Merge pull request #159 from kavore/dev

bugfix

.dockerignore

@@ -1,21 +1,10 @@
 # Git
+.git
 .gitignore
 .github
 .gitattributes
 LICENSE
 README.md
-.env
-.env.*
-!.env.example
-scratch_*.py
-scratch/
-.claude/
-*.local.*
-node_modules/
-frontend/node_modules/
-deploy/compose/docker-compose-dev.yml
-data/*
-!data/tariffs.example.json
 
 
 # CI
@@ -25,15 +14,9 @@ data/*
 
 # Docker
 docker-compose.yml
-deploy/compose/*.yml
+Dockerfile
+.docker
 .dockerignore
-tmp/
-
-# WebApp build artifacts (regenerated inside Docker)
-backend/bot/app/web/templates/subscription_webapp.css
-backend/bot/app/web/templates/subscription_webapp.js
-backend/bot/app/web/templates/subscription_webapp.min.*.js
-backend/bot/app/web/templates/subscription_webapp.*.css
 
 # Byte-compiled / optimized / DLL files
 **/__pycache__/

.env.example

@@ -1,72 +1,184 @@
-# Minimal bootstrap env.
-# Most product settings are configured later in Web App admin:
-# Admin -> System -> Settings, Admin -> System -> Tariffs, Admin -> Appearance.
-# Full reference: docs/env-vars.md
+# Telegram Bot Token and Admin IDs
+BOT_TOKEN=your_bot_token_here                                                 # Telegram bot token
+ADMIN_IDS=comma_separated_admin_ids                                           # Your telegram ID
 
-# Telegram bot token from @BotFather.
-# Example: 1234567890:AA...
-BOT_TOKEN=your_bot_token_here
+# PostgreSQL Database Connection Settings
+POSTGRES_USER=postgres                                                        # Database user name
+POSTGRES_PASSWORD=postgres                                                    # Database password
+POSTGRES_HOST=remnawave-tg-shop-db                                            # Database container name
+POSTGRES_PORT=5432                                                            # Port
+POSTGRES_DB=postgres                                                          # Database name
 
-# Telegram numeric user IDs allowed to open the admin panel.
-# Use commas for several admins, for example: 123456789,987654321
-ADMIN_IDS=123456789
+# Localization and Display
+DEFAULT_LANGUAGE="ru"                                                         # or "en"
+DEFAULT_CURRENCY_SYMBOL="RUB"                                                 # e.g., RUB, USD, EUR
 
-# Public HTTPS base URL of the backend webhook server.
-# Telegram, payment providers and Remnawave call webhook endpoints under this domain.
-# This is usually the backend/API domain, not the Mini App frontend domain.
-# Example: https://bot.yourdomain.tld
+# External Links
+SUPPORT_LINK=https://t.me/your_support_link                                   # Link to the support chat
+SERVER_STATUS_URL=https://status.yourdomain.tld/status/your_service           # Link to the server status page
+TERMS_OF_SERVICE_URL=https://example.com/tos                                  # Link to the terms of service
+SUBSCRIPTION_MINI_APP_URL=                                                    # URL of the subscription mini-app 
+START_COMMAND_DESCRIPTION=                                                    # Description of the /start command
+DISABLE_WELCOME_MESSAGE=                                                      # Disable the welcome message
+MY_DEVICES_SECTION_ENABLED=False                                              # Enable the My Devices section in the subscription menu
+USER_HWID_DEVICE_LIMIT=0                                                      # Default HWID/device limit for panel users (0 = unlimited)
+
+# Required channel subscription
+REQUIRED_CHANNEL_ID=                                                          # Telegram channel ID (e.g. -1001234567890) the user must join
+REQUIRED_CHANNEL_LINK=https://t.me/your_channel                               # Optional: public link/invite button text opens
+
+# Webhook Base URL (used for Telegram and payment providers)
 WEBHOOK_BASE_URL=https://webhooks.yourdomain.tld
 
-# PostgreSQL user created by Docker Compose and used by the backend.
-POSTGRES_USER=remnawave_minishop
+# Payment Method Toggles
+YOOKASSA_ENABLED=True                                                         # Turn on YOOKASSA
+FREEKASSA_ENABLED=True                                                        # Turn on FreeKassa
+STARS_ENABLED=True                                                            # Turn on STARS
+TRIBUTE_ENABLED=True                                                          # Turn on TRIBUTE
+CRYPTOPAY_ENABLED=True                                                        # Turn on CRYPTOPAY
+PLATEGA_ENABLED=False                                                         # Turn on PLATEGA
+SEVERPAY_ENABLED=False                                                        # Turn on SeverPay
+# Order of payment methods (top to bottom). Supported: severpay, freekassa, platega, yookassa, tribute, stars, cryptopay
+PAYMENT_METHODS_ORDER=severpay,yookassa,cryptopay,freekassa,platega,tribute,stars
 
-# PostgreSQL password. Change it before production deploy.
-POSTGRES_PASSWORD=change_me
+# YooKassa Payment Gateway Configuration
+YOOKASSA_SHOP_ID=your_shop_id                                                 # Your store ID in YooKassa
+YOOKASSA_SECRET_KEY=your_secret_key                                           # Your secret key for YooKassa
+YOOKASSA_RETURN_URL=https://t.me/your_bot                                     # URL to which the user will be returned after payment  
+YOOKASSA_DEFAULT_RECEIPT_EMAIL=your_email@example.com                         # Default email for sending receipts
+YOOKASSA_VAT_CODE=1                                                           # VAT code
+YOOKASSA_AUTOPAYMENTS_ENABLED=False                                           # Auto-renew toggle
+YOOKASSA_AUTOPAYMENTS_REQUIRE_CARD_BINDING=True                               # Force automatic card binding when autopay is enabled (set to False to show the save-card checkbox)
 
-# PostgreSQL database name created by Docker Compose.
-POSTGRES_DB=remnawave_minishop
+# Nalogo (self-employed receipts)
+NALOGO_INN=your_inn                                                           # INN for nalog.ru
+NALOGO_PASSWORD=your_nalogo_password                                          # Password for nalog.ru
+NALOGO_RECEIPT_NAME_SUBSCRIPTION=subscription {months} months                 # Receipt name for time-based subscriptions ({months} = duration)
+NALOGO_RECEIPT_NAME_TRAFFIC=traffic package {gb} GB                           # Receipt name for traffic packages ({gb} = traffic amount)
 
-# Enables the Web App and the Web App admin panel.
-# Keep True for the first setup. If set to False, the admin UI is unavailable
-# until you change it back to True in .env and restart the app.
-WEBAPP_ENABLED=True
+# FreeKassa Payment Gateway Configuration
+FREEKASSA_MERCHANT_ID=your_shop_id                                            # Your shop ID in FreeKassa
+FREEKASSA_API_KEY=your_api_key                                                # API key for REST requests
+FREEKASSA_SECOND_SECRET=your_second_secret                                    # Secret word #2 (used to verify notifications)
+FREEKASSA_PAYMENT_IP=                                                         # Public IP address reported to FreeKassa
+FREEKASSA_PAYMENT_METHOD_ID=44                                                # Payment method ID, you can get it from https://merchant.freekassa.net/settings/currencies
 
-# Stable secret for Web App sessions.
-# Generate with: openssl rand -hex 32
-# If empty, sessions are invalidated on every restart.
-WEBAPP_SESSION_SECRET=
+# CryptoBot Payment Gateway Configuration
+CRYPTOPAY_TOKEN=                                                              # API token for CryptoPay
+CRYPTOPAY_NETWORK=mainnet                                                     # Network (mainnet or testnet)
+CRYPTOPAY_CURRENCY_TYPE=fiat                                                  # Currency type (fiat or crypto)
+CRYPTOPAY_ASSET=RUB                                                           # Asset, e.g., RUB, BTC, USDT
 
-# Stable Telegram webhook secret_token.
-# Generate with: openssl rand -hex 32
-# If empty, a new token can be generated on process start.
-WEBHOOK_SECRET_TOKEN=
+# Platega Payment Gateway Configuration
+PLATEGA_BASE_URL=https://app.platega.io                                       # Base API URL
+PLATEGA_MERCHANT_ID=                                                          # Your MerchantId from Platega
+PLATEGA_SECRET=                                                               # API secret from Platega
+PLATEGA_PAYMENT_METHOD=2                                                      # Payment method ID (2=SBP QR, 10=RU cards, 12=International, 13=Crypto)
+PLATEGA_RETURN_URL=                                                           # Optional: redirect after successful payment (defaults to bot link)
+PLATEGA_FAILED_URL=                                                           # Optional: redirect after failed/cancelled payment (defaults to return URL)
 
-# Public HTTPS URL of the Mini App frontend, with trailing slash.
-# This URL is opened by Telegram buttons and BotFather Mini App settings.
-# Do not put /api or webhook paths here.
-# Example: https://app.yourdomain.tld/
-SUBSCRIPTION_MINI_APP_URL=https://app.yourdomain.tld/
+# SeverPay Payment Gateway Configuration
+SEVERPAY_BASE_URL=https://severpay.io/api/merchant                            # Base API URL
+SEVERPAY_MID=                                                                 # Your MID from SeverPay
+SEVERPAY_TOKEN=                                                               # API token/secret for signing requests
+SEVERPAY_RETURN_URL=                                                          # Optional: redirect URL after payment (defaults to bot link)
+SEVERPAY_LIFETIME_MINUTES=                                                    # Optional: payment link lifetime in minutes (30-4320, leave empty for default)
 
-# Remnawave panel API URL. Usually the panel domain plus /api.
-# Example: https://panel.yourdomain.tld/api
-PANEL_API_URL=https://panel.yourdomain.tld/api
+# Tribute Payment Gateway Configuration
+TRIBUTE_API_KEY=                                                              # API key for verifying Tribute webhook signatures
+TRIBUTE_SKIP_NOTIFICATIONS=True                                               # Skip renewal notifications for Tribute payments
+TRIBUTE_SKIP_CANCELLATION_NOTIFICATIONS=False                                 # Skip cancellation notifications for Tribute payments
 
-# Remnawave API key with permissions to manage users, subscriptions and squads.
-# Keep this secret. It can be overridden later in the admin panel if needed.
-PANEL_API_KEY=
+# Subscription Options. Specify cost parameters or payment links here.
+1_MONTH_ENABLED=True
+RUB_PRICE_1_MONTH=150
+STARS_PRICE_1_MONTH=0
+TRIBUTE_LINK_1_MONTH=
 
-# Shared secret for validating incoming Remnawave webhooks.
-# Use the same value when configuring the webhook in Remnawave panel.
-PANEL_WEBHOOK_SECRET=
+3_MONTHS_ENABLED=True
+RUB_PRICE_3_MONTHS=300
+STARS_PRICE_3_MONTHS=0
+TRIBUTE_LINK_3_MONTHS=
 
-# Host port that publishes the backend webhook server from Docker Compose.
-# Your reverse proxy should route WEBHOOK_BASE_URL traffic to this port.
+6_MONTHS_ENABLED=True
+RUB_PRICE_6_MONTHS=500
+STARS_PRICE_6_MONTHS=0
+TRIBUTE_LINK_6_MONTHS=
+
+12_MONTHS_ENABLED=True
+RUB_PRICE_12_MONTHS=900
+STARS_PRICE_12_MONTHS=0
+TRIBUTE_LINK_12_MONTHS=
+
+# Traffic Packages (enables traffic sale mode when set)
+TRAFFIC_PACKAGES=10:199,50:799                                                # Format: "<GB>:<price>", comma-separated
+STARS_TRAFFIC_PACKAGES=10:2500                                                # Optional: traffic packages priced in Stars
+
+# Subscription Notifications
+SUBSCRIPTION_NOTIFICATIONS_ENABLED=True                                       # Enable subscription
+SUBSCRIPTION_NOTIFY_ON_EXPIRE=True                                            # Notify on subscription
+SUBSCRIPTION_NOTIFY_AFTER_EXPIRE=True                                         # Notify after
+SUBSCRIPTION_NOTIFY_DAYS_BEFORE=3                                             # Days before expiration to notify
+
+
+REFERRAL_ONE_BONUS_PER_REFEREE=False                                          # Give a bonus only once per referee
+LEGACY_REFS=true                                                              # Allow ref_<tg_id> links. Leave unset/true unless you want to disable old links
+# Referral Bonus Days
+# Bonus for the inviting user
+REFERRAL_BONUS_DAYS_1_MONTH=3
+REFERRAL_BONUS_DAYS_3_MONTHS=7
+REFERRAL_BONUS_DAYS_6_MONTHS=15
+REFERRAL_BONUS_DAYS_12_MONTHS=30
+# Invited User Bonus
+REFEREE_BONUS_DAYS_1_MONTH=1
+REFEREE_BONUS_DAYS_3_MONTHS=3
+REFEREE_BONUS_DAYS_6_MONTHS=7
+REFEREE_BONUS_DAYS_12_MONTHS=15
+
+# Panel API Configuration
+PANEL_API_URL=http://your_panel_api_url/api                                   # URL of the panel API
+PANEL_API_KEY=your_panel_api_key                                              # Panel API key
+PANEL_WEBHOOK_SECRET=                                                         # secret used to verify panel webhook signatures
+
+# User traffic limits (applied for all users)
+# 0 means unlimited
+USER_TRAFFIC_LIMIT_GB=0                                                       # Traffic limit for users (0 unlimited)
+USER_TRAFFIC_STRATEGY="NO_RESET"                                              # Traffic reset strategy (NO_RESET, WEEK, MONTH)
+
+# Default Internal Squads for Users (Optional, comma-separated UUIDs)
+USER_SQUAD_UUIDS=uuid1,uuid2,uuid3
+# Default External Squad for Users (Optional, single UUID)
+USER_EXTERNAL_SQUAD_UUID=                                                     # Optional: UUID from Remnawave External Squads to auto-link new panel users
+
+# Trial Settings
+TRIAL_ENABLED=True                                                            # Enable the trial period
+TRIAL_DURATION_DAYS=5                                                         # Duration of the trial period in days
+TRIAL_TRAFFIC_LIMIT_GB=0                                                      # Traffic limit for the trial period (0 = unlimited)
+TRIAL_TRAFFIC_STRATEGY="NO_RESET"                                             # Traffic reset strategy for the trial period (NO_RESET, WEEK, MONTH)
+
+# Connection link handling (happ crypt4)
+CRYPT4_ENABLED=False                                                          # Enable happ crypt4 encryption for subscription URLs
+CRYPT4_REDIRECT_URL=                                                          # Base redirect to wrap the connect button, e.g. https://redir.example.com?url=
+
+# Web Server Settings (for handling webhooks)
+WEB_SERVER_HOST="0.0.0.0"
 WEB_SERVER_PORT=8080
 
-# Host port that publishes the frontend nginx from Docker Compose.
-# Your reverse proxy should route SUBSCRIPTION_MINI_APP_URL traffic to this port.
-FRONTEND_PORT=8082
+# Admin Panel Log Pagination
+LOGS_PAGE_SIZE=10                                                             # Number of events in the log
+LOG_LEVEL=INFO                                                                # Global log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
 
-# Reverse proxy IPs/CIDRs trusted for X-Forwarded-For.
-# Keep loopback for local proxy; add your proxy network if needed.
-TRUSTED_PROXIES=127.0.0.1,::1
+# Admin Logging Configuration
+LOG_CHAT_ID=-1001234567890                                                    # Telegram chat/group ID for admin notifications
+LOG_THREAD_ID=                                                                # Optional: Thread ID for supergroup messages
+LOG_NEW_USERS=True                                                            # Log new user registrations
+LOG_PAYMENTS=True                                                             # Log payments
+LOG_PROMO_ACTIVATIONS=True                                                    # Log promo code activations
+LOG_TRIAL_ACTIVATIONS=True                                                    # Log trial activations
+LOG_SUSPICIOUS_ACTIVITY=True                                                  # Log suspicious activity
+
+# Embedded mode thumbnails. Please don't touch this if you don't know what it is.
+INLINE_REFERRAL_THUMBNAIL_URL=https://cdn-icons-png.flaticon.com/512/1077/1077114.png
+INLINE_USER_STATS_THUMBNAIL_URL=https://cdn-icons-png.flaticon.com/512/681/681494.png
+INLINE_FINANCIAL_STATS_THUMBNAIL_URL=https://cdn-icons-png.flaticon.com/512/2769/2769339.png
+INLINE_SYSTEM_STATS_THUMBNAIL_URL=https://cdn-icons-png.flaticon.com/512/2920/2920277.png

.gitattributes

@@ -1,2 +0,0 @@
-*.sh text eol=lf
-deploy/docker/frontend/*.sh text eol=lf

.github/workflows/dev-docker-build.yml

@@ -0,0 +1,68 @@
+name: Build and Push Dev Docker Image
+
+on:
+  push:
+    branches:
+      - dev
+  pull_request:
+    branches:
+      - dev
+
+env:
+  GHCR_REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  DOCKERHUB_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.GHCR_REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    - name: Extract metadata (tags, labels) for Docker
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
+          ${{ env.DOCKERHUB_IMAGE }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=sha,prefix={{branch}}-
+        flavor: |
+          latest=false
+
+    - name: Build and push Docker image
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Image digest
+      run: echo ${{ steps.meta.outputs.digest }}

.github/workflows/docker-publish.yml

@@ -0,0 +1,56 @@
+name: Build and Publish multi-arch Docker Image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*.*.*'
+    paths-ignore:
+      - 'README.md'
+
+env:
+  GHCR_IMAGE: ghcr.io/${{ github.repository }}
+  DOCKERHUB_IMAGE: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU (для эмуляции arm64 на x86)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push multi-arch Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ${{ env.GHCR_IMAGE }}:latest
+            ${{ env.GHCR_IMAGE }}:${{ github.ref_name }}
+            ${{ env.DOCKERHUB_IMAGE }}:latest
+            ${{ env.DOCKERHUB_IMAGE }}:${{ github.ref_name }}

.gitignore

@@ -3,50 +3,6 @@ bot_database.sqlite3
 
 # Игнорировать файлы окружения
 .env
-.env.*
-!.env.example
-docker-compose-dev.yml
-scratch_*.py
-scratch/
-*.local.*
-node_modules/
-.git/
-
-# WebApp build artifacts (regenerated by `npm run build:webapp` / Docker build)
-bot/app/web/templates/subscription_webapp.css
-bot/app/web/templates/subscription_webapp.js
-bot/app/web/templates/subscription_webapp.min.*.js
-bot/app/web/templates/subscription_webapp.*.css
-bot/app/web/templates/subscription_webapp.min.*.js.br
-bot/app/web/templates/subscription_webapp.min.*.js.gz
-bot/app/web/templates/subscription_webapp.*.css.br
-bot/app/web/templates/subscription_webapp.*.css.gz
-bot/app/web/templates/subscription_webapp_admin.css
-bot/app/web/templates/subscription_webapp_admin.js
-bot/app/web/templates/subscription_webapp_admin.min.*.js
-bot/app/web/templates/subscription_webapp_admin.*.css
-bot/app/web/templates/subscription_webapp_admin.min.*.js.br
-bot/app/web/templates/subscription_webapp_admin.min.*.js.gz
-bot/app/web/templates/subscription_webapp_admin.*.css.br
-bot/app/web/templates/subscription_webapp_admin.*.css.gz
-backend/bot/app/web/templates/subscription_webapp.css
-backend/bot/app/web/templates/subscription_webapp.js
-backend/bot/app/web/templates/subscription_webapp.min.*.js
-backend/bot/app/web/templates/subscription_webapp.*.css
-backend/bot/app/web/templates/subscription_webapp.min.*.js.br
-backend/bot/app/web/templates/subscription_webapp.min.*.js.gz
-backend/bot/app/web/templates/subscription_webapp.*.css.br
-backend/bot/app/web/templates/subscription_webapp.*.css.gz
-backend/bot/app/web/templates/subscription_webapp_admin.css
-backend/bot/app/web/templates/subscription_webapp_admin.js
-backend/bot/app/web/templates/subscription_webapp_admin.min.*.js
-backend/bot/app/web/templates/subscription_webapp_admin.*.css
-backend/bot/app/web/templates/subscription_webapp_admin.min.*.js.br
-backend/bot/app/web/templates/subscription_webapp_admin.min.*.js.gz
-backend/bot/app/web/templates/subscription_webapp_admin.*.css.br
-backend/bot/app/web/templates/subscription_webapp_admin.*.css.gz
-tmp
-.claude
 
 # Игнорировать кэш Python
 __pycache__/
@@ -60,6 +16,4 @@ __pycache__/
 *.pid
 locales/ru_backup.json
 locales/en_backup.json
-db/models_old.py
-data/*
-!data/tariffs.example.json
+db/models_old.py

Dockerfile

@@ -0,0 +1,20 @@
+FROM python:3.12-slim AS builder
+
+WORKDIR /app
+
+COPY requirements.txt .
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --no-cache-dir -r requirements.txt
+
+FROM python:3.12-slim
+
+WORKDIR /app
+ 
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+
+COPY . .
+
+RUN rm -rf /root/.cache
+
+CMD ["python", "main.py"]

README.md

@@ -1,125 +1,364 @@
-# Remnawave Minishop
+# Telegram-бот для продажи подписок Remnawave
 
-![Remnawave Minishop](docs/remnawave-minishop.webp)
+Этот Telegram-бот предназначен для автоматизации продажи и управления подписками для панели **Remnawave**. Он интегрируется с API Remnawave для управления пользователями и подписками, а также использует различные платежные системы для приема платежей.
 
-Remnawave Minishop - Telegram-бот и Web App (Mini App) для продажи и управления подписками Remnawave. Бот обрабатывает регистрацию, оплату, продление, пробный период, промокоды, рефералов и поддержку в чате. Web App показывает ссылку подключения, срок действия, трафик, оплату, устройства и вход по Telegram Mini Apps `initData`, Telegram OAuth / OpenID Connect и одноразовому email-коду.
+## ✨ Ключевые возможности
 
-Проект является переработанным форком [kavore/remnawave-tg-shop](https://github.com/kavore/remnawave-tg-shop). Для переноса данных из прежнего стека используйте [инструкцию по миграции](docs/migration-to-minishop.md).
+### Для пользователей:
+-   **Регистрация и выбор языка:** Поддержка русского и английского языков.
+-   **Просмотр подписки:** Пользователи могут видеть статус своей подписки, дату окончания и ссылку на конфигурацию.
+-   **Мои устройства:** Опциональный раздел для просмотра и отключения подключенных устройств (активируется через переменную `MY_DEVICES_SECTION_ENABLED`).
+-   **Пробная подписка:** Система пробных подписок для новых пользователей (активируется вручную по кнопке).
+-   **Промокоды:** Возможность применять промокоды для получения скидок или бонусных дней.
+-   **Реферальная программа:** Пользователи могут приглашать друзей и получать за это бонусные дни подписки.
+    -   **Оплата:** Поддержка оплаты через YooKassa, FreeKassa (REST API), Platega, SeverPay, CryptoPay и Telegram Stars.
 
-## Возможности
+### Для администраторов:
+-   **Защищенная админ-панель:** Доступ только для администраторов, указанных в `ADMIN_IDS`.
+-   **Статистика:** Просмотр статистики использования бота (общее количество пользователей, забаненные, активные подписки), недавние платежи и статус синхронизации с панелью.
+-   **Управление пользователями:** Блокировка/разблокировка пользователей, просмотр списка забаненных и детальной информации о пользователе.
+-   **Рассылка:** Отправка сообщений всем пользователям, пользователям с активной или истекшей подпиской.
+-   **Управление промокодами:** Создание и просмотр промокодов.
+-   **Синхронизация с панелью:** Ручной запуск синхронизации пользователей и подписок с панелью Remnawave.
+-   **Логи действий:** Просмотр логов всех действий пользователей.
 
-Для пользователей:
+## 🚀 Технологии
 
-- регистрация с выбором русского или английского языка;
-- просмотр статуса подписки, даты окончания, ссылки подключения и трафика;
-- покупка подписок, пакетов трафика, обычная и premium-докупка трафика, докупка устройств по настроенному каталогу тарифов;
-- Web App / Mini App с входом через Telegram или email;
-- пробный период, промокоды и реферальная программа;
-- оплата через YooKassa, FreeKassa, Platega, SeverPay, Wata, CryptoPay, Heleket и Telegram Stars;
-- тикеты поддержки в Web App и внешняя ссылка на поддержку;
-- раздел "Мои устройства" при включенном `MY_DEVICES_SECTION_ENABLED`.
+-   **Python 3.12**
+-   **Aiogram 3.x:** Асинхронный фреймворк для Telegram ботов.
+-   **aiohttp:** Для запуска веб-сервера (вебхуки).
+-   **SQLAlchemy 2.x & asyncpg:** Асинхронная работа с базой данных PostgreSQL.
+-   **YooKassa, FreeKassa API, Platega, SeverPay, aiocryptopay:** Интеграции с платежными системами.
+-   **Pydantic:** Для управления настройками из `.env` файла.
+-   **Docker & Docker Compose:** Для контейнеризации и развертывания.
 
-Для администраторов:
+## ⚙️ Установка и запуск
 
-- админ-панель для пользователей из `ADMIN_IDS` (только при входе через Telegram, не для аккаунтов только с email);
-- статистика пользователей, подписок, платежей и синхронизации с Remnawave;
-- список пользователей с поиском, фильтрами и колонкой premium-трафика;
-- блокировка пользователей, поддержка через тикеты, рассылки, промокоды, логи действий и настройка разрешенных параметров приложения поверх `.env`;
-- редактор JSON-каталога тарифов с period/traffic-моделями, Internal Squads, premium-сквадами и HWID-пакетами;
-- ручная синхронизация пользователей и подписок с панелью.
+### Предварительные требования
 
-## Документация
+-   Установленные Docker и Docker Compose.
+-   Рабочая панель Remnawave.
+-   Токен Telegram-бота.
+-   Данные для подключения к платежным системам (YooKassa, CryptoPay и т.д.).
 
-- [Настройка окружения](docs/configuration.md) - bootstrap `.env` и рекомендуемая настройка через Web App админку.
-- [Переменные `.env`](docs/env-vars.md) - полный справочник всех env-ключей по разделам.
-- [Тарифы](docs/tariffs.md) - каталог тарифов, period- и traffic-модели, обычные и premium-докупки, premium-сквады, смена тарифа, HWID-лимиты и обработка трафика.
-- [Админ-панель](docs/admin.md) - права доступа, настройки, редактор тарифов, premium-сквады и сохранение JSON-каталога.
-- [Web App / Mini App](docs/webapp.md) - отдельный порт, домен, Telegram OAuth, email-вход и реферальные ссылки.
-- [Поддержка](docs/support.md) - тикеты в Mini App, входящий список админки, уведомления, лимиты и внешняя ссылка поддержки.
-- [Темы Web App](docs/webapp-themes.md) - кастомные темы, настройка внешнего вида, логотипы, CSS/ассеты и пайплайн создания новой темы.
-- [Развертывание](docs/deployment.md) - Docker Compose, reverse proxy, Nginx, Caddy, вебхуки, запуск из образа и обновление версии (`IMAGE_TAG`).
-- [Миграция с remnawave-tg-shop](docs/migration-to-minishop.md) - перенос данных из прежнего стека.
+### Шаги установки
 
-## Совместимость
+1.  **Клонируйте репозиторий:**
+    ```bash
+    git clone https://github.com/kavore/remnawave-tg-shop
+    cd remnawave-tg-shop
+    ```
 
-Интеграция с API панели Remnawave (вебхуки, пользователи, подписки, статистика в админке и т.д.) **протестирована** на панели Remnawave версии **`> 2.7.0`**. Более старые версии могут работать частично или не работать из‑за изменений в API.
+2.  **Создайте и настройте файл `.env`:**
+    Скопируйте `env.example` в `.env` и заполните своими данными.
+    ```bash
+    cp .env.example .env
+    nano .env 
+    ```
+    Ниже перечислены ключевые переменные.
 
-## Стек
+    <details>
+    <summary><b>Основные настройки</b></summary>
 
-Сборка и runtime задаются **deploy/docker/Dockerfile** и **docker-compose.yml**; точные версии пакетов — в **backend/requirements.txt** и **frontend/package.json**.
+    | Переменная | Описание | Пример |
+    | --- | --- | --- |
+    | `BOT_TOKEN` | **Обязательно.** Токен вашего Telegram-бота. | `1234567890:ABC-DEF1234ghIkl-zyx57W2v1u123ew11` |
+    | `ADMIN_IDS` | **Обязательно.** ID администраторов в Telegram через запятую. | `12345678,98765432` |
+    | `DEFAULT_LANGUAGE` | Язык по умолчанию для новых пользователей. | `ru` |
+    | `SUPPORT_LINK` | (Опционально) Ссылка на поддержку. | `https://t.me/your_support` |
+    | `SUBSCRIPTION_MINI_APP_URL` | (Опционально) URL Mini App для показа подписки. | `https://t.me/your_bot/app` |
+    | `MY_DEVICES_SECTION_ENABLED` | Включить раздел «Мои устройства» в меню подписки (`true`/`false`). | `false` |
+    | `REQUIRED_CHANNEL_ID` | (Опционально) ID канала, на который пользователь должен подписаться перед использованием. Оставьте пустым, если проверка не нужна. | `-1001234567890` |
+    | `REQUIRED_CHANNEL_LINK` | (Опционально) Публичная ссылка или invite на канал для кнопки «Проверить подписку». | `https://t.me/your_channel` |
+    </details>
 
-| Слой | Технологии |
-| --- | --- |
-| Backend | Python **3.12**, [aiogram](https://docs.aiogram.dev/) 3.x (Telegram), **aiohttp** (HTTP и Web App), **SQLAlchemy** 2 async, **asyncpg**, **Pydantic** / pydantic-settings, **httpx**, платёжные SDK (в т.ч. YooKassa, aiocryptopay), **PyJWT** |
-| Данные | **PostgreSQL** **17** (сервис `postgres` в Compose) и **Redis** **7** (сервис `redis`) |
-| Сборка Web App | **Node.js** **22**, **Svelte** **5**, **Vite**, **Tailwind CSS** 4; артефакты попадают в шаблоны `backend/bot/app/web/templates/` |
+    <details>
+    <summary><b>Настройки платежей и вебхуков</b></summary>
 
-Локальная разработка без Docker возможна при установленных Python 3.12, PostgreSQL и (для пересборки фронта) Node 22; типичный сценарий — всё через Compose.
+    | Переменная | Описание |
+    | --- | --- |
+    | `WEBHOOK_BASE_URL`| **Обязательно.** Базовый URL для вебхуков, например `https://your.domain.com`. |
+    | `WEB_SERVER_HOST` | Хост для веб-сервера. | `0.0.0.0` |
+    | `WEB_SERVER_PORT` | Порт для веб-сервера. | `8080` |
+    | `PAYMENT_METHODS_ORDER` | (Опционально) Порядок отображения кнопок оплаты через запятую. Поддерживаемые ключи: `severpay`, `freekassa`, `platega`, `yookassa`, `stars`, `cryptopay`. Первый будет сверху. |
+    | `YOOKASSA_ENABLED` | Включить/выключить YooKassa (`true`/`false`). |
+    | `YOOKASSA_SHOP_ID` | ID вашего магазина в YooKassa. |
+    | `YOOKASSA_SECRET_KEY`| Секретный ключ магазина YooKassa. |
+    | `YOOKASSA_AUTOPAYMENTS_ENABLED` | Включить автопродление (сохранение карт, автосписания, управление способами оплаты). |
+    | `YOOKASSA_AUTOPAYMENTS_REQUIRE_CARD_BINDING` | Требовать обязательную привязку карты при оплате с автосписанием. Установите `false`, чтобы пользователю показывался чекбокс «Сохранить карту». |
+    | `NALOGO_INN` | ИНН для авторизации в nalog.ru (самозанятый). |
+    | `NALOGO_PASSWORD` | Пароль для авторизации в nalog.ru (самозанятый). |
+    | `CRYPTOPAY_ENABLED` | Включить/выключить CryptoPay (`true`/`false`). |
+    | `CRYPTOPAY_TOKEN` | Токен из вашего CryptoPay App. |
+    | `FREEKASSA_ENABLED` | Включить/выключить FreeKassa (`true`/`false`). |
+    | `FREEKASSA_MERCHANT_ID` | ID вашего магазина в FreeKassa. |
+    | `FREEKASSA_API_KEY` | API-ключ для запросов к FreeKassa REST API. |
+    | `FREEKASSA_SECOND_SECRET` | Секретное слово №2 — используется для проверки уведомлений от FreeKassa. |
+    | `FREEKASSA_PAYMENT_URL` | (Опционально, legacy SCI) Базовый URL платёжной формы FreeKassa. По умолчанию `https://pay.freekassa.ru/`. |
+    | `FREEKASSA_PAYMENT_IP` | Внешний IP вашего сервера, который будет передаваться в запрос оплаты. |
+    | `FREEKASSA_PAYMENT_METHOD_ID` | ID метода оплаты через магазин FreeKassa. По умолчанию `44`. |
+    | `STARS_ENABLED` | Включить/выключить Telegram Stars (`true`/`false`). |
+    | `PLATEGA_ENABLED`| Включить/выключить Platega (`true`/`false`). |
+    | `PLATEGA_MERCHANT_ID`| MerchantId из личного кабинета Platega. |
+    | `PLATEGA_SECRET`| API секрет для запросов Platega. |
+    | `PLATEGA_PAYMENT_METHOD`| ID способа оплаты (2 — SBP QR, 10 — РФ карты, 12 — международные карты, 13 — crypto). |
+    | `PLATEGA_RETURN_URL`| (Опционально) URL редиректа после успешной оплаты. По умолчанию ссылка на бота. |
+    | `PLATEGA_FAILED_URL`| (Опционально) URL редиректа при ошибке/отмене. По умолчанию как `PLATEGA_RETURN_URL`. |
+    | `SEVERPAY_ENABLED` | Включить/выключить SeverPay (`true`/`false`). |
+    | `SEVERPAY_MID` | MID магазина в SeverPay. |
+    | `SEVERPAY_TOKEN` | Секрет/токен для подписи запросов SeverPay. |
+    | `SEVERPAY_BASE_URL` | (Опционально) Базовый URL API SeverPay. По умолчанию `https://severpay.io/api/merchant`. |
+    | `SEVERPAY_RETURN_URL` | (Опционально) URL редиректа после оплаты (по умолчанию ссылка на бота). |
+    | `SEVERPAY_LIFETIME_MINUTES` | (Опционально) Время жизни платежной ссылки в минутах (30–4320). |
+    </details>
 
-## Быстрый старт
+    <details>
+    <summary><b>Настройки подписок</b></summary>
 
-Требования:
+    Для каждого периода (1, 3, 6, 12 месяцев) можно настроить доступность и цены:
+    - `1_MONTH_ENABLED`: `true` или `false`
+    - `RUB_PRICE_1_MONTH`: Цена в рублях
+    - `STARS_PRICE_1_MONTH`: Цена в Telegram Stars
+    Аналогичные переменные есть для `3_MONTHS`, `6_MONTHS`, `12_MONTHS`.
+    </details>
 
-- Docker и Docker Compose;
-- рабочая панель Remnawave версии **`> 2.7.0`** (см. раздел «Совместимость»);
-- токен Telegram-бота;
-- публичные домены для webhook и Mini App.
+    <details>
+    <summary><b>Настройки панели Remnawave</b></summary>
+    
+    | Переменная | Описание |
+    | --- | --- |
+    | `PANEL_API_URL` | URL API вашей панели Remnawave. |
+    | `PANEL_API_KEY` | API ключ для доступа к панели. |
+    | `PANEL_WEBHOOK_SECRET`| Секретный ключ для проверки вебхуков от панели. |
+    | `USER_SQUAD_UUIDS` | ID отрядов для новых пользователей. |
+    | `USER_EXTERNAL_SQUAD_UUID` | Опционально. UUID внешнего отряда (External Squad) из [документации Remnawave](https://docs.rw/api), куда автоматически добавляются новые пользователи. |
+    | `USER_TRAFFIC_LIMIT_GB`| Лимит трафика в ГБ (0 - безлимит). |
+    | `USER_HWID_DEVICE_LIMIT`| Лимит устройств (HWID) для новых пользователей (0 - безлимит). |
+
+    > Раздел "Мои устройства" становится доступен пользователям только при включении `MY_DEVICES_SECTION_ENABLED`. Значение лимита устройств при создании записей в панели берётся из `USER_HWID_DEVICE_LIMIT`.
+    </details>
+
+    <details>
+    <summary><b>Настройки пробного периода</b></summary>
+
+    | Переменная | Описание |
+    | --- | --- |
+    | `TRIAL_ENABLED` | Включить/выключить пробный период (`true`/`false`). |
+    | `TRIAL_DURATION_DAYS`| Длительность пробного периода в днях. |
+    | `TRIAL_TRAFFIC_LIMIT_GB`| Лимит трафика для пробного периода в ГБ. |
+    </details>
+
+3.  **Запустите контейнеры:**
+    ```bash
+    docker compose up -d
+    ```
+    Эта команда скачает образ и запустит сервис в фоновом режиме.
+
+4.  **Настройка вебхуков (Обязательно):**
+    Вебхуки являются **обязательным** компонентом для работы бота, так как они используются для получения уведомлений от платежных систем (YooKassa, FreeKassa, CryptoPay, Platega, SeverPay) и панели Remnawave.
+
+    Вам понадобится обратный прокси (например, Nginx) для обработки HTTPS-трафика и перенаправления запросов на контейнер с ботом.
+
+    **Пути для перенаправления:**
+    -   `https://<ваш_домен>/webhook/yookassa` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/yookassa`
+    -   `https://<ваш_домен>/webhook/freekassa` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/freekassa`
+    -   `https://<ваш_домен>/webhook/platega` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/platega`
+    -   `https://<ваш_домен>/webhook/severpay` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/severpay`
+    -   `https://<ваш_домен>/webhook/cryptopay` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/cryptopay`
+    -   `https://<ваш_домен>/webhook/panel` → `http://remnawave-tg-shop:<WEB_SERVER_PORT>/webhook/panel`
+    -   **Для Telegram:** Бот автоматически установит вебхук, если в `.env` указан `WEBHOOK_BASE_URL`. Путь будет `https://<ваш_домен>/<BOT_TOKEN>`.
+
+    Где `remnawave-tg-shop` — это имя сервиса из `docker-compose.yml`, а `<WEB_SERVER_PORT>` — порт, указанный в `.env`.
+
+5.  **Просмотр логов:**
+    ```bash
+    docker compose logs -f remnawave-tg-shop
+    ```
+
+    > 💡 Если включена проверка подписки на канал (`REQUIRED_CHANNEL_ID`), добавьте бота администратором в этот канал. Пользователь увидит кнопку «Проверить подписку», и, после первого успешного подтверждения, дальнейшие действия блокироваться не будут.
+
+## Подробная инструкция для развертывания на сервере с панелью Remnawave
+
+### 1. Клонирование репозитория
 
 ```bash
-git clone https://github.com/3252a8/remnawave-minishop
-cd remnawave-minishop
-cp .env.example .env
-nano .env
-docker compose up -d --build
-docker compose logs -f backend worker frontend
+git clone https://github.com/kavore/remnawave-tg-shop && cd remnawave-tg-shop
 ```
 
-Минимально заполните в `.env`:
-
-- `BOT_TOKEN` - токен Telegram-бота;
-- `ADMIN_IDS` - Telegram ID администраторов через запятую;
-- `WEBHOOK_BASE_URL` - публичный URL вебхуков;
-- `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB` - доступы PostgreSQL;
-- `WEBAPP_ENABLED=True` - включает Web App и админку для первого входа;
-- `WEBAPP_SESSION_SECRET`, `WEBHOOK_SECRET_TOKEN` - стабильные секреты;
-- `SUBSCRIPTION_MINI_APP_URL` - публичный HTTPS URL Mini App/frontend, например `https://app.domain.com/`;
-- `PANEL_API_URL`, `PANEL_API_KEY`, `PANEL_WEBHOOK_SECRET` - доступ к Remnawave;
-- остальные настройки удобнее задать в Web App админке.
-
-После первого входа в админку настройте тарифы, платежные провайдеры, внешний вид, поддержку и уведомления через UI. Полный справочник env-переменных: [docs/env-vars.md](docs/env-vars.md).
-
-Для каталога тарифов используется `TARIFFS_CONFIG_PATH` со значением по умолчанию `data/tariffs.json`. Пример формата лежит в [data/tariffs.example.json](data/tariffs.example.json), подробности - в [docs/tariffs.md](docs/tariffs.md).
-
-Если в Docker Compose включаете bind mount `./data:/app/data`, заранее создайте каталог и отдайте его пользователю контейнера. Это нужно для сохранения `data/tariffs.json`, каталога тем `data/themes`, кеша логотипа Web App и animated emoji:
+### 2. Настройка переменных окружения
 
 ```bash
-mkdir -p data/themes data/webapp-logo data/webapp-emoji
-chown -R 10001:10001 data
-chmod -R u+rwX data
+cp .env.example .env && nano .env
 ```
 
-## Полезные команды
+**Обязательные поля для заполнения:**
+- `BOT_TOKEN` - токен телеграмм бота, например, `234567890:ABC-DEF1234ghIkl-zyx57W2v1u123ew11`
+- `ADMIN_IDS` - TG ID администраторов, например, `12345678,98765432` и т.д. (через запятую без пробелов)
+- `WEBHOOK_BASE_URL` - Обязательно. Базовый URL для вебхуков, например `https://webhook.domain.com`
+- `PANEL_API_URL` - URL API вашей панели Remnawave (например, `http://remnawave:3000/api` или `https://panel.domain.com/api`)
+- `PANEL_API_KEY` - API ключ для доступа к панели (генерируется из UI-интерфейса панели)
+- `PANEL_WEBHOOK_SECRET` - Секретный ключ для проверки вебхуков от панели (берётся из `.env` самой панели)
+- `USER_SQUAD_UUIDS` - ID отрядов для новых пользователей
+
+### 3. Настройка Reverse Proxy (Nginx)
+
+Перейдите в директорию конфигурации Nginx панели Remnawave:
 
 ```bash
-# Локальная сборка и запуск
-docker compose up -d --build
-
-# Логи приложения
-docker compose logs -f backend worker frontend
-
-# Запуск с Caddy
-docker compose -f deploy/compose/docker-compose-caddy.yml up -d
-
-# Запуск из готового образа
-IMAGE_TAG=3.1.0 docker compose -f deploy/compose/docker-compose-remote-server.yml up -d
+cd /opt/remnawave/nginx && nano nginx.conf
 ```
 
-GHCR image names for releases:
+Добавьте в `nginx.conf` следующую конфигурацию:
 
-- `ghcr.io/3252a8/remnawave-minishop-backend`
-- `ghcr.io/3252a8/remnawave-minishop-worker`
-- `ghcr.io/3252a8/remnawave-minishop-frontend`
+```nginx
+upstream remnawave-tg-shop {
+    server remnawave-tg-shop:8080;
+}
 
-## Поддержать проект
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    "" close;
+}
 
-- Crypto: `USDT/Other ERC-20 0xeD506D44aae634fEc0E01C8835744fBedb7B2a44 (Ethereum/Polygon/Gnosis)`
+server {
+    server_name webhook.domain.com; # Домен для отправки Webhook'ов
+    listen 443 ssl;
+    http2 on;
+
+    ssl_certificate "/etc/nginx/ssl/webhook_fullchain.pem";
+    ssl_certificate_key "/etc/nginx/ssl/webhook_privkey.key";
+    ssl_trusted_certificate "/etc/nginx/ssl/webhook_fullchain.pem";
+
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_send_timeout 60s;
+    proxy_read_timeout 60s;
+    proxy_intercept_errors on;
+    error_page 400 404 500 502 @redirect;
+
+    location / {
+        proxy_pass http://remnawave-tg-shop$request_uri;
+    }
+
+    location @redirect {
+        return 404;
+    }
+}
+```
+
+### 4. Выпуск SSL-сертификата для домена webhook
+
+Убедитесь, что установлены необходимые компоненты, а также откройте 80 порт:
+
+```bash
+sudo apt-get install cron socat
+curl https://get.acme.sh | sh -s email=EMAIL && source ~/.bashrc
+ufw allow 80/tcp && ufw reload
+```
+
+Выпустите сертификат:
+
+```bash
+acme.sh --set-default-ca --server letsencrypt
+acme.sh --issue --standalone -d 'webhook.domain.com' \
+  --key-file /opt/remnawave/nginx/webhook_privkey.key \
+  --fullchain-file /opt/remnawave/nginx/webhook_fullchain.pem
+```
+
+### 5. Добавление сертификатов в Docker Compose Nginx
+
+Отредактируйте `docker-compose.yml` панели Nginx:
+
+```bash
+cd /opt/remnawave/nginx && nano docker-compose.yml
+```
+
+Добавьте две строки в секцию `volumes`:
+
+```yaml
+services:
+    remnawave-nginx:
+        image: nginx:1.26
+        container_name: remnawave-nginx
+        hostname: remnawave-nginx
+        volumes:
+            - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+            - ./fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro
+            - ./privkey.key:/etc/nginx/ssl/privkey.key:ro
+            - ./subdomain_fullchain.pem:/etc/nginx/ssl/subdomain_fullchain.pem:ro
+            - ./subdomain_privkey.key:/etc/nginx/ssl/subdomain_privkey.key:ro
+            - ./webhook_fullchain.pem:/etc/nginx/ssl/webhook_fullchain.pem:ro     # Добавьте эту строку
+            - ./webhook_privkey.key:/etc/nginx/ssl/webhook_privkey.key:ro         # Добавьте эту строку
+        restart: always
+        ports:
+            - '0.0.0.0:443:443'
+        networks:
+            - remnawave-network
+
+networks:
+    remnawave-network:
+        name: remnawave-network
+        driver: bridge
+        external: true
+```
+
+### 6. Запуск бота и перезапуск Nginx
+
+Запустите бота:
+
+```bash
+cd /root/remnawave-tg-shop && docker compose up -d && docker compose logs -f -t
+```
+
+Перезапустите Nginx:
+
+```bash
+cd /opt/remnawave/nginx && docker compose down && docker compose up -d && docker compose logs -f -t
+```
+
+## 🐳 Docker
+
+Файлы `Dockerfile` и `docker-compose.yml` уже настроены для сборки и запуска проекта. `docker-compose.yml` использует готовый образ с GitHub Container Registry, но вы можете раскомментировать `build: .` для локальной сборки.
+
+Для автоматической публикации образов настроены GitHub Actions (`.github/workflows`). По умолчанию образы пушатся в GitHub Container Registry и Docker Hub. Добавьте в Secrets репозитория значения `DOCKERHUB_USERNAME` и `DOCKERHUB_TOKEN` (персональный access token или пароль для Docker Hub), чтобы загрузка в Docker Hub работала корректно.
+
+## 📁 Структура проекта
+
+```
+.
+├── bot/
+│   ├── filters/          # Пользовательские фильтры Aiogram
+│   ├── handlers/         # Обработчики сообщений и колбэков
+│   ├── keyboards/        # Клавиатуры
+│   ├── middlewares/      # Промежуточные слои (i18n, проверка бана)
+│   ├── services/         # Бизнес-логика (платежи, API панели)
+│   ├── states/           # Состояния FSM
+│   └── main_bot.py       # Основная логика бота
+├── config/
+│   └── settings.py       # Настройки Pydantic
+├── db/
+│   ├── dal/              # Слой доступа к данным (DAL)
+│   ├── database_setup.py # Настройка БД
+│   └── models.py         # Модели SQLAlchemy
+├── locales/              # Файлы локализации (ru, en)
+├── .env.example          # Пример файла с переменными окружения
+├── Dockerfile            # Инструкции для сборки Docker-образа
+├── docker-compose.yml    # Файл для оркестрации контейнеров
+├── requirements.txt      # Зависимости Python
+└── main.py               # Точка входа в приложение
+```
+
+## 🔮 Планы на будущее
+
+-   Расширенные типы промокодов (например, скидки в процентах).
+
+## ❤️ Поддержка
+- Карты РФ и зарубежные: [Tribute](https://t.me/tribute/app?startapp=dqdg)
+- Crypto: `USDT TRC-20 TT3SqBbfU4vYm6SUwUVNZsy278m2xbM4GE`

backend/app_logging.py

@@ -1,12 +0,0 @@
-import logging
-import os
-import sys
-
-
-def configure_logging() -> None:
-    level = getattr(logging, os.getenv("LOG_LEVEL", "INFO").upper(), logging.INFO)
-    logging.basicConfig(
-        level=level,
-        stream=sys.stdout,
-        format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",
-    )

backend/bot/app/factories/build_services.py

@@ -1,88 +0,0 @@
-from aiogram import Bot
-from sqlalchemy.orm import sessionmaker
-
-from bot.middlewares.i18n import JsonI18n
-from bot.payment_providers import (
-    ServiceFactoryContext,
-    build_provider_configs,
-    build_provider_services,
-)
-from bot.services.email_auth_service import EmailAuthService
-from bot.services.lknpd_service import LknpdService
-from bot.services.notification_service import NotificationService
-from bot.services.panel_api_service import PanelApiService
-from bot.services.panel_webhook_service import PanelWebhookService
-from bot.services.promo_code_service import PromoCodeService
-from bot.services.referral_service import ReferralService
-from bot.services.subscription_service import SubscriptionService
-from bot.services.support_service import SupportService
-from config.settings import Settings
-
-
-def build_core_services(
-    settings: Settings,
-    bot: Bot,
-    async_session_factory: sessionmaker,
-    i18n: JsonI18n,
-    bot_username_for_default_return: str,
-):
-    panel_service = PanelApiService(settings)
-    subscription_service = SubscriptionService(settings, panel_service, bot, i18n)
-    referral_service = ReferralService(settings, subscription_service, bot, i18n)
-    promo_code_service = PromoCodeService(settings, subscription_service, bot, i18n)
-    email_auth_service = EmailAuthService(settings)
-    notification_service = NotificationService(
-        bot,
-        settings,
-        i18n,
-        session_factory=async_session_factory,
-        email_auth_service=email_auth_service,
-        bot_username=bot_username_for_default_return,
-    )
-    support_service = SupportService(
-        async_session_factory,
-        settings,
-        bot,
-        i18n,
-        notification_service,
-        email_auth_service,
-    )
-    panel_webhook_service = PanelWebhookService(
-        bot, settings, i18n, async_session_factory, panel_service
-    )
-    provider_configs = build_provider_configs()
-    payment_services = build_provider_services(
-        ServiceFactoryContext(
-            settings=settings,
-            bot=bot,
-            async_session_factory=async_session_factory,
-            i18n=i18n,
-            bot_username_for_default_return=bot_username_for_default_return,
-            subscription_service=subscription_service,
-            referral_service=referral_service,
-            provider_configs=provider_configs,
-        )
-    )
-    lknpd_service = LknpdService(
-        settings.LKNPD_INN,
-        settings.LKNPD_PASSWORD,
-        api_url=settings.LKNPD_API_URL,
-    )
-
-    # These attachments are critical for auto-renew and panel pre-expiry hooks.
-    subscription_service.yookassa_service = payment_services.get("yookassa_service")
-    panel_webhook_service.subscription_service = subscription_service
-
-    services = {
-        "panel_service": panel_service,
-        "subscription_service": subscription_service,
-        "referral_service": referral_service,
-        "promo_code_service": promo_code_service,
-        "notification_service": notification_service,
-        "email_auth_service": email_auth_service,
-        "support_service": support_service,
-        "panel_webhook_service": panel_webhook_service,
-        "lknpd_service": lknpd_service,
-    }
-    services.update(payment_services)
-    return services

backend/bot/app/web/admin_api.py

@@ -1,60 +0,0 @@
-"""Compatibility facade for the admin Mini App API."""
-
-# ruff: noqa: I001
-
-from bot.app.web.admin_api_impl import (
-    _runtime as _runtime,
-    ads as _ads,
-    auth as _auth,
-    broadcast as _broadcast,
-    common as _common,
-    logs as _logs,
-    panel as _panel,
-    payments as _payments,
-    promos as _promos,
-    routes as _routes,
-    settings as _settings,
-    stats as _stats,
-    support as _support,
-    sync as _sync,
-    tariffs as _tariffs,
-    themes as _themes,
-    users as _users,
-)
-
-_MODULES = (
-    _runtime,
-    _auth,
-    _common,
-    _stats,
-    _users,
-    _payments,
-    _promos,
-    _logs,
-    _support,
-    _broadcast,
-    _sync,
-    _ads,
-    _settings,
-    _tariffs,
-    _themes,
-    _panel,
-    _routes,
-)
-
-_NAMESPACE = {}
-for _module in _MODULES:
-    _NAMESPACE.update(
-        {
-            _name: _value
-            for _name, _value in vars(_module).items()
-            if not _name.startswith("__") and _name != "annotations"
-        }
-    )
-
-for _module in _MODULES:
-    vars(_module).update(_NAMESPACE)
-
-globals().update(_NAMESPACE)
-
-__all__ = sorted(_name for _name in _NAMESPACE if not _name.startswith("__"))

backend/bot/app/web/admin_api_impl/__init__.py

@@ -1 +0,0 @@
-"""Domain modules for the admin Mini App API."""

backend/bot/app/web/admin_api_impl/_runtime.py

@@ -1,66 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-"""HTTP API powering the admin section of the subscription Mini App.
-
-All routes require an authenticated webapp session (cookie or Bearer
-token) AND the resolved Telegram user id must appear in
-``settings.ADMIN_IDS``. Authorization is enforced via the
-``_require_admin_user_id`` helper, never trusted from the client.
-"""
-
-from __future__ import annotations
-
-import csv
-import io
-import json
-import logging
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
-from urllib.parse import parse_qsl, urlsplit, urlunsplit
-
-from aiohttp import web
-from pydantic import ValidationError
-from sqlalchemy import Float, and_, case, cast, or_, select
-from sqlalchemy import func as sa_func
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import sessionmaker
-
-from bot.app.web.admin_settings_manifest import (
-    manifest_payload,
-)
-from bot.infra.webhook_queue import enqueue_webhook_event
-from bot.services.referral_service import ReferralService
-from bot.services.settings_override_service import (
-    current_value,
-    update_overrides,
-)
-from bot.utils import MessageContent, send_message_via_queue
-from bot.utils.message_queue import get_queue_manager
-from config.settings import Settings
-from config.tariffs_config import TariffsConfig
-from db.dal import (
-    ad_dal,
-    app_settings_dal,
-    message_log_dal,
-    panel_sync_dal,
-    payment_dal,
-    promo_code_dal,
-    subscription_dal,
-    user_dal,
-)
-from db.models import (
-    AdCampaign,
-    MessageLog,
-    Payment,
-    PromoCode,
-    Subscription,
-    User,
-    UserTelegramAvatar,
-)
-
-logger = logging.getLogger(__name__)
-
-
-# ─── Auth ──────────────────────────────────────────────────────────
-
-__all__ = [name for name in globals() if not name.startswith("__")]

backend/bot/app/web/admin_api_impl/ads.py

@@ -1,69 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_ads_list_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        campaigns = await ad_dal.list_campaigns(session)
-        totals = await ad_dal.get_totals(session)
-        results = []
-        for campaign in campaigns:
-            try:
-                stats = await ad_dal.get_campaign_stats(session, campaign.ad_campaign_id)
-            except Exception:
-                stats = {}
-            results.append(_serialize_ad(campaign, stats))
-    return _ok({"campaigns": results, "totals": totals})
-
-
-async def admin_ad_create_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    payload = await _read_json(request)
-    source = str(payload.get("source") or "").strip()
-    start_param = str(payload.get("start_param") or "").strip()
-    cost = float(payload.get("cost") or 0.0)
-    if not source or not start_param:
-        return _error(400, "invalid_payload")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        existing = await ad_dal.get_campaign_by_start_param(session, start_param)
-        if existing:
-            return _error(409, "duplicate_start_param")
-        campaign = await ad_dal.create_campaign(
-            session,
-            source=source,
-            start_param=start_param,
-            cost=cost,
-        )
-        await session.commit()
-        await session.refresh(campaign)
-    return _ok({"campaign": _serialize_ad(campaign)})
-
-
-async def admin_ad_toggle_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    campaign_id = int(request.match_info["campaign_id"])
-    payload = await _read_json(request)
-    is_active = bool(payload.get("is_active", True))
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        ok = await ad_dal.toggle_campaign_active(session, campaign_id, is_active)
-        if not ok:
-            return _error(404, "not_found")
-        await session.commit()
-    return _ok({})
-
-
-async def admin_ad_delete_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    campaign_id = int(request.match_info["campaign_id"])
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        ok = await ad_dal.delete_campaign(session, campaign_id)
-        if not ok:
-            return _error(404, "not_found")
-        await session.commit()
-    return _ok({})

backend/bot/app/web/admin_api_impl/auth.py

@@ -1,58 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-def _require_admin_user_id(request: web.Request) -> int:
-    """Return the authenticated user id, or raise 401/403 for non-admins."""
-
-    from bot.app.web.session import extract_authenticated_user_id
-
-    settings: Settings = request.app["settings"]
-    user_id = extract_authenticated_user_id(request)
-    if not user_id:
-        raise web.HTTPUnauthorized(
-            text=json.dumps({"ok": False, "error": "unauthorized"}),
-            content_type="application/json",
-        )
-
-    admin_ids = settings.ADMIN_IDS or []
-    db_user_telegram_id = request.get("admin_telegram_id")
-    if db_user_telegram_id is None:
-        raise web.HTTPForbidden(
-            text=json.dumps({"ok": False, "error": "forbidden"}),
-            content_type="application/json",
-        )
-
-    if int(db_user_telegram_id) not in {int(x) for x in admin_ids}:
-        raise web.HTTPForbidden(
-            text=json.dumps({"ok": False, "error": "forbidden"}),
-            content_type="application/json",
-        )
-    return int(user_id)
-
-
-@web.middleware
-async def admin_auth_middleware(request: web.Request, handler):
-    """Resolve the Telegram id of the current user and stash it on the request.
-
-    Doing this once per request lets every admin route call
-    ``_require_admin_user_id`` without re-querying the DB.
-    """
-
-    if not request.path.startswith("/api/admin"):
-        return await handler(request)
-
-    from bot.app.web.session import extract_authenticated_user_id
-
-    user_id = extract_authenticated_user_id(request)
-    if user_id:
-        async_session_factory: sessionmaker = request.app["async_session_factory"]
-        async with async_session_factory() as session:
-            db_user = await user_dal.get_user_by_id(session, user_id)
-        if db_user and db_user.telegram_id:
-            request["admin_telegram_id"] = int(db_user.telegram_id)
-        elif db_user:
-            # No telegram_id yet (email-only user) — can't be an admin
-            request["admin_telegram_id"] = None
-
-    return await handler(request)

backend/bot/app/web/admin_api_impl/broadcast.py

@@ -1,54 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_broadcast_route(request: web.Request) -> web.Response:
-    actor_id = _require_admin_user_id(request)
-    payload = await _read_json(request)
-    text = str(payload.get("text") or "").strip()
-    target = str(payload.get("target") or "all").strip().lower()
-    if not text:
-        return _error(400, "empty_text")
-    if target not in {"all", "active", "inactive"}:
-        target = "all"
-
-    queue_manager = get_queue_manager()
-    if not queue_manager:
-        return _error(503, "queue_unavailable")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        if target == "active":
-            user_ids = await user_dal.get_user_ids_with_active_subscription(session)
-        elif target == "inactive":
-            user_ids = await user_dal.get_user_ids_without_active_subscription(session)
-        else:
-            user_ids = await user_dal.get_all_active_user_ids_for_broadcast(session)
-
-        sent = 0
-        failed = 0
-        for uid in user_ids:
-            try:
-                await send_message_via_queue(
-                    queue_manager,
-                    int(uid),
-                    MessageContent(content_type="text", text=text),
-                    parse_mode="HTML",
-                    disable_web_page_preview=True,
-                )
-                sent += 1
-            except Exception as exc:
-                failed += 1
-                logger.debug("Broadcast queue failed for %s: %s", uid, exc)
-
-        await message_log_dal.create_message_log(
-            session,
-            {
-                "user_id": actor_id,
-                "event_type": "admin_broadcast_webapp",
-                "content": f"target={target} sent={sent} failed={failed} text={text[:120]}",
-                "is_admin_event": True,
-            },
-        )
-
-    return _ok({"queued": sent, "failed": failed, "target": target})

backend/bot/app/web/admin_api_impl/common.py

@@ -1,371 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-def _ok(payload: Dict[str, Any], **extra) -> web.Response:
-    body = {"ok": True, **payload, **extra}
-    return web.json_response(body)
-
-
-def _error(status: int, code: str, message: str = "") -> web.Response:
-    return web.json_response(
-        {"ok": False, "error": code, "message": message or code},
-        status=status,
-    )
-
-
-async def _read_json(request: web.Request) -> Dict[str, Any]:
-    try:
-        data = await request.json()
-        return data if isinstance(data, dict) else {}
-    except Exception:
-        return {}
-
-
-def _serialize_user(user: User) -> Dict[str, Any]:
-    return {
-        "user_id": int(user.user_id),
-        "telegram_id": int(user.telegram_id) if user.telegram_id else None,
-        "telegram_photo_url": user.telegram_photo_url,
-        "username": user.username,
-        "first_name": user.first_name,
-        "last_name": user.last_name,
-        "email": user.email,
-        "language_code": user.language_code,
-        "is_banned": bool(user.is_banned),
-        "registration_date": user.registration_date.isoformat() if user.registration_date else None,
-        "panel_user_uuid": user.panel_user_uuid,
-        "referral_code": user.referral_code,
-        "referred_by_id": int(user.referred_by_id) if user.referred_by_id else None,
-    }
-
-
-def _premium_limit_bytes_from_subscription(sub: Subscription) -> int:
-    premium_bonus_bytes = int(getattr(sub, "premium_bonus_bytes", 0) or 0)
-    return (
-        int(sub.premium_baseline_bytes or 0)
-        + int(sub.premium_topup_balance_bytes or 0)
-        + int(getattr(sub, "premium_topup_used_bytes", 0) or 0)
-        + premium_bonus_bytes
-    )
-
-
-def _premium_traffic_list_payload(sub: Optional[Subscription]) -> Dict[str, Any]:
-    """Premium traffic column when subscription has a finite premium quota (bytes > 0).
-
-    Note: ``Subscription.premium_is_limited`` in the DB means *quota exhausted* for panel
-    routing, not 'tariff includes premium traffic' — do not use it here.
-    """
-
-    if sub is None:
-        return {"state": "none"}
-    if bool(getattr(sub, "premium_unlimited_override", False)):
-        return {
-            "state": "unlimited",
-            "unlimited": True,
-            "used_bytes": int(sub.premium_used_bytes or 0),
-            "limit_bytes": None,
-            "percent": None,
-        }
-    limit_bytes = _premium_limit_bytes_from_subscription(sub)
-    if limit_bytes <= 0:
-        return {"state": "none"}
-    used_bytes = int(sub.premium_used_bytes or 0)
-    ratio = float(used_bytes) / float(limit_bytes) if limit_bytes else 0.0
-    pct = int(max(0, min(100, round(ratio * 100))))
-    if ratio >= 1.0:
-        state = "critical"
-    elif ratio >= 0.85:
-        state = "warn"
-    else:
-        state = "good"
-    return {
-        "state": state,
-        "unlimited": False,
-        "used_bytes": used_bytes,
-        "limit_bytes": limit_bytes,
-        "percent": pct,
-    }
-
-
-def _serialize_subscription(sub: Subscription) -> Dict[str, Any]:
-    premium_bonus_bytes = int(getattr(sub, "premium_bonus_bytes", 0) or 0)
-    regular_bonus_bytes = int(getattr(sub, "regular_bonus_bytes", 0) or 0)
-    regular_unlimited_override = bool(getattr(sub, "regular_unlimited_override", False))
-    premium_unlimited_override = bool(getattr(sub, "premium_unlimited_override", False))
-    premium_limit_bytes = _premium_limit_bytes_from_subscription(sub)
-    return {
-        "subscription_id": int(sub.subscription_id),
-        "panel_user_uuid": sub.panel_user_uuid,
-        "panel_subscription_uuid": sub.panel_subscription_uuid,
-        "start_date": sub.start_date.isoformat() if sub.start_date else None,
-        "end_date": sub.end_date.isoformat() if sub.end_date else None,
-        "duration_months": sub.duration_months,
-        "is_active": bool(sub.is_active),
-        "status_from_panel": sub.status_from_panel,
-        "traffic_limit_bytes": sub.traffic_limit_bytes,
-        "traffic_used_bytes": sub.traffic_used_bytes,
-        "tier_baseline_bytes": sub.tier_baseline_bytes,
-        "topup_balance_bytes": sub.topup_balance_bytes,
-        "premium_used_bytes": sub.premium_used_bytes,
-        "premium_limit_bytes": premium_limit_bytes,
-        "premium_baseline_bytes": sub.premium_baseline_bytes,
-        "premium_topup_balance_bytes": sub.premium_topup_balance_bytes,
-        "premium_topup_used_bytes": getattr(sub, "premium_topup_used_bytes", 0),
-        "premium_bonus_bytes": premium_bonus_bytes,
-        "regular_bonus_bytes": regular_bonus_bytes,
-        "regular_unlimited_override": regular_unlimited_override,
-        "premium_unlimited_override": premium_unlimited_override,
-        "premium_is_limited": bool(sub.premium_is_limited),
-        "tariff_key": sub.tariff_key,
-        "auto_renew_enabled": bool(sub.auto_renew_enabled),
-        "provider": sub.provider,
-        "is_throttled": bool(sub.is_throttled),
-    }
-
-
-def _payment_traffic_gb_split(payment: Payment) -> Tuple[Optional[float], Optional[float]]:
-    """For traffic purchases: ``(regular_gb, premium_gb)``. Other payments → (None, None)."""
-    if payment.purchased_gb is None:
-        return None, None
-    try:
-        gb = float(payment.purchased_gb)
-    except (TypeError, ValueError):
-        return None, None
-    sm = (payment.sale_mode or "").strip()
-    if not sm:
-        return None, None
-    base = sm.split("@", 1)[0].split("|", 1)[0].lower()
-    if base == "premium_topup":
-        return None, gb
-    if base in {"traffic", "traffic_package", "topup"}:
-        return gb, None
-    return None, None
-
-
-def _payment_user_display_label(loaded_user: Any, payment_user_id: int) -> str:
-    """Human-facing name for payments tables: TG profile name, else email, else user id."""
-    if loaded_user is None:
-        return str(payment_user_id)
-    tid = getattr(loaded_user, "telegram_id", None)
-    if tid is not None:
-        fn = (getattr(loaded_user, "first_name", None) or "").strip()
-        ln = (getattr(loaded_user, "last_name", None) or "").strip()
-        full = f"{fn} {ln}".strip()
-        if full:
-            return full
-        un = (getattr(loaded_user, "username", None) or "").strip()
-        if un:
-            return un if un.startswith("@") else f"@{un}"
-        return str(payment_user_id)
-    email = (getattr(loaded_user, "email", None) or "").strip()
-    if email:
-        return email
-    return str(payment_user_id)
-
-
-def _serialize_payment(payment: Payment) -> Dict[str, Any]:
-    # Avoid lazy-loading `payment.user` outside an active SQLAlchemy session.
-    # Some admin routes serialize payments after the session scope is closed.
-    telegram_id = None
-    loaded_user = payment.__dict__.get("user")
-    user_label = _payment_user_display_label(loaded_user, int(payment.user_id))
-    if loaded_user is not None:
-        tid = getattr(loaded_user, "telegram_id", None)
-        if tid is not None:
-            try:
-                telegram_id = int(tid)
-            except (TypeError, ValueError):
-                telegram_id = None
-    reg_gb, prem_gb = _payment_traffic_gb_split(payment)
-    return {
-        "payment_id": int(payment.payment_id),
-        "user_id": int(payment.user_id),
-        "user_label": user_label,
-        "telegram_id": telegram_id,
-        "traffic_regular_gb": reg_gb,
-        "traffic_premium_gb": prem_gb,
-        "provider": payment.provider,
-        "provider_payment_id": payment.provider_payment_id,
-        "amount": float(payment.amount),
-        "currency": payment.currency,
-        "status": payment.status,
-        "description": payment.description,
-        "subscription_duration_months": payment.subscription_duration_months,
-        "sale_mode": payment.sale_mode,
-        "tariff_key": payment.tariff_key,
-        "purchased_gb": payment.purchased_gb,
-        "purchased_hwid_devices": payment.purchased_hwid_devices,
-        "created_at": payment.created_at.isoformat() if payment.created_at else None,
-    }
-
-
-def _serialize_promo(promo: PromoCode) -> Dict[str, Any]:
-    return {
-        "id": int(promo.promo_code_id),
-        "code": promo.code,
-        "bonus_days": int(promo.bonus_days),
-        "max_activations": int(promo.max_activations),
-        "current_activations": int(promo.current_activations or 0),
-        "is_active": bool(promo.is_active),
-        "valid_until": promo.valid_until.isoformat() if promo.valid_until else None,
-        "created_at": promo.created_at.isoformat() if promo.created_at else None,
-        "created_by_admin_id": int(promo.created_by_admin_id)
-        if promo.created_by_admin_id
-        else None,
-    }
-
-
-def _serialize_ad(campaign: AdCampaign, totals: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
-    return {
-        "id": int(campaign.ad_campaign_id),
-        "source": campaign.source,
-        "start_param": campaign.start_param,
-        "cost": float(campaign.cost or 0),
-        "is_active": bool(campaign.is_active),
-        "created_at": campaign.created_at.isoformat() if campaign.created_at else None,
-        "stats": totals or {},
-    }
-
-
-def _serialize_log(entry: MessageLog) -> Dict[str, Any]:
-    return {
-        "log_id": int(entry.log_id),
-        "user_id": int(entry.user_id) if entry.user_id else None,
-        "telegram_username": entry.telegram_username,
-        "telegram_first_name": entry.telegram_first_name,
-        "event_type": entry.event_type,
-        "content": entry.content,
-        "is_admin_event": bool(entry.is_admin_event),
-        "target_user_id": int(entry.target_user_id) if entry.target_user_id else None,
-        "timestamp": entry.timestamp.isoformat() if entry.timestamp else None,
-    }
-
-
-def _tariffs_config_path(settings: Settings) -> Path:
-    return Path(settings.TARIFFS_CONFIG_PATH).expanduser()
-
-
-def _tariffs_config_payload(config: TariffsConfig) -> Dict[str, Any]:
-    return config.model_dump(mode="json", exclude_none=True)
-
-
-def _write_tariffs_config_file(path: Path, config: TariffsConfig) -> None:
-    data = _tariffs_config_payload(config)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    tmp_path = path.with_suffix(f"{path.suffix}.tmp")
-    payload = json.dumps(data, ensure_ascii=False, indent=2) + "\n"
-    try:
-        tmp_path.write_text(payload, encoding="utf-8")
-        tmp_path.replace(path)
-    except PermissionError:
-        # A docker-compose single-file bind mount can make /app/config
-        # unwritable while the mounted tariffs.json itself is writable.
-        # Fall back to updating the existing file in-place.
-        if tmp_path.exists():
-            try:
-                tmp_path.unlink()
-            except OSError:
-                pass
-        path.write_text(payload, encoding="utf-8")
-
-
-def _webapp_themes_catalog_payload(config: Any) -> Dict[str, Any]:
-    return config.model_dump(mode="json", exclude_none=True)
-
-
-def _panel_node_uuid_key(node: Dict[str, Any]) -> str:
-    uid = node.get("nodeUuid") or node.get("node_uuid") or node.get("uuid") or node.get("id")
-    return str(uid).strip().lower() if uid else ""
-
-
-def _panel_node_users_online(node: Dict[str, Any]) -> Optional[int]:
-    uo = node.get("usersOnline")
-    if uo is None:
-        uo = node.get("users_online")
-    if uo is None:
-        uo = node.get("onlineUsers") or node.get("online_users")
-    if uo is None:
-        mg = node.get("metricGroups")
-        if isinstance(mg, dict):
-            uo = mg.get("onlineUsers") or mg.get("online_users")
-    if uo is None:
-        return None
-    try:
-        return int(uo)
-    except (TypeError, ValueError):
-        return None
-
-
-def _panel_nodes_online_by_uuid(nodes_payload: Any) -> Dict[str, int]:
-    """Build node_uuid(lower) -> usersOnline from GET /system/stats/nodes payload."""
-    out: Dict[str, int] = {}
-    raw_list: Optional[List[Any]] = None
-    if isinstance(nodes_payload, list):
-        raw_list = nodes_payload
-    elif isinstance(nodes_payload, dict):
-        raw_list = nodes_payload.get("nodes")
-        if raw_list is None:
-            raw_list = nodes_payload.get("items") or nodes_payload.get("data")
-    if not isinstance(raw_list, list):
-        return out
-    for n in raw_list:
-        if not isinstance(n, dict):
-            continue
-        key = _panel_node_uuid_key(n)
-        if not key:
-            continue
-        online = _panel_node_users_online(n)
-        if online is not None:
-            out[key] = online
-    return out
-
-
-def _enrich_bandwidth_nodes_with_online(
-    bw: Any,
-    online_by_uuid: Dict[str, int],
-    online_by_name: Optional[Dict[str, int]] = None,
-) -> None:
-    """Attach usersOnline to topNodes/series (UUID and optional node name)."""
-    if not isinstance(bw, dict):
-        return
-    if not online_by_uuid and not online_by_name:
-        return
-    for key in ("topNodes", "series"):
-        arr = bw.get(key)
-        if not isinstance(arr, list):
-            continue
-        for item in arr:
-            if not isinstance(item, dict):
-                continue
-            if item.get("usersOnline") is not None:
-                continue
-            uid = item.get("uuid") or item.get("nodeUuid") or item.get("node_uuid")
-            if uid and online_by_uuid:
-                hit = online_by_uuid.get(str(uid).strip().lower())
-                if hit is not None:
-                    item["usersOnline"] = hit
-                    continue
-            if online_by_name:
-                nm = item.get("name")
-                if nm and isinstance(nm, str):
-                    hitn = online_by_name.get(nm.strip().lower())
-                    if hitn is not None:
-                        item["usersOnline"] = hitn
-
-
-def _build_admin_webapp_referral_link(
-    base_url: Optional[str], referral_code: Optional[str]
-) -> Optional[str]:
-    """Mirror of ``subscription_webapp._build_webapp_referral_link``.
-
-    Kept local to avoid a cross-module import cycle (subscription_webapp
-    imports admin_api).
-    """
-    if not base_url or not referral_code:
-        return None
-    parts = urlsplit(base_url)
-    query = dict(parse_qsl(parts.query, keep_blank_values=True))
-    query["ref"] = f"u{referral_code}"
-    new_query = "&".join(f"{k}={v}" for k, v in query.items())
-    return urlunsplit((parts.scheme, parts.netloc, parts.path, new_query, parts.fragment))

backend/bot/app/web/admin_api_impl/logs.py

@@ -1,36 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_logs_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    page = max(0, int(request.query.get("page", 0) or 0))
-    page_size = min(200, max(1, int(request.query.get("page_size", 50) or 50)))
-    user_filter = request.query.get("user_id")
-
-    async with async_session_factory() as session:
-        if user_filter:
-            try:
-                user_id = int(user_filter)
-            except (TypeError, ValueError):
-                return _error(400, "invalid_user_id")
-            entries = await message_log_dal.get_user_message_logs(
-                session, user_id, page_size, page * page_size
-            )
-            total = await message_log_dal.count_user_message_logs(session, user_id)
-        else:
-            entries = await message_log_dal.get_all_message_logs(
-                session, page_size, page * page_size
-            )
-            total = await message_log_dal.count_all_message_logs(session)
-
-    return _ok(
-        {
-            "logs": [_serialize_log(entry) for entry in entries],
-            "page": page,
-            "page_size": page_size,
-            "total": int(total or 0),
-        }
-    )

backend/bot/app/web/admin_api_impl/panel.py

@@ -1,35 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_panel_internal_squads_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    panel_service = request.app.get("panel_service")
-    if panel_service is None:
-        return _error(503, "panel_unavailable", "Panel service unavailable")
-    try:
-        squads = await panel_service.get_internal_squads()
-    except Exception as exc:
-        logger.exception("Failed to load internal squads from panel")
-        return _error(502, "panel_request_failed", str(exc))
-    if squads is None:
-        return _error(502, "panel_request_failed", "Unable to load internal squads")
-    items = []
-    for squad in squads:
-        if not isinstance(squad, dict):
-            continue
-        uuid = squad.get("uuid") or squad.get("id")
-        if not uuid:
-            continue
-        items.append(
-            {
-                "uuid": str(uuid),
-                "name": squad.get("name") or squad.get("title") or str(uuid),
-                "members_count": squad.get("membersCount")
-                or squad.get("usersCount")
-                or squad.get("members_count"),
-                "active_inbounds_count": squad.get("activeInboundsCount")
-                or squad.get("active_inbounds_count"),
-            }
-        )
-    return _ok({"squads": items})

backend/bot/app/web/admin_api_impl/payments.py

@@ -1,95 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_payments_list_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    page = max(0, int(request.query.get("page", 0) or 0))
-    page_size = min(100, max(1, int(request.query.get("page_size", 25) or 25)))
-
-    async with async_session_factory() as session:
-        from sqlalchemy.orm import selectinload
-
-        stmt = (
-            select(Payment)
-            .options(selectinload(Payment.user))
-            .order_by(Payment.created_at.desc())
-            .offset(page * page_size)
-            .limit(page_size)
-        )
-        rows = (await session.execute(stmt)).scalars().all()
-        total = await payment_dal.get_payments_count(session)
-
-    return _ok(
-        {
-            "payments": [_serialize_payment(p) for p in rows],
-            "page": page,
-            "page_size": page_size,
-            "total": int(total or 0),
-        }
-    )
-
-
-async def admin_payments_export_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    async with async_session_factory() as session:
-        from sqlalchemy.orm import selectinload
-
-        stmt = (
-            select(Payment)
-            .options(selectinload(Payment.user))
-            .order_by(Payment.created_at.desc())
-            .limit(10000)
-        )
-        rows = (await session.execute(stmt)).scalars().all()
-
-    buffer = io.StringIO()
-    writer = csv.writer(buffer)
-    writer.writerow(
-        [
-            "payment_id",
-            "user_id",
-            "user_label",
-            "provider",
-            "provider_payment_id",
-            "amount",
-            "currency",
-            "status",
-            "description",
-            "duration_months",
-            "sale_mode",
-            "tariff_key",
-            "created_at",
-        ]
-    )
-    for p in rows:
-        label = _payment_user_display_label(p.user, int(p.user_id)) if p.user else str(p.user_id)
-        writer.writerow(
-            [
-                p.payment_id,
-                p.user_id,
-                label,
-                p.provider,
-                p.provider_payment_id or "",
-                p.amount,
-                p.currency,
-                p.status,
-                p.description or "",
-                p.subscription_duration_months or "",
-                p.sale_mode or "",
-                p.tariff_key or "",
-                p.created_at.isoformat() if p.created_at else "",
-            ]
-        )
-
-    response = web.Response(
-        body=buffer.getvalue().encode("utf-8-sig"),
-        content_type="text/csv",
-        charset="utf-8",
-    )
-    response.headers["Content-Disposition"] = 'attachment; filename="payments.csv"'
-    return response

backend/bot/app/web/admin_api_impl/promos.py

@@ -1,96 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_promos_list_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    page = max(0, int(request.query.get("page", 0) or 0))
-    page_size = min(100, max(1, int(request.query.get("page_size", 25) or 25)))
-    async with async_session_factory() as session:
-        promos = await promo_code_dal.get_all_promo_codes_with_details(
-            session, limit=page_size, offset=page * page_size
-        )
-        total = await promo_code_dal.get_promo_codes_count(session)
-    return _ok(
-        {
-            "promos": [_serialize_promo(p) for p in promos],
-            "page": page,
-            "page_size": page_size,
-            "total": int(total or 0),
-        }
-    )
-
-
-async def admin_promo_create_route(request: web.Request) -> web.Response:
-    actor_id = _require_admin_user_id(request)
-    payload = await _read_json(request)
-    code = str(payload.get("code") or "").strip().upper()
-    bonus_days = int(payload.get("bonus_days") or 0)
-    max_activations = int(payload.get("max_activations") or 0)
-    valid_days = payload.get("valid_days")
-    if not code or bonus_days <= 0 or max_activations <= 0:
-        return _error(400, "invalid_payload")
-
-    valid_until = None
-    if valid_days:
-        try:
-            valid_until = datetime.now(timezone.utc) + timedelta(days=int(valid_days))
-        except (TypeError, ValueError):
-            return _error(400, "invalid_valid_days")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        existing = await promo_code_dal.get_promo_code_by_code(session, code)
-        if existing:
-            return _error(409, "duplicate_code")
-        promo = await promo_code_dal.create_promo_code(
-            session,
-            {
-                "code": code,
-                "bonus_days": bonus_days,
-                "max_activations": max_activations,
-                "valid_until": valid_until,
-                "created_by_admin_id": actor_id,
-                "is_active": True,
-            },
-        )
-        await session.commit()
-    return _ok({"promo": _serialize_promo(promo)})
-
-
-async def admin_promo_update_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    promo_id = int(request.match_info["promo_id"])
-    payload = await _read_json(request)
-    update_data: Dict[str, Any] = {}
-    if "is_active" in payload:
-        update_data["is_active"] = bool(payload["is_active"])
-    if "bonus_days" in payload and payload["bonus_days"] is not None:
-        update_data["bonus_days"] = int(payload["bonus_days"])
-    if "max_activations" in payload and payload["max_activations"] is not None:
-        update_data["max_activations"] = int(payload["max_activations"])
-
-    if not update_data:
-        return _error(400, "no_changes")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        promo = await promo_code_dal.update_promo_code(session, promo_id, update_data)
-        if not promo:
-            return _error(404, "not_found")
-        await session.commit()
-        await session.refresh(promo)
-    return _ok({"promo": _serialize_promo(promo)})
-
-
-async def admin_promo_delete_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    promo_id = int(request.match_info["promo_id"])
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        promo = await promo_code_dal.delete_promo_code(session, promo_id)
-        if not promo:
-            return _error(404, "not_found")
-        await session.commit()
-    return _ok({})

backend/bot/app/web/admin_api_impl/routes.py

@@ -1,75 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-def setup_admin_routes(app: web.Application) -> None:
-    router = app.router
-    router.add_get("/api/admin/me", admin_me_route)
-    router.add_get("/api/admin/stats", admin_stats_route)
-
-    router.add_get("/api/admin/users", admin_users_list_route)
-    router.add_get("/api/admin/users/{user_id:-?\\d+}", admin_user_detail_route)
-    router.add_get("/api/admin/users/{user_id:-?\\d+}/avatar", admin_user_avatar_route)
-    router.add_post("/api/admin/users/{user_id:-?\\d+}/ban", admin_user_ban_route)
-    router.add_post("/api/admin/users/{user_id:-?\\d+}/message", admin_user_message_route)
-    router.add_post(
-        "/api/admin/users/{user_id:-?\\d+}/message/preview", admin_user_message_preview_route
-    )
-    router.add_post(
-        "/api/admin/users/{user_id:-?\\d+}/telegram-profile-link",
-        admin_user_telegram_profile_link_route,
-    )
-    router.add_post("/api/admin/users/{user_id:-?\\d+}/reset-trial", admin_user_reset_trial_route)
-    router.add_post("/api/admin/users/{user_id:-?\\d+}/extend", admin_user_extend_route)
-    router.add_post(
-        "/api/admin/users/{user_id:-?\\d+}/premium-override",
-        admin_user_premium_override_route,
-    )
-    router.add_post(
-        "/api/admin/users/{user_id:-?\\d+}/regular-traffic-override",
-        admin_user_regular_traffic_override_route,
-    )
-    router.add_post(
-        "/api/admin/users/{user_id:-?\\d+}/traffic-grant",
-        admin_user_traffic_grant_route,
-    )
-    router.add_delete("/api/admin/users/{user_id:-?\\d+}", admin_user_delete_route)
-
-    router.add_get("/api/admin/payments", admin_payments_list_route)
-    router.add_get("/api/admin/payments/export.csv", admin_payments_export_route)
-
-    router.add_get("/api/admin/promos", admin_promos_list_route)
-    router.add_post("/api/admin/promos", admin_promo_create_route)
-    router.add_patch("/api/admin/promos/{promo_id:\\d+}", admin_promo_update_route)
-    router.add_delete("/api/admin/promos/{promo_id:\\d+}", admin_promo_delete_route)
-
-    router.add_get("/api/admin/logs", admin_logs_route)
-
-    router.add_get("/api/admin/support/tickets", admin_support_tickets_route)
-    router.add_get("/api/admin/support/tickets/{id:\\d+}", admin_support_ticket_detail_route)
-    router.add_post(
-        "/api/admin/support/tickets/{id:\\d+}/messages",
-        admin_support_ticket_reply_route,
-    )
-    router.add_patch("/api/admin/support/tickets/{id:\\d+}", admin_support_ticket_patch_route)
-    router.add_post("/api/admin/support/tickets/{id:\\d+}/read", admin_support_ticket_read_route)
-    router.add_get("/api/admin/support/stats", admin_support_stats_route)
-
-    router.add_post("/api/admin/broadcast", admin_broadcast_route)
-    router.add_post("/api/admin/sync", admin_sync_route)
-
-    router.add_get("/api/admin/ads", admin_ads_list_route)
-    router.add_post("/api/admin/ads", admin_ad_create_route)
-    router.add_post("/api/admin/ads/{campaign_id:\\d+}/toggle", admin_ad_toggle_route)
-    router.add_delete("/api/admin/ads/{campaign_id:\\d+}", admin_ad_delete_route)
-
-    router.add_get("/api/admin/settings", admin_settings_get_route)
-    router.add_patch("/api/admin/settings", admin_settings_patch_route)
-
-    router.add_get("/api/admin/tariffs", admin_tariffs_get_route)
-    router.add_put("/api/admin/tariffs", admin_tariffs_save_route)
-    router.add_get("/api/admin/themes", admin_themes_get_route)
-    router.add_put("/api/admin/themes", admin_themes_save_route)
-    router.add_post("/api/admin/appearance/logo", admin_appearance_logo_upload_route)
-    router.add_post("/api/admin/appearance/favicon", admin_appearance_favicon_upload_route)
-    router.add_get("/api/admin/panel/internal-squads", admin_panel_internal_squads_route)

backend/bot/app/web/admin_api_impl/settings.py

@@ -1,90 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_settings_get_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    async with async_session_factory() as session:
-        overrides = await app_settings_dal.get_overrides_with_meta(session)
-
-    overrides_by_key = {entry["key"]: entry for entry in overrides}
-
-    fields = manifest_payload()
-    sections: Dict[str, Dict[str, Any]] = {}
-    for field in fields:
-        key = field["key"]
-        section_id = field["section"]
-        if section_id not in sections:
-            sections[section_id] = {
-                "id": section_id,
-                "order": field["section_order"],
-                "fields": [],
-            }
-        override = overrides_by_key.get(key)
-        value = current_value(settings, key)
-        is_secret = bool(field.get("secret"))
-        response_field = {
-            **field,
-            "value": "" if is_secret else value,
-            "overridden": bool(override),
-            "updated_at": override.get("updated_at") if override else None,
-        }
-        if is_secret:
-            response_field["has_value"] = bool(value)
-        sections[section_id]["fields"].append(response_field)
-
-    ordered_sections = sorted(sections.values(), key=lambda s: s["order"])
-    return _ok({"sections": ordered_sections})
-
-
-async def admin_settings_patch_route(request: web.Request) -> web.Response:
-    actor_id = _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    payload = await _read_json(request)
-    updates = payload.get("updates") or {}
-    deletes = payload.get("deletes") or []
-    if not isinstance(updates, dict):
-        return _error(400, "invalid_updates")
-    if not isinstance(deletes, list):
-        return _error(400, "invalid_deletes")
-
-    result = await update_overrides(
-        settings,
-        async_session_factory,
-        updates=updates,
-        deletes=deletes,
-        actor_id=actor_id,
-    )
-    if not result.get("ok"):
-        return web.json_response(
-            {"ok": False, "error": "validation_failed", "errors": result.get("errors", {})},
-            status=400,
-        )
-
-    # Bust the public webapp settings cache so users see new values immediately.
-    cache = request.app.get("webapp_settings_cache")
-    if isinstance(cache, dict):
-        cache["ts"] = 0.0
-        cache["data"] = {}
-    if (
-        "WEBAPP_LOGO_URL" in updates
-        or "WEBAPP_LOGO_URL" in deletes
-        or "WEBAPP_LOGO_USE_EMOJI" in updates
-        or "WEBAPP_LOGO_USE_EMOJI" in deletes
-        or "WEBAPP_FAVICON_URL" in updates
-        or "WEBAPP_FAVICON_URL" in deletes
-        or "WEBAPP_FAVICON_USE_CUSTOM" in updates
-        or "WEBAPP_FAVICON_USE_CUSTOM" in deletes
-        or "WEBAPP_LOGO_FAVICON_URL" in updates
-        or "WEBAPP_LOGO_FAVICON_URL" in deletes
-    ):
-        request.app["webapp_logo_cache"] = None
-        from bot.app.web.admin_api_impl.themes import prune_unused_appearance_assets
-
-        prune_unused_appearance_assets(settings)
-
-    return _ok({"applied": result.get("applied", 0), "reverted": result.get("reverted", 0)})

backend/bot/app/web/admin_api_impl/stats.py

@@ -1,168 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-import asyncio
-
-from ._runtime import *  # noqa: F403,F405
-from .auth import _require_admin_user_id
-from .common import _ok, _serialize_payment
-from bot.utils.ttl_cache import AsyncTTLCache
-
-_ADMIN_PANEL_STATS_CACHES: Dict[tuple[int, int], AsyncTTLCache] = {}
-_ADMIN_DB_STATS_CACHES: Dict[tuple[int, int], AsyncTTLCache] = {}
-
-
-async def admin_me_route(request: web.Request) -> web.Response:
-    user_id = _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    return _ok({}, user_id=user_id, admin_ids=list(settings.ADMIN_IDS or []))
-
-
-async def admin_stats_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    payload = dict(await _load_admin_db_stats(settings, async_session_factory))
-
-    panel_service = request.app.get("panel_service")
-    if panel_service is not None:
-        payload["panel"] = await _load_admin_panel_stats(request, settings, panel_service)
-
-    queue_manager = get_queue_manager()
-    if queue_manager:
-        try:
-            payload["queue"] = queue_manager.get_queue_stats()
-        except Exception:  # pragma: no cover - defensive
-            payload["queue"] = None
-
-    payload["currency_symbol"] = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
-    return _ok(payload)
-
-
-async def _load_admin_db_stats(
-    settings: Settings,
-    async_session_factory: sessionmaker,
-) -> Dict[str, Any]:
-    cache = _admin_db_stats_cache(settings)
-    if cache is None:
-        return await _load_admin_db_stats_uncached(async_session_factory)
-    return await cache.get_or_load(
-        "db",
-        lambda: _load_admin_db_stats_uncached(async_session_factory),
-    )
-
-
-async def _load_admin_db_stats_uncached(async_session_factory: sessionmaker) -> Dict[str, Any]:
-    async with async_session_factory() as session:
-        user_stats = await user_dal.get_enhanced_user_statistics(session)
-        financial_stats = await payment_dal.get_financial_statistics(session)
-        sync_status = await panel_sync_dal.get_panel_sync_status(session)
-        recent_payments = await payment_dal.get_recent_payment_logs_with_user(session, limit=10)
-
-    return {
-        "users": user_stats,
-        "financial": financial_stats,
-        "panel_sync": {
-            "status": sync_status.status if sync_status else "never_run",
-            "last_sync_time": sync_status.last_sync_time.isoformat()
-            if sync_status and sync_status.last_sync_time
-            else None,
-            "details": sync_status.details if sync_status else None,
-            "users_processed": sync_status.users_processed_from_panel if sync_status else 0,
-            "subscriptions_synced": sync_status.subscriptions_synced if sync_status else 0,
-        },
-        "recent_payments": [_serialize_payment(p) for p in recent_payments],
-    }
-
-
-def _admin_db_stats_cache(settings: Settings) -> Optional[AsyncTTLCache]:
-    ttl_seconds = int(getattr(settings, "ADMIN_DB_STATS_CACHE_TTL_SECONDS", 5) or 0)
-    if ttl_seconds <= 0:
-        return None
-    cache_key = (id(settings), ttl_seconds)
-    cache = _ADMIN_DB_STATS_CACHES.get(cache_key)
-    if cache is None:
-        cache = AsyncTTLCache(
-            ttl_seconds=ttl_seconds,
-            settings=settings,
-            namespace="admin:db_stats",
-        )
-        _ADMIN_DB_STATS_CACHES[cache_key] = cache
-    return cache
-
-
-async def _load_admin_panel_stats(
-    request: web.Request,
-    settings: Settings,
-    panel_service,
-) -> Dict[str, Any]:
-    cache = _admin_panel_stats_cache(settings)
-    if cache is None:
-        return await _load_admin_panel_stats_uncached(panel_service)
-    return await cache.get_or_load("panel", lambda: _load_admin_panel_stats_uncached(panel_service))
-
-
-def _admin_panel_stats_cache(settings: Settings) -> Optional[AsyncTTLCache]:
-    ttl_seconds = int(getattr(settings, "ADMIN_PANEL_STATS_CACHE_TTL_SECONDS", 15) or 0)
-    if ttl_seconds <= 0:
-        return None
-    cache_key = (id(settings), ttl_seconds)
-    cache = _ADMIN_PANEL_STATS_CACHES.get(cache_key)
-    if cache is None:
-        cache = AsyncTTLCache(
-            ttl_seconds=ttl_seconds,
-            settings=settings,
-            namespace="admin:panel_stats",
-        )
-        _ADMIN_PANEL_STATS_CACHES[cache_key] = cache
-    return cache
-
-
-async def _load_admin_panel_stats_uncached(panel_service) -> Dict[str, Any]:
-    try:
-        today = datetime.now(timezone.utc).date()
-        start_d = today - timedelta(days=7)
-        system, bandwidth, nodes, nodes_bw, lookups = await asyncio.gather(
-            _safe_panel_call(panel_service.get_system_stats(), "system stats"),
-            _safe_panel_call(panel_service.get_bandwidth_stats(), "bandwidth stats"),
-            _safe_panel_call(panel_service.get_nodes_statistics(), "nodes stats"),
-            _safe_panel_call(
-                panel_service.get_nodes_bandwidth_usage(
-                    start=start_d.isoformat(),
-                    end=today.isoformat(),
-                    top_nodes_limit=64,
-                ),
-                "nodes bandwidth range",
-            ),
-            _safe_panel_call(panel_service.get_nodes_online_lookups(), "nodes online lookups"),
-        )
-
-        panel_body: Dict[str, Any] = {
-            "system": system or {},
-            "bandwidth": bandwidth or {},
-            "nodes": nodes or {},
-            "nodes_bandwidth": nodes_bw or {},
-        }
-        if isinstance(lookups, dict):
-            try:
-                online_map = _panel_nodes_online_by_uuid(panel_body.get("nodes"))
-                for k, v in lookups.get("byUuid", {}).items():
-                    online_map[k] = v
-                _enrich_bandwidth_nodes_with_online(
-                    panel_body.get("nodes_bandwidth"),
-                    online_map,
-                    lookups.get("byName") or {},
-                )
-            except Exception as exc_merge:  # pragma: no cover
-                logger.debug("Panel nodes online merge skipped: %s", exc_merge)
-        return panel_body
-    except Exception as exc:
-        logger.debug("Panel stats unavailable: %s", exc)
-        return {"error": "unavailable"}
-
-
-async def _safe_panel_call(awaitable, label: str) -> Any:
-    try:
-        return await awaitable
-    except Exception as exc:  # pragma: no cover - optional panel endpoints
-        logger.debug("Panel %s unavailable: %s", label, exc)
-        return None

backend/bot/app/web/admin_api_impl/support.py

@@ -1,251 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from typing import Literal, Optional
-
-from pydantic import BaseModel, ConfigDict, constr, field_validator
-
-from bot.services.support_service import TicketNotFound
-from db.dal import support_dal, user_dal
-from db.models import SupportTicket, SupportTicketMessage
-
-
-class AdminTicketReplyPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    body: constr(min_length=1, max_length=4000)
-    is_internal_note: bool = False
-
-    @field_validator("body")
-    @classmethod
-    def _strip_body(cls, value: str) -> str:
-        stripped = value.strip()
-        if not stripped:
-            raise ValueError("empty_text")
-        return stripped
-
-
-class AdminTicketPatchPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    status: Optional[Literal["open", "awaiting_user", "awaiting_admin", "resolved", "closed"]] = (
-        None
-    )
-    priority: Optional[Literal["low", "normal", "high", "urgent"]] = None
-    category: Optional[Literal["billing", "technical", "account", "other"]] = None
-    assigned_admin_id: Optional[int] = None
-
-
-def _validate_model_payload(model_cls, payload: Dict[str, Any]):
-    try:
-        return model_cls.model_validate(payload), None
-    except ValidationError:
-        return None, _error(400, "invalid_request", "Invalid request")
-
-
-def _support_ticket_payload(ticket: SupportTicket) -> Dict[str, Any]:
-    return {
-        "ticket_id": ticket.ticket_id,
-        "user_id": ticket.user_id,
-        "subject": ticket.subject,
-        "category": ticket.category,
-        "priority": ticket.priority,
-        "status": ticket.status,
-        "assigned_admin_id": ticket.assigned_admin_id,
-        "last_message_at": ticket.last_message_at.isoformat() if ticket.last_message_at else None,
-        "last_message_role": ticket.last_message_role,
-        "unread_user_count": int(ticket.unread_user_count or 0),
-        "unread_admin_count": int(ticket.unread_admin_count or 0),
-        "created_at": ticket.created_at.isoformat() if ticket.created_at else None,
-        "updated_at": ticket.updated_at.isoformat() if ticket.updated_at else None,
-        "closed_at": ticket.closed_at.isoformat() if ticket.closed_at else None,
-    }
-
-
-def _user_display_name(user) -> Optional[str]:
-    if not user:
-        return None
-    name = " ".join(
-        part.strip() for part in [user.first_name, user.last_name] if part and part.strip()
-    ).strip()
-    return name or user.username or user.email or str(user.user_id)
-
-
-def _support_message_payload(
-    message: SupportTicketMessage,
-    *,
-    authors: Optional[Dict[int, Any]] = None,
-) -> Dict[str, Any]:
-    author = authors.get(message.author_user_id) if authors and message.author_user_id else None
-    return {
-        "message_id": message.message_id,
-        "ticket_id": message.ticket_id,
-        "author_role": message.author_role,
-        "author_user_id": message.author_user_id,
-        "author_name": _user_display_name(author),
-        "body": message.body,
-        "is_internal_note": bool(message.is_internal_note),
-        "created_at": message.created_at.isoformat() if message.created_at else None,
-        "read_by_user_at": message.read_by_user_at.isoformat() if message.read_by_user_at else None,
-        "read_by_admin_at": message.read_by_admin_at.isoformat()
-        if message.read_by_admin_at
-        else None,
-    }
-
-
-def _admin_support_user_payload(user) -> Dict[str, Any]:
-    if not user:
-        return {}
-    return {
-        "user_id": user.user_id,
-        "telegram_id": user.telegram_id,
-        "username": user.username,
-        "first_name": user.first_name,
-        "last_name": user.last_name,
-        "email": user.email,
-        "telegram_photo_url": user.telegram_photo_url,
-        "is_banned": bool(user.is_banned),
-        "registration_date": user.registration_date.isoformat() if user.registration_date else None,
-    }
-
-
-def _support_limit_offset(request: web.Request) -> tuple[int, int]:
-    limit = max(1, min(100, int(request.query.get("limit", 25) or 25)))
-    offset = max(0, int(request.query.get("offset", 0) or 0))
-    return limit, offset
-
-
-async def admin_support_tickets_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    limit, offset = _support_limit_offset(request)
-    assigned_raw = request.query.get("assigned")
-    assigned_admin_id = None
-    if assigned_raw and assigned_raw not in {"all", "any"}:
-        assigned_admin_id = int(assigned_raw)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        tickets = await support_dal.list_admin_tickets(
-            session,
-            status=request.query.get("status") or None,
-            priority=request.query.get("priority") or None,
-            category=request.query.get("category") or None,
-            assigned_admin_id=assigned_admin_id,
-            search=request.query.get("search") or None,
-            sort=request.query.get("sort") or "updated_desc",
-            limit=limit,
-            offset=offset,
-        )
-    return web.json_response(
-        {
-            "ok": True,
-            "tickets": [
-                {
-                    **_support_ticket_payload(ticket),
-                    "user": _admin_support_user_payload(getattr(ticket, "user", None)),
-                }
-                for ticket in tickets
-            ],
-        }
-    )
-
-
-async def admin_support_ticket_detail_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    service = request.app["support_service"]
-    async with async_session_factory() as session:
-        ticket, messages = await support_dal.get_ticket(session, ticket_id, include_internal=True)
-        if not ticket:
-            return _error(404, "not_found", "Ticket not found")
-        user = await user_dal.get_user_by_id(session, ticket.user_id)
-        snapshot = await service.build_user_snapshot(user, session=session) if user else {}
-        author_ids = {m.author_user_id for m in messages if m.author_user_id is not None}
-        authors = {}
-        for author_id in author_ids:
-            author = await user_dal.get_user_by_id(session, author_id)
-            if author:
-                authors[author_id] = author
-    return web.json_response(
-        {
-            "ok": True,
-            "ticket": {
-                **_support_ticket_payload(ticket),
-                "user": _admin_support_user_payload(user),
-            },
-            "messages": [_support_message_payload(m, authors=authors) for m in messages],
-            "user_snapshot": snapshot,
-        }
-    )
-
-
-async def admin_support_ticket_reply_route(request: web.Request) -> web.Response:
-    admin_id = _require_admin_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    payload, error = _validate_model_payload(AdminTicketReplyPayload, await _read_json(request))
-    if error:
-        return error
-    try:
-        ticket, message = await request.app["support_service"].reply_as_admin(
-            admin_id,
-            ticket_id,
-            payload.body,
-            is_internal_note=payload.is_internal_note,
-        )
-    except TicketNotFound:
-        return _error(404, "not_found", "Ticket not found")
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        admin = await user_dal.get_user_by_id(session, admin_id)
-    return web.json_response(
-        {
-            "ok": True,
-            "ticket": _support_ticket_payload(ticket),
-            "message": _support_message_payload(
-                message, authors={admin_id: admin} if admin else {}
-            ),
-        }
-    )
-
-
-async def admin_support_ticket_patch_route(request: web.Request) -> web.Response:
-    admin_id = _require_admin_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    payload, error = _validate_model_payload(AdminTicketPatchPayload, await _read_json(request))
-    if error:
-        return error
-    updates = payload.model_dump(exclude_unset=True)
-    try:
-        if updates.get("status") == "closed":
-            ticket = await request.app["support_service"].close_ticket(admin_id, ticket_id)
-            updates.pop("status", None)
-            if updates:
-                ticket = await request.app["support_service"]._update_and_audit(
-                    admin_id,
-                    ticket_id,
-                    **updates,
-                )
-        else:
-            ticket = await request.app["support_service"]._update_and_audit(
-                admin_id,
-                ticket_id,
-                **updates,
-            )
-    except TicketNotFound:
-        return _error(404, "not_found", "Ticket not found")
-    return web.json_response({"ok": True, "ticket": _support_ticket_payload(ticket)})
-
-
-async def admin_support_ticket_read_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    await request.app["support_service"].mark_read_as_admin(ticket_id)
-    return web.json_response({"ok": True})
-
-
-async def admin_support_stats_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        stats = await support_dal.admin_stats(session)
-    return web.json_response({"ok": True, "stats": stats})

backend/bot/app/web/admin_api_impl/sync.py

@@ -1,16 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_sync_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    queued = await enqueue_webhook_event(
-        settings,
-        "panel_sync",
-        {"requested_by": _require_admin_user_id(request)},
-        event_id=None,
-    )
-    if queued:
-        return _ok({"result": {"status": "queued"}})
-    return _error(503, "queue_unavailable")

backend/bot/app/web/admin_api_impl/tariffs.py

@@ -1,63 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def admin_tariffs_get_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    path = _tariffs_config_path(settings)
-
-    try:
-        config = settings.tariffs_config
-    except Exception as exc:
-        logger.warning("Invalid tariffs config requested from admin UI: %s", exc)
-        return _error(400, "invalid_tariffs_config", str(exc))
-
-    if config is None:
-        return _ok(
-            {
-                "exists": path.exists(),
-                "path": str(path),
-                "catalog": {
-                    "default_tariff": "",
-                    "topup_packages_default": {"rub": [], "stars": []},
-                    "tariffs": [],
-                },
-            }
-        )
-
-    return _ok(
-        {
-            "exists": True,
-            "path": str(path),
-            "catalog": _tariffs_config_payload(config),
-        }
-    )
-
-
-async def admin_tariffs_save_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    payload = await _read_json(request)
-    catalog = payload.get("catalog") if "catalog" in payload else payload
-    if not isinstance(catalog, dict):
-        return _error(400, "invalid_payload", "catalog must be an object")
-
-    try:
-        config = TariffsConfig.model_validate(catalog)
-    except (ValidationError, ValueError) as exc:
-        return _error(400, "invalid_tariffs_config", str(exc))
-
-    path = _tariffs_config_path(settings)
-    try:
-        _write_tariffs_config_file(path, config)
-    except OSError as exc:
-        logger.exception("Failed to write tariffs config to %s", path)
-        return _error(500, "write_failed", str(exc))
-
-    cache = request.app.get("webapp_settings_cache")
-    if isinstance(cache, dict):
-        cache["ts"] = 0.0
-        cache["data"] = {}
-
-    return _ok({"exists": True, "path": str(path), "catalog": _tariffs_config_payload(config)})

backend/bot/app/web/admin_api_impl/themes.py

@@ -1,498 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-import asyncio
-import hashlib
-import ipaddress
-import shutil
-import re
-import socket
-
-from aiohttp import ClientSession, ClientTimeout
-from PIL import Image, ImageOps, UnidentifiedImageError
-
-from config.webapp_themes_config import (
-    WebappThemesConfig,
-    ensure_webapp_core_themes,
-    resolved_webapp_themes_catalog,
-    write_webapp_theme_dir,
-)
-
-
-WEBAPP_LOGO_MAX_BYTES = 2 * 1024 * 1024
-WEBAPP_UPLOADED_LOGO_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-logo" / "uploads"
-WEBAPP_UPLOADED_LOGO_PATH = "/webapp-uploaded-logo"
-WEBAPP_FAVICON_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-logo" / "favicons"
-WEBAPP_FAVICON_PATH = "/webapp-favicon"
-WEBAPP_EMOJI_CACHE_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-emoji"
-WEBAPP_FAVICON_SIZES = (16, 32, 48, 180, 192, 512)
-WEBAPP_LOGO_UPLOAD_CONTENT_TYPES = {
-    ".gif": "image/gif",
-    ".ico": "image/x-icon",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".png": "image/png",
-    ".svg": "image/svg+xml",
-    ".webp": "image/webp",
-}
-
-
-def _theme_payload_for_version_compare(theme: Any) -> Dict[str, Any]:
-    if hasattr(theme, "model_dump"):
-        data = theme.model_dump(mode="json", exclude_none=True)
-    elif isinstance(theme, dict):
-        data = dict(theme)
-    else:
-        data = {}
-    data.pop("assets_version", None)
-    data.pop("default", None)
-    return data
-
-
-def _bump_theme_asset_versions(
-    config: WebappThemesConfig,
-    previous: WebappThemesConfig,
-) -> WebappThemesConfig:
-    previous_by_key = {theme.key: theme for theme in previous.themes}
-    default_changed = config.default_theme != previous.default_theme
-    data = config.model_dump(mode="json", exclude_none=True)
-    for theme in data.get("themes", []):
-        if not isinstance(theme, dict):
-            continue
-        if not str(theme.get("css_file") or "").strip():
-            continue
-        key = str(theme.get("key") or "")
-        previous_theme = previous_by_key.get(key)
-        previous_version = int(getattr(previous_theme, "assets_version", 0) or 0)
-        current_version = int(theme.get("assets_version") or 1)
-        theme_changed = (
-            previous_theme is None
-            or _theme_payload_for_version_compare(theme)
-            != _theme_payload_for_version_compare(previous_theme)
-        )
-        if theme_changed or (default_changed and key == config.default_theme):
-            theme["assets_version"] = max(previous_version + 1, current_version, 1)
-        elif previous_version > current_version:
-            theme["assets_version"] = previous_version
-    return WebappThemesConfig.model_validate(data)
-
-
-def _detect_logo_extension(
-    body: bytes, content_type: str = "", filename: str = ""
-) -> Optional[str]:
-    content_type = (content_type or "").split(";", 1)[0].strip().lower()
-    suffix = Path(filename or "").suffix.lower()
-    if content_type == "image/png" or body.startswith(b"\x89PNG\r\n\x1a\n"):
-        return ".png"
-    if content_type == "image/jpeg" or body.startswith(b"\xff\xd8\xff"):
-        return ".jpg"
-    if content_type == "image/gif" or body.startswith((b"GIF87a", b"GIF89a")):
-        return ".gif"
-    if content_type == "image/webp" or (
-        len(body) > 12 and body[:4] == b"RIFF" and body[8:12] == b"WEBP"
-    ):
-        return ".webp"
-    if content_type in {"image/svg+xml", "image/svg"} or suffix == ".svg":
-        head = body[:512].lstrip().lower()
-        if head.startswith(b"<svg") or b"<svg" in head:
-            return ".svg"
-    if content_type == "image/x-icon" or suffix == ".ico":
-        if body.startswith(b"\x00\x00\x01\x00"):
-            return ".ico"
-    return suffix if suffix in WEBAPP_LOGO_UPLOAD_CONTENT_TYPES else None
-
-
-def _write_uploaded_logo(body: bytes, content_type: str = "", filename: str = "") -> str:
-    if not body or len(body) > WEBAPP_LOGO_MAX_BYTES:
-        raise ValueError("logo must be a non-empty image up to 2 MiB")
-    ext = _detect_logo_extension(body, content_type, filename)
-    if ext not in WEBAPP_LOGO_UPLOAD_CONTENT_TYPES:
-        raise ValueError("unsupported image type")
-    digest = hashlib.sha256(body).hexdigest()[:16]
-    safe_name = f"logo-{digest}{ext}"
-    WEBAPP_UPLOADED_LOGO_DIR.mkdir(parents=True, exist_ok=True)
-    (WEBAPP_UPLOADED_LOGO_DIR / safe_name).write_bytes(body)
-    return f"{WEBAPP_UPLOADED_LOGO_PATH}/{safe_name}"
-
-
-def _uploaded_logo_filename(url: str) -> Optional[str]:
-    parsed = urlsplit(str(url or ""))
-    path = parsed.path if parsed.scheme or parsed.netloc else str(url or "")
-    prefix = f"{WEBAPP_UPLOADED_LOGO_PATH}/"
-    if not path.startswith(prefix):
-        return None
-    filename = path.removeprefix(prefix)
-    if re.fullmatch(r"logo-[0-9a-f]{16}\.(?:gif|ico|jpe?g|png|svg|webp)", filename):
-        return filename
-    return None
-
-
-def _favicon_digest(url: str) -> Optional[str]:
-    parsed = urlsplit(str(url or ""))
-    path = parsed.path if parsed.scheme or parsed.netloc else str(url or "")
-    match = re.fullmatch(
-        rf"{re.escape(WEBAPP_FAVICON_PATH)}/([0-9a-f]{{16}})/(?:[A-Za-z0-9_.-]+)",
-        path,
-    )
-    return match.group(1) if match else None
-
-
-def _emoji_to_codepoints(value: str) -> str:
-    return "_".join(f"{ord(char):x}" for char in str(value or "").strip())
-
-
-def prune_unused_appearance_assets(settings: Settings) -> None:
-    keep_logos = {
-        filename
-        for filename in [
-            _uploaded_logo_filename(getattr(settings, "WEBAPP_LOGO_URL", "")),
-        ]
-        if filename
-    }
-    keep_favicons = {
-        digest
-        for digest in [
-            _favicon_digest(getattr(settings, "WEBAPP_FAVICON_URL", "")),
-            _favicon_digest(getattr(settings, "WEBAPP_LOGO_FAVICON_URL", "")),
-        ]
-        if digest
-    }
-    keep_emoji_prefixes = set()
-    if (
-        getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False)
-        and str(getattr(settings, "WEBAPP_LOGO_EMOJI_FONT", "") or "").strip()
-        == "noto-color-animated"
-    ):
-        codepoints = _emoji_to_codepoints(getattr(settings, "WEBAPP_LOGO_EMOJI", ""))
-        if codepoints:
-            keep_emoji_prefixes.add(f"{codepoints}.512.")
-
-    for path in WEBAPP_UPLOADED_LOGO_DIR.glob("logo-*"):
-        if path.is_file() and path.name not in keep_logos:
-            try:
-                path.unlink()
-            except OSError:
-                logger.warning("Failed to remove unused webapp logo %s", path, exc_info=True)
-
-    for path in WEBAPP_FAVICON_DIR.glob("*"):
-        if (
-            path.is_dir()
-            and re.fullmatch(r"[0-9a-f]{16}", path.name)
-            and path.name not in keep_favicons
-        ):
-            try:
-                shutil.rmtree(path)
-            except OSError:
-                logger.warning("Failed to remove unused webapp favicon set %s", path, exc_info=True)
-
-    for path in WEBAPP_EMOJI_CACHE_DIR.glob("*.512.*"):
-        if path.is_file() and not any(
-            path.name.startswith(prefix) for prefix in keep_emoji_prefixes
-        ):
-            try:
-                path.unlink()
-            except OSError:
-                logger.warning("Failed to remove unused webapp emoji asset %s", path, exc_info=True)
-
-
-async def _persist_appearance_upload(
-    request: web.Request,
-    updates: Dict[str, Any],
-    actor_id: int,
-) -> bool:
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    result = await update_overrides(
-        settings,
-        async_session_factory,
-        updates=updates,
-        deletes=[],
-        actor_id=actor_id,
-    )
-    if not result.get("ok"):
-        logger.warning("Failed to persist uploaded appearance asset settings: %s", result)
-        return False
-
-    cache = request.app.get("webapp_settings_cache")
-    if isinstance(cache, dict):
-        cache["ts"] = 0.0
-        cache["data"] = {}
-    request.app["webapp_logo_cache"] = None
-    prune_unused_appearance_assets(settings)
-    return True
-
-
-def _image_to_square_icon(source: Image.Image, size: int) -> Image.Image:
-    fitted = source.copy()
-    fitted.thumbnail((size, size), Image.Resampling.LANCZOS)
-    canvas = Image.new("RGBA", (size, size), (0, 0, 0, 0))
-    left = (size - fitted.width) // 2
-    top = (size - fitted.height) // 2
-    canvas.alpha_composite(fitted, (left, top))
-    return canvas
-
-
-def _write_favicon_set(body: bytes, content_type: str = "", filename: str = "") -> Dict[str, Any]:
-    if not body or len(body) > WEBAPP_LOGO_MAX_BYTES:
-        raise ValueError("favicon source must be a non-empty image up to 2 MiB")
-
-    ext = _detect_logo_extension(body, content_type, filename)
-    digest = hashlib.sha256(body).hexdigest()[:16]
-    target_dir = WEBAPP_FAVICON_DIR / digest
-    target_dir.mkdir(parents=True, exist_ok=True)
-
-    if ext == ".svg":
-        safe_name = "favicon.svg"
-        (target_dir / safe_name).write_bytes(body)
-        return {
-            "favicon_url": f"{WEBAPP_FAVICON_PATH}/{digest}/{safe_name}",
-            "variants": {"svg": f"{WEBAPP_FAVICON_PATH}/{digest}/{safe_name}"},
-        }
-
-    try:
-        with Image.open(io.BytesIO(body)) as image:
-            image.seek(0)
-            source = ImageOps.exif_transpose(image).convert("RGBA")
-    except (OSError, UnidentifiedImageError, ValueError) as exc:
-        raise ValueError("favicon source must be a raster image") from exc
-
-    if source.width < 1 or source.height < 1 or source.width > 8192 or source.height > 8192:
-        raise ValueError("favicon source dimensions are not supported")
-
-    variants: Dict[str, str] = {}
-    png_icons: Dict[int, Image.Image] = {}
-    for size in WEBAPP_FAVICON_SIZES:
-        icon = _image_to_square_icon(source, size)
-        png_icons[size] = icon
-        filename = f"icon-{size}.png"
-        icon.save(target_dir / filename, format="PNG", optimize=True)
-        variants[f"{size}"] = f"{WEBAPP_FAVICON_PATH}/{digest}/{filename}"
-
-    png_icons[180].save(target_dir / "apple-touch-icon.png", format="PNG", optimize=True)
-    variants["apple_touch"] = f"{WEBAPP_FAVICON_PATH}/{digest}/apple-touch-icon.png"
-    png_icons[32].save(
-        target_dir / "favicon.ico",
-        format="ICO",
-        sizes=[(16, 16), (32, 32), (48, 48)],
-    )
-    variants["ico"] = f"{WEBAPP_FAVICON_PATH}/{digest}/favicon.ico"
-    return {
-        "favicon_url": variants["180"],
-        "variants": variants,
-    }
-
-
-async def _read_uploaded_logo_file(request: web.Request) -> tuple[bytes, str, str]:
-    reader = await request.multipart()
-    async for part in reader:
-        if part.name != "file":
-            continue
-        body = bytearray()
-        while True:
-            chunk = await part.read_chunk(size=64 * 1024)
-            if not chunk:
-                break
-            body.extend(chunk)
-            if len(body) > WEBAPP_LOGO_MAX_BYTES:
-                raise ValueError("logo must be up to 2 MiB")
-        return bytes(body), part.headers.get("Content-Type", ""), part.filename or ""
-    raise ValueError("file field is required")
-
-
-async def _hostname_resolves_to_public_address(hostname: str) -> bool:
-    if not hostname:
-        return False
-    try:
-        ip_obj = ipaddress.ip_address(hostname)
-        return not (
-            ip_obj.is_private
-            or ip_obj.is_loopback
-            or ip_obj.is_link_local
-            or ip_obj.is_unspecified
-            or ip_obj.is_reserved
-        )
-    except ValueError:
-        pass
-
-    loop = asyncio.get_running_loop()
-    try:
-        resolved = await loop.getaddrinfo(hostname, None, type=socket.SOCK_STREAM)
-    except Exception:
-        return False
-
-    found_public_ip = False
-    for entry in resolved:
-        sockaddr = entry[4]
-        candidate = sockaddr[0] if sockaddr else ""
-        try:
-            ip_obj = ipaddress.ip_address(candidate)
-        except ValueError:
-            continue
-        if (
-            ip_obj.is_private
-            or ip_obj.is_loopback
-            or ip_obj.is_link_local
-            or ip_obj.is_unspecified
-            or ip_obj.is_reserved
-        ):
-            return False
-        found_public_ip = True
-    return found_public_ip
-
-
-async def _fetch_logo_from_url(url: str) -> tuple[bytes, str, str]:
-    parsed = urlsplit(url)
-    if parsed.scheme != "https" or not parsed.hostname:
-        raise ValueError("only https image URLs are supported")
-    if not await _hostname_resolves_to_public_address(parsed.hostname):
-        raise ValueError("logo URL must resolve to a public address")
-
-    timeout = ClientTimeout(total=5)
-    async with ClientSession(timeout=timeout, headers={"User-Agent": "Mozilla/5.0"}) as session:
-        async with session.get(
-            url,
-            allow_redirects=False,
-            headers={"Accept": "image/avif,image/webp,image/svg+xml,image/png,image/*,*/*;q=0.8"},
-        ) as response:
-            if response.status != 200:
-                raise ValueError(f"logo URL returned HTTP {response.status}")
-            content_type = (
-                (response.headers.get("Content-Type") or "").split(";", 1)[0].strip().lower()
-            )
-            if content_type and not content_type.startswith("image/"):
-                raise ValueError("logo URL returned non-image content")
-            body = bytearray()
-            async for chunk in response.content.iter_chunked(64 * 1024):
-                body.extend(chunk)
-                if len(body) > WEBAPP_LOGO_MAX_BYTES:
-                    raise ValueError("logo must be up to 2 MiB")
-            return bytes(body), content_type, Path(parsed.path).name
-
-
-async def admin_appearance_logo_upload_route(request: web.Request) -> web.Response:
-    actor_id = _require_admin_user_id(request)
-    content_type = (request.headers.get("Content-Type") or "").lower()
-    try:
-        if content_type.startswith("multipart/form-data"):
-            body, detected_content_type, filename = await _read_uploaded_logo_file(request)
-        else:
-            payload = await _read_json(request)
-            source_url = str(payload.get("url") or "").strip()
-            if not source_url:
-                return _error(400, "invalid_payload", "url or file is required")
-            body, detected_content_type, filename = await _fetch_logo_from_url(source_url)
-        logo_url = _write_uploaded_logo(body, detected_content_type, filename)
-        try:
-            favicon_payload = _write_favicon_set(body, detected_content_type, filename)
-        except ValueError:
-            favicon_payload = {}
-    except ValueError as exc:
-        return _error(400, "invalid_logo", str(exc))
-    except OSError as exc:
-        logger.exception("Failed to save uploaded webapp logo")
-        return _error(500, "write_failed", str(exc))
-    persisted = await _persist_appearance_upload(
-        request,
-        {
-            "WEBAPP_LOGO_URL": logo_url,
-            "WEBAPP_LOGO_USE_EMOJI": False,
-            **(
-                {"WEBAPP_LOGO_FAVICON_URL": favicon_payload["favicon_url"]}
-                if favicon_payload.get("favicon_url")
-                else {}
-            ),
-        },
-        actor_id,
-    )
-
-    return _ok({"logo_url": logo_url, "persisted": persisted, **favicon_payload})
-
-
-async def admin_appearance_favicon_upload_route(request: web.Request) -> web.Response:
-    actor_id = _require_admin_user_id(request)
-    content_type = (request.headers.get("Content-Type") or "").lower()
-    try:
-        if content_type.startswith("multipart/form-data"):
-            body, detected_content_type, filename = await _read_uploaded_logo_file(request)
-        else:
-            payload = await _read_json(request)
-            source_url = str(payload.get("url") or "").strip()
-            if not source_url:
-                return _error(400, "invalid_payload", "url or file is required")
-            body, detected_content_type, filename = await _fetch_logo_from_url(source_url)
-        favicon_payload = _write_favicon_set(body, detected_content_type, filename)
-    except ValueError as exc:
-        return _error(400, "invalid_favicon", str(exc))
-    except OSError as exc:
-        logger.exception("Failed to save uploaded webapp favicon")
-        return _error(500, "write_failed", str(exc))
-    persisted = await _persist_appearance_upload(
-        request,
-        {
-            "WEBAPP_FAVICON_URL": favicon_payload["favicon_url"],
-            "WEBAPP_FAVICON_USE_CUSTOM": True,
-        },
-        actor_id,
-    )
-
-    return _ok({"persisted": persisted, **favicon_payload})
-
-
-async def admin_themes_get_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    primary = settings.WEBAPP_PRIMARY_COLOR or "#00fe7a"
-    catalog = resolved_webapp_themes_catalog(
-        primary_accent=primary,
-        env_default_theme=settings.WEBAPP_DEFAULT_THEME,
-        theme_dir=settings.WEBAPP_THEMES_DIR,
-    )
-
-    return _ok(
-        {
-            "exists": Path(settings.WEBAPP_THEMES_DIR).expanduser().exists(),
-            "themes_dir": str(Path(settings.WEBAPP_THEMES_DIR).expanduser()),
-            "catalog": _webapp_themes_catalog_payload(catalog),
-        }
-    )
-
-
-async def admin_themes_save_route(request: web.Request) -> web.Response:
-    _require_admin_user_id(request)
-    settings: Settings = request.app["settings"]
-    previous_config = resolved_webapp_themes_catalog(
-        primary_accent=settings.WEBAPP_PRIMARY_COLOR or "#00fe7a",
-        env_default_theme=settings.WEBAPP_DEFAULT_THEME,
-        theme_dir=settings.WEBAPP_THEMES_DIR,
-    )
-    payload = await _read_json(request)
-    catalog = payload.get("catalog") if "catalog" in payload else payload
-    if not isinstance(catalog, dict):
-        return _error(400, "invalid_payload", "catalog must be an object")
-
-    try:
-        config = WebappThemesConfig.model_validate(catalog)
-    except (ValidationError, ValueError) as exc:
-        return _error(400, "invalid_webapp_themes_config", str(exc))
-
-    config, _changed = ensure_webapp_core_themes(config, settings.WEBAPP_PRIMARY_COLOR or "#00fe7a")
-    config = _bump_theme_asset_versions(config, previous_config)
-
-    try:
-        write_webapp_theme_dir(settings.WEBAPP_THEMES_DIR, config, delete_missing=True)
-    except OSError as exc:
-        logger.exception("Failed to write webapp themes to %s", settings.WEBAPP_THEMES_DIR)
-        return _error(500, "write_failed", str(exc))
-
-    cache = request.app.get("webapp_settings_cache")
-    if isinstance(cache, dict):
-        cache["ts"] = 0.0
-        cache["data"] = {}
-
-    return _ok(
-        {
-            "exists": True,
-            "themes_dir": str(Path(settings.WEBAPP_THEMES_DIR).expanduser()),
-            "catalog": _webapp_themes_catalog_payload(config),
-        }
-    )

backend/bot/app/web/admin_settings_manifest.py

@@ -1,576 +0,0 @@
-"""Manifest of settings editable from the admin web app.
-
-Each entry describes a single overridable attribute on the global
-``Settings`` instance. The manifest is the only contract between the
-admin UI and the backend: keys not listed here cannot be changed via
-the API, even by an admin.
-"""
-
-from __future__ import annotations
-
-import re
-from dataclasses import dataclass
-from typing import Any, List, Optional, Tuple
-
-
-@dataclass(frozen=True)
-class SettingField:
-    key: str
-    type: str  # "string" | "int" | "float" | "bool" | "text" | "url" | "color" | "icon"
-    section: str
-    label: str
-    description: str = ""
-    placeholder: str = ""
-    optional: bool = True
-    secret: bool = False
-    min: Optional[float] = None
-    max: Optional[float] = None
-    choices: Optional[Tuple[Tuple[str, str], ...]] = None
-    subsection: Optional[str] = None  # group label inside a section
-    i18n_label_key: Optional[str] = None
-    i18n_description_key: Optional[str] = None
-    i18n_subsection_key: Optional[str] = None
-
-
-SETTINGS_MANIFEST: List[SettingField] = [
-    # ─── General ────────────────────────────────────────────────────
-    SettingField(
-        "DEFAULT_LANGUAGE",
-        "string",
-        "general",
-        "Язык по умолчанию",
-        "Используется для приветственных сообщений и публичных страниц.",
-    ),
-    SettingField(
-        "DEFAULT_CURRENCY_SYMBOL",
-        "string",
-        "general",
-        "Валюта",
-        "Например, RUB, USD, EUR.",
-        placeholder="RUB",
-    ),
-    SettingField(
-        "SUPPORT_LINK", "url", "general", "Ссылка поддержки", "Куда вести пользователей за помощью."
-    ),
-    SettingField("SERVER_STATUS_URL", "url", "general", "Ссылка на статус серверов"),
-    SettingField("TERMS_OF_SERVICE_URL", "url", "general", "Условия использования"),
-    SettingField("PRIVACY_POLICY_URL", "url", "general", "Политика конфиденциальности"),
-    SettingField("USER_AGREEMENT_URL", "url", "general", "Пользовательское соглашение"),
-    SettingField("DISABLE_WELCOME_MESSAGE", "bool", "general", "Скрыть приветствие /start"),
-    SettingField(
-        "START_COMMAND_DESCRIPTION", "string", "general", "Описание /start", placeholder=""
-    ),
-    SettingField(
-        "REQUIRED_CHANNEL_ID",
-        "int",
-        "general",
-        "ID обязательного канала",
-        "Telegram ID канала, в котором нужно состоять.",
-    ),
-    SettingField(
-        "REQUIRED_CHANNEL_LINK",
-        "string",
-        "general",
-        "Ссылка на канал",
-        "Имя пользователя или invite-link.",
-    ),
-    SettingField(
-        "PANEL_API_URL",
-        "url",
-        "general",
-        "URL API Remnawave",
-        "Например, https://panel.example.com/api.",
-        subsection="Remnawave",
-    ),
-    SettingField(
-        "PANEL_API_KEY",
-        "string",
-        "general",
-        "API-ключ Remnawave",
-        "Секретный ключ API панели.",
-        secret=True,
-        subsection="Remnawave",
-    ),
-    SettingField(
-        "PANEL_WEBHOOK_SECRET",
-        "string",
-        "general",
-        "Секрет вебхуков Remnawave",
-        "Используется для проверки входящих вебхуков панели.",
-        secret=True,
-        subsection="Remnawave",
-    ),
-    SettingField(
-        "USER_SQUAD_UUIDS",
-        "string",
-        "general",
-        "Internal Squads по умолчанию",
-        "UUID через запятую для legacy-режима без JSON-каталога тарифов.",
-        subsection="Remnawave",
-    ),
-    SettingField(
-        "USER_EXTERNAL_SQUAD_UUID",
-        "string",
-        "general",
-        "External Squad по умолчанию",
-        "Необязательный UUID External Squad для новых пользователей.",
-        subsection="Remnawave",
-    ),
-    # ─── Web app appearance ────────────────────────────────────────
-    SettingField(
-        "WEBAPP_TITLE", "string", "appearance", "Название Web App", placeholder="Моя подписка"
-    ),
-    SettingField(
-        "SUBSCRIPTION_MINI_APP_URL",
-        "url",
-        "appearance",
-        "Публичный URL Mini App",
-        "Например, https://app.example.com/.",
-    ),
-    SettingField(
-        "WEBAPP_PRIMARY_COLOR", "color", "appearance", "Основной цвет", placeholder="#00fe7a"
-    ),
-    SettingField("WEBAPP_LOGO_USE_EMOJI", "bool", "appearance", "Использовать эмоджи-логотип"),
-    SettingField("WEBAPP_LOGO_URL", "url", "appearance", "URL логотипа"),
-    SettingField("WEBAPP_LOGO_EMOJI", "string", "appearance", "Эмоджи-логотип", placeholder="🫥"),
-    SettingField(
-        "WEBAPP_LOGO_EMOJI_FONT",
-        "string",
-        "appearance",
-        "Шрифт эмоджи-логотипа",
-        "Выберите шрифт для отображения эмодзи-логотипа",
-        choices=(
-            ("system", "Системный (по умолчанию)"),
-            ("noto-color", "Noto Color Emoji"),
-            ("noto-color-animated", "Noto Color Emoji Animated"),
-            ("noto-emoji", "Noto Emoji"),
-            ("twemoji", "Twitter Emoji"),
-            ("openmoji", "OpenMoji"),
-            ("apple", "Apple Color Emoji (local)"),
-            ("segoe", "Segoe UI Emoji (local)"),
-            ("noto-local", "Noto Emoji (local)"),
-        ),
-    ),
-    SettingField(
-        "WEBAPP_FAVICON_USE_CUSTOM",
-        "bool",
-        "appearance",
-        "Использовать отдельную favicon",
-    ),
-    SettingField("WEBAPP_FAVICON_URL", "url", "appearance", "URL отдельной favicon"),
-    SettingField("WEBAPP_LOGO_FAVICON_URL", "url", "appearance", "Favicon из логотипа"),
-    SettingField("WEBAPP_ENABLED", "bool", "appearance", "Web App включён"),
-    # ─── Subscription periods & pricing ────────────────────────────
-    SettingField("MONTH_1_ENABLED", "bool", "pricing", "Тариф 1 месяц"),
-    SettingField("MONTH_3_ENABLED", "bool", "pricing", "Тариф 3 месяца"),
-    SettingField("MONTH_6_ENABLED", "bool", "pricing", "Тариф 6 месяцев"),
-    SettingField("MONTH_12_ENABLED", "bool", "pricing", "Тариф 12 месяцев"),
-    SettingField("RUB_PRICE_1_MONTH", "int", "pricing", "Цена 1 мес. (RUB)"),
-    SettingField("RUB_PRICE_3_MONTHS", "int", "pricing", "Цена 3 мес. (RUB)"),
-    SettingField("RUB_PRICE_6_MONTHS", "int", "pricing", "Цена 6 мес. (RUB)"),
-    SettingField("RUB_PRICE_12_MONTHS", "int", "pricing", "Цена 12 мес. (RUB)"),
-    SettingField("STARS_PRICE_1_MONTH", "int", "pricing", "Цена 1 мес. (Stars)"),
-    SettingField("STARS_PRICE_3_MONTHS", "int", "pricing", "Цена 3 мес. (Stars)"),
-    SettingField("STARS_PRICE_6_MONTHS", "int", "pricing", "Цена 6 мес. (Stars)"),
-    SettingField("STARS_PRICE_12_MONTHS", "int", "pricing", "Цена 12 мес. (Stars)"),
-    SettingField(
-        "TRAFFIC_PACKAGES", "string", "pricing", "Пакеты трафика", "Формат: 10:199,50:799 (ГБ:цена)"
-    ),
-    SettingField("STARS_TRAFFIC_PACKAGES", "string", "pricing", "Пакеты трафика (Stars)"),
-    SettingField(
-        "PAYMENT_METHODS_ORDER",
-        "string",
-        "pricing",
-        "Порядок методов оплаты",
-        "Через запятую, например: severpay,freekassa,yookassa,heleket",
-    ),
-    SettingField(
-        "SUBSCRIPTION_PURCHASE_DESCRIPTION_ENABLED",
-        "bool",
-        "pricing",
-        "Показывать описание подписки",
-        "Текст появится перед выбором срока покупки или продления.",
-    ),
-    SettingField(
-        "SUBSCRIPTION_PURCHASE_DESCRIPTION_RU",
-        "text",
-        "pricing",
-        "Описание подписки (RU)",
-        "Русская версия текста на этапе оплаты.",
-    ),
-    SettingField(
-        "SUBSCRIPTION_PURCHASE_DESCRIPTION_EN",
-        "text",
-        "pricing",
-        "Описание подписки (EN)",
-        "Английская версия текста на этапе оплаты.",
-    ),
-    # ─── Payment providers (toggles) ───────────────────────────────
-    # Common
-    SettingField("STARS_ENABLED", "bool", "payments", "Telegram Stars", subsection="common"),
-    SettingField(
-        "PAYMENT_METHODS_ORDER",
-        "string",
-        "payments",
-        "Порядок методов оплаты",
-        "Через запятую: severpay,freekassa,yookassa,platega,stars,cryptopay,heleket",
-        subsection="common",
-    ),
-    # ─── Trial ─────────────────────────────────────────────────────
-    SettingField("TRIAL_ENABLED", "bool", "trial", "Триал включён"),
-    SettingField("TRIAL_DURATION_DAYS", "int", "trial", "Длительность триала (дней)", min=0),
-    SettingField("TRIAL_TRAFFIC_LIMIT_GB", "float", "trial", "Лимит трафика триала (ГБ)", min=0),
-    SettingField("TRIAL_TRAFFIC_STRATEGY", "string", "trial", "Стратегия сброса трафика триала"),
-    # ─── Referral program ──────────────────────────────────────────
-    SettingField(
-        "REFERRAL_ONE_BONUS_PER_REFEREE", "bool", "referral", "Один бонус на приглашённого"
-    ),
-    SettingField(
-        "REFERRAL_WELCOME_BONUS_DAYS", "int", "referral", "Приветственный бонус (дней)", min=0
-    ),
-    SettingField("LEGACY_REFS", "bool", "referral", "Поддержка старых ref-ссылок"),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_INVITER_1_MONTH",
-        "int",
-        "referral",
-        "Бонус приглашающему: 1 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_INVITER_3_MONTHS",
-        "int",
-        "referral",
-        "Бонус приглашающему: 3 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_INVITER_6_MONTHS",
-        "int",
-        "referral",
-        "Бонус приглашающему: 6 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_INVITER_12_MONTHS",
-        "int",
-        "referral",
-        "Бонус приглашающему: 12 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_REFEREE_1_MONTH",
-        "int",
-        "referral",
-        "Бонус приглашённому: 1 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_REFEREE_3_MONTHS",
-        "int",
-        "referral",
-        "Бонус приглашённому: 3 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_REFEREE_6_MONTHS",
-        "int",
-        "referral",
-        "Бонус приглашённому: 6 мес.",
-        min=0,
-    ),
-    SettingField(
-        "REFERRAL_BONUS_DAYS_REFEREE_12_MONTHS",
-        "int",
-        "referral",
-        "Бонус приглашённому: 12 мес.",
-        min=0,
-    ),
-    # ─── Notifications ─────────────────────────────────────────────
-    SettingField(
-        "SUBSCRIPTION_NOTIFICATIONS_ENABLED",
-        "bool",
-        "notifications",
-        "Включены уведомления о подписке",
-    ),
-    SettingField(
-        "SUBSCRIPTION_NOTIFY_ON_EXPIRE", "bool", "notifications", "Уведомлять об истечении"
-    ),
-    SettingField(
-        "SUBSCRIPTION_NOTIFY_AFTER_EXPIRE", "bool", "notifications", "Уведомлять после истечения"
-    ),
-    SettingField(
-        "SUBSCRIPTION_NOTIFY_DAYS_BEFORE",
-        "int",
-        "notifications",
-        "За сколько дней предупреждать",
-        min=0,
-    ),
-    SettingField("LOG_NEW_USERS", "bool", "notifications", "Логировать новых пользователей"),
-    SettingField("LOG_PAYMENTS", "bool", "notifications", "Логировать платежи"),
-    SettingField("LOG_SUPPORT", "bool", "notifications", "Логировать тикеты поддержки"),
-    SettingField(
-        "LOG_PROMO_ACTIVATIONS", "bool", "notifications", "Логировать активации промокодов"
-    ),
-    SettingField("LOG_TRIAL_ACTIVATIONS", "bool", "notifications", "Логировать активации триала"),
-    SettingField(
-        "LOG_SUSPICIOUS_ACTIVITY", "bool", "notifications", "Логировать подозрительные действия"
-    ),
-    SettingField(
-        "LOG_ADMIN_ACTIONS",
-        "bool",
-        "notifications",
-        "Логировать действия администраторов",
-        "Если выключено, события от пользователей из ADMIN_IDS не записываются в message logs.",
-        i18n_label_key="admin_settings_field_log_admin_actions_label",
-        i18n_description_key="admin_settings_field_log_admin_actions_description",
-    ),
-    SettingField(
-        "LOG_LEVEL",
-        "string",
-        "notifications",
-        "Глобальный уровень логов",
-        "DEBUG / INFO / WARNING / ERROR",
-    ),
-    SettingField("LOG_CHAT_ID", "int", "notifications", "ID чата для логов"),
-    SettingField("LOG_THREAD_ID", "int", "notifications", "ID треда (для супергрупп)"),
-    SettingField(
-        "LOG_SUPPORT_THREAD_ID",
-        "int",
-        "notifications",
-        "ID треда поддержки",
-        "Тред лог-чата для уведомлений о тикетах поддержки.",
-    ),
-    SettingField(
-        "SUPPORT_TICKETS_ENABLED",
-        "bool",
-        "support",
-        "Тикеты поддержки включены",
-        "Показывает раздел поддержки в ЛК и включает создание тикетов.",
-    ),
-    SettingField(
-        "SUPPORT_ADMIN_EMAIL_NOTIFICATIONS_ENABLED",
-        "bool",
-        "support",
-        "Email-уведомления админам",
-        (
-            "Если выключено, новые тикеты и ответы пользователей останутся "
-            "только в Telegram и лог-чате."
-        ),
-    ),
-    SettingField(
-        "SUPPORT_ADMIN_NOTIFICATION_COOLDOWN_SECONDS",
-        "int",
-        "support",
-        "Пауза Telegram-уведомлений",
-        (
-            "Минимум секунд между повторными Telegram/log уведомлениями "
-            "по одному непрочитанному тикету."
-        ),
-        min=0,
-    ),
-    SettingField(
-        "SUPPORT_ADMIN_EMAIL_COOLDOWN_SECONDS",
-        "int",
-        "support",
-        "Пауза email-уведомлений",
-        "Минимум секунд между повторными email-уведомлениями по одному непрочитанному тикету.",
-        min=0,
-    ),
-    SettingField(
-        "SUPPORT_TICKET_MAX_BODY_LENGTH",
-        "int",
-        "support",
-        "Макс. длина сообщения",
-        "Максимальное количество символов в сообщении тикета.",
-        min=1,
-    ),
-    SettingField(
-        "SUPPORT_TICKET_MAX_SUBJECT_LENGTH",
-        "int",
-        "support",
-        "Макс. длина темы",
-        "Максимальное количество символов в теме тикета.",
-        min=1,
-    ),
-    SettingField(
-        "SUPPORT_TICKET_RATE_LIMIT_PER_HOUR",
-        "int",
-        "support",
-        "Лимит тикетов в час",
-        "Сколько новых тикетов пользователь может создать за час. 0 — без лимита.",
-        min=0,
-    ),
-    # ─── Devices ───────────────────────────────────────────────────
-    SettingField("MY_DEVICES_SECTION_ENABLED", "bool", "devices", "Раздел «Мои устройства»"),
-    SettingField(
-        "USER_HWID_DEVICE_LIMIT", "int", "devices", "Лимит устройств по умолчанию (0 = ∞)", min=0
-    ),
-    SettingField("USER_TRAFFIC_LIMIT_GB", "float", "devices", "Лимит трафика пользователя (ГБ)"),
-    SettingField("USER_TRAFFIC_STRATEGY", "string", "devices", "Стратегия сброса трафика"),
-]
-
-
-def _provider_field_to_setting_field(spec: Any, manifest_field: Any) -> SettingField:
-    return SettingField(
-        key=manifest_field.key,
-        type=manifest_field.type,
-        section="payments",
-        label=manifest_field.label,
-        description=manifest_field.description,
-        placeholder=manifest_field.placeholder,
-        optional=manifest_field.optional,
-        secret=manifest_field.secret,
-        min=manifest_field.min,
-        max=manifest_field.max,
-        choices=tuple(manifest_field.choices) if manifest_field.choices else None,
-        subsection=manifest_field.subsection,
-        i18n_label_key=getattr(manifest_field, "i18n_label_key", None),
-        i18n_description_key=getattr(manifest_field, "i18n_description_key", None),
-        i18n_subsection_key=getattr(manifest_field, "i18n_subsection_key", None),
-    )
-
-
-def aggregated_manifest() -> List[SettingField]:
-    """SETTINGS_MANIFEST + per-provider fragments declared in provider SPECs."""
-    from bot.payment_providers import iter_provider_manifest_fields  # local to avoid cycle
-
-    fields: List[SettingField] = list(SETTINGS_MANIFEST)
-    for spec, manifest_field in iter_provider_manifest_fields():
-        fields.append(_provider_field_to_setting_field(spec, manifest_field))
-    return fields
-
-
-def get_field_by_key(key: str) -> Optional[SettingField]:
-    for field in aggregated_manifest():
-        if field.key == key:
-            return field
-    return None
-
-
-def manifest_keys() -> List[str]:
-    return [f.key for f in aggregated_manifest()]
-
-
-def coerce_value(field: SettingField, raw: Any) -> Any:
-    """Coerce a value coming from JSON to the type declared by the field."""
-
-    if raw is None or (isinstance(raw, str) and raw.strip() == ""):
-        return None
-
-    if field.type == "bool":
-        if isinstance(raw, bool):
-            return raw
-        if isinstance(raw, (int, float)):
-            return bool(raw)
-        if isinstance(raw, str):
-            return raw.strip().lower() in {"1", "true", "yes", "on"}
-        return bool(raw)
-
-    if field.type == "int":
-        try:
-            value = int(str(raw).strip())
-        except (TypeError, ValueError) as exc:
-            raise ValueError(f"{field.key}: integer expected") from exc
-        if field.min is not None and value < field.min:
-            raise ValueError(f"{field.key}: must be >= {field.min:g}")
-        if field.max is not None and value > field.max:
-            raise ValueError(f"{field.key}: must be <= {field.max:g}")
-        return value
-
-    if field.type == "float":
-        try:
-            value = float(str(raw).strip())
-        except (TypeError, ValueError) as exc:
-            raise ValueError(f"{field.key}: number expected") from exc
-        if field.min is not None and value < field.min:
-            raise ValueError(f"{field.key}: must be >= {field.min:g}")
-        if field.max is not None and value > field.max:
-            raise ValueError(f"{field.key}: must be <= {field.max:g}")
-        return value
-
-    if isinstance(raw, str):
-        return raw.strip()
-    return str(raw)
-
-
-def _i18n_slug(value: str) -> str:
-    slug = re.sub(r"[^a-z0-9]+", "_", value.strip().lower()).strip("_")
-    return slug or "default"
-
-
-def manifest_payload() -> List[dict]:
-    """Serialize the manifest for the admin UI.
-
-    For provider presentation fields we resolve the SPEC-declared default
-    (e.g. the button text the bot would use if the admin leaves the override
-    blank) and expose it as ``default``; ``placeholder`` falls back to the
-    same value so existing UIs that only read ``placeholder`` also show the
-    hint inside the empty input.
-    """
-    from bot.payment_providers import find_manifest_owner, manifest_field_default
-
-    sections_order = {
-        "general": 1,
-        "appearance": 2,
-        "pricing": 3,
-        "payments": 4,
-        "trial": 5,
-        "referral": 6,
-        "notifications": 7,
-        "support": 8,
-        "devices": 9,
-    }
-    items: List[dict] = []
-    for field in aggregated_manifest():
-        auto_label_i18n_key = f"admin_settings_field_{field.key.lower()}_label"
-        auto_description_i18n_key = f"admin_settings_field_{field.key.lower()}_description"
-        auto_subsection_i18n_key = (
-            f"admin_settings_subsection_{_i18n_slug(field.subsection)}"
-            if field.subsection
-            else None
-        )
-
-        default_value: Optional[str] = None
-        owner = find_manifest_owner(field.key)
-        if owner is not None:
-            spec, manifest_field = owner
-            default_value = manifest_field_default(spec, manifest_field)
-
-        placeholder = field.placeholder
-        if not placeholder and default_value:
-            placeholder = default_value
-
-        item = {
-            "key": field.key,
-            "type": field.type,
-            "section": field.section,
-            "section_order": sections_order.get(field.section, 99),
-            "subsection": field.subsection,
-            "label": field.label,
-            "description": field.description,
-            "i18n_label_key": field.i18n_label_key or auto_label_i18n_key,
-            "i18n_description_key": field.i18n_description_key
-            or (auto_description_i18n_key if field.description else None),
-            "i18n_subsection_key": field.i18n_subsection_key or auto_subsection_i18n_key,
-            "i18n_placeholder_key": (
-                f"admin_settings_field_{field.key.lower()}_placeholder" if placeholder else None
-            ),
-            "placeholder": placeholder,
-            "optional": field.optional,
-            "secret": field.secret,
-        }
-        if default_value is not None:
-            item["default"] = default_value
-        if field.choices:
-            item["choices"] = [
-                {
-                    "value": v,
-                    "label": lbl,
-                    "i18n_label_key": (
-                        f"admin_settings_field_{field.key.lower()}_choice_{_i18n_slug(str(v))}"
-                    ),
-                }
-                for v, lbl in field.choices
-            ]
-        items.append(item)
-    return items

backend/bot/app/web/session.py

@@ -1,29 +0,0 @@
-from __future__ import annotations
-
-from typing import Optional
-
-from aiohttp import web
-
-from bot.app.web.webapp_auth import verify_webapp_session_token
-from config.settings import Settings
-
-WEBAPP_SESSION_COOKIE_NAME = "rw_webapp_session"
-
-
-def extract_authenticated_user_id(request: web.Request) -> Optional[int]:
-    settings: Settings = request.app["settings"]
-
-    auth_header = request.headers.get("Authorization", "")
-    if auth_header.startswith("Bearer "):
-        user_id = verify_webapp_session_token(
-            settings,
-            auth_header.removeprefix("Bearer ").strip(),
-        )
-        if user_id:
-            return user_id
-
-    session_cookie = request.cookies.get(WEBAPP_SESSION_COOKIE_NAME)
-    if session_cookie:
-        return verify_webapp_session_token(settings, session_cookie)
-
-    return None

backend/bot/app/web/subscription_webapp.py

@@ -1,50 +0,0 @@
-"""Compatibility facade for the subscription Mini App backend."""
-
-# ruff: noqa: I001
-
-from bot.app.web.webapp import (
-    _runtime as _runtime,
-    account as _account,
-    application as _application,
-    assets as _assets,
-    auth as _auth,
-    billing as _billing,
-    common as _common,
-    devices as _devices,
-    payloads as _payloads,
-    routes as _routes,
-    serializers as _serializers,
-    support as _support,
-)
-
-_MODULES = (
-    _runtime,
-    _payloads,
-    _common,
-    _assets,
-    _auth,
-    _account,
-    _serializers,
-    _billing,
-    _devices,
-    _support,
-    _routes,
-    _application,
-)
-
-_NAMESPACE = {}
-for _module in _MODULES:
-    _NAMESPACE.update(
-        {
-            _name: _value
-            for _name, _value in vars(_module).items()
-            if not _name.startswith("__") and _name != "annotations"
-        }
-    )
-
-for _module in _MODULES:
-    vars(_module).update(_NAMESPACE)
-
-globals().update(_NAMESPACE)
-
-__all__ = sorted(_name for _name in _NAMESPACE if not _name.startswith("__"))

backend/bot/app/web/templates/subscription_webapp.html

@@ -1,60 +0,0 @@
-<!doctype html>
-<html lang="ru">
-  <head>
-    <meta charset="utf-8" />
-    <meta
-      name="viewport"
-      content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover"
-    />
-    <meta name="robots" content="noindex, nofollow" />
-    <meta name="theme-color" content="#03070b" />
-    <link id="app-favicon" rel="icon" href="data:," sizes="any" />
-    <title>/minishop</title>
-    <link rel="stylesheet" href="/subscription_webapp.css" />
-    <style>
-      .app-boot-fallback {
-        min-height: 100dvh;
-        display: grid;
-        place-items: center;
-        padding: 24px;
-        background: #03070b;
-      }
-
-      .app-boot-fallback__spinner {
-        width: 28px;
-        height: 28px;
-        border: 2px solid rgba(242, 247, 244, 0.18);
-        border-top-color: #00fe7a;
-        border-radius: 999px;
-        animation: appBootSpin 0.8s linear infinite;
-      }
-
-      @media (prefers-reduced-motion: reduce) {
-        .app-boot-fallback__spinner {
-          animation: none;
-        }
-      }
-
-      @keyframes appBootSpin {
-        to {
-          transform: rotate(360deg);
-        }
-      }
-    </style>
-  </head>
-
-  <body>
-    <main id="app">
-      <div class="app-boot-fallback" role="status" aria-label="Загрузка">
-        <div class="app-boot-fallback__spinner" aria-hidden="true"></div>
-      </div>
-    </main>
-
-    <!-- WEBAPP_I18N_SCRIPT -->
-    <!-- WEBAPP_CONFIG_SCRIPT -->
-    <!-- WEBAPP_JS_SCRIPT -->
-    <!-- WEBAPP_DEV_MOCK_START -->
-    <script src="/subscription_webapp.js" defer></script>
-    <!-- WEBAPP_DEV_MOCK_END -->
-  </body>
-</html>

backend/bot/app/web/themes/ascii/theme.json

@@ -1,17 +0,0 @@
-{
-  "key": "ascii",
-  "names": {
-    "ru": "ASCII",
-    "en": "ASCII"
-  },
-  "enabled": true,
-  "default": false,
-  "use_primary_accent": false,
-  "use_in_admin": true,
-  "css_file": "style.css",
-  "assets_version": 3,
-  "tokens": {
-    "color_scheme": "dark",
-    "style_preset": "ascii"
-  }
-}

backend/bot/app/web/themes/dark/theme.json

@@ -1,27 +0,0 @@
-{
-  "key": "dark",
-  "names": {
-    "ru": "Темная",
-    "en": "Dark"
-  },
-  "enabled": true,
-  "default": true,
-  "use_primary_accent": true,
-  "use_in_admin": true,
-  "assets_version": 1,
-  "tokens": {
-    "color_scheme": "dark",
-    "bg": "#03070b",
-    "panel": "#111820",
-    "panel_2": "#0b1118",
-    "panel_3": "#17212b",
-    "border": "rgba(255, 255, 255, 0.12)",
-    "border_strong": "rgba(255, 255, 255, 0.2)",
-    "text": "#f2f7f4",
-    "muted": "#a9b4b0",
-    "dim": "#68736f",
-    "danger": "#ff6b6b",
-    "blue": "#2d9cff",
-    "radius": "8px"
-  }
-}

backend/bot/app/web/themes/light/style.css

@@ -1,131 +0,0 @@
-.theme-key-light {
-  color-scheme: light;
-  --accent: #047857;
-  --bg: #f7f8fb;
-  --panel: #ffffff;
-  --panel-2: #f1f5f9;
-  --panel-3: #e8edf3;
-  --border: rgba(15, 23, 42, 0.11);
-  --border-strong: rgba(15, 23, 42, 0.2);
-  --text: #0f172a;
-  --muted: #475569;
-  --dim: #64748b;
-  --danger: #dc2626;
-  --danger-text: #b91c1c;
-  --danger-soft: color-mix(in srgb, var(--danger) 9%, var(--panel));
-  --danger-border: color-mix(in srgb, var(--danger) 34%, var(--border));
-  --success: #16a34a;
-  --success-text: #166534;
-  --success-soft: color-mix(in srgb, var(--success) 10%, var(--panel));
-  --success-border: color-mix(in srgb, var(--success) 34%, var(--border));
-  --warning: #d97706;
-  --warning-text: #92400e;
-  --warning-soft: color-mix(in srgb, var(--warning) 11%, var(--panel));
-  --warning-border: color-mix(in srgb, var(--warning) 34%, var(--border));
-  --info: #2563eb;
-  --info-text: #1d4ed8;
-  --info-soft: color-mix(in srgb, var(--info) 9%, var(--panel));
-  --info-border: color-mix(in srgb, var(--info) 30%, var(--border));
-  --blue: #2563eb;
-  --radius: 8px;
-  --accent-contrast: #ffffff;
-  --surface-sheen: rgba(15, 23, 42, 0.035);
-  --surface-sheen-soft: rgba(15, 23, 42, 0.012);
-  --surface-hover: rgba(15, 23, 42, 0.045);
-  --surface-muted: rgba(15, 23, 42, 0.035);
-  --surface-subtle-border: rgba(15, 23, 42, 0.1);
-  --overlay-scrim: rgba(15, 23, 42, 0.34);
-  --nav-bg: rgba(255, 255, 255, 0.88);
-  --rail-bg: rgba(255, 255, 255, 0.72);
-  --shadow-soft: 0 6px 18px rgba(15, 23, 42, 0.06);
-  --shadow-strong: 0 18px 44px rgba(15, 23, 42, 0.12);
-  --shadow-popover: 0 14px 28px rgba(15, 23, 42, 0.12);
-  --inset-highlight: rgba(255, 255, 255, 0.75);
-  --admin-bg: #f7f8fb;
-  --admin-surface: #ffffff;
-  --admin-surface-2: #f1f5f9;
-  --admin-elev: #e8edf3;
-  --admin-border: rgba(15, 23, 42, 0.1);
-  --admin-border-strong: rgba(15, 23, 42, 0.18);
-  --admin-text: #0f172a;
-  --admin-muted: #64748b;
-  --admin-dim: #64748b;
-  --admin-chart-stroke: #065f46;
-  --admin-chart-fill: rgba(6, 95, 70, 0.22);
-}
-
-.theme-key-light .ui-spinner,
-.theme-key-light .brand-mark-spinner {
-  color: inherit;
-}
-
-.theme-key-light .telegram-button-spinner {
-  border-color: rgba(255, 255, 255, 0.35);
-  border-top-color: #ffffff;
-}
-
-.theme-key-light .btn-primary,
-.theme-key-light .admin-btn.admin-btn-primary,
-.theme-key-light .admin-extend-control .admin-btn.admin-btn-primary {
-  background: color-mix(in srgb, var(--accent) 50%, #000000);
-  border-color: color-mix(in srgb, var(--accent) 42%, #000000);
-  color: #ffffff;
-}
-
-.theme-key-light .btn-primary:hover:not(:disabled),
-.theme-key-light .admin-btn.admin-btn-primary:hover:not(:disabled),
-.theme-key-light .admin-extend-control .admin-btn.admin-btn-primary:hover:not(:disabled) {
-  background: color-mix(in srgb, var(--accent) 52%, #000000);
-}
-
-.theme-key-light.app-shell {
-  background: var(--bg) !important;
-}
-
-.theme-key-light .phone-screen {
-  background: var(--bg);
-}
-
-/* Flatten Settings rows: no gradient sheen, no inset highlight that reads as a 3D bevel */
-.theme-key-light .settings-row {
-  background: var(--panel);
-  box-shadow: none;
-}
-
-.theme-key-light .settings-row-linked {
-  background: var(--success-soft);
-}
-
-/* Avatar/profile card: bigger lift, but rows below have an opaque background and
-   stack above, so the shadow stays visually under them instead of bleeding through. */
-.theme-key-light .settings-profile {
-  box-shadow:
-    0 10px 24px rgba(15, 23, 42, 0.10),
-    inset 0 1px 0 var(--inset-highlight);
-}
-
-.theme-key-light .settings-links-block {
-  position: relative;
-  z-index: 1;
-}
-
-/* Slightly stronger axis/grid contrast for the revenue chart on a light surface */
-.theme-key-light .admin-revenue-svg-frame {
-  background: #ffffff;
-}
-
-/* Bonus section: drop accent color from body strongs; only the bonus-system heading
-   and explicitly-accent card headings stay tinted — and they use the same darkened
-   accent technique as .btn-primary on light, so they remain readable on white. */
-.theme-key-light .bonus-card strong {
-  color: var(--text);
-}
-
-.theme-key-light .bonus-card-head strong,
-.theme-key-light .card-heading-accent {
-  color: color-mix(in srgb, var(--accent) 50%, #000000);
-}
-
-.theme-key-light .bonus-card-head > svg {
-  color: color-mix(in srgb, var(--accent) 50%, #000000);
-}

backend/bot/app/web/themes/light/theme.json

@@ -1,16 +0,0 @@
-{
-  "key": "light",
-  "names": {
-    "ru": "Светлая",
-    "en": "Light"
-  },
-  "enabled": true,
-  "default": false,
-  "use_primary_accent": true,
-  "use_in_admin": true,
-  "css_file": "style.css",
-  "assets_version": 2,
-  "tokens": {
-    "color_scheme": "light"
-  }
-}

backend/bot/app/web/themes/windows95/theme.json

@@ -1,17 +0,0 @@
-{
-  "key": "windows95",
-  "names": {
-    "ru": "Windows 95",
-    "en": "Windows 95"
-  },
-  "enabled": true,
-  "default": false,
-  "use_primary_accent": false,
-  "use_in_admin": true,
-  "css_file": "style.css",
-  "assets_version": 9,
-  "tokens": {
-    "color_scheme": "light",
-    "style_preset": "win95"
-  }
-}

backend/bot/app/web/web_server.py

@@ -1,158 +0,0 @@
-import asyncio
-import hmac
-import logging
-
-from aiogram import Bot, Dispatcher
-from aiogram.webhook.aiohttp_server import SimpleRequestHandler, setup_application
-from aiohttp import web
-from sqlalchemy.orm import sessionmaker
-
-from bot.payment_providers import iter_provider_specs, iter_service_keys
-from config.settings import Settings
-
-
-class SecureSimpleRequestHandler(SimpleRequestHandler):
-    def verify_secret(self, telegram_secret_token: str, bot: Bot) -> bool:
-        if not self.secret_token:
-            return False
-        return hmac.compare_digest(telegram_secret_token, self.secret_token)
-
-
-def _inject_shared_instances(
-    app: web.Application,
-    dp: Dispatcher,
-    bot: Bot,
-    settings: Settings,
-    async_session_factory: sessionmaker,
-) -> None:
-    app["bot"] = bot
-    app["dp"] = dp
-    app["settings"] = settings
-    app["async_session_factory"] = async_session_factory
-    app["i18n"] = dp.get("i18n_instance")
-    shared_keys = [
-        "subscription_service",
-        "referral_service",
-        "panel_service",
-        "panel_webhook_service",
-        "lknpd_service",
-        *iter_service_keys(),
-    ]
-    for key in shared_keys:
-        if hasattr(dp, "workflow_data") and key in dp.workflow_data:  # type: ignore
-            app[key] = dp.workflow_data[key]  # type: ignore
-
-
-async def build_and_start_web_app(
-    dp: Dispatcher,
-    bot: Bot,
-    settings: Settings,
-    async_session_factory: sessionmaker,
-):
-    app = web.Application()
-    _inject_shared_instances(app, dp, bot, settings, async_session_factory)
-
-    async def _healthcheck(request: web.Request) -> web.Response:
-        payload = {"status": "ok"}
-        try:
-            from db.database_setup import async_engine
-
-            pool = async_engine.pool if async_engine is not None else None
-            if pool is not None:
-                payload["db_pool"] = {
-                    "checked_in": pool.checkedin(),
-                    "checked_out": pool.checkedout(),
-                    "size": pool.size(),
-                    "overflow": pool.overflow(),
-                }
-        except Exception:
-            logging.exception("Failed to collect DB pool health metrics")
-        return web.json_response(payload)
-
-    app.router.add_get("/healthz", _healthcheck)
-    app.router.add_get("/health", _healthcheck)
-
-    setup_application(app, dp, bot=bot)
-
-    telegram_uses_webhook_mode = bool(settings.WEBHOOK_BASE_URL)
-
-    if telegram_uses_webhook_mode:
-        telegram_webhook_path = settings.telegram_webhook_path
-        SecureSimpleRequestHandler(
-            dispatcher=dp,
-            bot=bot,
-            secret_token=settings.WEBHOOK_SECRET_TOKEN,
-        ).register(app, path=telegram_webhook_path)
-        logging.info(
-            f"Telegram webhook route configured at: [POST] {telegram_webhook_path} (relative to base URL)"  # noqa: E501
-        )
-
-    from bot.services.panel_webhook_service import panel_webhook_route
-
-    registered_webhook_paths: set[str] = set()
-    for spec in iter_provider_specs():
-        webhook_route = spec.load_webhook_route()
-        if not spec.webhook_path or not webhook_route:
-            continue
-        if spec.webhook_requires_base_url and not settings.WEBHOOK_BASE_URL:
-            continue
-        path = spec.webhook_path(settings)
-        if not path or not path.startswith("/") or path in registered_webhook_paths:
-            continue
-        registered_webhook_paths.add(path)
-        app.router.add_post(path, webhook_route)
-        logging.info("%s webhook route configured at: [POST] %s", spec.label, path)
-
-    panel_path = settings.panel_webhook_path
-    if panel_path.startswith("/"):
-        app.router.add_post(panel_path, panel_webhook_route)
-        logging.info(f"Panel webhook route configured at: [POST] {panel_path}")
-
-    runners = []
-
-    webhooks_runner = web.AppRunner(app)
-    await webhooks_runner.setup()
-    runners.append(webhooks_runner)
-    site = web.TCPSite(
-        webhooks_runner,
-        host=settings.WEB_SERVER_HOST,
-        port=settings.WEB_SERVER_PORT,
-    )
-
-    await site.start()
-    logging.info(
-        f"AIOHTTP server started on http://{settings.WEB_SERVER_HOST}:{settings.WEB_SERVER_PORT}"
-    )
-
-    if settings.WEBAPP_ENABLED:
-        from bot.app.web.subscription_webapp import create_subscription_webapp_application
-
-        subscription_app = create_subscription_webapp_application(
-            dp,
-            bot,
-            settings,
-            async_session_factory,
-        )
-        subscription_runner = web.AppRunner(subscription_app)
-        await subscription_runner.setup()
-        runners.append(subscription_runner)
-        subscription_site = web.TCPSite(
-            subscription_runner,
-            host=settings.WEBAPP_SERVER_HOST,
-            port=settings.WEBAPP_SERVER_PORT,
-        )
-        await subscription_site.start()
-        logging.info(
-            "Subscription WebApp server started on http://%s:%s",
-            settings.WEBAPP_SERVER_HOST,
-            settings.WEBAPP_SERVER_PORT,
-        )
-
-    try:
-        await asyncio.Event().wait()
-    finally:
-        for runner in reversed(runners):
-            try:
-                await runner.cleanup()
-            except Exception as cleanup_error:
-                logging.warning("Failed to cleanup aiohttp runner: %s", cleanup_error)

backend/bot/app/web/webapp/__init__.py

@@ -1 +0,0 @@
-"""Domain modules for the subscription Mini App backend."""

backend/bot/app/web/webapp/_runtime.py

@@ -1,113 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-import asyncio
-import base64
-import hashlib
-import html
-import hmac
-import io
-import ipaddress
-import json
-import logging
-import os
-import re
-import secrets
-import socket
-import subprocess
-import time
-from collections import deque
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
-from urllib.parse import parse_qsl, quote, urlencode, urlsplit, urlunsplit
-
-from aiogram import Bot, Dispatcher
-from aiohttp import ClientSession, ClientTimeout, web
-from pydantic import BaseModel, ConfigDict, EmailStr, ValidationError, constr, field_validator
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import sessionmaker
-
-from bot.app.web.admin_api import (
-    admin_auth_middleware,
-    setup_admin_routes,
-)
-from bot.app.web.webapp_auth import (
-    create_signed_telegram_oauth_state,
-    create_telegram_oauth_nonce,
-    create_webapp_session_token,
-    validate_telegram_login_widget_data,
-    validate_telegram_oauth_id_token,
-    validate_telegram_webapp_init_data,
-    verify_signed_telegram_oauth_state,
-    verify_telegram_oauth_nonce,
-    verify_webapp_session_token,
-)
-from bot.infra.redis import cache_delete, cache_get_json, cache_set_json, get_redis, redis_key
-from bot.services.email_auth_service import EmailAuthService, normalize_email
-from bot.services.email_templates import render_account_merged
-from bot.services.promo_code_service import PromoCodeService
-from bot.services.referral_service import ReferralService
-from bot.services.subscription_service import SubscriptionService
-from bot.utils.config_link import prepare_config_links
-from bot.utils.request_security import parse_ip_entries, request_client_ip
-from bot.utils.text_sanitizer import sanitize_display_name, sanitize_username
-from config.settings import Settings
-from db.dal import payment_dal, security_dal, subscription_dal, support_dal, user_dal
-from db.dal.user_dal import UserMergeConflictError
-from db.models import Payment, User, UserTelegramAvatar
-
-logger = logging.getLogger(__name__)
-
-TEMPLATE_PATH = Path(__file__).resolve().parents[1] / "templates" / "subscription_webapp.html"
-ASSET_DIR = TEMPLATE_PATH.parent
-APP_ROOT = Path(__file__).resolve().parents[5]
-WEBAPP_LOGO_PROXY_PATH = "/webapp-logo"
-WEBAPP_LOGO_CACHE_DIR = APP_ROOT / "data" / "webapp-logo"
-WEBAPP_UPLOADED_LOGO_DIR = WEBAPP_LOGO_CACHE_DIR / "uploads"
-WEBAPP_UPLOADED_LOGO_PATH = "/webapp-uploaded-logo"
-WEBAPP_FAVICON_DIR = WEBAPP_LOGO_CACHE_DIR / "favicons"
-WEBAPP_FAVICON_PATH = "/webapp-favicon"
-WEBAPP_EMOJI_CACHE_DIR = APP_ROOT / "data" / "webapp-emoji"
-WEBAPP_CONFIG_PLACEHOLDER = "<!-- WEBAPP_CONFIG_SCRIPT -->"
-WEBAPP_I18N_PLACEHOLDER = "<!-- WEBAPP_I18N_SCRIPT -->"
-WEBAPP_JS_PLACEHOLDER = "<!-- WEBAPP_JS_SCRIPT -->"
-APP_REPOSITORY_URL = "https://github.com/3252a8/remnawave-minishop"
-DEV_MOCK_START_MARKER = "<!-- WEBAPP_DEV_MOCK_START -->"
-DEV_MOCK_END_MARKER = "<!-- WEBAPP_DEV_MOCK_END -->"
-WEBAPP_RATE_LIMIT_WINDOW_SECONDS = 60
-WEBAPP_RATE_LIMIT_MAX_REQUESTS = 30
-WEBAPP_LOGO_MAX_BYTES = 2 * 1024 * 1024
-WEBAPP_EMOJI_MAX_BYTES = 4 * 1024 * 1024
-WEBAPP_THEME_CSS_MAX_BYTES = 512 * 1024
-WEBAPP_THEME_ASSET_MAX_BYTES = 1024 * 1024
-WEBAPP_THEME_ASSET_CONTENT_TYPES = {
-    ".gif": "image/gif",
-    ".ico": "image/x-icon",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".png": "image/png",
-    ".svg": "image/svg+xml",
-    ".webp": "image/webp",
-}
-WEBAPP_TELEGRAM_AVATAR_MAX_BYTES = 128 * 1024
-WEBAPP_TELEGRAM_AVATAR_REFRESH_SECONDS = 24 * 60 * 60
-WEBAPP_TELEGRAM_AVATAR_FETCH_TIMEOUT_SECONDS = 4
-WEBAPP_SESSION_COOKIE_NAME = "rw_webapp_session"
-WEBAPP_CSRF_COOKIE_NAME = "rw_webapp_csrf"
-WEBAPP_TELEGRAM_OAUTH_STATE_COOKIE_NAME = "rw_tg_oauth_state"
-WEBAPP_CSRF_HEADER_NAME = "X-CSRF-Token"
-WEBAPP_STATE_CHANGING_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
-_APP_VERSION_CACHE: Optional[str] = None
-WEBAPP_CSRF_EXEMPT_PATHS = {
-    "/api/auth/telegram/nonce",
-    "/api/auth/token",
-    "/api/auth/email/request",
-    "/api/auth/email/verify",
-    "/api/auth/email/magic",
-    "/api/auth/email/password",
-    "/api/auth/logout",
-}
-
-_SHARED_HTTP_SESSION: Optional[ClientSession] = None
-_SHARED_HTTP_SESSION_LOCK = asyncio.Lock()
-
-__all__ = [name for name in globals() if not name.startswith("__")]

backend/bot/app/web/webapp/account.py

@@ -1,626 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from bot.app.web.webapp.cache_helpers import webapp_cached_user_payload
-from .auth import _hash_email_password
-from .common import _invalidate_webapp_user_caches
-
-
-async def account_email_request_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    payload = await _read_json(request)
-    email_payload, validation_error = _validate_model_payload(WebAppEmailPayload, payload)
-    if validation_error:
-        return validation_error
-    email = email_payload.email
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        if db_user.email == email and db_user.email_verified_at:
-            return web.json_response({"ok": True, "already_linked": True})
-        lang = _normalize_language(db_user.language_code or settings.DEFAULT_LANGUAGE)
-
-    return await _request_email_code(
-        request,
-        email=email,
-        purpose="link_email",
-        language_code=lang,
-        target_user_id=user_id,
-    )
-
-
-async def account_email_verify_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    rate_limit_response = await _enforce_webapp_rate_limit(
-        request,
-        user_id=user_id,
-        action="account_email_verify",
-    )
-    if rate_limit_response:
-        return rate_limit_response
-
-    payload = await _read_json(request)
-    email_payload, validation_error = _validate_model_payload(WebAppEmailCodePayload, payload)
-    if validation_error:
-        return validation_error
-    email = email_payload.email
-    code = str(email_payload.code or "")
-    email_service: EmailAuthService = request.app["email_auth_service"]
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    merge_notice: Optional[Dict[str, Any]] = None
-    source_panel_uuid: Optional[str] = None
-    final_user_id = user_id
-    final_email = email
-    final_telegram_id: Optional[int] = None
-    final_username: Optional[str] = None
-    final_first_name: Optional[str] = None
-    final_panel_uuid: Optional[str] = None
-    should_notify_email_linked = False
-
-    async with async_session_factory() as session:
-        try:
-            verify_result = await email_service.verify_code(
-                session,
-                email=email,
-                purpose="link_email",
-                code=code,
-                target_user_id=user_id,
-            )
-            if not verify_result.ok:
-                await session.commit()
-                status = 429 if verify_result.error == "rate_limited" else 400
-                return web.json_response(
-                    {
-                        "ok": False,
-                        "error": verify_result.error or "invalid_code",
-                        "retry_after": verify_result.retry_after,
-                        "message": "Invalid code",
-                    },
-                    status=status,
-                )
-
-            current_user = await user_dal.get_user_by_id(session, user_id)
-            if not current_user or current_user.is_banned:
-                await session.rollback()
-                return _json_error(403, "access_denied", "Access denied")
-            should_notify_email_linked = (
-                bool(_telegram_id_for_user(current_user)) and not current_user.email
-            )
-
-            existing_email_user = await user_dal.get_user_by_email(session, email)
-            if existing_email_user and existing_email_user.user_id != current_user.user_id:
-                source_panel_uuid = existing_email_user.panel_user_uuid
-                current_user = await user_dal.merge_users(
-                    session,
-                    source_user_id=existing_email_user.user_id,
-                    target_user_id=current_user.user_id,
-                )
-                merge_notice = await _build_account_merge_notice(
-                    session,
-                    merged_user=current_user,
-                    source_user_id=existing_email_user.user_id,
-                    source_panel_uuid=source_panel_uuid,
-                    settings=settings,
-                )
-            current_user.email = email
-            current_user.email_verified_at = datetime.now(timezone.utc)
-            await _sync_panel_identity_for_user(request, current_user)
-            await session.commit()
-            final_user_id = int(current_user.user_id)
-            final_telegram_id = _telegram_id_for_user(current_user)
-            final_username = current_user.username
-            final_first_name = current_user.first_name
-            final_panel_uuid = current_user.panel_user_uuid
-
-            if merge_notice:
-                merge_end_date_raw = merge_notice.get("final_end_date")
-                merge_end_date = (
-                    datetime.fromisoformat(merge_end_date_raw) if merge_end_date_raw else None
-                )
-                await _sync_panel_identity_for_user(
-                    request,
-                    current_user,
-                    expire_at=merge_end_date,
-                )
-                # Best-effort cleanup of the removed panel account after the DB merge.
-                if source_panel_uuid and final_panel_uuid and source_panel_uuid != final_panel_uuid:
-                    subscription_service: SubscriptionService = request.app.get(
-                        "subscription_service"
-                    )
-                    if subscription_service and subscription_service.panel_service:
-                        try:
-                            await subscription_service.panel_service.delete_user_from_panel(
-                                source_panel_uuid,
-                                log_response=False,
-                            )
-                        except Exception as exc:
-                            logger.warning(
-                                "Failed to delete merged source panel user %s: %s",
-                                source_panel_uuid,
-                                exc,
-                            )
-
-                email_service: EmailAuthService = request.app.get("email_auth_service")
-                if email_service and final_email:
-                    email_content = render_account_merged(
-                        settings,
-                        language_code=merge_notice.get("language") or settings.DEFAULT_LANGUAGE,
-                        primary_user_id=merge_notice.get("primary_user_id"),
-                        removed_user_id=merge_notice.get("removed_user_id"),
-                        final_end_date_text=str(
-                            merge_notice.get("final_end_date_text")
-                            or merge_notice.get("final_end_date")
-                            or ""
-                        ),
-                    )
-                    try:
-                        await email_service.send_rendered_email(
-                            email=final_email,
-                            content=email_content,
-                        )
-                    except Exception as exc:
-                        logger.warning(
-                            "Failed to send account merge email to %s: %s",
-                            final_email,
-                            exc,
-                        )
-        except UserMergeConflictError as exc:
-            await session.rollback()
-            return _json_error(409, "account_merge_conflict", str(exc))
-        except Exception:
-            await session.rollback()
-            logger.exception("Email account link failed")
-            return _json_error(500, "link_failed", "Link failed")
-
-    await _invalidate_webapp_user_caches(settings, user_id, final_user_id, include_devices=True)
-    if should_notify_email_linked:
-        try:
-            from bot.services.notification_service import NotificationService
-
-            bot: Bot = request.app["bot"]
-            notification_service = NotificationService(
-                bot,
-                settings,
-                request.app.get("i18n"),
-            )
-            await notification_service.notify_account_email_linked(
-                user_id=int(final_user_id),
-                email=final_email,
-                telegram_id=final_telegram_id,
-                username=final_username,
-                first_name=final_first_name,
-            )
-        except Exception:
-            logger.exception("Failed to send account email linked notification")
-
-    token = create_webapp_session_token(settings, int(final_user_id))
-    response_payload: Dict[str, Any] = {"ok": True}
-    if merge_notice:
-        response_payload["account_merge"] = merge_notice
-        response_payload["user_id"] = final_user_id
-    return _build_webapp_auth_response(settings, response_payload, token=token)
-
-
-async def account_password_request_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        if not db_user.email or not db_user.email_verified_at:
-            return _json_error(400, "email_not_linked", "Email is not linked")
-        email = db_user.email
-        lang = _normalize_language(db_user.language_code or settings.DEFAULT_LANGUAGE)
-
-    return await _request_email_code(
-        request,
-        email=email,
-        purpose="set_password",
-        language_code=lang,
-        target_user_id=user_id,
-    )
-
-
-async def account_password_confirm_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    payload = await _read_json(request)
-    password_payload, validation_error = _validate_model_payload(WebAppSetPasswordPayload, payload)
-    if validation_error:
-        return validation_error
-    if password_payload.password != password_payload.password_confirm:
-        return _json_error(400, "password_mismatch", "Passwords do not match")
-
-    settings: Settings = request.app["settings"]
-    email_service: EmailAuthService = request.app["email_auth_service"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        try:
-            db_user = await user_dal.get_user_by_id(session, user_id)
-            if not db_user or db_user.is_banned:
-                await session.rollback()
-                return _json_error(403, "access_denied", "Access denied")
-            if not db_user.email or not db_user.email_verified_at:
-                await session.rollback()
-                return _json_error(400, "email_not_linked", "Email is not linked")
-
-            verify_result = await email_service.verify_code(
-                session,
-                email=db_user.email,
-                purpose="set_password",
-                code=str(password_payload.code or ""),
-                target_user_id=user_id,
-            )
-            if not verify_result.ok:
-                await session.commit()
-                status = 429 if verify_result.error == "rate_limited" else 400
-                return web.json_response(
-                    {
-                        "ok": False,
-                        "error": verify_result.error or "invalid_code",
-                        "retry_after": verify_result.retry_after,
-                        "message": "Invalid code",
-                    },
-                    status=status,
-                )
-
-            db_user.password_hash = _hash_email_password(str(password_payload.password))
-            db_user.password_set_at = datetime.now(timezone.utc)
-            await session.flush()
-            await session.commit()
-        except Exception:
-            await session.rollback()
-            logger.exception("Email password setup failed")
-            return _json_error(500, "password_setup_failed", "Password setup failed")
-
-    await _invalidate_webapp_user_caches(settings, user_id)
-    return web.json_response({"ok": True, "password_auth_enabled": True})
-
-
-async def account_telegram_link_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    payload = await _read_json(request)
-    telegram_user = await _validate_telegram_auth_payload(request, payload)
-    if not telegram_user:
-        return _json_error(401, "invalid_auth", "Invalid Telegram auth data")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    merge_notice: Optional[Dict[str, Any]] = None
-    source_panel_uuid: Optional[str] = None
-    final_user_id = user_id
-    final_telegram_id: Optional[int] = None
-    final_email: Optional[str] = None
-    final_username: Optional[str] = None
-    final_first_name: Optional[str] = None
-    final_panel_uuid: Optional[str] = None
-    should_notify_telegram_linked = False
-    async with async_session_factory() as session:
-        try:
-            current_user_before_link = await user_dal.get_user_by_id(session, user_id)
-            if not current_user_before_link or current_user_before_link.is_banned:
-                await session.rollback()
-                return _json_error(403, "access_denied", "Access denied")
-            should_notify_telegram_linked = bool(
-                current_user_before_link.email
-            ) and not _telegram_id_for_user(current_user_before_link)
-            source_panel_uuid = current_user_before_link.panel_user_uuid
-
-            db_user = await _link_telegram_to_user(
-                request,
-                session,
-                current_user_id=user_id,
-                telegram_user=telegram_user,
-                settings=settings,
-            )
-            if db_user.is_banned:
-                await session.rollback()
-                return _json_error(403, "banned", "Access denied")
-
-            final_user_id = int(db_user.user_id)
-            final_telegram_id = _telegram_id_for_user(db_user)
-            final_email = db_user.email
-            final_username = db_user.username
-            final_first_name = db_user.first_name
-            final_panel_uuid = db_user.panel_user_uuid
-            if final_user_id != user_id:
-                merge_notice = await _build_account_merge_notice(
-                    session,
-                    merged_user=db_user,
-                    source_user_id=user_id,
-                    source_panel_uuid=source_panel_uuid,
-                    settings=settings,
-                )
-            await session.commit()
-
-            if merge_notice:
-                merge_end_date_raw = merge_notice.get("final_end_date")
-                merge_end_date = (
-                    datetime.fromisoformat(merge_end_date_raw) if merge_end_date_raw else None
-                )
-                await _sync_panel_identity_for_user(
-                    request,
-                    db_user,
-                    expire_at=merge_end_date,
-                )
-                # Best-effort cleanup of the removed panel account after the DB merge.
-                if source_panel_uuid and final_panel_uuid and source_panel_uuid != final_panel_uuid:
-                    subscription_service: SubscriptionService = request.app.get(
-                        "subscription_service"
-                    )
-                    if subscription_service and subscription_service.panel_service:
-                        try:
-                            await subscription_service.panel_service.delete_user_from_panel(
-                                source_panel_uuid,
-                                log_response=False,
-                            )
-                        except Exception as exc:
-                            logger.warning(
-                                "Failed to delete merged source panel user %s: %s",
-                                source_panel_uuid,
-                                exc,
-                            )
-
-                email_service: EmailAuthService = request.app.get("email_auth_service")
-                if email_service and final_email:
-                    email_content = render_account_merged(
-                        settings,
-                        language_code=merge_notice.get("language") or settings.DEFAULT_LANGUAGE,
-                        primary_user_id=merge_notice.get("primary_user_id"),
-                        removed_user_id=merge_notice.get("removed_user_id"),
-                        final_end_date_text=str(
-                            merge_notice.get("final_end_date_text")
-                            or merge_notice.get("final_end_date")
-                            or ""
-                        ),
-                    )
-                    try:
-                        await email_service.send_rendered_email(
-                            email=final_email,
-                            content=email_content,
-                        )
-                    except Exception as exc:
-                        logger.warning(
-                            "Failed to send account merge email to %s: %s",
-                            final_email,
-                            exc,
-                        )
-        except UserMergeConflictError as exc:
-            await session.rollback()
-            return _json_error(409, "account_merge_conflict", str(exc))
-        except Exception:
-            await session.rollback()
-            logger.exception("Telegram account link failed")
-            return _json_error(500, "link_failed", "Link failed")
-
-    await _invalidate_webapp_user_caches(settings, user_id, final_user_id, include_devices=True)
-    if should_notify_telegram_linked and final_telegram_id:
-        try:
-            from bot.services.notification_service import NotificationService
-
-            bot: Bot = request.app["bot"]
-            notification_service = NotificationService(
-                bot,
-                settings,
-                request.app.get("i18n"),
-            )
-            await notification_service.notify_account_telegram_linked(
-                user_id=int(final_user_id),
-                email=final_email,
-                telegram_id=int(final_telegram_id),
-                username=final_username,
-                first_name=final_first_name,
-            )
-        except Exception:
-            logger.exception("Failed to send account Telegram linked notification")
-
-    token = create_webapp_session_token(settings, int(final_user_id))
-    response_payload: Dict[str, Any] = {
-        "ok": True,
-        "user_id": int(final_user_id),
-        "telegram_id": final_telegram_id,
-    }
-    if merge_notice:
-        response_payload["account_merge"] = merge_notice
-    return _build_webapp_auth_response(settings, response_payload, token=token)
-
-
-async def me_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    data = await webapp_cached_user_payload(
-        settings,
-        "me",
-        user_id,
-        int(getattr(settings, "WEBAPP_ME_CACHE_TTL_SECONDS", 15) or 0),
-        lambda: _build_user_payload(request, user_id),
-    )
-    return web.json_response({"ok": True, **data})
-
-
-async def account_avatar_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            await session.rollback()
-            return _json_error(403, "access_denied", "Access denied")
-
-        avatar = await _ensure_cached_telegram_avatar(request, session, db_user)
-        await session.commit()
-
-    if not avatar:
-        raise web.HTTPNotFound(text="avatar_not_cached")
-
-    etag = _telegram_avatar_etag(avatar)
-    if etag and request.headers.get("If-None-Match") == etag:
-        return web.Response(status=304, headers={"ETag": etag})
-
-    response = web.Response(
-        body=bytes(avatar.image_bytes),
-        content_type=avatar.content_type or "image/jpeg",
-    )
-    response.headers["Cache-Control"] = "private, max-age=3600"
-    if etag:
-        response.headers["ETag"] = etag
-    return response
-
-
-async def account_language_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    payload = await _read_json(request)
-    language_payload, validation_error = _validate_model_payload(WebAppLanguagePayload, payload)
-    if validation_error:
-        return validation_error
-
-    language = _normalize_language(str(language_payload.language or ""))
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            await session.rollback()
-            return _json_error(403, "access_denied", "Access denied")
-
-        if _normalize_language(db_user.language_code or "") != language:
-            db_user.language_code = language
-            await session.flush()
-        await session.commit()
-
-    await _invalidate_webapp_user_caches(settings, user_id)
-    return web.json_response({"ok": True, "language": language})
-
-
-def _format_webapp_datetime(value: Optional[datetime]) -> Optional[str]:
-    if not value:
-        return None
-    normalized = value if value.tzinfo else value.replace(tzinfo=timezone.utc)
-    return normalized.strftime("%d.%m.%Y %H:%M")
-
-
-def _telegram_photo_url_value(telegram_user: Dict[str, Any]) -> Optional[str]:
-    raw_value = telegram_user.get("photo_url")
-    if not raw_value:
-        return None
-    value = str(raw_value).strip()
-    return value or None
-
-
-def _telegram_avatar_is_stale(avatar: Optional[UserTelegramAvatar]) -> bool:
-    if not avatar or not avatar.updated_at:
-        return True
-    updated_at = avatar.updated_at
-    if updated_at.tzinfo is None:
-        updated_at = updated_at.replace(tzinfo=timezone.utc)
-    return (
-        datetime.now(timezone.utc) - updated_at
-    ).total_seconds() >= WEBAPP_TELEGRAM_AVATAR_REFRESH_SECONDS
-
-
-def _telegram_avatar_etag(avatar: UserTelegramAvatar) -> str:
-    digest = hashlib.sha256(bytes(avatar.image_bytes)).hexdigest()[:16]
-    return f'"tg-avatar-{int(avatar.user_id)}-{digest}"'
-
-
-def _telegram_avatar_url(avatar: Optional[UserTelegramAvatar]) -> str:
-    if not avatar:
-        return ""
-    updated_at = avatar.updated_at
-    if updated_at and updated_at.tzinfo is None:
-        updated_at = updated_at.replace(tzinfo=timezone.utc)
-    version = (
-        int(updated_at.timestamp())
-        if updated_at
-        else hashlib.sha256(bytes(avatar.image_bytes)).hexdigest()[:8]
-    )
-    return f"/api/account/avatar?v={version}"
-
-
-def _select_compact_telegram_photo_size(sizes: List[Any]) -> Optional[Any]:
-    if not sizes:
-        return None
-    suitable = [size for size in sizes if int(getattr(size, "width", 0) or 0) >= 160]
-    candidates = suitable or sizes
-    return min(
-        candidates,
-        key=lambda size: (
-            int(getattr(size, "file_size", 0) or 0)
-            or int(getattr(size, "width", 0) or 0) * int(getattr(size, "height", 0) or 0),
-            int(getattr(size, "width", 0) or 0),
-        ),
-    )
-
-
-def _telegram_file_content_type(file_path: Optional[str]) -> str:
-    path = str(file_path or "").lower()
-    if path.endswith(".png"):
-        return "image/png"
-    if path.endswith(".webp"):
-        return "image/webp"
-    return "image/jpeg"
-
-
-async def _fetch_compact_telegram_avatar(
-    bot: Bot, telegram_id: int
-) -> Optional[Tuple[bytes, str, Optional[str]]]:
-    photos = await bot.get_user_profile_photos(user_id=telegram_id, limit=1)
-    if not photos or not photos.photos:
-        return None
-
-    photo_size = _select_compact_telegram_photo_size(list(photos.photos[0] or []))
-    if not photo_size:
-        return None
-
-    file_info = await bot.get_file(photo_size.file_id)
-    destination = io.BytesIO()
-    await bot.download_file(file_info.file_path, destination=destination)
-    body = destination.getvalue()
-    if not body or len(body) > WEBAPP_TELEGRAM_AVATAR_MAX_BYTES:
-        return None
-    return (
-        body,
-        _telegram_file_content_type(file_info.file_path),
-        getattr(photo_size, "file_unique_id", None),
-    )
-
-
-async def _ensure_cached_telegram_avatar(
-    request: web.Request,
-    session: AsyncSession,
-    user: User,
-) -> Optional[UserTelegramAvatar]:
-    avatar = await user_dal.get_user_telegram_avatar(session, int(user.user_id))
-    telegram_id = _telegram_id_for_user(user)
-    if not telegram_id:
-        return avatar
-    if avatar and not _telegram_avatar_is_stale(avatar):
-        return avatar
-
-    bot: Bot = request.app["bot"]
-    try:
-        fetched = await asyncio.wait_for(
-            _fetch_compact_telegram_avatar(bot, int(telegram_id)),
-            timeout=WEBAPP_TELEGRAM_AVATAR_FETCH_TIMEOUT_SECONDS,
-        )
-    except Exception as exc:
-        logger.info("Failed to refresh Telegram avatar for user %s: %s", user.user_id, exc)
-        return avatar
-
-    if not fetched:
-        return avatar
-
-    body, content_type, file_unique_id = fetched
-    return await user_dal.upsert_user_telegram_avatar(
-        session,
-        user_id=int(user.user_id),
-        file_unique_id=file_unique_id,
-        content_type=content_type,
-        image_bytes=body,
-    )

backend/bot/app/web/webapp/application.py

@@ -1,60 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-def create_subscription_webapp_application(
-    dp: Dispatcher,
-    bot: Bot,
-    settings: Settings,
-    async_session_factory: sessionmaker,
-) -> web.Application:
-    app = web.Application(
-        middlewares=[
-            _security_headers_middleware,
-            _csrf_protection_middleware,
-            admin_auth_middleware,
-        ]
-    )
-    app["bot"] = bot
-    app["dp"] = dp
-    app["settings"] = settings
-    app["async_session_factory"] = async_session_factory
-    app["i18n"] = dp.get("i18n_instance")
-    app["email_auth_service"] = EmailAuthService(settings)
-    app["webapp_logo_cache"] = None
-    app["webapp_logo_cache_lock"] = asyncio.Lock()
-    app["webapp_settings_cache"] = {"ts": 0.0, "data": {}}
-    app["webapp_rate_limit_buckets"] = {}
-    app["webapp_rate_limit_lock"] = asyncio.Lock()
-
-    async def _startup(app_obj: web.Application) -> None:
-        await _ensure_shared_http_session()
-        await _warm_webapp_logo_cache(app_obj)
-        await _warm_webapp_animated_emoji_cache(app_obj)
-
-    async def _shutdown(app_obj: web.Application) -> None:
-        await _close_shared_http_session()
-
-    app.on_startup.append(_startup)
-    app.on_shutdown.append(_shutdown)
-
-    from bot.payment_providers import iter_service_keys
-
-    for key in (
-        "subscription_service",
-        "promo_code_service",
-        "referral_service",
-        "support_service",
-        "notification_service",
-        "email_auth_service",
-        "panel_service",
-        *iter_service_keys(),
-    ):
-        if hasattr(dp, "workflow_data") and key in dp.workflow_data:  # type: ignore[attr-defined]
-            app[key] = dp.workflow_data[key]  # type: ignore[index]
-
-    if hasattr(dp, "workflow_data") and "bot_username" in dp.workflow_data:  # type: ignore[attr-defined]
-        app["bot_username"] = dp.workflow_data["bot_username"]  # type: ignore[index]
-
-    setup_subscription_webapp_routes(app)
-    return app

backend/bot/app/web/webapp/billing.py

@@ -1,681 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-async def apply_promo_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    payload = await _read_json(request)
-    code = str(payload.get("code") or "").strip()
-    if not code:
-        return _json_error(400, "empty_code", "Promo code is empty")
-
-    settings: Settings = request.app["settings"]
-    promo_code_service: PromoCodeService = request.app.get("promo_code_service")
-    if not promo_code_service:
-        return _json_error(503, "service_unavailable", "Promo service unavailable")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        try:
-            db_user = await user_dal.get_user_by_id(session, user_id)
-            if not db_user or db_user.is_banned:
-                await session.rollback()
-                return _json_error(403, "access_denied", "Access denied")
-            lang = _normalize_language(db_user.language_code or settings.DEFAULT_LANGUAGE)
-            success, result = await promo_code_service.apply_promo_code(
-                session,
-                user_id,
-                code,
-                lang,
-            )
-            if not success:
-                await session.commit()
-                return _json_error(400, "promo_apply_failed", str(result))
-            await session.commit()
-            end_date = result if isinstance(result, datetime) else None
-            return web.json_response(
-                {
-                    "ok": True,
-                    "end_date": end_date.isoformat() if end_date else None,
-                    "end_date_text": end_date.strftime("%d.%m.%Y %H:%M") if end_date else None,
-                }
-            )
-        except Exception:
-            await session.rollback()
-            logger.exception("WebApp promo apply failed")
-            return _json_error(500, "promo_apply_failed", "Promo apply failed")
-
-
-async def create_payment_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    rate_limit_response = await _enforce_webapp_rate_limit(
-        request,
-        user_id=user_id,
-        action="payments_create",
-    )
-    if rate_limit_response:
-        return rate_limit_response
-
-    payload = await _read_json(request)
-    payment_payload, validation_error = _validate_model_payload(WebAppPaymentCreatePayload, payload)
-    if validation_error:
-        return validation_error
-    method = str(payment_payload.method or "").strip().lower()
-    settings: Settings = request.app["settings"]
-    cached = _get_cached_webapp_settings(request)
-    tariffs_config = settings.tariffs_config
-    traffic_mode = bool(settings.traffic_sale_mode)
-    sale_mode = "subscription"
-    traffic_gb_for_payment: Optional[float] = None
-    requested_sale_mode = _sale_mode_base(str(payment_payload.sale_mode or ""))
-
-    if tariffs_config and requested_sale_mode in {"hwid_device", "hwid_devices"}:
-        tariff_key = str(payment_payload.tariff_key or "").strip()
-        if not tariff_key:
-            return _json_error(400, "invalid_plan", "Tariff is not selected")
-        try:
-            tariff = tariffs_config.require(tariff_key)
-        except Exception:
-            return _json_error(400, "invalid_plan", "Tariff is not available")
-        try:
-            device_count = int(
-                float(
-                    payment_payload.device_count
-                    if payment_payload.device_count is not None
-                    else payment_payload.months
-                )
-            )
-        except (TypeError, ValueError):
-            return _json_error(400, "invalid_plan", "Invalid device package")
-        packages = tariff.hwid_device_packages
-        rub_packages = {
-            int(package.count): float(package.price)
-            for package in (packages.rub if packages else [])
-        }
-        stars_packages = {
-            int(package.count): int(float(package.price))
-            for package in (packages.stars if packages else [])
-        }
-        price = rub_packages.get(device_count)
-        stars_price = stars_packages.get(device_count)
-        if price is None and method != "stars":
-            return _json_error(400, "invalid_plan", "Device package is not available")
-        if method == "stars" and (stars_price is None or int(stars_price) <= 0):
-            return _json_error(400, "invalid_plan", "Stars price is not configured")
-        payment_units = device_count
-        sale_mode = f"hwid_devices@{tariff.key}"
-    elif tariffs_config and requested_sale_mode in {"topup", "premium_topup"}:
-        tariff_key = str(payment_payload.tariff_key or "").strip()
-        if not tariff_key:
-            return _json_error(400, "invalid_plan", "Tariff is not selected")
-        try:
-            tariff = tariffs_config.require(tariff_key)
-        except Exception:
-            return _json_error(400, "invalid_plan", "Tariff is not available")
-        try:
-            traffic_gb = float(
-                payment_payload.traffic_gb
-                if payment_payload.traffic_gb is not None
-                else payment_payload.months
-            )
-        except (TypeError, ValueError):
-            return _json_error(400, "invalid_plan", "Invalid traffic package")
-        packages = (
-            tariff.premium_topup_packages
-            if requested_sale_mode == "premium_topup"
-            else tariffs_config.topup_packages_for(tariff)
-        )
-        rub_packages = {
-            float(package.gb): float(package.price)
-            for package in (packages.rub if packages else [])
-        }
-        stars_packages = {
-            float(package.gb): int(float(package.price))
-            for package in (packages.stars if packages else [])
-        }
-        package_key = _resolve_numeric_option_key(rub_packages, traffic_gb)
-        stars_package_key = _resolve_numeric_option_key(stars_packages, traffic_gb)
-        price = rub_packages.get(package_key) if package_key is not None else None
-        stars_price = (
-            stars_packages.get(stars_package_key) if stars_package_key is not None else None
-        )
-        if price is None and method != "stars":
-            return _json_error(400, "invalid_plan", "Traffic package is not available")
-        if method == "stars" and (stars_price is None or int(stars_price) <= 0):
-            return _json_error(400, "invalid_plan", "Stars price is not configured")
-        payment_units = int(traffic_gb) if float(traffic_gb).is_integer() else traffic_gb
-        traffic_gb_for_payment = float(payment_units)
-        sale_mode = f"{requested_sale_mode}@{tariff.key}"
-    elif tariffs_config:
-        tariff_key = str(payment_payload.tariff_key or "").strip()
-        if not tariff_key:
-            return _json_error(400, "invalid_plan", "Tariff is not selected")
-        try:
-            tariff = tariffs_config.require(tariff_key)
-        except Exception:
-            return _json_error(400, "invalid_plan", "Tariff is not available")
-
-        if tariff.billing_model == "traffic":
-            try:
-                traffic_gb = float(
-                    payment_payload.traffic_gb
-                    if payment_payload.traffic_gb is not None
-                    else payment_payload.months
-                )
-            except (TypeError, ValueError):
-                return _json_error(400, "invalid_plan", "Invalid traffic package")
-            if traffic_gb <= 0:
-                return _json_error(400, "invalid_plan", "Invalid traffic package")
-            rub_packages = {
-                float(package.gb): float(package.price)
-                for package in (tariff.traffic_packages.rub if tariff.traffic_packages else [])
-            }
-            stars_packages = {
-                float(package.gb): int(float(package.price))
-                for package in (tariff.traffic_packages.stars if tariff.traffic_packages else [])
-            }
-            package_key = _resolve_numeric_option_key(rub_packages, traffic_gb)
-            stars_package_key = _resolve_numeric_option_key(stars_packages, traffic_gb)
-            price = rub_packages.get(package_key) if package_key is not None else None
-            stars_price = (
-                stars_packages.get(stars_package_key) if stars_package_key is not None else None
-            )
-            if price is None and method != "stars":
-                return _json_error(400, "invalid_plan", "Traffic package is not available")
-            if method == "stars" and (stars_price is None or int(stars_price) <= 0):
-                return _json_error(400, "invalid_plan", "Stars price is not configured")
-            payment_units = int(traffic_gb) if float(traffic_gb).is_integer() else traffic_gb
-            traffic_gb_for_payment = float(payment_units)
-            sale_mode = f"traffic_package@{tariff.key}"
-        else:
-            try:
-                months = int(float(payment_payload.months))
-            except (TypeError, ValueError):
-                return _json_error(400, "invalid_plan", "Invalid subscription period")
-            if months not in tariff.enabled_periods:
-                return _json_error(400, "invalid_plan", "Subscription period is not available")
-            price = tariff.period_price(months, "rub")
-            stars_price_raw = tariff.period_price(months, "stars")
-            stars_price = int(stars_price_raw) if stars_price_raw and stars_price_raw > 0 else None
-            if price is None and method != "stars":
-                return _json_error(400, "invalid_plan", "Subscription period is not available")
-            if method == "stars" and (stars_price is None or int(stars_price) <= 0):
-                return _json_error(400, "invalid_plan", "Stars price is not configured")
-            payment_units = months
-            sale_mode = f"subscription@{tariff.key}"
-    elif traffic_mode:
-        try:
-            traffic_gb = float(
-                payment_payload.traffic_gb
-                if payment_payload.traffic_gb is not None
-                else payment_payload.months
-            )
-        except (TypeError, ValueError):
-            return _json_error(400, "invalid_plan", "Invalid traffic package")
-        if traffic_gb <= 0:
-            return _json_error(400, "invalid_plan", "Invalid traffic package")
-        package_key = _resolve_numeric_option_key(cached["traffic_packages"], traffic_gb)
-        stars_package_key = _resolve_numeric_option_key(
-            cached["stars_traffic_packages"], traffic_gb
-        )
-        price = cached["traffic_packages"].get(package_key) if package_key is not None else None
-        stars_price = (
-            cached["stars_traffic_packages"].get(stars_package_key)
-            if stars_package_key is not None
-            else None
-        )
-        if price is None and method != "stars":
-            return _json_error(400, "invalid_plan", "Traffic package is not available")
-        if method == "stars" and (stars_price is None or int(stars_price) <= 0):
-            return _json_error(400, "invalid_plan", "Stars price is not configured")
-        payment_units = int(traffic_gb) if float(traffic_gb).is_integer() else traffic_gb
-        traffic_gb_for_payment = float(payment_units)
-        sale_mode = "traffic"
-    else:
-        try:
-            months = int(float(payment_payload.months))
-        except (TypeError, ValueError):
-            return _json_error(400, "invalid_plan", "Invalid subscription period")
-        price = cached["subscription_options"].get(months)
-        stars_price = cached["stars_subscription_options"].get(months)
-        if price is None and method != "stars":
-            return _json_error(400, "invalid_plan", "Subscription period is not available")
-        if method == "stars" and (stars_price is None or int(stars_price) <= 0):
-            return _json_error(400, "invalid_plan", "Stars price is not configured")
-        payment_units = months
-        sale_mode = "subscription"
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        lang = db_user.language_code or settings.DEFAULT_LANGUAGE
-        return await _create_subscription_payment(
-            request=request,
-            session=session,
-            user_id=user_id,
-            method=method,
-            months=payment_units,
-            price=float(price or 0),
-            stars_price=stars_price,
-            lang=lang,
-            sale_mode=sale_mode,
-            traffic_gb=traffic_gb_for_payment,
-        )
-
-
-async def activate_trial_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    rate_limit_response = await _enforce_webapp_rate_limit(
-        request,
-        user_id=user_id,
-        action="trial_activate",
-    )
-    if rate_limit_response:
-        return rate_limit_response
-
-    settings: Settings = request.app["settings"]
-    if not settings.TRIAL_ENABLED or settings.TRIAL_DURATION_DAYS <= 0:
-        return _json_error(400, "trial_unavailable", "Trial is not available")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-
-        activation_result = await subscription_service.activate_trial_subscription(session, user_id)
-        if not activation_result or not activation_result.get("activated"):
-            await session.rollback()
-            message_key = (
-                activation_result.get("message_key", "trial_activation_failed")
-                if activation_result
-                else "trial_activation_failed"
-            )
-            status = 400 if message_key != "trial_activation_failed_panel_update" else 502
-            return _json_error(status, message_key, message_key)
-
-        end_date = activation_result.get("end_date")
-        config_link, connect_url = await prepare_config_links(
-            settings,
-            activation_result.get("subscription_url"),
-        )
-
-        i18n_instance = request.app.get("i18n")
-        if settings.LOG_TRIAL_ACTIVATIONS and i18n_instance:
-            try:
-                from bot.services.notification_service import NotificationService
-
-                notification_service = NotificationService(
-                    request.app["bot"], settings, i18n_instance
-                )
-                await notification_service.notify_trial_activation(user_id, end_date)
-            except Exception:
-                logger.exception("Failed to send WebApp trial activation notification")
-
-        try:
-            from db.dal import ad_dal as _ad_dal
-
-            await _ad_dal.mark_trial_activated(session, user_id)
-            await session.commit()
-        except Exception:
-            await session.rollback()
-            logger.exception("Failed to mark WebApp trial activation for ad attribution")
-
-        return web.json_response(
-            {
-                "ok": True,
-                "activated": True,
-                "days": activation_result.get("days", settings.TRIAL_DURATION_DAYS),
-                "end_date": end_date.isoformat() if isinstance(end_date, datetime) else None,
-                "end_date_text": _format_webapp_datetime(end_date)
-                if isinstance(end_date, datetime)
-                else None,
-                "traffic_gb": activation_result.get("traffic_gb", settings.TRIAL_TRAFFIC_LIMIT_GB),
-                "config_link": config_link,
-                "connect_url": connect_url or config_link,
-            }
-        )
-
-
-async def tariff_topup_options_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    config = settings.tariffs_config
-    topup_kind = str(request.query.get("kind") or "all").strip().lower()
-    if topup_kind not in {"all", "regular", "premium"}:
-        return _json_error(400, "invalid_topup_kind", "Invalid topup kind")
-    if not config:
-        return _json_error(404, "tariffs_unavailable", "Tariffs are not configured")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        sub = await subscription_dal.get_active_subscription_by_user_id(
-            session, user_id, db_user.panel_user_uuid
-        )
-        if not sub or not sub.tariff_key:
-            return _json_error(
-                400, "subscription_required", "Active tariff subscription is required"
-            )
-        lang = db_user.language_code or settings.DEFAULT_LANGUAGE
-        tariff = config.require(sub.tariff_key)
-        plans = (
-            _serialize_topup_packages(settings, tariff, config.topup_packages_for(tariff), lang)
-            if topup_kind in {"all", "regular"}
-            else []
-        )
-        premium_plans = (
-            _serialize_topup_packages(
-                settings,
-                tariff,
-                tariff.premium_topup_packages,
-                lang,
-                sale_mode="premium_topup",
-                title_prefix=f"{tariff.premium_name(lang)} ",
-            )
-            if topup_kind in {"all", "premium"} and tariff.premium_squad_uuids
-            else []
-        )
-        premium_bonus_bytes = int(getattr(sub, "premium_bonus_bytes", 0) or 0)
-        premium_unlimited_override = bool(getattr(sub, "premium_unlimited_override", False))
-        premium_limit_bytes = (
-            int(sub.premium_baseline_bytes or 0)
-            + int(sub.premium_topup_balance_bytes or 0)
-            + int(getattr(sub, "premium_topup_used_bytes", 0) or 0)
-            + premium_bonus_bytes
-        )
-        premium_access = await request.app["subscription_service"].premium_access_for_tariff(tariff)
-        return web.json_response(
-            {
-                "ok": True,
-                "tariff_key": tariff.key,
-                "tariff_name": tariff.name(lang),
-                "topup_kind": topup_kind,
-                "premium_title": tariff.premium_name(lang),
-                "traffic_percent": _traffic_percent(
-                    sub.traffic_used_bytes, sub.traffic_limit_bytes
-                ),
-                "premium_traffic_percent": 0
-                if premium_unlimited_override
-                else _traffic_percent(
-                    sub.premium_used_bytes,
-                    premium_limit_bytes,
-                ),
-                "premium_limit_bytes": premium_limit_bytes,
-                "premium_used_bytes": int(sub.premium_used_bytes or 0),
-                "premium_baseline_bytes": int(sub.premium_baseline_bytes or 0),
-                "premium_topup_balance_bytes": int(sub.premium_topup_balance_bytes or 0),
-                "premium_topup_used_bytes": int(getattr(sub, "premium_topup_used_bytes", 0) or 0),
-                "premium_bonus_bytes": premium_bonus_bytes,
-                "premium_unlimited_override": premium_unlimited_override,
-                "premium_is_limited": bool(sub.premium_is_limited),
-                "premium_squad_labels": premium_access.get("squad_labels") or [],
-                "premium_node_labels": premium_access.get("node_labels") or [],
-                "warning_levels": settings.tariff_traffic_warning_levels,
-                "plans": plans + premium_plans,
-            }
-        )
-
-
-async def tariff_change_options_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    config = settings.tariffs_config
-    if not config:
-        return _json_error(404, "tariffs_unavailable", "Tariffs are not configured")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        sub = await subscription_dal.get_active_subscription_by_user_id(
-            session, user_id, db_user.panel_user_uuid
-        )
-        if not sub or not sub.tariff_key:
-            return _json_error(
-                400, "subscription_required", "Active tariff subscription is required"
-            )
-        lang = db_user.language_code or settings.DEFAULT_LANGUAGE
-        current = config.require(sub.tariff_key)
-        targets = []
-        for tariff in config.enabled_tariffs:
-            if tariff.key == current.key:
-                continue
-            options = subscription_service.calculate_tariff_switch_options(sub, tariff)
-            targets.append(_serialize_tariff_change_target(settings, config, tariff, options, lang))
-        return web.json_response(
-            {
-                "ok": True,
-                "current": {
-                    "tariff_key": current.key,
-                    "title": current.name(lang),
-                    "description": current.description(lang),
-                    "billing_model": current.billing_model,
-                },
-                "targets": targets,
-            }
-        )
-
-
-async def tariff_change_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    payload = await _read_json(request)
-    change_payload, validation_error = _validate_model_payload(WebAppTariffChangePayload, payload)
-    if validation_error:
-        return validation_error
-    mode = str(change_payload.mode or "").strip()
-    if mode not in {"recalc_days", "convert_days_to_gb"}:
-        return _json_error(400, "invalid_change_mode", "This tariff change requires payment")
-
-    settings: Settings = request.app["settings"]
-    if not settings.tariffs_config:
-        return _json_error(404, "tariffs_unavailable", "Tariffs are not configured")
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        result = await subscription_service.switch_tariff_without_payment(
-            session,
-            user_id,
-            str(change_payload.tariff_key),
-            mode,
-        )
-        if not result:
-            await session.rollback()
-            return _json_error(400, "change_failed", "Tariff change failed")
-        await session.commit()
-        return web.json_response({"ok": True, **result})
-
-
-async def tariff_change_payment_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    payload = await _read_json(request)
-    payment_payload, validation_error = _validate_model_payload(WebAppPaymentCreatePayload, payload)
-    if validation_error:
-        return validation_error
-    method = str(payment_payload.method or "").strip().lower()
-    tariff_key = str(payment_payload.tariff_key or "").strip()
-    settings: Settings = request.app["settings"]
-    config = settings.tariffs_config
-    if not config:
-        return _json_error(404, "tariffs_unavailable", "Tariffs are not configured")
-    if not tariff_key:
-        return _json_error(400, "invalid_plan", "Tariff is not selected")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        sub = await subscription_dal.get_active_subscription_by_user_id(
-            session, user_id, db_user.panel_user_uuid
-        )
-        if not sub:
-            return _json_error(
-                400, "subscription_required", "Active tariff subscription is required"
-            )
-        target = config.require(tariff_key)
-        options = subscription_service.calculate_tariff_switch_options(sub, target)
-        price = float(options.get("paid_diff_rub") or 0)
-        if price <= 0:
-            return _json_error(
-                400, "payment_not_required", "Payment is not required for this tariff change"
-            )
-        return await _create_subscription_payment(
-            request=request,
-            session=session,
-            user_id=user_id,
-            method=method,
-            months=1,
-            price=price,
-            stars_price=None,
-            lang=db_user.language_code or settings.DEFAULT_LANGUAGE,
-            sale_mode=f"tariff_upgrade@{target.key}",
-        )
-
-
-async def device_topup_options_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    config = settings.tariffs_config
-    if not settings.MY_DEVICES_SECTION_ENABLED:
-        return _json_error(404, "devices_disabled", "Devices section is disabled")
-    if not config:
-        return _json_error(404, "tariffs_unavailable", "Tariffs are not configured")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-        sub = await subscription_dal.get_active_subscription_by_user_id(
-            session, user_id, db_user.panel_user_uuid
-        )
-        if not sub or not sub.tariff_key:
-            return _json_error(
-                400, "subscription_required", "Active tariff subscription is required"
-            )
-        tariff = config.require(sub.tariff_key)
-        active = await subscription_service.get_active_subscription_details(session, user_id)
-        plans = _serialize_hwid_device_packages(
-            settings,
-            tariff,
-            tariff.hwid_device_packages,
-            db_user.language_code or settings.DEFAULT_LANGUAGE,
-        )
-        return web.json_response(
-            {
-                "ok": True,
-                "tariff_key": tariff.key,
-                "tariff_name": tariff.name(db_user.language_code or settings.DEFAULT_LANGUAGE),
-                "current_limit": _coerce_int_or_none(active.get("max_devices")) if active else None,
-                "extra_hwid_devices": int(sub.extra_hwid_devices or 0),
-                "plans": plans,
-            }
-        )
-
-
-async def payment_status_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    try:
-        payment_id = int(request.match_info["payment_id"])
-    except (TypeError, ValueError):
-        return _json_error(400, "invalid_payment", "Invalid payment id")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        payment = await payment_dal.get_payment_by_db_id(session, payment_id)
-        if not payment or payment.user_id != user_id:
-            return _json_error(404, "not_found", "Payment not found")
-        return web.json_response(
-            {
-                "ok": True,
-                "payment_id": payment.payment_id,
-                "status": payment.status,
-                "paid": payment.status == "succeeded",
-            }
-        )
-
-
-def _sale_mode_base(sale_mode: str) -> str:
-    return str(sale_mode or "subscription").split("@", 1)[0].split("|", 1)[0]
-
-
-def _sale_mode_tariff_key(sale_mode: str) -> Optional[str]:
-    if "@" not in str(sale_mode or ""):
-        return None
-    return str(sale_mode).split("@", 1)[1].split("|", 1)[0] or None
-
-
-def _sale_mode_is_traffic(sale_mode: str) -> bool:
-    return _sale_mode_base(sale_mode) in {"traffic", "traffic_package", "topup", "premium_topup"}
-
-
-def _sale_mode_is_hwid_devices(sale_mode: str) -> bool:
-    return _sale_mode_base(sale_mode) in {"hwid_device", "hwid_devices"}
-
-
-async def _create_subscription_payment(
-    *,
-    request: web.Request,
-    session: AsyncSession,
-    user_id: int,
-    method: str,
-    months: Any,
-    price: float,
-    stars_price: Optional[int],
-    lang: str,
-    sale_mode: str = "subscription",
-    traffic_gb: Optional[float] = None,
-) -> web.Response:
-    settings: Settings = request.app["settings"]
-    sale_mode = str(sale_mode or "subscription")
-    traffic_sale = _sale_mode_is_traffic(sale_mode)
-    hwid_devices_sale = _sale_mode_is_hwid_devices(sale_mode)
-    description = (
-        _traffic_payment_description(float(traffic_gb if traffic_gb is not None else months), lang)
-        if traffic_sale
-        else _hwid_devices_payment_description(int(float(months)), lang)
-        if hwid_devices_sale
-        else _payment_description(int(months), lang)
-    )
-
-    from bot.payment_providers import WebAppPaymentContext, get_provider_spec
-
-    provider_spec = get_provider_spec(method)
-    if provider_spec and provider_spec.create_webapp_payment:
-        if not provider_spec.is_visible(settings, request.app):
-            logger.warning(
-                "WebApp payment method unavailable: method=%s enabled=%s configured=%s",
-                method,
-                provider_spec.is_enabled(settings),
-                provider_spec.is_service_configured(request.app),
-            )
-            return _json_error(400, "payment_unavailable", "Payment method unavailable")
-        return await provider_spec.create_webapp_payment(
-            WebAppPaymentContext(
-                request=request,
-                session=session,
-                user_id=user_id,
-                method=method,
-                months=months,
-                price=price,
-                stars_price=stars_price,
-                description=description,
-                sale_mode=sale_mode,
-                traffic_gb=traffic_gb,
-            )
-        )
-
-    return _json_error(400, "payment_unavailable", "Payment method unavailable")

backend/bot/app/web/webapp/cache_helpers.py

@@ -1,81 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, Awaitable, Callable, Optional
-
-from bot.infra.redis import cache_delete, redis_key
-from bot.utils.ttl_cache import AsyncTTLCache
-from config.settings import Settings
-
-_WEBAPP_USER_PAYLOAD_CACHES: dict[tuple[int, str, int], AsyncTTLCache] = {}
-
-
-def _webapp_user_payload_cache(
-    settings: Settings,
-    namespace: str,
-    ttl_seconds: int,
-) -> Optional[AsyncTTLCache]:
-    ttl = max(0, int(ttl_seconds or 0))
-    if ttl <= 0:
-        return None
-    cache_key = (id(settings), namespace, ttl)
-    cache = _WEBAPP_USER_PAYLOAD_CACHES.get(cache_key)
-    if cache is None:
-        cache = AsyncTTLCache(
-            ttl_seconds=ttl,
-            settings=settings,
-            namespace=f"webapp:{namespace}",
-        )
-        _WEBAPP_USER_PAYLOAD_CACHES[cache_key] = cache
-    return cache
-
-
-async def webapp_cached_user_payload(
-    settings: Settings,
-    namespace: str,
-    user_id: int,
-    ttl_seconds: int,
-    loader: Callable[[], Awaitable[Any]],
-) -> Any:
-    cache = _webapp_user_payload_cache(settings, namespace, ttl_seconds)
-    if cache is None:
-        return await loader()
-    return await cache.get_or_load(str(int(user_id)), loader)
-
-
-def invalidate_local_webapp_user_payload(
-    settings: Settings,
-    namespace: str,
-    user_id: int,
-) -> None:
-    key = str(int(user_id))
-    for (settings_id, cache_namespace, _ttl), cache in tuple(
-        _WEBAPP_USER_PAYLOAD_CACHES.items()
-    ):
-        if settings_id == id(settings) and cache_namespace == namespace:
-            cache.invalidate(key)
-
-
-async def invalidate_webapp_user_caches(
-    settings: Settings,
-    *user_ids: Optional[int],
-    include_devices: bool = False,
-) -> None:
-    keys: list[str] = []
-    seen: set[int] = set()
-    for raw_user_id in user_ids:
-        if raw_user_id is None:
-            continue
-        try:
-            user_id = int(raw_user_id)
-        except (TypeError, ValueError):
-            continue
-        if user_id in seen:
-            continue
-        seen.add(user_id)
-        keys.append(redis_key(settings, "cache", "webapp", "me", user_id))
-        invalidate_local_webapp_user_payload(settings, "me", user_id)
-        if include_devices:
-            keys.append(redis_key(settings, "cache", "webapp", "devices", user_id))
-            invalidate_local_webapp_user_payload(settings, "devices", user_id)
-    if keys:
-        await cache_delete(settings, *keys)

backend/bot/app/web/webapp/common.py

@@ -1,193 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from bot.app.web.webapp.cache_helpers import (
-    invalidate_local_webapp_user_payload,
-)
-
-
-async def _read_json(request: web.Request) -> Dict[str, Any]:
-    try:
-        data = await request.json()
-        return data if isinstance(data, dict) else {}
-    except Exception:
-        return {}
-
-
-def _json_error(status: int, code: str, message: str) -> web.Response:
-    return web.json_response(
-        {"ok": False, "error": code, "message": message},
-        status=status,
-    )
-
-
-async def _invalidate_webapp_user_caches(
-    settings: Settings,
-    *user_ids: Optional[int],
-    include_devices: bool = False,
-) -> None:
-    keys: List[str] = []
-    seen: set[int] = set()
-    for raw_user_id in user_ids:
-        if raw_user_id is None:
-            continue
-        try:
-            user_id = int(raw_user_id)
-        except (TypeError, ValueError):
-            continue
-        if user_id in seen:
-            continue
-        seen.add(user_id)
-        keys.append(redis_key(settings, "cache", "webapp", "me", user_id))
-        invalidate_local_webapp_user_payload(settings, "me", user_id)
-        if include_devices:
-            keys.append(redis_key(settings, "cache", "webapp", "devices", user_id))
-            invalidate_local_webapp_user_payload(settings, "devices", user_id)
-    if keys:
-        await cache_delete(settings, *keys)
-
-
-def _validation_error_response(exc: ValidationError) -> web.Response:
-    for error in exc.errors():
-        loc = error.get("loc") or ()
-        field = str(loc[0]) if loc else ""
-        error_type = str(error.get("type") or "")
-        message = str(error.get("msg") or "")
-        message_lower = message.lower()
-
-        if field == "email":
-            if (
-                "too_long" in message_lower
-                or "too long" in message_lower
-                or error_type == "string_too_long"
-            ):
-                return _json_error(400, "email_too_long", "Email is too long")
-            return _json_error(400, "invalid_email", "Invalid email")
-
-        if field in {"description", "comment", "note"} and error_type == "string_too_long":
-            return _json_error(400, f"{field}_too_long", f"{field.capitalize()} is too long")
-
-        if field in {"password", "password_confirm"}:
-            if error_type == "string_too_short":
-                return _json_error(400, "password_too_short", "Password is too short")
-            if error_type == "string_too_long":
-                return _json_error(400, "password_too_long", "Password is too long")
-            return _json_error(400, "invalid_password", "Invalid password")
-
-        if error_type == "string_too_long":
-            return _json_error(400, "text_too_long", "Text is too long")
-
-    return _json_error(400, "invalid_request", "Invalid request")
-
-
-def _validate_model_payload(
-    model_cls: type[BaseModel],
-    payload: Dict[str, Any],
-) -> tuple[Optional[BaseModel], Optional[web.Response]]:
-    try:
-        return model_cls.model_validate(payload), None
-    except ValidationError as exc:
-        return None, _validation_error_response(exc)
-
-
-def _normalize_language(lang: Optional[str]) -> str:
-    value = (lang or "ru").split("-")[0].lower()
-    return value if value in {"ru", "en"} else "ru"
-
-
-def _format_remaining(seconds: int, lang: str) -> str:
-    if seconds <= 0:
-        if lang == "en":
-            return "Subscription inactive"
-        return "Подписка не активна"
-    days, rem = divmod(seconds, 86400)
-    hours, rem = divmod(rem, 3600)
-    minutes = rem // 60
-    if lang == "en":
-        if days > 0:
-            return f"{days} d. {hours} h."
-        if hours > 0:
-            return f"{hours} h. {minutes} min."
-        return f"{max(1, minutes)} min."
-    if days > 0:
-        return f"{days} д. {hours} ч."
-    if hours > 0:
-        return f"{hours} ч. {minutes} мин."
-    return f"{max(1, minutes)} мин."
-
-
-def _coerce_int_or_none(value: Optional[Any]) -> Optional[int]:
-    if value is None:
-        return None
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        return None
-
-
-def _format_bytes(value: Optional[Any], *, zero_as_unlimited: bool = False) -> str:
-    if value is None:
-        return "N/A"
-    try:
-        size = float(value)
-    except (TypeError, ValueError):
-        return str(value)
-    if size <= 0 and zero_as_unlimited:
-        return "∞"
-    if size <= 0:
-        size = 0
-    units = ["B", "KB", "MB", "GB", "TB"]
-    index = 0
-    while size >= 1024 and index < len(units) - 1:
-        size /= 1024
-        index += 1
-    return f"{size:.2f} {units[index]}"
-
-
-def _format_months_title(months: int, lang: str) -> str:
-    if lang == "en":
-        if months == 1:
-            return "1 month"
-        return f"{months} months"
-    if months == 1:
-        return "1 месяц"
-    if 2 <= months <= 4:
-        return f"{months} месяца"
-    return f"{months} месяцев"
-
-
-def _format_number_for_payload(value: Any) -> str:
-    numeric = float(value or 0)
-    return str(int(numeric)) if numeric.is_integer() else f"{numeric:g}"
-
-
-def _format_traffic_title(traffic_gb: float, lang: str) -> str:
-    return f"{_format_number_for_payload(traffic_gb)} GB"
-
-
-def _traffic_payment_description(traffic_gb: float, lang: str) -> str:
-    if lang == "en":
-        return f"Traffic package {_format_traffic_title(traffic_gb, lang)}"
-    return f"Пакет трафика {_format_traffic_title(traffic_gb, lang)}"
-
-
-def _hwid_devices_payment_description(device_count: int, lang: str) -> str:
-    if lang == "en":
-        return f"HWID device package +{device_count}"
-    return f"Докупка устройств HWID +{device_count}"
-
-
-def _resolve_numeric_option_key(options: Dict[Any, Any], target: float) -> Optional[Any]:
-    for key in options:
-        try:
-            if abs(float(key) - float(target)) < 0.000001:
-                return key
-        except (TypeError, ValueError):
-            continue
-    return None
-
-
-def _payment_description(months: int, lang: str) -> str:
-    if lang == "en":
-        return f"Subscription for {_format_months_title(months, lang)}"
-    return f"Подписка на {_format_months_title(months, lang)}"

backend/bot/app/web/webapp/devices.py

@@ -1,217 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from bot.app.web.webapp.cache_helpers import webapp_cached_user_payload
-
-
-async def devices_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    settings: Settings = request.app["settings"]
-    if not settings.MY_DEVICES_SECTION_ENABLED:
-        return _json_error(404, "devices_disabled", "Devices section is disabled")
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-
-        result = await webapp_cached_user_payload(
-            settings,
-            "devices",
-            user_id,
-            int(getattr(settings, "WEBAPP_DEVICES_CACHE_TTL_SECONDS", 5) or 0),
-            lambda: _load_devices_payload(subscription_service, session, user_id),
-        )
-    if isinstance(result, dict) and result.get("ok") is True:
-        return web.json_response({"ok": True, **(result.get("payload") or {})})
-    if isinstance(result, dict) and not result.get("error"):
-        # Backward-compatible with payloads written by older versions under
-        # the same Redis cache key.
-        return web.json_response({"ok": True, **result})
-    if not isinstance(result, dict):
-        result = {}
-    if not result.get("ok"):
-        return _json_error(
-            int(result.get("status") or 500),
-            str(result.get("error") or "devices_load_failed"),
-            str(result.get("message") or "Failed to load devices"),
-        )
-    return web.json_response({"ok": True, **(result.get("payload") or {})})
-
-
-async def _load_devices_payload(
-    subscription_service: SubscriptionService,
-    session: AsyncSession,
-    user_id: int,
-) -> Dict[str, Any]:
-    active = await subscription_service.get_active_subscription_details(session, user_id)
-    panel_user_uuid = active.get("user_id") if active else None
-    if not panel_user_uuid:
-        return {
-            "ok": False,
-            "status": 400,
-            "error": "subscription_not_active",
-            "message": "Subscription is not active",
-        }
-
-    panel_service = getattr(subscription_service, "panel_service", None)
-    if not panel_service:
-        return {
-            "ok": False,
-            "status": 503,
-            "error": "panel_unavailable",
-            "message": "Panel service unavailable",
-        }
-
-    try:
-        devices_response = await panel_service.get_user_devices(panel_user_uuid)
-    except Exception:
-        logger.exception("Failed to load WebApp devices for user %s", user_id)
-        return {
-            "ok": False,
-            "status": 502,
-            "error": "devices_load_failed",
-            "message": "Failed to load devices",
-        }
-
-    devices = _normalize_devices_response(devices_response)
-    max_devices = _coerce_int_or_none(active.get("max_devices")) if active else None
-    return {
-        "ok": True,
-        "payload": {
-            "enabled": True,
-            "current_devices": len(devices),
-            "max_devices": max_devices,
-            "max_devices_label": _format_devices_limit(max_devices),
-            "devices": [
-                _serialize_device(device, index)
-                for index, device in enumerate(devices, start=1)
-            ],
-        },
-    }
-
-
-async def disconnect_device_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    rate_limit_response = await _enforce_webapp_rate_limit(
-        request,
-        user_id=user_id,
-        action="devices_disconnect",
-    )
-    if rate_limit_response:
-        return rate_limit_response
-
-    settings: Settings = request.app["settings"]
-    if not settings.MY_DEVICES_SECTION_ENABLED:
-        return _json_error(404, "devices_disabled", "Devices section is disabled")
-
-    payload = await _read_json(request)
-    disconnect_payload, validation_error = _validate_model_payload(
-        WebAppDeviceDisconnectPayload, payload
-    )
-    if validation_error:
-        return validation_error
-    token = str(disconnect_payload.token or "").strip()
-
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            return _json_error(403, "access_denied", "Access denied")
-
-        active = await subscription_service.get_active_subscription_details(session, user_id)
-        panel_user_uuid = active.get("user_id") if active else None
-        if not panel_user_uuid:
-            return _json_error(400, "subscription_not_active", "Subscription is not active")
-
-        panel_service = getattr(subscription_service, "panel_service", None)
-        if not panel_service:
-            return _json_error(503, "panel_unavailable", "Panel service unavailable")
-
-        try:
-            devices_response = await panel_service.get_user_devices(panel_user_uuid)
-        except Exception:
-            logger.exception("Failed to load WebApp devices before disconnect for user %s", user_id)
-            return _json_error(502, "devices_load_failed", "Failed to load devices")
-
-        target_hwid = None
-        for device in _normalize_devices_response(devices_response):
-            hwid = str(device.get("hwid") or "").strip()
-            if hwid and hmac.compare_digest(_device_hwid_token(hwid), token):
-                target_hwid = hwid
-                break
-
-        if not target_hwid:
-            return _json_error(404, "device_not_found", "Device not found")
-
-        success = await panel_service.disconnect_device(panel_user_uuid, target_hwid)
-        if not success:
-            return _json_error(502, "device_disconnect_failed", "Failed to disconnect device")
-        await cache_delete(settings, redis_key(settings, "cache", "webapp", "devices", user_id))
-        await session.commit()
-
-    return web.json_response({"ok": True})
-
-
-def _device_hwid_token(hwid: str) -> str:
-    return hashlib.sha256(str(hwid or "").encode()).hexdigest()[:32]
-
-
-def _shorten_hwid_for_display(hwid: Optional[str], max_length: int = 24) -> str:
-    value = str(hwid or "").strip()
-    if len(value) <= max_length:
-        return value
-    return f"{value[:8]}...{value[-6:]}"
-
-
-def _normalize_devices_response(devices_response: Any) -> List[Dict[str, Any]]:
-    if isinstance(devices_response, dict):
-        devices = devices_response.get("devices") or []
-    else:
-        devices = devices_response or []
-    if not isinstance(devices, list):
-        return []
-    return [device for device in devices if isinstance(device, dict)]
-
-
-def _format_devices_limit(max_devices: Optional[int]) -> str:
-    if max_devices in (None, 0):
-        return "Unlimited"
-    return str(max_devices)
-
-
-def _format_device_datetime(value: Any) -> str:
-    if not value:
-        return ""
-    text = str(value)
-    try:
-        normalized = datetime.fromisoformat(text.replace("Z", "+00:00"))
-        return normalized.strftime("%d.%m.%Y %H:%M")
-    except Exception:
-        return text
-
-
-def _serialize_device(device: Dict[str, Any], index: int) -> Dict[str, Any]:
-    hwid = str(device.get("hwid") or "").strip()
-    model = str(device.get("deviceModel") or "").strip()
-    platform = str(device.get("platform") or "").strip()
-    os_version = str(device.get("osVersion") or "").strip()
-    user_agent = str(device.get("userAgent") or "").strip()
-    display_name = model or platform or f"Device {index}"
-    platform_label = " ".join(part for part in (platform, os_version) if part).strip()
-    return {
-        "index": index,
-        "display_name": display_name,
-        "platform": platform,
-        "os_version": os_version,
-        "platform_label": platform_label,
-        "user_agent": user_agent,
-        "created_at": device.get("createdAt"),
-        "created_at_text": _format_device_datetime(device.get("createdAt")),
-        "hwid_short": _shorten_hwid_for_display(hwid),
-        "token": _device_hwid_token(hwid) if hwid else "",
-        "can_disconnect": bool(hwid),
-    }

backend/bot/app/web/webapp/payloads.py

@@ -1,122 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from typing import Literal
-
-
-class WebAppEmailPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    email: EmailStr
-
-    @field_validator("email")
-    @classmethod
-    def _normalize_and_limit_email(cls, value: EmailStr) -> str:
-        normalized = normalize_email(str(value))
-        if len(normalized) > 254:
-            raise ValueError("email_too_long")
-        return normalized
-
-
-class WebAppEmailCodePayload(WebAppEmailPayload):
-    code: str = ""
-
-
-class WebAppEmailPasswordPayload(WebAppEmailPayload):
-    password: constr(min_length=1, max_length=128)
-
-
-class WebAppSetPasswordPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    password: constr(min_length=8, max_length=128)
-    password_confirm: constr(min_length=8, max_length=128)
-    code: constr(min_length=1, max_length=32)
-
-
-class WebAppEmailMagicPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    token: constr(min_length=8, max_length=512)
-
-
-class WebAppPaymentCreatePayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    method: str = ""
-    months: Any = None
-    traffic_gb: Any = None
-    device_count: Any = None
-    tariff_key: Optional[constr(max_length=128)] = None
-    sale_mode: Optional[constr(max_length=64)] = None
-    description: Optional[constr(max_length=4096)] = None
-    comment: Optional[constr(max_length=4096)] = None
-    note: Optional[constr(max_length=4096)] = None
-
-
-class WebAppTariffChangePayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    tariff_key: constr(min_length=1, max_length=128)
-    mode: constr(min_length=1, max_length=64)
-
-
-class WebAppLanguagePayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    language: constr(min_length=2, max_length=16)
-
-
-class WebAppDeviceDisconnectPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    token: constr(min_length=8, max_length=128)
-
-
-SupportCategory = Literal["billing", "technical", "account", "other"]
-SupportPriority = Literal["low", "normal", "high", "urgent"]
-SupportStatus = Literal["open", "awaiting_user", "awaiting_admin", "resolved", "closed"]
-
-
-class CreateTicketPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    subject: constr(min_length=1, max_length=160)
-    category: SupportCategory = "other"
-    priority: Literal["normal", "high"] = "normal"
-    body: constr(min_length=1, max_length=4000)
-
-    @field_validator("subject", "body")
-    @classmethod
-    def _strip_required_text(cls, value: str) -> str:
-        stripped = value.strip()
-        if not stripped:
-            raise ValueError("empty_text")
-        return stripped
-
-
-class TicketReplyPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    body: constr(min_length=1, max_length=4000)
-
-    @field_validator("body")
-    @classmethod
-    def _strip_body(cls, value: str) -> str:
-        stripped = value.strip()
-        if not stripped:
-            raise ValueError("empty_text")
-        return stripped
-
-
-class AdminTicketReplyPayload(TicketReplyPayload):
-    is_internal_note: bool = False
-
-
-class AdminTicketPatchPayload(BaseModel):
-    model_config = ConfigDict(extra="ignore")
-
-    status: Optional[SupportStatus] = None
-    priority: Optional[SupportPriority] = None
-    category: Optional[SupportCategory] = None
-    assigned_admin_id: Optional[int] = None

backend/bot/app/web/webapp/routes.py

@@ -1,87 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-
-def setup_subscription_webapp_routes(app: web.Application) -> None:
-    app.router.add_get("/", index_route)
-    app.router.add_get("/login/password", index_route)
-    app.router.add_get("/home", index_route)
-    app.router.add_get("/invite", index_route)
-    app.router.add_get("/devices", index_route)
-    app.router.add_get("/settings", index_route)
-    app.router.add_get("/support", index_route)
-    app.router.add_get("/support/{ticket_id:\\d+}", index_route)
-    app.router.add_get("/admin", index_route)
-    app.router.add_get(
-        (
-            "/admin/{section:stats|users|payments|promos|ads|broadcast|logs|tariffs|"
-            "appearance|settings|support}"
-        ),
-        index_route,
-    )
-    app.router.add_get("/admin/users/{user_id:-?[0-9]+}", index_route)
-    app.router.add_get("/admin/support/{ticket_id:\\d+}", index_route)
-    app.router.add_get("/auth/telegram/start", telegram_oauth_start_route)
-    app.router.add_get("/auth/telegram/callback", telegram_oauth_callback_route)
-    app.router.add_get("/health", health_route)
-    app.router.add_get(WEBAPP_LOGO_PROXY_PATH, webapp_logo_route)
-    app.router.add_get(
-        rf"{WEBAPP_UPLOADED_LOGO_PATH}/{{filename:[A-Za-z0-9_.-]+}}",
-        webapp_uploaded_logo_route,
-    )
-    app.router.add_get(
-        rf"{WEBAPP_FAVICON_PATH}/{{digest:[0-9a-f]{{16}}}}/{{filename:[A-Za-z0-9_.-]+}}",
-        webapp_favicon_route,
-    )
-    app.router.add_get(
-        r"/webapp-emoji/{codepoints:[0-9a-f_]+}/512.{ext:gif|webp}",
-        webapp_animated_emoji_route,
-    )
-    app.router.add_get("/subscription_webapp.{asset_hash:[0-9a-f]{8}}.css", css_asset_route)
-    app.router.add_get("/subscription_webapp.css", css_asset_route)
-    app.router.add_get(
-        "/subscription_webapp_admin.{asset_hash:[0-9a-f]{8}}.css",
-        admin_css_asset_route,
-    )
-    app.router.add_get("/subscription_webapp_admin.css", admin_css_asset_route)
-    app.router.add_get(r"/webapp-theme-css/{path:.+}", theme_css_asset_route)
-    app.router.add_get(r"/webapp-theme-assets/{path:.+}", theme_asset_route)
-    app.router.add_get("/subscription_webapp.min.{asset_hash}.js", js_asset_route)
-    app.router.add_get("/subscription_webapp.js", js_asset_route)
-    app.router.add_get("/subscription_webapp_admin.min.{asset_hash}.js", admin_js_asset_route)
-    app.router.add_get("/subscription_webapp_admin.js", admin_js_asset_route)
-    app.router.add_post("/api/auth/telegram/nonce", telegram_oauth_nonce_route)
-    app.router.add_post("/api/auth/token", auth_token_route)
-    app.router.add_post("/api/auth/email/request", email_auth_request_route)
-    app.router.add_post("/api/auth/email/verify", email_auth_verify_route)
-    app.router.add_post("/api/auth/email/magic", email_auth_magic_route)
-    app.router.add_post("/api/auth/email/password", email_password_auth_route)
-    app.router.add_post("/api/auth/logout", logout_route)
-    app.router.add_get("/api/bootstrap", bootstrap_route)
-    app.router.add_get("/api/i18n", i18n_route)
-    app.router.add_get("/api/me", me_route)
-    app.router.add_get("/api/account/avatar", account_avatar_route)
-    app.router.add_post("/api/account/language", account_language_route)
-    app.router.add_post("/api/account/email/request", account_email_request_route)
-    app.router.add_post("/api/account/email/verify", account_email_verify_route)
-    app.router.add_post("/api/account/password/request", account_password_request_route)
-    app.router.add_post("/api/account/password/confirm", account_password_confirm_route)
-    app.router.add_post("/api/account/telegram/link", account_telegram_link_route)
-    app.router.add_post("/api/promo/apply", apply_promo_route)
-    app.router.add_post("/api/trial/activate", activate_trial_route)
-    app.router.add_get("/api/devices", devices_route)
-    app.router.add_post("/api/devices/disconnect", disconnect_device_route)
-    app.router.add_get("/api/devices/topup-options", device_topup_options_route)
-    app.router.add_get("/api/support/tickets", support_tickets_route)
-    app.router.add_post("/api/support/tickets", support_create_ticket_route)
-    app.router.add_get("/api/support/tickets/{id:\\d+}", support_ticket_detail_route)
-    app.router.add_post("/api/support/tickets/{id:\\d+}/messages", support_ticket_reply_route)
-    app.router.add_post("/api/support/tickets/{id:\\d+}/read", support_ticket_read_route)
-    app.router.add_get("/api/support/unread", support_unread_route)
-    app.router.add_get("/api/tariffs/topup-options", tariff_topup_options_route)
-    app.router.add_get("/api/tariffs/change-options", tariff_change_options_route)
-    app.router.add_post("/api/tariffs/change", tariff_change_route)
-    app.router.add_post("/api/tariffs/change-payment", tariff_change_payment_route)
-    app.router.add_post("/api/payments", create_payment_route)
-    app.router.add_get("/api/payments/{payment_id}", payment_status_route)
-    setup_admin_routes(app)

backend/bot/app/web/webapp/serializers.py

@@ -1,606 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from config.webapp_themes_config import public_themes_catalog_payload
-
-
-async def _build_user_payload(request: web.Request, user_id: int) -> Dict[str, Any]:
-    settings: Settings = request.app["settings"]
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    subscription_service: SubscriptionService = request.app["subscription_service"]
-    cached = _get_cached_webapp_settings(request)
-
-    async with async_session_factory() as session:
-        db_user = await user_dal.get_user_by_id(session, user_id)
-        if not db_user or db_user.is_banned:
-            raise web.HTTPForbidden(
-                text=json.dumps({"ok": False, "error": "access_denied"}),
-                content_type="application/json",
-            )
-
-        active = await subscription_service.get_active_subscription_details(session, user_id)
-        referral_code = await user_dal.ensure_referral_code(session, db_user)
-        referral_service: Optional[ReferralService] = request.app.get("referral_service")
-        bot_username = request.app.get("bot_username") or ""
-        referral_link = None
-        if referral_service and bot_username:
-            referral_link = await referral_service.generate_referral_link(
-                session,
-                bot_username,
-                user_id,
-            )
-        webapp_referral_link = _build_webapp_referral_link(
-            request.app["settings"].SUBSCRIPTION_MINI_APP_URL,
-            referral_code,
-        )
-        referral_stats = (
-            await referral_service.get_referral_stats(session, user_id)
-            if referral_service
-            else {"invited_count": 0, "purchased_count": 0}
-        )
-        support_unread_count = (
-            await support_dal.count_user_unread(session, user_id)
-            if settings.SUPPORT_TICKETS_ENABLED
-            else 0
-        )
-        local_sub = (
-            await subscription_dal.get_active_subscription_by_user_id(
-                session,
-                user_id,
-                db_user.panel_user_uuid,
-            )
-            if db_user.panel_user_uuid
-            else None
-        )
-        trial_available = bool(
-            settings.TRIAL_ENABLED
-            and settings.TRIAL_DURATION_DAYS > 0
-            and not await subscription_service.has_had_any_subscription(session, user_id)
-        )
-        avatar = await _ensure_cached_telegram_avatar(request, session, db_user)
-        try:
-            await session.commit()
-        except Exception:
-            await session.rollback()
-
-    lang = _normalize_language(db_user.language_code or settings.DEFAULT_LANGUAGE)
-    admin_ids = {int(x) for x in (settings.ADMIN_IDS or [])}
-    is_admin = bool(db_user.telegram_id and int(db_user.telegram_id) in admin_ids)
-    return {
-        "user": {
-            "id": user_id,
-            "username": db_user.username,
-            "email": db_user.email,
-            "email_verified": bool(db_user.email_verified_at),
-            "password_auth_enabled": bool(
-                db_user.email and db_user.email_verified_at and db_user.password_hash
-            ),
-            "telegram_id": db_user.telegram_id,
-            "telegram_linked": bool(_telegram_id_for_user(db_user)),
-            "telegram_photo_url": _telegram_avatar_url(avatar),
-            "first_name": db_user.first_name,
-            "language_code": lang,
-            "is_admin": is_admin,
-        },
-        "subscription": _serialize_subscription(settings, active, local_sub, lang),
-        "referral": {
-            "code": referral_code,
-            "bot_link": referral_link,
-            "webapp_link": webapp_referral_link,
-            "invited_count": referral_stats.get("invited_count", 0),
-            "purchased_count": referral_stats.get("purchased_count", 0),
-            "welcome_bonus_days": max(
-                0, int(getattr(settings, "REFERRAL_WELCOME_BONUS_DAYS", 0) or 0)
-            ),
-            "one_bonus_per_referee": bool(
-                getattr(settings, "REFERRAL_ONE_BONUS_PER_REFEREE", False)
-            ),
-            "bonus_details": _serialize_referral_bonus_details(settings, lang),
-        },
-        "plans": _serialize_plans(
-            settings,
-            lang,
-            subscription_options=cached["subscription_options"],
-            stars_subscription_options=cached["stars_subscription_options"],
-            traffic_packages=cached["traffic_packages"],
-            stars_traffic_packages=cached["stars_traffic_packages"],
-        ),
-        "payment_methods": _serialize_payment_methods(settings, request.app, lang),
-        "themes_catalog": public_themes_catalog_payload(
-            settings.webapp_themes_catalog,
-            settings.WEBAPP_PRIMARY_COLOR or "#00fe7a",
-            enabled_only=True,
-        ),
-        "support_unread_count": int(support_unread_count or 0),
-        "settings": {
-            "support_url": settings.SUPPORT_LINK,
-            "support_tickets_enabled": bool(settings.SUPPORT_TICKETS_ENABLED),
-            "support_ticket_max_body_length": int(settings.SUPPORT_TICKET_MAX_BODY_LENGTH or 4000),
-            "support_ticket_max_subject_length": int(
-                settings.SUPPORT_TICKET_MAX_SUBJECT_LENGTH or 160
-            ),
-            "traffic_mode": bool(settings.traffic_sale_mode),
-            "my_devices_enabled": bool(settings.MY_DEVICES_SECTION_ENABLED),
-            "user_hwid_device_limit": (
-                int(settings.USER_HWID_DEVICE_LIMIT)
-                if settings.USER_HWID_DEVICE_LIMIT is not None
-                else None
-            ),
-            "trial_enabled": bool(settings.TRIAL_ENABLED),
-            "trial_available": trial_available,
-            "trial_duration_days": int(settings.TRIAL_DURATION_DAYS or 0),
-            "trial_traffic_limit_gb": float(settings.TRIAL_TRAFFIC_LIMIT_GB or 0),
-            "trial_traffic_strategy": getattr(settings, "TRIAL_TRAFFIC_STRATEGY", "NO_RESET"),
-            "subscription_purchase_description": settings.subscription_purchase_description(lang),
-            "email_auth_enabled": settings.email_auth_configured,
-        },
-    }
-
-
-def _serialize_referral_bonus_details(settings: Settings, lang: str) -> List[Dict[str, Any]]:
-    if getattr(settings, "traffic_sale_mode", False):
-        return []
-
-    details: List[Dict[str, Any]] = []
-    for months, _price in sorted(settings.subscription_options.items()):
-        inviter_days = settings.referral_bonus_inviter.get(months)
-        friend_days = settings.referral_bonus_referee.get(months)
-        if inviter_days is None and friend_days is None:
-            continue
-        details.append(
-            {
-                "months": int(months),
-                "title": _format_months_title(int(months), lang),
-                "inviter_days": int(inviter_days or 0),
-                "friend_days": int(friend_days or 0),
-            }
-        )
-    return details
-
-
-def _build_webapp_referral_link(
-    base_url: Optional[str],
-    referral_code: Optional[str],
-) -> Optional[str]:
-    if not base_url or not referral_code:
-        return None
-    parts = urlsplit(base_url)
-    query = dict(parse_qsl(parts.query, keep_blank_values=True))
-    query["ref"] = f"u{referral_code}"
-    return urlunsplit(
-        (
-            parts.scheme,
-            parts.netloc,
-            parts.path or "/",
-            urlencode(query),
-            parts.fragment,
-        )
-    )
-
-
-def _serialize_subscription(
-    settings: Settings,
-    active: Optional[Dict[str, Any]],
-    local_sub: Optional[Any],
-    lang: str,
-) -> Dict[str, Any]:
-    if not active:
-        return {
-            "active": False,
-            "status": "INACTIVE",
-            "remaining_text": _format_remaining(0, lang),
-            "days_left": 0,
-            "config_link": None,
-            "connect_url": None,
-        }
-
-    end_date = active.get("end_date")
-    if end_date and end_date.tzinfo is None:
-        end_date = end_date.replace(tzinfo=timezone.utc)
-
-    seconds_left = 0
-    if end_date:
-        seconds_left = max(
-            0,
-            int((end_date - datetime.now(timezone.utc)).total_seconds()),
-        )
-
-    can_topup_regular_traffic = False
-    can_topup_premium_traffic = False
-    can_topup_traffic = False
-    can_topup_devices = False
-    if settings.tariffs_config and active.get("tariff_key"):
-        try:
-            tariff = settings.tariffs_config.require(str(active.get("tariff_key")))
-            packages = settings.tariffs_config.topup_packages_for(tariff)
-            can_topup_regular_traffic = bool(packages and packages.has_any())
-            can_topup_premium_traffic = bool(
-                tariff.premium_squad_uuids
-                and tariff.premium_topup_packages
-                and tariff.premium_topup_packages.has_any()
-            )
-            can_topup_traffic = bool(can_topup_regular_traffic or can_topup_premium_traffic)
-            # max_devices == 0 means unlimited — top-up is pointless in that case.
-            can_topup_devices = bool(
-                tariff.has_hwid_device_packages()
-                and _coerce_int_or_none(active.get("max_devices")) != 0
-            )
-        except Exception:
-            can_topup_regular_traffic = False
-            can_topup_premium_traffic = False
-            can_topup_traffic = False
-            can_topup_devices = False
-
-    return {
-        "active": seconds_left > 0,
-        "status": active.get("status_from_panel") or "UNKNOWN",
-        "end_date": end_date.isoformat() if end_date else None,
-        "end_date_text": end_date.strftime("%d.%m.%Y %H:%M") if end_date else "N/A",
-        "days_left": seconds_left // 86400,
-        "remaining_text": _format_remaining(seconds_left, lang),
-        "config_link": active.get("config_link"),
-        "connect_url": active.get("connect_button_url") or active.get("config_link"),
-        "traffic_limit": _format_bytes(active.get("traffic_limit_bytes"), zero_as_unlimited=True),
-        "traffic_used": _format_bytes(active.get("traffic_used_bytes")),
-        "traffic_limit_bytes": _coerce_int_or_none(active.get("traffic_limit_bytes")),
-        "traffic_used_bytes": _coerce_int_or_none(active.get("traffic_used_bytes")),
-        "tariff_key": active.get("tariff_key"),
-        "tariff_name": active.get("tariff_name"),
-        "tariff_description": active.get("tariff_description"),
-        "premium_title": active.get("premium_title"),
-        "billing_model": active.get("billing_model"),
-        "traffic_limit_strategy": str(active.get("traffic_limit_strategy") or ""),
-        "tier_baseline_bytes": _coerce_int_or_none(active.get("tier_baseline_bytes")),
-        "topup_balance_bytes": _coerce_int_or_none(active.get("topup_balance_bytes")),
-        "premium_limit": _format_bytes(active.get("premium_limit_bytes"), zero_as_unlimited=True),
-        "premium_used": _format_bytes(active.get("premium_used_bytes")),
-        "premium_limit_bytes": _coerce_int_or_none(active.get("premium_limit_bytes")),
-        "premium_used_bytes": _coerce_int_or_none(active.get("premium_used_bytes")),
-        "premium_baseline_bytes": _coerce_int_or_none(active.get("premium_baseline_bytes")),
-        "premium_topup_balance_bytes": _coerce_int_or_none(
-            active.get("premium_topup_balance_bytes")
-        ),
-        "premium_topup_used_bytes": _coerce_int_or_none(active.get("premium_topup_used_bytes")),
-        "premium_bonus_bytes": _coerce_int_or_none(active.get("premium_bonus_bytes")) or 0,
-        "regular_bonus_bytes": _coerce_int_or_none(active.get("regular_bonus_bytes")) or 0,
-        "regular_unlimited_override": bool(active.get("regular_unlimited_override")),
-        "premium_unlimited_override": bool(active.get("premium_unlimited_override")),
-        "premium_is_limited": bool(active.get("premium_is_limited")),
-        "premium_squad_labels": list(active.get("premium_squad_labels") or []),
-        "premium_node_labels": list(active.get("premium_node_labels") or []),
-        "can_topup_traffic": can_topup_traffic,
-        "can_topup_regular_traffic": can_topup_regular_traffic,
-        "can_topup_premium_traffic": can_topup_premium_traffic,
-        "can_topup_devices": can_topup_devices,
-        "period_start_at": active.get("period_start_at").isoformat()
-        if active.get("period_start_at")
-        else None,
-        "is_throttled": bool(active.get("is_throttled")),
-        "max_devices": _coerce_int_or_none(active.get("max_devices")),
-        "base_hwid_device_limit": _coerce_int_or_none(active.get("base_hwid_device_limit")),
-        "extra_hwid_devices": _coerce_int_or_none(active.get("extra_hwid_devices")) or 0,
-        "auto_renew_enabled": bool(getattr(local_sub, "auto_renew_enabled", False)),
-        "provider": getattr(local_sub, "provider", None),
-    }
-
-
-def _serialize_plans(
-    settings: Settings,
-    lang: str,
-    *,
-    subscription_options: Optional[Dict[int, float]] = None,
-    stars_subscription_options: Optional[Dict[int, int]] = None,
-    traffic_packages: Optional[Dict[float, float]] = None,
-    stars_traffic_packages: Optional[Dict[float, int]] = None,
-) -> List[Dict[str, Any]]:
-    tariffs_config = settings.tariffs_config
-    if tariffs_config:
-        plans: List[Dict[str, Any]] = []
-        for tariff in tariffs_config.enabled_tariffs:
-            common = {
-                "tariff_key": tariff.key,
-                "tariff_name": tariff.name(lang),
-                "billing_model": tariff.billing_model,
-                "description": tariff.description(lang),
-                "squad_uuids": tariff.squad_uuids,
-                "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-                "hwid_device_limit": tariff.hwid_device_limit,
-                "hwid_device_packages": _serialize_hwid_device_packages(
-                    settings,
-                    tariff,
-                    tariff.hwid_device_packages,
-                    lang,
-                ),
-            }
-            if tariff.billing_model == "period":
-                for months in sorted(tariff.enabled_periods):
-                    price = tariff.period_price(int(months), "rub")
-                    stars_price = tariff.period_price(int(months), "stars")
-                    if price is None and (stars_price is None or int(stars_price) <= 0):
-                        continue
-                    plan = {
-                        **common,
-                        "id": f"{tariff.key}:period:{int(months)}",
-                        "sale_mode": "subscription",
-                        "months": int(months),
-                        "price": float(price or 0),
-                        "title": tariff.name(lang),
-                        "subtitle": _format_months_title(int(months), lang),
-                        "monthly_gb": tariff.monthly_gb,
-                    }
-                    if stars_price is not None and int(stars_price) > 0:
-                        plan["stars_price"] = int(stars_price)
-                    plans.append(plan)
-            else:
-                rub_packages = {
-                    float(package.gb): float(package.price)
-                    for package in (tariff.traffic_packages.rub if tariff.traffic_packages else [])
-                }
-                stars_packages = {
-                    float(package.gb): int(float(package.price))
-                    for package in (
-                        tariff.traffic_packages.stars if tariff.traffic_packages else []
-                    )
-                }
-                for traffic_gb in sorted(set(rub_packages) | set(stars_packages)):
-                    price = rub_packages.get(traffic_gb)
-                    stars_price = stars_packages.get(traffic_gb)
-                    if price is None and (stars_price is None or int(stars_price) <= 0):
-                        continue
-                    traffic_value = float(traffic_gb)
-                    plan = {
-                        **common,
-                        "id": f"{tariff.key}:traffic:{_format_number_for_payload(traffic_value)}",
-                        "sale_mode": "traffic_package",
-                        "months": int(traffic_value)
-                        if traffic_value.is_integer()
-                        else traffic_value,
-                        "traffic_gb": traffic_value,
-                        "price": float(price or 0),
-                        "title": tariff.name(lang),
-                        "subtitle": _format_traffic_title(traffic_value, lang),
-                    }
-                    if stars_price is not None and int(stars_price) > 0:
-                        plan["stars_price"] = int(stars_price)
-                    plans.append(plan)
-        return plans
-
-    if getattr(settings, "traffic_sale_mode", False):
-        active_traffic_packages = traffic_packages or settings.traffic_packages
-        active_stars_traffic_packages = stars_traffic_packages or settings.stars_traffic_packages
-        traffic_units = sorted(set(active_traffic_packages) | set(active_stars_traffic_packages))
-        plans: List[Dict[str, Any]] = []
-        for traffic_gb in traffic_units:
-            price = active_traffic_packages.get(traffic_gb)
-            stars_price = active_stars_traffic_packages.get(traffic_gb)
-            if price is None and (stars_price is None or int(stars_price) <= 0):
-                continue
-            traffic_value = float(traffic_gb)
-            plan = {
-                "months": int(traffic_value) if traffic_value.is_integer() else traffic_value,
-                "traffic_gb": traffic_value,
-                "price": float(price or 0),
-                "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-                "title": _format_traffic_title(traffic_value, lang),
-                "sale_mode": "traffic",
-            }
-            if stars_price is not None and int(stars_price) > 0:
-                plan["stars_price"] = int(stars_price)
-            plans.append(plan)
-        return plans
-
-    active_subscription_options = subscription_options or settings.subscription_options
-    active_stars_subscription_options = (
-        stars_subscription_options or settings.stars_subscription_options
-    )
-    plans: List[Dict[str, Any]] = []
-    for months in sorted(set(active_subscription_options) | set(active_stars_subscription_options)):
-        price = active_subscription_options.get(months)
-        stars_price = active_stars_subscription_options.get(months)
-        if price is None and (stars_price is None or int(stars_price) <= 0):
-            continue
-        plan = {
-            "months": int(months),
-            "price": float(price or 0),
-            "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-            "title": _format_months_title(int(months), lang),
-            "sale_mode": "subscription",
-        }
-        if stars_price is not None and int(stars_price) > 0:
-            plan["stars_price"] = int(stars_price)
-        plans.append(plan)
-    return plans
-
-
-def _traffic_percent(used: Optional[int], limit: Optional[int]) -> int:
-    used_val = int(used or 0)
-    limit_val = int(limit or 0)
-    if limit_val <= 0:
-        return 0
-    return max(0, min(100, round((used_val / limit_val) * 100)))
-
-
-def _serialize_topup_packages(
-    settings: Settings,
-    tariff: Any,
-    packages: Optional[Any],
-    lang: str,
-    *,
-    sale_mode: str = "topup",
-    title_prefix: str = "",
-) -> List[Dict[str, Any]]:
-    rub_packages = {
-        float(package.gb): float(package.price) for package in (packages.rub if packages else [])
-    }
-    stars_packages = {
-        float(package.gb): int(float(package.price))
-        for package in (packages.stars if packages else [])
-    }
-    plans: List[Dict[str, Any]] = []
-    for traffic_gb in sorted(set(rub_packages) | set(stars_packages)):
-        price = rub_packages.get(traffic_gb)
-        stars_price = stars_packages.get(traffic_gb)
-        if price is None and (stars_price is None or int(stars_price) <= 0):
-            continue
-        traffic_value = float(traffic_gb)
-        plan: Dict[str, Any] = {
-            "id": f"{tariff.key}:{sale_mode}:{_format_number_for_payload(traffic_value)}",
-            "tariff_key": tariff.key,
-            "tariff_name": tariff.name(lang),
-            "billing_model": tariff.billing_model,
-            "sale_mode": sale_mode,
-            "months": int(traffic_value) if traffic_value.is_integer() else traffic_value,
-            "traffic_gb": traffic_value,
-            "price": float(price or 0),
-            "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-            "title": f"{title_prefix}{_format_traffic_title(traffic_value, lang)}",
-            "subtitle": tariff.premium_name(lang)
-            if sale_mode == "premium_topup"
-            else tariff.name(lang),
-        }
-        if stars_price is not None and int(stars_price) > 0:
-            plan["stars_price"] = int(stars_price)
-        plans.append(plan)
-    return plans
-
-
-def _serialize_hwid_device_packages(
-    settings: Settings,
-    tariff: Any,
-    packages: Optional[Any],
-    lang: str,
-) -> List[Dict[str, Any]]:
-    rub_packages = {
-        int(package.count): float(package.price) for package in (packages.rub if packages else [])
-    }
-    stars_packages = {
-        int(package.count): int(float(package.price))
-        for package in (packages.stars if packages else [])
-    }
-    plans: List[Dict[str, Any]] = []
-    for count in sorted(set(rub_packages) | set(stars_packages)):
-        price = rub_packages.get(count)
-        stars_price = stars_packages.get(count)
-        if price is None and (stars_price is None or int(stars_price) <= 0):
-            continue
-        plan: Dict[str, Any] = {
-            "id": f"{tariff.key}:hwid:{count}",
-            "tariff_key": tariff.key,
-            "tariff_name": tariff.name(lang),
-            "billing_model": tariff.billing_model,
-            "sale_mode": "hwid_devices",
-            "months": int(count),
-            "device_count": int(count),
-            "price": float(price or 0),
-            "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-            "title": f"+{count}",
-            "subtitle": tariff.name(lang),
-        }
-        if stars_price is not None and int(stars_price) > 0:
-            plan["stars_price"] = int(stars_price)
-        plans.append(plan)
-    return plans
-
-
-def _serialize_tariff_change_target(
-    settings: Settings,
-    config: Any,
-    tariff: Any,
-    options: Dict[str, Any],
-    lang: str,
-) -> Dict[str, Any]:
-    actions: List[Dict[str, Any]] = []
-    mode = str(options.get("mode") or "")
-    if mode == "period_to_period":
-        actions.append(
-            {
-                "mode": "recalc_days",
-                "kind": "free",
-                "title": "recalc_days",
-                "days_after": int(options.get("recalc_days") or 0),
-                "remaining_days": int(options.get("remaining_days") or 0),
-            }
-        )
-        paid_diff = float(options.get("paid_diff_rub") or 0)
-        if paid_diff > 0:
-            actions.append(
-                {
-                    "mode": "paid_diff",
-                    "kind": "payment",
-                    "title": "paid_diff",
-                    "price": paid_diff,
-                    "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-                }
-            )
-    elif mode == "period_to_traffic":
-        actions.append(
-            {
-                "mode": "convert_days_to_gb",
-                "kind": "free",
-                "title": "convert_days_to_gb",
-                "converted_gb": float(options.get("converted_gb") or 0),
-                "remaining_days": int(options.get("remaining_days") or 0),
-            }
-        )
-        actions.extend(
-            {
-                "mode": "buy_package",
-                "kind": "payment",
-                "title": f"+{package.gb:g} GB",
-                "traffic_gb": float(package.gb),
-                "price": float(package.price),
-                "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-            }
-            for package in (tariff.traffic_packages.rub if tariff.traffic_packages else [])
-        )
-    else:
-        for months in tariff.enabled_periods:
-            price = tariff.period_price(int(months), "rub")
-            if price:
-                actions.append(
-                    {
-                        "mode": "buy_period",
-                        "kind": "payment",
-                        "months": int(months),
-                        "title": _format_months_title(int(months), lang),
-                        "price": float(price),
-                        "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
-                    }
-                )
-    return {
-        "tariff_key": tariff.key,
-        "title": tariff.name(lang),
-        "description": tariff.description(lang),
-        "billing_model": tariff.billing_model,
-        "monthly_gb": tariff.monthly_gb,
-        "options": options,
-        "actions": actions,
-    }
-
-
-def _serialize_payment_methods(
-    settings: Settings,
-    app: web.Application,
-    lang: str = "ru",
-) -> List[Dict[str, Any]]:
-    from bot.payment_providers import get_provider_spec, resolve_provider_presentation
-
-    methods: List[Dict[str, Any]] = []
-    for method in settings.payment_methods_order:
-        method = method.lower()
-        spec = get_provider_spec(method)
-        if spec and spec.is_visible(settings, app):
-            presentation = resolve_provider_presentation(spec, settings, language=lang)
-            methods.append(
-                {
-                    "id": method,
-                    "name": presentation.webapp_label,
-                    "icon": presentation.webapp_icon,
-                }
-            )
-    return methods
-
-
-def _service_configured(app: web.Application, key: str) -> bool:
-    service = app.get(key)
-    return bool(service and getattr(service, "configured", False))

backend/bot/app/web/webapp/support.py

@@ -1,152 +0,0 @@
-# ruff: noqa: F401,F403,F405,I001
-from ._runtime import *  # noqa: F403,F405
-
-from bot.services.support_service import TicketForbidden, TicketNotFound, TicketRateLimited
-from db.dal import support_dal, user_dal
-from db.models import SupportTicket, SupportTicketMessage
-
-
-def _support_ticket_payload(ticket: SupportTicket) -> Dict[str, Any]:
-    return {
-        "ticket_id": ticket.ticket_id,
-        "user_id": ticket.user_id,
-        "subject": ticket.subject,
-        "category": ticket.category,
-        "priority": ticket.priority,
-        "status": ticket.status,
-        "assigned_admin_id": ticket.assigned_admin_id,
-        "last_message_at": ticket.last_message_at.isoformat() if ticket.last_message_at else None,
-        "last_message_role": ticket.last_message_role,
-        "unread_user_count": int(ticket.unread_user_count or 0),
-        "unread_admin_count": int(ticket.unread_admin_count or 0),
-        "created_at": ticket.created_at.isoformat() if ticket.created_at else None,
-        "updated_at": ticket.updated_at.isoformat() if ticket.updated_at else None,
-        "closed_at": ticket.closed_at.isoformat() if ticket.closed_at else None,
-    }
-
-
-def _support_message_payload(message: SupportTicketMessage) -> Dict[str, Any]:
-    return {
-        "message_id": message.message_id,
-        "ticket_id": message.ticket_id,
-        "author_role": message.author_role,
-        "author_user_id": message.author_user_id,
-        "body": message.body,
-        "is_internal_note": bool(message.is_internal_note),
-        "created_at": message.created_at.isoformat() if message.created_at else None,
-        "read_by_user_at": message.read_by_user_at.isoformat() if message.read_by_user_at else None,
-        "read_by_admin_at": message.read_by_admin_at.isoformat()
-        if message.read_by_admin_at
-        else None,
-    }
-
-
-def _support_limit_offset(request: web.Request) -> tuple[int, int]:
-    limit = max(1, min(100, int(request.query.get("limit", 25) or 25)))
-    offset = max(0, int(request.query.get("offset", 0) or 0))
-    return limit, offset
-
-
-async def support_tickets_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    limit, offset = _support_limit_offset(request)
-    status_filter = request.query.get("status") or None
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        tickets = await support_dal.list_user_tickets(
-            session,
-            user_id,
-            limit=limit,
-            offset=offset,
-            status_filter=status_filter,
-        )
-        counts = await support_dal.user_ticket_counts(session, user_id)
-    return web.json_response(
-        {
-            "ok": True,
-            "tickets": [_support_ticket_payload(t) for t in tickets],
-            "counts": counts,
-        }
-    )
-
-
-async def support_create_ticket_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    payload, error = _validate_model_payload(CreateTicketPayload, await _read_json(request))
-    if error:
-        return error
-    service = request.app["support_service"]
-    try:
-        ticket = await service.create_ticket(
-            user_id,
-            payload.subject,
-            payload.category,
-            payload.priority,
-            payload.body,
-        )
-    except TicketForbidden:
-        return _json_error(403, "ticket_forbidden", "Support ticket action is forbidden")
-    except TicketRateLimited:
-        return _json_error(429, "ticket_rate_limited", "Too many support tickets")
-    return web.json_response({"ok": True, "ticket": _support_ticket_payload(ticket)})
-
-
-async def support_ticket_detail_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        ticket, messages = await support_dal.get_ticket(session, ticket_id, include_internal=False)
-        if not ticket or ticket.user_id != user_id:
-            return _json_error(404, "not_found", "Ticket not found")
-    return web.json_response(
-        {
-            "ok": True,
-            "ticket": _support_ticket_payload(ticket),
-            "messages": [_support_message_payload(m) for m in messages],
-        }
-    )
-
-
-async def support_ticket_reply_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    payload, error = _validate_model_payload(TicketReplyPayload, await _read_json(request))
-    if error:
-        return error
-    service = request.app["support_service"]
-    try:
-        ticket, message = await service.reply_as_user(user_id, ticket_id, payload.body)
-    except TicketForbidden:
-        return _json_error(403, "ticket_forbidden", "Support ticket action is forbidden")
-    except TicketNotFound:
-        return _json_error(404, "not_found", "Ticket not found")
-    return web.json_response(
-        {
-            "ok": True,
-            "ticket": _support_ticket_payload(ticket),
-            "message": _support_message_payload(message),
-        }
-    )
-
-
-async def support_ticket_read_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    ticket_id = int(request.match_info["id"])
-    service = request.app["support_service"]
-    try:
-        await service.mark_read_as_user(user_id, ticket_id)
-    except TicketNotFound:
-        return _json_error(404, "not_found", "Ticket not found")
-    return web.json_response({"ok": True})
-
-
-async def support_unread_route(request: web.Request) -> web.Response:
-    user_id = _require_user_id(request)
-    async_session_factory: sessionmaker = request.app["async_session_factory"]
-    async with async_session_factory() as session:
-        user = await user_dal.get_user_by_id(session, user_id)
-        if user and user.is_banned:
-            return _json_error(403, "ticket_forbidden", "Support ticket action is forbidden")
-        unread = await support_dal.count_user_unread(session, user_id)
-    return web.json_response({"ok": True, "unread": unread})

backend/bot/app/web/webapp_auth.py

@@ -1,362 +0,0 @@
-import asyncio
-import base64
-import hashlib
-import hmac
-import json
-import logging
-import secrets
-import time
-from typing import Any, Dict, Optional
-from urllib.parse import parse_qsl
-
-from config.settings import Settings
-
-logger = logging.getLogger(__name__)
-
-# 5 minutes clock skew tolerance for Telegram clients
-TELEGRAM_CLOCK_SKEW_SECONDS = 300
-TELEGRAM_OAUTH_ISSUER = "https://oauth.telegram.org"
-TELEGRAM_OAUTH_JWKS_URL = "https://oauth.telegram.org/.well-known/jwks.json"
-TELEGRAM_OAUTH_ALGORITHMS = ["RS256", "ES256", "EdDSA"]
-
-
-def _urlsafe_b64encode(raw: bytes) -> str:
-    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
-
-
-def _urlsafe_b64decode(raw: str) -> bytes:
-    padded = raw + ("=" * (-len(raw) % 4))
-    return base64.urlsafe_b64decode(padded.encode("ascii"))
-
-
-def _session_secret(settings: Settings) -> bytes:
-    return hmac.new(
-        settings.WEBAPP_SESSION_SECRET.encode("utf-8"),
-        b"remnawave-tg-shop-webapp-session",
-        hashlib.sha256,
-    ).digest()
-
-
-def create_webapp_session_token(settings: Settings, user_id: int) -> str:
-    now = int(time.time())
-    payload = {
-        "sub": int(user_id),
-        "iat": now,
-        "exp": now + max(60, int(settings.WEBAPP_SESSION_TTL_SECONDS)),
-    }
-    payload_part = _urlsafe_b64encode(json.dumps(payload, separators=(",", ":")).encode("utf-8"))
-    signature = hmac.new(
-        _session_secret(settings),
-        payload_part.encode("ascii"),
-        hashlib.sha256,
-    ).digest()
-    return f"{payload_part}.{_urlsafe_b64encode(signature)}"
-
-
-def verify_webapp_session_token(settings: Settings, token: str) -> Optional[int]:
-    if not token or "." not in token:
-        return None
-
-    try:
-        payload_part, signature_part = token.split(".", 1)
-        expected_signature = hmac.new(
-            _session_secret(settings),
-            payload_part.encode("ascii"),
-            hashlib.sha256,
-        ).digest()
-        received_signature = _urlsafe_b64decode(signature_part)
-        if not hmac.compare_digest(expected_signature, received_signature):
-            return None
-
-        payload = json.loads(_urlsafe_b64decode(payload_part).decode("utf-8"))
-        if int(payload.get("exp", 0)) < int(time.time()):
-            return None
-        return int(payload["sub"])
-    except Exception as exc:
-        logger.debug("Failed to verify webapp session token: %s", exc)
-        return None
-
-
-def create_telegram_oauth_nonce(settings: Settings, *, ttl_seconds: int = 600) -> str:
-    now = int(time.time())
-    payload = {
-        "n": secrets.token_urlsafe(24),
-        "iat": now,
-        "exp": now + max(60, int(ttl_seconds)),
-    }
-    payload_part = _urlsafe_b64encode(json.dumps(payload, separators=(",", ":")).encode("utf-8"))
-    signature = hmac.new(
-        _session_secret(settings),
-        f"telegram-oauth-nonce.{payload_part}".encode("ascii"),
-        hashlib.sha256,
-    ).digest()
-    return f"{payload_part}.{_urlsafe_b64encode(signature)}"
-
-
-def verify_telegram_oauth_nonce(settings: Settings, nonce: str) -> bool:
-    if not nonce or "." not in nonce:
-        return False
-
-    try:
-        payload_part, signature_part = nonce.split(".", 1)
-        expected_signature = hmac.new(
-            _session_secret(settings),
-            f"telegram-oauth-nonce.{payload_part}".encode("ascii"),
-            hashlib.sha256,
-        ).digest()
-        received_signature = _urlsafe_b64decode(signature_part)
-        if not hmac.compare_digest(expected_signature, received_signature):
-            return False
-
-        payload = json.loads(_urlsafe_b64decode(payload_part).decode("utf-8"))
-        now = int(time.time())
-        if int(payload.get("exp", 0)) < now:
-            return False
-        if int(payload.get("iat", 0)) > now + TELEGRAM_CLOCK_SKEW_SECONDS:
-            return False
-        return bool(payload.get("n"))
-    except Exception as exc:
-        logger.debug("Failed to verify Telegram OAuth nonce: %s", exc)
-        return False
-
-
-def create_signed_telegram_oauth_state(
-    settings: Settings,
-    payload: Dict[str, Any],
-    *,
-    ttl_seconds: int = 600,
-) -> str:
-    now = int(time.time())
-    state_payload = {
-        **payload,
-        "iat": now,
-        "exp": now + max(60, int(ttl_seconds)),
-    }
-    payload_part = _urlsafe_b64encode(
-        json.dumps(state_payload, separators=(",", ":")).encode("utf-8")
-    )
-    signature = hmac.new(
-        _session_secret(settings),
-        f"telegram-oauth-state.{payload_part}".encode("ascii"),
-        hashlib.sha256,
-    ).digest()
-    return f"{payload_part}.{_urlsafe_b64encode(signature)}"
-
-
-def verify_signed_telegram_oauth_state(
-    settings: Settings,
-    state: str,
-) -> Optional[Dict[str, Any]]:
-    if not state or "." not in state:
-        return None
-
-    try:
-        payload_part, signature_part = state.split(".", 1)
-        expected_signature = hmac.new(
-            _session_secret(settings),
-            f"telegram-oauth-state.{payload_part}".encode("ascii"),
-            hashlib.sha256,
-        ).digest()
-        received_signature = _urlsafe_b64decode(signature_part)
-        if not hmac.compare_digest(expected_signature, received_signature):
-            return None
-
-        payload = json.loads(_urlsafe_b64decode(payload_part).decode("utf-8"))
-        now = int(time.time())
-        if int(payload.get("exp", 0)) < now:
-            return None
-        if int(payload.get("iat", 0)) > now + TELEGRAM_CLOCK_SKEW_SECONDS:
-            return None
-        return payload
-    except Exception as exc:
-        logger.debug("Failed to verify Telegram OAuth state: %s", exc)
-        return None
-
-
-async def validate_telegram_oauth_id_token(
-    id_token: str,
-    *,
-    client_id: int,
-    expected_nonce: str,
-    max_age_seconds: int,
-) -> Optional[Dict[str, Any]]:
-    """Validate Telegram OIDC ID token and return a Telegram-like user payload."""
-
-    if not id_token or not client_id or not expected_nonce:
-        return None
-
-    try:
-        import jwt
-        from jwt import PyJWKClient
-    except Exception as exc:
-        logger.error(
-            "PyJWT is not installed; Telegram OAuth ID token validation is unavailable: %s",
-            exc,
-        )
-        return None
-
-    try:
-        jwks_client = PyJWKClient(TELEGRAM_OAUTH_JWKS_URL)
-        signing_key = await asyncio.to_thread(
-            jwks_client.get_signing_key_from_jwt,
-            id_token,
-        )
-        claims = await asyncio.to_thread(
-            jwt.decode,
-            id_token,
-            signing_key.key,
-            algorithms=TELEGRAM_OAUTH_ALGORITHMS,
-            audience=str(client_id),
-            issuer=TELEGRAM_OAUTH_ISSUER,
-            leeway=TELEGRAM_CLOCK_SKEW_SECONDS,
-            options={"require": ["exp", "iat", "iss", "aud"]},
-        )
-
-        if not hmac.compare_digest(str(claims.get("nonce") or ""), expected_nonce):
-            logger.warning("Telegram OAuth nonce mismatch.")
-            return None
-
-        now = int(time.time())
-        issued_at = int(claims.get("iat") or 0)
-        max_age = max(60, int(max_age_seconds))
-        if issued_at > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - issued_at > max_age:
-            logger.warning("Telegram OAuth ID token is stale.")
-            return None
-
-        telegram_id_raw = claims.get("id")
-        if not telegram_id_raw:
-            return None
-        telegram_id = int(telegram_id_raw)
-
-        full_name = str(claims.get("name") or "").strip()
-        first_name = str(claims.get("given_name") or "").strip()
-        last_name = str(claims.get("family_name") or "").strip()
-        if full_name and not first_name:
-            name_parts = full_name.split(None, 1)
-            first_name = name_parts[0]
-            if len(name_parts) > 1 and not last_name:
-                last_name = name_parts[1]
-
-        return {
-            "id": telegram_id,
-            "username": claims.get("preferred_username") or claims.get("username"),
-            "first_name": first_name or full_name or "Telegram",
-            "last_name": last_name,
-            "photo_url": claims.get("picture"),
-            "language_code": claims.get("locale"),
-        }
-    except Exception as exc:
-        logger.warning("Failed to validate Telegram OAuth ID token: %s", exc)
-        return None
-
-
-def validate_telegram_webapp_init_data(
-    init_data: str,
-    bot_token: str,
-    *,
-    max_age_seconds: int,
-) -> Optional[Dict[str, Any]]:
-    """Validate Telegram Mini App initData and return the trusted user payload."""
-
-    try:
-        parsed_data = dict(parse_qsl(init_data or "", keep_blank_values=True))
-        received_hash = parsed_data.pop("hash", None)
-        if not received_hash:
-            return None
-
-        data_check_string = "\n".join(
-            f"{key}={value}" for key, value in sorted(parsed_data.items())
-        )
-        secret_key = hmac.new(
-            b"WebAppData",
-            bot_token.encode("utf-8"),
-            hashlib.sha256,
-        ).digest()
-        calculated_hash = hmac.new(
-            secret_key,
-            data_check_string.encode("utf-8"),
-            hashlib.sha256,
-        ).hexdigest()
-        if not hmac.compare_digest(calculated_hash, received_hash):
-            logger.warning("Telegram WebApp initData hash mismatch.")
-            return None
-
-        auth_date_raw = parsed_data.get("auth_date")
-        if auth_date_raw:
-            auth_date = int(auth_date_raw)
-            now = int(time.time())
-            max_age = max(60, int(max_age_seconds))
-            if auth_date > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - auth_date > max_age:
-                logger.warning("Telegram WebApp initData auth_date is stale.")
-                return None
-
-        user_json = parsed_data.get("user")
-        if not user_json:
-            return None
-        user_data = json.loads(user_json)
-        if not user_data.get("id"):
-            return None
-        if parsed_data.get("start_param"):
-            user_data["start_param"] = parsed_data.get("start_param")
-        return user_data
-    except Exception as exc:
-        logger.warning("Failed to validate Telegram WebApp initData: %s", exc)
-        return None
-
-
-def validate_telegram_login_widget_data(
-    auth_data: Any,
-    bot_token: str,
-    *,
-    max_age_seconds: int,
-) -> Optional[Dict[str, Any]]:
-    """Validate Telegram Login Widget data and return the trusted user payload."""
-
-    try:
-        if isinstance(auth_data, str):
-            parsed_data = dict(parse_qsl(auth_data or "", keep_blank_values=True))
-        elif isinstance(auth_data, dict):
-            parsed_data = {
-                str(key): str(value) for key, value in auth_data.items() if value is not None
-            }
-        else:
-            return None
-
-        received_hash = str(parsed_data.pop("hash", "") or "")
-        if not received_hash:
-            return None
-
-        data_check_string = "\n".join(
-            f"{key}={value}" for key, value in sorted(parsed_data.items())
-        )
-        secret_key = hashlib.sha256(bot_token.encode("utf-8")).digest()
-        calculated_hash = hmac.new(
-            secret_key,
-            data_check_string.encode("utf-8"),
-            hashlib.sha256,
-        ).hexdigest()
-        if not hmac.compare_digest(calculated_hash, received_hash):
-            logger.warning("Telegram Login Widget hash mismatch.")
-            return None
-
-        auth_date_raw = parsed_data.get("auth_date")
-        if auth_date_raw:
-            auth_date = int(auth_date_raw)
-            now = int(time.time())
-            max_age = max(60, int(max_age_seconds))
-            if auth_date > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - auth_date > max_age:
-                logger.warning("Telegram Login Widget auth_date is stale.")
-                return None
-
-        user_id_raw = parsed_data.get("id")
-        if not user_id_raw:
-            return None
-        int(user_id_raw)
-
-        if not parsed_data.get("first_name"):
-            return None
-
-        return parsed_data
-    except Exception as exc:
-        logger.warning("Failed to validate Telegram Login Widget data: %s", exc)
-        return None

backend/bot/handlers/admin/promo/create.py

@@ -1,412 +0,0 @@
-import logging
-from datetime import datetime, timedelta, timezone
-from typing import Optional
-
-from aiogram import F, Router, types
-from aiogram.filters import StateFilter
-from aiogram.fsm.context import FSMContext
-from aiogram.utils.keyboard import InlineKeyboardBuilder, InlineKeyboardButton
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from bot.keyboards.inline.admin_keyboards import (
-    get_admin_panel_keyboard,
-    get_back_to_admin_panel_keyboard,
-)
-from bot.middlewares.i18n import JsonI18n
-from bot.states.admin_states import AdminStates
-from config.settings import Settings
-from db.dal import promo_code_dal
-
-router = Router(name="promo_create_router")
-
-
-async def create_promo_prompt_handler(
-    callback: types.CallbackQuery,
-    state: FSMContext,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n or not callback.message:
-        await callback.answer("Error preparing promo creation.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    # Step 1: Ask for promo code
-    prompt_text = _("admin_promo_step1_code")
-
-    try:
-        await callback.message.edit_text(
-            prompt_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-    except Exception as e:
-        logging.warning(f"Could not edit message for promo prompt: {e}. Sending new.")
-        await callback.message.answer(
-            prompt_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-    await callback.answer()
-    await state.set_state(AdminStates.waiting_for_promo_code)
-
-
-# Step 1: Process promo code
-@router.message(AdminStates.waiting_for_promo_code, F.text)
-async def process_promo_code_handler(
-    message: types.Message,
-    state: FSMContext,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        await message.reply("Language service error.")
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    try:
-        code_str = message.text.strip().upper()
-        if not (3 <= len(code_str) <= 30 and code_str.isalnum()):
-            await message.answer(_("admin_promo_invalid_code_format"))
-            return
-
-        # Check if code already exists
-        existing_promo = await promo_code_dal.get_promo_code_by_code(session, code_str)
-        if existing_promo:
-            await message.answer(_("admin_promo_code_already_exists"))
-            return
-
-        await state.update_data(promo_code=code_str)
-
-        # Step 2: Ask for bonus days
-        prompt_text = _("admin_promo_step2_bonus_days", code=code_str)
-
-        await message.answer(
-            prompt_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-        await state.set_state(AdminStates.waiting_for_promo_bonus_days)
-
-    except Exception as e:
-        logging.error(f"Error processing promo code: {e}")
-        await message.answer(_("error_occurred_try_again"))
-
-
-# Step 2: Process bonus days
-@router.message(AdminStates.waiting_for_promo_bonus_days, F.text)
-async def process_promo_bonus_days_handler(
-    message: types.Message, state: FSMContext, i18n_data: dict, settings: Settings
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        await message.reply("Language service error.")
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    try:
-        bonus_days = int(message.text.strip())
-        if not (1 <= bonus_days <= 365):
-            await message.answer(_("admin_promo_invalid_bonus_days"))
-            return
-
-        await state.update_data(bonus_days=bonus_days)
-
-        # Step 3: Ask for max activations
-        data = await state.get_data()
-        prompt_text = _(
-            "admin_promo_step3_max_activations", code=data.get("promo_code"), bonus_days=bonus_days
-        )
-
-        await message.answer(
-            prompt_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-        await state.set_state(AdminStates.waiting_for_promo_max_activations)
-
-    except ValueError:
-        await message.answer(_("admin_promo_invalid_number"))
-    except Exception as e:
-        logging.error(f"Error processing promo bonus days: {e}")
-        await message.answer(_("error_occurred_try_again"))
-
-
-# Step 3: Process max activations
-@router.message(AdminStates.waiting_for_promo_max_activations, F.text)
-async def process_promo_max_activations_handler(
-    message: types.Message, state: FSMContext, i18n_data: dict, settings: Settings
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        await message.reply("Language service error.")
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    try:
-        max_activations = int(message.text.strip())
-        if not (1 <= max_activations <= 10000):
-            await message.answer(_("admin_promo_invalid_max_activations"))
-            return
-
-        await state.update_data(max_activations=max_activations)
-
-        # Step 4: Ask for validity
-        data = await state.get_data()
-        prompt_text = _(
-            "admin_promo_step4_validity",
-            code=data.get("promo_code"),
-            bonus_days=data.get("bonus_days"),
-            max_activations=max_activations,
-        )
-
-        # Create keyboard for validity options
-        builder = InlineKeyboardBuilder()
-        builder.row(
-            InlineKeyboardButton(
-                text=_("admin_promo_unlimited_validity"), callback_data="promo_unlimited_validity"
-            )
-        )
-        builder.row(
-            InlineKeyboardButton(
-                text=_("admin_promo_set_validity_days"), callback_data="promo_set_validity"
-            )
-        )
-        builder.row(
-            InlineKeyboardButton(text=_("admin_back_to_panel"), callback_data="admin_action:main")
-        )
-
-        await message.answer(prompt_text, reply_markup=builder.as_markup(), parse_mode="HTML")
-        await state.set_state(AdminStates.waiting_for_promo_validity_days)
-
-    except ValueError:
-        await message.answer(_("admin_promo_invalid_number"))
-    except Exception as e:
-        logging.error(f"Error processing promo max activations: {e}")
-        await message.answer(_("error_occurred_try_again"))
-
-
-# Step 4: Handle unlimited validity
-@router.callback_query(
-    F.data == "promo_unlimited_validity", StateFilter(AdminStates.waiting_for_promo_validity_days)
-)
-async def process_promo_unlimited_validity(
-    callback: types.CallbackQuery,
-    state: FSMContext,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-):
-    await state.update_data(validity_days=None)
-    await create_promo_code_final(callback, state, i18n_data, settings, session)
-
-
-# Step 4: Handle set validity
-@router.callback_query(
-    F.data == "promo_set_validity", StateFilter(AdminStates.waiting_for_promo_validity_days)
-)
-async def process_promo_set_validity(
-    callback: types.CallbackQuery, state: FSMContext, i18n_data: dict, settings: Settings
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n or not callback.message:
-        await callback.answer("Error processing validity.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    data = await state.get_data()
-    prompt_text = _(
-        "admin_promo_enter_validity_days",
-        code=data.get("promo_code"),
-        bonus_days=data.get("bonus_days"),
-        max_activations=data.get("max_activations"),
-    )
-
-    try:
-        await callback.message.edit_text(
-            prompt_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-    except Exception:
-        await callback.message.answer(
-            prompt_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-    await callback.answer()
-
-
-# Step 4: Process validity days
-@router.message(AdminStates.waiting_for_promo_validity_days, F.text)
-async def process_promo_validity_days_handler(
-    message: types.Message,
-    state: FSMContext,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        await message.reply("Language service error.")
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    try:
-        validity_days = int(message.text.strip())
-        if not (1 <= validity_days <= 365):
-            await message.answer(_("admin_promo_invalid_validity_days"))
-            return
-
-        await state.update_data(validity_days=validity_days)
-        await create_promo_code_final(message, state, i18n_data, settings, session)
-
-    except ValueError:
-        await message.answer(_("admin_promo_invalid_number"))
-    except Exception as e:
-        logging.error(f"Error processing promo validity days: {e}")
-        await message.answer(_("error_occurred_try_again"))
-
-
-async def create_promo_code_final(
-    callback_or_message,
-    state: FSMContext,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-):
-    """Final step - create the promo code in database"""
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    try:
-        data = await state.get_data()
-
-        # Prepare promo code data
-        promo_data = {
-            "code": data["promo_code"],
-            "bonus_days": data["bonus_days"],
-            "max_activations": data["max_activations"],
-            "current_activations": 0,
-            "is_active": True,
-            "created_by_admin_id": callback_or_message.from_user.id,
-            "created_at": datetime.now(timezone.utc),
-        }
-
-        # Set validity
-        if data.get("validity_days"):
-            promo_data["valid_until"] = datetime.now(timezone.utc) + timedelta(
-                days=data["validity_days"]
-            )
-        else:
-            promo_data["valid_until"] = None
-
-        # Create promo code
-        created_promo = await promo_code_dal.create_promo_code(session, promo_data)
-        await session.commit()
-
-        # Log successful creation
-        logging.info(
-            f"Promo code '{data['promo_code']}' created with ID {created_promo.promo_code_id}"
-        )
-
-        # Success message
-        valid_until_str = (
-            _("admin_promo_unlimited")
-            if not data.get("validity_days")
-            else f"{data['validity_days']} дней"
-        )
-        success_text = _(
-            "admin_promo_created_success",
-            code=data["promo_code"],
-            bonus_days=data["bonus_days"],
-            max_activations=data["max_activations"],
-            valid_until_str=valid_until_str,
-        )
-
-        if hasattr(callback_or_message, "message"):  # CallbackQuery
-            try:
-                await callback_or_message.message.edit_text(
-                    success_text,
-                    reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-                    parse_mode="HTML",
-                )
-            except Exception:
-                await callback_or_message.message.answer(
-                    success_text,
-                    reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-                    parse_mode="HTML",
-                )
-            await callback_or_message.answer()
-        else:  # Message
-            await callback_or_message.answer(
-                success_text,
-                reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-                parse_mode="HTML",
-            )
-
-        await state.clear()
-
-    except Exception as e:
-        logging.error(f"Error creating promo code: {e}")
-        error_text = _("error_occurred_try_again")
-
-        if hasattr(callback_or_message, "message"):  # CallbackQuery
-            await callback_or_message.message.answer(error_text)
-            await callback_or_message.answer()
-        else:  # Message
-            await callback_or_message.answer(error_text)
-
-        await state.clear()
-
-
-# Cancel promo creation
-@router.callback_query(
-    F.data == "admin_action:main",
-    StateFilter(
-        AdminStates.waiting_for_promo_code,
-        AdminStates.waiting_for_promo_bonus_days,
-        AdminStates.waiting_for_promo_max_activations,
-        AdminStates.waiting_for_promo_validity_days,
-    ),
-)
-async def cancel_promo_creation_state_to_menu(
-    callback: types.CallbackQuery,
-    state: FSMContext,
-    settings: Settings,
-    i18n_data: dict,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n or not callback.message:
-        await callback.answer("Error cancelling.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    try:
-        await callback.message.edit_text(
-            _(key="admin_panel_title"),
-            reply_markup=get_admin_panel_keyboard(i18n, current_lang, settings),
-        )
-    except Exception:
-        await callback.message.answer(
-            _(key="admin_panel_title"),
-            reply_markup=get_admin_panel_keyboard(i18n, current_lang, settings),
-        )
-
-    await callback.answer(_("admin_promo_creation_cancelled"))
-    await state.clear()

backend/bot/handlers/admin/statistics.py

@@ -1,399 +0,0 @@
-import html
-import logging
-from typing import Dict, List, Optional
-
-from aiogram import Router, types
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from bot.keyboards.inline.admin_keyboards import (
-    get_back_to_admin_panel_keyboard,
-    get_back_to_user_management_keyboard,
-)
-from bot.middlewares.i18n import JsonI18n
-from bot.payment_providers import pending_statuses
-from bot.services.panel_api_service import PanelApiService
-from config.settings import Settings
-from db.dal import panel_sync_dal, payment_dal, user_dal
-from db.models import PanelSyncStatus, Payment
-
-router = Router(name="admin_statistics_router")
-
-
-def _format_rating_user_label(
-    user_row: Dict[str, object], bot_username: Optional[str] = None
-) -> str:
-    user_id = int(user_row.get("user_id", 0) or 0)
-    username = user_row.get("username")
-    first_name = user_row.get("first_name")
-    user_id_text = str(user_id)
-    user_id_html = html.escape(user_id_text)
-
-    if bot_username:
-        safe_bot_username = html.escape(bot_username)
-        user_id_html = (
-            f'<a href="https://t.me/{safe_bot_username}?start=admin_user_{user_id_text}">'
-            f"{user_id_html}</a>"
-        )
-
-    parts: List[str] = []
-    if username:
-        parts.append(f"@{html.escape(str(username))}")
-    elif first_name:
-        parts.append(html.escape(str(first_name)))
-
-    if not parts:
-        parts.append(f"ID {user_id_html}")
-    else:
-        parts.append(f"(ID {user_id_html})")
-
-    return " ".join(parts)
-
-
-async def show_statistics_handler(
-    callback: types.CallbackQuery, i18n_data: dict, settings: Settings, session: AsyncSession
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n or not callback.message:
-        await callback.answer("Error displaying statistics.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    await callback.answer()
-
-    stats_text_parts = [f"<b>{_('admin_stats_header')}</b>"]
-
-    # Enhanced user statistics
-    user_stats = await user_dal.get_enhanced_user_statistics(session)
-
-    stats_text_parts.append(f"\n<b>👥 {_('admin_enhanced_users_stats_header')}</b>")
-    stats_text_parts.append(
-        f"📊 {_('admin_user_stats_total_label')}: <b>{user_stats['total_users']}</b>"
-    )
-    # Removed: Active today moved to panel stats
-    stats_text_parts.append(
-        f"💳 {_('admin_user_stats_paid_subs_label')}: <b>{user_stats['paid_subscriptions']}</b>"
-    )
-    stats_text_parts.append(
-        f"🆓 {_('admin_user_stats_trial_label')}: <b>{user_stats['trial_users']}</b>"
-    )
-    stats_text_parts.append(
-        f"😴 {_('admin_user_stats_inactive_label')}: <b>{user_stats['inactive_users']}</b>"
-    )
-    stats_text_parts.append(
-        f"🚫 {_('admin_user_stats_banned_label')}: <b>{user_stats['banned_users']}</b>"
-    )
-    stats_text_parts.append(
-        f"🎁 {_('admin_user_stats_referral_label')}: <b>{user_stats['referral_users']}</b>"
-    )
-
-    # Panel Statistics - moved above financial
-    stats_text_parts.append(f"\n<b>🖥 {_('admin_panel_stats_header')}</b>")
-
-    try:
-        async with PanelApiService(settings) as panel_service:
-            # Get system stats
-            system_stats = await panel_service.get_system_stats()
-            bandwidth_stats = await panel_service.get_bandwidth_stats()
-            nodes_stats = await panel_service.get_nodes_statistics()
-
-            logging.info(
-                f"Panel stats response: system={system_stats}, bandwidth={bandwidth_stats}, nodes={nodes_stats}"  # noqa: E501
-            )
-
-            if system_stats:
-                users = system_stats.get("users", {})
-                status_counts = users.get("statusCounts", {})
-                online_stats = system_stats.get("onlineStats", {})
-
-                active_users = status_counts.get("ACTIVE", 0)
-                disabled_users = status_counts.get("DISABLED", 0)
-                expired_users = status_counts.get("EXPIRED", 0)
-                limited_users = status_counts.get("LIMITED", 0)
-                total_users = users.get("totalUsers", 0)
-                online_now = online_stats.get("onlineNow", 0)
-
-                stats_text_parts.append(f"🟢 {_('admin_panel_online_label')}: <b>{online_now}</b>")
-                stats_text_parts.append(
-                    f"📊 {_('admin_panel_active_label')}: <b>{active_users}</b>"
-                )
-                stats_text_parts.append(
-                    f"🔴 {_('admin_panel_disabled_label')}: <b>{disabled_users}</b>"
-                )
-                stats_text_parts.append(
-                    f"⏰ {_('admin_panel_expired_label')}: <b>{expired_users}</b>"
-                )
-                stats_text_parts.append(
-                    f"⚠️ {_('admin_panel_limited_label')}: <b>{limited_users}</b>"
-                )
-                stats_text_parts.append(
-                    f"👥 {_('admin_panel_total_users_label')}: <b>{total_users}</b>"
-                )
-
-                # System resources
-                memory = system_stats.get("memory", {})
-                if memory:
-                    memory_total = memory.get("total", 1)
-                    memory_used = memory.get("used", 0)
-                    memory_usage = (memory_used / memory_total) * 100 if memory_total > 0 else 0
-                    stats_text_parts.append(
-                        f"💾 {_('admin_panel_memory_usage_label')}: <b>{memory_usage:.1f}%</b>"
-                    )
-            else:
-                stats_text_parts.append(f"⚠️ {_('admin_panel_system_stats_error')}")
-
-            # Bandwidth stats
-            if bandwidth_stats:
-                week_traffic = bandwidth_stats.get("bandwidthLastSevenDays", {})
-                month_traffic = bandwidth_stats.get("bandwidthLast30Days", {})
-                # Fallback to the actual key name from API if the above doesn't exist
-                if not month_traffic:
-                    month_traffic = bandwidth_stats.get("bandwidthLastThirtyDays", {})
-
-                if week_traffic:
-                    week_total = week_traffic.get("current", "0 B")
-                    stats_text_parts.append(
-                        f"📊 {_('admin_panel_traffic_week_label')}: <b>{week_total}</b>"
-                    )
-
-                if month_traffic:
-                    month_total = month_traffic.get("current", "0 B")
-                    stats_text_parts.append(
-                        f"📊 {_('admin_panel_traffic_month_label')}: <b>{month_total}</b>"
-                    )
-            else:
-                stats_text_parts.append(f"⚠️ {_('admin_panel_bandwidth_stats_error')}")
-
-            # Nodes stats
-            if nodes_stats and "lastSevenDays" in nodes_stats:
-                last_seven_days = nodes_stats.get("lastSevenDays", [])
-                # Get unique node names from the data
-                unique_nodes = set()
-                for node_data in last_seven_days:
-                    unique_nodes.add(node_data.get("nodeName", ""))
-                total_nodes_count = len(unique_nodes)
-                # Assume all nodes are active since we don't have status info
-                stats_text_parts.append(
-                    f"🔗 {_('admin_panel_nodes_label')}: <b>{total_nodes_count}/{total_nodes_count}</b>"  # noqa: E501
-                )
-            else:
-                # Use nodes total from system stats as fallback
-                nodes_info = system_stats.get("nodes", {}) if system_stats else {}
-                total_online = nodes_info.get("totalOnline", 0)
-                stats_text_parts.append(f"🔗 {_('admin_panel_nodes_label')}: <b>{total_online}</b>")
-
-    except Exception as e:
-        logging.error(f"Failed to fetch panel statistics: {e}", exc_info=True)
-        stats_text_parts.append(f"❌ {_('admin_panel_stats_fetch_error')}")
-        stats_text_parts.append(f"⚠️ {_('admin_panel_stats_error_details')}: {str(e)}")
-
-    # Financial statistics
-    financial_stats = await payment_dal.get_financial_statistics(session)
-
-    stats_text_parts.append(f"\n<b>💰 {_('admin_financial_stats_header')}</b>")
-    stats_text_parts.append(
-        f"📅 {_('admin_financial_today_label')}: <b>{financial_stats['today_revenue']:.2f} RUB</b> ({financial_stats['today_payments_count']} {_('admin_financial_payments_label')})"  # noqa: E501
-    )
-    stats_text_parts.append(
-        f"📅 {_('admin_financial_week_label')}: <b>{financial_stats['week_revenue']:.2f} RUB</b>"
-    )
-    stats_text_parts.append(
-        f"📅 {_('admin_financial_month_label')}: <b>{financial_stats['month_revenue']:.2f} RUB</b>"
-    )
-    stats_text_parts.append(
-        f"🏆 {_('admin_financial_all_time_label')}: <b>{financial_stats['all_time_revenue']:.2f} RUB</b>"  # noqa: E501
-    )
-
-    last_payments_models: List[Payment] = await payment_dal.get_recent_payment_logs_with_user(
-        session, limit=5
-    )
-    if last_payments_models:
-        stats_text_parts.append(f"\n<b>{_('admin_stats_recent_payments_header')}</b>")
-        for payment in last_payments_models:
-            status_emoji = (
-                "✅"
-                if payment.status == "succeeded"
-                else "⏳"
-                if payment.status in pending_statuses()
-                else "❌"
-            )
-
-            user_info = f"User {payment.user_id}"
-            if payment.user and payment.user.username:
-                user_info += f" (@{payment.user.username})"
-            elif payment.user and payment.user.first_name:
-                user_info += f" ({payment.user.first_name})"
-
-            payment_date_str = (
-                payment.created_at.strftime("%Y-%m-%d") if payment.created_at else "N/A"
-            )
-
-            stats_text_parts.append(
-                _(
-                    "admin_stats_payment_item",
-                    status_emoji=status_emoji,
-                    amount=payment.amount,
-                    currency=payment.currency,
-                    user_info=user_info,
-                    p_status=payment.status,
-                    p_date=payment_date_str,
-                )
-            )
-    else:
-        stats_text_parts.append(f"\n{_('admin_stats_no_payments_found')}")
-
-    sync_status_model: Optional[PanelSyncStatus] = await panel_sync_dal.get_panel_sync_status(
-        session
-    )
-    if sync_status_model and sync_status_model.status != "never_run":
-        stats_text_parts.append(f"\n<b>{_('admin_stats_last_sync_header')}</b>")
-
-        sync_time_val = sync_status_model.last_sync_time
-        sync_time_str = sync_time_val.strftime("%Y-%m-%d %H:%M:%S UTC") if sync_time_val else "N/A"
-
-        details_val = sync_status_model.details
-        details_str = details_val or "N/A"
-
-        stats_text_parts.append(f"  {_('admin_stats_sync_time')}: {sync_time_str}")
-        stats_text_parts.append(f"  {_('admin_stats_sync_status')}: {sync_status_model.status}")
-        stats_text_parts.append(
-            f"  {_('admin_stats_sync_users_processed')}: {sync_status_model.users_processed_from_panel}"  # noqa: E501
-        )
-        stats_text_parts.append(
-            f"  {_('admin_stats_sync_subs_synced')}: {sync_status_model.subscriptions_synced}"
-        )
-        stats_text_parts.append(f"  {_('admin_stats_sync_details_label')}: {details_str}")
-    else:
-        stats_text_parts.append(f"\n{_('admin_sync_status_never_run')}")
-
-    final_text = "\n".join(stats_text_parts)
-
-    try:
-        await callback.message.edit_text(
-            final_text,
-            reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-            parse_mode="HTML",
-        )
-    except Exception as e_edit:
-        logging.error(f"Error editing message for statistics: {e_edit}", exc_info=True)
-
-        max_chunk_size = 4000
-        for i in range(0, len(final_text), max_chunk_size):
-            chunk = final_text[i : i + max_chunk_size]
-            is_last_chunk = (i + max_chunk_size) >= len(final_text)
-            try:
-                await callback.message.answer(
-                    chunk,
-                    reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n)
-                    if is_last_chunk
-                    else None,
-                    parse_mode="HTML",
-                )
-            except Exception as e_chunk:
-                logging.error(f"Failed to send statistics chunk: {e_chunk}")
-                if i == 0:
-                    await callback.message.answer(
-                        _("error_displaying_statistics"),
-                        reply_markup=get_back_to_admin_panel_keyboard(current_lang, i18n),
-                    )
-                break
-
-
-async def show_user_ratings_handler(
-    callback: types.CallbackQuery,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n or not callback.message:
-        await callback.answer("Error displaying ratings.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    await callback.answer()
-
-    top_limit = 10
-    bot_username: Optional[str] = None
-    try:
-        me = await callback.bot.get_me()
-        bot_username = me.username
-    except Exception as e_get_me:
-        logging.warning("Failed to resolve bot username for ratings links: %s", e_get_me)
-
-    traffic_top = await user_dal.get_top_users_by_traffic_used(session, limit=top_limit)
-    lifetime_traffic_top = await user_dal.get_top_users_by_lifetime_traffic_used(
-        session, limit=top_limit
-    )
-    invited_top = await user_dal.get_top_users_by_referrals_count(session, limit=top_limit)
-    revenue_top = await user_dal.get_top_users_by_referral_revenue(session, limit=top_limit)
-
-    text_parts: List[str] = [
-        _("admin_user_ratings_header", top_limit=top_limit),
-        "",
-        f"<b>{_('admin_user_ratings_traffic_month_title')}</b>",
-    ]
-
-    if traffic_top:
-        for idx, row in enumerate(traffic_top, start=1):
-            traffic_gb = float(row.get("traffic_used_bytes") or 0) / (1024**3)
-            text_parts.append(
-                _(
-                    "admin_user_ratings_traffic_item",
-                    rank=idx,
-                    user=_format_rating_user_label(row, bot_username),
-                    traffic_gb=f"{traffic_gb:.2f}",
-                )
-            )
-    else:
-        text_parts.append(_("admin_user_ratings_empty"))
-
-    text_parts.extend(["", f"<b>{_('admin_user_ratings_traffic_lifetime_title')}</b>"])
-    if lifetime_traffic_top:
-        for idx, row in enumerate(lifetime_traffic_top, start=1):
-            traffic_gb = float(row.get("lifetime_used_traffic_bytes") or 0) / (1024**3)
-            text_parts.append(
-                _(
-                    "admin_user_ratings_traffic_item",
-                    rank=idx,
-                    user=_format_rating_user_label(row, bot_username),
-                    traffic_gb=f"{traffic_gb:.2f}",
-                )
-            )
-    else:
-        text_parts.append(_("admin_user_ratings_empty"))
-
-    text_parts.extend(["", f"<b>{_('admin_user_ratings_invited_title')}</b>"])
-    if invited_top:
-        for idx, row in enumerate(invited_top, start=1):
-            text_parts.append(
-                _(
-                    "admin_user_ratings_invited_item",
-                    rank=idx,
-                    user=_format_rating_user_label(row, bot_username),
-                    invited_count=int(row.get("invited_count") or 0),
-                )
-            )
-    else:
-        text_parts.append(_("admin_user_ratings_empty"))
-
-    text_parts.extend(["", f"<b>{_('admin_user_ratings_revenue_title')}</b>"])
-    if revenue_top:
-        for idx, row in enumerate(revenue_top, start=1):
-            text_parts.append(
-                _(
-                    "admin_user_ratings_revenue_item",
-                    rank=idx,
-                    user=_format_rating_user_label(row, bot_username),
-                    revenue=f"{float(row.get('referral_revenue') or 0):.2f}",
-                )
-            )
-    else:
-        text_parts.append(_("admin_user_ratings_empty"))
-
-    await callback.message.edit_text(
-        "\n".join(text_parts),
-        reply_markup=get_back_to_user_management_keyboard(current_lang, i18n),
-        parse_mode="HTML",
-    )

backend/bot/handlers/admin/sync_admin.py

@@ -1,967 +0,0 @@
-import asyncio
-import logging
-from datetime import datetime, timezone
-from typing import Any, Optional, Union
-
-from aiogram import Bot, Router, types
-from aiogram.filters import Command
-from sqlalchemy import func, or_, select, update
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from bot.middlewares.i18n import JsonI18n
-from bot.services.notification_service import NotificationService
-from bot.services.panel_api_service import PanelApiService
-from config.settings import Settings
-from db.dal import panel_sync_dal, subscription_dal, user_dal
-from db.models import Subscription, User
-
-router = Router(name="admin_sync_router")
-
-# Single-flight guard: panel sync runs concurrently with the bot, but only one
-# sync at a time. Overlapping callers (startup, /sync, admin API) return early
-# instead of queueing behind the running sync.
-_sync_lock = asyncio.Lock()
-
-
-def _normalize_panel_email(value: Optional[str]) -> Optional[str]:
-    email = (value or "").strip().lower()
-    return email or None
-
-
-def _coerce_panel_telegram_id(value: Any) -> Optional[int]:
-    if value in (None, ""):
-        return None
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        logging.warning("Panel user has non-numeric telegramId: %r", value)
-        return None
-
-
-def _normalize_description(value: Optional[str]) -> str:
-    return "\n".join((value or "").split()).strip()
-
-
-def _description_matches(current: Optional[str], desired: str) -> bool:
-    return _normalize_description(current) == _normalize_description(desired)
-
-
-def _datetime_matches(current: Optional[datetime], desired: datetime) -> bool:
-    if current is None:
-        return False
-    current_dt = current if current.tzinfo else current.replace(tzinfo=timezone.utc)
-    desired_dt = desired if desired.tzinfo else desired.replace(tzinfo=timezone.utc)
-    delta = current_dt.astimezone(timezone.utc) - desired_dt.astimezone(timezone.utc)
-    return abs(delta.total_seconds()) < 1
-
-
-def _as_utc(value: datetime) -> datetime:
-    if value.tzinfo is None:
-        return value.replace(tzinfo=timezone.utc)
-    return value.astimezone(timezone.utc)
-
-
-def _should_update_lifetime_used_traffic(
-    existing_user,
-    lifetime_used: int,
-    *,
-    now: datetime,
-    settings: Settings,
-    is_duplicate_panel_identity: bool = False,
-) -> bool:
-    if is_duplicate_panel_identity:
-        return False
-
-    current_value = existing_user.lifetime_used_traffic_bytes
-    if current_value == lifetime_used:
-        return False
-    if current_value is None:
-        return True
-
-    try:
-        min_delta_bytes = max(
-            0,
-            int(getattr(settings, "PANEL_SYNC_LIFETIME_TRAFFIC_MIN_DELTA_BYTES", 0) or 0),
-        )
-    except (TypeError, ValueError):
-        min_delta_bytes = 0
-    if min_delta_bytes and abs(int(lifetime_used) - int(current_value or 0)) >= min_delta_bytes:
-        return True
-
-    try:
-        min_interval_seconds = max(
-            0,
-            int(getattr(settings, "PANEL_SYNC_LIFETIME_TRAFFIC_MIN_INTERVAL_SECONDS", 0) or 0),
-        )
-    except (TypeError, ValueError):
-        min_interval_seconds = 0
-    if min_interval_seconds <= 0:
-        return True
-
-    last_synced_at = getattr(existing_user, "lifetime_used_traffic_synced_at", None)
-    if not last_synced_at:
-        return True
-
-    return (_as_utc(now) - _as_utc(last_synced_at)).total_seconds() >= min_interval_seconds
-
-
-def _subscription_update_delta(
-    subscription: Subscription, desired: dict[str, Any]
-) -> dict[str, Any]:
-    delta: dict[str, Any] = {}
-    for key, desired_value in desired.items():
-        current_value = getattr(subscription, key)
-        if key == "end_date":
-            if not _datetime_matches(current_value, desired_value):
-                delta[key] = desired_value
-        elif current_value != desired_value:
-            delta[key] = desired_value
-    return delta
-
-
-async def _prefetch_sync_indexes(
-    session: AsyncSession, panel_users_data: list[dict[str, Any]]
-) -> dict[str, Any]:
-    telegram_ids: set[int] = set()
-    panel_uuids: set[str] = set()
-    emails: set[str] = set()
-    panel_subscription_uuids: set[str] = set()
-    panel_uuids_by_telegram_id: dict[int, set[str]] = {}
-
-    for panel_user in panel_users_data:
-        telegram_id = _coerce_panel_telegram_id(panel_user.get("telegramId"))
-        panel_uuid = panel_user.get("uuid")
-        if telegram_id:
-            telegram_ids.add(telegram_id)
-            if panel_uuid:
-                panel_uuids_by_telegram_id.setdefault(telegram_id, set()).add(str(panel_uuid))
-        if panel_uuid:
-            panel_uuids.add(panel_uuid)
-        email = _normalize_panel_email(panel_user.get("email"))
-        if email:
-            emails.add(email)
-        panel_subscription_uuid = panel_user.get("subscriptionUuid") or panel_user.get("shortUuid")
-        if panel_subscription_uuid:
-            panel_subscription_uuids.add(panel_subscription_uuid)
-
-    users_by_telegram_id: dict[int, User] = {}
-    users_by_user_id: dict[int, User] = {}
-    users_by_panel_uuid: dict[str, User] = {}
-    users_by_email: dict[str, User] = {}
-
-    user_filters = []
-    if telegram_ids:
-        user_filters.append(User.telegram_id.in_(telegram_ids))
-        user_filters.append(User.user_id.in_(telegram_ids))
-    if panel_uuids:
-        user_filters.append(User.panel_user_uuid.in_(panel_uuids))
-    if emails:
-        user_filters.append(func.lower(User.email).in_(emails))
-    if user_filters:
-        result = await session.execute(select(User).where(or_(*user_filters)))
-        for user in result.scalars().unique().all():
-            if user.telegram_id is not None:
-                users_by_telegram_id[int(user.telegram_id)] = user
-            users_by_user_id[int(user.user_id)] = user
-            if user.panel_user_uuid:
-                users_by_panel_uuid[user.panel_user_uuid] = user
-            if user.email:
-                users_by_email[user.email.strip().lower()] = user
-
-    subscriptions_by_panel_uuid: dict[str, Subscription] = {}
-    if panel_subscription_uuids:
-        result = await session.execute(
-            select(Subscription).where(
-                Subscription.panel_subscription_uuid.in_(panel_subscription_uuids)
-            )
-        )
-        subscriptions_by_panel_uuid = {
-            str(sub.panel_subscription_uuid): sub
-            for sub in result.scalars().unique().all()
-            if sub.panel_subscription_uuid
-        }
-
-    active_subscriptions_by_user_panel: dict[tuple[int, str], Subscription] = {}
-    if panel_uuids:
-        result = await session.execute(
-            select(Subscription)
-            .where(
-                Subscription.panel_user_uuid.in_(panel_uuids),
-                Subscription.is_active.is_(True),
-                Subscription.end_date > datetime.now(timezone.utc),
-            )
-            .order_by(Subscription.end_date.desc())
-        )
-        for sub in result.scalars().unique().all():
-            active_subscriptions_by_user_panel.setdefault(
-                (int(sub.user_id), sub.panel_user_uuid), sub
-            )
-
-    return {
-        "users_by_telegram_id": users_by_telegram_id,
-        "users_by_user_id": users_by_user_id,
-        "users_by_panel_uuid": users_by_panel_uuid,
-        "users_by_email": users_by_email,
-        "subscriptions_by_panel_uuid": subscriptions_by_panel_uuid,
-        "active_subscriptions_by_user_panel": active_subscriptions_by_user_panel,
-        "panel_uuids_by_telegram_id": panel_uuids_by_telegram_id,
-    }
-
-
-def _extract_lifetime_used_traffic_bytes(panel_user_data: dict) -> Optional[int]:
-    user_traffic = panel_user_data.get("userTraffic") or {}
-    raw_value = (
-        user_traffic.get("lifetimeUsedTrafficBytes") if isinstance(user_traffic, dict) else None
-    )
-    if raw_value is None:
-        raw_value = panel_user_data.get("lifetimeUsedTrafficBytes")
-
-    try:
-        if raw_value is None:
-            return None
-        return int(raw_value)
-    except (TypeError, ValueError):
-        return None
-
-
-async def _bind_panel_email_to_user(
-    session: AsyncSession,
-    *,
-    existing_user,
-    email_from_panel: Optional[str],
-    panel_uuid: str,
-) -> tuple[object, bool]:
-    """Bind panel email to a local user without violating the unique email index.
-
-    Panel email is treated as verified because it comes from the operator-managed
-    panel. If the same email already belongs to an email-only local account for
-    this panel user, merge that account into the Telegram/local user.
-    """
-    if not email_from_panel:
-        return existing_user, False
-
-    if existing_user.email == email_from_panel:
-        if not existing_user.email_verified_at:
-            existing_user.email_verified_at = datetime.now(timezone.utc)
-            return existing_user, True
-        return existing_user, False
-
-    user_with_email = await user_dal.get_user_by_email(session, email_from_panel)
-    if user_with_email and user_with_email.user_id != existing_user.user_id:
-        can_merge_email_identity = (
-            not user_with_email.telegram_id
-            and user_with_email.panel_user_uuid in (None, panel_uuid)
-            and (not existing_user.email or existing_user.email == email_from_panel)
-        )
-        if can_merge_email_identity:
-            try:
-                merged_user = await user_dal.merge_users(
-                    session,
-                    source_user_id=user_with_email.user_id,
-                    target_user_id=existing_user.user_id,
-                )
-                if not merged_user.email:
-                    merged_user.email = email_from_panel
-                if not merged_user.email_verified_at:
-                    merged_user.email_verified_at = datetime.now(timezone.utc)
-                logging.info(
-                    "Merged email-only user %s into user %s while binding panel email %s for panel UUID %s.",  # noqa: E501
-                    user_with_email.user_id,
-                    merged_user.user_id,
-                    email_from_panel,
-                    panel_uuid,
-                )
-                return merged_user, True
-            except Exception as merge_error:
-                logging.warning(
-                    "Could not merge email-only user %s into user %s for panel email %s: %s",
-                    user_with_email.user_id,
-                    existing_user.user_id,
-                    email_from_panel,
-                    merge_error,
-                )
-                return existing_user, False
-
-        logging.warning(
-            "Panel email %s for panel UUID %s is already linked to local user %s; "
-            "skipping email binding for user %s.",
-            email_from_panel,
-            panel_uuid,
-            user_with_email.user_id,
-            existing_user.user_id,
-        )
-        return existing_user, False
-
-    existing_user.email = email_from_panel
-    existing_user.email_verified_at = datetime.now(timezone.utc)
-    logging.info(
-        "Bound panel email %s to local user %s for panel UUID %s.",
-        email_from_panel,
-        existing_user.user_id,
-        panel_uuid,
-    )
-    return existing_user, True
-
-
-async def perform_sync(
-    panel_service: PanelApiService,
-    session: AsyncSession,
-    settings: Settings,
-    i18n_instance: JsonI18n,
-) -> dict:
-    """Single-flight entry point — skips when another sync is already running."""
-    if _sync_lock.locked():
-        logging.info("perform_sync: skipped because another sync is already in progress")
-        return {
-            "status": "skipped",
-            "details": "Another sync run is already in progress.",
-            "errors": [],
-            "users_processed": 0,
-            "subs_synced": 0,
-        }
-    async with _sync_lock:
-        return await _perform_sync_impl(
-            panel_service=panel_service,
-            session=session,
-            settings=settings,
-            i18n_instance=i18n_instance,
-        )
-
-
-async def _perform_sync_impl(
-    panel_service: PanelApiService,
-    session: AsyncSession,
-    settings: Settings,
-    i18n_instance: JsonI18n,
-) -> dict:
-    """
-    Perform panel synchronization and return results
-    Returns dict with status, details, and sync statistics
-    """
-    panel_records_checked = 0
-    users_found_in_db = 0
-    users_updated = 0
-    subscriptions_synced_count = 0
-    sync_errors = []
-
-    # Additional counters for detailed logging
-    users_without_telegram_id = 0
-    users_not_found_in_db = 0
-    users_created = 0
-    users_uuid_updated = 0
-    subscriptions_created = 0
-    subscriptions_updated = 0
-
-    try:
-        panel_users_data = await panel_service.get_all_panel_users()
-
-        if panel_users_data is None:
-            error_msg = "Failed to fetch users from panel or panel API issue."
-            sync_errors.append(error_msg)
-            await panel_sync_dal.update_panel_sync_status(session, "failed", error_msg)
-            await session.commit()
-            return {"status": "failed", "details": error_msg, "errors": sync_errors}
-
-        if not panel_users_data:
-            status_msg = "No users found in the panel to sync."
-            await panel_sync_dal.update_panel_sync_status(session, "success", status_msg, 0, 0)
-            await session.commit()
-            return {
-                "status": "success",
-                "details": status_msg,
-                "users_synced": 0,
-                "subs_synced": 0,
-            }
-
-        total_panel_users = len(panel_users_data)
-        logging.info(f"Starting sync for {total_panel_users} panel users.")
-        sync_indexes = await _prefetch_sync_indexes(session, panel_users_data)
-        users_by_telegram_id = sync_indexes["users_by_telegram_id"]
-        users_by_user_id = sync_indexes["users_by_user_id"]
-        users_by_panel_uuid = sync_indexes["users_by_panel_uuid"]
-        users_by_email = sync_indexes["users_by_email"]
-        subscriptions_by_panel_uuid = sync_indexes["subscriptions_by_panel_uuid"]
-        active_subscriptions_by_user_panel = sync_indexes["active_subscriptions_by_user_panel"]
-        panel_uuids_by_telegram_id = sync_indexes["panel_uuids_by_telegram_id"]
-
-        for panel_user_dict in panel_users_data:
-            try:
-                panel_records_checked += 1
-                panel_uuid = panel_user_dict.get("uuid")
-                panel_user_dict.get("subscriptionUuid") or panel_user_dict.get("shortUuid")
-                telegram_id_from_panel = _coerce_panel_telegram_id(
-                    panel_user_dict.get("telegramId")
-                )
-                email_from_panel = _normalize_panel_email(panel_user_dict.get("email"))
-
-                if not panel_uuid:
-                    sync_errors.append(f"Panel user missing UUID: {panel_user_dict}")
-                    logging.warning(f"Skipping panel user without UUID: {panel_user_dict}")
-                    continue
-
-                # Track users without telegram ID
-                if not telegram_id_from_panel:
-                    users_without_telegram_id += 1
-
-                # Try to find existing user in local DB
-                existing_user = None
-
-                # First, try to find by telegram ID if available
-                if telegram_id_from_panel:
-                    existing_user = users_by_telegram_id.get(
-                        telegram_id_from_panel
-                    ) or users_by_user_id.get(telegram_id_from_panel)
-                    if existing_user:
-                        logging.debug(f"Found user by telegramId {telegram_id_from_panel}")
-
-                # If not found by telegram ID, try to find by panel UUID.
-                # The panel UUID is the strongest local link for subscription sync.
-                if not existing_user:
-                    existing_user = users_by_panel_uuid.get(panel_uuid)
-                    if existing_user:
-                        logging.debug(
-                            f"Found user by panel UUID {panel_uuid}, telegramId: {existing_user.user_id}"  # noqa: E501
-                        )
-                        # Update telegram ID if it was missing in panel data but we have local user
-                        if (
-                            telegram_id_from_panel
-                            and existing_user.user_id != telegram_id_from_panel
-                        ):
-                            logging.warning(
-                                f"TelegramId mismatch: panel={telegram_id_from_panel}, local={existing_user.user_id}"  # noqa: E501
-                            )
-
-                # Finally, fall back to email. This mainly catches panel users that
-                # were first imported as email-only identities.
-                if not existing_user and email_from_panel:
-                    existing_user = users_by_email.get(email_from_panel)
-                    if existing_user:
-                        logging.debug(f"Found user by email {email_from_panel}")
-
-                if not existing_user:
-                    users_not_found_in_db += 1
-                    if telegram_id_from_panel:
-                        # Create new user if they have telegram_id
-                        try:
-                            user_data = {
-                                "user_id": telegram_id_from_panel,
-                                "telegram_id": telegram_id_from_panel,
-                                "email": email_from_panel,
-                                "email_verified_at": (
-                                    datetime.now(timezone.utc) if email_from_panel else None
-                                ),
-                                "username": None,  # Username will be updated when user interacts with bot  # noqa: E501
-                                "first_name": None,  # Panel doesn't provide this info
-                                "last_name": None,  # Panel doesn't provide this info
-                                "language_code": "ru",  # Default language
-                                "panel_user_uuid": panel_uuid,
-                                "is_banned": False,
-                                "referred_by_id": None,
-                            }
-
-                            new_user, was_created = await user_dal.create_user(session, user_data)
-                            if was_created:
-                                users_created += 1
-                                logging.info(
-                                    f"Created new user {telegram_id_from_panel} from panel sync with UUID {panel_uuid}"  # noqa: E501
-                                )
-
-                            existing_user = new_user
-                            users_by_user_id[int(new_user.user_id)] = new_user
-                            if new_user.telegram_id is not None:
-                                users_by_telegram_id[int(new_user.telegram_id)] = new_user
-                            users_by_panel_uuid[panel_uuid] = new_user
-                            if email_from_panel:
-                                users_by_email[email_from_panel] = new_user
-
-                        except Exception as e_create:
-                            sync_errors.append(
-                                f"Error creating user {telegram_id_from_panel}: {str(e_create)}"
-                            )
-                            logging.error(
-                                f"Error creating user {telegram_id_from_panel}: {e_create}"
-                            )
-                            continue
-                    elif email_from_panel:
-                        try:
-                            new_user, was_created = await user_dal.create_email_user(
-                                session,
-                                email=email_from_panel,
-                                language_code="ru",
-                            )
-                            new_user.panel_user_uuid = panel_uuid
-                            if was_created:
-                                users_created += 1
-                                logging.info(
-                                    f"Created new email user {new_user.user_id} from panel sync with UUID {panel_uuid}"  # noqa: E501
-                                )
-                            existing_user = new_user
-                            users_by_user_id[int(new_user.user_id)] = new_user
-                            users_by_panel_uuid[panel_uuid] = new_user
-                            users_by_email[email_from_panel] = new_user
-                        except Exception as e_create_email:
-                            sync_errors.append(
-                                f"Error creating email user {email_from_panel}: {str(e_create_email)}"  # noqa: E501
-                            )
-                            logging.error(
-                                f"Error creating email user {email_from_panel}: {e_create_email}"
-                            )
-                            continue
-                    else:
-                        logging.debug(
-                            f"Panel user with UUID {panel_uuid} (no telegramId) not found in local DB - skipping"  # noqa: E501
-                        )
-                        continue
-
-                # User found in local DB
-                users_found_in_db += 1
-                user_was_updated = False
-
-                # Get the actual user_id for subscription operations
-                actual_user_id = existing_user.user_id
-                is_duplicate_panel_identity = False
-
-                # Update panel UUID if different
-                if existing_user.panel_user_uuid != panel_uuid:
-                    linked_uuid = existing_user.panel_user_uuid
-                    linked_uuid_still_present = bool(
-                        telegram_id_from_panel
-                        and linked_uuid
-                        and str(linked_uuid)
-                        in panel_uuids_by_telegram_id.get(telegram_id_from_panel, set())
-                    )
-                    if linked_uuid_still_present:
-                        is_duplicate_panel_identity = True
-                        logging.warning(
-                            "Sync: duplicate panel users share telegramId %s; keeping local panel UUID %s and skipping duplicate panel UUID %s.",  # noqa: E501
-                            telegram_id_from_panel,
-                            linked_uuid,
-                            panel_uuid,
-                        )
-                    else:
-                        existing_user.panel_user_uuid = panel_uuid
-                        user_was_updated = True
-                        users_uuid_updated += 1
-                        users_by_panel_uuid[panel_uuid] = existing_user
-                        logging.info(f"Updated panel UUID for user {actual_user_id}: {panel_uuid}")
-                if not is_duplicate_panel_identity:
-                    existing_user, email_was_bound = await _bind_panel_email_to_user(
-                        session,
-                        existing_user=existing_user,
-                        email_from_panel=email_from_panel,
-                        panel_uuid=panel_uuid,
-                    )
-                    if email_was_bound:
-                        user_was_updated = True
-                        if email_from_panel:
-                            users_by_email[email_from_panel] = existing_user
-                    if (
-                        telegram_id_from_panel
-                        and existing_user.telegram_id != telegram_id_from_panel
-                    ):
-                        existing_user.telegram_id = telegram_id_from_panel
-                        user_was_updated = True
-                        users_by_telegram_id[telegram_id_from_panel] = existing_user
-
-                lifetime_used = _extract_lifetime_used_traffic_bytes(panel_user_dict)
-                if lifetime_used is not None and _should_update_lifetime_used_traffic(
-                    existing_user,
-                    lifetime_used,
-                    now=datetime.now(timezone.utc),
-                    settings=settings,
-                    is_duplicate_panel_identity=is_duplicate_panel_identity,
-                ):
-                    existing_user.lifetime_used_traffic_bytes = lifetime_used
-                    existing_user.lifetime_used_traffic_synced_at = datetime.now(timezone.utc)
-                    user_was_updated = True
-
-                # Ensure panel description contains Telegram fields
-                try:
-                    if panel_uuid and existing_user and not is_duplicate_panel_identity:
-                        description_text = "\n".join(
-                            line
-                            for line in [
-                                existing_user.email or "",
-                                existing_user.username or "",
-                                existing_user.first_name or "",
-                                existing_user.last_name or "",
-                            ]
-                            if line
-                        )
-                        # Update description only when it differs from the current one on panel
-                        current_panel_description = (
-                            panel_user_dict.get("description") or ""
-                        ).strip()
-                        desired_description = description_text.strip()
-                        if desired_description and not _description_matches(
-                            current_panel_description, desired_description
-                        ):
-                            await panel_service.update_user_details_on_panel(
-                                panel_uuid,
-                                {
-                                    "description": description_text,
-                                    **(
-                                        {"email": existing_user.email}
-                                        if existing_user.email
-                                        else {}
-                                    ),
-                                    **(
-                                        {"telegramId": existing_user.telegram_id}
-                                        if existing_user.telegram_id
-                                        else {}
-                                    ),
-                                },
-                            )
-                except Exception as e_desc:
-                    logging.warning(
-                        f"Sync: Failed to update description for panel user {panel_uuid} (tg {actual_user_id}): {e_desc}"  # noqa: E501
-                    )
-
-                # Sync subscription data
-                panel_expire_at_iso = panel_user_dict.get("expireAt")
-                panel_status = panel_user_dict.get("status", "UNKNOWN")
-
-                if panel_expire_at_iso:
-                    try:
-                        panel_expire_at = datetime.fromisoformat(
-                            panel_expire_at_iso.replace("Z", "+00:00")
-                        )
-
-                        # Prefer syncing by concrete subscription UUID (shortUuid/subscriptionUuid)
-                        subscription_uuid_from_panel = panel_user_dict.get(
-                            "subscriptionUuid"
-                        ) or panel_user_dict.get("shortUuid")
-
-                        if subscription_uuid_from_panel:
-                            # Если панель говорит, что подписка ACTIVE — сначала деактивируем все другие активные  # noqa: E501
-                            if panel_status == "ACTIVE":
-                                await session.execute(
-                                    update(Subscription)
-                                    .where(
-                                        Subscription.panel_user_uuid == panel_uuid,
-                                        Subscription.is_active.is_(True),
-                                        or_(
-                                            Subscription.panel_subscription_uuid
-                                            != subscription_uuid_from_panel,
-                                            Subscription.panel_subscription_uuid.is_(None),
-                                        ),
-                                    )
-                                    .values(
-                                        is_active=False,
-                                        status_from_panel="INACTIVE",
-                                    )
-                                )
-
-                            # Try to find subscription by its panel_subscription_uuid first (idempotent)  # noqa: E501
-                            existing_sub_by_uuid = subscriptions_by_panel_uuid.get(
-                                subscription_uuid_from_panel
-                            )
-
-                            if existing_sub_by_uuid:
-                                update_payload = {
-                                    "user_id": actual_user_id,
-                                    "panel_user_uuid": panel_uuid,
-                                    "end_date": panel_expire_at,
-                                    "is_active": panel_status == "ACTIVE",
-                                    "status_from_panel": panel_status,
-                                }
-                                update_delta = _subscription_update_delta(
-                                    existing_sub_by_uuid, update_payload
-                                )
-                                if update_delta:
-                                    # Atomic update of changed relevant fields
-                                    await subscription_dal.update_subscription(
-                                        session,
-                                        existing_sub_by_uuid.subscription_id,
-                                        update_delta,
-                                    )
-                                    subscriptions_updated += 1
-                                    user_was_updated = True
-                                subscriptions_synced_count += 1
-                                logging.debug(
-                                    f"Synced existing subscription {existing_sub_by_uuid.subscription_id} "  # noqa: E501
-                                    f"for user {actual_user_id}: expires {panel_expire_at}, status {panel_status}"  # noqa: E501
-                                )
-                            else:
-                                # Create a new subscription only when we have a concrete subscription UUID  # noqa: E501
-                                sub_payload = {
-                                    "user_id": actual_user_id,
-                                    "panel_user_uuid": panel_uuid,
-                                    "panel_subscription_uuid": subscription_uuid_from_panel,
-                                    # Do not guess precise start_date from panel; keep nullable
-                                    "start_date": None,
-                                    "end_date": panel_expire_at,
-                                    "duration_months": None,
-                                    "is_active": panel_status == "ACTIVE",
-                                    "status_from_panel": panel_status,
-                                    "traffic_limit_bytes": settings.user_traffic_limit_bytes,
-                                    "auto_renew_enabled": False,
-                                }
-                                created_sub = await subscription_dal.upsert_subscription(
-                                    session, sub_payload
-                                )
-                                subscriptions_by_panel_uuid[subscription_uuid_from_panel] = (
-                                    created_sub
-                                )
-                                if created_sub.is_active and created_sub.end_date > datetime.now(
-                                    timezone.utc
-                                ):
-                                    active_subscriptions_by_user_panel[
-                                        (int(created_sub.user_id), created_sub.panel_user_uuid)
-                                    ] = created_sub
-                                subscriptions_synced_count += 1
-                                subscriptions_created += 1
-                                user_was_updated = True
-                                logging.debug(
-                                    f"Created subscription {created_sub.subscription_id} "
-                                    f"for user {actual_user_id} by panel_sub_uuid {subscription_uuid_from_panel}"  # noqa: E501
-                                )
-                        else:
-                            # No subscription UUID from panel: only update an already active subscription for this user/panel UUID  # noqa: E501
-                            active_sub = active_subscriptions_by_user_panel.get(
-                                (actual_user_id, panel_uuid)
-                            )
-                            if active_sub:
-                                update_payload = {
-                                    "end_date": panel_expire_at,
-                                    "is_active": panel_status == "ACTIVE",
-                                    "status_from_panel": panel_status,
-                                }
-                                update_delta = _subscription_update_delta(
-                                    active_sub, update_payload
-                                )
-                                if update_delta:
-                                    await subscription_dal.update_subscription(
-                                        session,
-                                        active_sub.subscription_id,
-                                        update_delta,
-                                    )
-                                    subscriptions_updated += 1
-                                    user_was_updated = True
-                                subscriptions_synced_count += 1
-                                logging.debug(
-                                    f"Updated active subscription {active_sub.subscription_id} "
-                                    f"for user {actual_user_id}: expires {panel_expire_at}, status {panel_status}"  # noqa: E501
-                                )
-                            else:
-                                # Without a concrete subscription UUID we avoid creating new records to keep sync idempotent  # noqa: E501
-                                logging.debug(
-                                    f"No subscriptionUuid for panel user {panel_uuid}; skipped creation for user {actual_user_id}"  # noqa: E501
-                                )
-
-                    except Exception as e:
-                        sync_errors.append(
-                            f"Error syncing subscription for user {actual_user_id}: {str(e)}"
-                        )
-                        logging.error(f"Error syncing subscription for user {actual_user_id}: {e}")
-
-                if user_was_updated:
-                    users_updated += 1
-
-            except Exception as e_user:
-                sync_errors.append(
-                    f"Error processing panel user {panel_user_dict.get('uuid', 'unknown')}: {str(e_user)}"  # noqa: E501
-                )
-                logging.error(f"Error syncing user: {e_user}")
-
-        # Update sync status
-        status = "completed_with_errors" if sync_errors else "completed"
-        # Build additional stats
-        default_lang = settings.DEFAULT_LANGUAGE
-        additional_stats = ""
-        if users_without_telegram_id > 0:
-            additional_stats += i18n_instance.gettext(
-                default_lang,
-                "admin_sync_no_telegram_id",
-                count=users_without_telegram_id,
-            )
-        if users_not_found_in_db > 0:
-            additional_stats += i18n_instance.gettext(
-                default_lang,
-                "admin_sync_not_found_in_db",
-                count=users_not_found_in_db,
-            )
-        if sync_errors:
-            additional_stats += i18n_instance.gettext(
-                default_lang, "admin_sync_errors", count=len(sync_errors)
-            )
-
-        # Build full details using localization
-        details = i18n_instance.gettext(
-            default_lang,
-            "admin_sync_details",
-            panel_records_checked=panel_records_checked,
-            users_found_in_db=users_found_in_db,
-            users_created=users_created,
-            users_updated=users_updated,
-            subscriptions_synced_count=subscriptions_synced_count,
-            subscriptions_created=subscriptions_created,
-            subscriptions_updated=subscriptions_updated,
-            additional_stats=additional_stats,
-        )
-
-        await panel_sync_dal.update_panel_sync_status(
-            session,
-            status,
-            details,
-            panel_records_checked,
-            subscriptions_synced_count,
-        )
-        await session.commit()
-
-        # Detailed logging summary
-        logging.info("Sync completed - Summary:")
-        logging.info(f"  Panel records checked: {panel_records_checked}")
-        logging.info(f"  Users without telegramId: {users_without_telegram_id}")
-        logging.info(f"  Users not found in local DB: {users_not_found_in_db}")
-        logging.info(f"  Users found in local DB: {users_found_in_db}")
-        logging.info(f"  Users created: {users_created}")
-        logging.info(f"  Users with UUID updated: {users_uuid_updated}")
-        logging.info(f"  Users updated overall: {users_updated}")
-        logging.info(f"  Subscriptions total synced: {subscriptions_synced_count}")
-        logging.info(f"  Subscriptions created: {subscriptions_created}")
-        logging.info(f"  Subscriptions updated: {subscriptions_updated}")
-        logging.info(f"  Sync errors: {len(sync_errors)}")
-
-        return {
-            "status": status,
-            "details": details,
-            "users_processed": panel_records_checked,
-            "users_synced": users_found_in_db,
-            "users_created": users_created,
-            "subs_synced": subscriptions_synced_count,
-            "errors": sync_errors,
-        }
-
-    except Exception as e_sync_global:
-        await session.rollback()
-        logging.error(f"Global error during sync: {e_sync_global}", exc_info=True)
-        error_detail = f"Unexpected error during sync: {str(e_sync_global)}"
-
-        await panel_sync_dal.update_panel_sync_status(
-            session,
-            "failed",
-            error_detail,
-            panel_records_checked,
-            subscriptions_synced_count,
-        )
-
-        return {
-            "status": "failed",
-            "details": error_detail,
-            "errors": [str(e_sync_global)],
-        }
-
-
-@router.message(Command("sync"))
-async def sync_command_handler(
-    message_event: Union[types.Message, types.CallbackQuery],
-    bot: Bot,
-    settings: Settings,
-    i18n_data: dict,
-    panel_service: PanelApiService,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        logging.error("i18n missing in sync_command_handler")
-
-        if isinstance(message_event, types.Message):
-            await message_event.answer("Language error.")
-        elif isinstance(message_event, types.CallbackQuery):
-            await message_event.answer("Language error.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    target_chat_id = (
-        message_event.chat.id
-        if isinstance(message_event, types.Message)
-        else (message_event.message.chat.id if message_event.message else None)
-    )
-    if not target_chat_id:
-        logging.error("Sync handler: could not determine target_chat_id.")
-        if isinstance(message_event, types.CallbackQuery):
-            await message_event.answer("Error initiating sync.", show_alert=True)
-        return
-
-    if isinstance(message_event, types.Message):
-        await message_event.answer(_("sync_started_simple"))
-
-    logging.info(f"Admin ({message_event.from_user.id}) triggered panel sync.")
-
-    # Use the extracted perform_sync function
-    try:
-        sync_result = await perform_sync(panel_service, session, settings, i18n)
-
-        status = sync_result.get("status")
-        details = sync_result.get("details", "No details available")
-        errors = sync_result.get("errors", [])
-
-        # Simple confirmation message to admin
-        if status == "failed":
-            await bot.send_message(target_chat_id, _("sync_failed_simple"))
-        elif status == "completed_with_errors":
-            await bot.send_message(
-                target_chat_id,
-                _("sync_errors_simple", errors_count=len(errors)),
-            )
-        else:
-            await bot.send_message(target_chat_id, _("sync_success_simple"))
-
-        # Send notification to log channel with proper thread handling
-        try:
-            notification_service = NotificationService(bot, settings, i18n)
-            await notification_service.notify_panel_sync(
-                status,
-                details,
-                sync_result.get("users_processed", 0),
-                sync_result.get("subs_synced", 0),
-            )
-        except Exception as e_notification:
-            logging.error(f"Failed to send sync notification: {e_notification}")
-
-    except Exception as e_sync_global:
-        logging.error(f"Global error during /sync command: {e_sync_global}", exc_info=True)
-        await bot.send_message(target_chat_id, _("sync_critical_error"))
-
-        # Send notification to log channel about failure
-        try:
-            notification_service = NotificationService(bot, settings, i18n)
-            await notification_service.notify_panel_sync("failed", str(e_sync_global), 0, 0)
-        except Exception as e_notification:
-            logging.error(f"Failed to send sync failure notification: {e_notification}")
-
-
-@router.message(Command("syncstatus"))
-async def sync_status_command_handler(
-    message: types.Message, i18n_data: dict, settings: Settings, session: AsyncSession
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        await message.answer("Language error.")
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    status_record_model = await panel_sync_dal.get_panel_sync_status(session)
-    response_text = ""
-    if status_record_model:
-        last_time_val = status_record_model.last_sync_time
-        last_time_str = last_time_val.strftime("%Y-%m-%d %H:%M:%S UTC") if last_time_val else "N/A"
-
-        details_val = status_record_model.details
-        details_str = details_val or "N/A"
-
-        response_text = (
-            f"<b>{_('admin_stats_last_sync_header')}</b>\n"
-            f"  {_('admin_stats_sync_time')}: {last_time_str}\n"
-            f"  {_('admin_stats_sync_status')}: {status_record_model.status}\n"
-            f"  {_('admin_stats_sync_users_processed')}: {status_record_model.users_processed_from_panel}\n"  # noqa: E501
-            f"  {_('admin_stats_sync_subs_synced')}: {status_record_model.subscriptions_synced}\n"
-            f"  {_('admin_stats_sync_details_label')}: {details_str}"
-        )
-    else:
-        response_text = _("admin_sync_status_never_run")
-
-    await message.answer(response_text, parse_mode="HTML")

backend/bot/handlers/user/promo_user.py

@@ -1,220 +0,0 @@
-import logging
-import re
-from datetime import datetime
-from typing import Optional
-
-from aiogram import Bot, F, Router, types
-from aiogram.fsm.context import FSMContext
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from bot.keyboards.inline.user_keyboards import (
-    get_back_to_main_menu_markup,
-    get_connect_and_main_keyboard,
-)
-from bot.middlewares.i18n import JsonI18n
-from bot.services.promo_code_service import PromoCodeService
-from bot.services.subscription_service import SubscriptionService
-from bot.states.user_states import UserPromoStates
-from bot.utils.callback_answer import safe_answer_callback
-from config.settings import Settings
-
-from .start import send_main_menu
-
-router = Router(name="user_promo_router")
-
-SUSPICIOUS_SQL_KEYWORDS_REGEX = re.compile(
-    r"\b(DROP\s*TABLE|DELETE\s*FROM|ALTER\s*TABLE|TRUNCATE\s*TABLE|UNION\s*SELECT|"
-    r";\s*SELECT|;\s*INSERT|;\s*UPDATE|;\s*DELETE|xp_cmdshell|sysdatabases|sysobjects|INFORMATION_SCHEMA)\b",
-    re.IGNORECASE,
-)
-SUSPICIOUS_CHARS_REGEX = re.compile(r"(--|#\s|;|\*\/|\/\*)")
-MAX_PROMO_CODE_INPUT_LENGTH = 100
-
-
-async def prompt_promo_code_input(
-    callback: types.CallbackQuery,
-    state: FSMContext,
-    i18n_data: dict,
-    settings: Settings,
-    session: AsyncSession,
-    back_callback: str = "main_action:back_to_main",
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        await safe_answer_callback(callback, "Language service error.", show_alert=True)
-        return
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-
-    if not callback.message:
-        logging.error("CallbackQuery has no message in prompt_promo_code_input")
-        await safe_answer_callback(
-            callback,
-            _("error_occurred_processing_request"),
-            show_alert=True,
-        )
-        return
-
-    try:
-        await callback.message.edit_text(
-            text=_(key="promo_code_prompt"),
-            reply_markup=get_back_to_main_menu_markup(
-                current_lang,
-                i18n,
-                callback_data=back_callback,
-            ),
-        )
-    except Exception as e_edit:
-        logging.warning(f"Failed to edit message for promo prompt: {e_edit}. Sending new one.")
-        await callback.message.answer(
-            text=_(key="promo_code_prompt"),
-            reply_markup=get_back_to_main_menu_markup(
-                current_lang,
-                i18n,
-                callback_data=back_callback,
-            ),
-        )
-
-    await safe_answer_callback(callback)
-    await state.set_state(UserPromoStates.waiting_for_promo_code)
-    logging.info(
-        f"User {callback.from_user.id} entered state UserPromoStates.waiting_for_promo_code. "
-        f"FSM state: {await state.get_state()}"
-    )
-
-
-@router.message(UserPromoStates.waiting_for_promo_code, F.text)
-async def process_promo_code_input(
-    message: types.Message,
-    state: FSMContext,
-    settings: Settings,
-    i18n_data: dict,
-    promo_code_service: PromoCodeService,
-    subscription_service: SubscriptionService,
-    bot: Bot,
-    session: AsyncSession,
-):
-    logging.info(
-        f"Processing promo code input from user {message.from_user.id} in state {await state.get_state()}: '{message.text}'"  # noqa: E501
-    )
-
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-
-    if not i18n or not promo_code_service:
-        logging.error("Dependencies (i18n or PromoCodeService) missing in process_promo_code_input")
-        await message.reply("Service error. Please try again later.")
-        await state.clear()
-        return
-
-    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-    code_input = message.text.strip() if message.text else ""
-    user = message.from_user
-
-    is_suspicious = False
-    if not code_input:
-        is_suspicious = True
-        logging.warning(f"Empty promo code input by user {user.id}.")
-    elif (
-        len(code_input) > MAX_PROMO_CODE_INPUT_LENGTH
-        or SUSPICIOUS_SQL_KEYWORDS_REGEX.search(code_input)
-        or SUSPICIOUS_CHARS_REGEX.search(code_input)
-    ):
-        is_suspicious = True
-        logging.warning(
-            f"Suspicious input for promo code by user {user.id} (len: {len(code_input)}): '{code_input}'"  # noqa: E501
-        )
-
-    response_to_user_text = ""
-    if is_suspicious:
-        # Send notification through NotificationService if enabled
-        if settings.LOG_SUSPICIOUS_ACTIVITY:
-            try:
-                from bot.services.notification_service import NotificationService
-
-                notification_service = NotificationService(bot, settings, i18n)
-                await notification_service.notify_suspicious_promo_attempt(
-                    user_id=user.id,
-                    username=user.username,
-                    first_name=user.first_name,
-                    suspicious_input=code_input,
-                )
-            except Exception as e:
-                logging.error(f"Failed to send suspicious promo notification: {e}")
-
-    success, result = await promo_code_service.apply_promo_code(
-        session, user.id, code_input, current_lang
-    )
-    if success:
-        await session.commit()
-        logging.info(f"Promo code '{code_input}' successfully applied for user {user.id}.")
-
-        new_end_date = result if isinstance(result, datetime) else None
-        active = await subscription_service.get_active_subscription_details(session, user.id)
-        config_link_display = active.get("config_link") if active else None
-        connect_button_url = active.get("connect_button_url") if active else None
-        config_link_text = config_link_display or _("config_link_not_available")
-
-        response_to_user_text = _(
-            "promo_code_applied_success_full",
-            end_date=(new_end_date.strftime("%d.%m.%Y %H:%M:%S") if new_end_date else "N/A"),
-            config_link=config_link_text,
-        )
-        reply_markup = get_connect_and_main_keyboard(
-            current_lang,
-            i18n,
-            settings,
-            config_link_display,
-            connect_button_url=connect_button_url,
-        )
-    else:
-        await session.commit()
-        logging.info(
-            f"Promo code '{code_input}' application failed for user {user.id}. Reason: {result}"
-        )
-        response_to_user_text = result
-        reply_markup = get_back_to_main_menu_markup(current_lang, i18n)
-
-    await message.answer(
-        response_to_user_text,
-        reply_markup=reply_markup,
-        parse_mode="HTML",
-    )
-    await state.clear()
-    logging.info(
-        f"Promo code input '{code_input}' processing finished for user {message.from_user.id}. State cleared."  # noqa: E501
-    )
-
-
-@router.callback_query(F.data == "main_action:back_to_main", UserPromoStates.waiting_for_promo_code)
-async def cancel_promo_input_via_button(
-    callback: types.CallbackQuery,
-    state: FSMContext,
-    settings: Settings,
-    i18n_data: dict,
-    subscription_service: SubscriptionService,
-    session: AsyncSession,
-):
-    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
-    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
-    if not i18n:
-        logging.error("i18n missing in cancel_promo_input_via_button")
-        await safe_answer_callback(callback, "Language error", show_alert=True)
-        return
-
-    logging.info(
-        f"User {callback.from_user.id} cancelled promo code input via button from state {await state.get_state()}. Clearing state."  # noqa: E501
-    )
-    await state.clear()
-
-    if callback.message:
-        await send_main_menu(
-            callback, settings, i18n_data, subscription_service, session, is_edit=True
-        )
-    else:
-        _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
-        await safe_answer_callback(
-            callback,
-            _("promo_input_cancelled_short"),
-            show_alert=False,
-        )