стек** (`docker compose -f $COMPOSE_FILE up -d --remove-orphans`, а для локальной сборки ещё и `--build`) и печатает `docker compose ps`.
+
+Скрипт идемпотентен: повторный запуск ничего не сломает, просто пропустит уже выполненные шаги.
+
+После того как убедитесь, что бот работает и данные на месте, удалите старые тома:
+
+```bash
+docker volume rm remnawave-tg-shop-db-data
+docker volume rm remnawave-tg-shop-caddy-data remnawave-tg-shop-caddy-config 2>/dev/null || true
+```
+
+> ⚠️ Если у вас есть внешний reverse proxy (Nginx и т.п.), не забудьте поправить в его конфиге `upstream`/`proxy_pass`: имя хоста контейнера изменилось с `remnawave-tg-shop` на `remnawave-minishop`. Скрипт не трогает внешние конфиги.
+
+## Ручной способ
+
+1.  **Остановите старый стек и обновите код:**
+
+    ```bash
+    docker compose down
+    git fetch origin
+    git checkout main
+    git pull --ff-only origin main
+    ```
+
+2.  **Обновите `.env`:**
+
+    ```bash
+    sed -i.bak 's/^POSTGRES_HOST=remnawave-tg-shop-db$/POSTGRES_HOST=remnawave-minishop-db/' .env
+    ```
+
+3.  **Подготовьте новый стек без запуска:**
+
+    ```bash
+    # Локальная сборка
+    docker compose up --no-start --build
+
+    # Или Caddy-вариант
+    docker compose -f docker-compose-caddy.yml up --no-start --build
+
+    # Или готовый образ
+    docker compose -f docker-compose-remote-server.yml up --no-start
+    ```
+
+4.  **Перенесите том БД в новое имя:**
+
+    ```bash
+    docker run --rm \
+      -v remnawave-tg-shop-db-data:/from:ro \
+      -v remnawave-minishop-db-data:/to \
+      alpine sh -c "cd /from && cp -a . /to"
+    ```
+
+5.  **(Только для Caddy)** перенесите тома Caddy с TLS-сертификатами и состоянием ACME:
+
+    ```bash
+    for v in caddy-data caddy-config; do
+      docker run --rm \
+        -v "remnawave-tg-shop-$v":/from:ro \
+        -v "remnawave-minishop-$v":/to \
+        alpine sh -c "cd /from && cp -a . /to"
+    done
+    ```
+
+6.  **Запустите новый стек:**
+
+    ```bash
+    docker compose up -d
+    # или
+    docker compose -f docker-compose-caddy.yml up -d --build
+    # или
+    docker compose -f docker-compose-remote-server.yml up -d
+    ```
+
+7.  **Проверьте:**
+
+    ```bash
+    docker compose ps
+    docker compose logs -f remnawave-minishop
+    ```
+
+8.  **(Опционально) удалите старые тома**, когда убедитесь, что новый стек стабилен:
+
+    ```bash
+    docker volume rm remnawave-tg-shop-db-data
+    docker volume rm remnawave-tg-shop-caddy-data remnawave-tg-shop-caddy-config 2>/dev/null || true
+    ```

docs/tariffs.md

@@ -0,0 +1,125 @@
+# Тарифы
+
+В Minishop два режима тарификации, и они **взаимоисключающие**: бот в каждый момент времени продаёт либо подписку на срок (1 / 3 / 6 / 12 месяцев), либо пакеты трафика. Ниже — что именно настраивается, что происходит при покупке и как переключаться.
+
+## Краткое сравнение
+
+| | Подписка по времени | Пакеты трафика |
+| --- | --- | --- |
+| Что покупает пользователь | Период доступа (1/3/6/12 мес.) | Объём трафика в ГБ |
+| Срок действия в панели | До конца купленного периода | До 01.01.2099 (фактически бессрочно) |
+| Лимит трафика | Из `USER_TRAFFIC_LIMIT_GB`, сбрасывается по `USER_TRAFFIC_STRATEGY` | Кумулятивно: каждый платёж **прибавляет** ГБ к лимиту |
+| Стратегия сброса | `NO_RESET` / `WEEK` / `MONTH` / `DAY` | Принудительно `NO_RESET` |
+| Автопродление YooKassa | Поддерживается | Выключено |
+| Реферальные бонусы | Доступны (бонусные дни) | Не выдаются |
+| Триал | Доступен (`TRIAL_*`) | Доступен (включается отдельно) |
+
+Бот определяет режим по наличию переменных `TRAFFIC_PACKAGES` или `STARS_TRAFFIC_PACKAGES`: если хотя бы одна из них непустая — включается режим продажи трафика и переменные `*_MONTHS_ENABLED` / `RUB_PRICE_*` игнорируются.
+
+## Режим «Подписка по времени» (по умолчанию)
+
+Используется, когда `TRAFFIC_PACKAGES` и `STARS_TRAFFIC_PACKAGES` пусты.
+
+### Цены и периоды
+
+Для каждого периода настраивается доступность и две цены — в основной валюте (`DEFAULT_CURRENCY_SYMBOL`, по умолчанию RUB) и в Telegram Stars:
+
+| Переменная | Описание |
+| --- | --- |
+| `1_MONTH_ENABLED` / `3_MONTHS_ENABLED` / `6_MONTHS_ENABLED` / `12_MONTHS_ENABLED` | `true`/`false` — показывать ли период в выборе |
+| `RUB_PRICE_1_MONTH` / `RUB_PRICE_3_MONTHS` / `RUB_PRICE_6_MONTHS` / `RUB_PRICE_12_MONTHS` | Цена в рублях. Если не задана — кнопка не появится |
+| `STARS_PRICE_1_MONTH` / `STARS_PRICE_3_MONTHS` / `STARS_PRICE_6_MONTHS` / `STARS_PRICE_12_MONTHS` | Цена в Stars. Используется, когда оплата идёт через `STARS_ENABLED` |
+
+Если `RUB_PRICE_*` равно `0` — соответствующий период просто скрывается.
+
+### Трафик пользователя
+
+Лимит трафика и стратегия его сброса настраиваются глобально и применяются ко всем платным пользователям (в том числе при продлении):
+
+| Переменная | Описание |
+| --- | --- |
+| `USER_TRAFFIC_LIMIT_GB` | Лимит трафика в ГБ. `0` — безлимит |
+| `USER_TRAFFIC_STRATEGY` | Когда сбрасывается счётчик: `NO_RESET`, `DAY`, `WEEK`, `MONTH` |
+
+### Что происходит при оплате
+
+1. Если у пользователя ещё нет активной подписки — стартовая дата = «сейчас». Если есть — новая длительность прибавляется к её `end_date` (продление, а не перезапись).
+2. К итогу могут добавиться бонусные дни промокода (`promo_codes`) и реферальной программы (`REFERRAL_BONUS_DAYS_*`, `REFEREE_BONUS_DAYS_*`).
+3. В панели Remnawave у пользователя обновляются `expireAt`, `trafficLimitBytes` и `trafficLimitStrategy` под текущие настройки.
+
+### Автопродление (только YooKassa)
+
+Включается через `YOOKASSA_AUTOPAYMENTS_ENABLED=true`. Если включено и пользователь сохранил карту, то за `SUBSCRIPTION_NOTIFY_DAYS_BEFORE` дней до окончания бот пытается списать сумму, равную `RUB_PRICE_*` для длительности из последнего платежа. См. `YOOKASSA_AUTOPAYMENTS_REQUIRE_CARD_BINDING` для управления чекбоксом «сохранить карту».
+
+В режиме трафика автопродление принудительно выключается, даже если YooKassa-настройки разрешают его.
+
+### Уведомления
+
+Управляются `SUBSCRIPTION_NOTIFICATIONS_ENABLED`, `SUBSCRIPTION_NOTIFY_ON_EXPIRE`, `SUBSCRIPTION_NOTIFY_AFTER_EXPIRE`, `SUBSCRIPTION_NOTIFY_DAYS_BEFORE`. Работают по `end_date` подписки — поэтому в режиме трафика, где `end_date` всегда «2099», они эффективно не отправляются.
+
+## Режим «Пакеты трафика»
+
+Включается заданием переменной `TRAFFIC_PACKAGES` (и/или `STARS_TRAFFIC_PACKAGES`) в `.env`.
+
+### Формат
+
+```env
+# Пакеты в основной валюте (RUB), формат "<GB>:<цена>", через запятую
+TRAFFIC_PACKAGES=10:199,50:799,200:1999
+
+# Пакеты в Telegram Stars (опционально, если включён STARS_ENABLED)
+STARS_TRAFFIC_PACKAGES=10:2500,50:9000
+```
+
+Для дробных размеров допускается `0.5:99`, `1.5:299` и т. п. Цены допускают `0` (например, для теста).
+
+Если задана только `STARS_TRAFFIC_PACKAGES`, при выборе пакета бот покажет цену в звёздах и автоматически подменит символ валюты на `⭐`. Если фиатные провайдеры (`YOOKASSA_ENABLED`, `FREEKASSA_ENABLED`, `PLATEGA_ENABLED`, `SEVERPAY_ENABLED`, `CRYPTOPAY_ENABLED`) включены, но `TRAFFIC_PACKAGES` не задана — бот сочтёт это ошибкой конфигурации и не пропустит покупку.
+
+### Что происходит при оплате
+
+1. К текущему лимиту трафика пользователя в панели **прибавляется** купленный объём (`new_limit = current_limit + purchase_bytes`). Это работает и для существующих подписчиков.
+2. Стратегия сброса принудительно ставится в `NO_RESET` — иначе докупленные ГБ обнулялись бы по расписанию.
+3. `end_date` ставится в `2099-01-01 UTC` (или сохраняется более поздняя, если по какой-то причине уже была). Это нужно, чтобы Remnawave не помечал пользователя как просроченного.
+4. Реферальные бонусы и автопродление при таких платежах отключены: даже если в `.env` они настроены, в этом режиме бот их не применяет.
+5. Поле `subscription_duration_months` в БД и в CSV-выгрузке платежей в этом режиме интерпретируется как «количество ГБ», а не как месяцы. В UI и админке это учитывается, но имейте в виду при ручных запросах к БД.
+
+### Триал в режиме трафика
+
+Триал работает по той же логике, что и в режиме подписок: задаётся `TRIAL_ENABLED`, `TRIAL_DURATION_DAYS`, `TRIAL_TRAFFIC_LIMIT_GB`, `TRIAL_TRAFFIC_STRATEGY`. То есть пробный период всё ещё ограничен по времени, даже если основная продажа — это пакеты трафика.
+
+## Как переключиться между режимами
+
+1. В `.env` либо заполните `TRAFFIC_PACKAGES` (включится режим трафика), либо очистите её (включится режим подписок).
+2. Перезапустите контейнер: `docker compose up -d`.
+3. Существующие подписчики не теряют доступ:
+   - При переключении в режим трафика их `end_date` остаётся прежним до следующей покупки. Покупка пакета установит `end_date` = «2099» и переведёт стратегию в `NO_RESET`.
+   - При обратном переключении следующий платёж задаст обычный `end_date` от «сейчас» (или продлит существующий).
+
+> ⚠️ Одновременно совмещать продажу подписок и трафика бот **не умеет**. Проверка идёт по одному булевому флагу `traffic_sale_mode`.
+
+## Чеки для самозанятых (nalog.ru)
+
+Для каждого режима используется отдельный шаблон названия в чеке:
+
+| Переменная | Назначение |
+| --- | --- |
+| `NALOGO_RECEIPT_NAME_SUBSCRIPTION` | Шаблон для подписки. Поддерживает `{months}` |
+| `NALOGO_RECEIPT_NAME_TRAFFIC` | Шаблон для пакета трафика. Поддерживает `{gb}` |
+
+Пример: `NALOGO_RECEIPT_NAME_TRAFFIC=traffic package {gb} GB`.
+
+## Связанные переменные
+
+| Переменная | Описание |
+| --- | --- |
+| `DEFAULT_CURRENCY_SYMBOL` | Что показывается рядом с фиатной ценой (`RUB`, `USD`, `EUR`, …) |
+| `PAYMENT_METHODS_ORDER` | Порядок кнопок оплаты — общий для обоих режимов |
+| `STARS_ENABLED` | Без него Stars-цены не предложатся, даже если заданы |
+| `USER_HWID_DEVICE_LIMIT` | Лимит устройств — общий для обоих режимов, к тарификации не относится |
+
+## Где это всё в коде
+
+- Чтение и парсинг переменных: [config/settings.py](../config/settings.py) — `subscription_options`, `traffic_packages`, `stars_traffic_packages`, `traffic_sale_mode`.
+- Активация платежа: [bot/services/subscription_service.py](../bot/services/subscription_service.py) — `activate_subscription` (ветка по `sale_mode`) и `_activate_traffic_package`.
+- Выбор тарифа в боте: [bot/handlers/user/subscription/core.py](../bot/handlers/user/subscription/core.py) и [bot/handlers/user/subscription/payments_subscription.py](../bot/handlers/user/subscription/payments_subscription.py).
+- Web App: [bot/app/web/subscription_webapp.py](../bot/app/web/subscription_webapp.py) — поле `traffic_mode` в payload и логика отображения трафика.

locales/en.json

@@ -5,18 +5,28 @@
   "channel_subscription_verify_button": "Check subscription",
   "channel_subscription_check_failed": "Couldn't verify the subscription. Please try again later or contact support.",
   "channel_subscription_verified_success": "✅ Subscription confirmed! You're good to go.",
-  "main_menu_greeting": "Hi, {user_name}! 👋\nWhat would you like to do?",
+  "webapp_auth_success": "✅ Login confirmed. Return to the Web App.",
+  "webapp_auth_expired": "The login link has expired. Return to the Web App and try again.",
+  "main_menu_greeting": "Hi, {user_name}! 👋\nOpen \"Personal Account\" to set up the connection, view your subscription, or renew access.",
   "menu_activate_trial_button": "🆓 Free Trial",
   "menu_subscribe_inline": "🚀 Purchase",
+  "menu_personal_account_button": "🔑 Personal Account",
+  "menu_bot_interface_button": "🤖 Bot menu",
   "menu_my_subscription_inline": "🔐 My Subscription",
   "no_subscription_options_available": "Subscription issuance is not configured by the bot administrator",
-  "menu_referral_inline": "🎁 Referrals",
+  "menu_referral_inline": "🎁 Invite friend",
   "referral_no_bonuses_configured": "Sorry, the referral program is currently disabled",
   "menu_apply_promo_button": "🎟 Promo Code",
   "menu_language_settings_inline": "🌐 Language",
   "menu_server_status_button": "📊 Status",
   "menu_support_button": "💬 Support",
   "menu_terms_button": "📄 Terms of Service",
+  "menu_info_button": "ℹ️ Information",
+  "bot_interface_menu_title": "Bot interface",
+  "bot_interface_menu_webapp_hint": "The Personal Account is the easier place to manage the service.",
+  "info_links_message": "Choose a document:",
+  "privacy_policy_button": "🔒 Privacy Policy",
+  "user_agreement_button": "📄 User Agreement",
   "back_to_main_menu_button": "⬅️ Back",
   "choose_language": "Choose language:",
   "language_set_alert": "Language changed!",
@@ -41,13 +51,14 @@
   "yookassa_autopay_charge_initiated": "Charge request sent to the selected card. We'll notify you once the payment completes.",
   "pay_with_sbp_button": "📱 SBP",
   "pay_with_platega_button": "💳 Platega (SBP/Cards)",
+  "pay_with_platega_sbp_button": "🏦 Pay via SBP",
+  "pay_with_platega_crypto_button": "🪙 Pay with crypto",
   "pay_with_severpay_button": "💳 SeverPay",
   "back_to_payment_methods_button": "⬅️ Back",
   "pay_with_cryptopay_button": "💎 CryptoBot",
   "pay_with_stars_button": "🌟 Telegram Stars",
   "connect_button": "🔗 Connect",
   "cancel_button": "❌ Cancel",
-
   "devices_button": "📱 My Devices ({current_devices}/{max_devices})",
   "my_devices_details": "📱 <b>My Devices ({current_devices}/{max_devices})</b>\n\n{devices}\n\nYou can disconnect a device by selecting it from the list below.\n<blockquote><i>Note: If you disconnect a device, it will be automatically connected again when you use it next. Before deleting, make sure you have deleted the subscription from the application.</i></blockquote>",
   "no_devices_details_found_message": "📱 <b>My Devices</b>\n\nYou don't have any devices yet.\nYou have {max_devices} devices available. You can connect them by clicking the \"🔗 Connect\" button in the subscription menu.",
@@ -57,7 +68,6 @@
   "no_devices_found": "Error loading device list.",
   "devices_unlimited_label": "Unlimited",
   "my_devices_feature_disabled": "The My Devices section is currently unavailable.",
-
   "payment_description_subscription": "Subscription payment for {months} mo.",
   "payment_description_traffic": "Traffic package {traffic_gb} GB",
   "payment_link_message": "To pay for {months} mo. subscription, click the button below:",
@@ -72,8 +82,14 @@
   "payment_failed": "❌ Payment failed or was cancelled. Please try again or contact support.",
   "config_link_not_available": "not available, contact support",
   "traffic_unlimited": "Unlimited",
+  "traffic_period_day": "per day",
+  "traffic_period_week": "per week",
+  "traffic_period_month": "per month",
+  "traffic_period_no_reset": "no reset",
+  "traffic_used_with_period": "{traffic_used} ({traffic_period})",
   "promo_code_prompt": "Please enter your promo code:",
   "promo_code_not_found": "Promo code <code>{code}</code> not found, expired, or already used the maximum number of times.",
+  "promo_code_too_many_attempts": "Too many failed promo code attempts. Please try again in {seconds} sec.",
   "promo_code_already_used_by_user": "You have already used promo code <code>{code}</code>.",
   "promo_code_applied_success_full": "✅ Promo code applied successfully!\nSubscription active until {end_date}.\n\nConnection key:\n<code>{config_link}</code>\n\nTo connect, open the link and follow the instructions 👇",
   "error_applying_promo_bonus": "Failed to apply promo bonus. Please try again later or contact support.",
@@ -83,13 +99,16 @@
   "trial_confirm_activate_button": "✅ Activate!",
   "trial_activated_alert": "Trial activated!",
   "trial_activated_details_message": "✅ Trial activated!\nYour {days}-day trial is active until {end_date}.\n\nConnection key:\n<code>{config_link}</code>\n\nTo connect, open the link and follow the instructions 👇",
+  "referral_welcome_bonus_applied": "🎁 You have received {days} bonus day(s) for registering via a referral link!\nYour subscription is active until {end_date}.",
   "yes_button": "Yes",
   "no_button": "No",
-  "referral_program_info_new": "🎁 <b>Referral Program</b>\n\n📊 <b>Your stats:</b>\n👥 Friends invited: <b>{invited_count}</b>\n💳 Purchased subscription: <b>{purchased_count}</b>\n\n🔗 Your link:\n<code>{referral_link}</code>\n\n💰 <b>Invitation bonuses:</b>\n{bonus_details}\n\n📢 Share the link with friends and get bonuses!",
+  "referral_program_info_new": "🎁 <b>Referral Program</b>\n\n📊 <b>Your stats:</b>\n👥 Friends invited: <b>{invited_count}</b>\n💳 Purchased subscription: <b>{purchased_count}</b>\n\n🔗 Telegram link:\n<code>{referral_link}</code>{webapp_link_section}\n\n💰 <b>Invitation bonuses:</b>\n{bonus_details}\n\n📢 Share the link with friends and get bonuses!",
   "referral_bonus_per_period": "\n\n🎁 For a friend's {months}-month subscription:\n  ➢ You: <b>{inviter_bonus_days} days</b>\n  ➢ Friend: <b>{referee_bonus_days} days</b>",
   "referral_not_available_for_traffic": "Referral bonuses are not available for traffic packages.",
   "referral_share_message_button": "📩 Message for friend",
-  "referral_friend_message": "🚀 Hey! Try this VPN - it's fast, reliable and affordable!\n\n🎁 Use my link to get bonus days with your subscription!\n\n{referral_link}",
+  "referral_friend_message": "🚀 Hey! Try this service - it's fast, reliable and affordable!\n\n🎁 Use my link to get bonus days with your subscription!\n\n{referral_link}",
+  "referral_friend_message_with_webapp": "🚀 Hey! Try this service - it's fast, reliable and affordable!\n\n🎁 Use my link to get bonus days with your subscription!\n\nTelegram: {referral_link}\nWeb: {webapp_referral_link}",
+  "referral_webapp_link_line": "\n🌐 Web link:\n<code>{webapp_referral_link}</code>",
   "friend_placeholder": "friend",
   "referral_bonus_inviter_notification_extended": "🎉 Congrats! Your friend {referee_name} paid for a subscription. You received {days} bonus days! Your subscription is now active until {new_end_date}.",
   "referral_bonus_inviter_notification_new_sub": "🎉 Congrats! Your friend {referee_name} paid for a subscription. You received a {days}-day bonus subscription! It is active until {new_end_date}.",
@@ -123,6 +142,18 @@
   "admin_stats_payment_item": "{status_emoji} {amount} {currency} from {user_info} ({p_status}) [{p_date}]",
   "admin_stats_no_payments_found": "No payments found yet.",
   "admin_view_payments_button": "💰 Payments",
+  "admin_user_ratings_button": "🏆 User Ratings",
+  "back_to_stats_monitoring_button": "⬅️ To Statistics",
+  "admin_user_ratings_header": "🏆 <b>User Ratings (TOP {top_limit})</b>",
+  "admin_user_ratings_traffic_title": "📊 By used traffic",
+  "admin_user_ratings_traffic_month_title": "📊 By used traffic (month)",
+  "admin_user_ratings_traffic_lifetime_title": "📊 By used traffic (lifetime)",
+  "admin_user_ratings_invited_title": "👥 By invited users",
+  "admin_user_ratings_revenue_title": "💸 By referral revenue",
+  "admin_user_ratings_traffic_item": "{rank}. {user} — <b>{traffic_gb} GB</b>",
+  "admin_user_ratings_invited_item": "{rank}. {user} — <b>{invited_count}</b>",
+  "admin_user_ratings_revenue_item": "{rank}. {user} — <b>{revenue} RUB</b>",
+  "admin_user_ratings_empty": "No data yet.",
   "admin_payments_header": "💰 <b>All Payments</b>",
   "admin_no_payments_found": "No payments found.",
   "admin_export_payments_csv": "📊 Export CSV",
@@ -210,9 +241,9 @@
   "admin_promo_edit_bonus_days": "🎁 Bonus Days",
   "admin_promo_edit_max_activations": "🔢 Max Activations",
   "admin_promo_edit_validity": "⏰ Validity",
-  "admin_ban_user_prompt": "Enter user ID or @username to ban:",
+  "admin_ban_user_prompt": "Enter user ID, @username, or email to ban:",
   "admin_user_already_banned": "User {user_id_or_username} is already banned.",
-  "admin_unban_user_prompt": "Enter user ID or @username to unban:",
+  "admin_unban_user_prompt": "Enter user ID, @username, or email to unban:",
   "admin_user_not_banned": "⚠️ User is not banned",
   "admin_banned_user_button_text": "{user_display} (ID: {user_id})",
   "prev_page_button": "⬅️ Prev.",
@@ -229,7 +260,7 @@
   "admin_export_logs_csv_button": "📄 Export to CSV",
   "admin_no_logs_found": "No logs found.",
   "admin_log_entry_format": "<code>{timestamp_str}</code> - <b>{user_display}</b> (ID: {user_id})\n  <i>{event_type}</i>: {content_preview}",
-  "admin_prompt_for_user_id_or_username_logs": "Enter user ID or @username to view logs:",
+  "admin_prompt_for_user_id_or_username_logs": "Enter user ID, @username, or email to view logs:",
   "admin_log_user_not_found": "User \"{input}\" not found in bot database.",
   "sync_started_simple": "🔄 Starting synchronization...",
   "sync_success_simple": "✅ Synchronization completed successfully",
@@ -240,16 +271,16 @@
   "admin_broadcast_invalid_html": "❌ Invalid HTML in message. Please send valid HTML (Telegram-supported tags) or remove tags.",
   "error_displaying_logs_too_long": "Error: logs too long to display in one message. Try viewing logs for a specific user.",
   "error_displaying_statistics": "Error displaying statistics.",
-  "subscription_72h_notification": "👋 Hi, {user_name}!\n\n⏳ Your VPN subscription expires in 3 days — {end_date}.\n\nPlease renew it using the button below.",
-  "subscription_48h_notification": "👋 Hi, {user_name}!\n\n⏳ Your VPN subscription expires in 2 days — {end_date}.\n\nPlease renew it using the button below.",
-  "subscription_24h_notification": "👋 Hi, {user_name}!\n\n⏳ Your VPN subscription expires in 1 day — {end_date}.\n\nPlease renew it using the button below.",
-  "subscription_expired_notification": "👋 Hi, {user_name}!\n\n⛔ Your VPN subscription expired on {end_date}.\n\nPlease renew it using the button below.",
-  "subscription_expired_yesterday_notification": "👋 Hi, {user_name}!\n\n⏳ Your VPN subscription expired yesterday ({end_date}).\n\nPlease renew it using the button below.",
+  "subscription_72h_notification": "👋 Hi, {user_name}!\n\n⏳ Your service subscription expires in 3 days — {end_date}.\n\nPlease renew it using the button below.",
+  "subscription_48h_notification": "👋 Hi, {user_name}!\n\n⏳ Your service subscription expires in 2 days — {end_date}.\n\nPlease renew it using the button below.",
+  "subscription_24h_notification": "👋 Hi, {user_name}!\n\n⏳ Your service subscription expires in 1 day — {end_date}.\n\nPlease renew it using the button below.",
+  "subscription_expired_notification": "👋 Hi, {user_name}!\n\n⛔ Your service subscription expired on {end_date}.\n\nPlease renew it using the button below.",
+  "subscription_expired_yesterday_notification": "👋 Hi, {user_name}!\n\n⏳ Your service subscription expired yesterday ({end_date}).\n\nPlease renew it using the button below.",
   "autorenew_48h_charge_tomorrow_notice": "🔔 Reminder\n\nTomorrow an automatic charge will occur to renew your subscription. If you don't want auto-renew, disable it using the button below.",
   "autorenew_confirm_enable": "🔄 Enable auto-renew? An automatic charge will be attempted before your subscription ends.",
   "autorenew_confirm_disable": "🛑 Disable auto-renew? No further automatic charges will occur.",
   "yookassa_auto_renewal": "🔄 <b>Subscription Auto-Renewed</b>\n\nYour subscription was automatically renewed for {months} month(s).\nNew expiration date: {end_date}",
-  "admin_user_management_prompt": "👤 User Management\n\nEnter user ID or @username to search:",
+  "admin_user_management_prompt": "👤 User Management\n\nEnter user ID, @username, or email to search:",
   "admin_user_subscription_info": "Subscription Information:",
   "admin_user_reset_trial_button": "🔄 Reset Trial",
   "admin_user_add_subscription_button": "➕ Add Days",
@@ -305,6 +336,9 @@
   "log_open_profile_link": "👤 Open profile",
   "log_open_referrer_profile_button": "👤 Referrer profile",
   "log_new_user_registration": "👤 <b>New User</b>\n\n🆔 ID: <code>{user_id}</code>\n👤 Name: {user_display}{referral_text}\n📅 Time: {timestamp}",
+  "log_new_email_user_registration": "📧 <b>New User (email)</b>\n\n🆔 ID: <code>{user_id}</code>\n📧 Email: <code>{email}</code>{referral_text}\n📅 Time: {timestamp}",
+  "log_account_email_linked": "📧 <b>Email linked</b>\n\n🆔 User ID: <code>{user_id}</code>\n📨 Telegram ID: <code>{telegram_id}</code>\n👤 User: {user_display}\n📧 Email: <code>{email}</code>\n🕐 Time: {timestamp}",
+  "log_account_telegram_linked": "📨 <b>Telegram linked</b>\n\n🆔 User ID: <code>{user_id}</code>\n📨 Telegram ID: <code>{telegram_id}</code>\n👤 User: {user_display}\n📧 Email: <code>{email}</code>\n🕐 Time: {timestamp}",
   "log_payment_received": "{provider_emoji} <b>Payment Received</b>\n\n👤 User: {user_display}\n💰 Amount: <b>{amount} {currency}</b>\n📅 Period: <b>{months} mo.</b>\n🏦 Provider: {payment_provider}\n🕐 Time: {timestamp}",
   "log_payment_received_traffic": "{provider_emoji} <b>Payment Received</b>\n\n👤 User: {user_display}\n💰 Amount: <b>{amount} {currency}</b>\n🗂 Traffic: <b>{traffic_gb} GB</b>\n🏦 Provider: {payment_provider}\n🕐 Time: {timestamp}",
   "log_promo_activation": "🎁 <b>Promo Code Activated</b>\n\n👤 User: {user_display}\n🏷 Code: <code>{promo_code}</code>\n🎯 Bonus: <b>+{bonus_days}d</b>\n🕐 Time: {timestamp}",
@@ -345,6 +379,8 @@
   "admin_user_id_label": "🆔 <b>ID:</b>",
   "admin_user_name_label": "👤 <b>Name:</b>",
   "admin_user_username_label": "📱 <b>Username:</b>",
+  "admin_user_email_label": "✉️ <b>Email:</b>",
+  "admin_user_telegram_id_label": "📨 <b>Telegram ID:</b>",
   "admin_user_language_label": "🌍 <b>Language:</b>",
   "admin_user_registration_label": "📅 <b>Registration:</b>",
   "admin_user_status_label": "🛡 <b>Status:</b>",
@@ -428,9 +464,10 @@
   "admin_payments_pagination_info": "📊 Showing {shown} of {total} payments (page {current_page}/{total_pages})",
   "admin_payment_traffic_label": "🗂 Traffic: <b>{traffic_gb} GB</b>",
   "admin_payment_months_label": "📅 Period: <b>{months} mo.</b>",
-  "my_subscription_details": "🔐 <b>My Subscription</b>\n\n⏰ Status: <b>{status}</b>\n📅 Active until: <b>{end_date}</b>\n📆 Days left: <b>{days_left}</b>\n\n🔗 Configuration link:\n<code>{config_link}</code>\n\n📊 Traffic:\nLimit: <b>{traffic_limit}</b>\nUsed: <b>{traffic_used}</b>",
-  "my_traffic_details": "🔐 <b>My Traffic</b>\n\n⏰ Status: <b>{status}</b>\n📅 Valid until: <b>{end_date}</b>\n\n🔗 Configuration link:\n<code>{config_link}</code>\n\n📊 Traffic:\nLimit: <b>{traffic_limit}</b>\nUsed: <b>{traffic_used}</b>\nLeft: <b>{traffic_left}</b>",
+  "my_subscription_details": "🔐 <b>My Subscription</b>\n\n⏰ Status: <b>{status}</b>\n📅 Active until: <b>{end_date}</b>\n📆 Days left: <b>{days_left}</b>\n\n🔗 Configuration link:\n<code>{config_link}</code>\n\n📊 Traffic ({traffic_period}):\nLimit: <b>{traffic_limit}</b>\nUsed: <b>{traffic_used}</b>",
+  "my_traffic_details": "🔐 <b>My Traffic</b>\n\n⏰ Status: <b>{status}</b>\n📅 Valid until: <b>{end_date}</b>\n\n🔗 Configuration link:\n<code>{config_link}</code>\n\n📊 Traffic ({traffic_period}):\nLimit: <b>{traffic_limit}</b>\nUsed: <b>{traffic_used}</b>\nLeft: <b>{traffic_left}</b>",
   "traffic_no_expiry": "no limit",
+  "traffic_period_unknown": "unknown",
   "autorenew_enable_button": "🔄 Enable auto-renew",
   "autorenew_disable_button": "🛑 Disable auto-renew",
   "subscription_autorenew_updated": "Auto-renew settings updated.",
@@ -486,5 +523,205 @@
   "admin_ads_delete_confirm": "Are you sure you want to delete campaign #{id}? This action is irreversible.",
   "admin_ads_deleted_success": "Campaign deleted.",
   "admin_ads_not_found": "Campaign not found.",
-  "free_kassa_order_full": "Order #{order_id} from {date}\n\n"
+  "free_kassa_order_full": "Order #{order_id} from {date}\n\n",
+  "email_footer_auto": "Sent automatically by {brand}. Please don't reply.",
+  "email_login_code_subject": "{code} — your sign-in code",
+  "email_login_code_preheader": "Your one-time code expires in {minutes} min.",
+  "email_login_code_heading": "Confirm your sign-in",
+  "email_login_code_intro": "Use this 6-digit code to finish signing in to your subscription dashboard.",
+  "email_login_code_expiry_html": "The code is valid for <strong style=\"color:#e6e9ef;\">{minutes} min</strong>.",
+  "email_login_code_security": "If you didn't request this code, you can ignore this email — your account stays safe.",
+  "email_login_code_magic_cta": "Sign in with one tap",
+  "email_login_code_magic_intro": "Don't want to type the code? Sign in with this link.",
+  "email_login_code_magic_hint": "The link is single-use and expires together with the code.",
+  "email_login_code_magic_or": "or",
+  "email_login_code_text": "Your verification code: {code}\n\nThe code is valid for {minutes} min.\nIf you didn't request this code, ignore this message.",
+  "email_login_code_text_magic": "Or sign in with this single-use link: {url}",
+  "email_account_merged_subject": "Accounts merged",
+  "email_account_merged_preheader": "Your accounts were combined into one profile.",
+  "email_account_merged_heading": "Accounts merged",
+  "email_account_merged_intro": "We merged your accounts into a single profile so you keep one subscription and one history of payments.",
+  "email_account_merged_row_kept": "Kept account",
+  "email_account_merged_row_removed": "Removed account",
+  "email_account_merged_row_end_date": "New end date",
+  "email_account_merged_note": "Your subscription link is unchanged. The duplicate panel user was removed automatically.",
+  "email_account_merged_text": "We merged your accounts into one profile.\n\nKept account: {primary}\nRemoved account: {removed}\nPaid periods were combined. New subscription end date: {end_date}.\nYour subscription link stayed the same, and the later account was removed from Remnawave automatically.",
+  "email_payment_success_subject": "Payment received",
+  "email_payment_success_preheader": "Thanks — your subscription has been activated.",
+  "email_payment_success_heading": "Payment received",
+  "email_payment_success_intro_subscription": "Thanks! Your subscription has been extended by {months} month(s).",
+  "email_payment_success_intro_traffic": "Thanks! We added {traffic_gb} GB of traffic to your account.",
+  "email_payment_success_row_period": "Period",
+  "email_payment_success_row_traffic": "Traffic added",
+  "email_payment_success_row_amount": "Amount",
+  "email_payment_success_row_end_date": "Active until",
+  "email_payment_success_row_method": "Method",
+  "email_payment_success_period_value": "{months} month(s)",
+  "email_payment_success_traffic_value": "{traffic_gb} GB",
+  "email_payment_success_cta": "Open dashboard",
+  "email_payment_success_footer_note": "We'll remind you a few days before the subscription ends.",
+  "email_payment_success_text_subscription": "Payment received: {amount}.\nSubscription extended by {months} month(s).\nActive until: {end_date}.",
+  "email_payment_success_text_traffic": "Payment received: {amount}.\nTraffic added: {traffic_gb} GB.\nActive until: {end_date}.",
+  "email_payment_success_text_dashboard": "Dashboard: {url}",
+  "email_subscription_expiring_subject_today": "Your subscription ends today",
+  "email_subscription_expiring_subject_tomorrow": "1 day left on your subscription",
+  "email_subscription_expiring_subject_days": "{days} days left on your subscription",
+  "email_subscription_expiring_heading_today": "Subscription ends today",
+  "email_subscription_expiring_heading_tomorrow": "1 day left on your subscription",
+  "email_subscription_expiring_heading_days": "{days} days left on your subscription",
+  "email_subscription_expiring_preheader_today": "Renew today to avoid disconnection.",
+  "email_subscription_expiring_preheader_tomorrow": "Your subscription expires tomorrow.",
+  "email_subscription_expiring_preheader_days": "Your subscription expires in {days} days.",
+  "email_subscription_expiring_intro_today": "Your subscription is about to expire. Renew now to keep your connection active without interruption.",
+  "email_subscription_expiring_intro_tomorrow": "Your subscription expires tomorrow. Renew now to avoid losing access.",
+  "email_subscription_expiring_intro_days": "A heads-up so you can renew in advance and avoid any interruption.",
+  "email_subscription_expiring_row_days_left": "Days left",
+  "email_subscription_expiring_row_end_date": "Active until",
+  "email_subscription_expiring_cta": "Renew subscription",
+  "email_subscription_expiring_note": "If you've already renewed or use auto-renewal, you can ignore this email.",
+  "email_subscription_expiring_text": "{heading}.\nActive until: {end_date}.",
+  "email_subscription_expiring_text_renew": "Renew: {url}",
+  "wa_loading": "Loading...",
+  "wa_back": "Back",
+  "wa_close": "Close",
+  "wa_auth_checking_login": "Checking sign-in...",
+  "wa_auth_login_confirm_failed": "Could not confirm sign-in",
+  "wa_auth_checking_telegram": "Checking Telegram...",
+  "wa_auth_access_denied": "Access denied",
+  "wa_auth_telegram_not_confirmed": "Telegram sign-in not confirmed",
+  "wa_auth_telegram_unavailable": "Telegram sign-in is currently unavailable",
+  "wa_auth_telegram_not_configured": "Telegram sign-in is not configured",
+  "wa_auth_telegram_cancelled": "Telegram sign-in was cancelled",
+  "wa_auth_invalid_email": "Enter a valid email",
+  "wa_auth_sending_code": "Sending code...",
+  "wa_auth_send_code_failed": "Failed to send code",
+  "wa_auth_enter_code_6digits": "Enter the 6-digit code from the email",
+  "wa_auth_checking_code": "Checking code...",
+  "wa_auth_invalid_code": "Invalid code",
+  "wa_auth_code_expired": "Code expired",
+  "wa_auth_resend_wait": "You can resend in {seconds} sec.",
+  "wa_email_verification_title": "Email confirmation",
+  "wa_email_sent_to": "We sent a code to {email}",
+  "wa_email_code_aria": "Verification code",
+  "wa_email_placeholder": "Email",
+  "wa_confirm": "Confirm",
+  "wa_resend_code": "Resend code",
+  "wa_send_code_email": "Send code to email",
+  "wa_or": "or",
+  "wa_login_telegram_button": "Sign in with Telegram",
+  "wa_auth_legal_intro": "By creating an account, you agree to the",
+  "wa_auth_legal_privacy": "privacy policy",
+  "wa_auth_legal_and": "and",
+  "wa_auth_legal_agreement": "user agreement",
+  "wa_home_subscription_active": "Subscription active",
+  "wa_home_access_active": "Access active",
+  "wa_sub_term_forever": "Forever",
+  "wa_sub_term_value_unit": "{value} {unit}",
+  "wa_sub_term_day_one": "day",
+  "wa_sub_term_day_few": "days",
+  "wa_sub_term_day_many": "days",
+  "wa_sub_term_month_one": "month",
+  "wa_sub_term_month_few": "months",
+  "wa_sub_term_month_many": "months",
+  "wa_sub_term_year_one": "year",
+  "wa_sub_term_year_few": "years",
+  "wa_sub_term_year_many": "years",
+  "wa_home_subscription_inactive": "Subscription inactive",
+  "wa_until_date": "until {date}",
+  "wa_home_traffic_used": "Traffic used",
+  "wa_renew": "Renew",
+  "wa_pay_subscription": "Pay subscription",
+  "wa_subscription_title": "Subscription",
+  "wa_subscription_choose_period": "Choose subscription period",
+  "wa_per_month_short": "/mo",
+  "wa_traffic_packages_title": "Traffic",
+  "wa_traffic_packages_choose": "Choose traffic package",
+  "wa_per_gb_short": "/GB",
+  "wa_buy_traffic": "Buy traffic",
+  "wa_activate_trial": "Activate trial",
+  "wa_trial_title": "Trial period",
+  "wa_trial_details": "{days} days, {traffic}",
+  "wa_trial_activated": "Trial activated",
+  "wa_trial_activation_failed": "Failed to activate trial",
+  "wa_install_and_configure": "Install and configure",
+  "wa_payment_methods_not_configured": "Payment methods are not configured yet",
+  "wa_pay": "Pay",
+  "wa_referral_link_title": "Your referral link",
+  "wa_link_unavailable": "Link is not available yet",
+  "wa_link_copied": "Link copied",
+  "wa_copy": "Copy",
+  "wa_referral_bonus_overview_title": "Bonus system",
+  "wa_referral_bonus_once_note": "Bonus is granted only once per invited user after their first payment.",
+  "wa_referral_bonus_registration_title": "For registration via referral link",
+  "wa_referral_bonus_paid_intro": "If a friend pays for a subscription:",
+  "wa_referral_bonus_you_days": "You: +{days} days",
+  "wa_referral_bonus_friend_days": "Friend: +{days} days",
+  "wa_referral_bonus_not_configured": "Referral bonuses are not configured",
+  "wa_promo_enter": "Enter promo code",
+  "wa_promo_activated_until": "Promo code activated. Subscription until {date}",
+  "wa_promo_activated": "Promo code activated",
+  "wa_promo_activation_failed": "Failed to activate promo code",
+  "wa_activate": "Activate",
+  "wa_settings_avatar_alt": "User avatar",
+  "wa_settings_language": "Language",
+  "wa_settings_link_telegram": "Telegram linked",
+  "wa_settings_not_linked": "Not linked",
+  "wa_settings_link_email": "Email linked",
+  "wa_settings_email_not_linked": "Not linked",
+  "wa_settings_linked": "Linked",
+  "wa_settings_language_update_failed": "Failed to update language",
+  "wa_settings_user_agreement": "User agreement",
+  "wa_settings_privacy_policy": "Privacy policy",
+  "wa_logout": "Log out",
+  "wa_end_session": "End session",
+  "wa_navigation": "Navigation",
+  "wa_nav_home": "Home",
+  "wa_nav_settings": "Settings",
+  "wa_nav_devices": "Devices",
+  "wa_devices_title": "My devices",
+  "wa_devices_count": "{current} of {max}",
+  "wa_devices_unlimited": "Unlimited",
+  "wa_devices_refresh": "Refresh devices",
+  "wa_devices_loading": "Loading devices...",
+  "wa_devices_load_failed": "Failed to load devices",
+  "wa_devices_empty": "No devices yet",
+  "wa_devices_empty_hint": "You can connect up to {max} devices from your subscription app.",
+  "wa_device_fallback_name": "Device {index}",
+  "wa_devices_platform_unknown": "Platform unknown",
+  "wa_devices_connected_at": "Connected",
+  "wa_devices_disconnect": "Disconnect device",
+  "wa_devices_disconnect_title": "Disconnect device",
+  "wa_devices_disconnect_desc": "{device} will be removed from your device list. It may connect again next time you use the subscription on that device.",
+  "wa_devices_disconnect_confirm": "Disconnect",
+  "wa_device_disconnected": "Device disconnected",
+  "wa_device_disconnect_failed": "Failed to disconnect device",
+  "wa_cancel": "Cancel",
+  "wa_payment_created": "Payment created",
+  "wa_payment_create_failed": "Failed to create payment",
+  "wa_connect_link_unavailable": "Connection link is not available yet",
+  "wa_copied": "Copied",
+  "wa_unavailable": "Not available yet",
+  "wa_method_other_title": "Other methods",
+  "wa_unlimited_traffic": "Unlimited traffic",
+  "wa_traffic_of": "{used} of {limit}",
+  "wa_language_default": "English",
+  "wa_telegram_not_linked": "Telegram not linked",
+  "wa_tg_id_not_linked": "TG ID not linked",
+  "wa_nav_bonuses": "Bonuses",
+  "wa_method_platega_sbp_card": "SBP/Card",
+  "wa_method_platega_crypto": "Crypto",
+  "wa_settings_link_telegram_action": "Link Telegram",
+  "wa_settings_telegram_linked_title": "Telegram linked",
+  "wa_settings_link_email_action": "Link email",
+  "wa_settings_email_linked_title": "Email linked",
+  "wa_activate_promo_title": "Activate promo code",
+  "wa_link_email_modal_title": "Link email",
+  "wa_traffic_reset_none": "No reset",
+  "wa_traffic_reset_monthly": "Monthly reset",
+  "wa_traffic_reset_weekly": "Weekly reset",
+  "wa_traffic_reset_daily": "Daily reset",
+  "wa_traffic_reset_yearly": "Yearly reset",
+  "wa_traffic_reset_policy": "Traffic reset policy",
+  "wa_plan_one_year": "1 year",
+  "wa_link_email_modal_desc": "Enter your email and get a verification code"
 }

locales/ru.json

@@ -5,18 +5,28 @@
   "channel_subscription_verify_button": "Проверить подписку",
   "channel_subscription_check_failed": "Не удалось проверить подписку. Попробуйте позже или обратитесь в поддержку.",
   "channel_subscription_verified_success": "✅ Подписка подтверждена! Можно продолжать.",
-  "main_menu_greeting": "Привет, {user_name}! 👋\nЧто бы вы хотели сделать?",
+  "webapp_auth_success": "✅ Вход подтвержден. Вернитесь в Web App.",
+  "webapp_auth_expired": "Ссылка авторизации устарела. Вернитесь в Web App и попробуйте еще раз.",
+  "main_menu_greeting": "Привет, {user_name}! 👋\nПерейдите в \"Личный кабинет\", чтобы настроить подключение, посмотреть подписку или продлить доступ.",
   "menu_activate_trial_button": "🆓 Пробный период",
   "menu_subscribe_inline": "🚀 Купить",
+  "menu_personal_account_button": "🔑 Личный кабинет",
+  "menu_bot_interface_button": "🤖 Бот-меню",
   "menu_my_subscription_inline": "🔐 Моя подписка",
   "no_subscription_options_available": "Выдача подписки не настроена администратором бота",
-  "menu_referral_inline": "🎁 Рефералы",
+  "menu_referral_inline": "🎁 Пригласить друга",
   "referral_no_bonuses_configured": "Извините, реферальная программа в данный момент отключена",
   "menu_apply_promo_button": "🎟 Промокод",
   "menu_language_settings_inline": "🌐 Язык",
   "menu_server_status_button": "📊 Статус",
   "menu_support_button": "💬 Поддержка",
   "menu_terms_button": "📄 Условия сервиса",
+  "menu_info_button": "ℹ️ Информация",
+  "bot_interface_menu_title": "Интерфейс в боте",
+  "bot_interface_menu_webapp_hint": "В личном кабинете взаимодействовать с сервисом будет удобнее.",
+  "info_links_message": "Выберите документ:",
+  "privacy_policy_button": "🔒 Политика конфиденциальности",
+  "user_agreement_button": "📄 Пользовательское соглашение",
   "back_to_main_menu_button": "⬅️ Назад",
   "choose_language": "Выберите язык / Select language:",
   "language_set_alert": "Язык изменен!",
@@ -41,12 +51,13 @@
   "yookassa_autopay_charge_initiated": "Запрос на списание с выбранной карты отправлен. Сообщим, как только платёж завершится.",
   "pay_with_sbp_button": "📱 СБП",
   "pay_with_platega_button": "💳 Platega (СБП/карты)",
+  "pay_with_platega_sbp_button": "🏦 Оплата через СБП",
+  "pay_with_platega_crypto_button": "🪙 Оплата криптой",
   "pay_with_severpay_button": "💳 SeverPay",
   "back_to_payment_methods_button": "⬅️ Назад",
   "pay_with_cryptopay_button": "💎 CryptoBot",
   "pay_with_stars_button": "🌟 Звезды Telegram",
   "connect_button": "🔗 Подключиться",
-
   "devices_button": "📱 Мои устройства ({current_devices}/{max_devices})",
   "my_devices_details": "📱 <b>Список ваших устройств ({current_devices}/{max_devices})</b>\n\n{devices}\n\nВы можете отключить устройство, выбрав его в списке ниже.\n<blockquote><i>Примечание: Если вы отключили устройство, оно будет автоматически подключено заново при следующем использовании. Перед удалением убедитесь, что вы удалили подписку из приложения.</i></blockquote>",
   "no_devices_details_found_message": "📱 <b>Список ваших устройств</b>\n\nУ вас пока нет устройств.\nВам доступно {max_devices} устройств. Подключить их можно через кнопку \"🔗 Подключиться\" в меню подписки.",
@@ -56,7 +67,6 @@
   "no_devices_found": "Ошибка загрузки списка устройств.",
   "devices_unlimited_label": "Без ограничений",
   "my_devices_feature_disabled": "Раздел \"Мои устройства\" сейчас недоступен.",
-
   "cancel_button": "❌ Отмена",
   "payment_description_subscription": "Оплата подписки на {months} мес.",
   "payment_description_traffic": "Пакет трафика {traffic_gb} ГБ",
@@ -72,8 +82,14 @@
   "payment_failed": "❌ Оплата не удалась или была отменена. Пожалуйста, попробуйте еще раз или свяжитесь с поддержкой.",
   "config_link_not_available": "недоступна, обратитесь в поддержку",
   "traffic_unlimited": "Безлимитный",
+  "traffic_period_day": "за день",
+  "traffic_period_week": "за неделю",
+  "traffic_period_month": "за месяц",
+  "traffic_period_no_reset": "без сброса",
+  "traffic_used_with_period": "{traffic_used} ({traffic_period})",
   "promo_code_prompt": "Пожалуйста, введите ваш промокод:",
   "promo_code_not_found": "Промокод <code>{code}</code> не найден, истек или уже использован максимальное количество раз.",
+  "promo_code_too_many_attempts": "Слишком много неудачных попыток ввода промокода. Повторите через {seconds} сек.",
   "promo_code_already_used_by_user": "Вы уже активировали промокод <code>{code}</code>.",
   "promo_code_applied_success_full": "✅ Промокод успешно применен!\nПодписка активна до {end_date}.\n\nКлюч подключения:\n<code>{config_link}</code>\n\nЧтобы подключиться, перейдите по ссылке и следуйте инструкции 👇",
   "error_applying_promo_bonus": "Не удалось применить бонус по промокоду. Пожалуйста, попробуйте позже или свяжитесь с поддержкой.",
@@ -83,13 +99,16 @@
   "trial_confirm_activate_button": "✅ Активировать!",
   "trial_activated_alert": "Пробный период активирован!",
   "trial_activated_details_message": "✅ Пробный доступ активирован!\nВаш триал на {days} дн. действует до {end_date}.\n\nКлюч подключения:\n<code>{config_link}</code>\n\nЧтобы подключиться, перейдите по ссылке и следуйте инструкции 👇",
+  "referral_welcome_bonus_applied": "🎁 Вам начислено {days} бонусных дн. за регистрацию по реферальной ссылке!\nПодписка активна до {end_date}.",
   "yes_button": "Да",
   "no_button": "Нет",
-  "referral_program_info_new": "🎁 <b>Реферальная программа</b>\n\n📊 <b>Твоя статистика:</b>\n👥 Приглашено друзей: <b>{invited_count}</b>\n💳 Купили подписку: <b>{purchased_count}</b>\n\n🔗 Твоя ссылка:\n<code>{referral_link}</code>\n\n💰 <b>Бонусы за приглашения:</b>\n{bonus_details}\n\n📢 Поделись ссылкой с друзьями и получай бонусы!",
+  "referral_program_info_new": "🎁 <b>Реферальная программа</b>\n\n📊 <b>Твоя статистика:</b>\n👥 Приглашено друзей: <b>{invited_count}</b>\n💳 Купили подписку: <b>{purchased_count}</b>\n\n🔗 Telegram ссылка:\n<code>{referral_link}</code>{webapp_link_section}\n\n💰 <b>Бонусы за приглашения:</b>\n{bonus_details}\n\n📢 Поделись ссылкой с друзьями и получай бонусы!",
   "referral_bonus_per_period": "\n\n🎁 За {months}-мес. подписку друга:\n  ➢ Вы: <b>{inviter_bonus_days} дн.</b>\n  ➢ Друг: <b>{referee_bonus_days} дн.</b>",
   "referral_not_available_for_traffic": "Для пакетов трафика реферальные бонусы не начисляются.",
   "referral_share_message_button": "📩 Сообщение для друга",
-  "referral_friend_message": "🚀 Привет! Попробуй этот VPN - быстрый, надёжный и доступный!\n\n🎁 По моей ссылке тебе дадут бонусные дни к подписке!\n\n{referral_link}",
+  "referral_friend_message": "🚀 Привет! Попробуй этот сервис - быстрый, надёжный и доступный!\n\n🎁 По моей ссылке тебе дадут бонусные дни к подписке!\n\n{referral_link}",
+  "referral_friend_message_with_webapp": "🚀 Привет! Попробуй этот сервис - быстрый, надёжный и доступный!\n\n🎁 По моей ссылке тебе дадут бонусные дни к подписке!\n\nTelegram: {referral_link}\nWeb: {webapp_referral_link}",
+  "referral_webapp_link_line": "\n🌐 Web ссылка:\n<code>{webapp_referral_link}</code>",
   "friend_placeholder": "друг",
   "referral_bonus_inviter_notification_extended": "🎉 Поздравляем! Ваш друг {referee_name} оплатил подписку. Вам начислено {days} бонусных дней! Ваша подписка теперь активна до {new_end_date}.",
   "referral_bonus_inviter_notification_new_sub": "🎉 Поздравляем! Ваш друг {referee_name} оплатил подписку. Вам начислена бонусная подписка на {days} дней! Она активна до {new_end_date}.",
@@ -123,6 +142,18 @@
   "admin_stats_payment_item": "{status_emoji} {amount} {currency} от {user_info} ({p_status}) [{p_date}]",
   "admin_stats_no_payments_found": "Платежей пока нет.",
   "admin_view_payments_button": "💰 Платежи",
+  "admin_user_ratings_button": "🏆 Рейтинг пользователей",
+  "back_to_stats_monitoring_button": "⬅️ К статистике",
+  "admin_user_ratings_header": "🏆 <b>Рейтинг пользователей (ТОП {top_limit})</b>",
+  "admin_user_ratings_traffic_title": "📊 По использованному трафику",
+  "admin_user_ratings_traffic_month_title": "📊 По использованному трафику за месяц",
+  "admin_user_ratings_traffic_lifetime_title": "📊 По использованному трафику за всё время",
+  "admin_user_ratings_invited_title": "👥 По количеству приглашенных",
+  "admin_user_ratings_revenue_title": "💸 По доходу с приглашенных",
+  "admin_user_ratings_traffic_item": "{rank}. {user} — <b>{traffic_gb} ГБ</b>",
+  "admin_user_ratings_invited_item": "{rank}. {user} — <b>{invited_count}</b>",
+  "admin_user_ratings_revenue_item": "{rank}. {user} — <b>{revenue} RUB</b>",
+  "admin_user_ratings_empty": "Пока нет данных.",
   "admin_payments_header": "💰 <b>Все платежи</b>",
   "admin_no_payments_found": "Платежи не найдены.",
   "admin_export_payments_csv": "📊 Экспорт CSV",
@@ -169,11 +200,11 @@
   "admin_promo_invalid_max_activations": "Максимальное количество активаций должно быть положительным числом.",
   "admin_promo_invalid_validity_days": "Срок действия промокода (в днях) должен быть положительным числом.",
   "admin_promo_created_success": "✅ Промокод <code>{code}</code> успешно создан!\nБонус: {bonus_days} дней\nМакс. активаций: {max_activations}\nДействителен: {valid_until_str}",
-  "subscription_72h_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на VPN истекает через 3 дня — {end_date}.\n\nПродлите её по кнопке ниже.",
-  "subscription_48h_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на VPN истекает через 2 дня — {end_date}.\n\nПродлите её по кнопке ниже.",
-  "subscription_24h_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на VPN истекает через 1 день — {end_date}.\n\nПродлите её по кнопке ниже.",
-  "subscription_expired_notification": "👋 Привет, {user_name}!\n\n⛔ Срок вашей подписки на VPN истек ({end_date}).\n\nПродлите её по кнопке ниже.",
-  "subscription_expired_yesterday_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на VPN истекла сутки назад ({end_date}).\n\nПродлите её по кнопке ниже.",
+  "subscription_72h_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на сервис истекает через 3 дня — {end_date}.\n\nПродлите её по кнопке ниже.",
+  "subscription_48h_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на сервис истекает через 2 дня — {end_date}.\n\nПродлите её по кнопке ниже.",
+  "subscription_24h_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на сервис истекает через 1 день — {end_date}.\n\nПродлите её по кнопке ниже.",
+  "subscription_expired_notification": "👋 Привет, {user_name}!\n\n⛔ Срок вашей подписки на сервис истек ({end_date}).\n\nПродлите её по кнопке ниже.",
+  "subscription_expired_yesterday_notification": "👋 Привет, {user_name}!\n\n⏳ Ваша подписка на сервис истекла сутки назад ({end_date}).\n\nПродлите её по кнопке ниже.",
   "autorenew_48h_charge_tomorrow_notice": "🔔 Напоминание\n\nЗавтра будет автоматическое списание за продление подписки. Если вы не хотите автопродление — отключите его кнопкой ниже.",
   "autorenew_confirm_enable": "🔄 Включить автопродление? Перед окончанием подписки будет выполняться автосписание.",
   "autorenew_confirm_disable": "🛑 Отключить автопродление? Автосписаний больше не будет.",
@@ -219,9 +250,9 @@
   "admin_promo_edit_bonus_days": "🎁 Бонусные дни",
   "admin_promo_edit_max_activations": "🔢 Макс. активации",
   "admin_promo_edit_validity": "⏰ Срок действия",
-  "admin_ban_user_prompt": "Введите ID или @username пользователя для блокировки:",
+  "admin_ban_user_prompt": "Введите ID, @username или email пользователя для блокировки:",
   "admin_user_already_banned": "Пользователь {user_id_or_username} уже заблокирован.",
-  "admin_unban_user_prompt": "Введите ID или @username пользователя для разблокировки:",
+  "admin_unban_user_prompt": "Введите ID, @username или email пользователя для разблокировки:",
   "admin_user_not_banned": "⚠️ Пользователь не заблокирован",
   "admin_banned_user_button_text": "{user_display} (ID: {user_id})",
   "prev_page_button": "⬅️ Пред.",
@@ -238,7 +269,7 @@
   "admin_export_logs_csv_button": "📄 Экспорт в CSV",
   "admin_no_logs_found": "Логи не найдены.",
   "admin_log_entry_format": "<code>{timestamp_str}</code> - <b>{user_display}</b> (ID: {user_id})\n  <i>{event_type}</i>: {content_preview}",
-  "admin_prompt_for_user_id_or_username_logs": "Введите ID или @username пользователя для просмотра его логов:",
+  "admin_prompt_for_user_id_or_username_logs": "Введите ID, @username или email пользователя для просмотра его логов:",
   "admin_log_user_not_found": "Пользователь по запросу \"{input}\" не найден в базе данных бота.",
   "sync_started_simple": "🔄 Начинаю синхронизацию...",
   "sync_success_simple": "✅ Синхронизация успешно завершена",
@@ -249,7 +280,7 @@
   "admin_broadcast_invalid_html": "❌ Некорректный HTML в сообщении. Пожалуйста, отправьте корректный HTML (поддерживаются теги Telegram) или уберите теги.",
   "error_displaying_logs_too_long": "Ошибка: логи слишком длинные для отображения одним сообщением. Попробуйте найти логи по конкретному пользователю.",
   "error_displaying_statistics": "Ошибка отображения статистики.",
-  "admin_user_management_prompt": "👤 Управление пользователями\n\nВведите ID пользователя или @username для поиска:",
+  "admin_user_management_prompt": "👤 Управление пользователями\n\nВведите ID пользователя, @username или email для поиска:",
   "admin_user_subscription_info": "Информация о подписке:",
   "admin_user_reset_trial_button": "🔄 Сбросить триал",
   "admin_user_add_subscription_button": "➕ Добавить дни",
@@ -305,6 +336,9 @@
   "log_open_profile_link": "👤 Открыть профиль",
   "log_open_referrer_profile_button": "👤 Профиль пригласившего",
   "log_new_user_registration": "👤 <b>Новый пользователь</b>\n\n🆔 ID: <code>{user_id}</code>\n👤 Имя: {user_display}{referral_text}\n📅 Время: {timestamp}",
+  "log_new_email_user_registration": "📧 <b>Новый пользователь (email)</b>\n\n🆔 ID: <code>{user_id}</code>\n📧 Email: <code>{email}</code>{referral_text}\n📅 Время: {timestamp}",
+  "log_account_email_linked": "📧 <b>Привязана почта</b>\n\n🆔 ID пользователя: <code>{user_id}</code>\n📨 Telegram ID: <code>{telegram_id}</code>\n👤 Пользователь: {user_display}\n📧 Email: <code>{email}</code>\n🕐 Время: {timestamp}",
+  "log_account_telegram_linked": "📨 <b>Привязан Telegram</b>\n\n🆔 ID пользователя: <code>{user_id}</code>\n📨 Telegram ID: <code>{telegram_id}</code>\n👤 Пользователь: {user_display}\n📧 Email: <code>{email}</code>\n🕐 Время: {timestamp}",
   "log_payment_received": "{provider_emoji} <b>Получен платеж</b>\n\n👤 Пользователь: {user_display}\n💰 Сумма: <b>{amount} {currency}</b>\n📅 Период: <b>{months} мес.</b>\n🏦 Провайдер: {payment_provider}\n🕐 Время: {timestamp}",
   "log_payment_received_traffic": "{provider_emoji} <b>Получен платеж</b>\n\n👤 Пользователь: {user_display}\n💰 Сумма: <b>{amount} {currency}</b>\n🗂 Трафик: <b>{traffic_gb} ГБ</b>\n🏦 Провайдер: {payment_provider}\n🕐 Время: {timestamp}",
   "log_promo_activation": "🎁 <b>Активирован промокод</b>\n\n👤 Пользователь: {user_display}\n🏷 Код: <code>{promo_code}</code>\n🎯 Бонус: <b>+{bonus_days} дн.</b>\n🕐 Время: {timestamp}",
@@ -345,6 +379,8 @@
   "admin_user_id_label": "🆔 <b>ID:</b>",
   "admin_user_name_label": "👤 <b>Имя:</b>",
   "admin_user_username_label": "📱 <b>Username:</b>",
+  "admin_user_email_label": "✉️ <b>Email:</b>",
+  "admin_user_telegram_id_label": "📨 <b>Telegram ID:</b>",
   "admin_user_language_label": "🌍 <b>Язык:</b>",
   "admin_user_registration_label": "📅 <b>Регистрация:</b>",
   "admin_user_status_label": "🛡 <b>Статус:</b>",
@@ -428,9 +464,10 @@
   "admin_payments_pagination_info": "📊 Показано {shown} из {total} платежей (стр. {current_page}/{total_pages})",
   "admin_payment_traffic_label": "🗂 Трафик: <b>{traffic_gb} ГБ</b>",
   "admin_payment_months_label": "📅 Период: <b>{months} мес.</b>",
-  "my_subscription_details": "🔐 <b>Моя подписка</b>\n\n⏰ Статус: <b>{status}</b>\n📅 Действует до: <b>{end_date}</b>\n📆 Осталось дней: <b>{days_left}</b>\n\n🔗 Ссылка на конфигурацию:\n<code>{config_link}</code>\n\n📊 Трафик:\nЛимит: <b>{traffic_limit}</b>\nИспользовано: <b>{traffic_used}</b>",
-  "my_traffic_details": "🔐 <b>Мой трафик</b>\n\n⏰ Статус: <b>{status}</b>\n📅 Действует до: <b>{end_date}</b>\n\n🔗 Ссылка на конфигурацию:\n<code>{config_link}</code>\n\n📊 Трафик:\nЛимит: <b>{traffic_limit}</b>\nИспользовано: <b>{traffic_used}</b>\nОсталось: <b>{traffic_left}</b>",
+  "my_subscription_details": "🔐 <b>Моя подписка</b>\n\n⏰ Статус: <b>{status}</b>\n📅 Действует до: <b>{end_date}</b>\n📆 Осталось дней: <b>{days_left}</b>\n\n🔗 Ссылка на конфигурацию:\n<code>{config_link}</code>\n\n📊 Трафик ({traffic_period}):\nЛимит: <b>{traffic_limit}</b>\nИспользовано: <b>{traffic_used}</b>",
+  "my_traffic_details": "🔐 <b>Мой трафик</b>\n\n⏰ Статус: <b>{status}</b>\n📅 Действует до: <b>{end_date}</b>\n\n🔗 Ссылка на конфигурацию:\n<code>{config_link}</code>\n\n📊 Трафик ({traffic_period}):\nЛимит: <b>{traffic_limit}</b>\nИспользовано: <b>{traffic_used}</b>\nОсталось: <b>{traffic_left}</b>",
   "traffic_no_expiry": "без ограничения",
+  "traffic_period_unknown": "неизвестно",
   "autorenew_enable_button": "🔄 Включить автопродление",
   "autorenew_disable_button": "🛑 Отключить автопродление",
   "subscription_autorenew_updated": "Настройки автопродления обновлены.",
@@ -486,5 +523,205 @@
   "admin_ads_delete_confirm": "Вы уверены, что хотите удалить кампанию #{id}? Это действие необратимо.",
   "admin_ads_deleted_success": "Кампания удалена.",
   "admin_ads_not_found": "Кампания не найдена.",
-  "free_kassa_order_full": "Заказ №{order_id} от {date}\n\n"
+  "free_kassa_order_full": "Заказ №{order_id} от {date}\n\n",
+  "email_footer_auto": "Это автоматическое письмо от {brand}. Отвечать на него не нужно.",
+  "email_login_code_subject": "{code} — код для входа",
+  "email_login_code_preheader": "Одноразовый код действует {minutes} мин.",
+  "email_login_code_heading": "Подтвердите вход",
+  "email_login_code_intro": "Введите этот 6-значный код, чтобы завершить вход в личный кабинет подписки.",
+  "email_login_code_expiry_html": "Код действует <strong style=\"color:#e6e9ef;\">{minutes} мин</strong>.",
+  "email_login_code_security": "Если вы не запрашивали код, просто проигнорируйте это письмо — ваш аккаунт в безопасности.",
+  "email_login_code_magic_cta": "Войти одним нажатием",
+  "email_login_code_magic_intro": "Не хотите вводить код? Войдите по ссылке.",
+  "email_login_code_magic_hint": "Ссылка одноразовая и действует столько же, сколько код.",
+  "email_login_code_magic_or": "или",
+  "email_login_code_text": "Ваш код подтверждения: {code}\n\nКод действует {minutes} мин.\nЕсли вы не запрашивали код, проигнорируйте это письмо.",
+  "email_login_code_text_magic": "Или войдите по ссылке (одноразовая): {url}",
+  "email_account_merged_subject": "Аккаунты объединены",
+  "email_account_merged_preheader": "Мы объединили ваши аккаунты в один профиль.",
+  "email_account_merged_heading": "Аккаунты объединены",
+  "email_account_merged_intro": "Мы объединили ваши аккаунты в один профиль — теперь у вас одна подписка и общая история оплат.",
+  "email_account_merged_row_kept": "Оставлен аккаунт",
+  "email_account_merged_row_removed": "Удалён аккаунт",
+  "email_account_merged_row_end_date": "Новая дата окончания",
+  "email_account_merged_note": "Ссылка на подписку осталась прежней. Дублирующий пользователь панели был удалён автоматически.",
+  "email_account_merged_text": "Мы объединили ваши аккаунты в один профиль.\n\nОставлен аккаунт: {primary}\nУдалён аккаунт: {removed}\nОплаченные периоды сложились. Новая дата окончания подписки: {end_date}.\nСсылка на подписку осталась прежней, а более поздний аккаунт был удалён из Remnawave автоматически.",
+  "email_payment_success_subject": "Платёж получен",
+  "email_payment_success_preheader": "Спасибо — подписка активирована.",
+  "email_payment_success_heading": "Платёж получен",
+  "email_payment_success_intro_subscription": "Спасибо! Ваша подписка продлена на {months} мес.",
+  "email_payment_success_intro_traffic": "Спасибо! Мы зачислили {traffic_gb} ГБ трафика на ваш аккаунт.",
+  "email_payment_success_row_period": "Период",
+  "email_payment_success_row_traffic": "Трафик",
+  "email_payment_success_row_amount": "Сумма",
+  "email_payment_success_row_end_date": "Действует до",
+  "email_payment_success_row_method": "Способ оплаты",
+  "email_payment_success_period_value": "{months} мес.",
+  "email_payment_success_traffic_value": "{traffic_gb} ГБ",
+  "email_payment_success_cta": "Открыть кабинет",
+  "email_payment_success_footer_note": "За несколько дней до окончания мы напомним о продлении.",
+  "email_payment_success_text_subscription": "Платёж получен: {amount}.\nПодписка продлена на {months} мес.\nДействует до: {end_date}.",
+  "email_payment_success_text_traffic": "Платёж получен: {amount}.\nЗачислено трафика: {traffic_gb} ГБ.\nДействует до: {end_date}.",
+  "email_payment_success_text_dashboard": "Кабинет: {url}",
+  "email_subscription_expiring_subject_today": "Подписка заканчивается сегодня",
+  "email_subscription_expiring_subject_tomorrow": "Подписка заканчивается завтра",
+  "email_subscription_expiring_subject_days": "До конца подписки осталось {days} дн.",
+  "email_subscription_expiring_heading_today": "Подписка заканчивается сегодня",
+  "email_subscription_expiring_heading_tomorrow": "Подписка заканчивается завтра",
+  "email_subscription_expiring_heading_days": "До конца подписки {days} дн.",
+  "email_subscription_expiring_preheader_today": "Продлите сегодня, чтобы не потерять доступ.",
+  "email_subscription_expiring_preheader_tomorrow": "Подписка истекает завтра.",
+  "email_subscription_expiring_preheader_days": "Подписка заканчивается через {days} дн.",
+  "email_subscription_expiring_intro_today": "Ваша подписка вот-вот истечёт. Продлите её, чтобы соединение не прерывалось.",
+  "email_subscription_expiring_intro_tomorrow": "Ваша подписка истекает завтра. Продлите её, чтобы не потерять доступ.",
+  "email_subscription_expiring_intro_days": "Напоминаем заранее, чтобы вы успели продлить подписку без перерыва в работе.",
+  "email_subscription_expiring_row_days_left": "Осталось дней",
+  "email_subscription_expiring_row_end_date": "Действует до",
+  "email_subscription_expiring_cta": "Продлить подписку",
+  "email_subscription_expiring_note": "Если вы уже продлили или включили автопродление — просто проигнорируйте это письмо.",
+  "email_subscription_expiring_text": "{heading}.\nДействует до: {end_date}.",
+  "email_subscription_expiring_text_renew": "Продлить: {url}",
+  "wa_loading": "Загрузка...",
+  "wa_back": "Назад",
+  "wa_close": "Закрыть",
+  "wa_auth_checking_login": "Проверяем вход...",
+  "wa_auth_login_confirm_failed": "Не удалось подтвердить вход",
+  "wa_auth_checking_telegram": "Проверяем Telegram...",
+  "wa_auth_access_denied": "Доступ запрещен",
+  "wa_auth_telegram_not_confirmed": "Telegram-вход не подтвержден",
+  "wa_auth_telegram_unavailable": "Telegram-вход сейчас недоступен",
+  "wa_auth_telegram_not_configured": "Telegram-вход не настроен",
+  "wa_auth_telegram_cancelled": "Вход через Telegram отменён",
+  "wa_auth_invalid_email": "Введите корректный email",
+  "wa_auth_sending_code": "Отправляем код...",
+  "wa_auth_send_code_failed": "Не удалось отправить код",
+  "wa_auth_enter_code_6digits": "Введите 6 цифр из письма",
+  "wa_auth_checking_code": "Проверяем код...",
+  "wa_auth_invalid_code": "Неверный код",
+  "wa_auth_code_expired": "Код устарел",
+  "wa_auth_resend_wait": "Повторная отправка через {seconds} сек.",
+  "wa_email_verification_title": "Подтверждение по email",
+  "wa_email_sent_to": "Мы отправили код на {email}",
+  "wa_email_code_aria": "Код подтверждения",
+  "wa_email_placeholder": "Email",
+  "wa_confirm": "Подтвердить",
+  "wa_resend_code": "Отправить код повторно",
+  "wa_send_code_email": "Отправить код на почту",
+  "wa_or": "или",
+  "wa_login_telegram_button": "Войти через телеграм",
+  "wa_auth_legal_intro": "Создавая аккаунт, вы соглашаетесь с",
+  "wa_auth_legal_privacy": "политикой конфиденциальности",
+  "wa_auth_legal_and": "и",
+  "wa_auth_legal_agreement": "пользовательским соглашением",
+  "wa_home_subscription_active": "Подписка активна",
+  "wa_home_access_active": "Доступ активен",
+  "wa_sub_term_forever": "Навсегда",
+  "wa_sub_term_value_unit": "{value} {unit}",
+  "wa_sub_term_day_one": "день",
+  "wa_sub_term_day_few": "дня",
+  "wa_sub_term_day_many": "дней",
+  "wa_sub_term_month_one": "месяц",
+  "wa_sub_term_month_few": "месяца",
+  "wa_sub_term_month_many": "месяцев",
+  "wa_sub_term_year_one": "год",
+  "wa_sub_term_year_few": "года",
+  "wa_sub_term_year_many": "лет",
+  "wa_home_subscription_inactive": "Подписка не активна",
+  "wa_until_date": "до {date}",
+  "wa_home_traffic_used": "Использовано трафика",
+  "wa_renew": "Продлить",
+  "wa_pay_subscription": "Оплатить подписку",
+  "wa_subscription_title": "Подписка",
+  "wa_subscription_choose_period": "Выберите срок подписки",
+  "wa_per_month_short": "/мес",
+  "wa_traffic_packages_title": "Трафик",
+  "wa_traffic_packages_choose": "Выберите пакет трафика",
+  "wa_per_gb_short": "/ГБ",
+  "wa_buy_traffic": "Купить трафик",
+  "wa_activate_trial": "Активировать триал",
+  "wa_trial_title": "Пробный период",
+  "wa_trial_details": "{days} дн., {traffic}",
+  "wa_trial_activated": "Пробный период активирован",
+  "wa_trial_activation_failed": "Не удалось активировать пробный период",
+  "wa_install_and_configure": "Установить и настроить",
+  "wa_payment_methods_not_configured": "Способы оплаты пока не настроены",
+  "wa_pay": "Оплатить",
+  "wa_referral_link_title": "Ваша реферальная ссылка",
+  "wa_link_unavailable": "Ссылка пока недоступна",
+  "wa_link_copied": "Ссылка скопирована",
+  "wa_copy": "Копировать",
+  "wa_referral_bonus_overview_title": "Система бонусов",
+  "wa_referral_bonus_once_note": "Бонус за приглашённого начисляется только один раз, после его первой оплаты.",
+  "wa_referral_bonus_registration_title": "За регистрацию по реферальной ссылке",
+  "wa_referral_bonus_paid_intro": "Если друг оплатит подписку:",
+  "wa_referral_bonus_you_days": "Вам: +{days} дней",
+  "wa_referral_bonus_friend_days": "Другу: +{days} дней",
+  "wa_referral_bonus_not_configured": "Реферальные бонусы не настроены",
+  "wa_promo_enter": "Введите промокод",
+  "wa_promo_activated_until": "Промокод активирован. Подписка до {date}",
+  "wa_promo_activated": "Промокод активирован",
+  "wa_promo_activation_failed": "Не удалось активировать промокод",
+  "wa_activate": "Активировать",
+  "wa_settings_avatar_alt": "Аватар пользователя",
+  "wa_settings_language": "Выбор языка",
+  "wa_settings_link_telegram": "Привязка Telegram",
+  "wa_settings_not_linked": "Не привязан",
+  "wa_settings_link_email": "Привязка почты",
+  "wa_settings_email_not_linked": "Не привязана",
+  "wa_settings_linked": "Привязано",
+  "wa_settings_language_update_failed": "Не удалось обновить язык",
+  "wa_settings_user_agreement": "Пользовательское соглашение",
+  "wa_settings_privacy_policy": "Политика конфиденциальности",
+  "wa_logout": "Выйти",
+  "wa_end_session": "Завершить сессию",
+  "wa_navigation": "Навигация",
+  "wa_nav_home": "Главная",
+  "wa_nav_settings": "Настройки",
+  "wa_nav_devices": "Устройства",
+  "wa_devices_title": "Мои устройства",
+  "wa_devices_count": "{current} из {max}",
+  "wa_devices_unlimited": "Без ограничений",
+  "wa_devices_refresh": "Обновить устройства",
+  "wa_devices_loading": "Загружаем устройства...",
+  "wa_devices_load_failed": "Не удалось загрузить устройства",
+  "wa_devices_empty": "Устройств пока нет",
+  "wa_devices_empty_hint": "Можно подключить до {max} устройств через приложение с подпиской.",
+  "wa_device_fallback_name": "Устройство {index}",
+  "wa_devices_platform_unknown": "Платформа неизвестна",
+  "wa_devices_connected_at": "Подключено",
+  "wa_devices_disconnect": "Отключить устройство",
+  "wa_devices_disconnect_title": "Отключить устройство",
+  "wa_devices_disconnect_desc": "{device} будет удалено из списка устройств. Оно может подключиться снова при следующем использовании подписки на этом устройстве.",
+  "wa_devices_disconnect_confirm": "Отключить",
+  "wa_device_disconnected": "Устройство отключено",
+  "wa_device_disconnect_failed": "Не удалось отключить устройство",
+  "wa_cancel": "Отмена",
+  "wa_payment_created": "Платеж создан",
+  "wa_payment_create_failed": "Не удалось создать платеж",
+  "wa_connect_link_unavailable": "Ссылка для подключения пока недоступна",
+  "wa_copied": "Скопировано",
+  "wa_unavailable": "Пока недоступно",
+  "wa_method_other_title": "Другие способы",
+  "wa_unlimited_traffic": "Безлимитный трафик",
+  "wa_traffic_of": "{used} из {limit}",
+  "wa_language_default": "Русский",
+  "wa_telegram_not_linked": "Telegram не привязан",
+  "wa_tg_id_not_linked": "TG ID не привязан",
+  "wa_nav_bonuses": "Бонусы",
+  "wa_method_platega_sbp_card": "СБП/Карта",
+  "wa_method_platega_crypto": "Крипта",
+  "wa_settings_link_telegram_action": "Привязать телеграм",
+  "wa_settings_telegram_linked_title": "Телеграм привязан",
+  "wa_settings_link_email_action": "Привязать почту",
+  "wa_settings_email_linked_title": "Почта привязана",
+  "wa_activate_promo_title": "Активировать промокод",
+  "wa_link_email_modal_title": "Привязать почту",
+  "wa_traffic_reset_none": "Без сброса",
+  "wa_traffic_reset_monthly": "Сброс ежемесячно",
+  "wa_traffic_reset_weekly": "Сброс еженедельно",
+  "wa_traffic_reset_daily": "Сброс ежедневно",
+  "wa_traffic_reset_yearly": "Сброс ежегодно",
+  "wa_traffic_reset_policy": "Стратегия сброса трафика",
+  "wa_plan_one_year": "1 год",
+  "wa_link_email_modal_desc": "Введите email и получите код подтверждения"
 }

main.py

@@ -11,22 +11,10 @@ from db.database_setup import init_db, init_db_connection
 
 
 def _resolve_log_level(value: str) -> int:
-    if not value:
-        return logging.INFO
-    if isinstance(value, str):
-        normalized = value.strip()
-        if not normalized:
-            return logging.INFO
-        if normalized.isdigit():
-            return int(normalized)
-        level = getattr(logging, normalized.upper(), None)
-        if isinstance(level, int):
-            return level
-    return logging.INFO
+    return getattr(logging, value.upper(), logging.INFO)
 
 
 async def main():
-    load_dotenv()
     settings = get_settings()
 
     session_factory = init_db_connection(settings)

package.json

@@ -0,0 +1,22 @@
+{
+  "private": true,
+  "scripts": {
+    "build:webapp:svelte": "vite build --config ./bot/app/web/frontend/vite.config.mjs",
+    "build:webapp:css": "npm run build:webapp:svelte",
+    "build:webapp:js": "node ./scripts/build_subscription_webapp_js.mjs",
+    "build:webapp": "npm run build:webapp:svelte && npm run build:webapp:js"
+  },
+  "devDependencies": {
+    "@sveltejs/vite-plugin-svelte": "^7.0.0",
+    "@tailwindcss/cli": "4.2.4",
+    "bits-ui": "^2.18.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "esbuild": "^0.28.0",
+    "lucide-svelte": "^1.0.1",
+    "svelte": "^5.55.5",
+    "tailwind-merge": "^3.5.0",
+    "tailwindcss": "4.2.4",
+    "vite": "^8.0.10"
+  }
+}

requirements.txt

@@ -3,8 +3,10 @@ python-dotenv==1.2.1
 aiohttp==3.13.3
 pydantic==2.12.5
 yookassa==3.9.0
-nalogo==1.0.0
+httpx>=0.27.0
 pydantic_settings==2.12.0
+email-validator==2.3.0
 sqlalchemy[asyncio]==2.0.45
 asyncpg==0.31.0
 aiocryptopay==0.4.8
+PyJWT[crypto]==2.10.1

scratch_divs.py

@@ -0,0 +1,159 @@
+import re
+
+html_path = "bot/app/web/templates/subscription_webapp.html"
+
+with open(html_path, 'r', encoding='utf-8') as f:
+    html = f.read()
+
+replacements = {
+    r'class="flex items-start justify-between gap-3"': 'class="panel-head"',
+    r'class="text-lg font-extrabold leading-tight text-\[var\(--text-primary\)\]"': 'class="section-title"',
+    r'class="mt-\[3px\] text-\[13px\] text-\[var\(--text-secondary\)\]"': 'class="section-caption"',
+    r'class="min-w-0 font-\[family-name:var\(--font-mono\)\] text-\[11px\] font-bold text-\[var\(--text-muted\)\]"': 'class="metric-label"',
+    r'class="min-w-0 text-right text-sm font-bold text-\[var\(--text-primary\)\]"': 'class="metric-value"',
+    r'class="m-0 text-\[32px\] font-extrabold leading-\[1\.08\] text-\[var\(--text-primary\)\]"': 'class="main-value"',
+    r'class="mt-1\.5 mb-0 text-sm leading-\[1\.45\] text-\[var\(--text-secondary\)\]"': 'class="main-caption"',
+    r'class="login-text login-status hidden m-0 min-h-5 text-sm leading-\[1\.45\] text-\[var\(--text-secondary\)\]"': 'class="status-text hidden"',
+    r'class="login-text login-status hidden"': 'class="status-text hidden"',
+    r'class="actions grid min-w-0 grid-cols-\[minmax\(0,1fr\)_48px\] gap-2"': 'class="actions-row"',
+    r'class="hidden flex flex-wrap justify-center gap-x-4 gap-y-1\.5"': 'class="legal-links hidden"',
+    r'class="flex min-h-12 items-center justify-between gap-3"': 'class="app-header"',
+    r'class="flex min-w-0 items-center gap-2\.5"': 'class="app-header-title"',
+    r'class="flex min-w-0 items-center gap-2"': 'class="app-header-actions"',
+    r'class="flex min-w-0 items-center justify-between gap-2\.5"': 'class="panel-head-sm"',
+    r'class="flex min-w-0 items-center justify-center gap-3\.5"': 'class="login-head"',
+}
+
+for pattern, repl in replacements.items():
+    html = re.sub(pattern, repl, html)
+
+with open(html_path, 'w', encoding='utf-8') as f:
+    f.write(html)
+
+js_path = "bot/app/web/templates/subscription_webapp.js"
+with open(js_path, 'r', encoding='utf-8') as f:
+    js = f.read()
+
+js_replacements = {
+    r"panelHead: 'flex items-start justify-between gap-3',": "panelHead: 'panel-head',",
+    r"flowCaption: 'mt-\[3px\] text-\[13px\] text-\[var\(--text-secondary\)\]',": "flowCaption: 'section-caption',",
+    r"sectionTitle: 'text-lg font-extrabold leading-tight text-\[var\(--text-primary\)\]',": "sectionTitle: 'section-title',",
+    r"metricLabel: 'min-w-0 font-\[family-name:var\(--font-mono\)\] text-\[11px\] font-bold text-\[var\(--text-muted\)\]',": "metricLabel: 'metric-label',",
+    r"metricValue: 'min-w-0 text-right text-sm font-bold text-\[var\(--text-primary\)\]',": "metricValue: 'metric-value',",
+    r"referralLinkRow: 'grid min-h-\[58px\] grid-cols-\[minmax\(0,1fr\)_48px\] items-center gap-2\.5 rounded-\[var\(--radius-md\)\] border border-\[var\(--border\)\] bg-\[rgba\(255,255,255,0\.02\)\] px-3 py-\[11px\]',": "referralLinkRow: 'referral-link-row',",
+    r"referralLinkValue: 'mt-1 font-\[family-name:var\(--font-mono\)\] text-xs font-bold leading-\[1\.35\] text-\[var\(--text-primary\)\]',": "referralLinkValue: 'referral-link-value',",
+    r"bonusRow: 'grid min-h-\[58px\] grid-cols-\[minmax\(0,0\.8fr\)_minmax\(0,1\.2fr\)\] items-center gap-2\.5 rounded-\[var\(--radius-md\)\] border border-\[var\(--border\)\] bg-\[rgba\(255,255,255,0\.02\)\] px-3 py-\[11px\]',": "bonusRow: 'bonus-row',",
+    r"empty: 'rounded-\[var\(--radius-md\)\] border border-\[var\(--border\)\] bg-\[rgba\(255,255,255,0\.02\)\] p-\[13px\] text-sm leading-\[1\.45\] text-\[var\(--text-secondary\)\]',": "empty: 'empty-state',",
+    r"planCard: 'flex min-h-16 w-full min-w-0 items-center justify-between gap-3 rounded-\[var\(--radius-md\)\] border border-\[var\(--border\)\] bg-\[rgba\(255,255,255,0\.02\)\] p-\[13px\] text-left text-\[var\(--text-primary\)\] transition-\[transform,border-color,background,box-shadow\] hover:-translate-y-0\.5 hover:border-\[color-mix\(in_srgb,var\(--accent\)_42%,var\(--border\)\)\] hover:bg-\[var\(--bg-card-hover\)\]',": "planCard: 'plan-card',",
+    r"planCardActive: 'border-\[var\(--accent\)\] bg-\[color-mix\(in_srgb,var\(--accent\)_8%,transparent\)\] ring-1 ring-\[color-mix\(in_srgb,var\(--accent\)_58%,transparent\)\] shadow-\[0_12px_30px_rgba\(0,0,0,0\.2\)\]',": "planCardActive: 'plan-card-active',",
+    r"planName: 'block text-\[15px\] font-extrabold leading-tight',": "planName: 'plan-name',",
+    r"planMeta: 'mt-1 block font-\[family-name:var\(--font-mono\)\] text-\[11px\] font-bold leading-\[1\.3\] text-\[var\(--text-muted\)\]',": "planMeta: 'plan-meta',",
+    r"planPrice: 'block max-w-\[48%\] flex-none text-right font-\[family-name:var\(--font-mono\)\] text-\[15px\] font-extrabold leading-tight text-\[var\(--accent\)\]',": "planPrice: 'plan-price',",
+    r"notice: 'rounded-\[var\(--radius-md\)\] border border-\[var\(--border\)\] bg-\[rgba\(255,255,255,0\.02\)\] p-\[13px\] text-sm leading-\[1\.45\] text-\[var\(--text-secondary\)\]',": "notice: 'notice',",
+    r"stepNum: 'block font-\[family-name:var\(--font-mono\)\] text-\[11px\] font-extrabold leading-\[1\.1\] text-current',": "stepNum: 'step-num',",
+    r"stepName: 'mt-1 block text-xs font-extrabold leading-\[1\.15\] text-current'": "stepName: 'step-name'"
+}
+
+for pattern, repl in js_replacements.items():
+    js = re.sub(pattern, repl, js)
+
+with open(js_path, 'w', encoding='utf-8') as f:
+    f.write(js)
+
+# CSS additions
+css_path = "bot/app/web/templates/subscription_webapp.tailwind.css"
+with open(css_path, 'r', encoding='utf-8') as f:
+    css = f.read()
+
+new_components = """
+  .panel-head {
+    @apply flex items-start justify-between gap-3;
+  }
+  .section-title {
+    @apply text-lg font-extrabold leading-tight text-[var(--text-primary)];
+  }
+  .section-caption {
+    @apply mt-[3px] text-[13px] text-[var(--text-secondary)];
+  }
+  .metric-label {
+    @apply min-w-0 font-[family-name:var(--font-mono)] text-[11px] font-bold text-[var(--text-muted)];
+  }
+  .metric-value {
+    @apply min-w-0 text-right text-sm font-bold text-[var(--text-primary)];
+  }
+  .referral-link-row {
+    @apply grid min-h-[58px] grid-cols-[minmax(0,1fr)_48px] items-center gap-2.5 rounded-[var(--radius-md)] border border-[var(--border)] bg-[rgba(255,255,255,0.02)] px-3 py-[11px];
+  }
+  .referral-link-value {
+    @apply mt-1 font-[family-name:var(--font-mono)] text-xs font-bold leading-[1.35] text-[var(--text-primary)];
+  }
+  .bonus-row {
+    @apply grid min-h-[58px] grid-cols-[minmax(0,0.8fr)_minmax(0,1.2fr)] items-center gap-2.5 rounded-[var(--radius-md)] border border-[var(--border)] bg-[rgba(255,255,255,0.02)] px-3 py-[11px];
+  }
+  .empty-state {
+    @apply rounded-[var(--radius-md)] border border-[var(--border)] bg-[rgba(255,255,255,0.02)] p-[13px] text-sm leading-[1.45] text-[var(--text-secondary)];
+  }
+  .plan-card {
+    @apply flex min-h-16 w-full min-w-0 items-center justify-between gap-3 rounded-[var(--radius-md)] border border-[var(--border)] bg-[rgba(255,255,255,0.02)] p-[13px] text-left text-[var(--text-primary)] transition-[transform,border-color,background,box-shadow] hover:-translate-y-0.5 hover:border-[color-mix(in_srgb,var(--accent)_42%,var(--border))] hover:bg-[var(--bg-card-hover)];
+    transition-duration: 200ms;
+  }
+  .plan-card-active {
+    @apply border-[var(--accent)] bg-[color-mix(in_srgb,var(--accent)_8%,transparent)] ring-1 ring-[color-mix(in_srgb,var(--accent)_58%,transparent)] shadow-[0_12px_30px_rgba(0,0,0,0.2)];
+  }
+  .plan-name {
+    @apply block text-[15px] font-extrabold leading-tight;
+  }
+  .plan-meta {
+    @apply mt-1 block font-[family-name:var(--font-mono)] text-[11px] font-bold leading-[1.3] text-[var(--text-muted)];
+  }
+  .plan-price {
+    @apply block max-w-[48%] flex-none text-right font-[family-name:var(--font-mono)] text-[15px] font-extrabold leading-tight text-[var(--accent)];
+  }
+  .notice {
+    @apply rounded-[var(--radius-md)] border border-[var(--border)] bg-[rgba(255,255,255,0.02)] p-[13px] text-sm leading-[1.45] text-[var(--text-secondary)];
+  }
+  .step-num {
+    @apply block font-[family-name:var(--font-mono)] text-[11px] font-extrabold leading-[1.1] text-current;
+  }
+  .step-name {
+    @apply mt-1 block text-xs font-extrabold leading-[1.15] text-current;
+  }
+  .main-value {
+    @apply m-0 text-[32px] font-extrabold leading-[1.08] text-[var(--text-primary)];
+  }
+  .main-caption {
+    @apply mt-1.5 mb-0 text-sm leading-[1.45] text-[var(--text-secondary)];
+  }
+  .status-text {
+    @apply m-0 min-h-5 text-sm leading-[1.45] text-[var(--text-secondary)];
+  }
+  .legal-links {
+    @apply flex flex-wrap justify-center gap-x-4 gap-y-1.5;
+  }
+  .actions-row {
+    @apply grid min-w-0 grid-cols-[minmax(0,1fr)_48px] gap-2;
+  }
+  .app-header {
+    @apply flex min-h-12 items-center justify-between gap-3;
+  }
+  .app-header-title {
+    @apply flex min-w-0 items-center gap-2.5;
+  }
+  .app-header-actions {
+    @apply flex min-w-0 items-center gap-2;
+  }
+  .panel-head-sm {
+    @apply flex min-w-0 items-center justify-between gap-2.5;
+  }
+  .login-head {
+    @apply flex min-w-0 items-center justify-center gap-3.5;
+  }
+"""
+
+css_split = css.split('.btn {')
+new_css = css_split[0] + new_components + '\n  .btn {' + css_split[1]
+
+with open(css_path, 'w', encoding='utf-8') as f:
+    f.write(new_css)
+
+print("Done")

scratch_find.py

@@ -0,0 +1,8 @@
+import re
+
+with open('bot/app/web/templates/subscription_webapp.html', 'r', encoding='utf-8') as f:
+    html = f.read()
+
+long_classes = set(re.findall(r'class="([^"]{40,})"', html))
+for cls in long_classes:
+    print(f"--- LONG CLASS ({len(cls)} chars) ---\n{cls}\n")

scripts/build_subscription_webapp_js.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readFile, readdir, unlink, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { transform } from "esbuild";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, "..");
+const sourcePath = path.join(
+  repoRoot,
+  "bot",
+  "app",
+  "web",
+  "templates",
+  "subscription_webapp.js",
+);
+
+function normalizeLineEndings(value) {
+  return value.replace(/\r\n/g, "\n");
+}
+
+function stripMarkedBlock(source, startMarker, endMarker) {
+  const start = source.indexOf(startMarker);
+  if (start === -1) {
+    return source;
+  }
+  const end = source.indexOf(endMarker, start);
+  if (end === -1) {
+    return source.slice(0, start);
+  }
+  return source.slice(0, start) + source.slice(end + endMarker.length);
+}
+
+function stripFallbackI18n(source) {
+  const fallbackStart = source.indexOf("    const FALLBACK_I18N = {");
+  const i18nLine = "    const I18N = readJsonScript('i18n') || (MOCK && MOCK.i18n) || FALLBACK_I18N;";
+  const i18nLineIndex = source.indexOf(i18nLine);
+  if (fallbackStart === -1 || i18nLineIndex === -1 || i18nLineIndex < fallbackStart) {
+    return source;
+  }
+
+  return (
+    source.slice(0, fallbackStart)
+    + "    const I18N = readJsonScript('i18n') || (MOCK && MOCK.i18n) || {};\n"
+    + source.slice(i18nLineIndex + i18nLine.length)
+  );
+}
+
+async function removeOldMinifiedAssets(assetDir, keepName) {
+  const entries = await readdir(assetDir, { withFileTypes: true });
+  await Promise.all(
+    entries
+      .filter(
+        (entry) => entry.isFile() && /^subscription_webapp\.min\.[0-9a-f]{8}\.js$/.test(entry.name) && entry.name !== keepName,
+      )
+      .map((entry) => unlink(path.join(assetDir, entry.name))),
+  );
+}
+
+async function main() {
+  const rawSource = await readFile(sourcePath, "utf8");
+  const withoutMocks = stripMarkedBlock(
+    normalizeLineEndings(rawSource),
+    "/* WEBAPP_DEV_MOCK_START */",
+    "/* WEBAPP_DEV_MOCK_END */",
+  );
+  const strippedSource = stripFallbackI18n(withoutMocks);
+  const result = await transform(strippedSource, {
+    charset: "utf8",
+    legalComments: "none",
+    loader: "js",
+    minify: true,
+    target: "es2018",
+  });
+
+  const code = `${result.code.replace(/[ \t]+$/gm, "").trimEnd()}\n`;
+  const hash = createHash("sha256").update(code, "utf8").digest("hex").slice(0, 8);
+  const outputPath = path.join(
+    path.dirname(sourcePath),
+    `subscription_webapp.min.${hash}.js`,
+  );
+
+  await removeOldMinifiedAssets(path.dirname(sourcePath), path.basename(outputPath));
+  await writeFile(outputPath, code, "utf8");
+  console.log(`Wrote ${path.relative(repoRoot, outputPath)} (${Buffer.byteLength(code, "utf8")} bytes)`);
+}
+
+await main();

scripts/migrate_to_minishop.sh

@@ -0,0 +1,303 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=""
+
+OLD_PREFIX="remnawave-tg-shop"
+NEW_PREFIX="remnawave-minishop"
+OLD_DB_VOLUME="${OLD_PREFIX}-db-data"
+NEW_DB_VOLUME="${NEW_PREFIX}-db-data"
+OLD_CADDY_VOLUMES=("${OLD_PREFIX}-caddy-data" "${OLD_PREFIX}-caddy-config")
+NEW_CADDY_VOLUMES=("${NEW_PREFIX}-caddy-data" "${NEW_PREFIX}-caddy-config")
+KNOWN_CONTAINERS=(
+  "${OLD_PREFIX}"
+  "${OLD_PREFIX}-db"
+  "${OLD_PREFIX}-caddy"
+  "${NEW_PREFIX}"
+  "${NEW_PREFIX}-db"
+  "${NEW_PREFIX}-caddy"
+)
+
+log() {
+  printf '%s\n' "$*"
+}
+
+die() {
+  printf 'Ошибка: %s\n' "$*" >&2
+  exit 1
+}
+
+require_cmd() {
+  command -v "$1" >/dev/null 2>&1 || die "Не найдено обязательное средство \`$1\` в PATH."
+}
+
+resolve_root() {
+  if [[ -n "${PROJECT_ROOT:-}" ]]; then
+    [[ -d "$PROJECT_ROOT" ]] || die "PROJECT_ROOT не существует: $PROJECT_ROOT"
+    (cd -- "$PROJECT_ROOT" >/dev/null && pwd -P)
+    return
+  fi
+
+  local git_root
+  if git_root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
+    printf '%s\n' "$git_root"
+    return
+  fi
+
+  pwd -P
+}
+
+run() {
+  log "+ $*"
+  "$@"
+}
+
+container_exists() {
+  docker inspect "$1" >/dev/null 2>&1
+}
+
+container_running() {
+  [[ "$(docker inspect -f '{{.State.Running}}' "$1" 2>/dev/null || true)" == "true" ]]
+}
+
+stop_container() {
+  local name="$1"
+
+  if ! container_exists "$name"; then
+    return 1
+  fi
+
+  if container_running "$name"; then
+    docker stop "$name" >/dev/null
+  fi
+  docker rm "$name" >/dev/null
+}
+
+volume_exists() {
+  docker volume inspect "$1" >/dev/null 2>&1
+}
+
+volume_is_empty() {
+  docker run --rm -v "$1:/data" alpine sh -c 'test -z "$(find /data -mindepth 1 -print -quit)"' >/dev/null 2>&1
+}
+
+copy_volume() {
+  local source="$1"
+  local target="$2"
+
+  if ! volume_exists "$source"; then
+    log "  - Пропускаю том \`$source\`: исходный том не найден."
+    return 1
+  fi
+
+  if volume_exists "$target" && ! volume_is_empty "$target"; then
+    log "  - Пропускаю том \`$target\`: он уже не пустой."
+    return 1
+  fi
+
+  if ! volume_exists "$target"; then
+    die "Целевой том \`$target\` не создан Compose. Сначала нужно подготовить новый стек в режиме \`--no-start\`."
+  fi
+
+  docker run --rm -v "$source:/from:ro" -v "$target:/to" alpine sh -c 'cd /from && cp -a . /to/'
+}
+
+is_old_postgres_host() {
+  grep -Eq "^[[:space:]]*POSTGRES_HOST[[:space:]]*=[[:space:]]*${OLD_PREFIX}-db[[:space:]]*(#.*)?$" "$ROOT/.env"
+}
+
+is_new_postgres_host() {
+  grep -Eq "^[[:space:]]*POSTGRES_HOST[[:space:]]*=[[:space:]]*${NEW_PREFIX}-db[[:space:]]*(#.*)?$" "$ROOT/.env"
+}
+
+update_postgres_host() {
+  if is_old_postgres_host; then
+    sed -i.bak -E "s|^([[:space:]]*POSTGRES_HOST[[:space:]]*=[[:space:]]*)${OLD_PREFIX}-db([[:space:]]*(#.*)?)$|\\1${NEW_PREFIX}-db\\2|" "$ROOT/.env"
+    log "  - \`.env\` обновлён, резервная копия сохранена в \`.env.bak\`."
+  elif is_new_postgres_host; then
+    log "  - \`POSTGRES_HOST\` уже указывает на новый контейнер, ничего менять не нужно."
+  else
+    log "  - \`POSTGRES_HOST\` не похож на старую схему, пропускаю изменение."
+  fi
+}
+
+main() {
+  require_cmd git
+  require_cmd docker
+  docker info >/dev/null
+
+  ROOT="$(resolve_root)"
+
+  local compose_file="${COMPOSE_FILE:-docker-compose.yml}"
+  local target_branch="${TARGET_BRANCH:-main}"
+  local git_remote="${GIT_REMOTE:-origin}"
+  local new_origin_url="${NEW_ORIGIN_URL:-}"
+  local assume_yes="${ASSUME_YES:-0}"
+  local current_origin
+  local current_branch
+  local remote_ref
+  local head_commit
+  local compose_has_build=0
+  local compose_has_caddy=0
+  local -a compose_cmd
+  local -a running_containers=()
+  local -a summary=()
+  local -a up_args
+  local name
+  local source
+  local target
+  local answer
+
+  if [[ $compose_file != /* ]]; then
+    compose_file="$ROOT/$compose_file"
+  fi
+  [[ -f "$compose_file" ]] || die "Compose-файл не найден: $compose_file"
+  [[ -e "$ROOT/.git" ]] || die "Скрипт нужно запускать из корня git-репозитория."
+  [[ -f "$ROOT/.env" ]] || die "Не найден \`.env\` в корне репозитория."
+
+  if docker compose version >/dev/null 2>&1; then
+    compose_cmd=(docker compose)
+  elif command -v docker-compose >/dev/null 2>&1; then
+    compose_cmd=(docker-compose)
+  else
+    die "Не найден ни \`docker compose\`, ни \`docker-compose\`."
+  fi
+
+  if [[ -n "$(git -C "$ROOT" status --porcelain=v1)" ]]; then
+    die "В рабочем дереве есть незакоммиченные изменения. Сначала сохраните их, чтобы миграция не затёрла чужие правки."
+  fi
+
+  if grep -Eq '^[[:space:]]*build:[[:space:]]*' "$compose_file"; then
+    compose_has_build=1
+  fi
+  if grep -Eq '^[[:space:]]*caddy:[[:space:]]*$' "$compose_file"; then
+    compose_has_caddy=1
+  fi
+
+  for name in "${KNOWN_CONTAINERS[@]}"; do
+    if container_exists "$name"; then
+      running_containers+=("$name")
+    fi
+  done
+
+  current_origin="$(git -C "$ROOT" remote get-url "$git_remote")"
+  if [[ -n "$new_origin_url" && "$current_origin" != "$new_origin_url" ]]; then
+    summary+=( "обновить $git_remote с \`$current_origin\` на \`$new_origin_url\`" )
+  fi
+  summary+=( "скачать ветку \`$target_branch\` из \`$git_remote\`" )
+  if volume_exists "$OLD_DB_VOLUME"; then
+    summary+=( "проверить том БД \`$OLD_DB_VOLUME\` и перенести в \`$NEW_DB_VOLUME\` при необходимости" )
+  fi
+  if ((compose_has_caddy)); then
+    for i in 0 1; do
+      source="${OLD_CADDY_VOLUMES[$i]}"
+      target="${NEW_CADDY_VOLUMES[$i]}"
+      if volume_exists "$source"; then
+        summary+=( "проверить том \`$source\` и перенести в \`$target\` при необходимости" )
+      fi
+    done
+  fi
+  if is_old_postgres_host; then
+    summary+=( "обновить \`POSTGRES_HOST\` в \`.env\`" )
+  fi
+  summary+=( "подготовить новый стек через Compose в режиме \`--no-start\`" )
+  summary+=( "запустить compose-файл \`$(basename "$compose_file")\`" )
+
+  if [[ "$assume_yes" != "1" ]]; then
+    if [[ ! -t 0 ]]; then
+      die "Скрипт ожидает интерактивное подтверждение. Запустите с \`ASSUME_YES=1\` для неинтерактивного режима."
+    fi
+    log "План миграции:"
+    for name in "${summary[@]}"; do
+      log "  - $name"
+    done
+    read -r -p "Продолжить? [y/N]: " answer
+    case "$answer" in
+      y|Y|yes|YES|Yes)
+        ;;
+      *)
+        die "Миграция отменена пользователем."
+        ;;
+    esac
+  fi
+
+  log "1. Останавливаю старый стек"
+  if ((${#running_containers[@]})); then
+    for name in "${running_containers[@]}"; do
+      stop_container "$name"
+      log "  - контейнер \`$name\` остановлен/удалён"
+    done
+  else
+    log "  - запущенных контейнеров старой схемы не найдено"
+  fi
+
+  if [[ -n "$new_origin_url" && "$current_origin" != "$new_origin_url" ]]; then
+    log "2. Обновляю origin"
+    run git -C "$ROOT" remote set-url "$git_remote" "$new_origin_url"
+  else
+    log "2. Origin уже актуален, пропускаю"
+  fi
+
+  log "3. Обновляю git до ветки \`$target_branch\`"
+  run git -C "$ROOT" fetch "$git_remote" "$target_branch"
+
+  current_branch="$(git -C "$ROOT" branch --show-current || true)"
+  if [[ -z "$current_branch" ]]; then
+    current_branch="$(git -C "$ROOT" rev-parse --abbrev-ref HEAD)"
+  fi
+
+  if [[ "$current_branch" != "$target_branch" ]]; then
+    if git -C "$ROOT" show-ref --verify --quiet "refs/heads/$target_branch"; then
+      run git -C "$ROOT" switch "$target_branch"
+    else
+      run git -C "$ROOT" switch -c "$target_branch" --track "$git_remote/$target_branch"
+    fi
+  else
+    log "  - уже на ветке \`$target_branch\`"
+  fi
+
+  remote_ref="$(git -C "$ROOT" rev-parse "$git_remote/$target_branch")"
+  head_commit="$(git -C "$ROOT" rev-parse HEAD)"
+  if [[ "$head_commit" != "$remote_ref" ]]; then
+    run git -C "$ROOT" pull --ff-only "$git_remote" "$target_branch"
+  else
+    log "  - локальная ветка уже совпадает с удалённой, \`git pull\` не нужен"
+  fi
+
+  log "4. Обновляю \`.env\`"
+  update_postgres_host
+
+  log "5. Подготавливаю новый стек через Compose"
+  if ((compose_has_build)); then
+    run "${compose_cmd[@]}" -f "$compose_file" up --no-start --build
+  else
+    run "${compose_cmd[@]}" -f "$compose_file" up --no-start
+  fi
+
+  log "6. Переношу тома"
+  if copy_volume "$OLD_DB_VOLUME" "$NEW_DB_VOLUME"; then
+    log "  - БД перенесена в \`$NEW_DB_VOLUME\`"
+  fi
+  if ((compose_has_caddy)); then
+    for i in 0 1; do
+      source="${OLD_CADDY_VOLUMES[$i]}"
+      target="${NEW_CADDY_VOLUMES[$i]}"
+      if copy_volume "$source" "$target"; then
+        log "  - \`$source\` перенесён в \`$target\`"
+      fi
+    done
+  fi
+
+  log "7. Запускаю новый стек"
+  if ((compose_has_build)); then
+    up_args=(up -d --build --remove-orphans)
+  else
+    up_args=(up -d --remove-orphans)
+  fi
+  run "${compose_cmd[@]}" -f "$compose_file" "${up_args[@]}"
+  run "${compose_cmd[@]}" -f "$compose_file" ps
+
+  log "Готово."
+}
+
+main "$@"

tests/test_security.py

@@ -0,0 +1,261 @@
+import hashlib
+import hmac
+import unittest
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+from aiohttp import web
+
+from bot.app.web import subscription_webapp
+from bot.app.web.webapp_auth import (
+    create_telegram_oauth_nonce,
+    create_webapp_session_token,
+    verify_telegram_oauth_nonce,
+)
+from bot.services.crypto_pay_service import CryptoPayService
+from bot.handlers.user.payment import yookassa_webhook_route
+from bot.services.freekassa_service import FreeKassaService
+from bot.utils.request_security import request_client_ip
+
+
+class RequestSecurityTests(unittest.IsolatedAsyncioTestCase):
+    async def test_request_client_ip_uses_last_forwarded_for_value_for_trusted_proxy(self):
+        request = SimpleNamespace(
+            remote="127.0.0.1",
+            headers={"X-Forwarded-For": "203.0.113.10, 198.51.100.7"},
+        )
+
+        self.assertEqual(
+            request_client_ip(request, trusted_proxies=["127.0.0.1"]),
+            "198.51.100.7",
+        )
+
+    async def test_yookassa_webhook_rejects_untrusted_ip_before_reading_body(self):
+        request = SimpleNamespace(
+            app={
+                "bot": object(),
+                "i18n": object(),
+                "settings": SimpleNamespace(trusted_proxies=["127.0.0.1"]),
+                "panel_service": object(),
+                "subscription_service": object(),
+                "referral_service": object(),
+                "lknpd_service": None,
+                "async_session_factory": object(),
+            },
+            headers={},
+            remote="203.0.113.50",
+            json=AsyncMock(side_effect=AssertionError("request.json() must not be called")),
+        )
+
+        response = await yookassa_webhook_route(request)
+
+        self.assertEqual(response.status, 403)
+        request.json.assert_not_awaited()
+
+
+class FreeKassaServiceTests(unittest.TestCase):
+    def _make_service(self) -> FreeKassaService:
+        settings = SimpleNamespace(
+            FREEKASSA_ENABLED=True,
+            FREEKASSA_MERCHANT_ID="123456",
+            FREEKASSA_API_KEY="api-key",
+            FREEKASSA_SECOND_SECRET="second-secret",
+            DEFAULT_CURRENCY_SYMBOL="RUB",
+            FREEKASSA_PAYMENT_IP="203.0.113.10",
+            FREEKASSA_PAYMENT_METHOD_ID=44,
+            FREEKASSA_TRUSTED_IPS="127.0.0.1,203.0.113.0/24",
+            trusted_proxies=["127.0.0.1"],
+            freekassa_trusted_ips=["127.0.0.1", "203.0.113.0/24"],
+        )
+        return FreeKassaService(
+            bot=object(),
+            settings=settings,
+            i18n=object(),
+            async_session_factory=object(),
+            subscription_service=object(),
+            referral_service=object(),
+        )
+
+    def test_validate_signature_accepts_hmac_sha256_raw_body(self):
+        service = self._make_service()
+        raw_body = b'{"amount":"199.00","o":"42"}'
+        expected_signature = hmac.new(
+            service.second_secret.encode("utf-8"),
+            raw_body,
+            hashlib.sha256,
+        ).hexdigest()
+
+        self.assertTrue(service._validate_signature(raw_body, expected_signature))
+
+    def test_validate_signature_rejects_wrong_signature(self):
+        service = self._make_service()
+
+        self.assertFalse(service._validate_signature(b"payload", "not-a-signature"))
+
+    def test_webhook_rejects_unauthorized_ip_before_body_read(self):
+        service = self._make_service()
+        request = SimpleNamespace(
+            remote="198.51.100.250",
+            headers={},
+            read=AsyncMock(side_effect=AssertionError("request.read() must not be called")),
+        )
+
+        response = asyncio_run(service.webhook_route(request))
+
+        self.assertEqual(response.status, 403)
+        request.read.assert_not_awaited()
+
+
+class CryptoPayServiceTests(unittest.TestCase):
+    def _make_service(self) -> CryptoPayService:
+        service = CryptoPayService.__new__(CryptoPayService)
+        service.token = "cryptopay-token"
+        return service
+
+    def test_validate_webhook_signature_accepts_valid_signature(self):
+        service = self._make_service()
+        raw_body = b'{"payload":"42"}'
+        expected_signature = hmac.new(
+            hashlib.sha256(service.token.encode("utf-8")).digest(),
+            raw_body,
+            hashlib.sha256,
+        ).hexdigest()
+
+        self.assertTrue(service._validate_webhook_signature(raw_body, expected_signature))
+
+    def test_validate_webhook_signature_rejects_invalid_signature(self):
+        service = self._make_service()
+
+        self.assertFalse(service._validate_webhook_signature(b"payload", "not-a-signature"))
+
+
+class WebAppSecurityTests(unittest.IsolatedAsyncioTestCase):
+    def test_require_user_id_falls_back_to_cookie_session(self):
+        settings = SimpleNamespace(
+            WEBAPP_SESSION_SECRET="session-secret",
+            WEBAPP_SESSION_TTL_SECONDS=3600,
+        )
+        token = create_webapp_session_token(settings, 321)
+        request = SimpleNamespace(
+            app={"settings": settings},
+            headers={},
+            cookies={"rw_webapp_session": token},
+        )
+
+        self.assertEqual(subscription_webapp._require_user_id(request), 321)
+
+    async def test_csrf_middleware_rejects_mismatched_token_when_cookie_session_exists(self):
+        settings = SimpleNamespace(
+            WEBAPP_SESSION_SECRET="session-secret",
+            WEBAPP_SESSION_TTL_SECONDS=3600,
+        )
+        request = SimpleNamespace(
+            method="POST",
+            path="/api/payments",
+            headers={"X-CSRF-Token": "bad-token"},
+            cookies={"rw_webapp_session": "session-cookie", "rw_webapp_csrf": "good-token"},
+            app={"settings": settings},
+        )
+        handler = AsyncMock(return_value=web.Response(text="ok"))
+
+        response = await subscription_webapp._csrf_protection_middleware(request, handler)
+
+        self.assertEqual(response.status, 403)
+        handler.assert_not_awaited()
+
+    async def test_csrf_middleware_allows_matching_token_when_cookie_session_exists(self):
+        settings = SimpleNamespace(
+            WEBAPP_SESSION_SECRET="session-secret",
+            WEBAPP_SESSION_TTL_SECONDS=3600,
+        )
+        request = SimpleNamespace(
+            method="POST",
+            path="/api/payments",
+            headers={"X-CSRF-Token": "good-token"},
+            cookies={"rw_webapp_session": "session-cookie", "rw_webapp_csrf": "good-token"},
+            app={"settings": settings},
+        )
+        handler = AsyncMock(return_value=web.Response(text="ok"))
+
+        response = await subscription_webapp._csrf_protection_middleware(request, handler)
+
+        self.assertEqual(response.text, "ok")
+        handler.assert_awaited_once()
+
+    async def test_csrf_middleware_allows_valid_bearer_authorization_for_compatibility(self):
+        settings = SimpleNamespace(
+            WEBAPP_SESSION_SECRET="session-secret",
+            WEBAPP_SESSION_TTL_SECONDS=3600,
+        )
+        token = create_webapp_session_token(settings, 321)
+        request = SimpleNamespace(
+            method="POST",
+            path="/api/payments",
+            headers={
+                "Authorization": f"Bearer {token}",
+                "X-CSRF-Token": "bad-token",
+            },
+            cookies={"rw_webapp_session": "session-cookie", "rw_webapp_csrf": "good-token"},
+            app={"settings": settings},
+        )
+        handler = AsyncMock(return_value=web.Response(text="ok"))
+
+        response = await subscription_webapp._csrf_protection_middleware(request, handler)
+
+        self.assertEqual(response.text, "ok")
+        handler.assert_awaited_once()
+
+    def test_email_payload_rejects_overlong_email(self):
+        long_email = ("a" * 245) + "@example.com"
+
+        model, response = subscription_webapp._validate_model_payload(
+            subscription_webapp.WebAppEmailPayload,
+            {"email": long_email},
+        )
+
+        self.assertIsNone(model)
+        self.assertEqual(response.status, 400)
+        self.assertIn("email_too_long", response.text)
+
+    def test_payment_payload_rejects_overlong_description(self):
+        model, response = subscription_webapp._validate_model_payload(
+            subscription_webapp.WebAppPaymentCreatePayload,
+            {
+                "method": "platega",
+                "months": 3,
+                "description": "x" * 4097,
+            },
+        )
+
+        self.assertIsNone(model)
+        self.assertEqual(response.status, 400)
+        self.assertIn("description_too_long", response.text)
+
+    def test_telegram_oauth_nonce_round_trips(self):
+        settings = SimpleNamespace(
+            WEBAPP_SESSION_SECRET="session-secret",
+            WEBAPP_SESSION_TTL_SECONDS=3600,
+        )
+        nonce = create_telegram_oauth_nonce(settings, ttl_seconds=60)
+
+        self.assertTrue(verify_telegram_oauth_nonce(settings, nonce))
+        self.assertFalse(verify_telegram_oauth_nonce(settings, nonce + "tampered"))
+
+    def test_telegram_oauth_client_id_defaults_to_bot_id(self):
+        settings = SimpleNamespace(
+            BOT_TOKEN="123456789:secret",
+            TELEGRAM_OAUTH_CLIENT_ID=None,
+            TELEGRAM_OAUTH_REQUEST_ACCESS="write, phone, unknown, write",
+        )
+
+        self.assertEqual(subscription_webapp._resolve_telegram_oauth_client_id(settings), 123456789)
+        self.assertEqual(
+            subscription_webapp._resolve_telegram_oauth_request_access(settings),
+            ["write", "phone"],
+        )
+
+
+def asyncio_run(coro):
+    import asyncio
+
+    return asyncio.run(coro)

tests/test_settings.py

@@ -0,0 +1,39 @@
+import unittest
+
+from pydantic import ValidationError
+
+from config.settings import Settings
+
+
+class SettingsTests(unittest.TestCase):
+    def test_blank_postgres_password_is_rejected(self):
+        with self.assertRaises(ValidationError):
+            Settings(
+                _env_file=None,
+                BOT_TOKEN="token",
+                POSTGRES_USER="app_user",
+                POSTGRES_PASSWORD="",
+            )
+
+    def test_webapp_secrets_are_generated_when_missing(self):
+        settings = Settings(
+            _env_file=None,
+            BOT_TOKEN="token",
+            POSTGRES_USER="app_user",
+            POSTGRES_PASSWORD="app_password",
+        )
+
+        self.assertTrue(settings.WEBAPP_SESSION_SECRET)
+        self.assertTrue(settings.WEBHOOK_SECRET_TOKEN)
+        self.assertEqual(settings.WEBAPP_SESSION_TTL_SECONDS, 86400)
+
+    def test_trial_traffic_strategy_is_available(self):
+        settings = Settings(
+            _env_file=None,
+            BOT_TOKEN="token",
+            POSTGRES_USER="app_user",
+            POSTGRES_PASSWORD="app_password",
+            TRIAL_TRAFFIC_STRATEGY="WEEK",
+        )
+
+        self.assertEqual(settings.TRIAL_TRAFFIC_STRATEGY, "WEEK")

tests/test_user_bot_menu.py

@@ -0,0 +1,129 @@
+import json
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+
+from bot.app.web import subscription_webapp
+from bot.handlers.user import referral
+from bot.keyboards.inline.user_keyboards import (
+    get_bot_interface_inline_keyboard,
+    get_information_links_keyboard,
+    get_language_selection_keyboard,
+    get_main_menu_inline_keyboard,
+    get_referral_link_keyboard,
+    get_subscription_options_keyboard,
+)
+
+
+class JsonI18nStub:
+    def __init__(self):
+        self.translations = json.loads(
+            Path("locales/en.json").read_text(encoding="utf-8")
+        )
+
+    def gettext(self, lang, key, **kwargs):
+        text = self.translations[key]
+        return text.format(**kwargs) if kwargs else text
+
+
+class UserBotMenuTests(unittest.TestCase):
+    def setUp(self):
+        self.i18n = JsonI18nStub()
+        self.settings = SimpleNamespace(
+            SUBSCRIPTION_MINI_APP_URL="https://app.example.com/",
+            SUPPORT_LINK="https://t.me/support",
+            PRIVACY_POLICY_URL="https://example.com/privacy",
+            USER_AGREEMENT_URL="https://example.com/agreement",
+            TERMS_OF_SERVICE_URL="",
+            TRIAL_ENABLED=True,
+            SERVER_STATUS_URL="",
+        )
+
+    def _callback_data(self, markup):
+        return [
+            button.callback_data
+            for row in markup.inline_keyboard
+            for button in row
+            if button.callback_data
+        ]
+
+    def test_main_menu_exposes_bot_menu_and_information(self):
+        markup = get_main_menu_inline_keyboard("en", self.i18n, self.settings)
+
+        callbacks = self._callback_data(markup)
+
+        self.assertIn("main_action:bot_interface", callbacks)
+        self.assertIn("main_action:info", callbacks)
+
+    def test_bot_interface_buttons_return_to_bot_interface(self):
+        markup = get_bot_interface_inline_keyboard("en", self.i18n, self.settings)
+
+        callbacks = self._callback_data(markup)
+
+        self.assertIn("main_action:bot_subscribe", callbacks)
+        self.assertIn("main_action:bot_my_subscription", callbacks)
+        self.assertIn("main_action:bot_referral", callbacks)
+        self.assertIn("main_action:bot_info", callbacks)
+        self.assertIn("main_action:back_to_main", callbacks)
+
+    def test_nested_bot_menu_keyboards_can_target_bot_interface_back(self):
+        subscription_markup = get_subscription_options_keyboard(
+            {1: 100},
+            "RUB",
+            "en",
+            self.i18n,
+            back_callback="main_action:bot_interface",
+        )
+        referral_markup = get_referral_link_keyboard(
+            "en",
+            self.i18n,
+            back_callback="main_action:bot_interface",
+        )
+        info_markup = get_information_links_keyboard(
+            "en",
+            self.i18n,
+            "https://example.com/privacy",
+            "https://example.com/agreement",
+            back_callback="main_action:bot_interface",
+        )
+        language_markup = get_language_selection_keyboard(
+            self.i18n,
+            "en",
+            back_callback="main_action:bot_interface",
+        )
+
+        self.assertIn("main_action:bot_interface", self._callback_data(subscription_markup))
+        self.assertIn("main_action:bot_interface", self._callback_data(referral_markup))
+        self.assertIn("main_action:bot_interface", self._callback_data(info_markup))
+        self.assertIn("set_lang_ru:bot", self._callback_data(language_markup))
+
+    def test_webapp_referral_link_uses_ref_query_and_is_normalized(self):
+        link = referral._build_webapp_referral_link(
+            "https://app.example.com/invite?utm=channel",
+            "AbC123xYz",
+        )
+
+        self.assertEqual(
+            link,
+            "https://app.example.com/invite?utm=channel&ref=uAbC123xYz",
+        )
+        self.assertEqual(subscription_webapp._normalize_referral_param("uAbC123xYz"), "ABC123XYZ")
+        self.assertEqual(subscription_webapp._normalize_referral_param("ref_uAbC123xYz"), "ABC123XYZ")
+
+    def test_referral_text_places_web_link_after_telegram_link(self):
+        text = self.i18n.gettext(
+            "en",
+            "referral_program_info_new",
+            referral_link="https://t.me/bot?start=ref_uABC123XYZ",
+            webapp_link_section=self.i18n.gettext(
+                "en",
+                "referral_webapp_link_line",
+                webapp_referral_link="https://app.example.com/?ref=uABC123XYZ",
+            ),
+            bonus_details="bonus",
+            invited_count=1,
+            purchased_count=0,
+        )
+
+        self.assertLess(text.index("Telegram link:"), text.index("Web link:"))
+        self.assertLess(text.index("Web link:"), text.index("Invitation bonuses:"))

tests/test_user_dal.py

@@ -0,0 +1,133 @@
+import unittest
+from datetime import datetime, timezone
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, patch
+
+from sqlalchemy.dialects import postgresql
+from sqlalchemy.sql.dml import Delete, Update
+
+from db.dal import user_dal
+
+
+class FakeResult:
+    def __init__(self, scalar_value=None, rowcount=1):
+        self._scalar_value = scalar_value
+        self.rowcount = rowcount
+
+    def scalar_one_or_none(self):
+        return self._scalar_value
+
+    def scalars(self):
+        return self
+
+    def all(self):
+        if self._scalar_value is None:
+            return []
+        if isinstance(self._scalar_value, list):
+            return self._scalar_value
+        return [self._scalar_value]
+
+
+class UserDalMergeTests(unittest.IsolatedAsyncioTestCase):
+    async def test_get_user_ids_without_active_subscription_uses_left_join_null_check(self):
+        session = SimpleNamespace(
+            execute=AsyncMock(return_value=FakeResult([2, 3])),
+        )
+
+        result = await user_dal.get_user_ids_without_active_subscription(session)
+
+        self.assertEqual(result, [2, 3])
+        stmt = session.execute.await_args.args[0]
+        sql = str(
+            stmt.compile(
+                dialect=postgresql.dialect(),
+                compile_kwargs={"literal_binds": True},
+            )
+        ).upper()
+        self.assertIn("LEFT OUTER JOIN", sql)
+        self.assertIn("IS NULL", sql)
+
+    async def test_merge_users_uses_bulk_updates_for_related_tables(self):
+        source = SimpleNamespace(
+            user_id=1,
+            email="source@example.com",
+            telegram_id=111,
+            panel_user_uuid="panel-source",
+            email_verified_at=datetime.now(timezone.utc),
+            username="source-user",
+            first_name="Source",
+            last_name="User",
+            language_code="ru",
+            telegram_photo_url="https://example.com/source.jpg",
+            channel_subscription_verified=True,
+            channel_subscription_checked_at=datetime.now(timezone.utc),
+            channel_subscription_verified_for=1,
+            lifetime_used_traffic_bytes=512,
+            referred_by_id=999,
+            referral_code="SRC123",
+        )
+        target = SimpleNamespace(
+            user_id=2,
+            email=None,
+            telegram_id=None,
+            panel_user_uuid=None,
+            email_verified_at=None,
+            username=None,
+            first_name=None,
+            last_name=None,
+            language_code=None,
+            telegram_photo_url=None,
+            channel_subscription_verified=False,
+            channel_subscription_checked_at=None,
+            channel_subscription_verified_for=None,
+            lifetime_used_traffic_bytes=128,
+            referred_by_id=None,
+            referral_code=None,
+        )
+        session = SimpleNamespace(
+            execute=AsyncMock(side_effect=lambda stmt: FakeResult()),
+            delete=AsyncMock(),
+            flush=AsyncMock(),
+            refresh=AsyncMock(),
+        )
+
+        async def fake_get_user_by_id(_session, user_id):
+            if user_id == source.user_id:
+                return source
+            if user_id == target.user_id:
+                return target
+            return None
+
+        with (
+            patch("db.dal.user_dal.get_user_by_id", side_effect=fake_get_user_by_id),
+            patch("db.dal.user_dal._get_active_subscription_for_user", return_value=None),
+            patch("db.dal.user_dal._get_latest_subscription_for_user", return_value=None),
+        ):
+            merged = await user_dal.merge_users(
+                session,
+                source_user_id=source.user_id,
+                target_user_id=target.user_id,
+            )
+
+        self.assertIs(merged, target)
+
+        update_tables = []
+        delete_tables = []
+        for call in session.execute.await_args_list:
+            stmt = call.args[0]
+            if isinstance(stmt, Update):
+                update_tables.append(stmt.table.name)
+            elif isinstance(stmt, Delete):
+                delete_tables.append(stmt.table.name)
+
+        self.assertIn("user_billing", update_tables)
+        self.assertIn("ad_attributions", update_tables)
+        self.assertIn("subscriptions", update_tables)
+        self.assertIn("payments", update_tables)
+        self.assertIn("promo_code_activations", update_tables)
+        self.assertIn("user_payment_methods", update_tables)
+        self.assertIn("message_logs", update_tables)
+        self.assertIn("users", update_tables)
+        self.assertIn("user_payment_methods", delete_tables)
+        self.assertIn("promo_code_activations", delete_tables)
+        session.delete.assert_awaited_once_with(source)

tests/test_webapp_assets.py

@@ -0,0 +1,62 @@
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from bot.app.web import subscription_webapp
+from config.settings import Settings
+
+
+class WebAppAssetTests(unittest.IsolatedAsyncioTestCase):
+    def test_serialize_plans_uses_traffic_packages_in_traffic_mode(self):
+        settings = Settings(
+            _env_file=None,
+            BOT_TOKEN="token",
+            POSTGRES_USER="app_user",
+            POSTGRES_PASSWORD="app_password",
+            TRAFFIC_PACKAGES="10:199,50:799",
+            STARS_TRAFFIC_PACKAGES="50:2500",
+        )
+
+        plans = subscription_webapp._serialize_plans(settings, "en")
+
+        self.assertEqual([plan["traffic_gb"] for plan in plans], [10.0, 50.0])
+        self.assertEqual(plans[0]["sale_mode"], "traffic")
+        self.assertEqual(plans[0]["price"], 199.0)
+        self.assertEqual(plans[1]["stars_price"], 2500)
+
+    def test_resolve_webapp_js_asset_name_prefers_latest_minified_build(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            asset_dir = Path(tmpdir)
+            (asset_dir / "subscription_webapp.js").write_text("console.log('fallback');", encoding="utf-8")
+            old_asset = asset_dir / "subscription_webapp.min.11111111.js"
+            new_asset = asset_dir / "subscription_webapp.min.22222222.js"
+            old_asset.write_text("console.log('old');", encoding="utf-8")
+            new_asset.write_text("console.log('new');", encoding="utf-8")
+            os.utime(old_asset, (1, 1))
+            os.utime(new_asset, (2, 2))
+
+            with patch.object(subscription_webapp, "ASSET_DIR", asset_dir):
+                self.assertEqual(
+                    subscription_webapp._resolve_webapp_js_asset_name(),
+                    "subscription_webapp.min.22222222.js",
+                )
+
+    async def test_js_asset_route_sets_immutable_cache_control_for_minified_asset(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            asset_dir = Path(tmpdir)
+            minified_asset = asset_dir / "subscription_webapp.min.abcdef12.js"
+            minified_asset.write_text("console.log('minified');", encoding="utf-8")
+
+            request = SimpleNamespace(
+                app={"settings": SimpleNamespace(WEBAPP_ENABLED=True)},
+                match_info={"asset_hash": "abcdef12"},
+            )
+
+            with patch.object(subscription_webapp, "ASSET_DIR", asset_dir):
+                response = await subscription_webapp.js_asset_route(request)
+
+            self.assertEqual(response.headers["Cache-Control"], "public, max-age=31536000, immutable")
+            self.assertEqual(response.text, "console.log('minified');")