docs: document LAVA provider setup

Describe LAVA Business configuration: env keys, webhook URL and
signature scheme, RUB-only invoices, and the include-services filter.
Mention LAVA in the provider lists of the README, admin panel page,
and tariff currency matrix.

.dockerignore

@@ -16,7 +16,9 @@ frontend/node_modules/
 docs-site/node_modules/
 docs-site/.astro/
 docs-site/dist/
+docs-site/public/demo/runtime/
 docs-site/src/content/docs/
+frontend-nginx-dist/
 deploy/compose/docker-compose-dev.yml
 data/*
 !data/tariffs.example.json
@@ -51,6 +53,11 @@ bot/app/web/templates/subscription_webapp_admin.min.*.js.br
 bot/app/web/templates/subscription_webapp_admin.min.*.js.gz
 bot/app/web/templates/subscription_webapp_admin.*.css.br
 bot/app/web/templates/subscription_webapp_admin.*.css.gz
+bot/app/web/templates/subscription_webapp_docs_demo.css
+bot/app/web/templates/subscription_webapp_docs_demo.js
+bot/app/web/templates/subscription_webapp_docs_demo.*.css
+bot/app/web/templates/subscription_webapp_docs_demo.*.css.br
+bot/app/web/templates/subscription_webapp_docs_demo.*.css.gz
 backend/bot/app/web/templates/subscription_webapp.css
 backend/bot/app/web/templates/subscription_webapp.js
 backend/bot/app/web/templates/subscription_webapp.min.*.js
@@ -67,6 +74,11 @@ backend/bot/app/web/templates/subscription_webapp_admin.min.*.js.br
 backend/bot/app/web/templates/subscription_webapp_admin.min.*.js.gz
 backend/bot/app/web/templates/subscription_webapp_admin.*.css.br
 backend/bot/app/web/templates/subscription_webapp_admin.*.css.gz
+backend/bot/app/web/templates/subscription_webapp_docs_demo.css
+backend/bot/app/web/templates/subscription_webapp_docs_demo.js
+backend/bot/app/web/templates/subscription_webapp_docs_demo.*.css
+backend/bot/app/web/templates/subscription_webapp_docs_demo.*.css.br
+backend/bot/app/web/templates/subscription_webapp_docs_demo.*.css.gz
 
 # Byte-compiled / optimized / DLL files
 **/__pycache__/

.env.example

@@ -71,5 +71,19 @@ WEB_SERVER_PORT=8080
 FRONTEND_PORT=8082
 
 # Reverse proxy IPs/CIDRs trusted for X-Forwarded-For.
-# Keep loopback for local proxy; add your proxy network if needed.
-TRUSTED_PROXIES=127.0.0.1,::1
+# Keep loopback and private network ranges so payment provider IP allowlists
+# see the original webhook sender behind Docker/LAN/Kubernetes proxies.
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7
+
+# ─── Anonymous install telemetry (opt-out) ──────────────────────────────
+# Once a day the worker sends a single anonymous "heartbeat" so the project
+# maintainer can see how many installs are active and which versions/OSes are
+# used. It contains an opaque random install id and coarse facts only:
+# version, official/custom image provenance, OS/arch, Python version, language,
+# enabled payment providers and a user-count RANGE (e.g. "51-200"). No bot
+# token, domain, user data or any personal information is ever sent.
+# Full details: docs/configuration/telemetry.md
+#
+# Set to False to disable, or toggle it any time in Admin -> System ->
+# "Anonymous install analytics" (applies without a restart).
+TELEMETRY_ENABLED=True

.gitattributes

@@ -1,5 +1,6 @@
 .gitattributes text eol=lf
 *.sh text eol=lf
+.github/workflows/*.yml text eol=lf
 deploy/docker/frontend/*.sh text eol=lf
 frontend/src/*.js text eol=lf
 frontend/src/**/*.js text eol=lf

.github/workflows/_docker-build-push.yml

@@ -0,0 +1,138 @@
+name: Docker build & push (reusable)
+
+# Reusable workflow that builds the three image targets defined in
+# deploy/docker/Dockerfile (backend, worker, frontend) and optionally pushes
+# them to the selected registries under the repository owner's namespace.
+#
+# Called by:
+#   - docker-dev.yml      (tag_mode: dev,     push: true)  on pushes to dev
+#   - docker-release.yml  (tag_mode: release, push: true)  on release tags
+#   - ci.yml              (tag_mode: dev,     push: false) on pull requests
+
+on:
+  workflow_call:
+    inputs:
+      push:
+        description: "Push the built images to the registries"
+        type: boolean
+        default: true
+      tag_mode:
+        description: "Tagging strategy: 'dev' or 'release'"
+        type: string
+        required: true
+      publish_dockerhub:
+        description: "Include Docker Hub tags and login when pushing"
+        type: boolean
+        default: true
+
+# No permissions block here on purpose: a reusable workflow cannot request more
+# than its caller grants, so the token scope is set by each caller
+# (docker-dev.yml / docker-release.yml grant packages: write to push; ci.yml
+# only needs contents: read for a no-push build).
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: backend
+            image: remnawave-minishop-backend
+          - target: worker
+            image: remnawave-minishop-worker
+          - target: frontend
+            image: remnawave-minishop-frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history + tags: the Dockerfile's version-builder stage runs
+          # `git describe --tags` against the copied .git tree.
+          fetch-depth: 0
+
+      - name: Resolve release version
+        id: version
+        if: inputs.tag_mode == 'release'
+        run: |
+          # On a tag push github.ref_name is the tag (e.g. v3.4.5); for a
+          # manual workflow_dispatch on a branch, fall back to the latest tag.
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            raw="${{ github.ref_name }}"
+          else
+            raw="$(git describe --tags --abbrev=0 2>/dev/null)"
+          fi
+          version="${raw#v}"
+          if [ -z "$version" ]; then
+            echo "::error::No git tag found to derive the release version from"
+            exit 1
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "Release version: ${version}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        if: inputs.push
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        if: inputs.push && inputs.publish_dockerhub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Resolve image namespaces
+        id: image_namespaces
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+        run: |
+          github_owner="${{ github.repository_owner }}"
+          echo "github_owner=${github_owner,,}" >> "$GITHUB_OUTPUT"
+          dockerhub_owner="${github_owner,,}"
+          if [ "${{ inputs.push }}" = "true" ] && [ "${{ inputs.publish_dockerhub }}" = "true" ]; then
+            if [ -z "$DOCKERHUB_USERNAME" ]; then
+              echo "::error::DOCKERHUB_USERNAME secret is required for Docker Hub publishing"
+              exit 1
+            fi
+            dockerhub_owner="${DOCKERHUB_USERNAME,,}"
+          fi
+          echo "dockerhub_owner=$dockerhub_owner" >> "$GITHUB_OUTPUT"
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ steps.image_namespaces.outputs.dockerhub_owner }}/${{ matrix.image }},enable=${{ inputs.push && inputs.publish_dockerhub }}
+            name=ghcr.io/${{ steps.image_namespaces.outputs.github_owner }}/${{ matrix.image }},enable=true
+          tags: |
+            type=raw,value=dev,enable=${{ inputs.tag_mode == 'dev' }}
+            type=raw,value=latest,enable=${{ inputs.tag_mode == 'release' }}
+            type=raw,value=${{ steps.version.outputs.version }},enable=${{ inputs.tag_mode == 'release' }}
+
+      - name: Build${{ inputs.push && ' & push' || '' }} ${{ matrix.image }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/docker/Dockerfile
+          target: ${{ matrix.target }}
+          platforms: linux/amd64
+          push: ${{ inputs.push }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          # The Dockerfile's version-builder appends a "-<branch>" suffix to the
+          # internal version string for non-main builds. Force "main" on release
+          # (the ref is the tag, not a branch) so release images stay un-suffixed.
+          build-args: |
+            GITHUB_REF_NAME=${{ inputs.tag_mode == 'release' && 'main' || github.ref_name }}
+            REMNAWAVE_MINISHOP_BUILD_PROVENANCE=${{ github.repository == '3252a8/remnawave-minishop' && 'official' || 'custom' }}
+          cache-from: type=gha,scope=${{ matrix.target }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.target }}
+          provenance: false

.github/workflows/ci.yml

@@ -0,0 +1,88 @@
+name: PR checks
+
+# Runs on pull requests into main (typically from dev) and into dev (typically
+# from feature/* branches): lint + format checks, a demo settings-manifest
+# drift guard, and a no-push image build to prove the Docker images still build.
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint & format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install ruff
+        run: pip install "ruff>=0.8.0"
+
+      - name: Ruff lint (Python)
+        run: ruff check .
+
+      - name: Ruff format check (Python)
+        run: ruff format --check .
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend deps
+        run: npm ci
+        working-directory: frontend
+
+      - name: ESLint (frontend)
+        run: npm run lint
+        working-directory: frontend
+
+      - name: Prettier check (frontend)
+        run: npm run format:check
+        working-directory: frontend
+
+  demo-manifest:
+    name: Demo settings manifest in sync
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: backend/requirements.txt
+
+      - name: Install backend deps + pytest
+        run: pip install -r backend/requirements.txt pytest
+
+      # Fails if admin_settings_manifest.py changed without regenerating the
+      # demo snapshot. Fix: `python scripts/export_settings_manifest.py` then
+      # `npx --prefix frontend prettier --write \
+      #   src/lib/webapp/settingsManifest.generated.json`, and commit the result.
+      - name: Check demo settings manifest is in sync
+        run: python -m pytest tests/test_settings_manifest_demo_sync.py -q
+
+  build:
+    name: Docker build
+    uses: ./.github/workflows/_docker-build-push.yml
+    with:
+      push: false
+      tag_mode: dev

.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+name: Dependency review
+
+# On PRs into main/dev, flag any newly added dependency that has a known
+# vulnerability or an incompatible license before it gets merged.
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/docker-dev.yml

@@ -0,0 +1,25 @@
+name: Dev images
+
+# On every push to the dev branch, build all three images and push them to
+# GHCR and Docker Hub tagged `dev`.
+
+on:
+  push:
+    branches: [dev]
+  workflow_dispatch:
+
+concurrency:
+  group: docker-dev-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push:
+    uses: ./.github/workflows/_docker-build-push.yml
+    with:
+      push: true
+      tag_mode: dev
+    secrets: inherit

.github/workflows/docker-release.yml

@@ -0,0 +1,28 @@
+name: Release images
+
+# Build all three images and push them to ghcr.io and Docker Hub tagged
+# `latest` and the release version (the pushed tag with its leading `v`
+# stripped, e.g. v3.4.5 -> 3.4.5). Triggered only when a new v* tag is pushed,
+# so images are built once per release rather than on every commit to main.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: docker-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push:
+    uses: ./.github/workflows/_docker-build-push.yml
+    with:
+      push: true
+      tag_mode: release
+    secrets: inherit

.github/workflows/security.yml

@@ -0,0 +1,96 @@
+name: Security
+
+# Audits the full dependency set (pip-audit, npm audit) and runs a Trivy
+# filesystem scan (dependencies + Dockerfile/IaC misconfig). Trivy results are
+# uploaded to the Security -> Code scanning tab.
+#
+# pip-audit / npm audit are informational (continue-on-error): they surface
+# upstream/transitive advisories that aren't necessarily fixable in a given PR,
+# so they report in the logs without blocking merges. The PR gate for newly
+# introduced vulnerable deps is dependency-review.yml.
+
+on:
+  pull_request:
+    branches: [main, dev]
+  push:
+    branches: [main, dev]
+  schedule:
+    - cron: "27 4 * * 1" # weekly, Monday 04:27 UTC
+  workflow_dispatch:
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  python-audit:
+    name: pip-audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install pip-audit
+        run: pip install pip-audit
+
+      - name: Audit Python dependencies
+        continue-on-error: true
+        run: pip-audit -r backend/requirements.txt
+
+  npm-audit:
+    name: npm audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend deps
+        run: npm ci
+        working-directory: frontend
+
+      - name: Audit npm dependencies
+        continue-on-error: true
+        run: npm audit --audit-level=high
+        working-directory: frontend
+
+  trivy:
+    name: Trivy filesystem scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Trivy
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+
+      - name: Upload Trivy results
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy-fs

.gitignore

@@ -17,6 +17,7 @@ docs-site/.astro/
 docs-site/dist/
 docs-site/public/demo/runtime/
 docs-site/src/content/docs/
+frontend-nginx-dist/
 
 # WebApp build artifacts (regenerated by `npm run build:webapp` / Docker build)
 bot/app/web/templates/subscription_webapp.css

README.md

@@ -16,7 +16,7 @@ Remnawave Minishop - Telegram-бот и Web App (Mini App) для продажи
 - Web App / Mini App с входом через Telegram или email;
 - встроенные инструкции установки в Mini App: личный экран `/install` и публичная ссылка `/s/<token>` для передачи инструкции;
 - пробный период, промокоды и реферальная программа;
-- оплата через YooKassa, FreeKassa, Platega, SeverPay, Wata, CryptoPay, Heleket и Telegram Stars;
+- оплата через YooKassa, FreeKassa, Platega, SeverPay, Wata, CryptoPay, Heleket, PayKilla, LAVA и Telegram Stars;
 - тикеты поддержки в Web App и внешняя ссылка на поддержку;
 - раздел "Мои устройства" при включенном `MY_DEVICES_SECTION_ENABLED`.
 
@@ -43,8 +43,8 @@ Remnawave Minishop - Telegram-бот и Web App (Mini App) для продажи
 - [Telegram-авторизация](docs/features/telegram-auth.md) и [вход по email](docs/features/email-login.md) - настройка BotFather/OAuth и SMTP-логина.
 - [Поддержка пользователей / тикеты](docs/features/support.md) - тикеты в Mini App, входящий список админки, уведомления, лимиты и внешняя ссылка поддержки.
 - [Темы Web App](docs/features/webapp-themes.md) - кастомные темы, настройка внешнего вида, логотипы, CSS/ассеты и пайплайн создания новой темы.
-- [Миграции](docs/migrations/index.md) - готовые сценарии переноса с других ботов; сейчас описан `remnawave-tg-shop`.
-- [Миграция с remnawave-tg-shop](docs/migrations/remnawave-tg-shop.md) - готовый сценарий для legacy-стека.
+- [Миграции](docs/migrations/index.md) - готовые сценарии переноса с `remnawave-tg-shop` и Remnashop.
+- [Миграция с remnawave-tg-shop](docs/migrations/remnawave-tg-shop.md) и [Remnashop](docs/migrations/remnashop.md) - сценарии через общий install wizard.
 
 ## Совместимость
 
@@ -90,6 +90,7 @@ docker compose logs -f backend worker frontend
 - `WEBAPP_SESSION_SECRET`, `WEBHOOK_SECRET_TOKEN` - стабильные секреты;
 - `SUBSCRIPTION_MINI_APP_URL` - публичный HTTPS URL Mini App/frontend, например `https://app.domain.com/`;
 - `PANEL_API_URL`, `PANEL_API_KEY`, `PANEL_WEBHOOK_SECRET` - доступ к Remnawave;
+- `TRUSTED_PROXIES` - оставьте дефолт для Docker/Caddy/Nginx/Newt или укажите IP/CIDR своего reverse proxy, чтобы IP allowlist платежных webhook видел реального провайдера;
 - остальные настройки удобнее задать в Web App админке.
 
 В Remnawave Panel укажите `WEBHOOK_URL` как публичный адрес Minishop с путем `/webhook/panel`, например `https://app.example.com/webhook/panel`. Секрет вебхука задается в самой Remnawave Panel; это же значение вставьте в `PANEL_WEBHOOK_SECRET` в `.env` или в **Система -> Настройки -> Remnawave Panel** в админке.
@@ -98,10 +99,12 @@ docker compose logs -f backend worker frontend
 
 Для каталога тарифов используется `TARIFFS_CONFIG_PATH` со значением по умолчанию `data/tariffs.json`. Пример формата лежит в [data/tariffs.example.json](data/tariffs.example.json), подробности - в [docs/features/tariffs.md](docs/features/tariffs.md).
 
-В compose-примерах `/app/data` монтируется из папки `./data` рядом с `docker-compose.yml`. Заранее создайте каталог и отдайте его пользователю контейнера. Это нужно для сохранения `data/tariffs.json`, каталога тем `data/themes`, кеша логотипа Web App и animated emoji:
+В Docker этот файл должен быть доступен не только `backend` и `worker`, но и одноразовому сервису `migrate`: мигратор читает каталог тарифов при привязке существующих подписок к тарифу по умолчанию. В текущих compose-файлах весь `/app/data` уже смонтирован в `migrate`, `backend` и `worker`; если переносите compose вручную, сохраните одинаковый mount для всех трех сервисов.
+
+В compose-примерах `/app/data` монтируется из папки `./data` рядом с `docker-compose.yml`. Заранее создайте каталог и отдайте его пользователю контейнера. Это нужно для сохранения `data/tariffs.json`, каталога тем `data/themes` и кеша логотипа Web App:
 
 ```bash
-mkdir -p data/themes data/webapp-logo data/webapp-emoji
+mkdir -p data/themes data/webapp-logo data/tariffs
 touch data/locales-overrides.json
 chown -R 10001:10001 data
 chmod -R u+rwX data
@@ -136,15 +139,3 @@ IMAGE_TAG=3.1.0 docker compose up -d
 - `docker.io/3252a8/remnawave-minishop-backend`
 - `docker.io/3252a8/remnawave-minishop-worker`
 - `docker.io/3252a8/remnawave-minishop-frontend`
-
-Сборка и публикация сразу в GHCR и Docker Hub:
-
-```bash
-docker login ghcr.io
-docker login docker.io
-IMAGE_TAG=v3.4.3 bash scripts/docker-build-push-images.sh
-```
-
-## Поддержать проект
-
-- Crypto: `USDT/Other ERC-20 0xeD506D44aae634fEc0E01C8835744fBedb7B2a44 (Ethereum/Polygon/Gnosis)`

backend/bot/app/controllers/dispatcher_controller.py

@@ -17,6 +17,7 @@ from bot.middlewares.channel_subscription import ChannelSubscriptionMiddleware
 from bot.middlewares.db_session import DBSessionMiddleware
 from bot.middlewares.i18n import I18nMiddleware, get_i18n_instance
 from bot.middlewares.profile_sync import ProfileSyncMiddleware
+from bot.middlewares.update_antiflood import UpdateAntiFloodMiddleware
 from config.settings import Settings
 
 
@@ -38,6 +39,7 @@ def build_dispatcher(
     dp["i18n_instance"] = i18n_instance
     dp["async_session_factory"] = async_session_factory
 
+    dp.update.outer_middleware(UpdateAntiFloodMiddleware(settings=settings))
     dp.update.outer_middleware(DBSessionMiddleware(async_session_factory))
     dp.update.outer_middleware(I18nMiddleware(i18n=i18n_instance, settings=settings))
     dp.update.outer_middleware(ProfileSyncMiddleware())

backend/bot/app/factories/build_services.py

@@ -11,6 +11,7 @@ from bot.services.email_auth_service import EmailAuthService
 from bot.services.lknpd_service import LknpdService
 from bot.services.notification_service import NotificationService
 from bot.services.panel_api_service import PanelApiService
+from bot.services.panel_dry_run_api_service import PanelDryRunApiService
 from bot.services.panel_webhook_service import PanelWebhookService
 from bot.services.promo_code_service import PromoCodeService
 from bot.services.referral_service import ReferralService
@@ -26,7 +27,11 @@ def build_core_services(
     i18n: JsonI18n,
     bot_username_for_default_return: str,
 ):
-    panel_service = PanelApiService(settings)
+    panel_service = (
+        PanelDryRunApiService(settings)
+        if bool(getattr(settings, "panel_dry_run_enabled", False))
+        else PanelApiService(settings)
+    )
     subscription_service = SubscriptionService(settings, panel_service, bot, i18n)
     referral_service = ReferralService(settings, subscription_service, bot, i18n)
     promo_code_service = PromoCodeService(settings, subscription_service, bot, i18n)

backend/bot/app/web/admin_api.py

@@ -9,6 +9,7 @@ from bot.app.web.admin_api_impl import (
     backups as _backups,
     broadcast as _broadcast,
     common as _common,
+    health as _health,
     logs as _logs,
     panel as _panel,
     payments as _payments,
@@ -28,6 +29,7 @@ _MODULES = (
     _runtime,
     _auth,
     _common,
+    _health,
     _stats,
     _users,
     _payments,

backend/bot/app/web/admin_api_impl/_runtime.py

@@ -37,7 +37,7 @@ from bot.services.settings_override_service import (
 from bot.utils import MessageContent, send_message_via_queue
 from bot.utils.message_queue import get_queue_manager
 from config.settings import Settings
-from config.tariffs_config import TariffsConfig
+from config.tariffs_config import TariffsConfig, default_payment_currency_code_for_settings
 from db.dal import (
     ad_dal,
     app_settings_dal,

backend/bot/app/web/admin_api_impl/backups.py

@@ -169,12 +169,11 @@ async def admin_backups_restore_route(request: web.Request) -> web.Response:
     except (OSError, subprocess.SubprocessError, TimeoutError) as exc:
         logger.exception("Backup restore failed")
         return _error(500, "backup_restore_failed", str(exc))
-
-    if result.database_restored:
+    finally:
         try:
             from db import database_setup
 
-            if database_setup.async_engine is not None:
+            if restore_database and database_setup.async_engine is not None:
                 await database_setup.async_engine.dispose()
         except Exception:
             logger.exception("Failed to dispose DB engine after backup restore")

backend/bot/app/web/admin_api_impl/broadcast.py

@@ -1,5 +1,165 @@
 # ruff: noqa: F401,F403,F405,I001
 from ._runtime import *  # noqa: F403,F405
+from .common import _panel_user_connection_activity
+
+import asyncio
+from collections import defaultdict
+
+from bot.utils.ttl_cache import AsyncTTLCache
+
+
+BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED = "active_never_connected"
+BROADCAST_TARGETS = {
+    "all",
+    "active",
+    "inactive",
+    "expired",
+    "never",
+    BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED,
+}
+PANEL_ACTIVITY_LOOKUP_CONCURRENCY = 10
+_ADMIN_BROADCAST_AUDIENCE_COUNT_CACHES: Dict[tuple[int, int], AsyncTTLCache] = {}
+
+
+def _resolve_panel_service(request: web.Request) -> Any:
+    subscription_service = request.app.get("subscription_service")
+    return getattr(subscription_service, "panel_service", None)
+
+
+async def _active_subscription_panel_uuids_by_user(
+    session: AsyncSession,
+) -> Dict[int, List[str]]:
+    now = datetime.now(timezone.utc)
+    stmt = (
+        select(Subscription.user_id, Subscription.panel_user_uuid)
+        .join(User, Subscription.user_id == User.user_id)
+        .where(
+            User.is_banned == False,
+            Subscription.is_active == True,
+            Subscription.end_date > now,
+            Subscription.panel_user_uuid.is_not(None),
+            Subscription.panel_user_uuid != "",
+        )
+        .order_by(Subscription.user_id.asc(), Subscription.end_date.desc())
+    )
+    result = await session.execute(stmt)
+
+    grouped: Dict[int, List[str]] = defaultdict(list)
+    seen: Dict[int, set[str]] = defaultdict(set)
+    for user_id, panel_uuid in result.all():
+        user_id_int = int(user_id)
+        panel_uuid_str = str(panel_uuid or "").strip()
+        if panel_uuid_str and panel_uuid_str not in seen[user_id_int]:
+            grouped[user_id_int].append(panel_uuid_str)
+            seen[user_id_int].add(panel_uuid_str)
+    return dict(grouped)
+
+
+async def _panel_connection_status(panel_service: Any, panel_uuid: str) -> str:
+    try:
+        panel_user = await panel_service.get_user_by_uuid(panel_uuid)
+    except Exception as exc:
+        logger.warning("Failed to fetch panel user activity uuid=%s: %s", panel_uuid, exc)
+        return "unknown"
+    activity = _panel_user_connection_activity(panel_user)
+    return str(activity.get("status") or "unknown")
+
+
+async def _user_ids_with_active_subscription_never_connected(
+    session: AsyncSession,
+    panel_service: Any,
+) -> List[int]:
+    panel_uuids_by_user = await _active_subscription_panel_uuids_by_user(session)
+    semaphore = asyncio.Semaphore(PANEL_ACTIVITY_LOOKUP_CONCURRENCY)
+
+    async def lookup(panel_uuid: str) -> str:
+        async with semaphore:
+            return await _panel_connection_status(panel_service, panel_uuid)
+
+    panel_uuids = list(
+        dict.fromkeys(
+            panel_uuid
+            for user_panel_uuids in panel_uuids_by_user.values()
+            for panel_uuid in user_panel_uuids
+        )
+    )
+    statuses_by_uuid = dict(
+        zip(
+            panel_uuids,
+            await asyncio.gather(*(lookup(uuid) for uuid in panel_uuids)),
+        )
+    )
+
+    user_ids: List[int] = []
+    for user_id, panel_uuids in panel_uuids_by_user.items():
+        statuses = [statuses_by_uuid.get(panel_uuid, "unknown") for panel_uuid in panel_uuids]
+        if statuses and all(status == "never" for status in statuses):
+            user_ids.append(user_id)
+    return user_ids
+
+
+def _admin_broadcast_audience_counts_cache(settings: Settings) -> Optional[AsyncTTLCache]:
+    ttl_seconds = int(
+        getattr(settings, "ADMIN_BROADCAST_AUDIENCE_COUNTS_CACHE_TTL_SECONDS", 30) or 0
+    )
+    if ttl_seconds <= 0:
+        return None
+    cache_key = (id(settings), ttl_seconds)
+    cache = _ADMIN_BROADCAST_AUDIENCE_COUNT_CACHES.get(cache_key)
+    if cache is None:
+        cache = AsyncTTLCache(
+            ttl_seconds=ttl_seconds,
+            settings=settings,
+            namespace="admin:broadcast_audience_counts",
+        )
+        _ADMIN_BROADCAST_AUDIENCE_COUNT_CACHES[cache_key] = cache
+    return cache
+
+
+async def _load_broadcast_audience_counts(
+    settings: Settings,
+    async_session_factory: sessionmaker,
+    panel_service: Any,
+) -> Dict[str, Optional[int]]:
+    cache = _admin_broadcast_audience_counts_cache(settings)
+    if cache is None:
+        return await _load_broadcast_audience_counts_uncached(
+            async_session_factory,
+            panel_service,
+        )
+    cache_key = "with-panel" if panel_service is not None else "without-panel"
+    return await cache.get_or_load(
+        cache_key,
+        lambda: _load_broadcast_audience_counts_uncached(
+            async_session_factory,
+            panel_service,
+        ),
+    )
+
+
+async def _load_broadcast_audience_counts_uncached(
+    async_session_factory: sessionmaker,
+    panel_service: Any,
+) -> Dict[str, Optional[int]]:
+    async with async_session_factory() as session:
+        counts: Dict[str, Optional[int]] = {
+            "all": await user_dal.count_all_active_users_for_broadcast(session),
+            "active": await user_dal.count_users_with_active_subscription_for_broadcast(session),
+            "inactive": await user_dal.count_users_without_active_subscription_for_broadcast(
+                session
+            ),
+            "expired": await user_dal.count_users_with_expired_subscription_for_broadcast(session),
+            "never": await user_dal.count_users_without_any_subscription_for_broadcast(session),
+            BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED: None,
+        }
+        if panel_service is not None:
+            counts[BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED] = len(
+                await _user_ids_with_active_subscription_never_connected(
+                    session,
+                    panel_service,
+                )
+            )
+    return counts
 
 
 async def admin_broadcast_route(request: web.Request) -> web.Response:
@@ -9,7 +169,7 @@ async def admin_broadcast_route(request: web.Request) -> web.Response:
     target = str(payload.get("target") or "all").strip().lower()
     if not text:
         return _error(400, "empty_text")
-    if target not in {"all", "active", "inactive"}:
+    if target not in BROADCAST_TARGETS:
         target = "all"
 
     queue_manager = get_queue_manager()
@@ -18,10 +178,22 @@ async def admin_broadcast_route(request: web.Request) -> web.Response:
 
     async_session_factory: sessionmaker = request.app["async_session_factory"]
     async with async_session_factory() as session:
-        if target == "active":
+        if target == BROADCAST_TARGET_ACTIVE_NEVER_CONNECTED:
+            panel_service = _resolve_panel_service(request)
+            if panel_service is None:
+                return _error(503, "panel_service_unavailable")
+            user_ids = await _user_ids_with_active_subscription_never_connected(
+                session,
+                panel_service,
+            )
+        elif target == "active":
             user_ids = await user_dal.get_user_ids_with_active_subscription(session)
         elif target == "inactive":
             user_ids = await user_dal.get_user_ids_without_active_subscription(session)
+        elif target == "expired":
+            user_ids = await user_dal.get_user_ids_with_expired_subscription(session)
+        elif target == "never":
+            user_ids = await user_dal.get_user_ids_without_any_subscription(session)
         else:
             user_ids = await user_dal.get_all_active_user_ids_for_broadcast(session)
 
@@ -52,3 +224,19 @@ async def admin_broadcast_route(request: web.Request) -> web.Response:
         )
 
     return _ok({"queued": sent, "failed": failed, "target": target})
+
+
+async def admin_broadcast_audience_counts_route(request: web.Request) -> web.Response:
+    """Return how many users each broadcast audience currently resolves to."""
+    _require_admin_user_id(request)
+
+    settings: Settings = request.app["settings"]
+    async_session_factory: sessionmaker = request.app["async_session_factory"]
+    panel_service = _resolve_panel_service(request)
+    counts = await _load_broadcast_audience_counts(
+        settings,
+        async_session_factory,
+        panel_service,
+    )
+
+    return _ok({"counts": counts})

backend/bot/app/web/admin_api_impl/common.py

@@ -22,6 +22,175 @@ async def _read_json(request: web.Request) -> Dict[str, Any]:
         return {}
 
 
+_PANEL_LAST_CONNECTED_KEYS = (
+    "onlineAt",
+    "online_at",
+    "lastSeenAt",
+    "last_seen_at",
+    "lastConnectedAt",
+    "last_connected_at",
+    "lastConnectionAt",
+    "last_connection_at",
+)
+_PANEL_CONNECTION_MARKER_KEYS = (
+    *_PANEL_LAST_CONNECTED_KEYS,
+    "firstConnectedAt",
+    "first_connected_at",
+    "lastConnectedNodeUuid",
+    "last_connected_node_uuid",
+)
+_PANEL_CONNECTION_MARKER_OBJECT_KEYS = ("lastConnectedNode", "last_connected_node")
+_PANEL_TRAFFIC_OBJECT_KEYS = ("userTraffic", "user_traffic", "traffic", "trafficStats")
+_PANEL_TRAFFIC_USED_KEYS = (
+    "lifetimeUsedTrafficBytes",
+    "lifetime_used_traffic_bytes",
+    "usedTrafficBytes",
+    "used_traffic_bytes",
+    "trafficUsedBytes",
+    "traffic_used_bytes",
+    "downloadBytes",
+    "download_bytes",
+    "uploadBytes",
+    "upload_bytes",
+)
+
+
+def _panel_user_payload(panel_user_data: Any) -> Dict[str, Any]:
+    if not isinstance(panel_user_data, dict):
+        return {}
+    response = panel_user_data.get("response")
+    if isinstance(response, dict) and not any(
+        key in panel_user_data
+        for key in ("uuid", "shortUuid", "subscriptionUrl", "userTraffic", "status")
+    ):
+        return response
+    return panel_user_data
+
+
+def _coerce_panel_datetime(value: Any) -> Optional[str]:
+    if value is None or value is False:
+        return None
+    if isinstance(value, datetime):
+        return value.isoformat()
+    if isinstance(value, (int, float)):
+        if value <= 0:
+            return None
+        seconds = float(value) / 1000.0 if value > 10_000_000_000 else float(value)
+        try:
+            return datetime.fromtimestamp(seconds, tz=timezone.utc).isoformat()
+        except (OSError, OverflowError, ValueError):
+            return None
+    text = str(value).strip()
+    if not text or text.lower() in {"0", "null", "none", "never"}:
+        return None
+    if text.isdigit():
+        return _coerce_panel_datetime(int(text))
+    try:
+        parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return parsed.isoformat()
+
+
+def _coerce_panel_int(value: Any) -> Optional[int]:
+    try:
+        if value is None or value == "":
+            return None
+        return int(float(value))
+    except (TypeError, ValueError):
+        return None
+
+
+def _panel_nested_dicts(panel_user: Dict[str, Any], keys: Tuple[str, ...]) -> List[Dict[str, Any]]:
+    out: List[Dict[str, Any]] = []
+    for key in keys:
+        value = panel_user.get(key)
+        if isinstance(value, dict):
+            out.append(value)
+    return out
+
+
+def _panel_user_connection_containers(panel_user: Dict[str, Any]) -> List[Dict[str, Any]]:
+    traffic_containers = _panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)
+    marker_containers = _panel_nested_dicts(
+        panel_user,
+        _PANEL_CONNECTION_MARKER_OBJECT_KEYS,
+    )
+    for traffic_container in traffic_containers:
+        marker_containers.extend(
+            _panel_nested_dicts(traffic_container, _PANEL_CONNECTION_MARKER_OBJECT_KEYS)
+        )
+    return [panel_user, *traffic_containers, *marker_containers]
+
+
+def _panel_user_last_connected_at(panel_user_data: Any) -> Optional[str]:
+    panel_user = _panel_user_payload(panel_user_data)
+    if not panel_user:
+        return None
+    for container in _panel_user_connection_containers(panel_user):
+        for key in _PANEL_LAST_CONNECTED_KEYS:
+            connected_at = _coerce_panel_datetime(container.get(key))
+            if connected_at:
+                return connected_at
+    return None
+
+
+def _panel_user_positive_traffic_bytes(panel_user: Dict[str, Any]) -> bool:
+    containers = [panel_user, *_panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)]
+    for container in containers:
+        for key in _PANEL_TRAFFIC_USED_KEYS:
+            value = _coerce_panel_int(container.get(key))
+            if value is not None and value > 0:
+                return True
+    return False
+
+
+def _panel_user_has_connection_marker(panel_user: Dict[str, Any]) -> bool:
+    for container in _panel_user_connection_containers(panel_user):
+        for key in _PANEL_CONNECTION_MARKER_KEYS:
+            if key in container:
+                return True
+    for container in [panel_user, *_panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)]:
+        for key in _PANEL_CONNECTION_MARKER_OBJECT_KEYS:
+            if key in container:
+                return True
+    return False
+
+
+def _panel_user_has_connected_marker_value(panel_user: Dict[str, Any]) -> bool:
+    for container in _panel_user_connection_containers(panel_user):
+        for key in (*_PANEL_LAST_CONNECTED_KEYS, "firstConnectedAt", "first_connected_at"):
+            if _coerce_panel_datetime(container.get(key)):
+                return True
+        for key in ("lastConnectedNodeUuid", "last_connected_node_uuid"):
+            if str(container.get(key) or "").strip():
+                return True
+    for container in [panel_user, *_panel_nested_dicts(panel_user, _PANEL_TRAFFIC_OBJECT_KEYS)]:
+        for key in _PANEL_CONNECTION_MARKER_OBJECT_KEYS:
+            marker = container.get(key)
+            if isinstance(marker, dict) and any(
+                str(value or "").strip() for value in marker.values()
+            ):
+                return True
+            if marker and not isinstance(marker, dict):
+                return True
+    return False
+
+
+def _panel_user_connection_activity(panel_user_data: Any) -> Dict[str, Any]:
+    panel_user = _panel_user_payload(panel_user_data)
+    last_connected_at = _panel_user_last_connected_at(panel_user)
+    if not panel_user:
+        return {"status": "unknown", "last_connected_at": None}
+    if last_connected_at or _panel_user_positive_traffic_bytes(panel_user):
+        return {"status": "connected", "last_connected_at": last_connected_at}
+    if _panel_user_has_connected_marker_value(panel_user):
+        return {"status": "connected", "last_connected_at": last_connected_at}
+    if _panel_user_has_connection_marker(panel_user):
+        return {"status": "never", "last_connected_at": None}
+    return {"status": "unknown", "last_connected_at": None}
+
+
 def _serialize_user(user: User) -> Dict[str, Any]:
     return {
         "user_id": int(user.user_id),
@@ -94,6 +263,9 @@ def _serialize_subscription(sub: Subscription) -> Dict[str, Any]:
     regular_unlimited_override = bool(getattr(sub, "regular_unlimited_override", False))
     premium_unlimited_override = bool(getattr(sub, "premium_unlimited_override", False))
     premium_limit_bytes = _premium_limit_bytes_from_subscription(sub)
+    provider = sub.provider
+    is_trial = str(provider or "").strip().lower() == "trial"
+    display_label = "Trial" if is_trial else sub.tariff_key
     return {
         "subscription_id": int(sub.subscription_id),
         "panel_user_uuid": sub.panel_user_uuid,
@@ -117,9 +289,13 @@ def _serialize_subscription(sub: Subscription) -> Dict[str, Any]:
         "regular_unlimited_override": regular_unlimited_override,
         "premium_unlimited_override": premium_unlimited_override,
         "premium_is_limited": bool(sub.premium_is_limited),
+        "hwid_device_limit": getattr(sub, "hwid_device_limit", None),
+        "extra_hwid_devices": int(getattr(sub, "extra_hwid_devices", 0) or 0),
         "tariff_key": sub.tariff_key,
+        "display_label": display_label,
+        "is_trial": is_trial,
         "auto_renew_enabled": bool(sub.auto_renew_enabled),
-        "provider": sub.provider,
+        "provider": provider,
         "is_throttled": bool(sub.is_throttled),
     }
 

backend/bot/app/web/admin_api_impl/health.py

@@ -0,0 +1,19 @@
+# ruff: noqa: F401,F403,F405,I001
+from datetime import datetime, timezone
+
+from ._runtime import *  # noqa: F403,F405
+from .auth import _require_admin_user_id
+from .common import _ok
+from bot.services.config_health_service import collect_config_alerts
+
+
+async def admin_health_route(request: web.Request) -> web.Response:
+    _require_admin_user_id(request)
+    refresh = str(request.query.get("refresh", "")).strip().lower() in {"1", "true", "yes"}
+    alerts = await collect_config_alerts(request, refresh=refresh)
+    return _ok(
+        {
+            "alerts": alerts,
+            "checked_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )

backend/bot/app/web/admin_api_impl/routes.py

@@ -6,9 +6,11 @@ def setup_admin_routes(app: web.Application) -> None:
     router = app.router
     router.add_get("/api/admin/me", admin_me_route)
     router.add_get("/api/admin/stats", admin_stats_route)
+    router.add_get("/api/admin/health", admin_health_route)
 
     router.add_get("/api/admin/users", admin_users_list_route)
     router.add_get("/api/admin/users/{user_id:-?\\d+}", admin_user_detail_route)
+    router.add_get("/api/admin/users/{user_id:-?\\d+}/referrals", admin_user_referrals_route)
     router.add_get("/api/admin/users/{user_id:-?\\d+}/avatar", admin_user_avatar_route)
     router.add_post("/api/admin/users/{user_id:-?\\d+}/ban", admin_user_ban_route)
     router.add_post("/api/admin/users/{user_id:-?\\d+}/message", admin_user_message_route)
@@ -29,6 +31,10 @@ def setup_admin_routes(app: web.Application) -> None:
         "/api/admin/users/{user_id:-?\\d+}/regular-traffic-override",
         admin_user_regular_traffic_override_route,
     )
+    router.add_post(
+        "/api/admin/users/{user_id:-?\\d+}/hwid-device-limit",
+        admin_user_hwid_device_limit_route,
+    )
     router.add_post(
         "/api/admin/users/{user_id:-?\\d+}/traffic-grant",
         admin_user_traffic_grant_route,
@@ -56,6 +62,7 @@ def setup_admin_routes(app: web.Application) -> None:
     router.add_post("/api/admin/support/tickets/{id:\\d+}/read", admin_support_ticket_read_route)
     router.add_get("/api/admin/support/stats", admin_support_stats_route)
 
+    router.add_get("/api/admin/broadcast/audience-counts", admin_broadcast_audience_counts_route)
     router.add_post("/api/admin/broadcast", admin_broadcast_route)
     router.add_post("/api/admin/sync", admin_sync_route)
 

backend/bot/app/web/admin_api_impl/stats.py

@@ -34,7 +34,7 @@ async def admin_stats_route(request: web.Request) -> web.Response:
         except Exception:  # pragma: no cover - defensive
             payload["queue"] = None
 
-    payload["currency_symbol"] = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+    payload["currency_symbol"] = default_payment_currency_code_for_settings(settings)
     return _ok(payload)
 
 

backend/bot/app/web/admin_api_impl/tariffs.py

@@ -21,9 +21,14 @@ async def admin_tariffs_get_route(request: web.Request) -> web.Response:
                 "path": str(path),
                 "catalog": {
                     "default_tariff": "",
+                    "default_currency": "rub",
                     "topup_packages_default": {"rub": [], "stars": []},
                     "tariffs": [],
                 },
+                "provider_currency_support": _provider_currency_support_payload(
+                    settings,
+                    request.app,
+                ),
             }
         )
 
@@ -32,6 +37,7 @@ async def admin_tariffs_get_route(request: web.Request) -> web.Response:
             "exists": True,
             "path": str(path),
             "catalog": _tariffs_config_payload(config),
+            "provider_currency_support": _provider_currency_support_payload(settings, request.app),
         }
     )
 
@@ -58,4 +64,51 @@ async def admin_tariffs_save_route(request: web.Request) -> web.Response:
 
     await refresh_webapp_runtime_after_settings_change(request, updates={}, deletes=[])
 
-    return _ok({"exists": True, "path": str(path), "catalog": _tariffs_config_payload(config)})
+    return _ok(
+        {
+            "exists": True,
+            "path": str(path),
+            "catalog": _tariffs_config_payload(config),
+            "provider_currency_support": _provider_currency_support_payload(settings, request.app),
+        }
+    )
+
+
+def _provider_currency_support_payload(
+    settings: Settings,
+    app: web.Application,
+) -> List[Dict[str, Any]]:
+    from bot.payment_providers import iter_provider_specs, resolve_provider_presentation
+
+    default_currency = default_payment_currency_code_for_settings(settings)
+    providers: List[Dict[str, Any]] = []
+    for spec in iter_provider_specs():
+        presentation = resolve_provider_presentation(spec, settings)
+        supported = spec.supported_currency_codes(settings)
+        providers.append(
+            {
+                "id": spec.id,
+                "provider_key": spec.provider_key,
+                "label": presentation.webapp_label or spec.label,
+                "telegram_label": presentation.telegram_label,
+                "icon": presentation.webapp_icon,
+                "enabled": spec.is_effectively_enabled(settings),
+                "configured": spec.is_service_configured(app),
+                "admin_only": spec.is_admin_only_enabled(settings),
+                "price_source": spec.price_source,
+                "currencies": list(supported) if supported is not None else None,
+                "accepts_any_currency": supported is None,
+                "supports_default_currency": spec.is_usable_for_payment_currency(
+                    settings,
+                    default_currency,
+                ),
+                "directly_supports_default_currency": spec.supports_currency(
+                    settings,
+                    default_currency,
+                ),
+                "default_currency": default_currency,
+                "note": spec.currency_support_note,
+                "docs_url": spec.currency_support_url,
+            }
+        )
+    return providers

backend/bot/app/web/admin_api_impl/themes.py

@@ -25,7 +25,6 @@ WEBAPP_UPLOADED_LOGO_DIR = Path(__file__).resolve().parents[5] / "data" / "webap
 WEBAPP_UPLOADED_LOGO_PATH = "/webapp-uploaded-logo"
 WEBAPP_FAVICON_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-logo" / "favicons"
 WEBAPP_FAVICON_PATH = "/webapp-favicon"
-WEBAPP_EMOJI_CACHE_DIR = Path(__file__).resolve().parents[5] / "data" / "webapp-emoji"
 WEBAPP_FAVICON_SIZES = (16, 32, 48, 180, 192, 512)
 WEBAPP_LOGO_UPLOAD_CONTENT_TYPES = {
     ".gif": "image/gif",
@@ -136,10 +135,6 @@ def _favicon_digest(url: str) -> Optional[str]:
     return match.group(1) if match else None
 
 
-def _emoji_to_codepoints(value: str) -> str:
-    return "_".join(f"{ord(char):x}" for char in str(value or "").strip())
-
-
 def prune_unused_appearance_assets(settings: Settings) -> None:
     keep_logos = {
         filename
@@ -156,15 +151,6 @@ def prune_unused_appearance_assets(settings: Settings) -> None:
         ]
         if digest
     }
-    keep_emoji_prefixes = set()
-    if (
-        getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False)
-        and str(getattr(settings, "WEBAPP_LOGO_EMOJI_FONT", "") or "").strip()
-        == "noto-color-animated"
-    ):
-        codepoints = _emoji_to_codepoints(getattr(settings, "WEBAPP_LOGO_EMOJI", ""))
-        if codepoints:
-            keep_emoji_prefixes.add(f"{codepoints}.512.")
 
     for path in WEBAPP_UPLOADED_LOGO_DIR.glob("logo-*"):
         if path.is_file() and path.name not in keep_logos:
@@ -184,15 +170,6 @@ def prune_unused_appearance_assets(settings: Settings) -> None:
             except OSError:
                 logger.warning("Failed to remove unused webapp favicon set %s", path, exc_info=True)
 
-    for path in WEBAPP_EMOJI_CACHE_DIR.glob("*.512.*"):
-        if path.is_file() and not any(
-            path.name.startswith(prefix) for prefix in keep_emoji_prefixes
-        ):
-            try:
-                path.unlink()
-            except OSError:
-                logger.warning("Failed to remove unused webapp emoji asset %s", path, exc_info=True)
-
 
 async def _persist_appearance_upload(
     request: web.Request,
@@ -389,7 +366,6 @@ async def admin_appearance_logo_upload_route(request: web.Request) -> web.Respon
         request,
         {
             "WEBAPP_LOGO_URL": logo_url,
-            "WEBAPP_LOGO_USE_EMOJI": False,
             **(
                 {"WEBAPP_LOGO_FAVICON_URL": favicon_payload["favicon_url"]}
                 if favicon_payload.get("favicon_url")

backend/bot/app/web/admin_api_impl/users.py

@@ -5,6 +5,7 @@ from .common import (
     _build_admin_webapp_referral_link,
     _error,
     _ok,
+    _panel_user_connection_activity,
     _premium_traffic_list_payload,
     _read_json,
     _serialize_payment,
@@ -16,6 +17,7 @@ import hashlib
 from html import escape as html_escape
 
 from aiogram.types import InlineKeyboardButton, InlineKeyboardMarkup
+from sqlalchemy.orm import aliased
 
 from bot.app.web.webapp.cache_helpers import invalidate_webapp_user_caches
 from bot.infra.redis import cache_delete_pattern, redis_key
@@ -127,12 +129,15 @@ async def _load_admin_users_list_payload_uncached(
         active_subs = await _bulk_active_subscriptions_for_users(
             session, [u.user_id for u in users]
         )
+        payment_summaries = await _bulk_user_payment_summaries(session, [u.user_id for u in users])
+        referral_counts = await _bulk_user_referral_counts(session, [u.user_id for u in users])
 
     serialized = []
     for user in users:
         payload = _serialize_user(user)
         status_payload = statuses.get(user.user_id) or {"status": "bot_only", "end_date": None}
         payload["panel_status"] = status_payload.get("status")
+        payload["subscription_expires_at"] = status_payload.get("end_date")
         if status_payload.get("status") == "expired" and status_payload.get("end_date"):
             payload["panel_status_expired_at"] = status_payload["end_date"]
         payload["avatar_url"] = (
@@ -141,6 +146,11 @@ async def _load_admin_users_list_payload_uncached(
             else None
         )
         payload["premium_traffic"] = _premium_traffic_list_payload(active_subs.get(user.user_id))
+        payment_summary = payment_summaries.get(user.user_id) or {}
+        payload["payments_total_amount"] = float(payment_summary.get("total_amount") or 0)
+        payload["payments_count"] = int(payment_summary.get("count") or 0)
+        payload["payments_currency"] = payment_summary.get("currency")
+        payload["invited_users_count"] = int(referral_counts.get(user.user_id) or 0)
         serialized.append(payload)
 
     return {
@@ -255,6 +265,17 @@ async def _bulk_user_avatar_keys(session: AsyncSession, user_ids: List[int]) ->
     return {int(uid): (updated_at.isoformat() if updated_at else "") for uid, updated_at in rows}
 
 
+def _serialize_admin_user_with_avatar(user: User, avatar_keys: Dict[int, str]) -> Dict[str, Any]:
+    payload = _serialize_user(user)
+    user_id = int(user.user_id)
+    payload["avatar_url"] = (
+        f"/api/admin/users/{user_id}/avatar?v={avatar_keys[user_id]}"
+        if user_id in avatar_keys
+        else None
+    )
+    return payload
+
+
 async def admin_user_avatar_route(request: web.Request) -> web.Response:
     """Serve the cached Telegram avatar for any user (admin-only).
 
@@ -353,6 +374,88 @@ async def _bulk_active_subscriptions_for_users(
     return out
 
 
+def _user_payment_summary_sq():
+    return (
+        select(
+            Payment.user_id.label("user_id"),
+            sa_func.coalesce(sa_func.sum(Payment.amount), 0.0).label("payments_total_amount"),
+            sa_func.count(Payment.payment_id).label("payments_count"),
+        )
+        .where(Payment.status == "succeeded")
+        .group_by(Payment.user_id)
+        .subquery(name="user_payment_summary")
+    )
+
+
+def _user_referral_count_sq():
+    referred_user = aliased(User)
+    return (
+        select(
+            referred_user.referred_by_id.label("user_id"),
+            sa_func.count(referred_user.user_id).label("invited_users_count"),
+        )
+        .where(referred_user.referred_by_id.is_not(None))
+        .group_by(referred_user.referred_by_id)
+        .subquery(name="user_referral_count")
+    )
+
+
+def _user_subscription_expiry_sq():
+    return (
+        select(
+            Subscription.user_id.label("user_id"),
+            sa_func.max(Subscription.end_date).label("subscription_expires_at"),
+        )
+        .group_by(Subscription.user_id)
+        .subquery(name="user_subscription_expiry")
+    )
+
+
+async def _bulk_user_payment_summaries(
+    session: AsyncSession,
+    user_ids: List[int],
+) -> Dict[int, Dict[str, Any]]:
+    if not user_ids:
+        return {}
+
+    stmt = (
+        select(
+            Payment.user_id,
+            sa_func.coalesce(sa_func.sum(Payment.amount), 0.0),
+            sa_func.count(Payment.payment_id),
+            sa_func.max(Payment.currency),
+        )
+        .where(Payment.user_id.in_(user_ids), Payment.status == "succeeded")
+        .group_by(Payment.user_id)
+    )
+    rows = (await session.execute(stmt)).all()
+    return {
+        int(user_id): {
+            "total_amount": float(total_amount or 0),
+            "count": int(payments_count or 0),
+            "currency": currency,
+        }
+        for user_id, total_amount, payments_count, currency in rows
+    }
+
+
+async def _bulk_user_referral_counts(
+    session: AsyncSession,
+    user_ids: List[int],
+) -> Dict[int, int]:
+    if not user_ids:
+        return {}
+
+    referred_user = aliased(User)
+    stmt = (
+        select(referred_user.referred_by_id, sa_func.count(referred_user.user_id))
+        .where(referred_user.referred_by_id.in_(user_ids))
+        .group_by(referred_user.referred_by_id)
+    )
+    rows = (await session.execute(stmt)).all()
+    return {int(user_id): int(count or 0) for user_id, count in rows}
+
+
 async def _filter_and_sort_users(
     session: AsyncSession,
     *,
@@ -381,6 +484,13 @@ async def _filter_and_sort_users(
     ratio_expr = None
     plim_expr = None
     pu_expr = None
+    payment_summary_sq = None
+    payment_total_expr = None
+    payment_count_expr = None
+    referral_count_sq = None
+    referral_count_expr = None
+    subscription_expiry_sq = None
+    subscription_expires_expr = None
 
     if needs_premium_sq:
         sq = _ranked_active_subscriptions_sq(now)
@@ -401,6 +511,42 @@ async def _filter_and_sort_users(
             else_=cast(pu_expr, Float) / cast(plim_expr, Float),
         )
 
+    if sort_key in {
+        "payments_total_asc",
+        "payments_total_desc",
+        "payments_count_asc",
+        "payments_count_desc",
+    }:
+        payment_summary_sq = _user_payment_summary_sq()
+        stmt = stmt.outerjoin(payment_summary_sq, User.user_id == payment_summary_sq.c.user_id)
+        count_stmt = count_stmt.outerjoin(
+            payment_summary_sq,
+            User.user_id == payment_summary_sq.c.user_id,
+        )
+        payment_total_expr = sa_func.coalesce(payment_summary_sq.c.payments_total_amount, 0.0)
+        payment_count_expr = sa_func.coalesce(payment_summary_sq.c.payments_count, 0)
+
+    if sort_key in {"invited_users_count_asc", "invited_users_count_desc"}:
+        referral_count_sq = _user_referral_count_sq()
+        stmt = stmt.outerjoin(referral_count_sq, User.user_id == referral_count_sq.c.user_id)
+        count_stmt = count_stmt.outerjoin(
+            referral_count_sq,
+            User.user_id == referral_count_sq.c.user_id,
+        )
+        referral_count_expr = sa_func.coalesce(referral_count_sq.c.invited_users_count, 0)
+
+    if sort_key in {"subscription_expires_at_asc", "subscription_expires_at_desc"}:
+        subscription_expiry_sq = _user_subscription_expiry_sq()
+        stmt = stmt.outerjoin(
+            subscription_expiry_sq,
+            User.user_id == subscription_expiry_sq.c.user_id,
+        )
+        count_stmt = count_stmt.outerjoin(
+            subscription_expiry_sq,
+            User.user_id == subscription_expiry_sq.c.user_id,
+        )
+        subscription_expires_expr = subscription_expiry_sq.c.subscription_expires_at
+
     search_cond = _user_search_condition(query)
     if search_cond is not None:
         stmt = stmt.where(search_cond)
@@ -499,6 +645,22 @@ async def _filter_and_sort_users(
         stmt = stmt.order_by(ratio_expr.asc().nullslast(), User.user_id.asc())
     elif needs_premium_sq and ratio_expr is not None and sort_key == "premium_ratio_desc":
         stmt = stmt.order_by(ratio_expr.desc().nullslast(), User.user_id.desc())
+    elif payment_total_expr is not None and sort_key == "payments_total_asc":
+        stmt = stmt.order_by(payment_total_expr.asc(), User.user_id.asc())
+    elif payment_total_expr is not None and sort_key == "payments_total_desc":
+        stmt = stmt.order_by(payment_total_expr.desc(), User.user_id.desc())
+    elif payment_count_expr is not None and sort_key == "payments_count_asc":
+        stmt = stmt.order_by(payment_count_expr.asc(), User.user_id.asc())
+    elif payment_count_expr is not None and sort_key == "payments_count_desc":
+        stmt = stmt.order_by(payment_count_expr.desc(), User.user_id.desc())
+    elif referral_count_expr is not None and sort_key == "invited_users_count_asc":
+        stmt = stmt.order_by(referral_count_expr.asc(), User.user_id.asc())
+    elif referral_count_expr is not None and sort_key == "invited_users_count_desc":
+        stmt = stmt.order_by(referral_count_expr.desc(), User.user_id.desc())
+    elif subscription_expires_expr is not None and sort_key == "subscription_expires_at_asc":
+        stmt = stmt.order_by(subscription_expires_expr.asc().nullslast(), User.user_id.asc())
+    elif subscription_expires_expr is not None and sort_key == "subscription_expires_at_desc":
+        stmt = stmt.order_by(subscription_expires_expr.desc().nullslast(), User.user_id.desc())
     else:
         order = sort_map.get(sort_key, sort_map["registered_desc"])
         if isinstance(order, tuple):
@@ -527,9 +689,34 @@ def _user_panel_status_condition(panel_status: str):
             normalized_status == "active", blank_status & Subscription.is_active.is_(True)
         )
     elif status == "expired":
-        status_cond = or_(
-            normalized_status == "expired", blank_status & Subscription.is_active.is_(False)
+        now = datetime.now(timezone.utc)
+        expired_subs = aliased(Subscription)
+        active_subs = aliased(Subscription)
+        expired_status = sa_func.lower(sa_func.coalesce(expired_subs.status_from_panel, ""))
+        expired_blank_status = or_(
+            expired_subs.status_from_panel.is_(None),
+            expired_subs.status_from_panel == "",
         )
+        expired_condition = or_(
+            expired_status == "expired",
+            expired_blank_status & expired_subs.is_active.is_(False),
+            expired_subs.end_date <= now,
+        )
+        expired_exists = (
+            select(expired_subs.subscription_id)
+            .where(expired_subs.user_id == User.user_id, expired_condition)
+            .exists()
+        )
+        active_exists = (
+            select(active_subs.subscription_id)
+            .where(
+                active_subs.user_id == User.user_id,
+                active_subs.is_active.is_(True),
+                active_subs.end_date > now,
+            )
+            .exists()
+        )
+        return and_(expired_exists, ~active_exists)
     else:
         status_cond = normalized_status == "limited"
 
@@ -559,6 +746,24 @@ def _user_search_condition(query: str):
     return or_(*conditions)
 
 
+def _serialize_trial_summary(user: User, trial_subs: List[Subscription]) -> Dict[str, Any]:
+    first_trial_sub = trial_subs[0] if trial_subs else None
+    latest_trial_sub = trial_subs[-1] if trial_subs else None
+    first_start = getattr(first_trial_sub, "start_date", None)
+    latest_start = getattr(latest_trial_sub, "start_date", None)
+    latest_end = getattr(latest_trial_sub, "end_date", None)
+    reset_at = getattr(user, "trial_eligibility_reset_at", None)
+    return {
+        "used": bool(trial_subs),
+        "count": len(trial_subs),
+        "first_activated_at": first_start.isoformat() if first_start else None,
+        "latest_activated_at": latest_start.isoformat() if latest_start else None,
+        "latest_end_date": latest_end.isoformat() if latest_end else None,
+        "active": bool(latest_trial_sub and getattr(latest_trial_sub, "is_active", False)),
+        "last_reset_at": reset_at.isoformat() if reset_at else None,
+    }
+
+
 async def admin_user_detail_route(request: web.Request) -> web.Response:
     _require_admin_user_id(request)
     target_id = int(request.match_info["user_id"])
@@ -578,6 +783,15 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
             .limit(20)
         )
         latest_subs = (await session.execute(latest_subs_stmt)).scalars().all()
+        trial_subs_stmt = (
+            select(Subscription)
+            .where(
+                Subscription.user_id == target_id,
+                sa_func.lower(sa_func.coalesce(Subscription.provider, "")) == "trial",
+            )
+            .order_by(Subscription.start_date.asc().nullslast(), Subscription.end_date.asc())
+        )
+        trial_subs = (await session.execute(trial_subs_stmt)).scalars().all()
         total_paid = await payment_dal.get_user_total_paid(session, target_id)
         recent_payments_stmt = (
             select(Payment)
@@ -587,7 +801,12 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
         )
         recent_payments = (await session.execute(recent_payments_stmt)).scalars().all()
         log_count = await message_log_dal.count_user_message_logs(session, target_id)
-        avatar_keys = await _bulk_user_avatar_keys(session, [target_id])
+        inviter = await user_dal.get_referrer_for_user(session, user)
+        invitees_total = await user_dal.count_users_referred_by(session, target_id)
+        avatar_user_ids = [target_id]
+        if inviter is not None:
+            avatar_user_ids.append(int(inviter.user_id))
+        avatar_keys = await _bulk_user_avatar_keys(session, avatar_user_ids)
 
         # Referral links — both the bot deep-link and the webapp deep-link.
         referral_code: Optional[str] = None
@@ -618,7 +837,13 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
     # imports into their VPN client. May be missing if the user has never
     # been provisioned on the panel.
     subscription_url: Optional[str] = None
-    panel_uuid = getattr(user, "panel_user_uuid", None)
+    last_vpn_connected_at: Optional[str] = None
+    vpn_connection_status = "unknown"
+    panel_uuid = getattr(user, "panel_user_uuid", None) or getattr(
+        active_sub,
+        "panel_user_uuid",
+        None,
+    )
     if panel_uuid:
         subscription_service = request.app.get("subscription_service")
         panel_service = getattr(subscription_service, "panel_service", None)
@@ -627,39 +852,87 @@ async def admin_user_detail_route(request: web.Request) -> web.Response:
                 panel_data = await panel_service.get_user_by_uuid(panel_uuid)
                 if panel_data:
                     subscription_url = panel_data.get("subscriptionUrl") or None
+                    vpn_activity = _panel_user_connection_activity(panel_data)
+                    vpn_connection_status = str(vpn_activity.get("status") or "unknown")
+                    last_vpn_connected_at = vpn_activity.get("last_connected_at")
             except Exception as exc_panel:  # pragma: no cover
                 logger.warning(
-                    "Failed to fetch subscriptionUrl for user %s (uuid=%s): %s",
+                    "Failed to fetch panel details for user %s (uuid=%s): %s",
                     target_id,
                     panel_uuid,
                     exc_panel,
                 )
 
-    serialized_user = _serialize_user(user)
-    serialized_user["avatar_url"] = (
-        f"/api/admin/users/{target_id}/avatar?v={avatar_keys[target_id]}"
-        if target_id in avatar_keys
-        else None
+    serialized_user = _serialize_admin_user_with_avatar(user, avatar_keys)
+    serialized_inviter = (
+        _serialize_admin_user_with_avatar(inviter, avatar_keys) if inviter is not None else None
     )
+    trial_payload = _serialize_trial_summary(user, trial_subs)
 
     return _ok(
         {
             "user": serialized_user,
             "active_subscription": _serialize_subscription(active_sub) if active_sub else None,
             "subscriptions": [_serialize_subscription(s) for s in (latest_subs or [])],
+            "trial": trial_payload,
             "total_paid": float(total_paid),
             "recent_payments": [_serialize_payment(p) for p in recent_payments],
             "log_count": int(log_count or 0),
             "subscription_url": subscription_url,
+            "last_vpn_connected_at": last_vpn_connected_at,
+            "vpn_connection_status": vpn_connection_status,
             "referral": {
                 "code": referral_code,
                 "bot_link": referral_bot_link,
                 "webapp_link": referral_webapp_link,
+                "inviter": serialized_inviter,
+                "invitees_total": int(invitees_total or 0),
             },
         }
     )
 
 
+async def admin_user_referrals_route(request: web.Request) -> web.Response:
+    _require_admin_user_id(request)
+    target_id = int(request.match_info["user_id"])
+    page = max(0, int(request.query.get("page", 0) or 0))
+    page_size = min(100, max(1, int(request.query.get("page_size", 25) or 25)))
+    async_session_factory: sessionmaker = request.app["async_session_factory"]
+
+    async with async_session_factory() as session:
+        user = await user_dal.get_user_by_id(session, target_id)
+        if not user:
+            return _error(404, "not_found", "User not found")
+
+        inviter = await user_dal.get_referrer_for_user(session, user)
+        invitees_total = await user_dal.count_users_referred_by(session, target_id)
+        invitees = await user_dal.get_users_referred_by(
+            session,
+            target_id,
+            limit=page_size,
+            offset=page * page_size,
+        )
+        avatar_user_ids = [target_id, *(int(u.user_id) for u in invitees)]
+        if inviter is not None:
+            avatar_user_ids.append(int(inviter.user_id))
+        avatar_keys = await _bulk_user_avatar_keys(session, avatar_user_ids)
+
+    return _ok(
+        {
+            "user": _serialize_admin_user_with_avatar(user, avatar_keys),
+            "inviter": _serialize_admin_user_with_avatar(inviter, avatar_keys)
+            if inviter is not None
+            else None,
+            "invitees": [
+                _serialize_admin_user_with_avatar(invitee, avatar_keys) for invitee in invitees
+            ],
+            "total": int(invitees_total or 0),
+            "page": page,
+            "page_size": page_size,
+        }
+    )
+
+
 async def admin_user_ban_route(request: web.Request) -> web.Response:
     _require_admin_user_id(request)
     target_id = int(request.match_info["user_id"])
@@ -940,10 +1213,6 @@ async def admin_user_reset_trial_route(request: web.Request) -> web.Response:
     actor_id = _require_admin_user_id(request)
     target_id = int(request.match_info["user_id"])
     settings: Settings = request.app["settings"]
-    panel_service = request.app.get("panel_service")
-    subscription_service = request.app.get("subscription_service")
-    if panel_service is None or subscription_service is None:
-        return _error(503, "service_unavailable")
 
     async_session_factory: sessionmaker = request.app["async_session_factory"]
     async with async_session_factory() as session:
@@ -951,16 +1220,17 @@ async def admin_user_reset_trial_route(request: web.Request) -> web.Response:
         if not user:
             return _error(404, "not_found")
 
-        active = await subscription_dal.get_active_subscription_by_user_id(session, target_id)
-        if active:
-            await session.delete(active)
+        reset_at = await user_dal.mark_trial_eligibility_reset(session, target_id)
+        if reset_at is None:
+            await session.rollback()
+            return _error(404, "not_found")
 
-        await message_log_dal.create_message_log(
+        await message_log_dal.create_message_log_no_commit(
             session,
             {
                 "user_id": actor_id,
                 "event_type": "admin_reset_trial_webapp",
-                "content": f"Reset trial for user_id={target_id}",
+                "content": f"Reset trial eligibility for user_id={target_id}",
                 "is_admin_event": True,
                 "target_user_id": target_id,
             },
@@ -1031,7 +1301,7 @@ async def admin_user_premium_override_route(request: web.Request) -> web.Respons
 
 
 async def admin_user_regular_traffic_override_route(request: web.Request) -> web.Response:
-    """Main (regular) traffic: unlimited-style ceiling + admin bonus GB."""
+    """Main (regular) traffic: native unlimited panel limit + admin bonus GB."""
     actor_id = _require_admin_user_id(request)
     target_id = int(request.match_info["user_id"])
     settings: Settings = request.app["settings"]
@@ -1089,6 +1359,78 @@ async def admin_user_regular_traffic_override_route(request: web.Request) -> web
     return _ok({"subscription": _serialize_subscription(active)})
 
 
+async def admin_user_hwid_device_limit_route(request: web.Request) -> web.Response:
+    """Override the user's base HWID device limit.
+
+    ``hwid_device_limit == 0`` means unlimited; ``NULL`` means the tariff/.env
+    default is used. Purchased extra devices remain tracked separately and are
+    added when syncing the effective panel limit.
+    """
+    actor_id = _require_admin_user_id(request)
+    target_id = int(request.match_info["user_id"])
+    settings: Settings = request.app["settings"]
+    payload = await _read_json(request)
+
+    unlimited = bool(payload.get("unlimited"))
+    use_default = bool(payload.get("use_default") or payload.get("reset_to_default"))
+    limit_raw = payload.get("hwid_device_limit", payload.get("limit"))
+
+    if unlimited:
+        hwid_device_limit: Optional[int] = 0
+    elif use_default or limit_raw is None or limit_raw == "":
+        hwid_device_limit = None
+    else:
+        try:
+            hwid_device_limit = int(limit_raw)
+        except (TypeError, ValueError):
+            return _error(
+                400,
+                "invalid_hwid_device_limit",
+                "hwid_device_limit must be a non-negative integer",
+            )
+        if hwid_device_limit < 0 or hwid_device_limit > 1_000_000:
+            return _error(
+                400,
+                "invalid_hwid_device_limit",
+                "hwid_device_limit must be an integer from 0 to 1000000",
+            )
+
+    subscription_service = request.app.get("subscription_service")
+
+    async_session_factory: sessionmaker = request.app["async_session_factory"]
+    async with async_session_factory() as session:
+        active = await subscription_dal.get_active_subscription_by_user_id(session, target_id)
+        if not active:
+            return _error(404, "no_active_subscription")
+
+        active.hwid_device_limit = hwid_device_limit
+
+        effective_limit = None
+        if subscription_service is not None:
+            effective_limit = await subscription_service.sync_hwid_device_limit_to_panel(
+                session, target_id
+            )
+
+        await message_log_dal.create_message_log(
+            session,
+            {
+                "user_id": actor_id,
+                "event_type": "admin_hwid_device_limit_webapp",
+                "content": (
+                    f"hwid_device_limit={hwid_device_limit!r} "
+                    f"effective_hwid_device_limit={effective_limit!r}"
+                ),
+                "is_admin_event": True,
+                "target_user_id": target_id,
+            },
+        )
+        await session.commit()
+        await session.refresh(active)
+
+    await _invalidate_after_admin_user_mutation(settings, target_id)
+    return _ok({"subscription": _serialize_subscription(active)})
+
+
 async def admin_user_traffic_grant_route(request: web.Request) -> web.Response:
     """Credit regular or premium traffic to a user without a payment.
 
@@ -1185,6 +1527,8 @@ async def admin_user_extend_route(request: web.Request) -> web.Response:
         return _error(400, "invalid_days")
     if days <= 0:
         return _error(400, "invalid_days")
+    extend_hwid_devices = payload.get("extend_hwid_devices")
+    extend_hwid_devices = True if extend_hwid_devices is None else bool(extend_hwid_devices)
 
     subscription_service = request.app.get("subscription_service")
     if subscription_service is None:
@@ -1197,6 +1541,7 @@ async def admin_user_extend_route(request: web.Request) -> web.Response:
             target_id,
             days,
             "admin_extend_subscription_webapp",
+            extend_hwid_devices=extend_hwid_devices,
         )
         if not new_end:
             await session.rollback()
@@ -1207,7 +1552,10 @@ async def admin_user_extend_route(request: web.Request) -> web.Response:
             {
                 "user_id": actor_id,
                 "event_type": "admin_extend_subscription_webapp",
-                "content": f"+{days}d -> {new_end.isoformat()}",
+                "content": (
+                    f"+{days}d -> {new_end.isoformat()} "
+                    f"(hwid={'yes' if extend_hwid_devices else 'no'})"
+                ),
                 "is_admin_event": True,
                 "target_user_id": target_id,
             },

backend/bot/app/web/admin_api_impl/webapp_runtime.py

@@ -13,9 +13,6 @@ WEBAPP_APPEARANCE_SETTING_KEYS = frozenset(
     {
         "WEBAPP_TITLE",
         "WEBAPP_LOGO_URL",
-        "WEBAPP_LOGO_USE_EMOJI",
-        "WEBAPP_LOGO_EMOJI",
-        "WEBAPP_LOGO_EMOJI_FONT",
         "WEBAPP_FAVICON_URL",
         "WEBAPP_FAVICON_USE_CUSTOM",
         "WEBAPP_LOGO_FAVICON_URL",

backend/bot/app/web/admin_settings_manifest.py

@@ -65,7 +65,6 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "SUPPORT_LINK", "url", "general", "Ссылка поддержки", "Куда вести пользователей за помощью."
     ),
     SettingField("SERVER_STATUS_URL", "url", "general", "Ссылка на статус серверов"),
-    SettingField("TERMS_OF_SERVICE_URL", "url", "general", "Условия использования"),
     SettingField("PRIVACY_POLICY_URL", "url", "general", "Политика конфиденциальности"),
     SettingField("USER_AGREEMENT_URL", "url", "general", "Пользовательское соглашение"),
     SettingField("DISABLE_WELCOME_MESSAGE", "bool", "general", "Скрыть приветствие /start"),
@@ -77,14 +76,20 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "int",
         "general",
         "ID обязательного канала",
-        "Telegram ID канала, в котором нужно состоять.",
+        (
+            "Telegram ID канала для проверки подписки. Если бот видит канал, "
+            "ссылка кнопки будет получена автоматически."
+        ),
     ),
     SettingField(
         "REQUIRED_CHANNEL_LINK",
         "string",
         "general",
         "Ссылка на канал",
-        "Имя пользователя или invite-link.",
+        (
+            "Необязательно: публичный @username или invite-link, "
+            "если ссылку нельзя получить по ID канала."
+        ),
     ),
     SettingField(
         "PANEL_API_URL",
@@ -101,6 +106,42 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "Секретный ключ API панели.",
         secret=True,
     ),
+    SettingField(
+        "PANEL_API_TOTAL_TIMEOUT_SECONDS",
+        "float",
+        "remnawave",
+        "Panel API total timeout",
+        "Maximum total time for one Remnawave API request, in seconds.",
+        optional=False,
+        min=1,
+    ),
+    SettingField(
+        "PANEL_API_CONNECT_TIMEOUT_SECONDS",
+        "float",
+        "remnawave",
+        "Panel API connect timeout",
+        "Maximum time to get or open a Remnawave API connection, in seconds.",
+        optional=False,
+        min=1,
+    ),
+    SettingField(
+        "PANEL_API_SOCK_CONNECT_TIMEOUT_SECONDS",
+        "float",
+        "remnawave",
+        "Panel API socket connect timeout",
+        "Maximum TCP/TLS connection time for Remnawave API, in seconds.",
+        optional=False,
+        min=1,
+    ),
+    SettingField(
+        "PANEL_API_SOCK_READ_TIMEOUT_SECONDS",
+        "float",
+        "remnawave",
+        "Panel API socket read timeout",
+        "Maximum time to wait for response data from Remnawave API, in seconds.",
+        optional=False,
+        min=1,
+    ),
     SettingField(
         "PANEL_WEBHOOK_SECRET",
         "string",
@@ -139,27 +180,7 @@ SETTINGS_MANIFEST: List[SettingField] = [
     SettingField(
         "WEBAPP_PRIMARY_COLOR", "color", "appearance", "Основной цвет", placeholder="#00fe7a"
     ),
-    SettingField("WEBAPP_LOGO_USE_EMOJI", "bool", "appearance", "Использовать эмоджи-логотип"),
     SettingField("WEBAPP_LOGO_URL", "url", "appearance", "URL логотипа"),
-    SettingField("WEBAPP_LOGO_EMOJI", "string", "appearance", "Эмоджи-логотип", placeholder="🫥"),
-    SettingField(
-        "WEBAPP_LOGO_EMOJI_FONT",
-        "string",
-        "appearance",
-        "Шрифт эмоджи-логотипа",
-        "Выберите шрифт для отображения эмодзи-логотипа",
-        choices=(
-            ("system", "Системный (по умолчанию)"),
-            ("noto-color", "Noto Color Emoji"),
-            ("noto-color-animated", "Noto Color Emoji Animated"),
-            ("noto-emoji", "Noto Emoji"),
-            ("twemoji", "Twitter Emoji"),
-            ("openmoji", "OpenMoji"),
-            ("apple", "Apple Color Emoji (local)"),
-            ("segoe", "Segoe UI Emoji (local)"),
-            ("noto-local", "Noto Emoji (local)"),
-        ),
-    ),
     SettingField(
         "WEBAPP_FAVICON_USE_CUSTOM",
         "bool",
@@ -327,6 +348,16 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "Английская версия текста на этапе оплаты.",
         subsection="checkout",
     ),
+    SettingField(
+        "PAYMENT_REQUEST_TIMEOUT_SECONDS",
+        "float",
+        "payments",
+        "Таймаут запроса к провайдеру",
+        "Максимальное общее время одного API-запроса к платёжному провайдеру, в секундах.",
+        optional=False,
+        min=1,
+        subsection="checkout",
+    ),
     # ─── Payment providers (toggles) ───────────────────────────────
     # Common
     SettingField("STARS_ENABLED", "bool", "payments", "Telegram Stars", subsection="common"),
@@ -348,7 +379,7 @@ SETTINGS_MANIFEST: List[SettingField] = [
         "string",
         "payments",
         "Порядок методов оплаты",
-        "Через запятую: severpay,freekassa,yookassa,platega,stars,cryptopay,heleket",
+        "Через запятую: severpay,freekassa,yookassa,platega,stars,cryptopay,heleket,paykilla,lava",
         subsection="common",
     ),
     # ─── Trial ─────────────────────────────────────────────────────
@@ -386,6 +417,18 @@ SETTINGS_MANIFEST: List[SettingField] = [
         optional=False,
         subsection="trial",
     ),
+    SettingField(
+        "TRIAL_WITHOUT_TELEGRAM_ENABLED",
+        "bool",
+        "pricing",
+        "Триал без Telegram",
+        (
+            "Если выключено, email-only пользователю нужно привязать Telegram для "
+            "активации триала. Disposable email домены всегда требуют Telegram."
+        ),
+        optional=False,
+        subsection="trial",
+    ),
     SettingField(
         "TRIAL_SQUAD_UUIDS",
         "string",
@@ -396,12 +439,82 @@ SETTINGS_MANIFEST: List[SettingField] = [
     ),
     # ─── Referral program ──────────────────────────────────────────
     SettingField(
-        "REFERRAL_ONE_BONUS_PER_REFEREE", "bool", "referral", "Один бонус на приглашённого"
+        "REFERRAL_ONE_BONUS_PER_REFEREE",
+        "bool",
+        "pricing",
+        "Один бонус на приглашённого",
+        subsection="referral",
     ),
     SettingField(
-        "REFERRAL_WELCOME_BONUS_DAYS", "int", "referral", "Приветственный бонус (дней)", min=0
+        "REFERRAL_WELCOME_BONUS_DAYS",
+        "int",
+        "pricing",
+        "Приветственный бонус (дней)",
+        min=0,
+        subsection="referral",
+    ),
+    SettingField(
+        "REFERRAL_WELCOME_BONUS_WITHOUT_TELEGRAM_ENABLED",
+        "bool",
+        "pricing",
+        "Приветственный бонус без Telegram",
+        (
+            "Если выключено, email-only пользователю нужно привязать Telegram для получения "
+            "реферального приветственного бонуса. Disposable email домены всегда требуют Telegram."
+        ),
+        subsection="referral",
+    ),
+    SettingField(
+        "LEGACY_REFS",
+        "bool",
+        "pricing",
+        "Поддержка старых ref-ссылок",
+        subsection="referral",
+    ),
+    SettingField(
+        "DISPOSABLE_EMAIL_DOMAINS",
+        "text",
+        "pricing",
+        "Disposable email домены",
+        (
+            "Домены по одному на строку или через запятую. Пользователи без Telegram с такими "
+            "email не смогут получить trial или реферальный приветственный бонус."
+        ),
+        placeholder="mailinator.com\ntemp-mail.org\nyopmail.com",
+        subsection="referral",
+    ),
+    SettingField(
+        "MIGRATION_REMNASHOP_REFERRAL_CODE_COMPAT_ENABLED",
+        "bool",
+        "migrations",
+        "Старые ref-ссылки Remnashop",
+        "Принимать импортированные ref-коды Remnashop вместе с текущими кодами пользователей.",
+        subsection="Remnashop",
+    ),
+    SettingField(
+        "MIGRATION_REMNASHOP_PROMO_CODE_COMPAT_ENABLED",
+        "bool",
+        "migrations",
+        "Старые промокоды Remnashop",
+        "Пробовать точное совпадение промокода перед обычной uppercase-нормализацией.",
+        subsection="Remnashop",
+    ),
+    SettingField(
+        "MIGRATION_REMNASHOP_IMPORTED_AT",
+        "string",
+        "migrations",
+        "Последний импорт Remnashop",
+        "Заполняется скриптом импорта. Можно очистить, если отметка больше не нужна.",
+        subsection="Remnashop",
+    ),
+    SettingField(
+        "MIGRATION_REMNASHOP_NOTES",
+        "text",
+        "migrations",
+        "Заметки по миграции Remnashop",
+        "Внутренние заметки оператора по перенесенному инстансу.",
+        subsection="Remnashop",
     ),
-    SettingField("LEGACY_REFS", "bool", "referral", "Поддержка старых ref-ссылок"),
     # ─── Notifications ─────────────────────────────────────────────
     SettingField(
         "SUBSCRIPTION_NOTIFICATIONS_ENABLED",
@@ -588,6 +701,132 @@ SETTINGS_MANIFEST: List[SettingField] = [
     ),
     SettingField("USER_TRAFFIC_LIMIT_GB", "float", "devices", "Лимит трафика пользователя (ГБ)"),
     SettingField("USER_TRAFFIC_STRATEGY", "string", "devices", "Стратегия сброса трафика"),
+    # ─── System ────────────────────────────────────────────────────
+    SettingField(
+        "TELEGRAM_DROP_NON_PRIVATE_UPDATES",
+        "bool",
+        "system",
+        "Drop non-private Telegram updates",
+        "Drops group/channel messages and callbacks before DB-backed middleware runs.",
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_ENABLED",
+        "bool",
+        "system",
+        "Telegram anti-flood enabled",
+        "Enables soft per-user limits for extreme Telegram update floods.",
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_WINDOW_SECONDS",
+        "int",
+        "system",
+        "Anti-flood window",
+        "Rolling window, in seconds, used by all Telegram anti-flood buckets.",
+        min=1,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_MAX_UPDATES_PER_WINDOW",
+        "int",
+        "system",
+        "All updates limit",
+        "Maximum total Telegram updates from one actor during the window. 0 disables this bucket.",
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_MESSAGE_MAX_PER_WINDOW",
+        "int",
+        "system",
+        "Messages limit",
+        "Maximum message updates from one actor during the window. 0 disables this bucket.",
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_CALLBACK_MAX_PER_WINDOW",
+        "int",
+        "system",
+        "Button callbacks limit",
+        "Maximum callback-query updates from one actor during the window. 0 disables this bucket.",
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_INLINE_MAX_PER_WINDOW",
+        "int",
+        "system",
+        "Inline queries limit",
+        "Maximum inline-query updates from one actor during the window. 0 disables this bucket.",
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_START_MAX_PER_WINDOW",
+        "int",
+        "system",
+        "/start limit",
+        "Maximum /start messages from one actor during the window. 0 disables this bucket.",
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ANTIFLOOD_EXPENSIVE_CALLBACK_MAX_PER_WINDOW",
+        "int",
+        "system",
+        "Expensive callbacks limit",
+        (
+            "Maximum payment, trial, promo and account-changing callbacks from one actor "
+            "during the window. 0 disables this bucket."
+        ),
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_ACTION_COOLDOWN_ENABLED",
+        "bool",
+        "system",
+        "Action cooldowns enabled",
+        "Deduplicates repeated payment and trial button presses from the same user.",
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_PAYMENT_CALLBACK_COOLDOWN_SECONDS",
+        "int",
+        "system",
+        "Payment callback cooldown",
+        (
+            "Seconds to suppress an exact repeated payment callback from the same user. "
+            "0 disables this cooldown."
+        ),
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEGRAM_TRIAL_CALLBACK_COOLDOWN_SECONDS",
+        "int",
+        "system",
+        "Trial callback cooldown",
+        (
+            "Seconds to suppress an exact repeated trial activation callback from the same user. "
+            "0 disables this cooldown."
+        ),
+        min=0,
+        subsection="telegram_antiflood",
+    ),
+    SettingField(
+        "TELEMETRY_ENABLED",
+        "bool",
+        "system",
+        "Анонимная статистика установки",
+        "Раз в сутки отправляет обезличенный сигнал: версия, маркер образа "
+        "official/custom, ОС, локаль и число пользователей в виде диапазона. Без персональных "
+        "данных, токенов и доменов. Помогает понять число активных установок, какие "
+        "версии используются и долю изменённых сборок. Можно отключить здесь без "
+        "перезапуска.",
+    ),
 ]
 
 
@@ -722,6 +961,8 @@ def manifest_payload() -> List[dict]:
         "backups": 9,
         "devices": 10,
         "subscription_guides": 10,
+        "system": 12,
+        "migrations": 13,
     }
     exclusive_map = {
         key: opposite

backend/bot/app/web/templates/open_app_gateway.html

@@ -8,11 +8,18 @@
     <style nonce="__NONCE__">
       :root {
         color-scheme: dark light;
+        --accent: #14b86f;
+        --accent-contrast: #03120b;
+        --bg: #0b1017;
+        --panel-3: #344052;
+        --border: #2d3847;
+        --text: #f7fafc;
+        --muted: #aeb8c5;
         font-family:
           Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont,
           "Segoe UI", sans-serif;
-        background: #0b1017;
-        color: #f7fafc;
+        background: var(--bg);
+        color: var(--text);
       }
 
       body {
@@ -39,7 +46,7 @@
 
       p {
         margin: 0;
-        color: #aeb8c5;
+        color: var(--muted);
         font-size: 15px;
         line-height: 1.55;
       }
@@ -57,8 +64,8 @@
         justify-content: center;
         border: 1px solid transparent;
         border-radius: 8px;
-        background: #14b86f;
-        color: #03120b;
+        background: var(--accent);
+        color: var(--accent-contrast);
         padding: 0 18px;
         box-sizing: border-box;
         font: inherit;
@@ -68,15 +75,15 @@
       }
 
       .button.secondary {
-        border-color: #2d3847;
+        border-color: var(--border);
         background: transparent;
-        color: #f7fafc;
+        color: var(--text);
       }
 
       .button[aria-disabled="true"] {
         pointer-events: none;
-        background: #344052;
-        color: #aeb8c5;
+        background: var(--panel-3);
+        color: var(--muted);
       }
 
       [hidden] {
@@ -109,6 +116,8 @@
         let attempted = false;
         let pageLeft = false;
         let state = "opening";
+        let closeAttemptTimer = null;
+        const CLOSE_ATTEMPT_DELAY_MS = 2500;
 
         function hasControlChars(value) {
           return Array.from(String(value || "")).some((char) => {
@@ -167,7 +176,10 @@
         function markDone() {
           if (state === "done" || isUnsafe) return;
           render("done");
-          window.setTimeout(tryCloseWindow, 120);
+          if (closeAttemptTimer) window.clearTimeout(closeAttemptTimer);
+          closeAttemptTimer = window.setTimeout(() => {
+            if (pageLeft || document.hidden) tryCloseWindow();
+          }, CLOSE_ATTEMPT_DELAY_MS);
         }
 
         function notePageLeft() {
@@ -201,7 +213,6 @@
           render("done");
         });
         window.addEventListener("pagehide", notePageLeft);
-        window.addEventListener("blur", notePageLeft);
         document.addEventListener("visibilitychange", () => {
           if (!attempted) return;
           if (document.hidden) {

backend/bot/app/web/templates/subscription_webapp.html

@@ -22,7 +22,7 @@
       sizes="180x180"
       href="/apple-touch-icon-precomposed.png"
     />
-    <title>/minishop</title>
+    <title>Subscription</title>
     <link rel="stylesheet" href="/subscription_webapp.css" />
     <style>
       .app-boot-fallback {

backend/bot/app/web/themes/ascii/style.css

@@ -168,6 +168,7 @@
 .theme-key-ascii .admin-toolbar-card,
 .theme-key-ascii .admin-table-card,
 .theme-key-ascii .admin-panel-dash-card,
+.theme-key-ascii .admin-config-alerts,
 .theme-key-ascii .admin-select-trigger,
 .theme-key-ascii .admin-select-content,
 .theme-key-ascii .admin-cn-card[data-slot="card"],
@@ -199,7 +200,8 @@
 .theme-key-ascii .admin-tabs-trigger,
 .theme-key-ascii .admin-revenue-period-btn,
 .theme-key-ascii .admin-mobile-toggle,
-.theme-key-ascii .admin-nav-item {
+.theme-key-ascii .admin-nav-item,
+.theme-key-ascii .admin-config-alert-link {
   border: 1px solid #ffffff;
   border-radius: 0;
   background: #000000;
@@ -216,7 +218,8 @@
 .theme-key-ascii .admin-nav-item:hover,
 .theme-key-ascii .admin-tabs-trigger:hover,
 .theme-key-ascii .admin-revenue-period-btn:hover,
-.theme-key-ascii .bottom-nav button:hover {
+.theme-key-ascii .bottom-nav button:hover,
+.theme-key-ascii .admin-config-alert-link:hover {
   background: #ffffff;
   color: #000000;
 }
@@ -318,6 +321,133 @@
   box-shadow: inset 0 0 0 1px #ffffff;
 }
 
+/* ---------- Admin controls: range sliders and sortable rows ---------- */
+
+.theme-key-ascii .ui-range-input {
+  height: 20px;
+}
+
+.theme-key-ascii .ui-range-input::before {
+  height: 8px;
+  border: 1px solid #ffffff;
+  background: #000000;
+}
+
+.theme-key-ascii .ui-range-input__range {
+  height: 8px;
+  background: #ffffff;
+}
+
+.theme-key-ascii .ui-range-input__thumb {
+  width: 16px;
+  height: 18px;
+  border: 1px solid #ffffff;
+  border-radius: 0;
+  background: #000000;
+  box-shadow: none;
+  transition: none;
+}
+
+.theme-key-ascii .ui-range-input__thumb:hover,
+.theme-key-ascii .ui-range-input__thumb:focus-visible {
+  background: #ffffff;
+  color: #000000;
+  box-shadow: 0 0 0 1px #000000;
+}
+
+.theme-key-ascii .ui-sortable {
+  --sortable-drop-line: #ffffff;
+  --sortable-drop-soft: rgba(255, 255, 255, 0.08);
+  gap: 6px;
+}
+
+.theme-key-ascii .ui-sortable-item.is-dragging {
+  opacity: 0.72;
+}
+
+.theme-key-ascii .ui-sortable-item.is-drop-target {
+  outline: 1px dashed #ffffff;
+  outline-offset: 2px;
+  background: rgba(255, 255, 255, 0.08);
+  box-shadow: none;
+}
+
+.theme-key-ascii .ui-sortable-item.is-drop-target::before {
+  top: -5px;
+  height: 1px;
+  border-radius: 0;
+  background: #ffffff;
+  box-shadow: none;
+}
+
+.theme-key-ascii .ui-sortable-handle {
+  align-self: center;
+  height: 28px;
+  border: 1px solid #ffffff;
+  background: #000000;
+  color: #ffffff;
+  box-shadow: none;
+}
+
+.theme-key-ascii .ui-sortable-handle:hover,
+.theme-key-ascii .ui-sortable-handle:focus-visible,
+.theme-key-ascii .ui-sortable-handle:active {
+  background: #ffffff;
+  color: #000000;
+}
+
+/* ---------- Admin health config alerts ---------- */
+
+.theme-key-ascii .admin-config-alerts {
+  position: relative;
+  padding-left: 18px;
+  color: #ffffff;
+}
+
+.theme-key-ascii .admin-config-alerts::before {
+  content: "!";
+  position: absolute;
+  top: 11px;
+  left: 7px;
+  color: #ffffff;
+  font-family: var(--font-mono);
+  font-weight: 700;
+}
+
+.theme-key-ascii .admin-config-alerts-error {
+  border-color: #ff5555;
+  color: #ffaaaa;
+}
+
+.theme-key-ascii .admin-config-alerts-error::before {
+  color: #ff5555;
+}
+
+.theme-key-ascii .admin-config-alert-dot {
+  width: auto;
+  height: auto;
+  border-radius: 0;
+  background: transparent;
+  color: currentColor;
+  transform: none;
+}
+
+.theme-key-ascii .admin-config-alert-dot::before {
+  content: ">";
+  font-family: var(--font-mono);
+}
+
+.theme-key-ascii .admin-config-alert-error .admin-config-alert-dot {
+  background: transparent;
+  color: #ff5555;
+}
+
+.theme-key-ascii .admin-config-alert-link {
+  padding: 1px 7px;
+  font-family: var(--font-mono);
+  opacity: 1;
+}
+
 /* ---------- New webapp surfaces: support, purchase info, password login ---------- */
 
 .theme-key-ascii .trial-offer-card,
@@ -1104,6 +1234,7 @@ body:has(.theme-key-ascii) .install-platform-item[data-selected] svg {
   .admin-cn-card-skeleton--tall,
   .admin-input, .admin-textarea, .admin-btn, .admin-chip,
   .admin-tabs-trigger, .admin-tabs-list,
+  .ui-range-input__thumb, .ui-sortable-item, .ui-sortable-handle,
   .admin-nav-item, .admin-revenue-period-btn, .admin-mobile-toggle,
   .admin-header, .admin-sidebar, .admin-sidebar-brand,
   .admin-dialog,
@@ -1243,3 +1374,51 @@ body:has(.theme-key-ascii) .install-platform-item[data-selected] svg {
 .theme-key-ascii table tbody tr:hover td {
   color: #ffffff;
 }
+
+/* ============================================================
+ * Newer webapp surfaces: telegram banner, traffic/referral
+ * dropdowns, login language picker. Flatten the accent pills,
+ * rounded badges and colored gradients these ship with so they
+ * read as plain console boxes.
+ * ============================================================ */
+
+/* Telegram notifications banner: the .card chrome is already
+ * flattened above; only the rounded, color-tinted icon badge needs
+ * squaring off (the Send glyph itself is whitened by the global rule). */
+.theme-key-ascii .telegram-notifications-icon {
+  border: 1px solid #ffffff;
+  border-radius: 0;
+  background: #000000;
+  color: #ffffff;
+}
+
+/* Premium-server / referral-tariff dropdown help glyph: drop the
+ * pill background in every state (the accent maps to white here,
+ * which would otherwise paint a white blob behind the icon). */
+.theme-key-ascii .premium-server-help-icon,
+.theme-key-ascii .premium-server-dropdown summary:hover .premium-server-help-icon,
+.theme-key-ascii .premium-server-dropdown[open] .premium-server-help-icon,
+.theme-key-ascii .referral-tariff-dropdown summary:hover .premium-server-help-icon,
+.theme-key-ascii .referral-tariff-dropdown[open] .premium-server-help-icon {
+  padding: 0;
+  border-radius: 0;
+  background: transparent;
+  color: #ffffff;
+}
+
+/* The check on the selected language sits on a solid white row, so a
+ * white glyph would vanish — invert it to black to keep it readable. */
+.theme-key-ascii .language-select-item[data-selected] .language-select-item-check {
+  color: #000000 !important;
+  stroke: #000000 !important;
+}
+
+/* Login-screen language trigger: square the rounded chip. */
+.theme-key-ascii .auth-language-trigger {
+  border-radius: 0;
+}
+
+/* Render flag emoji as monochrome glyphs to stay in the console palette. */
+.theme-key-ascii .emoji-flag {
+  filter: grayscale(1) contrast(1.05);
+}

backend/bot/app/web/themes/ascii/theme.json

@@ -9,7 +9,7 @@
   "use_primary_accent": false,
   "use_in_admin": true,
   "css_file": "style.css",
-  "assets_version": 4,
+  "assets_version": 7,
   "tokens": {
     "color_scheme": "dark",
     "style_preset": "ascii"

backend/bot/app/web/themes/light/style.css

@@ -204,3 +204,77 @@ body:has(.theme-key-light) .install-platform-item[data-selected] {
 .theme-key-light .install-loading .ui-spinner {
   color: color-mix(in srgb, var(--accent) 55%, #000000);
 }
+
+/* Admin controls: range sliders and sortable rows */
+
+.theme-key-light .ui-range-input::before {
+  background: rgba(15, 23, 42, 0.12);
+}
+
+.theme-key-light .ui-range-input__range {
+  background: color-mix(in srgb, var(--accent) 70%, #0f172a);
+}
+
+.theme-key-light .ui-range-input__thumb {
+  border-color: color-mix(in srgb, var(--accent) 68%, #0f172a);
+  background: #ffffff;
+  box-shadow: 0 2px 8px rgba(15, 23, 42, 0.18);
+}
+
+.theme-key-light .ui-range-input__thumb:focus-visible {
+  box-shadow: 0 0 0 4px color-mix(in srgb, var(--accent) 18%, transparent);
+}
+
+.theme-key-light .ui-sortable-handle {
+  border-radius: 6px;
+  color: color-mix(in srgb, var(--admin-muted) 82%, var(--admin-text));
+}
+
+.theme-key-light .ui-sortable-handle:hover,
+.theme-key-light .ui-sortable-handle:focus-visible {
+  background: rgba(15, 23, 42, 0.055);
+  color: color-mix(in srgb, var(--accent) 58%, #0f172a);
+}
+
+.theme-key-light .ui-sortable {
+  --sortable-drop-line: color-mix(in srgb, var(--accent) 64%, #0f172a);
+}
+
+.theme-key-light .ui-sortable-item.is-drop-target {
+  background: color-mix(in srgb, var(--accent) 8%, #ffffff);
+  box-shadow:
+    inset 0 0 0 1px color-mix(in srgb, var(--accent) 26%, transparent),
+    0 10px 22px color-mix(in srgb, var(--accent) 7%, transparent);
+}
+
+.theme-key-light .ui-sortable-item.is-drop-target::before {
+  background: var(--sortable-drop-line);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 14%, transparent);
+}
+
+/* Admin health config alerts */
+
+.theme-key-light .admin-config-alerts {
+  border-color: color-mix(in srgb, var(--warning) 38%, var(--admin-border));
+  background: color-mix(in srgb, var(--warning) 9%, #ffffff);
+  box-shadow: 0 8px 20px rgba(15, 23, 42, 0.06);
+}
+
+.theme-key-light .admin-config-alerts-error {
+  border-color: color-mix(in srgb, var(--danger) 38%, var(--admin-border));
+  background: color-mix(in srgb, var(--danger) 8%, #ffffff);
+}
+
+.theme-key-light .admin-config-alert-link {
+  background: rgba(255, 255, 255, 0.58);
+}
+
+.theme-key-light .admin-config-alert-link:hover {
+  background: #ffffff;
+}
+
+/* Telegram notifications banner: keep the warm warning tint but swap the
+ * dark-theme inset bevel for the soft drop shadow the other light cards use. */
+.theme-key-light .telegram-notifications-card {
+  box-shadow: 0 8px 20px rgba(15, 23, 42, 0.07);
+}

backend/bot/app/web/themes/light/theme.json

@@ -9,7 +9,7 @@
   "use_primary_accent": true,
   "use_in_admin": true,
   "css_file": "style.css",
-  "assets_version": 3,
+  "assets_version": 6,
   "tokens": {
     "color_scheme": "light"
   }

backend/bot/app/web/themes/windows95/style.css

@@ -127,6 +127,7 @@
 .theme-key-windows95 svg.lucide-file-text,
 .theme-key-windows95 svg.lucide-gift,
 .theme-key-windows95 svg.lucide-globe-2,
+.theme-key-windows95 svg.lucide-grip-vertical,
 .theme-key-windows95 svg.lucide-home,
 .theme-key-windows95 svg.lucide-house,
 .theme-key-windows95 svg.lucide-info,
@@ -232,6 +233,10 @@
   --win95-button-icon: var(--win95-icon-globe);
 }
 
+.theme-key-windows95 svg.lucide-grip-vertical {
+  --win95-button-icon: var(--win95-icon-sliders);
+}
+
 .theme-key-windows95 svg.lucide-file-text {
   --win95-button-icon: var(--win95-icon-file-text);
 }
@@ -375,6 +380,7 @@
   svg.lucide-file-text,
   svg.lucide-gift,
   svg.lucide-globe-2,
+  svg.lucide-grip-vertical,
   svg.lucide-home,
   svg.lucide-house,
   svg.lucide-info,
@@ -1171,6 +1177,149 @@ body:has(.theme-key-windows95) .install-platform-item[data-selected] {
   opacity: 0.52;
 }
 
+/* Admin controls: range sliders and sortable rows */
+
+.theme-key-windows95 .ui-range-input {
+  height: 22px;
+}
+
+.theme-key-windows95 .ui-range-input::before {
+  height: 8px;
+  border: 2px solid;
+  border-color: #404040 #ffffff #ffffff #404040;
+  border-radius: 0 !important;
+  background: #ffffff;
+  box-shadow:
+    inset 1px 1px 0 #808080,
+    inset -1px -1px 0 #dfdfdf;
+}
+
+.theme-key-windows95 .ui-range-input__range {
+  height: 8px;
+  border-radius: 0 !important;
+  background: var(--accent);
+}
+
+.theme-key-windows95 .ui-range-input__thumb {
+  width: 14px;
+  height: 20px;
+  border: 2px solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  border-radius: 0 !important;
+  background: #c0c0c0;
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+  transition: none;
+}
+
+.theme-key-windows95 .ui-range-input__thumb:hover,
+.theme-key-windows95 .ui-range-input__thumb:focus-visible {
+  background: #dfdfdf;
+}
+
+.theme-key-windows95 .ui-range-input__thumb[data-active] {
+  border-color: #404040 #ffffff #ffffff #404040;
+  box-shadow:
+    inset 1px 1px 0 #808080,
+    inset -1px -1px 0 #dfdfdf;
+}
+
+.theme-key-windows95 .ui-sortable-item.is-drop-target {
+  outline: 1px dotted #000000;
+  outline-offset: 3px;
+  background: color-mix(in srgb, var(--accent) 12%, var(--admin-surface));
+}
+
+.theme-key-windows95 .ui-sortable-item.is-drop-target::before {
+  top: -7px;
+  height: 2px;
+  border-radius: 0;
+  background: #000080;
+  box-shadow:
+    0 1px 0 #ffffff,
+    0 -1px 0 #000000;
+}
+
+.theme-key-windows95 .ui-sortable-handle {
+  align-self: center;
+  width: 24px;
+  height: 28px;
+  border: 2px solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  background: #c0c0c0;
+  color: #000000;
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+  transition: none;
+}
+
+.theme-key-windows95 .ui-sortable-handle:hover,
+.theme-key-windows95 .ui-sortable-handle:focus-visible {
+  background: #dfdfdf;
+}
+
+.theme-key-windows95 .ui-sortable-handle:active {
+  border-color: #404040 #ffffff #ffffff #404040;
+  box-shadow:
+    inset 1px 1px 0 #808080,
+    inset -1px -1px 0 #dfdfdf;
+}
+
+/* Admin health config alerts */
+
+.theme-key-windows95 .admin-config-alerts {
+  border: 2px solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  background: #ffffcc;
+  color: #000000;
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+}
+
+.theme-key-windows95 .admin-config-alerts-error {
+  border-color: #ffffff #404040 #404040 #ffffff;
+  background: #f7d6d6;
+  color: #000000;
+}
+
+.theme-key-windows95 .admin-config-alert-dot {
+  border-radius: 0;
+  background: #808000;
+  box-shadow:
+    1px 1px 0 #ffffff,
+    -1px -1px 0 #404040;
+}
+
+.theme-key-windows95 .admin-config-alert-error .admin-config-alert-dot {
+  background: #800000;
+}
+
+.theme-key-windows95 .admin-config-alert-link {
+  border: 2px solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  border-radius: 0;
+  background: #c0c0c0;
+  color: #000000;
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+  opacity: 1;
+}
+
+.theme-key-windows95 .admin-config-alert-link:hover {
+  background: #dfdfdf;
+}
+
+.theme-key-windows95 .admin-config-alert-link:active {
+  border-color: #404040 #ffffff #ffffff #404040;
+  box-shadow:
+    inset 1px 1px 0 #808080,
+    inset -1px -1px 0 #dfdfdf;
+}
+
 .theme-key-windows95 input::placeholder,
 .theme-key-windows95 textarea::placeholder,
 .theme-key-windows95 .input::placeholder,
@@ -1352,3 +1501,64 @@ body:has(.theme-key-windows95) .install-platform-item[data-selected] {
 .theme-key-windows95 a:not(.btn):not(.bottom-nav button):not([class*="-trigger"]):visited {
   color: #800080;
 }
+
+/* ---------- Newer webapp surfaces: telegram banner, traffic /
+ * referral dropdowns, login language picker ---------- */
+
+/* Telegram notifications banner: the Card chrome is already beveled by
+ * the shared .card rule; give the icon badge a raised chip look instead
+ * of the rounded, color-tinted default (the Send glyph maps to send.png). */
+.theme-key-windows95 .telegram-notifications-icon {
+  border-width: 2px;
+  border-style: solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  border-radius: 0;
+  background: var(--panel);
+  color: var(--text);
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+}
+
+/* Standalone referral-tariff dropdown and bonus rows: bevel them like the
+ * rest of the surfaces so they don't read as flat 1px boxes. */
+.theme-key-windows95 .referral-tariff-dropdown,
+.theme-key-windows95 .referral-bonus-row {
+  border-width: 2px;
+  border-style: solid;
+  border-color: #ffffff #404040 #404040 #ffffff;
+  border-radius: 0;
+  background: var(--panel);
+  box-shadow:
+    inset 1px 1px 0 #dfdfdf,
+    inset -1px -1px 0 #808080;
+}
+
+.theme-key-windows95 .referral-bonus-row-nested {
+  background: #dfdfdf;
+}
+
+/* Premium-server / referral help glyph: drop the rounded accent pill so it
+ * sits inline as a plain stroked question mark. */
+.theme-key-windows95 .premium-server-help-icon,
+.theme-key-windows95 .premium-server-dropdown summary:hover .premium-server-help-icon,
+.theme-key-windows95 .premium-server-dropdown[open] .premium-server-help-icon,
+.theme-key-windows95 .referral-tariff-dropdown summary:hover .premium-server-help-icon,
+.theme-key-windows95 .referral-tariff-dropdown[open] .premium-server-help-icon {
+  padding: 0;
+  border-radius: 0;
+  background: transparent;
+  color: var(--text);
+}
+
+/* The selected language row turns navy; its check maps to a dark bitmap,
+ * so invert it to white to keep it visible. */
+.theme-key-windows95 .language-select-item[data-highlighted] .language-select-item-check,
+.theme-key-windows95 .language-select-item[data-selected] .language-select-item-check {
+  filter: brightness(0) invert(1);
+}
+
+/* Login-screen language trigger: square the rounded chip. */
+.theme-key-windows95 .auth-language-trigger {
+  border-radius: 0;
+}

backend/bot/app/web/themes/windows95/theme.json

@@ -9,7 +9,7 @@
   "use_primary_accent": false,
   "use_in_admin": true,
   "css_file": "style.css",
-  "assets_version": 11,
+  "assets_version": 14,
   "tokens": {
     "color_scheme": "light",
     "style_preset": "win95"

backend/bot/app/web/web_server.py

@@ -1,13 +1,17 @@
 import asyncio
+import functools
 import hmac
 import logging
+from typing import Awaitable, Callable, Optional
 
 from aiogram import Bot, Dispatcher
 from aiogram.webhook.aiohttp_server import SimpleRequestHandler, setup_application
 from aiohttp import web
+from aiohttp.web_log import AccessLogger, KeyMethod
 from sqlalchemy.orm import sessionmaker
 
 from bot.payment_providers import iter_provider_specs, iter_service_keys
+from bot.utils.request_security import request_client_ip
 from config.settings import Settings
 
 
@@ -18,6 +22,39 @@ class SecureSimpleRequestHandler(SimpleRequestHandler):
         return hmac.compare_digest(telegram_secret_token, self.secret_token)
 
 
+class TrustedProxyAccessLogger(AccessLogger):
+    """Aiohttp access logger that respects trusted X-Forwarded-For headers."""
+
+    def compile_format(self, log_format):
+        methods = []
+        for atom in self.FORMAT_RE.findall(log_format):
+            if atom[1] == "":
+                format_key = self.LOG_FORMAT_MAP[atom[0]]
+                method = getattr(type(self), f"_format_{atom[0]}", None)
+                if method is None:
+                    method = getattr(AccessLogger, f"_format_{atom[0]}")
+                methods.append(KeyMethod(format_key, method))
+            else:
+                format_key = (self.LOG_FORMAT_MAP[atom[2]], atom[1])
+                method = getattr(type(self), f"_format_{atom[2]}", None)
+                if method is None:
+                    method = getattr(AccessLogger, f"_format_{atom[2]}")
+                methods.append(KeyMethod(format_key, functools.partial(method, atom[1])))
+
+        compiled = self.FORMAT_RE.sub(r"%s", log_format)
+        compiled = self.CLEANUP_RE.sub(r"%\1", compiled)
+        return compiled, methods
+
+    @staticmethod
+    def _format_a(request, response, time):
+        if request is None:
+            return "-"
+        settings = request.app.get("settings") if hasattr(request, "app") else None
+        trusted_proxies = getattr(settings, "trusted_proxies", None)
+        client_ip = request_client_ip(request, trusted_proxies=trusted_proxies)
+        return client_ip or "-"
+
+
 def _inject_shared_instances(
     app: web.Application,
     dp: Dispatcher,
@@ -48,6 +85,8 @@ async def build_and_start_web_app(
     bot: Bot,
     settings: Settings,
     async_session_factory: sessionmaker,
+    *,
+    after_webhooks_started: Optional[Callable[[], Awaitable[None]]] = None,
 ):
     app = web.Application()
     _inject_shared_instances(app, dp, bot, settings, async_session_factory)
@@ -110,7 +149,7 @@ async def build_and_start_web_app(
 
     runners = []
 
-    webhooks_runner = web.AppRunner(app)
+    webhooks_runner = web.AppRunner(app, access_log_class=TrustedProxyAccessLogger)
     await webhooks_runner.setup()
     runners.append(webhooks_runner)
     site = web.TCPSite(
@@ -123,6 +162,8 @@ async def build_and_start_web_app(
     logging.info(
         f"AIOHTTP server started on http://{settings.WEB_SERVER_HOST}:{settings.WEB_SERVER_PORT}"
     )
+    if after_webhooks_started is not None:
+        await after_webhooks_started()
 
     if settings.WEBAPP_ENABLED:
         from bot.app.web.subscription_webapp import create_subscription_webapp_application
@@ -133,7 +174,10 @@ async def build_and_start_web_app(
             settings,
             async_session_factory,
         )
-        subscription_runner = web.AppRunner(subscription_app)
+        subscription_runner = web.AppRunner(
+            subscription_app,
+            access_log_class=TrustedProxyAccessLogger,
+        )
         await subscription_runner.setup()
         runners.append(subscription_runner)
         subscription_site = web.TCPSite(

backend/bot/app/web/webapp/_runtime.py

@@ -42,7 +42,7 @@ from bot.app.web.webapp_auth import (
     verify_webapp_session_token,
 )
 from bot.infra.redis import cache_delete, cache_get_json, cache_set_json, get_redis, redis_key
-from bot.services.email_auth_service import EmailAuthService, normalize_email
+from bot.services.email_auth_service import EmailAuthService, is_disposable_email, normalize_email
 from bot.services.email_templates import render_account_merged
 from bot.services.promo_code_service import PromoCodeService
 from bot.services.referral_service import ReferralService
@@ -55,6 +55,11 @@ from bot.utils.text_sanitizer import (
     sanitize_username,
 )
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+    payment_currency_code,
+)
 from db.dal import payment_dal, security_dal, subscription_dal, support_dal, user_dal
 from db.dal.user_dal import UserMergeConflictError
 from db.models import Payment, User, UserTelegramAvatar
@@ -77,7 +82,6 @@ WEBAPP_DEFAULT_LOGO_PATH = "/webapp-default-logo.webp"
 WEBAPP_DEFAULT_FAVICON_DIGEST = "19b2a242e5b7bc2d"
 WEBAPP_DEFAULT_FAVICON_DIR = WEBAPP_DEFAULT_BRAND_DIR / "favicons" / WEBAPP_DEFAULT_FAVICON_DIGEST
 WEBAPP_DEFAULT_FAVICON_URL = f"{WEBAPP_FAVICON_PATH}/{WEBAPP_DEFAULT_FAVICON_DIGEST}/icon-180.png"
-WEBAPP_EMOJI_CACHE_DIR = APP_ROOT / "data" / "webapp-emoji"
 WEBAPP_CONFIG_PLACEHOLDER = "<!-- WEBAPP_CONFIG_SCRIPT -->"
 WEBAPP_I18N_PLACEHOLDER = "<!-- WEBAPP_I18N_SCRIPT -->"
 WEBAPP_JS_PLACEHOLDER = "<!-- WEBAPP_JS_SCRIPT -->"
@@ -87,7 +91,6 @@ DEV_MOCK_END_MARKER = "<!-- WEBAPP_DEV_MOCK_END -->"
 WEBAPP_RATE_LIMIT_WINDOW_SECONDS = 60
 WEBAPP_RATE_LIMIT_MAX_REQUESTS = 30
 WEBAPP_LOGO_MAX_BYTES = 2 * 1024 * 1024
-WEBAPP_EMOJI_MAX_BYTES = 4 * 1024 * 1024
 WEBAPP_THEME_CSS_MAX_BYTES = 512 * 1024
 WEBAPP_THEME_ASSET_MAX_BYTES = 1024 * 1024
 WEBAPP_THEME_ASSET_CONTENT_TYPES = {

backend/bot/app/web/webapp/account.py

@@ -11,9 +11,20 @@ from .common import _invalidate_webapp_user_caches
 from .telegram_notifications import _probe_telegram_notifications_for_user_id
 
 
+def _email_auth_enabled(settings: Settings) -> bool:
+    return bool(getattr(settings, "email_auth_configured", True))
+
+
+def _email_auth_not_configured_response() -> web.Response:
+    return _json_error(503, "email_auth_not_configured", "Email auth is not configured")
+
+
 async def account_email_request_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
     settings: Settings = request.app["settings"]
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     payload = await _read_json(request)
     email_payload, validation_error = _validate_model_payload(WebAppEmailPayload, payload)
     if validation_error:
@@ -40,6 +51,10 @@ async def account_email_request_route(request: web.Request) -> web.Response:
 
 async def account_email_verify_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
+    settings: Settings = request.app["settings"]
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     rate_limit_response = await _enforce_webapp_rate_limit(
         request,
         user_id=user_id,
@@ -55,7 +70,6 @@ async def account_email_verify_route(request: web.Request) -> web.Response:
     email = email_payload.email
     code = str(email_payload.code or "")
     email_service: EmailAuthService = request.app["email_auth_service"]
-    settings: Settings = request.app["settings"]
     async_session_factory: sessionmaker = request.app["async_session_factory"]
     merge_notice: Optional[Dict[str, Any]] = None
     source_panel_uuid: Optional[str] = None
@@ -210,6 +224,9 @@ async def account_email_verify_route(request: web.Request) -> web.Response:
 async def account_password_request_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
     settings: Settings = request.app["settings"]
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     async_session_factory: sessionmaker = request.app["async_session_factory"]
 
     async with async_session_factory() as session:
@@ -232,6 +249,10 @@ async def account_password_request_route(request: web.Request) -> web.Response:
 
 async def account_password_confirm_route(request: web.Request) -> web.Response:
     user_id = _require_user_id(request)
+    settings = request.app.get("settings")
+    if not _email_auth_enabled(settings):
+        return _email_auth_not_configured_response()
+
     payload = await _read_json(request)
     password_payload, validation_error = _validate_model_payload(WebAppSetPasswordPayload, payload)
     if validation_error:

backend/bot/app/web/webapp/application.py

@@ -33,7 +33,6 @@ def create_subscription_webapp_application(
     async def _startup(app_obj: web.Application) -> None:
         await _ensure_shared_http_session()
         await _warm_webapp_logo_cache(app_obj)
-        await _warm_webapp_animated_emoji_cache(app_obj)
         await warm_subscription_guides_config(app_obj)
 
     async def _shutdown(app_obj: web.Application) -> None:

backend/bot/app/web/webapp/assets.py

@@ -5,6 +5,7 @@ import gzip
 from config.webapp_themes_config import (
     default_webapp_theme_asset_file,
     default_webapp_theme_css_files,
+    effective_webapp_theme_accent,
     ensure_default_webapp_theme_descriptor_files,
     public_theme_payload,
     public_themes_catalog_payload,
@@ -17,6 +18,8 @@ _GZIP_BODY_CACHE: Dict[str, bytes] = {}
 _ASSET_NAME_CACHE: Dict[tuple[str, str], tuple[float, str]] = {}
 _I18N_PAYLOAD_CACHE: Dict[tuple[int, str, tuple[tuple[str, int, int], ...]], Dict[str, Any]] = {}
 _ASSET_NAME_CACHE_TTL_SECONDS = 30.0
+WEBAPP_HTML_CACHE_CONTROL = "no-store, no-cache, must-revalidate, max-age=0"
+WEBAPP_LEGACY_ASSET_CACHE_CONTROL = "no-store, no-cache, must-revalidate, max-age=0"
 
 
 async def health_route(request: web.Request) -> web.Response:
@@ -47,7 +50,7 @@ async def _css_asset_route(request: web.Request, *, base_name: str) -> web.Respo
         allow_precompressed=bool(asset_hash),
     )
     response.headers["Cache-Control"] = (
-        "public, max-age=31536000, immutable" if asset_hash else "no-cache"
+        "public, max-age=31536000, immutable" if asset_hash else WEBAPP_LEGACY_ASSET_CACHE_CONTROL
     )
     return response
 
@@ -206,9 +209,6 @@ async def theme_asset_route(request: web.Request) -> web.Response:
 
 
 def _resolve_webapp_logo_url(settings: Settings) -> str:
-    if getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False):
-        return ""
-
     raw_logo_url = (getattr(settings, "WEBAPP_LOGO_URL", None) or "").strip()
     if not raw_logo_url:
         return WEBAPP_DEFAULT_LOGO_PATH
@@ -303,29 +303,8 @@ def _uploaded_webapp_logo_response(filename: str) -> web.Response:
     return response
 
 
-def _emoji_to_codepoints(value: str) -> str:
-    return "_".join(f"{ord(char):x}" for char in str(value or "").strip())
-
-
-def _webapp_emoji_disk_path(codepoints: str, ext: str) -> Path:
-    return WEBAPP_EMOJI_CACHE_DIR / f"{codepoints}.512.{ext}"
-
-
-def _webapp_animated_emoji_source_url(codepoints: str, ext: str) -> str:
-    return f"https://fonts.gstatic.com/s/e/notoemoji/latest/{codepoints}/512.{ext}"
-
-
-def _webapp_animated_emoji_asset_path(emoji: str, ext: str = "gif") -> str:
-    codepoints = _emoji_to_codepoints(emoji)
-    if not codepoints or ext not in {"gif", "webp"}:
-        return ""
-    return f"/webapp-emoji/{codepoints}/512.{ext}"
-
-
 async def webapp_logo_route(request: web.Request) -> web.Response:
     settings: Settings = request.app["settings"]
-    if getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False):
-        raise web.HTTPNotFound(text="webapp_logo_disabled")
     raw_logo_url = (settings.WEBAPP_LOGO_URL or "").strip()
     if not raw_logo_url:
         raise web.HTTPNotFound(text="webapp_logo_not_configured")
@@ -405,11 +384,15 @@ async def webapp_current_favicon_route(request: web.Request) -> web.Response:
     favicon_url = _resolve_webapp_favicon_url(settings, _resolve_webapp_logo_url(settings))
     digest = _webapp_generated_favicon_digest(favicon_url)
     if digest:
-        return _webapp_favicon_file_response(digest, target_filename)
+        response = _webapp_favicon_file_response(digest, target_filename)
+        response.headers["Cache-Control"] = "no-cache"
+        return response
 
     redirect_url = _webapp_redirectable_favicon_url(favicon_url, target_filename)
     if redirect_url:
-        raise web.HTTPFound(location=redirect_url)
+        redirect = web.HTTPFound(location=redirect_url)
+        redirect.headers["Cache-Control"] = "no-cache"
+        raise redirect
 
     raise web.HTTPNotFound(text="webapp_favicon_not_found")
 
@@ -521,37 +504,8 @@ def _webapp_default_brand_file_response(path: Path, content_type: str) -> web.Re
     return web.Response(body=body, content_type=content_type)
 
 
-async def webapp_animated_emoji_route(request: web.Request) -> web.Response:
-    codepoints = str(request.match_info.get("codepoints") or "").strip().lower()
-    ext = str(request.match_info.get("ext") or "").strip().lower()
-    if not re.fullmatch(r"[0-9a-f]+(?:_[0-9a-f]+)*", codepoints) or ext not in {"gif", "webp"}:
-        raise web.HTTPNotFound(text="webapp_emoji_not_found")
-
-    emoji_cache_key = f"{codepoints}:{ext}"
-    emoji_caches: Dict[str, Tuple[bytes, str]] = request.app.setdefault("webapp_emoji_cache", {})
-    emoji_cache = emoji_caches.get(emoji_cache_key)
-    if emoji_cache is None:
-        cache_lock: asyncio.Lock = request.app.setdefault("webapp_emoji_cache_lock", asyncio.Lock())
-        async with cache_lock:
-            emoji_cache = emoji_caches.get(emoji_cache_key)
-            if emoji_cache is None:
-                emoji_cache = await _load_or_fetch_webapp_animated_emoji(codepoints, ext)
-                if emoji_cache:
-                    emoji_caches[emoji_cache_key] = emoji_cache
-
-    if not emoji_cache:
-        raise web.HTTPNotFound(text="webapp_emoji_unavailable")
-
-    body, content_type = emoji_cache
-    response = web.Response(body=body, content_type=content_type)
-    response.headers["Cache-Control"] = "public, max-age=31536000, immutable"
-    return response
-
-
 async def _warm_webapp_logo_cache(app: web.Application) -> None:
     settings: Settings = app["settings"]
-    if getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False):
-        return
     raw_logo_url = (settings.WEBAPP_LOGO_URL or "").strip()
     if not raw_logo_url or not _is_proxyable_webapp_logo_url(raw_logo_url):
         return
@@ -573,111 +527,6 @@ async def _warm_webapp_logo_cache(app: web.Application) -> None:
         )
 
 
-async def _warm_webapp_animated_emoji_cache(app: web.Application) -> None:
-    settings: Settings = app["settings"]
-    if not getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False):
-        return
-    if str(settings.WEBAPP_LOGO_EMOJI_FONT or "").strip() != "noto-color-animated":
-        return
-
-    codepoints = _emoji_to_codepoints(settings.WEBAPP_LOGO_EMOJI)
-    if not codepoints:
-        return
-
-    app.setdefault("webapp_emoji_cache", {})
-    app.setdefault("webapp_emoji_cache_lock", asyncio.Lock())
-    emoji_caches: Dict[str, Tuple[bytes, str]] = app["webapp_emoji_cache"]
-
-    for ext in ("gif", "webp"):
-        emoji_cache_key = f"{codepoints}:{ext}"
-        if emoji_cache_key in emoji_caches:
-            continue
-        loaded_emoji = await _load_or_fetch_webapp_animated_emoji(codepoints, ext)
-        if loaded_emoji:
-            emoji_caches[emoji_cache_key] = loaded_emoji
-            if ext == "gif":
-                return
-
-
-async def _load_or_fetch_webapp_animated_emoji(
-    codepoints: str, ext: str
-) -> Optional[Tuple[bytes, str]]:
-    disk_emoji = await asyncio.to_thread(_read_webapp_animated_emoji_from_disk, codepoints, ext)
-    if disk_emoji:
-        return disk_emoji
-
-    fetched_emoji = await _fetch_webapp_animated_emoji(codepoints, ext)
-    if fetched_emoji:
-        await asyncio.to_thread(
-            _write_webapp_animated_emoji_to_disk, codepoints, ext, fetched_emoji
-        )
-    return fetched_emoji
-
-
-def _read_webapp_animated_emoji_from_disk(codepoints: str, ext: str) -> Optional[Tuple[bytes, str]]:
-    path = _webapp_emoji_disk_path(codepoints, ext)
-    try:
-        body = path.read_bytes()
-    except OSError:
-        return None
-
-    if not body or len(body) > WEBAPP_EMOJI_MAX_BYTES:
-        return None
-    return body, "image/gif" if ext == "gif" else "image/webp"
-
-
-def _write_webapp_animated_emoji_to_disk(
-    codepoints: str, ext: str, emoji: Tuple[bytes, str]
-) -> None:
-    body, _content_type = emoji
-    if not body or len(body) > WEBAPP_EMOJI_MAX_BYTES:
-        return
-
-    path = _webapp_emoji_disk_path(codepoints, ext)
-    try:
-        WEBAPP_EMOJI_CACHE_DIR.mkdir(parents=True, exist_ok=True)
-        path.write_bytes(body)
-    except OSError as exc:
-        logger.warning("Failed to write WEBAPP animated emoji cache: %s", exc)
-
-
-async def _fetch_webapp_animated_emoji(codepoints: str, ext: str) -> Optional[Tuple[bytes, str]]:
-    try:
-        session = await _get_shared_http_session()
-        timeout = ClientTimeout(total=4)
-        source_url = _webapp_animated_emoji_source_url(codepoints, ext)
-        async with session.get(
-            source_url,
-            allow_redirects=False,
-            headers={"Accept": "image/gif,image/webp,image/*,*/*;q=0.8"},
-            timeout=timeout,
-        ) as response:
-            if response.status != 200:
-                return None
-
-            content_type = (
-                (response.headers.get("Content-Type") or "").split(";", 1)[0].strip().lower()
-            )
-            expected_content_type = "image/gif" if ext == "gif" else "image/webp"
-            if content_type and content_type != expected_content_type:
-                return None
-
-            body = bytearray()
-            async for chunk in response.content.iter_chunked(64 * 1024):
-                body.extend(chunk)
-                if len(body) > WEBAPP_EMOJI_MAX_BYTES:
-                    logger.warning("WEBAPP animated emoji exceeded the 4 MiB limit.")
-                    return None
-
-            if not body:
-                return None
-
-            return bytes(body), expected_content_type
-    except Exception as exc:
-        logger.warning("Failed to fetch WEBAPP animated emoji: %s", exc)
-        return None
-
-
 async def _load_or_fetch_webapp_logo(logo_url: str) -> Optional[Tuple[bytes, str]]:
     disk_logo = await asyncio.to_thread(_read_webapp_logo_from_disk, logo_url)
     if disk_logo:
@@ -923,7 +772,6 @@ def _get_cached_webapp_settings(request: web.Request) -> Dict[str, Any]:
             "traffic_packages": settings.traffic_packages,
             "stars_traffic_packages": settings.stars_traffic_packages,
             "support_url": settings.SUPPORT_LINK or "",
-            "terms_url": settings.TERMS_OF_SERVICE_URL or "",
             "privacy_policy_url": settings.PRIVACY_POLICY_URL or "",
             "user_agreement_url": settings.USER_AGREEMENT_URL or "",
             "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
@@ -934,12 +782,26 @@ def _get_cached_webapp_settings(request: web.Request) -> Dict[str, Any]:
     return cache["data"]
 
 
+def _resolve_app_version() -> str:
+    # Single source of truth shared with the telemetry worker so the admin
+    # sidebar and the install beacon always report the same version.
+    from bot.utils import app_version as app_version_module
+
+    global _APP_VERSION_CACHE
+
+    app_version_module.APP_ROOT = APP_ROOT
+    app_version_module._run_git_command = _run_git_command
+    app_version_module._APP_VERSION_CACHE = _APP_VERSION_CACHE
+    version = app_version_module.resolve_app_version()
+    _APP_VERSION_CACHE = app_version_module._APP_VERSION_CACHE
+    return version
+
+
 def _run_git_command(*args: str) -> str:
-    repo_root = APP_ROOT
     try:
         result = subprocess.run(
             ["git", *args],
-            cwd=repo_root,
+            cwd=APP_ROOT,
             check=True,
             capture_output=True,
             text=True,
@@ -950,73 +812,6 @@ def _run_git_command(*args: str) -> str:
     return result.stdout.strip()
 
 
-def _normalize_version_branch(raw_branch: str) -> str:
-    branch = str(raw_branch or "").strip()
-    for prefix in ("refs/heads/", "refs/remotes/origin/", "origin/"):
-        if branch.startswith(prefix):
-            branch = branch[len(prefix) :]
-            break
-    if branch == "HEAD":
-        return ""
-    return re.sub(r"[^A-Za-z0-9._-]+", "-", branch).strip("-")[:48]
-
-
-def _resolve_version_branch() -> str:
-    for env_name in (
-        "REMNAWAVE_MINISHOP_BRANCH",
-        "GIT_BRANCH",
-        "BRANCH_NAME",
-        "GITHUB_REF_NAME",
-        "CI_COMMIT_REF_NAME",
-    ):
-        branch = _normalize_version_branch(os.getenv(env_name, ""))
-        if branch:
-            return branch
-    return _normalize_version_branch(
-        _run_git_command("branch", "--show-current")
-        or _run_git_command("symbolic-ref", "--quiet", "--short", "HEAD")
-    )
-
-
-def _format_app_version(tag: str, sha: str, branch: str) -> str:
-    branch_suffix = "" if not branch or branch == "main" else f"-{branch}"
-    if tag and sha:
-        return f"{tag}{branch_suffix}+g{sha}"
-    if sha:
-        return f"dev{branch_suffix}+g{sha}"
-    if tag:
-        return f"{tag}{branch_suffix}"
-    return f"dev{branch_suffix}+unknown"
-
-
-def _resolve_app_version() -> str:
-    global _APP_VERSION_CACHE
-    if _APP_VERSION_CACHE:
-        return _APP_VERSION_CACHE
-
-    env_version = os.getenv("REMNAWAVE_MINISHOP_VERSION", "").strip()
-    if env_version:
-        _APP_VERSION_CACHE = env_version
-        return env_version
-
-    build_version_path = APP_ROOT / ".build-version"
-    try:
-        build_version = build_version_path.read_text(encoding="utf-8").strip()
-    except OSError:
-        build_version = ""
-    if build_version:
-        _APP_VERSION_CACHE = build_version
-        return build_version
-
-    tag = _run_git_command("describe", "--tags", "--abbrev=0")
-    sha = _run_git_command("rev-parse", "--short", "HEAD")
-    branch = _resolve_version_branch()
-    version = _format_app_version(tag, sha, branch)
-
-    _APP_VERSION_CACHE = version
-    return version
-
-
 async def _enforce_webapp_rate_limit(
     request: web.Request,
     *,
@@ -1108,7 +903,7 @@ async def _js_asset_route(request: web.Request, *, base_name: str) -> web.Respon
         strip_dev_mock=not asset_hash,
     )
     response.headers["Cache-Control"] = (
-        "public, max-age=31536000, immutable" if asset_hash else "no-cache"
+        "public, max-age=31536000, immutable" if asset_hash else WEBAPP_LEGACY_ASSET_CACHE_CONTROL
     )
     return response
 
@@ -1219,9 +1014,6 @@ def _build_webapp_bootstrap_payload(request: web.Request) -> Dict[str, Any]:
             "themesDir": settings.WEBAPP_THEMES_DIR,
             "themePreviewKey": preview_key,
             "logoUrl": cached["logo_url"],
-            "logoUseEmoji": bool(settings.WEBAPP_LOGO_USE_EMOJI),
-            "logoEmoji": settings.WEBAPP_LOGO_EMOJI,
-            "logoEmojiFont": settings.WEBAPP_LOGO_EMOJI_FONT,
             "faviconUrl": cached["favicon_url"],
             "faviconUseCustom": bool(settings.WEBAPP_FAVICON_USE_CUSTOM),
             "apiBase": "/api",
@@ -1232,7 +1024,6 @@ def _build_webapp_bootstrap_payload(request: web.Request) -> Dict[str, Any]:
             "telegramOAuthClientId": _resolve_telegram_oauth_client_id(settings) or 0,
             "telegramOAuthRequestAccess": _resolve_telegram_oauth_request_access(settings),
             "supportUrl": cached["support_url"],
-            "termsUrl": cached["terms_url"],
             "privacyPolicyUrl": cached["privacy_policy_url"],
             "userAgreementUrl": cached["user_agreement_url"],
             "currency": cached["currency"],
@@ -1351,9 +1142,11 @@ async def index_route(request: web.Request) -> web.Response:
     bootstrap = _build_webapp_bootstrap_payload(request)
     config = bootstrap["config"]
     html = _strip_marked_block(html, DEV_MOCK_START_MARKER, DEV_MOCK_END_MARKER)
+    css_asset_name = _resolve_webapp_css_asset_name()
+    js_asset_name = _resolve_webapp_js_asset_name()
     html = html.replace(
         'href="/subscription_webapp.css"',
-        f'href="/{_resolve_webapp_css_asset_name()}"',
+        f'href="/{css_asset_name}"',
         1,
     )
     initial_theme_markup = _initial_theme_head_markup(request, initial_theme, primary_color)
@@ -1380,15 +1173,9 @@ async def index_route(request: web.Request) -> web.Response:
     )
     html = html.replace(
         WEBAPP_JS_PLACEHOLDER,
-        f'<script src="/{_resolve_webapp_js_asset_name()}" defer></script>',
+        f'<script src="/{js_asset_name}" defer></script>',
     )
     brand_asset_url = cached["logo_url"]
-    if (
-        not brand_asset_url
-        and settings.WEBAPP_LOGO_USE_EMOJI
-        and settings.WEBAPP_LOGO_EMOJI_FONT == "noto-color-animated"
-    ):
-        brand_asset_url = _webapp_animated_emoji_asset_path(settings.WEBAPP_LOGO_EMOJI)
     if brand_asset_url:
         html = html.replace(
             "</head>",
@@ -1399,7 +1186,9 @@ async def index_route(request: web.Request) -> web.Response:
             1,
         )
     response = web.Response(text=html, content_type="text/html", charset="utf-8")
-    response.headers["Cache-Control"] = "no-cache"
+    response.headers["Cache-Control"] = WEBAPP_HTML_CACHE_CONTROL
+    response.headers["Pragma"] = "no-cache"
+    response.headers["Expires"] = "0"
     return response
 
 
@@ -1410,6 +1199,11 @@ async def app_deeplink_route(request: web.Request) -> web.Response:
 
     nonce = html.escape(str(request.get("csp_nonce", "")), quote=True)
     query = getattr(request, "query", {}) or {}
+    themes_catalog = getattr(settings, "webapp_themes_catalog", None)
+    primary_color = getattr(settings, "WEBAPP_PRIMARY_COLOR", None) or "#00fe7a"
+    initial_theme = (
+        _initial_theme_for_request(request, themes_catalog) if themes_catalog is not None else None
+    )
     lang = _normalize_language(query.get("lang") or getattr(settings, "DEFAULT_LANGUAGE", "ru"))
     messages = _app_deeplink_i18n_payload(request, lang)
     page_title = _webapp_page_title(settings, messages["title"])
@@ -1426,6 +1220,14 @@ async def app_deeplink_route(request: web.Request) -> web.Response:
         .replace("__NONCE__", nonce)
         .replace("__MESSAGES_JSON__", messages_json)
     )
+    initial_theme_markup = _app_deeplink_theme_head_markup(
+        request,
+        initial_theme,
+        themes_catalog,
+        primary_color,
+    )
+    if initial_theme_markup:
+        html_text = html_text.replace("</head>", f"{initial_theme_markup}\n</head>", 1)
     html_text = _apply_webapp_head_metadata(html_text, page_title, favicon_url)
     response = web.Response(text=html_text, content_type="text/html", charset="utf-8")
     response.headers["Cache-Control"] = "no-store"
@@ -1652,10 +1454,15 @@ def _resolve_webapp_js_asset_name() -> str:
 
 
 def _resolve_webapp_admin_js_asset_name() -> str:
-    # The admin bundle is lazy-loaded from the already running Mini App. In
-    # deployments where nginx serves static files in front of aiohttp, stale
-    # hashed admin filenames can 404 even though the runtime build asset exists.
-    return _set_cached_asset_name("admin-js", "subscription_webapp_admin.js")
+    # The admin bundle is lazy-loaded from the already running Mini App. It now
+    # ships content-hashed alongside the main bundle (same build, deterministic
+    # hashes, served immutable), so iOS WebViews fetch fresh admin assets on every
+    # deploy. The App.svelte loader falls back to the bare runtime build name if a
+    # hashed asset ever 404s.
+    return _resolve_hashed_js_asset_name(
+        kind="admin-js",
+        base_name="subscription_webapp_admin",
+    )
 
 
 def _resolve_hashed_js_asset_name(*, kind: str, base_name: str) -> str:
@@ -1674,7 +1481,7 @@ def _resolve_hashed_js_asset_name(*, kind: str, base_name: str) -> str:
     if minified_assets:
         minified_assets.sort(reverse=True)
         return _set_cached_asset_name(kind, minified_assets[0][1])
-    return _set_cached_asset_name(kind, f"{base_name}.js")
+    return _set_cached_asset_name(kind, _stable_asset_name_with_version(f"{base_name}.js"))
 
 
 def _resolve_webapp_css_asset_name() -> str:
@@ -1685,9 +1492,11 @@ def _resolve_webapp_css_asset_name() -> str:
 
 
 def _resolve_webapp_admin_css_asset_name() -> str:
-    # Keep the lazy-loaded admin stylesheet on the stable build filename for
-    # the same reason as the JS bundle above.
-    return _set_cached_asset_name("admin-css", "subscription_webapp_admin.css")
+    # Content-hashed and immutable, same rationale as the admin JS bundle above.
+    return _resolve_hashed_css_asset_name(
+        kind="admin-css",
+        base_name="subscription_webapp_admin",
+    )
 
 
 def _resolve_hashed_css_asset_name(*, kind: str, base_name: str) -> str:
@@ -1706,7 +1515,19 @@ def _resolve_hashed_css_asset_name(*, kind: str, base_name: str) -> str:
     if hashed_assets:
         hashed_assets.sort(reverse=True)
         return _set_cached_asset_name(kind, hashed_assets[0][1])
-    return _set_cached_asset_name(kind, f"{base_name}.css")
+    return _set_cached_asset_name(kind, _stable_asset_name_with_version(f"{base_name}.css"))
+
+
+def _stable_asset_name_with_version(filename: str) -> str:
+    path = ASSET_DIR / filename
+    try:
+        stat = path.stat()
+    except OSError:
+        return filename
+
+    raw_version = f"{filename}:{int(stat.st_mtime_ns)}:{int(stat.st_size)}"
+    version = hashlib.sha256(raw_version.encode("utf-8")).hexdigest()[:8]
+    return f"{filename}?v={version}"
 
 
 def _get_cached_asset_name(kind: str) -> Optional[str]:
@@ -1758,6 +1579,9 @@ _INITIAL_THEME_TOKEN_CSS_MAP = {
     "font_sans": "--font-sans",
     "font_logo": "--font-logo",
     "font_mono": "--font-mono",
+    "home_logo_scale": "--home-logo-scale",
+    "home_logo_scale_desktop": "--home-logo-scale-desktop",
+    "home_logo_scale_mobile": "--home-logo-scale-mobile",
     "admin_bg": "--admin-bg",
     "admin_surface": "--admin-surface",
     "admin_surface_2": "--admin-surface-2",
@@ -1769,6 +1593,12 @@ _INITIAL_THEME_TOKEN_CSS_MAP = {
     "admin_dim": "--admin-dim",
 }
 
+_INITIAL_THEME_LOGO_SCALE_TOKENS = {
+    "home_logo_scale",
+    "home_logo_scale_desktop",
+    "home_logo_scale_mobile",
+}
+
 
 def _theme_css_href_for_html(theme: Any) -> str:
     css_file = str(getattr(theme, "css_file", "") or "").strip()
@@ -1791,7 +1621,8 @@ def _theme_css_href_for_html(theme: Any) -> str:
 
 
 def _initial_theme_for_request(request: web.Request, catalog: Any) -> Any:
-    preview_key = str(request.query.get("theme_preview") or "").strip()
+    query = getattr(request, "query", {}) or {}
+    preview_key = str(query.get("theme_preview") or "").strip()
     if preview_key:
         preview_theme = catalog.theme_by_key(preview_key)
         if preview_theme is not None and preview_theme.enabled:
@@ -1803,18 +1634,38 @@ def _initial_theme_for_request(request: web.Request, catalog: Any) -> Any:
     return catalog.enabled_themes()[0] if catalog.enabled_themes() else None
 
 
+def _initial_theme_tokens(theme: Any, primary_color: str) -> Dict[str, Any]:
+    if theme is None:
+        return {}
+
+    payload = public_theme_payload(theme, primary_color)
+    tokens = payload.get("tokens") if isinstance(payload, dict) else {}
+    return tokens if isinstance(tokens, dict) else {}
+
+
+def _initial_theme_declarations(tokens: Dict[str, Any]) -> List[str]:
+    declarations = []
+    for token_key, css_name in _INITIAL_THEME_TOKEN_CSS_MAP.items():
+        if token_key in _INITIAL_THEME_LOGO_SCALE_TOKENS:
+            try:
+                scale = float(tokens.get(token_key) or 0)
+            except (TypeError, ValueError):
+                continue
+            if scale > 0:
+                declarations.append(f"{css_name}:{scale / 100:g}")
+            continue
+        value = str(tokens.get(token_key) or "").strip()
+        if value:
+            declarations.append(f"{css_name}:{value}")
+    return declarations
+
+
 def _initial_theme_head_markup(request: web.Request, theme: Any, primary_color: str) -> str:
     if theme is None:
         return ""
 
-    payload = public_theme_payload(theme, primary_color)
-    tokens = payload.get("tokens") if isinstance(payload, dict) else {}
-    tokens = tokens if isinstance(tokens, dict) else {}
-    declarations = []
-    for token_key, css_name in _INITIAL_THEME_TOKEN_CSS_MAP.items():
-        value = str(tokens.get(token_key) or "").strip()
-        if value:
-            declarations.append(f"{css_name}:{value}")
+    tokens = _initial_theme_tokens(theme, primary_color)
+    declarations = _initial_theme_declarations(tokens)
 
     scheme = "light" if tokens.get("color_scheme") == "light" else "dark"
     bg = str(tokens.get("bg") or "").strip()
@@ -1838,6 +1689,37 @@ def _initial_theme_head_markup(request: web.Request, theme: Any, primary_color:
     return stylesheet + "\n" + style_tag
 
 
+def _app_deeplink_theme_head_markup(
+    request: web.Request,
+    theme: Any,
+    catalog: Any,
+    primary_color: str,
+) -> str:
+    tokens = _initial_theme_tokens(theme, primary_color)
+    declarations = _initial_theme_declarations(tokens)
+    try:
+        accent = effective_webapp_theme_accent(
+            catalog,
+            primary_color,
+            theme_key=str(getattr(theme, "key", "") or "") or None,
+        )
+    except Exception:
+        accent = str(primary_color or "#00fe7a").strip() or "#00fe7a"
+    if accent and not any(item.startswith("--accent:") for item in declarations):
+        declarations.insert(0, f"--accent:{accent}")
+    if not declarations:
+        return ""
+
+    scheme = "light" if tokens.get("color_scheme") == "light" else "dark"
+    nonce = html.escape(str(request.get("csp_nonce", "")), quote=True)
+    return (
+        f'<style id="webapp-initial-theme" nonce="{nonce}">'
+        f"html{{color-scheme:{scheme};}}"
+        f":root{{{';'.join(declarations)}}}"
+        "</style>"
+    )
+
+
 def _favicon_head_markup(favicon_url: str) -> str:
     href = str(favicon_url or "").strip()
     if not href:

backend/bot/app/web/webapp/auth.py

@@ -713,6 +713,7 @@ async def email_auth_verify_route(request: web.Request) -> web.Response:
                     session,
                     referral_param,
                     current_user_id=None,
+                    settings=settings,
                 )
                 db_user, _ = await user_dal.create_email_user(
                     session,
@@ -821,6 +822,7 @@ async def email_auth_magic_route(request: web.Request) -> web.Response:
                     session,
                     referral_param,
                     current_user_id=None,
+                    settings=settings,
                 )
                 db_user, _ = await user_dal.create_email_user(
                     session,
@@ -1010,13 +1012,53 @@ async def _request_email_code(
 
 
 def _telegram_id_for_user(user: User) -> Optional[int]:
-    if user.telegram_id:
-        return int(user.telegram_id)
-    if user.user_id and int(user.user_id) > 0:
-        return int(user.user_id)
+    telegram_id = getattr(user, "telegram_id", None)
+    if telegram_id:
+        return int(telegram_id)
+    user_id = getattr(user, "user_id", None)
+    if user_id and int(user_id) > 0:
+        return int(user_id)
     return None
 
 
+def _user_has_linked_telegram(user: User) -> bool:
+    return bool(getattr(user, "telegram_id", None))
+
+
+def _email_only_telegram_required_reason(
+    settings: Settings,
+    user: User,
+    *,
+    without_telegram_enabled_attr: str,
+) -> Optional[str]:
+    if _user_has_linked_telegram(user):
+        return None
+    if is_disposable_email(getattr(user, "email", None), settings):
+        return "disposable_email"
+    if not bool(getattr(settings, without_telegram_enabled_attr, True)):
+        return "telegram_required"
+    return None
+
+
+def _trial_telegram_required_reason(settings: Settings, user: User) -> Optional[str]:
+    return _email_only_telegram_required_reason(
+        settings,
+        user,
+        without_telegram_enabled_attr="TRIAL_WITHOUT_TELEGRAM_ENABLED",
+    )
+
+
+def _referral_welcome_telegram_required_reason(
+    settings: Settings,
+    user: User,
+) -> Optional[str]:
+    return _email_only_telegram_required_reason(
+        settings,
+        user,
+        without_telegram_enabled_attr="REFERRAL_WELCOME_BONUS_WITHOUT_TELEGRAM_ENABLED",
+    )
+
+
 def _panel_description_for_user(user: User) -> str:
     return panel_description_from_profile(
         user.username,
@@ -1292,17 +1334,35 @@ async def _link_telegram_to_user(
     return current_user
 
 
-def _normalize_referral_param(raw: Optional[str]) -> Optional[str]:
+def _remnashop_referral_compat_enabled(settings: Optional[Settings]) -> bool:
+    if settings is None:
+        return False
+    return bool(getattr(settings, "MIGRATION_REMNASHOP_REFERRAL_CODE_COMPAT_ENABLED", False))
+
+
+def _strip_referral_param_prefix(
+    raw: Optional[str],
+    *,
+    preserve_current_u_prefix: bool,
+) -> str:
     value = (raw or "").strip()
     if not value:
-        return None
+        return ""
 
     value_lower = value.lower()
-    if value_lower.startswith("ref_u"):
+    if value_lower.startswith("ref_u") and not preserve_current_u_prefix:
         value = value[5:]
     elif value_lower.startswith("ref_"):
         value = value[4:]
-    elif value and value[0].lower() == "u" and len(value) == 10:
+    return value
+
+
+def _normalize_referral_param(raw: Optional[str]) -> Optional[str]:
+    value = _strip_referral_param_prefix(raw, preserve_current_u_prefix=False)
+    if not value:
+        return None
+
+    if value and value[0].lower() == "u" and len(value) == 10:
         value = value[1:]
 
     if not re.fullmatch(r"[A-Za-z0-9]{1,32}", value):
@@ -1310,26 +1370,64 @@ def _normalize_referral_param(raw: Optional[str]) -> Optional[str]:
     return value.upper()
 
 
+def _referral_param_lookup_candidates(
+    raw: Optional[str],
+    *,
+    remnashop_compat: bool,
+) -> List[str]:
+    if not remnashop_compat:
+        normalized = _normalize_referral_param(raw)
+        return [normalized] if normalized else []
+
+    value = _strip_referral_param_prefix(raw, preserve_current_u_prefix=True)
+    if not value or not re.fullmatch(r"[A-Za-z0-9._:-]{1,128}", value):
+        return []
+
+    candidates = [value]
+    if value and value[0].lower() == "u":
+        candidates.append(value[1:])
+
+    unique: List[str] = []
+    for candidate in candidates:
+        if candidate and candidate not in unique:
+            unique.append(candidate)
+    return unique
+
+
 async def _resolve_referrer_id(
     session: AsyncSession,
     raw_referral_param: Optional[str],
     *,
     current_user_id: Optional[int],
+    settings: Optional[Settings] = None,
 ) -> Optional[int]:
-    normalized = _normalize_referral_param(raw_referral_param)
-    if not normalized:
+    remnashop_compat = _remnashop_referral_compat_enabled(settings)
+    candidates = _referral_param_lookup_candidates(
+        raw_referral_param,
+        remnashop_compat=remnashop_compat,
+    )
+    if not candidates:
         return None
 
-    ref_user = None
-    if normalized.isdigit():
-        ref_user = await user_dal.get_user_by_id(session, int(normalized))
-    if not ref_user:
-        ref_user = await user_dal.get_user_by_referral_code(session, normalized)
-    if not ref_user:
-        return None
-    if current_user_id is not None and int(ref_user.user_id) == int(current_user_id):
-        return None
-    return int(ref_user.user_id)
+    for normalized in candidates:
+        ref_user = None
+        if normalized.isdigit() and not remnashop_compat:
+            ref_user = await user_dal.get_user_by_id(session, int(normalized))
+        if not ref_user:
+            ref_user = await user_dal.get_user_by_referral_code(
+                session,
+                normalized,
+                include_legacy=remnashop_compat,
+            )
+        if not ref_user and normalized.isdigit() and remnashop_compat:
+            ref_user = await user_dal.get_user_by_id(session, int(normalized))
+        if not ref_user:
+            continue
+        if current_user_id is not None and int(ref_user.user_id) == int(current_user_id):
+            continue
+        return int(ref_user.user_id)
+
+    return None
 
 
 async def _apply_referral_to_existing_user(
@@ -1345,6 +1443,7 @@ async def _apply_referral_to_existing_user(
         session,
         raw_referral_param,
         current_user_id=int(user.user_id),
+        settings=request.app["settings"],
     )
     if not referred_by_id:
         return False
@@ -1374,6 +1473,21 @@ async def _apply_referral_welcome_bonus_if_needed(
     if not raw_referral_param or not user.referred_by_id:
         return None
 
+    settings: Settings = request.app["settings"]
+    if _referral_welcome_telegram_required_reason(settings, user):
+        return None
+
+    return await _grant_referral_welcome_bonus_if_eligible(request, session, user)
+
+
+async def _grant_referral_welcome_bonus_if_eligible(
+    request: web.Request,
+    session: AsyncSession,
+    user: User,
+) -> Optional[datetime]:
+    if not user.referred_by_id:
+        return None
+
     settings: Settings = request.app["settings"]
     referral_welcome_days = max(
         0,
@@ -1383,6 +1497,10 @@ async def _apply_referral_welcome_bonus_if_needed(
         return None
 
     subscription_service: SubscriptionService = request.app["subscription_service"]
+    default_tariff_key = None
+    tariffs_config = getattr(settings, "tariffs_config", None)
+    if tariffs_config:
+        default_tariff_key = getattr(tariffs_config, "default_tariff", None)
     try:
         if await subscription_service.has_active_subscription(session, int(user.user_id)):
             return None
@@ -1394,6 +1512,68 @@ async def _apply_referral_welcome_bonus_if_needed(
         int(user.user_id),
         referral_welcome_days,
         reason="referral_welcome_bonus",
+        tariff_key=default_tariff_key,
+    )
+
+
+def _webapp_datetime_text(value: Optional[datetime]) -> Optional[str]:
+    if not value:
+        return None
+    normalized = value if value.tzinfo else value.replace(tzinfo=timezone.utc)
+    return normalized.strftime("%d.%m.%Y %H:%M")
+
+
+async def referral_welcome_bonus_claim_route(request: web.Request) -> web.Response:
+    user_id = _require_user_id(request)
+    rate_limit_response = await _enforce_webapp_rate_limit(
+        request,
+        user_id=user_id,
+        action="referral_welcome_claim",
+    )
+    if rate_limit_response:
+        return rate_limit_response
+
+    settings: Settings = request.app["settings"]
+    async_session_factory: sessionmaker = request.app["async_session_factory"]
+    async with async_session_factory() as session:
+        try:
+            db_user = await user_dal.get_user_by_id(session, user_id)
+            if not db_user or db_user.is_banned:
+                await session.rollback()
+                return _json_error(403, "access_denied", "Access denied")
+
+            reason = _referral_welcome_telegram_required_reason(settings, db_user)
+            if reason:
+                await session.rollback()
+                return _json_error(400, "referral_welcome_telegram_required", reason)
+
+            end_date = await _grant_referral_welcome_bonus_if_eligible(
+                request,
+                session,
+                db_user,
+            )
+            if not end_date:
+                await session.rollback()
+                return _json_error(
+                    400,
+                    "referral_welcome_unavailable",
+                    "Referral welcome bonus is not available",
+                )
+
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            logger.exception("Referral welcome bonus claim failed")
+            return _json_error(500, "referral_welcome_failed", "Referral welcome bonus failed")
+
+    await _invalidate_webapp_user_caches(settings, user_id, include_devices=True)
+    return web.json_response(
+        {
+            "ok": True,
+            "claimed": True,
+            "end_date": end_date.isoformat() if isinstance(end_date, datetime) else None,
+            "end_date_text": _webapp_datetime_text(end_date),
+        }
     )
 
 
@@ -1427,6 +1607,7 @@ async def _ensure_user_from_telegram(
             session,
             referral_param or telegram_user.get("start_param"),
             current_user_id=user_id,
+            settings=settings,
         )
         db_user, created = await user_dal.create_user(
             session,

backend/bot/app/web/webapp/billing.py

@@ -1,7 +1,18 @@
 # ruff: noqa: F401,F403,F405,I001
 from ._runtime import *  # noqa: F403,F405
 
+from bot.app.web.webapp.auth import _trial_telegram_required_reason
 from bot.app.web.webapp.cache_helpers import invalidate_webapp_user_caches
+from db.dal import message_log_dal
+
+
+_HTML_TAG_RE = re.compile(r"<[^>]+>")
+
+
+def _plain_text_message(value: Any) -> str:
+    """Strip Telegram-style HTML markup from a localized message for the web app."""
+    text = _HTML_TAG_RE.sub("", str(value))
+    return html.unescape(text).strip()
 
 
 def _billing_iso_datetime(value: Optional[Any]) -> Optional[str]:
@@ -68,7 +79,7 @@ async def apply_promo_route(request: web.Request) -> web.Response:
             )
             if not success:
                 await session.commit()
-                return _json_error(400, "promo_apply_failed", str(result))
+                return _json_error(400, "promo_apply_failed", _plain_text_message(result))
             await session.commit()
             end_date = result if isinstance(result, datetime) else None
             return web.json_response(
@@ -103,16 +114,19 @@ async def create_payment_route(request: web.Request) -> web.Response:
     subscription_service: SubscriptionService = request.app["subscription_service"]
     cached = _get_cached_webapp_settings(request)
     tariffs_config = settings.tariffs_config
+    default_currency = default_currency_key_for_settings(settings)
+    default_currency_code = payment_currency_code(default_currency)
     traffic_mode = bool(settings.traffic_sale_mode)
     sale_mode = "subscription"
     traffic_gb_for_payment: Optional[float] = None
     hwid_quote: Optional[Dict[str, Any]] = None
     requested_sale_mode = _sale_mode_base(str(payment_payload.sale_mode or ""))
 
+    if tariffs_config and requested_sale_mode == "hwid_devices_renewal":
+        return _json_error(400, "invalid_plan", "Device renewal is part of subscription renewal")
     if tariffs_config and requested_sale_mode in {
         "hwid_device",
         "hwid_devices",
-        "hwid_devices_renewal",
     }:
         tariff_key = str(payment_payload.tariff_key or "").strip()
         if not tariff_key:
@@ -155,17 +169,17 @@ async def create_payment_route(request: web.Request) -> web.Response:
             if requested_sale_mode == "premium_topup"
             else tariffs_config.topup_packages_for(tariff)
         )
-        rub_packages = {
+        currency_packages = {
             float(package.gb): float(package.price)
-            for package in (packages.rub if packages else [])
+            for package in (packages.for_currency(default_currency) if packages else [])
         }
         stars_packages = {
             float(package.gb): int(float(package.price))
             for package in (packages.stars if packages else [])
         }
-        package_key = _resolve_numeric_option_key(rub_packages, traffic_gb)
+        package_key = _resolve_numeric_option_key(currency_packages, traffic_gb)
         stars_package_key = _resolve_numeric_option_key(stars_packages, traffic_gb)
-        price = rub_packages.get(package_key) if package_key is not None else None
+        price = currency_packages.get(package_key) if package_key is not None else None
         stars_price = (
             stars_packages.get(stars_package_key) if stars_package_key is not None else None
         )
@@ -196,17 +210,21 @@ async def create_payment_route(request: web.Request) -> web.Response:
                 return _json_error(400, "invalid_plan", "Invalid traffic package")
             if traffic_gb <= 0:
                 return _json_error(400, "invalid_plan", "Invalid traffic package")
-            rub_packages = {
+            currency_packages = {
                 float(package.gb): float(package.price)
-                for package in (tariff.traffic_packages.rub if tariff.traffic_packages else [])
+                for package in (
+                    tariff.traffic_packages.for_currency(default_currency)
+                    if tariff.traffic_packages
+                    else []
+                )
             }
             stars_packages = {
                 float(package.gb): int(float(package.price))
                 for package in (tariff.traffic_packages.stars if tariff.traffic_packages else [])
             }
-            package_key = _resolve_numeric_option_key(rub_packages, traffic_gb)
+            package_key = _resolve_numeric_option_key(currency_packages, traffic_gb)
             stars_package_key = _resolve_numeric_option_key(stars_packages, traffic_gb)
-            price = rub_packages.get(package_key) if package_key is not None else None
+            price = currency_packages.get(package_key) if package_key is not None else None
             stars_price = (
                 stars_packages.get(stars_package_key) if stars_package_key is not None else None
             )
@@ -224,7 +242,7 @@ async def create_payment_route(request: web.Request) -> web.Response:
                 return _json_error(400, "invalid_plan", "Invalid subscription period")
             if months not in tariff.enabled_periods:
                 return _json_error(400, "invalid_plan", "Subscription period is not available")
-            price = tariff.period_price(months, "rub")
+            price = tariff.period_price(months, default_currency)
             stars_price_raw = tariff.period_price(months, "stars")
             stars_price = int(stars_price_raw) if stars_price_raw and stars_price_raw > 0 else None
             if price is None and method != "stars":
@@ -296,13 +314,13 @@ async def create_payment_route(request: web.Request) -> web.Response:
                 active_tariff = None
             if not active_tariff or active_tariff.billing_model != "period":
                 return _json_error(400, "invalid_plan", "Device top-up is not available")
-            currency = "stars" if method == "stars" else "rub"
+            currency = "stars" if method == "stars" else default_currency
             hwid_quote = await subscription_service.quote_hwid_device_topup(
                 session,
                 user_id=user_id,
                 device_count=int(payment_units),
                 tariff_key=sale_tariff_key,
-                renewal=_sale_mode_base(sale_mode) == "hwid_devices_renewal",
+                renewal=False,
                 currency=currency,
             )
             if not hwid_quote:
@@ -315,6 +333,25 @@ async def create_payment_route(request: web.Request) -> web.Response:
             else:
                 price = float(hwid_quote["price"])
                 stars_price = None
+        elif _sale_mode_base(sale_mode) == "subscription" and bool(
+            payment_payload.renew_hwid_devices
+        ):
+            currency = "stars" if method == "stars" else default_currency
+            sale_tariff_key = _sale_mode_tariff_key(sale_mode)
+            if sale_tariff_key:
+                hwid_quote = await subscription_service.quote_hwid_device_renewal_for_subscription(
+                    session,
+                    user_id=user_id,
+                    target_tariff_key=sale_tariff_key,
+                    months=int(payment_units),
+                    currency=currency,
+                )
+            if hwid_quote:
+                if method == "stars":
+                    stars_price = int(stars_price or 0) + int(hwid_quote["price"])
+                else:
+                    price = float(price or 0) + float(hwid_quote["price"])
+                    stars_price = None
         admin_ids = {int(item) for item in (settings.ADMIN_IDS or [])}
         is_admin = bool(db_user.telegram_id and int(db_user.telegram_id) in admin_ids)
         return await _create_subscription_payment(
@@ -325,6 +362,7 @@ async def create_payment_route(request: web.Request) -> web.Response:
             months=payment_units,
             price=float(price or 0),
             stars_price=stars_price,
+            currency=default_currency_code,
             lang=lang,
             sale_mode=sale_mode,
             traffic_gb=traffic_gb_for_payment,
@@ -353,6 +391,13 @@ async def activate_trial_route(request: web.Request) -> web.Response:
         db_user = await user_dal.get_user_by_id(session, user_id)
         if not db_user or db_user.is_banned:
             return _json_error(403, "access_denied", "Access denied")
+        telegram_required_reason = _trial_telegram_required_reason(settings, db_user)
+        if telegram_required_reason:
+            return _json_error(
+                400,
+                "trial_telegram_required",
+                telegram_required_reason,
+            )
 
         activation_result = await subscription_service.activate_trial_subscription(session, user_id)
         if not activation_result or not activation_result.get("activated"):
@@ -388,6 +433,28 @@ async def activate_trial_route(request: web.Request) -> web.Response:
             except Exception:
                 logger.exception("Failed to send WebApp trial activation notification")
 
+        try:
+            await message_log_dal.create_message_log_no_commit(
+                session,
+                {
+                    "user_id": user_id,
+                    "telegram_username": getattr(db_user, "username", None),
+                    "telegram_first_name": getattr(db_user, "first_name", None),
+                    "event_type": "webapp_trial_activate",
+                    "content": (
+                        f"Trial activated via WebApp for user_id={user_id}; "
+                        f"email={getattr(db_user, 'email', None) or 'N/A'}"
+                    ),
+                    "is_admin_event": False,
+                    "target_user_id": user_id,
+                    "timestamp": datetime.now(timezone.utc),
+                },
+            )
+        except Exception:
+            logger.exception("Failed to add WebApp trial activation audit log")
+
+        await session.commit()
+
         try:
             from db.dal import ad_dal as _ad_dal
 
@@ -583,6 +650,7 @@ async def tariff_change_payment_route(request: web.Request) -> web.Response:
     tariff_key = str(payment_payload.tariff_key or "").strip()
     settings: Settings = request.app["settings"]
     config = settings.tariffs_config
+    default_currency_code = default_payment_currency_code_for_settings(settings)
     if not config:
         return _json_error(404, "tariffs_unavailable", "Tariffs are not configured")
     if not tariff_key:
@@ -618,6 +686,7 @@ async def tariff_change_payment_route(request: web.Request) -> web.Response:
             months=1,
             price=price,
             stars_price=None,
+            currency=default_currency_code,
             lang=db_user.language_code or settings.DEFAULT_LANGUAGE,
             sale_mode=f"tariff_upgrade@{target.key}",
         )
@@ -650,26 +719,31 @@ async def device_topup_options_route(request: web.Request) -> web.Response:
             return _json_error(400, "device_topup_unavailable", "Device top-up is not available")
         lang = db_user.language_code or settings.DEFAULT_LANGUAGE
         active = await subscription_service.get_active_subscription_details(session, user_id)
-        renewal_available = bool(active and active.get("device_topup_renewal_available"))
         extra_hwid_valid_until = active.get("extra_hwid_devices_valid_until") if active else None
         extra_hwid_valid_until_text = (
             active.get("extra_hwid_devices_valid_until_text") if active else None
         ) or _billing_datetime_text(extra_hwid_valid_until)
         packages = tariff.hwid_device_packages
-        rub_counts = {int(package.count) for package in (packages.rub if packages else [])}
+        default_currency = default_currency_key_for_settings(settings)
+        default_currency_code = payment_currency_code(default_currency)
+        if packages and hasattr(packages, "for_currency"):
+            default_packages = packages.for_currency(default_currency)
+        else:
+            default_packages = getattr(packages, default_currency, []) if packages else []
+        currency_counts = {int(package.count) for package in default_packages}
         stars_counts = {int(package.count) for package in (packages.stars if packages else [])}
         plans = []
-        for count in sorted(rub_counts | stars_counts):
-            rub_quote = (
+        for count in sorted(currency_counts | stars_counts):
+            currency_quote = (
                 await subscription_service.quote_hwid_device_topup(
                     session,
                     user_id=user_id,
                     device_count=count,
                     tariff_key=tariff.key,
-                    renewal=renewal_available,
-                    currency="rub",
+                    renewal=False,
+                    currency=default_currency,
                 )
-                if count in rub_counts
+                if count in currency_counts
                 else None
             )
             stars_quote = (
@@ -678,30 +752,35 @@ async def device_topup_options_route(request: web.Request) -> web.Response:
                     user_id=user_id,
                     device_count=count,
                     tariff_key=tariff.key,
-                    renewal=renewal_available,
+                    renewal=False,
                     currency="stars",
                 )
                 if count in stars_counts
                 else None
             )
-            if not rub_quote and not stars_quote:
+            if not currency_quote and not stars_quote:
                 continue
-            sale_mode_for_plan = "hwid_devices_renewal" if renewal_available else "hwid_devices"
+            quote = currency_quote or stars_quote
+            valid_from = quote.get("valid_from")
+            valid_until = quote.get("valid_until")
             plan = {
-                "id": f"{tariff.key}:hwid:{count}{':renewal' if renewal_available else ''}",
+                "id": f"{tariff.key}:hwid:{count}",
                 "tariff_key": tariff.key,
                 "tariff_name": tariff.name(lang),
                 "billing_model": tariff.billing_model,
-                "sale_mode": sale_mode_for_plan,
+                "sale_mode": "hwid_devices",
+                "renewal": False,
                 "months": count,
                 "device_count": count,
-                "price": float(rub_quote.get("price") if rub_quote else 0),
-                "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+                "price": float(currency_quote.get("price") if currency_quote else 0),
+                "currency": default_currency_code,
                 "title": f"+{count}",
                 "subtitle": tariff.name(lang),
-                "valid_from": _billing_iso_datetime((rub_quote or stars_quote).get("valid_from")),
-                "valid_until": _billing_iso_datetime((rub_quote or stars_quote).get("valid_until")),
-                "proration_ratio": float((rub_quote or stars_quote).get("proration_ratio") or 0),
+                "valid_from": _billing_iso_datetime(valid_from),
+                "valid_from_text": _billing_datetime_text(valid_from),
+                "valid_until": _billing_iso_datetime(valid_until),
+                "valid_until_text": _billing_datetime_text(valid_until),
+                "proration_ratio": float(quote.get("proration_ratio") or 0),
             }
             if stars_quote and int(stars_quote.get("price") or 0) > 0:
                 plan["stars_price"] = int(stars_quote["price"])
@@ -717,10 +796,8 @@ async def device_topup_options_route(request: web.Request) -> web.Response:
                 else int(sub.extra_hwid_devices or 0),
                 "extra_hwid_devices_valid_until": _billing_iso_datetime(extra_hwid_valid_until),
                 "extra_hwid_devices_valid_until_text": extra_hwid_valid_until_text,
-                "renewal_available": renewal_available,
-                "renewal_recommended_count": int(active.get("extra_hwid_devices") or 0)
-                if active and renewal_available
-                else 0,
+                "renewal_available": False,
+                "renewal_recommended_count": 0,
                 "plans": plans,
             }
         )
@@ -886,7 +963,11 @@ async def payment_status_route(request: web.Request) -> web.Response:
         payment = await _refresh_yookassa_payment_status(request, session, payment)
         payment = await _refresh_wata_payment_status(request, session, payment)
         if payment.status == "succeeded":
-            await invalidate_webapp_user_caches(request.app["settings"], user_id)
+            await invalidate_webapp_user_caches(
+                request.app["settings"],
+                user_id,
+                include_devices=True,
+            )
         return web.json_response(
             {
                 "ok": True,
@@ -929,12 +1010,14 @@ async def _create_subscription_payment(
     price: float,
     stars_price: Optional[int],
     lang: str,
+    currency: Optional[str] = None,
     sale_mode: str = "subscription",
     traffic_gb: Optional[float] = None,
     is_admin: bool = False,
     hwid_quote: Optional[Dict[str, Any]] = None,
 ) -> web.Response:
     settings: Settings = request.app["settings"]
+    payment_currency = (currency or default_payment_currency_code_for_settings(settings)).upper()
     sale_mode = str(sale_mode or "subscription")
     traffic_sale = _sale_mode_is_traffic(sale_mode)
     hwid_devices_sale = _sale_mode_is_hwid_devices(sale_mode)
@@ -958,26 +1041,71 @@ async def _create_subscription_payment(
                 provider_spec.is_service_configured(request.app),
             )
             return _json_error(400, "payment_unavailable", "Payment method unavailable")
-        return await provider_spec.create_webapp_payment(
-            WebAppPaymentContext(
-                request=request,
-                session=session,
-                user_id=user_id,
-                method=method,
-                months=months,
-                price=price,
-                stars_price=stars_price,
-                description=description,
-                sale_mode=sale_mode,
-                traffic_gb=traffic_gb,
-                hwid_valid_from=hwid_quote.get("valid_from") if hwid_quote else None,
-                hwid_valid_until=hwid_quote.get("valid_until") if hwid_quote else None,
-                hwid_pricing_period_months=hwid_quote.get("pricing_period_months")
-                if hwid_quote
-                else None,
-                hwid_proration_ratio=hwid_quote.get("proration_ratio") if hwid_quote else None,
-                hwid_full_price=hwid_quote.get("full_price") if hwid_quote else None,
+        if not provider_spec.is_usable_for_payment_currency(settings, payment_currency):
+            logger.warning(
+                "WebApp payment method does not support currency: method=%s currency=%s",
+                method,
+                payment_currency,
             )
+            return _json_error(
+                400,
+                "unsupported_currency",
+                "Payment method does not support this currency",
+            )
+        if not provider_spec.is_usable_for_payment_amount(
+            settings,
+            payment_currency,
+            price,
+        ):
+            logger.warning(
+                "WebApp payment method does not support amount: method=%s amount=%s currency=%s",
+                method,
+                price,
+                payment_currency,
+            )
+            return _json_error(
+                400,
+                "payment_amount_below_minimum",
+                "Payment amount is below the provider minimum",
+            )
+        payment_context = WebAppPaymentContext(
+            request=request,
+            session=session,
+            user_id=user_id,
+            method=method,
+            months=months,
+            price=price,
+            stars_price=stars_price,
+            currency=payment_currency,
+            description=description,
+            sale_mode=sale_mode,
+            traffic_gb=traffic_gb,
+            hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+            hwid_valid_from=hwid_quote.get("valid_from") if hwid_quote else None,
+            hwid_valid_until=hwid_quote.get("valid_until") if hwid_quote else None,
+            hwid_pricing_period_months=hwid_quote.get("pricing_period_months")
+            if hwid_quote
+            else None,
+            hwid_proration_ratio=hwid_quote.get("proration_ratio") if hwid_quote else None,
+            hwid_full_price=hwid_quote.get("full_price") if hwid_quote else None,
         )
+        if provider_spec.reuse_webapp_payment:
+            from bot.payment_providers.shared import reusable_webapp_payment_response
+
+            try:
+                reusable_response = await reusable_webapp_payment_response(
+                    payment_context,
+                    provider_spec,
+                )
+            except Exception:
+                logger.exception(
+                    "Failed to verify reusable payment: user_id=%s provider=%s",
+                    user_id,
+                    provider_spec.provider_key,
+                )
+                reusable_response = None
+            if reusable_response is not None:
+                return reusable_response
+        return await provider_spec.create_webapp_payment(payment_context)
 
     return _json_error(400, "payment_unavailable", "Payment method unavailable")

backend/bot/app/web/webapp/payloads.py

@@ -49,6 +49,7 @@ class WebAppPaymentCreatePayload(BaseModel):
     device_count: Any = None
     tariff_key: Optional[constr(max_length=128)] = None
     sale_mode: Optional[constr(max_length=64)] = None
+    renew_hwid_devices: Optional[bool] = None
     description: Optional[constr(max_length=4096)] = None
     comment: Optional[constr(max_length=4096)] = None
     note: Optional[constr(max_length=4096)] = None

backend/bot/app/web/webapp/routes.py

@@ -46,10 +46,6 @@ def setup_subscription_webapp_routes(app: web.Application) -> None:
         rf"{WEBAPP_FAVICON_PATH}/{{digest:[0-9a-f]{{16}}}}/{{filename:[A-Za-z0-9_.-]+}}",
         webapp_favicon_route,
     )
-    app.router.add_get(
-        r"/webapp-emoji/{codepoints:[0-9a-f_]+}/512.{ext:gif|webp}",
-        webapp_animated_emoji_route,
-    )
     app.router.add_get("/subscription_webapp.{asset_hash:[0-9a-f]{8}}.css", css_asset_route)
     app.router.add_get("/subscription_webapp.css", css_asset_route)
     app.router.add_get(
@@ -89,6 +85,7 @@ def setup_subscription_webapp_routes(app: web.Application) -> None:
         "/api/account/telegram/notifications/probe",
         account_telegram_notifications_probe_route,
     )
+    app.router.add_post("/api/referral/welcome-bonus/claim", referral_welcome_bonus_claim_route)
     app.router.add_post("/api/promo/apply", apply_promo_route)
     app.router.add_post("/api/trial/activate", activate_trial_route)
     app.router.add_get("/api/devices", devices_route)

backend/bot/app/web/webapp/serializers.py

@@ -1,6 +1,11 @@
 # ruff: noqa: F401,F403,F405,I001
 from ._runtime import *  # noqa: F403,F405
 
+from bot.app.web.webapp.auth import (
+    _referral_welcome_telegram_required_reason,
+    _trial_telegram_required_reason,
+    _user_has_linked_telegram,
+)
 from config.subscription_guides_config import subscription_guides_available
 from config.webapp_themes_config import public_themes_catalog_payload
 from bot.services.telegram_notifications import (
@@ -64,10 +69,32 @@ async def _build_user_payload(request: web.Request, user_id: int) -> Dict[str, A
             if active and local_sub
             else None
         )
-        trial_available = bool(
+        trial_base_available = bool(
             settings.TRIAL_ENABLED
             and settings.TRIAL_DURATION_DAYS > 0
-            and not await subscription_service.has_had_any_subscription(session, user_id)
+            and not await subscription_service.has_trial_blocking_subscription(session, user_id)
+        )
+        trial_telegram_required_reason = (
+            _trial_telegram_required_reason(settings, db_user) if trial_base_available else None
+        )
+        trial_available = bool(trial_base_available and not trial_telegram_required_reason)
+        lang = _normalize_language(db_user.language_code or settings.DEFAULT_LANGUAGE)
+        plans_payload = _serialize_plans(
+            settings,
+            lang,
+            subscription_options=cached["subscription_options"],
+            stars_subscription_options=cached["stars_subscription_options"],
+            traffic_packages=cached["traffic_packages"],
+            stars_traffic_packages=cached["stars_traffic_packages"],
+        )
+        await _attach_hwid_renewal_quotes_to_plans(
+            session,
+            subscription_service,
+            user_id=user_id,
+            settings=settings,
+            active=active,
+            local_sub=local_sub,
+            plans=plans_payload,
         )
         avatar = await _ensure_cached_telegram_avatar(request, session, db_user)
         try:
@@ -75,9 +102,15 @@ async def _build_user_payload(request: web.Request, user_id: int) -> Dict[str, A
         except Exception:
             await session.rollback()
 
-    lang = _normalize_language(db_user.language_code or settings.DEFAULT_LANGUAGE)
     admin_ids = {int(x) for x in (settings.ADMIN_IDS or [])}
     is_admin = bool(db_user.telegram_id and int(db_user.telegram_id) in admin_ids)
+    telegram_linked = _user_has_linked_telegram(db_user)
+    referral_welcome_days = max(0, int(getattr(settings, "REFERRAL_WELCOME_BONUS_DAYS", 0) or 0))
+    referral_welcome_telegram_required_reason = (
+        _referral_welcome_telegram_required_reason(settings, db_user)
+        if db_user.referred_by_id and not active and referral_welcome_days > 0
+        else None
+    )
     telegram_notifications_status = normalize_telegram_notification_status(
         getattr(db_user, "telegram_notifications_status", None)
     )
@@ -94,7 +127,7 @@ async def _build_user_payload(request: web.Request, user_id: int) -> Dict[str, A
                 db_user.email and db_user.email_verified_at and db_user.password_hash
             ),
             "telegram_id": db_user.telegram_id,
-            "telegram_linked": bool(_telegram_id_for_user(db_user)),
+            "telegram_linked": telegram_linked,
             "telegram_notifications_status": telegram_notifications_status,
             "telegram_notifications_enabled": (
                 telegram_notifications_status == TELEGRAM_NOTIFICATIONS_ENABLED
@@ -120,22 +153,20 @@ async def _build_user_payload(request: web.Request, user_id: int) -> Dict[str, A
             "webapp_link": webapp_referral_link,
             "invited_count": referral_stats.get("invited_count", 0),
             "purchased_count": referral_stats.get("purchased_count", 0),
-            "welcome_bonus_days": max(
-                0, int(getattr(settings, "REFERRAL_WELCOME_BONUS_DAYS", 0) or 0)
+            "welcome_bonus_days": referral_welcome_days,
+            "welcome_bonus_without_telegram_enabled": bool(
+                getattr(settings, "REFERRAL_WELCOME_BONUS_WITHOUT_TELEGRAM_ENABLED", True)
             ),
+            "welcome_bonus_requires_telegram": bool(
+                referral_welcome_telegram_required_reason and not telegram_linked
+            ),
+            "welcome_bonus_block_reason": referral_welcome_telegram_required_reason,
             "one_bonus_per_referee": bool(
                 getattr(settings, "REFERRAL_ONE_BONUS_PER_REFEREE", False)
             ),
             "bonus_details": _serialize_referral_bonus_details(settings, lang),
         },
-        "plans": _serialize_plans(
-            settings,
-            lang,
-            subscription_options=cached["subscription_options"],
-            stars_subscription_options=cached["stars_subscription_options"],
-            traffic_packages=cached["traffic_packages"],
-            stars_traffic_packages=cached["stars_traffic_packages"],
-        ),
+        "plans": plans_payload,
         "payment_methods": _serialize_payment_methods(
             settings,
             request.app,
@@ -164,6 +195,11 @@ async def _build_user_payload(request: web.Request, user_id: int) -> Dict[str, A
             ),
             "trial_enabled": bool(settings.TRIAL_ENABLED),
             "trial_available": trial_available,
+            "trial_without_telegram_enabled": bool(
+                getattr(settings, "TRIAL_WITHOUT_TELEGRAM_ENABLED", True)
+            ),
+            "trial_requires_telegram": bool(trial_telegram_required_reason and not telegram_linked),
+            "trial_block_reason": trial_telegram_required_reason,
             "trial_duration_days": int(settings.TRIAL_DURATION_DAYS or 0),
             "trial_traffic_limit_gb": float(settings.TRIAL_TRAFFIC_LIMIT_GB or 0),
             "trial_traffic_strategy": getattr(settings, "TRIAL_TRAFFIC_STRATEGY", "NO_RESET"),
@@ -342,11 +378,12 @@ def _serialize_subscription(
                 and tariff.premium_topup_packages.has_any()
             )
             can_topup_traffic = bool(can_topup_regular_traffic or can_topup_premium_traffic)
-            # max_devices == 0 means unlimited — top-up is pointless in that case.
+            max_devices = _coerce_int_or_none(active.get("max_devices"))
+            # max_devices == 0 or None means unlimited — top-up is pointless in that case.
             can_topup_devices = bool(
                 tariff.billing_model == "period"
                 and tariff.has_hwid_device_packages()
-                and _coerce_int_or_none(active.get("max_devices")) != 0
+                and max_devices not in (None, 0)
             )
         except Exception:
             can_topup_regular_traffic = False
@@ -437,6 +474,102 @@ def _serialize_subscription(
     }
 
 
+def _webapp_iso_datetime(value: Optional[Any]) -> Optional[str]:
+    if not value:
+        return None
+    if isinstance(value, datetime):
+        normalized = value if value.tzinfo else value.replace(tzinfo=timezone.utc)
+        return normalized.isoformat()
+    return str(value)
+
+
+def _webapp_datetime_text(value: Optional[Any]) -> Optional[str]:
+    if not value:
+        return None
+    if isinstance(value, datetime):
+        normalized = value if value.tzinfo else value.replace(tzinfo=timezone.utc)
+        return normalized.strftime("%d.%m.%Y %H:%M")
+    return str(value)
+
+
+async def _attach_hwid_renewal_quotes_to_plans(
+    session: AsyncSession,
+    subscription_service: SubscriptionService,
+    *,
+    user_id: int,
+    settings: Settings,
+    active: Optional[Dict[str, Any]],
+    local_sub: Optional[Any],
+    plans: List[Dict[str, Any]],
+) -> None:
+    quote_method = getattr(subscription_service, "quote_hwid_device_renewal_for_subscription", None)
+    if not callable(quote_method):
+        return
+    if not active or not local_sub or not settings.tariffs_config:
+        return
+    if not active.get("end_date") or int(active.get("extra_hwid_devices") or 0) <= 0:
+        return
+
+    default_currency = default_currency_key_for_settings(settings)
+    default_currency_code = payment_currency_code(default_currency)
+    for plan in plans:
+        if str(plan.get("sale_mode") or "subscription") != "subscription":
+            continue
+        target_tariff_key = str(plan.get("tariff_key") or "").strip()
+        if not target_tariff_key:
+            continue
+        try:
+            months = int(plan.get("months") or 0)
+        except (TypeError, ValueError):
+            continue
+        if months <= 0:
+            continue
+        try:
+            currency_quote = await quote_method(
+                session,
+                user_id=user_id,
+                target_tariff_key=target_tariff_key,
+                months=months,
+                currency=default_currency,
+            )
+            stars_quote = await quote_method(
+                session,
+                user_id=user_id,
+                target_tariff_key=target_tariff_key,
+                months=months,
+                currency="stars",
+            )
+        except Exception:
+            logger.exception(
+                "Failed to quote HWID renewal for plan %s/%s",
+                target_tariff_key,
+                months,
+            )
+            continue
+        quote = currency_quote or stars_quote
+        if not quote:
+            continue
+        valid_from = quote.get("valid_from")
+        valid_until = quote.get("valid_until")
+        active_until = quote.get("active_until")
+        renewal = {
+            "available": True,
+            "device_count": int(quote.get("device_count") or 0),
+            "price": float(currency_quote.get("price") if currency_quote else 0),
+            "currency": default_currency_code,
+            "valid_from": _webapp_iso_datetime(valid_from),
+            "valid_from_text": _webapp_datetime_text(valid_from),
+            "valid_until": _webapp_iso_datetime(valid_until),
+            "valid_until_text": _webapp_datetime_text(valid_until),
+            "active_until": _webapp_iso_datetime(active_until),
+            "active_until_text": _webapp_datetime_text(active_until),
+            "pricing_period_months": int(quote.get("pricing_period_months") or months),
+        }
+        if stars_quote and int(stars_quote.get("price") or 0) > 0:
+            renewal["stars_price"] = int(stars_quote["price"])
+        plan["hwid_renewal"] = renewal
+
+
 def _build_install_share_link(
     request: Optional[web.Request],
     settings: Settings,
@@ -472,6 +605,8 @@ def _serialize_plans(
 ) -> List[Dict[str, Any]]:
     tariffs_config = settings.tariffs_config
     if tariffs_config:
+        default_currency = default_currency_key_for_settings(settings)
+        default_currency_code = payment_currency_code(default_currency)
         plans: List[Dict[str, Any]] = []
         for tariff in tariffs_config.enabled_tariffs:
             common = {
@@ -481,7 +616,7 @@ def _serialize_plans(
                 "billing_model": tariff.billing_model,
                 "description": tariff.description(lang),
                 "squad_uuids": tariff.squad_uuids,
-                "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+                "currency": default_currency_code,
                 "hwid_device_limit": tariff.hwid_device_limit,
                 "hwid_device_packages": _serialize_hwid_device_packages(
                     settings,
@@ -493,8 +628,11 @@ def _serialize_plans(
                 else [],
             }
             if tariff.billing_model == "period":
-                for months in sorted(tariff.enabled_periods):
-                    price = tariff.period_price(int(months), "rub")
+                # Render periods in the configured order (enabled_periods is the
+                # source of truth for purchase-period ordering, matching the bot
+                # keyboards). Do not sort so admins can reorder via drag & drop.
+                for months in tariff.enabled_periods:
+                    price = tariff.period_price(int(months), default_currency)
                     stars_price = tariff.period_price(int(months), "stars")
                     if price is None and (stars_price is None or int(stars_price) <= 0):
                         continue
@@ -512,9 +650,13 @@ def _serialize_plans(
                         plan["stars_price"] = int(stars_price)
                     plans.append(plan)
             else:
-                rub_packages = {
+                currency_packages = {
                     float(package.gb): float(package.price)
-                    for package in (tariff.traffic_packages.rub if tariff.traffic_packages else [])
+                    for package in (
+                        tariff.traffic_packages.for_currency(default_currency)
+                        if tariff.traffic_packages
+                        else []
+                    )
                 }
                 stars_packages = {
                     float(package.gb): int(float(package.price))
@@ -522,8 +664,15 @@ def _serialize_plans(
                         tariff.traffic_packages.stars if tariff.traffic_packages else []
                     )
                 }
-                for traffic_gb in sorted(set(rub_packages) | set(stars_packages)):
-                    price = rub_packages.get(traffic_gb)
+                # Preserve the configured package order (default-currency list first,
+                # then any Stars-only volumes) so admins can reorder via drag & drop.
+                # Matches the bot keyboard, which iterates the package list as-is.
+                ordered_gb: List[float] = []
+                for traffic_gb in list(currency_packages) + list(stars_packages):
+                    if traffic_gb not in ordered_gb:
+                        ordered_gb.append(traffic_gb)
+                for traffic_gb in ordered_gb:
+                    price = currency_packages.get(traffic_gb)
                     stars_price = stars_packages.get(traffic_gb)
                     if price is None and (stars_price is None or int(stars_price) <= 0):
                         continue
@@ -609,16 +758,19 @@ def _serialize_topup_packages(
     sale_mode: str = "topup",
     title_prefix: str = "",
 ) -> List[Dict[str, Any]]:
-    rub_packages = {
-        float(package.gb): float(package.price) for package in (packages.rub if packages else [])
+    default_currency = default_currency_key_for_settings(settings)
+    default_currency_code = payment_currency_code(default_currency)
+    currency_packages = {
+        float(package.gb): float(package.price)
+        for package in (packages.for_currency(default_currency) if packages else [])
     }
     stars_packages = {
         float(package.gb): int(float(package.price))
         for package in (packages.stars if packages else [])
     }
     plans: List[Dict[str, Any]] = []
-    for traffic_gb in sorted(set(rub_packages) | set(stars_packages)):
-        price = rub_packages.get(traffic_gb)
+    for traffic_gb in sorted(set(currency_packages) | set(stars_packages)):
+        price = currency_packages.get(traffic_gb)
         stars_price = stars_packages.get(traffic_gb)
         if price is None and (stars_price is None or int(stars_price) <= 0):
             continue
@@ -632,7 +784,7 @@ def _serialize_topup_packages(
             "months": int(traffic_value) if traffic_value.is_integer() else traffic_value,
             "traffic_gb": traffic_value,
             "price": float(price or 0),
-            "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+            "currency": default_currency_code,
             "title": f"{title_prefix}{_format_traffic_title(traffic_value, lang)}",
             "subtitle": tariff.premium_name(lang)
             if sale_mode == "premium_topup"
@@ -650,16 +802,19 @@ def _serialize_hwid_device_packages(
     packages: Optional[Any],
     lang: str,
 ) -> List[Dict[str, Any]]:
-    rub_packages = {
-        int(package.count): float(package.price) for package in (packages.rub if packages else [])
+    default_currency = default_currency_key_for_settings(settings)
+    default_currency_code = payment_currency_code(default_currency)
+    currency_packages = {
+        int(package.count): float(package.price)
+        for package in (packages.for_currency(default_currency) if packages else [])
     }
     stars_packages = {
         int(package.count): int(float(package.price))
         for package in (packages.stars if packages else [])
     }
     plans: List[Dict[str, Any]] = []
-    for count in sorted(set(rub_packages) | set(stars_packages)):
-        price = rub_packages.get(count)
+    for count in sorted(set(currency_packages) | set(stars_packages)):
+        price = currency_packages.get(count)
         stars_price = stars_packages.get(count)
         if price is None and (stars_price is None or int(stars_price) <= 0):
             continue
@@ -672,7 +827,7 @@ def _serialize_hwid_device_packages(
             "months": int(count),
             "device_count": int(count),
             "price": float(price or 0),
-            "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+            "currency": default_currency_code,
             "title": f"+{count}",
             "subtitle": tariff.name(lang),
         }
@@ -689,6 +844,8 @@ def _serialize_tariff_change_target(
     options: Dict[str, Any],
     lang: str,
 ) -> Dict[str, Any]:
+    default_currency = default_currency_key_for_settings(settings)
+    default_currency_code = payment_currency_code(default_currency)
     actions: List[Dict[str, Any]] = []
     mode = str(options.get("mode") or "")
     if mode == "period_to_period":
@@ -711,7 +868,7 @@ def _serialize_tariff_change_target(
                     "kind": "payment",
                     "title": "paid_diff",
                     "price": paid_diff,
-                    "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+                    "currency": default_currency_code,
                 }
             )
     elif mode == "period_to_traffic":
@@ -733,13 +890,17 @@ def _serialize_tariff_change_target(
                 "title": f"+{package.gb:g} GB",
                 "traffic_gb": float(package.gb),
                 "price": float(package.price),
-                "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+                "currency": default_currency_code,
             }
-            for package in (tariff.traffic_packages.rub if tariff.traffic_packages else [])
+            for package in (
+                tariff.traffic_packages.for_currency(default_currency)
+                if tariff.traffic_packages
+                else []
+            )
         )
     else:
         for months in tariff.enabled_periods:
-            price = tariff.period_price(int(months), "rub")
+            price = tariff.period_price(int(months), default_currency)
             if price:
                 actions.append(
                     {
@@ -748,7 +909,7 @@ def _serialize_tariff_change_target(
                         "months": int(months),
                         "title": _format_months_title(int(months), lang),
                         "price": float(price),
-                        "currency": settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+                        "currency": default_currency_code,
                     }
                 )
     return {
@@ -772,18 +933,25 @@ def _serialize_payment_methods(
     from bot.payment_providers import get_provider_spec, resolve_provider_presentation
 
     methods: List[Dict[str, Any]] = []
+    payment_currency = default_payment_currency_code_for_settings(settings)
     for method in settings.payment_methods_order:
         method = method.lower()
         spec = get_provider_spec(method)
-        if spec and spec.is_visible_for_user(settings, app, is_admin=is_admin):
+        if (
+            spec
+            and spec.is_visible_for_user(settings, app, is_admin=is_admin)
+            and spec.is_usable_for_payment_currency(settings, payment_currency)
+        ):
             presentation = resolve_provider_presentation(spec, settings, language=lang)
-            methods.append(
-                {
-                    "id": method,
-                    "name": presentation.webapp_label,
-                    "icon": presentation.webapp_icon,
-                }
-            )
+            payload = {
+                "id": method,
+                "name": presentation.webapp_label,
+                "icon": presentation.webapp_icon,
+            }
+            minimum = spec.payment_minimum(settings, payment_currency)
+            if minimum:
+                payload.update(minimum)
+            methods.append(payload)
     return methods
 
 

backend/bot/handlers/admin/broadcast.py

@@ -155,7 +155,7 @@ async def change_broadcast_target_handler(
         return
 
     new_target = callback.data.split(":")[1]
-    if new_target not in {"all", "active", "inactive"}:
+    if new_target not in {"all", "active", "inactive", "expired"}:
         await callback.answer("Unknown target.", show_alert=True)
         return
 
@@ -247,6 +247,8 @@ async def confirm_broadcast_callback_handler(
             user_ids = await user_dal.get_user_ids_with_active_subscription(session)
         elif target == "inactive":
             user_ids = await user_dal.get_user_ids_without_active_subscription(session)
+        elif target == "expired":
+            user_ids = await user_dal.get_user_ids_with_expired_subscription(session)
         else:
             user_ids = await user_dal.get_all_active_user_ids_for_broadcast(session)
 

backend/bot/handlers/admin/statistics.py

@@ -13,6 +13,7 @@ from bot.middlewares.i18n import JsonI18n
 from bot.payment_providers import pending_statuses
 from bot.services.panel_api_service import PanelApiService
 from config.settings import Settings
+from config.tariffs_config import default_payment_currency_code_for_settings
 from db.dal import panel_sync_dal, payment_dal, user_dal
 from db.models import PanelSyncStatus, Payment
 
@@ -71,11 +72,17 @@ async def show_statistics_handler(
         f"📊 {_('admin_user_stats_total_label')}: <b>{user_stats['total_users']}</b>"
     )
     # Removed: Active today moved to panel stats
+    stats_text_parts.append(
+        f"📡 {_('admin_user_stats_active_subscription_label')}: <b>{user_stats['active_subscriptions']}</b>"  # noqa: E501
+    )
     stats_text_parts.append(
         f"💳 {_('admin_user_stats_paid_subs_label')}: <b>{user_stats['paid_subscriptions']}</b>"
     )
     stats_text_parts.append(
-        f"🆓 {_('admin_user_stats_trial_label')}: <b>{user_stats['trial_users']}</b>"
+        f"🧪 {_('admin_user_stats_trial_label')}: <b>{user_stats['trial_users']}</b>"
+    )
+    stats_text_parts.append(
+        f"🎁 {_('admin_user_stats_free_subscription_label')}: <b>{user_stats['free_subscription_users']}</b>"  # noqa: E501
     )
     stats_text_parts.append(
         f"😴 {_('admin_user_stats_inactive_label')}: <b>{user_stats['inactive_users']}</b>"
@@ -189,19 +196,20 @@ async def show_statistics_handler(
 
     # Financial statistics
     financial_stats = await payment_dal.get_financial_statistics(session)
+    currency = default_payment_currency_code_for_settings(settings)
 
     stats_text_parts.append(f"\n<b>💰 {_('admin_financial_stats_header')}</b>")
     stats_text_parts.append(
-        f"📅 {_('admin_financial_today_label')}: <b>{financial_stats['today_revenue']:.2f} RUB</b> ({financial_stats['today_payments_count']} {_('admin_financial_payments_label')})"  # noqa: E501
+        f"📅 {_('admin_financial_today_label')}: <b>{financial_stats['today_revenue']:.2f} {currency}</b> ({financial_stats['today_payments_count']} {_('admin_financial_payments_label')})"  # noqa: E501
     )
     stats_text_parts.append(
-        f"📅 {_('admin_financial_week_label')}: <b>{financial_stats['week_revenue']:.2f} RUB</b>"
+        f"📅 {_('admin_financial_week_label')}: <b>{financial_stats['week_revenue']:.2f} {currency}</b>"  # noqa: E501
     )
     stats_text_parts.append(
-        f"📅 {_('admin_financial_month_label')}: <b>{financial_stats['month_revenue']:.2f} RUB</b>"
+        f"📅 {_('admin_financial_month_label')}: <b>{financial_stats['month_revenue']:.2f} {currency}</b>"  # noqa: E501
     )
     stats_text_parts.append(
-        f"🏆 {_('admin_financial_all_time_label')}: <b>{financial_stats['all_time_revenue']:.2f} RUB</b>"  # noqa: E501
+        f"🏆 {_('admin_financial_all_time_label')}: <b>{financial_stats['all_time_revenue']:.2f} {currency}</b>"  # noqa: E501
     )
 
     last_payments_models: List[Payment] = await payment_dal.get_recent_payment_logs_with_user(

backend/bot/handlers/admin/user_management.py

@@ -27,6 +27,7 @@ from bot.utils.text_sanitizer import (
     username_for_display,
 )
 from config.settings import Settings
+from config.tariffs_config import default_payment_currency_code_for_settings
 from db.dal import message_log_dal, subscription_dal, user_dal
 from db.models import User
 
@@ -88,6 +89,31 @@ async def _find_user_by_admin_input(
     return None
 
 
+def _admin_user_reference_label(
+    user: Optional[User], fallback_user_id: Optional[int] = None
+) -> str:
+    if user is None:
+        return f"ID {fallback_user_id}" if fallback_user_id is not None else "N/A"
+
+    first_name = sanitize_display_name(user.first_name) if user.first_name else ""
+    last_name = sanitize_display_name(user.last_name) if user.last_name else ""
+    full_name = f"{first_name} {last_name}".strip()
+    if full_name:
+        label = full_name
+    elif user.username:
+        label = username_for_display(user.username, with_at=True)
+    elif user.email:
+        label = user.email
+    else:
+        label = f"ID {user.user_id}"
+    return f"{label} · ID {user.user_id}"
+
+
+def _admin_user_button_label(user: User) -> str:
+    label = _admin_user_reference_label(user)
+    return label[:64]
+
+
 async def users_list_handler(
     callback: types.CallbackQuery,
     i18n_data: dict,
@@ -195,7 +221,13 @@ def get_user_card_keyboard(
         text=_(key="admin_user_refresh_button"), callback_data=f"user_action:refresh:{user_id}"
     )
 
-    # Row 3b: Premium override + traffic grant
+    # Row 3b: Referral details
+    builder.button(
+        text=_(key="admin_user_invitees_button"),
+        callback_data=f"user_action:invitees:{user_id}:0",
+    )
+
+    # Row 4: Premium override + traffic grant
     builder.button(
         text=_(key="admin_user_premium_override_button"),
         callback_data=f"user_action:premium_override:{user_id}",
@@ -204,6 +236,10 @@ def get_user_card_keyboard(
         text=_(key="admin_user_traffic_grant_button"),
         callback_data=f"user_action:traffic_grant:{user_id}",
     )
+    builder.button(
+        text=_(key="admin_user_hwid_limit_button"),
+        callback_data=f"user_action:hwid_limit:{user_id}",
+    )
 
     # Row 4: Quick links — only for users with a real Telegram profile
     # (synthetic email-only users have a negative user_id with no tg profile).
@@ -229,9 +265,9 @@ def get_user_card_keyboard(
 
     quick_links_count = (1 if has_self_link else 0) + (1 if has_referrer_link else 0)
     if quick_links_count == 0:
-        builder.adjust(2, 2, 2, 2, 1, 2)
+        builder.adjust(2, 2, 2, 1, 3, 1, 2)
     else:
-        builder.adjust(2, 2, 2, 2, quick_links_count, 1, 2)
+        builder.adjust(2, 2, 2, 1, 3, quick_links_count, 1, 2)
     return builder
 
 
@@ -314,7 +350,11 @@ async def format_user_card(
 
     # Referral info
     if user.referred_by_id:
-        card_parts.append(f"{_('admin_user_referral_label')} {hcode(str(user.referred_by_id))}")
+        referrer = await user_dal.get_referrer_for_user(session, user)
+        card_parts.append(
+            f"{_('admin_user_invited_by_label')} "
+            f"{hcode(_admin_user_reference_label(referrer, user.referred_by_id))}"
+        )
 
     # Panel info
     if user.panel_user_uuid:
@@ -367,6 +407,26 @@ async def format_user_card(
                     f"{_('admin_user_traffic_label')} {hcode(f'{used_display} / {limit_display}')}"
                 )
 
+            max_devices = subscription_details.get("max_devices")
+            extra_hwid_devices = int(subscription_details.get("extra_hwid_devices") or 0)
+            if max_devices is not None:
+                if int(max_devices) == 0:
+                    devices_display = _("admin_hwid_limit_state_unlimited")
+                elif extra_hwid_devices > 0:
+                    base_hwid_limit = subscription_details.get("base_hwid_device_limit")
+                    if base_hwid_limit is None:
+                        devices_display = _("admin_hwid_limit_state_count", count=int(max_devices))
+                    else:
+                        devices_display = _(
+                            "admin_hwid_limit_state_with_extra",
+                            total=int(max_devices),
+                            base=int(base_hwid_limit),
+                            extra=extra_hwid_devices,
+                        )
+                else:
+                    devices_display = _("admin_hwid_limit_state_count", count=int(max_devices))
+                card_parts.append(f"{_('admin_user_hwid_limit_label')} {hcode(devices_display)}")
+
             premium_unlimited = bool(subscription_details.get("premium_unlimited_override"))
             premium_bonus_bytes = int(subscription_details.get("premium_bonus_bytes") or 0)
             if premium_unlimited:
@@ -407,17 +467,18 @@ async def format_user_card(
         try:
             from db.dal import payment_dal
 
+            currency = default_payment_currency_code_for_settings(settings)
+
             # Total amount paid by this user
             total_paid = await payment_dal.get_user_total_paid(session, user.user_id)
             card_parts.append(
-                f"{_('admin_user_total_paid_label')} {hcode(f'{total_paid:.2f} RUB')}"
+                f"{_('admin_user_total_paid_label')} {hcode(f'{total_paid:.2f} {currency}')}"
             )
 
             # Total revenue from referrals
             referral_revenue = await payment_dal.get_referral_revenue(session, user.user_id)
-            card_parts.append(
-                f"{_('admin_user_referral_revenue_label')} {hcode(f'{referral_revenue:.2f} RUB')}"
-            )
+            referral_revenue_text = hcode(f"{referral_revenue:.2f} {currency}")
+            card_parts.append(f"{_('admin_user_referral_revenue_label')} {referral_revenue_text}")
         except Exception as e_fin:
             logging.error(
                 f"Failed to build financial analytics for admin card {user.user_id}: {e_fin}"
@@ -619,6 +680,12 @@ async def user_action_handler(
         await handle_send_message_prompt(callback, state, user, i18n, current_lang)
     elif action == "view_logs":
         await handle_view_user_logs(callback, user, session, settings, i18n, current_lang)
+    elif action == "invitees":
+        try:
+            page = max(0, int(parts[3])) if len(parts) > 3 else 0
+        except (TypeError, ValueError):
+            page = 0
+        await handle_view_user_invitees(callback, user, session, i18n, current_lang, page=page)
     elif action == "refresh":
         await handle_refresh_user_card(
             callback, user, subscription_service, session, settings, i18n, current_lang
@@ -663,6 +730,32 @@ async def user_action_handler(
         await handle_traffic_grant_prompt(callback, state, user, "regular", i18n, current_lang)
     elif action == "traffic_grant_premium":
         await handle_traffic_grant_prompt(callback, state, user, "premium", i18n, current_lang)
+    elif action == "hwid_limit":
+        await handle_hwid_limit_menu(callback, state, user, session, i18n, current_lang)
+    elif action == "hwid_limit_set_unlimited":
+        await handle_hwid_limit_apply(
+            callback,
+            user,
+            subscription_service,
+            session,
+            settings,
+            i18n,
+            current_lang,
+            hwid_device_limit=0,
+        )
+    elif action == "hwid_limit_reset":
+        await handle_hwid_limit_apply(
+            callback,
+            user,
+            subscription_service,
+            session,
+            settings,
+            i18n,
+            current_lang,
+            hwid_device_limit=None,
+        )
+    elif action == "hwid_limit_set_number":
+        await handle_hwid_limit_prompt(callback, state, user, i18n, current_lang)
     else:
         await callback.answer(_("admin_unknown_action"), show_alert=True)
 
@@ -807,6 +900,162 @@ async def handle_premium_override_bonus_prompt(
     await callback.answer()
 
 
+def _admin_hwid_limit_state_text(
+    get_text: Callable[..., str],
+    hwid_device_limit: Optional[int],
+    extra_hwid_devices: int = 0,
+) -> str:
+    if hwid_device_limit is None:
+        return get_text("admin_hwid_limit_state_default")
+    base_limit = int(hwid_device_limit)
+    if base_limit == 0:
+        return get_text("admin_hwid_limit_state_unlimited")
+    extra = max(0, int(extra_hwid_devices or 0))
+    if extra > 0:
+        return get_text(
+            "admin_hwid_limit_state_with_extra",
+            total=base_limit + extra,
+            base=base_limit,
+            extra=extra,
+        )
+    return get_text("admin_hwid_limit_state_count", count=base_limit)
+
+
+async def handle_hwid_limit_menu(
+    callback: types.CallbackQuery,
+    state: FSMContext,
+    user: User,
+    session: AsyncSession,
+    i18n_instance,
+    lang: str,
+) -> None:
+    """Show HWID device limit override controls."""
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+
+    active_sub = await subscription_dal.get_active_subscription_by_user_id(session, user.user_id)
+    if not active_sub:
+        await callback.answer(_("admin_hwid_limit_no_subscription"), show_alert=True)
+        return
+
+    current_text = _admin_hwid_limit_state_text(
+        _,
+        getattr(active_sub, "hwid_device_limit", None),
+        int(getattr(active_sub, "extra_hwid_devices", 0) or 0),
+    )
+    text = "\n".join(
+        [
+            f"<b>{_('admin_hwid_limit_title')}</b>",
+            "",
+            _("admin_hwid_limit_hint"),
+            "",
+            _("admin_hwid_limit_current", current=current_text),
+        ]
+    )
+
+    builder = InlineKeyboardBuilder()
+    builder.button(
+        text=_("admin_hwid_limit_btn_set_number"),
+        callback_data=f"user_action:hwid_limit_set_number:{user.user_id}",
+    )
+    builder.button(
+        text=_("admin_hwid_limit_btn_unlimited"),
+        callback_data=f"user_action:hwid_limit_set_unlimited:{user.user_id}",
+    )
+    builder.button(
+        text=_("admin_hwid_limit_btn_reset"),
+        callback_data=f"user_action:hwid_limit_reset:{user.user_id}",
+    )
+    builder.button(
+        text=_("admin_user_back_to_card_button"),
+        callback_data=f"user_action:refresh:{user.user_id}",
+    )
+    builder.adjust(1, 1, 1, 1)
+
+    try:
+        await callback.message.edit_text(text, reply_markup=builder.as_markup(), parse_mode="HTML")
+    except Exception:
+        await callback.message.answer(text, reply_markup=builder.as_markup(), parse_mode="HTML")
+    await state.update_data(target_user_id=user.user_id)
+    await callback.answer()
+
+
+async def handle_hwid_limit_apply(
+    callback: types.CallbackQuery,
+    user: User,
+    subscription_service: SubscriptionService,
+    session: AsyncSession,
+    settings: Settings,
+    i18n_instance,
+    lang: str,
+    *,
+    hwid_device_limit: Optional[int],
+) -> None:
+    """Persist a HWID device base limit override and push it to the panel."""
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+
+    try:
+        active_sub = await subscription_dal.get_active_subscription_by_user_id(
+            session, user.user_id
+        )
+        if not active_sub:
+            await callback.answer(_("admin_hwid_limit_no_subscription"), show_alert=True)
+            return
+
+        active_sub.hwid_device_limit = hwid_device_limit
+
+        effective_limit = await subscription_service.sync_hwid_device_limit_to_panel(
+            session, user.user_id
+        )
+        await message_log_dal.create_message_log_no_commit(
+            session,
+            {
+                "user_id": callback.from_user.id if callback.from_user else user.user_id,
+                "event_type": "admin:hwid_device_limit",
+                "content": (
+                    f"hwid_device_limit={hwid_device_limit!r} "
+                    f"effective_hwid_device_limit={effective_limit!r}"
+                ),
+                "is_admin_event": True,
+                "target_user_id": user.user_id,
+                "timestamp": datetime.now(timezone.utc),
+            },
+        )
+        await session.commit()
+
+        await callback.answer(_("admin_hwid_limit_saved"), show_alert=False)
+        await handle_refresh_user_card(
+            callback, user, subscription_service, session, settings, i18n_instance, lang
+        )
+    except Exception as exc:
+        logging.error(
+            "Failed to apply HWID device limit for user %s: %s",
+            user.user_id,
+            exc,
+            exc_info=True,
+        )
+        await session.rollback()
+        await callback.answer(_("admin_hwid_limit_save_error"), show_alert=True)
+
+
+async def handle_hwid_limit_prompt(
+    callback: types.CallbackQuery,
+    state: FSMContext,
+    user: User,
+    i18n_instance,
+    lang: str,
+) -> None:
+    """Ask admin for an explicit HWID device limit."""
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    await state.update_data(target_user_id=user.user_id)
+    await state.set_state(AdminStates.waiting_for_hwid_device_limit)
+    prompt = _("admin_hwid_limit_prompt", user_id=user.user_id)
+    try:
+        await callback.message.edit_text(prompt)
+    except Exception:
+        await callback.message.answer(prompt)
+    await callback.answer()
+
+
 async def handle_traffic_grant_menu(
     callback: types.CallbackQuery,
     user: User,
@@ -889,8 +1138,7 @@ async def handle_reset_trial(
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
 
     try:
-        # Delete all user subscriptions to reset trial eligibility
-        await subscription_dal.delete_all_user_subscriptions(session, user.user_id)
+        await user_dal.mark_trial_eligibility_reset(session, user.user_id)
         await session.commit()
 
         await callback.answer(_("admin_user_trial_reset_success"), show_alert=True)
@@ -1056,6 +1304,120 @@ async def handle_view_user_logs(
         await callback.answer(_("admin_user_logs_error"), show_alert=True)
 
 
+async def handle_view_user_invitees(
+    callback: types.CallbackQuery,
+    user: User,
+    session: AsyncSession,
+    i18n_instance,
+    lang: str,
+    *,
+    page: int = 0,
+):
+    """Show users invited by the selected account."""
+    _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    page_size = 10
+    safe_page = max(0, int(page or 0))
+
+    try:
+        total = await user_dal.count_users_referred_by(session, user.user_id)
+        total_pages = max(1, (total + page_size - 1) // page_size)
+        if safe_page >= total_pages:
+            safe_page = total_pages - 1
+        invitees = await user_dal.get_users_referred_by(
+            session,
+            user.user_id,
+            limit=page_size,
+            offset=safe_page * page_size,
+        )
+
+        header = _(
+            "admin_user_invitees_message_title",
+            user=hcode(_admin_user_reference_label(user)),
+            total=total,
+            current=safe_page + 1,
+            total_pages=total_pages,
+        )
+        if total <= 0:
+            invitees_text = f"{header}\n\n{_('admin_user_invitees_empty')}"
+        else:
+            lines = []
+            for index, invitee in enumerate(invitees, start=safe_page * page_size + 1):
+                registered = (
+                    invitee.registration_date.strftime("%Y-%m-%d")
+                    if invitee.registration_date
+                    else ""
+                )
+                suffix = (
+                    _("admin_user_invitee_registered_suffix", date=registered) if registered else ""
+                )
+                lines.append(
+                    _(
+                        "admin_user_invitee_item",
+                        index=index,
+                        user=hcode(_admin_user_reference_label(invitee)),
+                        suffix=suffix,
+                    )
+                )
+            invitees_text = "\n".join([header, "", *lines])
+
+        builder = InlineKeyboardBuilder()
+        for invitee in invitees:
+            builder.row(
+                types.InlineKeyboardButton(
+                    text=_admin_user_button_label(invitee),
+                    callback_data=f"user_action:refresh:{invitee.user_id}",
+                )
+            )
+
+        pagination_buttons = []
+        if safe_page > 0:
+            pagination_buttons.append(
+                types.InlineKeyboardButton(
+                    text=_("prev_page_button"),
+                    callback_data=f"user_action:invitees:{user.user_id}:{safe_page - 1}",
+                )
+            )
+        if safe_page < total_pages - 1:
+            pagination_buttons.append(
+                types.InlineKeyboardButton(
+                    text=_("next_page_button"),
+                    callback_data=f"user_action:invitees:{user.user_id}:{safe_page + 1}",
+                )
+            )
+        if pagination_buttons:
+            builder.row(*pagination_buttons)
+        builder.row(
+            types.InlineKeyboardButton(
+                text=_("admin_user_back_to_card_button"),
+                callback_data=f"user_action:refresh:{user.user_id}",
+            )
+        )
+        builder.row(
+            types.InlineKeyboardButton(
+                text=_("back_to_admin_panel_button"), callback_data="admin_action:main"
+            )
+        )
+
+        try:
+            await callback.message.edit_text(
+                invitees_text, reply_markup=builder.as_markup(), parse_mode="HTML"
+            )
+        except Exception:
+            await callback.message.answer(
+                invitees_text, reply_markup=builder.as_markup(), parse_mode="HTML"
+            )
+
+        await callback.answer()
+    except Exception as exc:
+        logging.error(
+            "Error viewing invitees for user %s: %s",
+            user.user_id,
+            exc,
+            exc_info=True,
+        )
+        await callback.answer(_("admin_user_invitees_error"), show_alert=True)
+
+
 async def handle_refresh_user_card(
     callback: types.CallbackQuery,
     user: User,
@@ -1815,6 +2177,114 @@ async def process_premium_override_bonus_handler(
         await state.clear()
 
 
+@router.message(AdminStates.waiting_for_hwid_device_limit, F.text)
+async def process_hwid_device_limit_handler(
+    message: types.Message,
+    state: FSMContext,
+    settings: Settings,
+    i18n_data: dict,
+    subscription_service: SubscriptionService,
+    session: AsyncSession,
+):
+    """Read explicit HWID device limit and apply it."""
+    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
+    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
+    if not i18n:
+        await message.reply("Language service error.")
+        return
+    _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs)
+
+    data = await state.get_data()
+    target_user_id = data.get("target_user_id")
+    if not target_user_id:
+        await message.answer(_("admin_hwid_limit_state_missing"))
+        await state.clear()
+        return
+
+    raw = (message.text or "").strip()
+    try:
+        hwid_device_limit = int(raw)
+        if hwid_device_limit < 0 or hwid_device_limit > 1_000_000:
+            raise ValueError("out_of_range")
+    except (TypeError, ValueError):
+        await message.answer(_("admin_hwid_limit_invalid"))
+        return
+
+    target_user = await user_dal.get_user_by_id(session, target_user_id)
+    if not target_user:
+        await message.answer(_("admin_user_not_found_action"))
+        await state.clear()
+        return
+
+    try:
+        active_sub = await subscription_dal.get_active_subscription_by_user_id(
+            session, target_user_id
+        )
+        if not active_sub:
+            await message.answer(_("admin_hwid_limit_no_subscription"))
+            await state.clear()
+            return
+
+        active_sub.hwid_device_limit = hwid_device_limit
+        effective_limit = await subscription_service.sync_hwid_device_limit_to_panel(
+            session, target_user_id
+        )
+        await message_log_dal.create_message_log_no_commit(
+            session,
+            {
+                "user_id": message.from_user.id if message.from_user else target_user_id,
+                "event_type": "admin:hwid_device_limit",
+                "content": (
+                    f"hwid_device_limit={hwid_device_limit!r} "
+                    f"effective_hwid_device_limit={effective_limit!r}"
+                ),
+                "is_admin_event": True,
+                "target_user_id": target_user_id,
+                "timestamp": datetime.now(timezone.utc),
+            },
+        )
+        await session.commit()
+
+        current_text = _admin_hwid_limit_state_text(_, hwid_device_limit)
+        await message.answer(
+            _("admin_hwid_limit_set", current=current_text, user_id=target_user_id)
+        )
+
+        referral_service = ReferralService(settings, subscription_service, message.bot, i18n)
+        bot_username = await _resolve_bot_username(message.bot)
+        user_card_text = await format_user_card(
+            target_user,
+            session,
+            subscription_service,
+            i18n,
+            current_lang,
+            referral_service,
+            settings=settings,
+            bot_username=bot_username,
+        )
+        keyboard = get_user_card_keyboard(
+            target_user.user_id, i18n, current_lang, target_user.referred_by_id
+        )
+        await _send_with_profile_link_fallback(
+            message.answer,
+            text=user_card_text,
+            markup=keyboard.as_markup(),
+            user_id=target_user.user_id,
+            parse_mode="HTML",
+        )
+    except Exception as exc:
+        logging.error(
+            "Error setting HWID device limit for user %s: %s",
+            target_user_id,
+            exc,
+            exc_info=True,
+        )
+        await session.rollback()
+        await message.answer(_("admin_hwid_limit_save_error"))
+    finally:
+        await state.clear()
+
+
 @router.message(AdminStates.waiting_for_traffic_grant_gb, F.text)
 async def process_traffic_grant_gb_handler(
     message: types.Message,
@@ -1964,7 +2434,7 @@ async def user_card_from_list_handler(
         text=_("admin_user_back_to_list_button"), callback_data=f"admin_action:users_list:{page}"
     )
     quick_links_width = 2 if user.referred_by_id else 1
-    keyboard.adjust(2, 2, 2, 2, quick_links_width, 1, 2, 1)
+    keyboard.adjust(2, 2, 2, 1, 2, quick_links_width, 1, 2, 1)
 
     # Format user card
     try:

backend/bot/handlers/inline_mode.py

@@ -166,8 +166,10 @@ async def create_user_stats_result(
             "inline_user_stats_message",
             total=user_stats["total_users"],
             active_today=user_stats["active_today"],
+            active=user_stats["active_subscriptions"],
             paid=user_stats["paid_subscriptions"],
             trial=user_stats["trial_users"],
+            free=user_stats["free_subscription_users"],
             inactive=user_stats["inactive_users"],
             banned=user_stats["banned_users"],
             referral=user_stats["referral_users"],
@@ -179,7 +181,7 @@ async def create_user_stats_result(
             description=_(
                 "inline_user_stats_description",
                 total=user_stats["total_users"],
-                active=user_stats["paid_subscriptions"],
+                active=user_stats["active_subscriptions"],
             ),
             input_message_content=InputTextMessageContent(
                 message_text=stats_text, parse_mode="HTML"

backend/bot/handlers/user/start.py

@@ -24,6 +24,11 @@ from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from bot.services.telegram_notifications import TELEGRAM_NOTIFICATIONS_ENABLED
 from bot.utils.callback_answer import safe_answer_callback
+from bot.utils.channel_subscription import (
+    is_required_channel_access_error,
+    normalize_required_channel_id,
+    resolve_required_channel_link,
+)
 from bot.utils.install_links import (
     append_install_share_link_text,
     ensure_user_install_guide_links,
@@ -36,6 +41,67 @@ from db.models import User
 router = Router(name="user_start_router")
 
 
+def _remnashop_referral_compat_enabled(settings: Settings) -> bool:
+    return bool(getattr(settings, "MIGRATION_REMNASHOP_REFERRAL_CODE_COMPAT_ENABLED", False))
+
+
+def _referral_code_lookup_candidates(
+    raw_ref_value: str,
+    *,
+    remnashop_compat: bool,
+) -> list[str]:
+    value = str(raw_ref_value or "").strip()
+    if not value:
+        return []
+
+    candidates = [value]
+    if value and value[0].lower() == "u":
+        stripped_current_prefix = value[1:]
+        if remnashop_compat:
+            candidates.append(stripped_current_prefix)
+        else:
+            candidates = [stripped_current_prefix]
+
+    unique: list[str] = []
+    for candidate in candidates:
+        candidate = candidate.strip()
+        if candidate and candidate not in unique:
+            unique.append(candidate)
+    return unique
+
+
+async def _resolve_referrer_from_start_ref(
+    session: AsyncSession,
+    raw_ref_value: str,
+    *,
+    settings: Settings,
+    current_user_id: int,
+) -> Optional[int]:
+    ref_user: Optional[User] = None
+    if raw_ref_value.isdigit() and settings.LEGACY_REFS:
+        potential_referrer_id = int(raw_ref_value)
+        if potential_referrer_id != current_user_id:
+            ref_user = await user_dal.get_user_by_id(session, potential_referrer_id)
+
+    include_legacy = _remnashop_referral_compat_enabled(settings)
+    if not ref_user:
+        for code in _referral_code_lookup_candidates(
+            raw_ref_value,
+            remnashop_compat=include_legacy,
+        ):
+            ref_user = await user_dal.get_user_by_referral_code(
+                session,
+                code,
+                include_legacy=include_legacy,
+            )
+            if ref_user:
+                break
+
+    if ref_user and ref_user.user_id != current_user_id:
+        return int(ref_user.user_id)
+    return None
+
+
 async def should_show_trial_button(
     settings: Settings,
     subscription_service: SubscriptionService,
@@ -45,12 +111,12 @@ async def should_show_trial_button(
     if not settings.TRIAL_ENABLED:
         return False
 
-    if hasattr(subscription_service, "has_had_any_subscription") and callable(
-        getattr(subscription_service, "has_had_any_subscription")
+    if hasattr(subscription_service, "has_trial_blocking_subscription") and callable(
+        getattr(subscription_service, "has_trial_blocking_subscription")
     ):
-        return not await subscription_service.has_had_any_subscription(session, user_id)
+        return not await subscription_service.has_trial_blocking_subscription(session, user_id)
 
-    logging.error("Method has_had_any_subscription is missing in SubscriptionService!")
+    logging.error("Method has_trial_blocking_subscription is missing in SubscriptionService!")
     return False
 
 
@@ -215,7 +281,7 @@ async def ensure_required_channel_subscription(
     Verify that the user is a member of the required channel (if configured).
     Returns True when access can proceed, False when user must subscribe first.
     """
-    required_channel_id = settings.REQUIRED_CHANNEL_ID
+    required_channel_id = normalize_required_channel_id(settings.REQUIRED_CHANNEL_ID)
     if not required_channel_id:
         return True
 
@@ -279,6 +345,29 @@ async def ensure_required_channel_subscription(
         if status_value in allowed_statuses:
             is_member = True
     except TelegramBadRequest as bad_request:
+        if is_required_channel_access_error(bad_request):
+            logging.error(
+                "Required channel check failed due to channel access/configuration error "
+                "(configured=%s, normalized=%s): %s",
+                settings.REQUIRED_CHANNEL_ID,
+                required_channel_id,
+                bad_request,
+            )
+            error_text = translate("channel_subscription_check_failed")
+            if isinstance(event, types.CallbackQuery):
+                try:
+                    await event.answer(error_text, show_alert=True)
+                except Exception:
+                    pass
+                if message_obj:
+                    try:
+                        await message_obj.answer(error_text)
+                    except Exception:
+                        pass
+            else:
+                await event.answer(error_text)
+            return False
+
         logging.info(
             "Required channel check: user %s not subscribed (details: %s)",
             user_id,
@@ -349,11 +438,12 @@ async def ensure_required_channel_subscription(
         )
         return True
 
-    keyboard = (
-        get_channel_subscription_keyboard(current_lang, i18n, settings.REQUIRED_CHANNEL_LINK)
-        if i18n
-        else None
+    channel_link = await resolve_required_channel_link(
+        bot_instance,
+        required_channel_id,
+        settings.REQUIRED_CHANNEL_LINK,
     )
+    keyboard = get_channel_subscription_keyboard(current_lang, i18n, channel_link) if i18n else None
 
     prompt_text = translate("channel_subscription_required")
 
@@ -383,14 +473,10 @@ async def ensure_required_channel_subscription(
 
 
 @router.message(CommandStart())
+@router.message(CommandStart(magic=F.args.regexp(r"^ref_([A-Za-z0-9_-]{1,64})$").as_("ref_match")))
 @router.message(
-    CommandStart(
-        magic=F.args.regexp(r"^ref_((?:[uU][A-Za-z0-9]{9})|(?:[A-Za-z0-9]{9})|\d+)$").as_(
-            "ref_match"
-        )
-    )
+    CommandStart(magic=F.args.regexp(r"^promo_([A-Za-z0-9_-]{1,100})$").as_("promo_match"))
 )
-@router.message(CommandStart(magic=F.args.regexp(r"^promo_(\w+)$").as_("promo_match")))
 @router.message(CommandStart(magic=F.args.regexp(r"^admin_user_(\d+)$").as_("admin_user_match")))
 @router.message(CommandStart(magic=F.args.regexp(r"^ticket_(\d+)$").as_("ticket_match")))
 @router.message(CommandStart(magic=F.args.regexp(r"^notifications$").as_("notifications_match")))
@@ -507,22 +593,12 @@ async def start_command_handler(
 
     if ref_match:
         raw_ref_value = ref_match.group(1)
-        if raw_ref_value.isdigit():
-            if settings.LEGACY_REFS:
-                potential_referrer_id = int(raw_ref_value)
-                if potential_referrer_id != user_id and await user_dal.get_user_by_id(
-                    session, potential_referrer_id
-                ):
-                    referred_by_user_id = potential_referrer_id
-        else:
-            normalized_code = raw_ref_value.strip()
-            if normalized_code and normalized_code[0].lower() == "u":
-                normalized_code = normalized_code[1:]
-            ref_user = None
-            if normalized_code:
-                ref_user = await user_dal.get_user_by_referral_code(session, normalized_code)
-            if ref_user and ref_user.user_id != user_id:
-                referred_by_user_id = ref_user.user_id
+        referred_by_user_id = await _resolve_referrer_from_start_ref(
+            session,
+            raw_ref_value,
+            settings=settings,
+            current_user_id=user_id,
+        )
     elif promo_match:
         promo_code_to_apply = promo_match.group(1)
         logging.info(f"User {user_id} started with promo code: {promo_code_to_apply}")
@@ -582,12 +658,17 @@ async def start_command_handler(
                 )
                 if referred_by_user_id and referral_welcome_days > 0:
                     try:
+                        default_tariff_key = None
+                        tariffs_config = getattr(settings, "tariffs_config", None)
+                        if tariffs_config:
+                            default_tariff_key = getattr(tariffs_config, "default_tariff", None)
                         referral_bonus_end_date = (
                             await subscription_service.extend_active_subscription_days(
                                 session,
                                 user_id,
                                 referral_welcome_days,
                                 reason="referral_welcome_bonus",
+                                tariff_key=default_tariff_key,
                             )
                         )
                         if referral_bonus_end_date:
@@ -1108,7 +1189,7 @@ async def main_action_callback_handler(
         _ = lambda key, **kwargs: i18n.gettext(current_lang, key, **kwargs) if i18n else key
 
         privacy_url = settings.PRIVACY_POLICY_URL
-        user_agreement_url = settings.USER_AGREEMENT_URL or settings.TERMS_OF_SERVICE_URL
+        user_agreement_url = settings.USER_AGREEMENT_URL
 
         if not privacy_url and not user_agreement_url:
             await safe_answer_callback(

backend/bot/handlers/user/subscription/core.py

@@ -22,7 +22,7 @@ from bot.keyboards.inline.user_keyboards import (
     get_tariff_packages_keyboard,
     get_tariff_periods_keyboard,
     sale_mode_with_callback_context,
-    subscription_options_callback,
+    tariff_purchase_back_callback,
 )
 from bot.middlewares.i18n import JsonI18n
 from bot.services.panel_api_service import PanelApiService
@@ -32,6 +32,10 @@ from bot.utils.install_links import (
     ensure_user_install_guide_links,
 )
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import subscription_dal, user_billing_dal
 from db.models import Subscription
 
@@ -80,11 +84,13 @@ def _tariff_purchase_markup(
             back_callback=back_callback,
             callback_context=callback_context,
         )
+    default_currency = default_currency_key_for_settings(settings)
     return get_tariff_packages_keyboard(
         tariff,
-        tariff.traffic_packages.rub,
+        tariff.traffic_packages.for_currency(default_currency),
         current_lang,
         i18n,
+        currency_symbol=default_payment_currency_code_for_settings(settings),
         back_callback=back_callback,
         callback_context=callback_context,
     )
@@ -185,6 +191,7 @@ async def display_subscription_options(
                 enabled_tariffs,
                 current_lang,
                 i18n,
+                settings=settings,
                 back_callback=back_callback,
                 callback_context=callback_context,
             )
@@ -296,7 +303,7 @@ async def select_tariff_callback(
         current_lang,
         i18n,
         settings,
-        back_callback=subscription_options_callback(callback_context),
+        back_callback=tariff_purchase_back_callback(callback_context),
         callback_context=callback_context,
     )
     text = _tariff_purchase_text(tariff, current_lang, i18n, settings)
@@ -312,7 +319,11 @@ async def select_tariff_callback(
 
 @router.callback_query(F.data.startswith("tariff:period:"))
 async def select_tariff_period_callback(
-    callback: types.CallbackQuery, i18n_data: dict, settings: Settings, session: AsyncSession
+    callback: types.CallbackQuery,
+    i18n_data: dict,
+    settings: Settings,
+    session: AsyncSession,
+    subscription_service: SubscriptionService,
 ):
     current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
     i18n: JsonI18n = i18n_data.get("i18n_instance")
@@ -326,25 +337,48 @@ async def select_tariff_period_callback(
         await callback.answer(get_text("error_try_again"), show_alert=True)
         return
     tariff_key, months_raw = parts[2], parts[3]
-    callback_context = parts[4] if len(parts) > 4 else None
+    callback_tokens = [part for part in parts[4:] if part]
+    callback_context = "bot" if "bot" in callback_tokens else None
+    renew_hwid_devices = "no_hwid" not in callback_tokens
     tariff = config.require(tariff_key)
     months = int(months_raw)
-    price_rub = tariff.period_price(months, "rub")
+    default_currency = default_currency_key_for_settings(settings)
+    currency_code = default_payment_currency_code_for_settings(settings)
+    price_rub = tariff.period_price(months, default_currency)
     stars_price = tariff.period_price(months, "stars")
     if price_rub is None:
         await callback.answer(get_text("error_try_again"), show_alert=True)
         return
+    hwid_renewal_quote = await subscription_service.quote_hwid_device_renewal_for_subscription(
+        session,
+        user_id=callback.from_user.id,
+        target_tariff_key=tariff.key,
+        months=months,
+        currency=default_currency,
+    )
+    hwid_renewal_stars_quote = (
+        await subscription_service.quote_hwid_device_renewal_for_subscription(
+            session,
+            user_id=callback.from_user.id,
+            target_tariff_key=tariff.key,
+            months=months,
+            currency="stars",
+        )
+    )
     markup = get_payment_method_keyboard(
         months,
         price_rub,
         int(stars_price) if stars_price else None,
-        settings.DEFAULT_CURRENCY_SYMBOL,
+        currency_code,
         current_lang,
         i18n,
         settings,
         sale_mode=sale_mode_with_callback_context(f"subscription@{tariff.key}", callback_context),
         back_callback=f"tariff:select:{tariff.key}{callback_suffix_for_context(callback_context)}",
         user_id=callback.from_user.id,
+        hwid_renewal_quote=hwid_renewal_quote,
+        hwid_renewal_stars_quote=hwid_renewal_stars_quote,
+        hwid_renewal_selected=bool(renew_hwid_devices),
     )
     await callback.message.edit_text(get_text("choose_payment_method"), reply_markup=markup)
     await callback.answer()
@@ -369,10 +403,16 @@ async def select_tariff_package_callback(
     callback_context = parts[4] if len(parts) > 4 else None
     tariff = config.require(tariff_key)
     gb = float(gb_raw)
+    default_currency = default_currency_key_for_settings(settings)
+    currency_code = default_payment_currency_code_for_settings(settings)
     packages = (
-        tariff.traffic_packages.rub
+        tariff.traffic_packages.for_currency(default_currency)
         if tariff.billing_model == "traffic"
-        else (config.topup_packages_for(tariff).rub if config.topup_packages_for(tariff) else [])
+        else (
+            config.topup_packages_for(tariff).for_currency(default_currency)
+            if config.topup_packages_for(tariff)
+            else []
+        )
     )
     package = next((pkg for pkg in packages if float(pkg.gb) == gb), None)
     if not package:
@@ -391,7 +431,7 @@ async def select_tariff_package_callback(
         gb,
         package.price,
         None,
-        settings.DEFAULT_CURRENCY_SYMBOL,
+        currency_code,
         current_lang,
         i18n,
         settings,
@@ -423,14 +463,19 @@ async def tariff_topup_list_callback(
         return
     tariff = config.require(active["tariff_key"])
     packages = config.topup_packages_for(tariff)
-    rub_packages = packages.rub if packages else []
-    premium_packages = tariff.premium_topup_packages.rub if tariff.premium_topup_packages else []
-    if not rub_packages and not premium_packages:
+    default_currency = default_currency_key_for_settings(settings)
+    currency = default_payment_currency_code_for_settings(settings)
+    currency_packages = packages.for_currency(default_currency) if packages else []
+    premium_packages = (
+        tariff.premium_topup_packages.for_currency(default_currency)
+        if tariff.premium_topup_packages
+        else []
+    )
+    if not currency_packages and not premium_packages:
         await callback.answer(get_text("no_subscription_options_available"), show_alert=True)
         return
     builder = InlineKeyboardBuilder()
-    currency = settings.DEFAULT_CURRENCY_SYMBOL
-    for package in rub_packages:
+    for package in currency_packages:
         builder.row(
             InlineKeyboardButton(
                 text=f"Обычный трафик +{package.gb:g} GB — {package.price:g} {currency}",
@@ -452,7 +497,7 @@ async def tariff_topup_list_callback(
 
     premium_lines = []
     carryover_lines = []
-    if rub_packages or premium_packages:
+    if currency_packages or premium_packages:
         carryover_lines.append(
             "Докупленный трафик не сгорает: сначала расходуется месячный лимит, затем докупленный остаток."  # noqa: E501
         )
@@ -495,7 +540,13 @@ async def select_tariff_premium_package_callback(
     _, _, tariff_key, gb_raw = callback.data.split(":", 3)
     tariff = config.require(tariff_key)
     gb = float(gb_raw)
-    packages = tariff.premium_topup_packages.rub if tariff.premium_topup_packages else []
+    default_currency = default_currency_key_for_settings(settings)
+    currency_code = default_payment_currency_code_for_settings(settings)
+    packages = (
+        tariff.premium_topup_packages.for_currency(default_currency)
+        if tariff.premium_topup_packages
+        else []
+    )
     package = next((pkg for pkg in packages if float(pkg.gb) == gb), None)
     if not package:
         await callback.answer(get_text("error_try_again"), show_alert=True)
@@ -504,7 +555,7 @@ async def select_tariff_premium_package_callback(
         gb,
         package.price,
         None,
-        settings.DEFAULT_CURRENCY_SYMBOL,
+        currency_code,
         current_lang,
         i18n,
         settings,
@@ -542,11 +593,15 @@ async def hwid_devices_list_callback(
     if tariff.billing_model != "period":
         await callback.answer(get_text("no_hwid_device_packages_available"), show_alert=True)
         return
-    packages = tariff.hwid_device_packages.rub if tariff.hwid_device_packages else []
+    default_currency = default_currency_key_for_settings(settings)
+    packages = (
+        tariff.hwid_device_packages.for_currency(default_currency)
+        if tariff.hwid_device_packages
+        else []
+    )
     if not packages:
         await callback.answer(get_text("no_hwid_device_packages_available"), show_alert=True)
         return
-    renewal_available = bool(active.get("device_topup_renewal_available"))
     markup = get_hwid_device_packages_keyboard(
         tariff,
         packages,
@@ -554,14 +609,11 @@ async def hwid_devices_list_callback(
         i18n,
         settings,
         back_callback="main_action:my_devices",
-        renewal=renewal_available,
-    )
-    text_key = (
-        "select_hwid_device_renewal_package" if renewal_available else "select_hwid_device_package"
+        renewal=False,
     )
     await callback.message.edit_text(
         get_text(
-            text_key,
+            "select_hwid_device_package",
             date=active.get("extra_hwid_devices_valid_until_text") or "",
         ),
         reply_markup=markup,
@@ -594,7 +646,13 @@ async def hwid_devices_package_callback(
     package = next(
         (
             pkg
-            for pkg in (tariff.hwid_device_packages.rub if tariff.hwid_device_packages else [])
+            for pkg in (
+                tariff.hwid_device_packages.for_currency(
+                    default_currency_key_for_settings(settings)
+                )
+                if tariff.hwid_device_packages
+                else []
+            )
             if int(pkg.count) == count
         ),
         None,
@@ -603,32 +661,35 @@ async def hwid_devices_package_callback(
         await callback.answer(get_text("error_try_again"), show_alert=True)
         return
     sale_mode_base = "hwid_devices_renewal" if action == "renewal_package" else "hwid_devices"
-    rub_quote = await subscription_service.quote_hwid_device_topup(
+    renewal = action == "renewal_package"
+    default_currency = default_currency_key_for_settings(settings)
+    currency_code = default_payment_currency_code_for_settings(settings)
+    currency_quote = await subscription_service.quote_hwid_device_topup(
         session,
         user_id=callback.from_user.id,
         device_count=count,
         tariff_key=tariff.key,
-        renewal=action == "renewal_package",
-        currency="rub",
+        renewal=renewal,
+        currency=default_currency,
     )
     stars_quote = await subscription_service.quote_hwid_device_topup(
         session,
         user_id=callback.from_user.id,
         device_count=count,
         tariff_key=tariff.key,
-        renewal=action == "renewal_package",
+        renewal=renewal,
         currency="stars",
     )
-    if not rub_quote and not stars_quote:
+    if not currency_quote and not stars_quote:
         await callback.answer(get_text("error_try_again"), show_alert=True)
         return
     markup = get_payment_method_keyboard(
         count,
-        float(rub_quote.get("price") if rub_quote else 0),
+        float(currency_quote.get("price") if currency_quote else 0),
         int(stars_quote["price"])
         if stars_quote and int(stars_quote.get("price") or 0) > 0
         else None,
-        settings.DEFAULT_CURRENCY_SYMBOL,
+        currency_code,
         current_lang,
         i18n,
         settings,
@@ -715,6 +776,8 @@ async def tariff_change_select_callback(
     options = await subscription_service.calculate_tariff_switch_options_with_hwid(
         session, db_sub, target
     )
+    default_currency = default_currency_key_for_settings(settings)
+    currency_code = default_payment_currency_code_for_settings(settings)
     rows = []
     if options["mode"] == "period_to_period":
         rows.append(
@@ -729,7 +792,7 @@ async def tariff_change_select_callback(
             rows.append(
                 [
                     InlineKeyboardButton(
-                        text=f"Доплатить {options['paid_diff_rub']} RUB",
+                        text=f"Доплатить {options['paid_diff_rub']} {currency_code}",
                         callback_data=f"tariff_change:confirm_pay:{target.key}:{options['paid_diff_rub']}",
                     )
                 ]
@@ -743,23 +806,23 @@ async def tariff_change_select_callback(
                 )
             ]
         )
-        for package in target.traffic_packages.rub:
+        for package in target.traffic_packages.for_currency(default_currency):
             rows.append(
                 [
                     InlineKeyboardButton(
-                        text=f"+ {package.gb:g} GB за {package.price:g} RUB",
+                        text=f"+ {package.gb:g} GB за {package.price:g} {currency_code}",
                         callback_data=f"tariff:package:{target.key}:{package.gb:g}",
                     )
                 ]
             )
     else:
         for months in target.enabled_periods:
-            price = target.period_price(months, "rub")
+            price = target.period_price(months, default_currency)
             if price:
                 rows.append(
                     [
                         InlineKeyboardButton(
-                            text=f"{months} мес. за {price:g} RUB",
+                            text=f"{months} мес. за {price:g} {currency_code}",
                             callback_data=f"tariff:period:{target.key}:{months}",
                         )
                     ]
@@ -842,6 +905,7 @@ async def tariff_change_confirm_pay_callback(
         return
     _, _, tariff_key, amount_raw = callback.data.split(":", 3)
     target = config.require(tariff_key)
+    currency_code = default_payment_currency_code_for_settings(settings)
     rows = [
         [
             InlineKeyboardButton(
@@ -857,7 +921,7 @@ async def tariff_change_confirm_pay_callback(
         ],
     ]
     await callback.message.edit_text(
-        f"Подтвердите смену тарифа\n\nНовый тариф: {target.name(current_lang)}\nБудет создана оплата на {amount_raw} RUB.",  # noqa: E501
+        f"Подтвердите смену тарифа\n\nНовый тариф: {target.name(current_lang)}\nБудет создана оплата на {amount_raw} {currency_code}.",  # noqa: E501
         reply_markup=InlineKeyboardMarkup(inline_keyboard=rows),
     )
     await callback.answer()
@@ -899,11 +963,12 @@ async def tariff_change_pay_callback(
     i18n: JsonI18n = i18n_data.get("i18n_instance")
     _, _, tariff_key, amount_raw = callback.data.split(":", 3)
     amount = float(amount_raw)
+    currency_code = default_payment_currency_code_for_settings(settings)
     markup = get_payment_method_keyboard(
         1,
         amount,
         None,
-        settings.DEFAULT_CURRENCY_SYMBOL,
+        currency_code,
         current_lang,
         i18n,
         settings,
@@ -1226,7 +1291,9 @@ async def my_subscription_command_handler(
                     if (
                         tariff_for_devices.billing_model == "period"
                         and tariff_for_devices.hwid_device_packages
-                        and tariff_for_devices.hwid_device_packages.rub
+                        and tariff_for_devices.hwid_device_packages.for_currency(
+                            default_currency_key_for_settings(settings)
+                        )
                     ):
                         prepend_rows.append(
                             [
@@ -1443,7 +1510,9 @@ async def my_devices_command_handler(
             if (
                 tariff_for_devices.billing_model == "period"
                 and tariff_for_devices.hwid_device_packages
-                and tariff_for_devices.hwid_device_packages.rub
+                and tariff_for_devices.hwid_device_packages.for_currency(
+                    default_currency_key_for_settings(settings)
+                )
             ):
                 devices_kb.append(
                     [

backend/bot/handlers/user/trial_handler.py

@@ -46,7 +46,7 @@ async def request_trial_confirmation_handler(
         return
 
     if settings.TRIAL_ENABLED:
-        if not await subscription_service.has_had_any_subscription(session, user_id):
+        if not await subscription_service.has_trial_blocking_subscription(session, user_id):
             pass
 
     if not settings.TRIAL_ENABLED:
@@ -60,7 +60,7 @@ async def request_trial_confirmation_handler(
             pass
         return
 
-    if await subscription_service.has_had_any_subscription(session, user_id):
+    if await subscription_service.has_trial_blocking_subscription(session, user_id):
         await callback.message.edit_text(
             _("trial_already_had_subscription_or_trial"),
             reply_markup=get_main_menu_inline_keyboard(current_lang, i18n, settings, False),
@@ -147,8 +147,9 @@ async def request_trial_confirmation_handler(
             await callback.answer(final_message_text_in_chat, show_alert=True)
         except Exception:
             pass
-        if settings.TRIAL_ENABLED and not await subscription_service.has_had_any_subscription(
-            session, user_id
+        if (
+            settings.TRIAL_ENABLED
+            and not await subscription_service.has_trial_blocking_subscription(session, user_id)
         ):
             show_trial_button_after_action = True
 
@@ -218,7 +219,7 @@ async def confirm_activate_trial_handler(
             callback, settings, i18n_data, subscription_service, session, is_edit=True
         )
         return
-    if await subscription_service.has_had_any_subscription(session, user_id):
+    if await subscription_service.has_trial_blocking_subscription(session, user_id):
         try:
             await callback.answer(_("trial_already_had_subscription_or_trial"), show_alert=True)
         except Exception:
@@ -283,8 +284,9 @@ async def confirm_activate_trial_handler(
             await callback.answer(final_message_text_in_chat, show_alert=True)
         except Exception:
             pass
-        if settings.TRIAL_ENABLED and not await subscription_service.has_had_any_subscription(
-            session, user_id
+        if (
+            settings.TRIAL_ENABLED
+            and not await subscription_service.has_trial_blocking_subscription(session, user_id)
         ):
             show_trial_button_after_action = True
 

backend/bot/keyboards/inline/admin_keyboards.py

@@ -452,10 +452,11 @@ def get_broadcast_confirmation_keyboard(
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
     builder = InlineKeyboardBuilder()
 
-    # Row: target selection (all / active / inactive)
+    # Row: target selection (all / active / inactive / expired)
     target_all_label = _(key="broadcast_target_all_button")
     target_active_label = _(key="broadcast_target_active_button")
     target_inactive_label = _(key="broadcast_target_inactive_button")
+    target_expired_label = _(key="broadcast_target_expired_button")
 
     # Highlight current selection with a prefix
     def mark_selected(label: str, is_selected: bool) -> str:
@@ -473,7 +474,10 @@ def get_broadcast_confirmation_keyboard(
         text=mark_selected(target_inactive_label, target == "inactive"),
         callback_data="broadcast_target:inactive",
     )
-    builder.adjust(3)
+    builder.button(
+        text=mark_selected(target_expired_label, target == "expired"),
+        callback_data="broadcast_target:expired",
+    )
 
     # Row: confirmation
     builder.button(
@@ -482,7 +486,7 @@ def get_broadcast_confirmation_keyboard(
     builder.button(
         text=_(key="cancel_broadcast_button"), callback_data="broadcast_final_action:cancel"
     )
-    builder.adjust(2)
+    builder.adjust(2, 2, 2)
     return builder.as_markup()
 
 

backend/bot/keyboards/inline/user_keyboards.py

@@ -4,11 +4,23 @@ from aiogram.types import InlineKeyboardMarkup, WebAppInfo
 from aiogram.utils.keyboard import InlineKeyboardBuilder, InlineKeyboardButton
 
 from bot.middlewares.i18n import locale_language_options
+from bot.utils.channel_subscription import normalize_required_channel_link
 from bot.utils.install_links import bot_install_guide_url
 from bot.utils.mini_app_url import subscription_mini_app_trial_url
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 
 BOT_MENU_CONTEXT = "bot"
+HWID_RENEWAL_TOKEN = "hwid_renewal"
+
+
+def sale_mode_tokens(sale_mode: Optional[str]) -> Tuple[str, ...]:
+    if not sale_mode or "|" not in sale_mode:
+        return ()
+    return tuple(token.strip() for token in str(sale_mode).split("|")[1:] if token.strip())
 
 
 def callback_context_from_back_callback(back_callback: Optional[str]) -> Optional[str]:
@@ -19,16 +31,36 @@ def callback_context_from_back_callback(back_callback: Optional[str]) -> Optiona
 
 def sale_mode_with_callback_context(sale_mode: str, context: Optional[str]) -> str:
     sale_mode = sale_mode or "subscription"
-    if not context or "|" in sale_mode:
+    if not context or context in sale_mode_tokens(sale_mode):
         return sale_mode
     return f"{sale_mode}|{context}"
 
 
+def sale_mode_with_token(sale_mode: str, token: str) -> str:
+    sale_mode = sale_mode or "subscription"
+    token = str(token or "").strip()
+    if not token or token in sale_mode_tokens(sale_mode):
+        return sale_mode
+    return f"{sale_mode}|{token}"
+
+
+def sale_mode_without_token(sale_mode: str, token: str) -> str:
+    sale_mode = sale_mode or "subscription"
+    token = str(token or "").strip()
+    if not token or "|" not in sale_mode:
+        return sale_mode
+    base, *tokens = sale_mode.split("|")
+    kept = [item for item in tokens if item.strip() and item.strip() != token]
+    return "|".join([base, *kept])
+
+
+def sale_mode_has_token(sale_mode: Optional[str], token: str) -> bool:
+    return str(token or "").strip() in sale_mode_tokens(sale_mode)
+
+
 def callback_context_from_sale_mode(sale_mode: Optional[str]) -> Optional[str]:
-    if not sale_mode or "|" not in sale_mode:
-        return None
-    context = str(sale_mode).split("|", 1)[1].strip()
-    return context or None
+    tokens = sale_mode_tokens(sale_mode)
+    return BOT_MENU_CONTEXT if BOT_MENU_CONTEXT in tokens else None
 
 
 def callback_suffix_for_context(context: Optional[str]) -> str:
@@ -39,6 +71,12 @@ def subscription_options_callback(context: Optional[str]) -> str:
     return "main_action:bot_subscribe" if context == BOT_MENU_CONTEXT else "main_action:subscribe"
 
 
+def tariff_purchase_back_callback(context: Optional[str]) -> str:
+    if context == BOT_MENU_CONTEXT:
+        return "main_action:bot_interface"
+    return subscription_options_callback(context)
+
+
 def payment_methods_back_callback(
     value: str, sale_mode: str = "subscription", price: Optional[float] = None
 ) -> str:
@@ -134,8 +172,7 @@ def get_main_menu_inline_keyboard(
             InlineKeyboardButton(text=_(key="menu_support_button"), url=settings.SUPPORT_LINK)
         )
 
-    user_agreement_url = settings.USER_AGREEMENT_URL or settings.TERMS_OF_SERVICE_URL
-    if settings.PRIVACY_POLICY_URL or user_agreement_url:
+    if settings.PRIVACY_POLICY_URL or settings.USER_AGREEMENT_URL:
         builder.row(
             InlineKeyboardButton(text=_(key="menu_info_button"), callback_data="main_action:info")
         )
@@ -202,8 +239,7 @@ def get_bot_interface_inline_keyboard(
             InlineKeyboardButton(text=_(key="menu_support_button"), url=settings.SUPPORT_LINK)
         )
 
-    user_agreement_url = settings.USER_AGREEMENT_URL or settings.TERMS_OF_SERVICE_URL
-    if settings.PRIVACY_POLICY_URL or user_agreement_url:
+    if settings.PRIVACY_POLICY_URL or settings.USER_AGREEMENT_URL:
         builder.row(
             InlineKeyboardButton(
                 text=_(key="menu_info_button"), callback_data="main_action:bot_info"
@@ -328,19 +364,31 @@ def get_tariff_catalog_keyboard(
     tariffs: List[Any],
     lang: str,
     i18n_instance,
+    settings: Optional[Settings] = None,
     back_callback: str = "main_action:back_to_main",
     callback_context: Optional[str] = None,
 ) -> InlineKeyboardMarkup:
     builder = InlineKeyboardBuilder()
     callback_context = callback_context or callback_context_from_back_callback(back_callback)
+    default_currency = default_currency_key_for_settings(settings) if settings else "rub"
     for tariff in tariffs:
         label = tariff.name(lang)
         if tariff.billing_model == "period":
-            min_price = tariff.min_period_price_rub()
+            if hasattr(tariff, "min_period_price"):
+                min_price = tariff.min_period_price(default_currency)
+            elif default_currency == "rub" and hasattr(tariff, "min_period_price_rub"):
+                min_price = tariff.min_period_price_rub()
+            else:
+                min_price = None
             if min_price is not None:
                 label = f"{label} от {min_price:g}"
         else:
-            package = tariff.min_traffic_package_rub()
+            if hasattr(tariff, "min_traffic_package"):
+                package = tariff.min_traffic_package(default_currency)
+            elif default_currency == "rub" and hasattr(tariff, "min_traffic_package_rub"):
+                package = tariff.min_traffic_package_rub()
+            else:
+                package = None
             if package:
                 label = f"{label} от {package.price:g} / {package.gb:g} GB"
         builder.row(
@@ -368,8 +416,10 @@ def get_tariff_periods_keyboard(
     builder = InlineKeyboardBuilder()
     callback_context = callback_context or callback_context_from_back_callback(back_callback)
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    default_currency = default_currency_key_for_settings(settings)
+    currency_code = default_payment_currency_code_for_settings(settings)
     for months in tariff.enabled_periods:
-        rub_price = tariff.period_price(months, "rub")
+        rub_price = tariff.period_price(months, default_currency)
         if rub_price and rub_price > 0:
             builder.row(
                 InlineKeyboardButton(
@@ -377,7 +427,7 @@ def get_tariff_periods_keyboard(
                         "subscribe_for_months_button",
                         months=months,
                         price=rub_price,
-                        currency_symbol=settings.DEFAULT_CURRENCY_SYMBOL,
+                        currency_symbol=currency_code,
                     ),
                     callback_data=f"tariff:period:{tariff.key}:{months}"
                     f"{callback_suffix_for_context(callback_context)}",
@@ -394,6 +444,7 @@ def get_tariff_packages_keyboard(
     packages: List[Any],
     lang: str,
     i18n_instance,
+    currency_symbol: str = "RUB",
     back_callback: str = "main_action:subscribe",
     callback_context: Optional[str] = None,
 ) -> InlineKeyboardMarkup:
@@ -407,7 +458,7 @@ def get_tariff_packages_keyboard(
                     "buy_traffic_package_button",
                     traffic_gb=f"{package.gb:g}",
                     price=package.price,
-                    currency_symbol="RUB",
+                    currency_symbol=currency_symbol,
                 ),
                 callback_data=f"tariff:package:{tariff.key}:{package.gb:g}"
                 f"{callback_suffix_for_context(callback_context)}",
@@ -430,6 +481,7 @@ def get_hwid_device_packages_keyboard(
 ) -> InlineKeyboardMarkup:
     builder = InlineKeyboardBuilder()
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
+    currency_code = default_payment_currency_code_for_settings(settings)
     for package in packages:
         builder.row(
             InlineKeyboardButton(
@@ -437,7 +489,7 @@ def get_hwid_device_packages_keyboard(
                     "buy_hwid_devices_button",
                     count=package.count,
                     price=package.price,
-                    currency_symbol=settings.DEFAULT_CURRENCY_SYMBOL,
+                    currency_symbol=currency_code,
                 ),
                 callback_data=(
                     f"hwid_devices:{'renewal_package' if renewal else 'package'}:"
@@ -463,6 +515,9 @@ def get_payment_method_keyboard(
     back_callback: Optional[str] = None,
     user_id: Optional[int] = None,
     is_admin: Optional[bool] = None,
+    hwid_renewal_quote: Optional[Dict[str, Any]] = None,
+    hwid_renewal_stars_quote: Optional[Dict[str, Any]] = None,
+    hwid_renewal_selected: bool = True,
 ) -> InlineKeyboardMarkup:
     _ = lambda key, **kwargs: i18n_instance.gettext(lang, key, **kwargs)
     builder = InlineKeyboardBuilder()
@@ -471,12 +526,39 @@ def get_payment_method_keyboard(
         return str(int(val)) if float(val).is_integer() else f"{val:g}"
 
     value_str = _format_value(months)
-    import logging as _kbd_logging
-
-    _kbd_logging.info(
-        "payment_method_keyboard build: order=%s",
-        settings.payment_methods_order,
-    )
+    payment_sale_mode = sale_mode
+    selected_hwid_quote = hwid_renewal_quote or hwid_renewal_stars_quote
+    if selected_hwid_quote:
+        tariff_key = None
+        sale_mode_main = str(sale_mode or "").split("|", 1)[0]
+        if "@" in sale_mode_main:
+            tariff_key = sale_mode_main.split("@", 1)[1]
+        context = callback_context_from_sale_mode(sale_mode)
+        toggle_tokens = [f"tariff:period:{tariff_key}:{value_str}"]
+        if context:
+            toggle_tokens.append(context)
+        toggle_tokens.append("no_hwid" if hwid_renewal_selected else "hwid")
+        builder.row(
+            InlineKeyboardButton(
+                text=_(
+                    "payment_hwid_renewal_toggle_on"
+                    if hwid_renewal_selected
+                    else "payment_hwid_renewal_toggle_off",
+                    count=int(selected_hwid_quote.get("device_count") or 0),
+                    price=(
+                        hwid_renewal_quote.get("price")
+                        if hwid_renewal_quote
+                        else hwid_renewal_stars_quote.get("price")
+                    ),
+                    currency_symbol=currency_symbol_val,
+                ),
+                callback_data=":".join(toggle_tokens),
+            )
+        )
+        if hwid_renewal_selected:
+            payment_sale_mode = sale_mode_with_token(sale_mode, HWID_RENEWAL_TOKEN)
+        else:
+            payment_sale_mode = sale_mode_without_token(sale_mode, HWID_RENEWAL_TOKEN)
     from bot.payment_providers import get_provider_spec, provider_telegram_button_text
 
     for method in settings.payment_methods_order:
@@ -484,6 +566,7 @@ def get_payment_method_keyboard(
         if (
             not spec
             or not spec.callback_prefix
+            or not spec.is_usable_for_payment(settings, currency_symbol_val, price)
             or not spec.is_available_to_user(
                 settings,
                 user_id=user_id,
@@ -496,7 +579,7 @@ def get_payment_method_keyboard(
             value=value_str,
             rub_price=price,
             stars_price=stars_price,
-            sale_mode=sale_mode,
+            sale_mode=payment_sale_mode,
         )
         if not callback_data:
             continue
@@ -555,7 +638,7 @@ def get_yk_autopay_choice_keyboard(
         builder.row(
             InlineKeyboardButton(
                 text=_(key="yookassa_autopay_pay_saved_card_button"),
-                callback_data=f"pay_yk_saved_list:{value_str}:{price_str}{suffix}",
+                callback_data=f"pay_yk_saved_list:{value_str}:{price_str}:0{suffix}",
             )
         )
     builder.row(
@@ -697,10 +780,11 @@ def get_channel_subscription_keyboard(
 
     has_buttons = False
 
-    if channel_link:
+    channel_url = normalize_required_channel_link(channel_link)
+    if channel_url:
         builder.button(
             text=_(key="channel_subscription_join_button"),
-            url=channel_link,
+            url=channel_url,
         )
         has_buttons = True
 

backend/bot/main_bot.py

@@ -91,12 +91,9 @@ async def register_all_routers(dp: Dispatcher, settings: Settings):
     logging.info("All application routers registered.")
 
 
-async def on_startup_configured(dispatcher: Dispatcher):
+async def configure_telegram_webhook(dispatcher: Dispatcher) -> None:
     bot: Bot = dispatcher["bot_instance"]
     settings: Settings = dispatcher["settings"]
-    i18n_instance: JsonI18n = dispatcher["i18n_instance"]
-
-    logging.info("STARTUP: on_startup_configured executing...")
 
     telegram_webhook_url_to_set = settings.WEBHOOK_BASE_URL
     if telegram_webhook_url_to_set:
@@ -152,6 +149,14 @@ async def on_startup_configured(dispatcher: Dispatcher):
         )
         raise SystemExit("WEBHOOK_BASE_URL is required. Polling mode is disabled.")
 
+
+async def on_startup_configured(dispatcher: Dispatcher):
+    bot: Bot = dispatcher["bot_instance"]
+    settings: Settings = dispatcher["settings"]
+    i18n_instance: JsonI18n = dispatcher["i18n_instance"]
+
+    logging.info("STARTUP: on_startup_configured executing...")
+
     if settings.SUBSCRIPTION_MINI_APP_URL:
 
         async def _configure_mini_app_menu() -> None:
@@ -331,8 +336,17 @@ async def run_bot(settings_param: Settings):
         _yk_path,
     )
 
+    async def _after_webhooks_started() -> None:
+        await configure_telegram_webhook(dp)
+
     async def web_server_task():
-        await build_and_start_web_app(dp, bot, settings_param, local_async_session_factory)
+        await build_and_start_web_app(
+            dp,
+            bot,
+            settings_param,
+            local_async_session_factory,
+            after_webhooks_started=_after_webhooks_started,
+        )
 
     main_tasks = [asyncio.create_task(web_server_task(), name="AIOHTTPServerTask")]
 

backend/bot/middlewares/action_logger_middleware.py

@@ -24,6 +24,9 @@ class ActionLoggerMiddleware(BaseMiddleware):
 
         result = await handler(event, data)
 
+        if data.get("skip_action_log") or data.get("antiflood_dropped"):
+            return result
+
         session: AsyncSession = data["session"]
         event_user: Optional[User] = data.get("event_from_user")
 

backend/bot/middlewares/channel_subscription.py

@@ -11,6 +11,10 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from bot.keyboards.inline.user_keyboards import get_channel_subscription_keyboard
 from bot.middlewares.i18n import JsonI18n
+from bot.utils.channel_subscription import (
+    normalize_required_channel_id,
+    resolve_required_channel_link,
+)
 from config.settings import Settings
 from db.dal import user_dal
 
@@ -32,7 +36,7 @@ class ChannelSubscriptionMiddleware(BaseMiddleware):
         event: Update,
         data: Dict[str, Any],
     ) -> Any:
-        required_channel_id = self.settings.REQUIRED_CHANNEL_ID
+        required_channel_id = normalize_required_channel_id(self.settings.REQUIRED_CHANNEL_ID)
         if not required_channel_id:
             return await handler(event, data)
 
@@ -85,10 +89,14 @@ class ChannelSubscriptionMiddleware(BaseMiddleware):
                 return i18n_instance.gettext(current_lang, key)
             return key
 
+        bot_instance = data.get("bot") or data.get("bot_instance")
+        channel_link = await resolve_required_channel_link(
+            bot_instance,
+            required_channel_id,
+            self.settings.REQUIRED_CHANNEL_LINK,
+        )
         keyboard = (
-            get_channel_subscription_keyboard(
-                current_lang, i18n_instance, self.settings.REQUIRED_CHANNEL_LINK
-            )
+            get_channel_subscription_keyboard(current_lang, i18n_instance, channel_link)
             if i18n_instance
             else None
         )

backend/bot/middlewares/update_antiflood.py

@@ -0,0 +1,371 @@
+import asyncio
+import hashlib
+import logging
+import time
+from collections import defaultdict, deque
+from dataclasses import dataclass
+from typing import Any, Awaitable, Callable, Deque, Dict, Optional
+
+from aiogram import BaseMiddleware
+from aiogram.types import Update
+
+from bot.infra.redis import get_redis, redis_key
+from config.settings import Settings
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_WINDOW_SECONDS = 60
+DEFAULT_MAX_UPDATES_PER_WINDOW = 180
+DEFAULT_MESSAGE_MAX_PER_WINDOW = 120
+DEFAULT_CALLBACK_MAX_PER_WINDOW = 240
+DEFAULT_INLINE_MAX_PER_WINDOW = 60
+DEFAULT_START_MAX_PER_WINDOW = 30
+DEFAULT_EXPENSIVE_CALLBACK_MAX_PER_WINDOW = 60
+DEFAULT_PAYMENT_CALLBACK_COOLDOWN_SECONDS = 20
+DEFAULT_TRIAL_CALLBACK_COOLDOWN_SECONDS = 30
+
+EXPENSIVE_CALLBACK_PREFIXES = (
+    "pay_",
+    "trial_action:confirm_activate",
+    "main_action:request_trial",
+    "main_action:apply_promo",
+    "main_action:bot_apply_promo",
+    "tariff_change:apply:",
+    "tariff_change:confirm_pay:",
+    "tariff_change:pay:",
+    "autorenew:confirm:",
+    "disconnect_device:",
+)
+
+TRIAL_CALLBACK_PREFIXES = (
+    "trial_action:confirm_activate",
+    "main_action:request_trial",
+)
+
+
+@dataclass(frozen=True)
+class RateLimitRule:
+    window_seconds: int
+    max_events: int
+
+
+class UpdateAntiFloodMiddleware(BaseMiddleware):
+    """Drop extreme update floods before DB-backed middleware runs."""
+
+    def __init__(
+        self,
+        settings: Settings,
+        *,
+        default_rule: Optional[RateLimitRule] = None,
+        action_rules: Optional[Dict[str, RateLimitRule]] = None,
+    ) -> None:
+        super().__init__()
+        self.settings = settings
+        self.default_rule = default_rule or RateLimitRule(
+            window_seconds=int(
+                getattr(settings, "TELEGRAM_ANTIFLOOD_WINDOW_SECONDS", DEFAULT_WINDOW_SECONDS)
+                or DEFAULT_WINDOW_SECONDS
+            ),
+            max_events=int(
+                getattr(
+                    settings,
+                    "TELEGRAM_ANTIFLOOD_MAX_UPDATES_PER_WINDOW",
+                    DEFAULT_MAX_UPDATES_PER_WINDOW,
+                )
+                or DEFAULT_MAX_UPDATES_PER_WINDOW
+            ),
+        )
+        self.action_rules = action_rules or _default_action_rules(settings)
+        self._local_buckets: Dict[str, Deque[float]] = defaultdict(deque)
+        self._local_cooldowns: Dict[str, float] = {}
+        self._local_lock = asyncio.Lock()
+
+    async def __call__(
+        self,
+        handler: Callable[[Update, Dict[str, Any]], Awaitable[Any]],
+        event: Update,
+        data: Dict[str, Any],
+    ) -> Any:
+        if bool(getattr(self.settings, "TELEGRAM_DROP_NON_PRIVATE_UPDATES", True)):
+            chat_type = _message_or_callback_chat_type(event)
+            if chat_type is not None and chat_type != "private":
+                logger.info(
+                    "Telegram update dropped outside private chat: chat_type=%s update_type=%s",
+                    chat_type,
+                    getattr(event, "event_type", "unknown"),
+                )
+                _mark_dropped(data)
+                return None
+
+        if not bool(getattr(self.settings, "TELEGRAM_ANTIFLOOD_ENABLED", True)):
+            return await handler(event, data)
+
+        actor_key = _update_actor_key(event)
+        if not actor_key:
+            return await handler(event, data)
+
+        action_key = _update_action_key(event)
+        cooldown = _update_action_cooldown(event, self.settings)
+        if cooldown and await self._is_cooldown_active(cooldown[0], cooldown[1]):
+            logger.info(
+                "Telegram callback dropped by action cooldown: actor=%s cooldown=%s",
+                actor_key,
+                cooldown[0],
+            )
+            _mark_dropped(data)
+            await _quietly_answer_callback(event)
+            return None
+
+        if await self._is_limited("updates", actor_key, self.default_rule) or (
+            action_key
+            and action_key in self.action_rules
+            and await self._is_limited(action_key, actor_key, self.action_rules[action_key])
+        ):
+            logger.warning(
+                "Telegram update dropped by anti-flood: actor=%s update_type=%s",
+                actor_key,
+                action_key or getattr(event, "event_type", "unknown"),
+            )
+            _mark_dropped(data)
+            return None
+
+        return await handler(event, data)
+
+    async def _is_limited(self, bucket_name: str, actor_key: str, rule: RateLimitRule) -> bool:
+        if rule.window_seconds <= 0 or rule.max_events <= 0:
+            return False
+
+        try:
+            redis = await get_redis(self.settings)
+            if redis is not None:
+                key = redis_key(
+                    self.settings,
+                    "rate-limit",
+                    "telegram",
+                    bucket_name,
+                    actor_key,
+                )
+                current = int(await redis.incr(key))
+                if current == 1:
+                    await redis.expire(key, rule.window_seconds)
+                return current > rule.max_events
+        except Exception as exc:
+            logger.warning("Redis telegram anti-flood unavailable; using local fallback: %s", exc)
+
+        return await self._is_limited_local(f"{bucket_name}:{actor_key}", rule)
+
+    async def _is_cooldown_active(self, cooldown_key: str, ttl_seconds: int) -> bool:
+        if ttl_seconds <= 0:
+            return False
+
+        try:
+            redis = await get_redis(self.settings)
+            if redis is not None:
+                key = redis_key(
+                    self.settings,
+                    "cooldown",
+                    "telegram",
+                    cooldown_key,
+                )
+                acquired = await redis.set(key, "1", nx=True, ex=ttl_seconds)
+                return not bool(acquired)
+        except Exception as exc:
+            logger.warning("Redis telegram cooldown unavailable; using local fallback: %s", exc)
+
+        return await self._is_cooldown_active_local(cooldown_key, ttl_seconds)
+
+    async def _is_cooldown_active_local(self, cooldown_key: str, ttl_seconds: int) -> bool:
+        now = time.monotonic()
+        async with self._local_lock:
+            expired = [
+                key for key, expires_at in self._local_cooldowns.items() if expires_at <= now
+            ]
+            for key in expired:
+                self._local_cooldowns.pop(key, None)
+
+            expires_at = self._local_cooldowns.get(cooldown_key)
+            if expires_at and expires_at > now:
+                return True
+
+            self._local_cooldowns[cooldown_key] = now + ttl_seconds
+        return False
+
+    async def _is_limited_local(self, actor_key: str, rule: RateLimitRule) -> bool:
+        now = time.monotonic()
+        cutoff = now - rule.window_seconds
+        async with self._local_lock:
+            bucket = self._local_buckets[actor_key]
+            while bucket and bucket[0] <= cutoff:
+                bucket.popleft()
+            bucket.append(now)
+            if len(bucket) > rule.max_events:
+                return True
+            if not bucket:
+                self._local_buckets.pop(actor_key, None)
+        return False
+
+
+def _update_actor_key(update: Update) -> Optional[str]:
+    user_id = None
+    chat_id = None
+
+    if update.message:
+        user_id = update.message.from_user.id if update.message.from_user else None
+        chat_id = update.message.chat.id if update.message.chat else None
+    elif update.callback_query:
+        user_id = update.callback_query.from_user.id if update.callback_query.from_user else None
+        if update.callback_query.message and update.callback_query.message.chat:
+            chat_id = update.callback_query.message.chat.id
+    elif update.inline_query:
+        user_id = update.inline_query.from_user.id if update.inline_query.from_user else None
+
+    if user_id is not None:
+        return f"user:{int(user_id)}"
+    if chat_id is not None:
+        return f"chat:{int(chat_id)}"
+    return None
+
+
+def _message_or_callback_chat_type(update: Update) -> Optional[str]:
+    if update.message and update.message.chat:
+        return str(update.message.chat.type)
+    if (
+        update.callback_query
+        and update.callback_query.message
+        and update.callback_query.message.chat
+    ):
+        return str(update.callback_query.message.chat.type)
+    return None
+
+
+def _update_action_key(update: Update) -> str:
+    if update.message:
+        text = update.message.text or ""
+        if text.startswith("/start"):
+            return "start"
+        return "message"
+    if update.callback_query:
+        data = update.callback_query.data or ""
+        if data.startswith(EXPENSIVE_CALLBACK_PREFIXES):
+            return "expensive_callback"
+        return "callback"
+    if update.inline_query:
+        return "inline"
+    return "updates"
+
+
+def _update_action_cooldown(update: Update, settings: Settings) -> Optional[tuple[str, int]]:
+    if not bool(getattr(settings, "TELEGRAM_ACTION_COOLDOWN_ENABLED", True)):
+        return None
+    if not update.callback_query or not update.callback_query.from_user:
+        return None
+
+    callback_data = update.callback_query.data or ""
+    if not callback_data:
+        return None
+
+    user_id = int(update.callback_query.from_user.id)
+    data_digest = hashlib.sha256(callback_data.encode("utf-8")).hexdigest()[:24]
+
+    if callback_data.startswith("pay_"):
+        ttl = int(
+            getattr(
+                settings,
+                "TELEGRAM_PAYMENT_CALLBACK_COOLDOWN_SECONDS",
+                DEFAULT_PAYMENT_CALLBACK_COOLDOWN_SECONDS,
+            )
+            or DEFAULT_PAYMENT_CALLBACK_COOLDOWN_SECONDS
+        )
+        return f"payment:user:{user_id}:data:{data_digest}", ttl
+
+    if callback_data.startswith(TRIAL_CALLBACK_PREFIXES):
+        ttl = int(
+            getattr(
+                settings,
+                "TELEGRAM_TRIAL_CALLBACK_COOLDOWN_SECONDS",
+                DEFAULT_TRIAL_CALLBACK_COOLDOWN_SECONDS,
+            )
+            or DEFAULT_TRIAL_CALLBACK_COOLDOWN_SECONDS
+        )
+        return f"trial:user:{user_id}:data:{data_digest}", ttl
+
+    return None
+
+
+async def _quietly_answer_callback(update: Update) -> None:
+    callback = update.callback_query
+    if not callback:
+        return
+    try:
+        await callback.answer()
+    except Exception:
+        pass
+
+
+def _mark_dropped(data: Dict[str, Any]) -> None:
+    data["antiflood_dropped"] = True
+    data["skip_action_log"] = True
+
+
+def _default_action_rules(settings: Settings) -> Dict[str, RateLimitRule]:
+    window_seconds = int(
+        getattr(settings, "TELEGRAM_ANTIFLOOD_WINDOW_SECONDS", DEFAULT_WINDOW_SECONDS)
+        or DEFAULT_WINDOW_SECONDS
+    )
+    return {
+        "message": RateLimitRule(
+            window_seconds,
+            int(
+                getattr(
+                    settings,
+                    "TELEGRAM_ANTIFLOOD_MESSAGE_MAX_PER_WINDOW",
+                    DEFAULT_MESSAGE_MAX_PER_WINDOW,
+                )
+                or DEFAULT_MESSAGE_MAX_PER_WINDOW
+            ),
+        ),
+        "callback": RateLimitRule(
+            window_seconds,
+            int(
+                getattr(
+                    settings,
+                    "TELEGRAM_ANTIFLOOD_CALLBACK_MAX_PER_WINDOW",
+                    DEFAULT_CALLBACK_MAX_PER_WINDOW,
+                )
+                or DEFAULT_CALLBACK_MAX_PER_WINDOW
+            ),
+        ),
+        "inline": RateLimitRule(
+            window_seconds,
+            int(
+                getattr(
+                    settings,
+                    "TELEGRAM_ANTIFLOOD_INLINE_MAX_PER_WINDOW",
+                    DEFAULT_INLINE_MAX_PER_WINDOW,
+                )
+                or DEFAULT_INLINE_MAX_PER_WINDOW
+            ),
+        ),
+        "start": RateLimitRule(
+            window_seconds,
+            int(
+                getattr(
+                    settings,
+                    "TELEGRAM_ANTIFLOOD_START_MAX_PER_WINDOW",
+                    DEFAULT_START_MAX_PER_WINDOW,
+                )
+                or DEFAULT_START_MAX_PER_WINDOW
+            ),
+        ),
+        "expensive_callback": RateLimitRule(
+            window_seconds,
+            int(
+                getattr(
+                    settings,
+                    "TELEGRAM_ANTIFLOOD_EXPENSIVE_CALLBACK_MAX_PER_WINDOW",
+                    DEFAULT_EXPENSIVE_CALLBACK_MAX_PER_WINDOW,
+                )
+                or DEFAULT_EXPENSIVE_CALLBACK_MAX_PER_WINDOW
+            ),
+        ),
+    }

backend/bot/payment_providers/base.py

@@ -112,7 +112,9 @@ class WebAppPaymentContext:
     stars_price: Optional[int]
     description: str
     sale_mode: str
+    currency: str = "RUB"
     traffic_gb: Optional[float] = None
+    hwid_device_count: Optional[int] = None
     hwid_valid_from: Optional[Any] = None
     hwid_valid_until: Optional[Any] = None
     hwid_pricing_period_months: Optional[int] = None
@@ -125,6 +127,39 @@ ServiceFactory = Callable[[ServiceFactoryContext], Any]
 WebhookPathGetter = Callable[[Any], str]
 WebhookRoute = Callable[[Any], Awaitable[Any]]
 WebAppPaymentFactory = Callable[[WebAppPaymentContext], Awaitable[Any]]
+ReusableWebAppPaymentResolver = Callable[[WebAppPaymentContext, Any], Awaitable[Optional[str]]]
+CurrencySupportResolver = Callable[[Any], Optional[Sequence[str]]]
+PaymentAmountResolver = Callable[[Any, Any, Any], bool]
+PaymentMinimumResolver = Callable[[Any, Any], Optional[Mapping[str, Any]]]
+
+
+def normalize_payment_currency_code(value: Any, default: str = "RUB") -> str:
+    text = str(value or "").strip().upper()
+    if not text:
+        text = str(default).strip().upper() if default is not None else ""
+    if not text:
+        return ""
+    aliases = {"RUR": "RUB", "STARS": "XTR", "STAR": "XTR"}
+    normalized = aliases.get(text, text)
+    return "".join(ch for ch in normalized if ch.isalnum() or ch in {"_", "-"}).strip("_-")
+
+
+def parse_supported_currency_codes(value: Any) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        raw_items = value.replace(";", ",").split(",")
+    else:
+        raw_items = list(value)
+    currencies: list[str] = []
+    seen: set[str] = set()
+    for item in raw_items:
+        code = normalize_payment_currency_code(item, default="")
+        if not code or code in seen:
+            continue
+        seen.add(code)
+        currencies.append(code)
+    return tuple(currencies)
 
 
 @dataclass(frozen=True)
@@ -146,6 +181,7 @@ class PaymentProviderSpec:
     webhook_route: Optional[WebhookRoute] = None
     webhook_requires_base_url: bool = False
     create_webapp_payment: Optional[WebAppPaymentFactory] = None
+    reuse_webapp_payment: Optional[ReusableWebAppPaymentResolver] = None
     requires_configured_service: bool = True
     price_source: str = "rub"
     emoji: str = "💳"
@@ -158,6 +194,12 @@ class PaymentProviderSpec:
     admin_only_manifest_key: Optional[str] = None
     admin_only_config_attr: str = "ADMIN_ONLY_ENABLED"
     admin_only_enabled: Optional[EnabledPredicate] = None
+    supported_currencies: Optional[Sequence[str]] = ("RUB",)
+    supported_currencies_resolver: Optional[CurrencySupportResolver] = None
+    payment_amount_resolver: Optional[PaymentAmountResolver] = None
+    payment_minimum_resolver: Optional[PaymentMinimumResolver] = None
+    currency_support_note: str = ""
+    currency_support_url: Optional[str] = None
 
     @property
     def settings_key(self) -> str:
@@ -237,6 +279,63 @@ class PaymentProviderSpec:
         service = app.get(self.service_key) if hasattr(app, "get") else None
         return bool(service and getattr(service, "configured", False))
 
+    def _currency_source(self, source: Any) -> Any:
+        if self.config_class is not None and self.service_key:
+            from .registry import get_provider_bundle
+
+            bundle = get_provider_bundle(self.service_key)
+            if bundle and bundle.config is not None:
+                return bundle.config
+        return source
+
+    def supported_currency_codes(self, source: Any = None) -> Optional[tuple[str, ...]]:
+        if self.price_source == "stars":
+            return ("XTR",)
+        source_for_currency = self._currency_source(source)
+        if self.supported_currencies_resolver is not None:
+            resolved = self.supported_currencies_resolver(source_for_currency)
+            if resolved is None:
+                return None
+            return parse_supported_currency_codes(resolved)
+        if self.supported_currencies is None:
+            return None
+        return parse_supported_currency_codes(self.supported_currencies)
+
+    def supports_currency(self, source: Any, currency: Any) -> bool:
+        supported = self.supported_currency_codes(source)
+        if supported is None:
+            return True
+        return normalize_payment_currency_code(currency) in supported
+
+    def is_usable_for_payment_currency(self, source: Any, currency: Any) -> bool:
+        if self.price_source == "stars":
+            return True
+        return self.supports_currency(source, currency)
+
+    def payment_minimum(self, source: Any, currency: Any) -> Optional[Mapping[str, Any]]:
+        if self.payment_minimum_resolver is None:
+            return None
+        source_for_amount = self._currency_source(source)
+        try:
+            return self.payment_minimum_resolver(source_for_amount, currency)
+        except Exception:
+            return None
+
+    def is_usable_for_payment_amount(self, source: Any, currency: Any, amount: Any) -> bool:
+        if self.price_source == "stars" or self.payment_amount_resolver is None:
+            return True
+        source_for_amount = self._currency_source(source)
+        try:
+            return bool(self.payment_amount_resolver(source_for_amount, currency, amount))
+        except Exception:
+            return True
+
+    def is_usable_for_payment(self, source: Any, currency: Any, amount: Any) -> bool:
+        return self.is_usable_for_payment_currency(
+            source,
+            currency,
+        ) and self.is_usable_for_payment_amount(source, currency, amount)
+
     def is_visible(self, source: Any, app: Any) -> bool:
         return self.is_enabled(source) and self.is_service_configured(app)
 

backend/bot/payment_providers/cryptopay.py

@@ -17,6 +17,10 @@ from bot.middlewares.i18n import JsonI18n
 from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal
 
 from .base import (
@@ -25,6 +29,7 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -49,6 +54,34 @@ from .shared import (
 
 logger = logging.getLogger(__name__)
 _LOG = "cryptopay"
+CRYPTOPAY_FIAT_CURRENCIES = (
+    "USD",
+    "EUR",
+    "RUB",
+    "BYN",
+    "UAH",
+    "GBP",
+    "CNY",
+    "KZT",
+    "UZS",
+    "GEL",
+    "TRY",
+    "AMD",
+    "THB",
+    "INR",
+    "BRL",
+    "IDR",
+    "AZN",
+    "AED",
+    "PLN",
+    "ILS",
+)
+CRYPTOPAY_CRYPTO_ASSETS = ("USDT", "TON", "BTC", "ETH", "LTC", "BNB", "TRX", "USDC")
+
+
+def _cryptopay_supported_currencies(config) -> tuple[str, ...]:
+    currency_type = str(getattr(config, "CURRENCY_TYPE", "fiat") or "fiat").strip().lower()
+    return CRYPTOPAY_CRYPTO_ASSETS if currency_type == "crypto" else CRYPTOPAY_FIAT_CURRENCIES
 
 
 class CryptoPayConfig(ProviderEnvConfig):
@@ -159,20 +192,37 @@ class CryptoPayService:
         sale_mode: str = "subscription",
         url_kind: str = "bot",
         hwid_quote: Optional[dict] = None,
+        hwid_device_count: Optional[int] = None,
+        currency: Optional[str] = None,
     ) -> Optional[str]:
         if not self.configured or not self.client:
             logging.error("CryptoPayService not configured")
             return None
 
+        currency_code = normalize_payment_currency_code(currency or self.config.ASSET)
+        currency_type = str(self.config.CURRENCY_TYPE or "fiat").strip().lower()
+        supported = _cryptopay_supported_currencies(self.config)
+        if currency_code not in supported:
+            logging.error(
+                "CryptoPay currency %s is not supported for currency_type=%s",
+                currency_code,
+                currency_type,
+            )
+            return None
+
         sale_base = sale_mode_base(sale_mode)
-        amounts = payment_record_amounts(months=months, sale_mode=sale_mode)
+        amounts = payment_record_amounts(
+            months=months,
+            sale_mode=sale_mode,
+            hwid_device_count=hwid_device_count,
+        )
         try:
             payment_record = await payment_dal.create_payment_record(
                 session,
                 {
                     "user_id": user_id,
                     "amount": float(amount),
-                    "currency": self.config.ASSET,
+                    "currency": currency_code,
                     "status": "pending_cryptopay",
                     "description": description,
                     "subscription_duration_months": (
@@ -207,14 +257,15 @@ class CryptoPayService:
                 "payment_db_id": str(payment_record.payment_id),
                 "sale_mode": sale_mode,
                 "traffic_gb": str(months) if sale_mode_is_traffic(sale_mode) else None,
+                "hwid_devices": amounts.purchased_hwid_devices,
             }
         )
         try:
             invoice = await self.client.create_invoice(
                 amount=amount,
-                currency_type=self.config.CURRENCY_TYPE,
-                fiat=self.config.ASSET if self.config.CURRENCY_TYPE == "fiat" else None,
-                asset=self.config.ASSET if self.config.CURRENCY_TYPE == "crypto" else None,
+                currency_type=currency_type,
+                fiat=currency_code if currency_type == "fiat" else None,
+                asset=currency_code if currency_type == "crypto" else None,
                 description=description,
                 payload=payload,
             )
@@ -393,7 +444,7 @@ async def pay_crypto_callback_handler(
         user_id=callback.from_user.id,
         parts=parts,
         subscription_service=cryptopay_service.subscription_service,
-        currency="rub",
+        currency=default_currency_key_for_settings(settings),
     )
     if not parts:
         await notify_callback_parse_error(callback, translator)
@@ -408,6 +459,7 @@ async def pay_crypto_callback_handler(
         description=payment_description,
         sale_mode=parts.sale_mode,
         hwid_quote=hwid_quote,
+        currency=default_payment_currency_code_for_settings(settings),
     )
 
     if invoice_url:
@@ -457,6 +509,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         description=ctx.description,
         sale_mode=ctx.sale_mode,
         url_kind="web",
+        currency=ctx.currency,
         hwid_quote={
             "valid_from": ctx.hwid_valid_from,
             "valid_until": ctx.hwid_valid_until,
@@ -466,6 +519,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         }
         if ctx.hwid_valid_from and ctx.hwid_valid_until
         else None,
+        hwid_device_count=ctx.hwid_device_count,
     )
     if not url:
         return payment_failed()
@@ -592,4 +646,10 @@ SPEC = PaymentProviderSpec(
     config_class=CryptoPayConfig,
     presentation_class=CryptoPayPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies_resolver=_cryptopay_supported_currencies,
+    currency_support_note=(
+        "Crypto Pay supports different sets for fiat invoices and crypto invoices; "
+        "CURRENCY_TYPE selects which set is active."
+    ),
+    currency_support_url="https://help.crypt.bot/crypto-pay-api/",
 )

backend/bot/payment_providers/freekassa.py

@@ -20,6 +20,10 @@ from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from bot.utils.request_security import ip_in_allowlist, request_client_ip
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal
 
 from .base import (
@@ -28,6 +32,7 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -48,14 +53,18 @@ from .shared import (
     notify_service_unavailable,
     parse_payment_callback,
     payment_failed,
+    payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
     post_json_request,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
+    safe_callback_answer,
 )
 
 _LOG = "freekassa"
+FREEKASSA_SUPPORTED_CURRENCIES = ("RUB", "USD", "EUR", "UAH", "KZT")
 
 
 class FreeKassaConfig(ProviderEnvConfig):
@@ -70,7 +79,7 @@ class FreeKassaConfig(ProviderEnvConfig):
     MERCHANT_ID: Optional[str] = None
     FIRST_SECRET: Optional[str] = None
     SECOND_SECRET: Optional[str] = None
-    PAYMENT_URL: str = Field(default="https://pay.freekassa.ru/")
+    PAYMENT_URL: str = Field(default="https://pay.freekassa.net/")
     API_KEY: Optional[str] = None
     PAYMENT_IP: Optional[str] = None
     PAYMENT_METHOD_ID: Optional[int] = None
@@ -144,10 +153,10 @@ class FreeKassaService(HttpClientMixin):
         self.subscription_service = subscription_service
         self.referral_service = referral_service
 
-        self.default_currency: str = (settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper()
+        self.default_currency: str = default_payment_currency_code_for_settings(settings).upper()
 
         self.api_base_url: str = "https://api.fk.life/v1"
-        self._init_http_client(total_timeout=15)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         self._nonce_lock = asyncio.Lock()
         self._last_nonce = int(time.time() * 1000)
 
@@ -207,7 +216,13 @@ class FreeKassaService(HttpClientMixin):
             return False, {"message": "missing_ip"}
 
         email = email or f"{user_id}@telegram.org"
-        currency_code = (currency or self.default_currency or "RUB").upper()
+        currency_code = normalize_payment_currency_code(currency or self.default_currency or "RUB")
+        if currency_code not in FREEKASSA_SUPPORTED_CURRENCIES:
+            return False, {
+                "message": "unsupported_currency",
+                "currency": currency_code,
+                "supported_currencies": list(FREEKASSA_SUPPORTED_CURRENCIES),
+            }
 
         payload: Dict[str, Any] = {
             "shopId": int(self.shop_id),
@@ -241,6 +256,62 @@ class FreeKassaService(HttpClientMixin):
             is_success=lambda status, data: status == 200 and (data or {}).get("type") == "success",
         )
 
+    async def get_orders(
+        self,
+        *,
+        payment_id: int,
+        order_status: Optional[int] = None,
+    ) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        payload: Dict[str, Any] = {
+            "shopId": int(self.shop_id),
+            "nonce": await self._generate_nonce(),
+            "paymentId": str(payment_id),
+        }
+        if order_status is not None:
+            payload["orderStatus"] = int(order_status)
+        payload["signature"] = self._sign_payload(payload)
+
+        session = await self._get_session()
+        return await post_json_request(
+            session,
+            f"{self.api_base_url}/orders",
+            body=payload,
+            log_prefix="FreeKassa get_orders",
+            is_success=lambda status, data: status == 200 and (data or {}).get("type") == "success",
+        )
+
+    async def try_reuse_pending_order(self, payment: Any) -> Optional[str]:
+        order_hash = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        if not order_hash:
+            return None
+
+        success, response_data = await self.get_orders(
+            payment_id=payment.payment_id,
+            order_status=0,
+        )
+        if not success:
+            return None
+
+        for order in response_data.get("orders") or []:
+            if not isinstance(order, dict):
+                continue
+            try:
+                is_new = int(order.get("status", -1)) == 0
+            except (TypeError, ValueError):
+                continue
+            if not is_new:
+                continue
+            if str(order.get("merchant_order_id") or "") != str(payment.payment_id):
+                continue
+            fk_order_id = str(order.get("fk_order_id") or "").strip()
+            if fk_order_id:
+                payment_url = (self.config.PAYMENT_URL or "https://pay.freekassa.net/").rstrip("/")
+                return f"{payment_url}/form/{fk_order_id}/{order_hash}"
+        return None
+
     async def _generate_nonce(self) -> int:
         async with self._nonce_lock:
             candidate = int(time.time() * 1000)
@@ -477,7 +548,7 @@ async def pay_fk_callback_handler(
         user_id=callback.from_user.id,
         parts=parts,
         subscription_service=freekassa_service.subscription_service,
-        currency="rub",
+        currency=default_currency_key_for_settings(settings),
     )
     if not parts:
         await notify_callback_parse_error(callback, translator)
@@ -485,7 +556,7 @@ async def pay_fk_callback_handler(
 
     currency_code = (
         getattr(freekassa_service, "default_currency", None)
-        or settings.DEFAULT_CURRENCY_SYMBOL
+        or default_payment_currency_code_for_settings(settings)
         or "RUB"
     )
     payment_description = describe_payment(translator, parts)
@@ -501,6 +572,39 @@ async def pay_fk_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="freekassa",
+        pending_status="pending_freekassa",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await freekassa_service.try_reuse_pending_order(reusable_payment)
+        if reusable_url:
+            await safe_callback_answer(callback)
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -578,12 +682,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     service: FreeKassaService = ctx.request.app["freekassa_service"]
     if not service or not service.configured or not service.payment_method_id:
         return payment_unavailable()
+    currency = ctx.currency or service.default_currency
 
     try:
         payment = await create_webapp_payment_record(
             ctx,
             amount=ctx.price,
-            currency=service.default_currency,
+            currency=currency,
             status="pending_freekassa",
             provider="freekassa",
         )
@@ -592,7 +697,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
             user_id=ctx.user_id,
             months=ctx.months,
             amount=ctx.price,
-            currency=service.default_currency,
+            currency=currency,
             payment_method_id=service.payment_method_id,
             ip_address=service.server_ip,
             extra_params={"us_method": service.payment_method_id},
@@ -612,6 +717,14 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: FreeKassaService = ctx.request.app.get("freekassa_service")
+    if not service or not service.configured:
+        return None
+
+    return await service.try_reuse_pending_order(payment)
+
+
 _PRESENTATION_MANIFEST = tuple(
     ProviderManifestField(
         key=key,
@@ -710,7 +823,7 @@ _CONFIG_MANIFEST = (
         "FREEKASSA_PAYMENT_URL",
         "url",
         "Payment URL",
-        placeholder="https://pay.freekassa.ru/",
+        placeholder="https://pay.freekassa.net/",
         subsection="FreeKassa",
         attr="PAYMENT_URL",
     ),
@@ -759,7 +872,13 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/freekassa",
     webhook_route=freekassa_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=FreeKassaConfig,
     presentation_class=FreeKassaPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies=FREEKASSA_SUPPORTED_CURRENCIES,
+    currency_support_note=(
+        "FreeKassa SCI documents the payment currency parameter as RUB, USD, EUR, UAH or KZT."
+    ),
+    currency_support_url="https://docs.freekassa.net/",
 )

backend/bot/payment_providers/heleket.py

@@ -3,6 +3,7 @@ import hashlib
 import hmac
 import json
 import logging
+import time
 from collections import OrderedDict
 from typing import Any, Dict, List, Optional, Tuple
 
@@ -18,6 +19,10 @@ from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from bot.utils.request_security import ip_in_allowlist, request_client_ip
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal
 
 from .base import (
@@ -26,6 +31,8 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
+    parse_supported_currency_codes,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -48,10 +55,12 @@ from .shared import (
     notify_user_payment_failed,
     parse_payment_callback,
     payment_failed,
+    payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
 )
 
 router = Router(name="user_subscription_payments_heleket_router")
@@ -59,6 +68,10 @@ _LOG = "heleket"
 
 _SUCCESS_STATUSES = {"paid", "paid_over"}
 _FAILED_STATUSES = {"fail", "wrong_amount", "cancel", "system_fail"}
+HELEKET_DEFAULT_SUPPORTED_CURRENCIES = (
+    "RUB,USD,EUR,USDT,USDC,BTC,ETH,LTC,TON,TRX,BNB,BCH,DASH,DAI,DOGE,"
+    "MATIC,SHIB,SOL,XMR,AVAX,BUSD,VERSE"
+)
 
 
 class HeleketConfig(ProviderEnvConfig):
@@ -83,6 +96,7 @@ class HeleketConfig(ProviderEnvConfig):
     LIFETIME_SECONDS: int = Field(default=3600)
     VERIFY_WEBHOOK_SIGNATURE: bool = Field(default=True)
     TRUSTED_IPS: str = Field(default="31.133.220.8")
+    SUPPORTED_CURRENCIES: str = Field(default=HELEKET_DEFAULT_SUPPORTED_CURRENCIES)
 
     @field_validator("LIFETIME_SECONDS", mode="before")
     @classmethod
@@ -232,7 +246,7 @@ class HeleketService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=20)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning(
                 "HeleketService initialized but not fully configured. Payments disabled."
@@ -299,9 +313,18 @@ class HeleketService(HttpClientMixin):
             logging.error("HeleketService is not configured. Cannot create payment link.")
             return False, {"message": "service_not_configured"}
 
+        currency_code = normalize_payment_currency_code(currency or self.currency)
+        supported = parse_supported_currency_codes(self.config.SUPPORTED_CURRENCIES)
+        if supported and currency_code not in supported:
+            return False, {
+                "message": "unsupported_currency",
+                "currency": currency_code,
+                "supported_currencies": list(supported),
+            }
+
         body: Dict[str, Any] = {
             "amount": str(format_decimal_amount(amount)),
-            "currency": (currency or self.currency).upper(),
+            "currency": currency_code,
             "order_id": str(payment_db_id),
             "url_return": self.return_url,
             "url_success": self.success_url,
@@ -352,6 +375,70 @@ class HeleketService(HttpClientMixin):
             logging.exception("Heleket create_payment_link: request failed.")
             return False, {"message": str(exc)}
 
+    async def get_payment_info(self, payment_uuid: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        payment_uuid = str(payment_uuid or "").strip()
+        if not payment_uuid:
+            return False, {"message": "missing_payment_uuid"}
+
+        body = {"uuid": payment_uuid}
+        headers = {
+            "merchant": self.merchant_id,
+            "sign": _compute_signature(body, self.api_key),
+            "Content-Type": "application/json",
+        }
+        session = await self._get_session()
+        try:
+            async with session.post(
+                f"{self.base_url}/v1/payment/info",
+                data=_serialize_for_signature(body).encode("utf-8"),
+                headers=headers,
+            ) as response:
+                response_data = await response.json(content_type=None)
+                state = response_data.get("state") if isinstance(response_data, dict) else None
+                if response.status != 200 or state != 0:
+                    logging.warning(
+                        "Heleket get_payment_info failed: uuid=%s status=%s body=%s",
+                        payment_uuid,
+                        response.status,
+                        response_data,
+                    )
+                    return False, {"status": response.status, "message": response_data}
+                result = response_data.get("result") or {}
+                return isinstance(result, dict), result
+        except Exception as exc:
+            logging.exception("Heleket get_payment_info request failed: uuid=%s", payment_uuid)
+            return False, {"message": str(exc)}
+
+    async def try_reuse_pending_payment(self, payment: Any) -> Optional[str]:
+        payment_uuid = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        if not payment_uuid:
+            return None
+
+        success, data = await self.get_payment_info(payment_uuid)
+        if not success or not isinstance(data, dict):
+            return None
+        status = str(data.get("payment_status") or data.get("status") or "").lower()
+        if status != "check" or bool(data.get("is_final")):
+            return None
+        if str(data.get("uuid") or "") != payment_uuid:
+            return None
+        if str(data.get("order_id") or "") != str(payment.payment_id):
+            return None
+        try:
+            expired_at = int(data.get("expired_at") or 0)
+        except (TypeError, ValueError):
+            return None
+        if expired_at and expired_at <= int(time.time()):
+            return None
+        return (
+            str(data.get("url") or "").strip()
+            or str(getattr(payment, "provider_payment_url", None) or "").strip()
+            or None
+        )
+
     def _verify_signature(self, payload: Dict[str, Any]) -> bool:
         received = payload.get("sign")
         if not isinstance(received, str) or not received:
@@ -572,13 +659,13 @@ async def pay_heleket_callback_handler(
         user_id=callback.from_user.id,
         parts=parts,
         subscription_service=heleket_service.subscription_service,
-        currency="rub",
+        currency=default_currency_key_for_settings(settings),
     )
     if not parts:
         await notify_callback_parse_error(callback, translator)
         return
 
-    currency_code = (heleket_service.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper()
+    currency_code = default_payment_currency_code_for_settings(settings)
     payment_description = describe_payment(translator, parts)
     record_payload = build_payment_record_payload(
         user_id=callback.from_user.id,
@@ -592,6 +679,38 @@ async def pay_heleket_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="heleket",
+        pending_status="pending_heleket",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await heleket_service.try_reuse_pending_payment(reusable_payment)
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -632,7 +751,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     if not service or not service.configured:
         return payment_unavailable()
 
-    currency = (service.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper()
+    currency = ctx.currency or default_payment_currency_code_for_settings(settings)
     try:
         payment = await create_webapp_payment_record(
             ctx,
@@ -664,6 +783,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: HeleketService = ctx.request.app.get("heleket_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_payment(payment)
+
+
 async def heleket_webhook_route(request: web.Request) -> web.Response:
     service: HeleketService = request.app["heleket_service"]
     return await service.webhook_route(request)
@@ -787,6 +913,18 @@ _CONFIG_MANIFEST = (
         subsection="Heleket",
         attr="CURRENCY",
     ),
+    ProviderManifestField(
+        "HELEKET_SUPPORTED_CURRENCIES",
+        "string",
+        "Supported currencies",
+        description=(
+            "Comma-separated invoice currencies allowed for Heleket in this shop. "
+            "Heleket can reject unsupported codes per account/service."
+        ),
+        placeholder=HELEKET_DEFAULT_SUPPORTED_CURRENCIES,
+        subsection="Heleket",
+        attr="SUPPORTED_CURRENCIES",
+    ),
     ProviderManifestField(
         "HELEKET_TO_CURRENCY",
         "string",
@@ -855,8 +993,17 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/heleket",
     webhook_route=heleket_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     emoji="🪙",
     config_class=HeleketConfig,
     presentation_class=HeleketPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies_resolver=lambda config: getattr(
+        config, "SUPPORTED_CURRENCIES", HELEKET_DEFAULT_SUPPORTED_CURRENCIES
+    ),
+    currency_support_note=(
+        "Heleket supports crypto and fiat invoice currencies, but exact availability "
+        "can depend on service/account settings."
+    ),
+    currency_support_url="https://doc.heleket.com/methods/payments/creating-invoice",
 )

backend/bot/payment_providers/lava.py

@@ -0,0 +1,877 @@
+import hashlib
+import hmac
+import json
+import logging
+from typing import Any, Dict, List, Optional, Tuple
+
+from aiogram import Bot, F, Router, types
+from aiohttp import web
+from pydantic import Field, field_validator
+from pydantic_settings import SettingsConfigDict
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import sessionmaker
+
+from bot.middlewares.i18n import JsonI18n
+from bot.services.referral_service import ReferralService
+from bot.services.subscription_service import SubscriptionService
+from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
+from db.dal import payment_dal
+
+from .base import (
+    PaymentProviderSpec,
+    ProviderEnvConfig,
+    ProviderManifestField,
+    ServiceFactoryContext,
+    WebAppPaymentContext,
+    normalize_payment_currency_code,
+    provider_env_file,
+    provider_runtime_enabled,
+)
+from .shared import (
+    HttpClientMixin,
+    PaymentSuccessRequest,
+    build_payment_record_payload,
+    create_webapp_payment_record,
+    decimal_amounts_equal,
+    describe_payment,
+    finalize_successful_payment,
+    finalize_webapp_link_payment,
+    first_value,
+    format_decimal_amount,
+    lookup_payment_by_order_or_provider_id,
+    make_translator,
+    notify_callback_parse_error,
+    notify_payment_record_failure,
+    notify_service_unavailable,
+    notify_user_payment_failed,
+    parse_payment_callback,
+    payment_failed,
+    payment_record_amounts,
+    payment_unavailable,
+    payment_units_for_activation,
+    quote_hwid_callback_parts,
+    render_link_or_fail,
+    render_payment_link,
+)
+
+_LOG = "lava"
+
+# LAVA Business invoice statuses (https://dev.lava.ru/business-objects-invoice).
+_SUCCESS_STATUSES = {"success"}
+_FAILED_STATUSES = {"cancel", "cancelled", "error", "failed", "expired"}
+_PENDING_STATUSES = {"created", "pending", "processing"}
+
+
+class LavaConfig(ProviderEnvConfig):
+    """All LAVA Business env vars. Lives inside the provider module."""
+
+    model_config = SettingsConfigDict(
+        env_file=provider_env_file(),
+        env_file_encoding="utf-8",
+        env_prefix="LAVA_",
+        extra="ignore",
+    )
+
+    ENABLED: bool = Field(default=False)
+    SHOP_ID: Optional[str] = None
+    SECRET_KEY: Optional[str] = None
+    WEBHOOK_SECRET: Optional[str] = None
+    BASE_URL: str = Field(default="https://api.lava.ru")
+    RETURN_URL: Optional[str] = None
+    LIFETIME_MINUTES: Optional[int] = None
+    INCLUDE_SERVICES: Optional[str] = None
+
+    @field_validator("LIFETIME_MINUTES", mode="before")
+    @classmethod
+    def _empty_to_none_int(cls, v):
+        if isinstance(v, str):
+            v = v.strip()
+            if not v:
+                return None
+        return v
+
+    @field_validator("SHOP_ID", "SECRET_KEY", "WEBHOOK_SECRET", "RETURN_URL", mode="before")
+    @classmethod
+    def _strip_optional(cls, v):
+        if isinstance(v, str) and not v.strip():
+            return None
+        return v
+
+    @property
+    def webhook_path(self) -> str:
+        return "/webhook/lava"
+
+    def full_webhook_url(self, base: Optional[str]) -> Optional[str]:
+        if not base:
+            return None
+        return f"{base.rstrip('/')}{self.webhook_path}"
+
+    @property
+    def include_services_list(self) -> List[str]:
+        return [item.strip() for item in (self.INCLUDE_SERVICES or "").split(",") if item.strip()]
+
+
+class LavaPresentation(ProviderEnvConfig):
+    """Admin-tunable button text/icon overrides for LAVA."""
+
+    model_config = SettingsConfigDict(
+        env_file=provider_env_file(),
+        env_file_encoding="utf-8",
+        env_prefix="PAYMENT_LAVA_",
+        extra="ignore",
+    )
+
+    WEBAPP_LABEL_RU: Optional[str] = None
+    WEBAPP_LABEL_EN: Optional[str] = None
+    WEBAPP_ICON: Optional[str] = None
+    TELEGRAM_LABEL_RU: Optional[str] = None
+    TELEGRAM_LABEL_EN: Optional[str] = None
+    TELEGRAM_EMOJI: Optional[str] = None
+
+
+def _canonical_json(payload: Dict[str, Any]) -> str:
+    """JSON with sorted keys, the way legacy LAVA PHP-SDK shops sign webhooks.
+
+    Only used as a webhook-verification fallback: outgoing requests sign the
+    exact raw bytes that go on the wire, never a re-serialization. The
+    ``signature`` field is dropped and ``float n.0`` collapses to ``int``
+    for PHP ``json_encode`` compatibility.
+    """
+
+    def normalize(value: Any) -> Any:
+        if isinstance(value, float) and value.is_integer():
+            return int(value)
+        if isinstance(value, dict):
+            return {key: normalize(item) for key, item in value.items() if key != "signature"}
+        if isinstance(value, list):
+            return [normalize(item) for item in value]
+        return value
+
+    without_sig = {key: normalize(value) for key, value in payload.items() if key != "signature"}
+    return json.dumps(without_sig, sort_keys=True, separators=(",", ":"))
+
+
+class LavaService(HttpClientMixin):
+    """Client for LAVA Business API (api.lava.ru).
+
+    Outgoing requests are signed with HMAC-SHA256 over the exact raw body
+    bytes using ``LAVA_SECRET_KEY``; the hex digest travels in the
+    ``Signature`` HTTP header. Webhooks arrive signed with the shop's
+    additional key (``LAVA_WEBHOOK_SECRET``) in the ``Authorization`` header;
+    some shops sign the raw body, others a sorted-keys re-serialization, so
+    verification accepts either canonicalization.
+    """
+
+    def __init__(
+        self,
+        *,
+        bot: Bot,
+        settings: Settings,
+        config: LavaConfig,
+        i18n: JsonI18n,
+        async_session_factory: sessionmaker,
+        subscription_service: SubscriptionService,
+        referral_service: ReferralService,
+        default_return_url: str,
+    ):
+        self.bot = bot
+        self.settings = settings
+        self.config = config
+        self.i18n = i18n
+        self.async_session_factory = async_session_factory
+        self.subscription_service = subscription_service
+        self.referral_service = referral_service
+        self._default_return_url = default_return_url
+
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
+
+        if not self.configured:
+            logging.warning("LavaService initialized but not fully configured. Payments disabled.")
+
+    @property
+    def configured(self) -> bool:
+        return bool(provider_runtime_enabled(self.config) and self.shop_id and self.secret_key)
+
+    @property
+    def base_url(self) -> str:
+        return (self.config.BASE_URL or "https://api.lava.ru").rstrip("/")
+
+    @property
+    def shop_id(self) -> str:
+        return (self.config.SHOP_ID or "").strip()
+
+    @property
+    def secret_key(self) -> str:
+        return (self.config.SECRET_KEY or "").strip()
+
+    @property
+    def webhook_secret(self) -> str:
+        # LAVA signs webhooks with the shop's "additional key"; merchants that
+        # use a single key can leave WEBHOOK_SECRET empty to reuse SECRET_KEY.
+        return (self.config.WEBHOOK_SECRET or "").strip() or self.secret_key
+
+    @property
+    def return_url(self) -> str:
+        return self.config.RETURN_URL or f"https://t.me/{self._default_return_url}"
+
+    @property
+    def lifetime_minutes(self) -> Optional[int]:
+        return self.config.LIFETIME_MINUTES
+
+    def _hmac_hex(self, message: bytes, key: str) -> str:
+        return hmac.new(key.encode("utf-8"), message, hashlib.sha256).hexdigest()
+
+    async def _post_signed(self, path: str, payload: Dict[str, Any]) -> Tuple[bool, Dict[str, Any]]:
+        """POST to LAVA signing the exact bytes that go on the wire."""
+        url = f"{self.base_url}/{path.lstrip('/')}"
+        body_bytes = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+        headers = {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "Signature": self._hmac_hex(body_bytes, self.secret_key),
+        }
+        session = await self._get_session()
+        try:
+            async with session.post(url, data=body_bytes, headers=headers) as response:
+                response_text = await response.text()
+                try:
+                    response_data = json.loads(response_text) if response_text else {}
+                except json.JSONDecodeError:
+                    logging.error("LAVA %s: invalid JSON response: %s", path, response_text[:500])
+                    return False, {"status": response.status, "message": "invalid_json"}
+                if not isinstance(response_data, dict):
+                    response_data = {"data": response_data}
+                api_status = str(response_data.get("status") or "").lower()
+                if response.status != 200 or api_status == "error":
+                    logging.error(
+                        "LAVA %s: API error (http=%s, body=%s)",
+                        path,
+                        response.status,
+                        response_data,
+                    )
+                    return False, {
+                        "status": response.status,
+                        "message": response_data.get("error")
+                        or response_data.get("message")
+                        or "lava_api_error",
+                        "code": response_data.get("code"),
+                    }
+                data = response_data.get("data")
+                return True, data if isinstance(data, dict) else response_data
+        except Exception as exc:
+            logging.exception("LAVA %s: request failed.", path)
+            return False, {"message": str(exc)}
+
+    async def create_payment(
+        self,
+        *,
+        payment_db_id: int,
+        amount: float,
+        currency: Optional[str],
+        description: Optional[str] = None,
+    ) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            logging.error("LavaService is not configured. Cannot create payment.")
+            return False, {"message": "service_not_configured"}
+
+        currency_code = normalize_payment_currency_code(
+            currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+        )
+        if currency_code != "RUB":
+            return False, {
+                "message": "unsupported_currency",
+                "currency": currency_code,
+                "supported_currencies": ["RUB"],
+            }
+
+        body: Dict[str, Any] = {
+            "sum": float(format_decimal_amount(amount)),
+            "orderId": str(payment_db_id),
+            "shopId": self.shop_id,
+        }
+        hook_url = self.config.full_webhook_url(getattr(self.settings, "WEBHOOK_BASE_URL", None))
+        if hook_url:
+            body["hookUrl"] = hook_url[:500]
+        if self.return_url:
+            body["successUrl"] = self.return_url[:500]
+            body["failUrl"] = self.return_url[:500]
+        if self.lifetime_minutes:
+            # LAVA accepts 1..7200 minutes (5 days).
+            body["expire"] = max(1, min(7200, int(self.lifetime_minutes)))
+        if description:
+            body["comment"] = description[:255]
+        include_services = self.config.include_services_list
+        if include_services:
+            body["includeService"] = include_services
+
+        return await self._post_signed("/business/invoice/create", body)
+
+    async def get_invoice_status(
+        self,
+        *,
+        order_id: Optional[str] = None,
+        invoice_id: Optional[str] = None,
+    ) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+        if not order_id and not invoice_id:
+            return False, {"message": "missing_identifier"}
+
+        body: Dict[str, Any] = {"shopId": self.shop_id}
+        if invoice_id:
+            body["invoiceId"] = str(invoice_id)
+        if order_id:
+            body["orderId"] = str(order_id)
+        return await self._post_signed("/business/invoice/status", body)
+
+    async def try_reuse_pending_payment(self, payment: Any) -> Optional[str]:
+        provider_payment_id = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        payment_url = str(getattr(payment, "provider_payment_url", None) or "").strip()
+        if not provider_payment_id or not payment_url:
+            return None
+
+        success, data = await self.get_invoice_status(
+            order_id=str(payment.payment_id),
+            invoice_id=provider_payment_id,
+        )
+        if not success or str(data.get("status") or "").lower() not in _PENDING_STATUSES:
+            return None
+        returned_ids = {str(data.get("id") or ""), str(data.get("invoice_id") or "")}
+        if provider_payment_id not in returned_ids:
+            return None
+        returned_order_id = str(data.get("order_id") or data.get("orderId") or "")
+        if returned_order_id and returned_order_id != str(payment.payment_id):
+            return None
+        return payment_url
+
+    def verify_webhook_signature(self, raw_body: bytes, received_signature: str) -> bool:
+        """Verify the ``Authorization`` header HMAC on a LAVA webhook.
+
+        Accepts HMAC of the raw body (current api.lava.ru contract) or of a
+        sorted-keys re-serialization (legacy PHP-SDK shops sign that instead).
+        """
+        received = str(received_signature or "").strip()
+        if not received:
+            logging.warning("LAVA webhook: missing signature header.")
+            return False
+        secret = self.webhook_secret
+        if not secret:
+            logging.error("LAVA webhook: no webhook secret configured.")
+            return False
+
+        expected_raw = self._hmac_hex(raw_body, secret)
+        if hmac.compare_digest(expected_raw.lower(), received.lower()):
+            return True
+
+        try:
+            payload = json.loads(raw_body)
+        except (ValueError, TypeError):
+            return False
+        if not isinstance(payload, dict):
+            return False
+        expected_canonical = self._hmac_hex(_canonical_json(payload).encode("utf-8"), secret)
+        return hmac.compare_digest(expected_canonical.lower(), received.lower())
+
+    async def webhook_route(self, request: web.Request) -> web.Response:
+        if not self.configured:
+            return web.json_response({"status": False, "msg": "lava_disabled"}, status=503)
+
+        raw_body = await request.read()
+        signature = request.headers.get("Authorization") or request.headers.get("Signature") or ""
+        if not self.verify_webhook_signature(raw_body, signature):
+            logging.error("LAVA webhook: invalid signature.")
+            return web.json_response({"status": False, "msg": "invalid_signature"}, status=403)
+
+        try:
+            payload = json.loads(raw_body)
+        except (ValueError, TypeError):
+            logging.exception("LAVA webhook: failed to parse JSON.")
+            return web.json_response({"status": False, "msg": "bad_request"}, status=400)
+        if not isinstance(payload, dict):
+            logging.error("LAVA webhook: unexpected payload type.")
+            return web.json_response({"status": False, "msg": "bad_request"}, status=400)
+
+        provider_payment_id = str(payload.get("invoice_id") or payload.get("id") or "")
+        order_id_raw = payload.get("order_id") or payload.get("orderId")
+        status = str(payload.get("status") or "").lower()
+
+        async with self.async_session_factory() as session:
+            payment = await lookup_payment_by_order_or_provider_id(
+                session,
+                order_id_raw=order_id_raw,
+                provider_payment_id=provider_payment_id or None,
+            )
+            if not payment:
+                logging.error(
+                    "LAVA webhook: payment not found (order_id=%s, provider_id=%s)",
+                    order_id_raw,
+                    provider_payment_id,
+                )
+                return web.json_response({"status": False, "msg": "payment_not_found"}, status=404)
+
+            resolved_provider_id = provider_payment_id or str(payment.payment_id)
+            sale_mode = payment.sale_mode or (
+                "traffic" if self.settings.traffic_sale_mode else "subscription"
+            )
+            payment_months = payment_units_for_activation(payment, sale_mode)
+
+            if status in _SUCCESS_STATUSES:
+                if payment.status == "succeeded":
+                    logging.info("LAVA webhook: payment %s already succeeded.", payment.payment_id)
+                    return web.json_response({"status": True})
+
+                webhook_amount = payload.get("amount")
+                if webhook_amount is not None and not decimal_amounts_equal(
+                    webhook_amount, payment.amount
+                ):
+                    logging.error(
+                        "LAVA webhook: amount mismatch for payment %s (expected=%s, received=%s)",
+                        payment.payment_id,
+                        payment.amount,
+                        webhook_amount,
+                    )
+                    return web.json_response(
+                        {"status": False, "msg": "amount_mismatch"}, status=400
+                    )
+
+                try:
+                    await payment_dal.update_provider_payment_and_status(
+                        session,
+                        payment.payment_id,
+                        resolved_provider_id,
+                        "succeeded",
+                    )
+                    await session.commit()
+                except Exception:
+                    await session.rollback()
+                    logging.exception(
+                        "LAVA webhook: failed to mark payment %s as succeeded.",
+                        resolved_provider_id,
+                    )
+                    return web.json_response(
+                        {"status": False, "msg": "processing_error"}, status=500
+                    )
+
+                outcome = await finalize_successful_payment(
+                    PaymentSuccessRequest(
+                        bot=self.bot,
+                        settings=self.settings,
+                        i18n=self.i18n,
+                        session=session,
+                        subscription_service=self.subscription_service,
+                        referral_service=self.referral_service,
+                        payment=payment,
+                        user_id=payment.user_id,
+                        amount=float(payment.amount),
+                        currency=payment.currency,
+                        sale_mode=sale_mode,
+                        months=payment_months,
+                        traffic_amount=float(payment_months),
+                        provider_subscription="lava",
+                        provider_notification="lava",
+                        db_user=payment.user,
+                        log_prefix="LAVA webhook",
+                    )
+                )
+                if outcome is None:
+                    return web.json_response(
+                        {"status": False, "msg": "processing_error"}, status=500
+                    )
+                return web.json_response({"status": True})
+
+            if status in _FAILED_STATUSES:
+                try:
+                    await payment_dal.update_provider_payment_and_status(
+                        session,
+                        payment.payment_id,
+                        resolved_provider_id,
+                        "failed",
+                    )
+                    await session.commit()
+                except Exception:
+                    await session.rollback()
+                    logging.exception(
+                        "LAVA webhook: failed to mark payment %s as failed.",
+                        resolved_provider_id,
+                    )
+                    return web.json_response(
+                        {"status": False, "msg": "processing_error"}, status=500
+                    )
+                await notify_user_payment_failed(
+                    bot=self.bot,
+                    settings=self.settings,
+                    i18n=self.i18n,
+                    session=session,
+                    payment=payment,
+                )
+                return web.json_response({"status": True})
+
+            if status in _PENDING_STATUSES:
+                try:
+                    await payment_dal.update_provider_payment_and_status(
+                        session,
+                        payment.payment_id,
+                        resolved_provider_id,
+                        "pending_lava",
+                    )
+                    await session.commit()
+                except Exception:
+                    await session.rollback()
+                    logging.exception(
+                        "LAVA webhook: failed to update pending status for %s.",
+                        resolved_provider_id,
+                    )
+                return web.json_response({"status": True})
+
+            logging.warning(
+                "LAVA webhook: unhandled status '%s' for payment %s",
+                status,
+                resolved_provider_id,
+            )
+            return web.json_response({"status": True})
+
+
+async def lava_webhook_route(request: web.Request) -> web.Response:
+    service: LavaService = request.app["lava_service"]
+    return await service.webhook_route(request)
+
+
+router = Router(name="user_subscription_payments_lava_router")
+
+
+@router.callback_query(F.data.startswith("pay_lava:"))
+async def pay_lava_callback_handler(
+    callback: types.CallbackQuery,
+    settings: Settings,
+    i18n_data: dict,
+    lava_service: LavaService,
+    session: AsyncSession,
+):
+    current_lang = i18n_data.get("current_language", settings.DEFAULT_LANGUAGE)
+    i18n: Optional[JsonI18n] = i18n_data.get("i18n_instance")
+    translator = make_translator(i18n, current_lang)
+
+    if not i18n or not callback.message:
+        await notify_callback_parse_error(callback, translator)
+        return
+
+    if not SPEC.is_available_to_user(
+        settings,
+        user_id=callback.from_user.id,
+        require_configured=False,
+    ):
+        await notify_service_unavailable(callback, translator)
+        return
+
+    if not lava_service or not lava_service.configured:
+        logging.error("LAVA service is not configured or unavailable.")
+        await notify_service_unavailable(callback, translator)
+        return
+
+    parts = parse_payment_callback(callback.data or "")
+    if not parts:
+        logging.error("Invalid pay_lava data in callback: %s", callback.data)
+        await notify_callback_parse_error(callback, translator)
+        return
+    parts, hwid_quote = await quote_hwid_callback_parts(
+        session=session,
+        user_id=callback.from_user.id,
+        parts=parts,
+        subscription_service=lava_service.subscription_service,
+        currency=default_currency_key_for_settings(settings),
+    )
+    if not parts:
+        await notify_callback_parse_error(callback, translator)
+        return
+
+    currency_code = default_payment_currency_code_for_settings(settings)
+    payment_description = describe_payment(translator, parts)
+    record_payload = build_payment_record_payload(
+        user_id=callback.from_user.id,
+        amount=parts.price,
+        currency=currency_code,
+        status="pending_lava",
+        description=payment_description,
+        months=parts.months,
+        provider="lava",
+        sale_mode=parts.sale_mode,
+        hwid_quote=hwid_quote,
+    )
+
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="lava",
+        pending_status="pending_lava",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await lava_service.try_reuse_pending_payment(reusable_payment)
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
+    try:
+        payment_record = await payment_dal.create_payment_record(session, record_payload)
+        await session.commit()
+    except Exception:
+        await session.rollback()
+        logging.exception(
+            "LAVA: failed to create payment record for user %s.", callback.from_user.id
+        )
+        await notify_payment_record_failure(callback, translator)
+        return
+
+    success, response_data = await lava_service.create_payment(
+        payment_db_id=payment_record.payment_id,
+        amount=parts.price,
+        currency=currency_code,
+        description=payment_description,
+    )
+    await render_link_or_fail(
+        callback,
+        translator=translator,
+        current_lang=current_lang,
+        i18n=i18n,
+        parts=parts,
+        session=session,
+        payment=payment_record,
+        api_success=success,
+        payment_url=first_value(response_data, "url", "payment_url", "paymentUrl"),
+        provider_payment_id=first_value(response_data, "id", "invoice_id"),
+        log_prefix=_LOG,
+    )
+
+
+def create_service(ctx: ServiceFactoryContext) -> LavaService:
+    bundle = ctx.config_for("lava_service")
+    config = bundle.config if bundle and isinstance(bundle.config, LavaConfig) else LavaConfig()
+    return LavaService(
+        bot=ctx.bot,
+        settings=ctx.settings,
+        config=config,
+        i18n=ctx.i18n,
+        async_session_factory=ctx.async_session_factory,
+        subscription_service=ctx.subscription_service,
+        referral_service=ctx.referral_service,
+        default_return_url=ctx.bot_username_for_default_return,
+    )
+
+
+async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
+    settings = ctx.request.app["settings"]
+    service: LavaService = ctx.request.app["lava_service"]
+    if not service or not service.configured:
+        return payment_unavailable()
+
+    currency = ctx.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+    try:
+        payment = await create_webapp_payment_record(
+            ctx,
+            amount=ctx.price,
+            currency=currency,
+            status="pending_lava",
+            provider="lava",
+        )
+        success, response_data = await service.create_payment(
+            payment_db_id=payment.payment_id,
+            amount=ctx.price,
+            currency=currency,
+            description=ctx.description,
+        )
+    except Exception:
+        await ctx.session.rollback()
+        logging.exception("LAVA WebApp payment failed")
+        return payment_failed()
+
+    return await finalize_webapp_link_payment(
+        session=ctx.session,
+        payment=payment,
+        api_success=success,
+        payment_url=(
+            first_value(response_data, "url", "payment_url", "paymentUrl") if success else None
+        ),
+        provider_payment_id=first_value(response_data, "id", "invoice_id"),
+        log_prefix="LAVA",
+    )
+
+
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: LavaService = ctx.request.app.get("lava_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_payment(payment)
+
+
+_PRESENTATION_MANIFEST = tuple(
+    ProviderManifestField(
+        key=key,
+        type=type_,
+        label=label,
+        description=description,
+        placeholder=placeholder,
+        subsection="LAVA",
+        target="presentation",
+        attr=attr,
+    )
+    for key, type_, label, description, placeholder, attr in (
+        (
+            "PAYMENT_LAVA_WEBAPP_LABEL_RU",
+            "string",
+            "WebApp button text (RU)",
+            "Custom Russian text shown in the Web App payment method button.",
+            "",
+            "WEBAPP_LABEL_RU",
+        ),
+        (
+            "PAYMENT_LAVA_WEBAPP_LABEL_EN",
+            "string",
+            "WebApp button text (EN)",
+            "Custom English text shown in the Web App payment method button.",
+            "",
+            "WEBAPP_LABEL_EN",
+        ),
+        (
+            "PAYMENT_LAVA_WEBAPP_ICON",
+            "icon",
+            "WebApp button icon",
+            "Lucide icon name rendered inside the Web App payment method button.",
+            "CreditCard",
+            "WEBAPP_ICON",
+        ),
+        (
+            "PAYMENT_LAVA_TELEGRAM_LABEL_RU",
+            "string",
+            "Telegram button text (RU)",
+            "Custom Russian text shown in Telegram bot payment buttons.",
+            "",
+            "TELEGRAM_LABEL_RU",
+        ),
+        (
+            "PAYMENT_LAVA_TELEGRAM_LABEL_EN",
+            "string",
+            "Telegram button text (EN)",
+            "Custom English text shown in Telegram bot payment buttons.",
+            "",
+            "TELEGRAM_LABEL_EN",
+        ),
+        (
+            "PAYMENT_LAVA_TELEGRAM_EMOJI",
+            "string",
+            "Telegram button emoji",
+            "Emoji prepended to the Telegram bot payment button when customized.",
+            "💳",
+            "TELEGRAM_EMOJI",
+        ),
+    )
+)
+
+_CONFIG_MANIFEST = (
+    ProviderManifestField("LAVA_ENABLED", "bool", "Включена", subsection="LAVA", attr="ENABLED"),
+    ProviderManifestField("LAVA_SHOP_ID", "string", "Shop ID", subsection="LAVA", attr="SHOP_ID"),
+    ProviderManifestField(
+        "LAVA_SECRET_KEY",
+        "string",
+        "Secret key",
+        description="Signs outgoing API requests (HMAC-SHA256 in the Signature header).",
+        subsection="LAVA",
+        secret=True,
+        attr="SECRET_KEY",
+    ),
+    ProviderManifestField(
+        "LAVA_WEBHOOK_SECRET",
+        "string",
+        "Webhook secret",
+        description=(
+            "The shop's additional key used to verify webhook signatures. "
+            "Leave empty to reuse the secret key."
+        ),
+        subsection="LAVA",
+        secret=True,
+        attr="WEBHOOK_SECRET",
+    ),
+    ProviderManifestField(
+        "LAVA_BASE_URL",
+        "url",
+        "Base URL",
+        placeholder="https://api.lava.ru",
+        subsection="LAVA",
+        attr="BASE_URL",
+    ),
+    ProviderManifestField(
+        "LAVA_RETURN_URL", "url", "Return URL", subsection="LAVA", attr="RETURN_URL"
+    ),
+    ProviderManifestField(
+        "LAVA_LIFETIME_MINUTES",
+        "int",
+        "Payment link lifetime (minutes)",
+        description="1..7200; leave empty for the LAVA default.",
+        subsection="LAVA",
+        min=1,
+        max=7200,
+        attr="LIFETIME_MINUTES",
+    ),
+    ProviderManifestField(
+        "LAVA_INCLUDE_SERVICES",
+        "string",
+        "Payment services filter",
+        description=(
+            "Comma-separated LAVA pay services to show on the payment page "
+            "(e.g. card,sbp). Empty shows everything enabled for the shop."
+        ),
+        placeholder="card,sbp",
+        subsection="LAVA",
+        attr="INCLUDE_SERVICES",
+    ),
+)
+
+
+SPEC = PaymentProviderSpec(
+    id="lava",
+    provider_key="lava",
+    label="LAVA",
+    webapp_label="LAVA",
+    webapp_labels={"ru": "LAVA", "en": "LAVA"},
+    webapp_icon="CreditCard",
+    telegram_labels={"ru": "LAVA", "en": "LAVA"},
+    telegram_emoji="💳",
+    pending_status="pending_lava",
+    enabled=lambda config: bool(getattr(config, "ENABLED", False)),
+    service_key="lava_service",
+    callback_prefix="pay_lava",
+    router=router,
+    create_service=create_service,
+    webhook_path=lambda source: "/webhook/lava",
+    webhook_route=lava_webhook_route,
+    create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
+    config_class=LavaConfig,
+    presentation_class=LavaPresentation,
+    manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies=("RUB",),
+    currency_support_note="LAVA Business invoices are issued in RUB only.",
+    currency_support_url="https://dev.lava.ru/",
+)

backend/bot/payment_providers/platega.py

@@ -14,6 +14,10 @@ from bot.middlewares.i18n import JsonI18n
 from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal
 
 from .base import (
@@ -22,6 +26,8 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
+    parse_supported_currency_codes,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -49,6 +55,7 @@ from .shared import (
     post_json_request,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
     safe_callback_answer,
 )
 
@@ -76,6 +83,7 @@ class PlategaConfig(ProviderEnvConfig):
     CRYPTO_METHOD: int = Field(default=13)
     RETURN_URL: Optional[str] = None
     FAILED_URL: Optional[str] = None
+    SUPPORTED_CURRENCIES: str = Field(default="RUB")
 
     @field_validator("MERCHANT_ID", "SECRET", "RETURN_URL", "FAILED_URL", mode="before")
     @classmethod
@@ -150,7 +158,7 @@ class PlategaService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=20)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning(
                 "PlategaService initialized but not fully configured. Payments disabled."
@@ -229,9 +237,19 @@ class PlategaService(HttpClientMixin):
             logging.error("PlategaService is not configured. Cannot create transaction.")
             return False, {"message": "service_not_configured"}
 
+        currency_code = normalize_payment_currency_code(
+            currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+        )
+        supported = parse_supported_currency_codes(self.config.SUPPORTED_CURRENCIES)
+        if supported and currency_code not in supported:
+            return False, {
+                "message": "unsupported_currency",
+                "currency": currency_code,
+                "supported_currencies": list(supported),
+            }
+
         session = await self._get_session()
         url = f"{self.base_url}/transaction/process"
-        currency_code = (currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper()
         method_id = int(payment_method if payment_method is not None else self.payment_method)
 
         body: Dict[str, Any] = {
@@ -265,6 +283,69 @@ class PlategaService(HttpClientMixin):
             log_prefix="Platega create_transaction",
         )
 
+    async def get_transaction(self, transaction_id: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        transaction_id = str(transaction_id or "").strip()
+        if not transaction_id:
+            return False, {"message": "missing_transaction_id"}
+
+        session = await self._get_session()
+        try:
+            async with session.get(
+                f"{self.base_url}/transaction/{transaction_id}",
+                headers=self._auth_headers,
+            ) as response:
+                data = await response.json(content_type=None)
+                if response.status != 200 or not isinstance(data, dict):
+                    logging.warning(
+                        "Platega get_transaction failed: id=%s status=%s body=%s",
+                        transaction_id,
+                        response.status,
+                        data,
+                    )
+                    return False, {"status": response.status, "message": data}
+                return True, data
+        except Exception as exc:
+            logging.exception("Platega get_transaction request failed: id=%s", transaction_id)
+            return False, {"message": str(exc)}
+
+    async def try_reuse_pending_transaction(
+        self,
+        payment: Any,
+        *,
+        user_id: int,
+        sale_mode: str,
+        variant: str,
+    ) -> Optional[str]:
+        transaction_id = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        payment_url = str(getattr(payment, "provider_payment_url", None) or "").strip()
+        if not transaction_id or not payment_url:
+            return None
+
+        success, data = await self.get_transaction(transaction_id)
+        if not success or str(data.get("status") or "").upper() != "PENDING":
+            return None
+        if str(data.get("id") or "") != transaction_id:
+            return None
+
+        try:
+            payload = json.loads(str(data.get("payload") or ""))
+        except (TypeError, ValueError, json.JSONDecodeError):
+            return None
+        expected = {
+            "payment_db_id": str(payment.payment_id),
+            "user_id": str(user_id),
+            "sale_mode": str(sale_mode),
+            "platega_variant": str(variant),
+        }
+        if not isinstance(payload, dict) or any(
+            str(payload.get(key) or "") != value for key, value in expected.items()
+        ):
+            return None
+        return payment_url
+
     async def webhook_route(self, request: web.Request) -> web.Response:
         if not self.configured:
             return web.Response(status=503, text="platega_disabled")
@@ -482,13 +563,13 @@ async def pay_platega_callback_handler(
         user_id=callback.from_user.id,
         parts=parts,
         subscription_service=platega_service.subscription_service,
-        currency="rub",
+        currency=default_currency_key_for_settings(settings),
     )
     if not parts:
         await notify_callback_parse_error(callback, translator)
         return
 
-    currency_code = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+    currency_code = default_payment_currency_code_for_settings(settings)
     payment_description = describe_payment(translator, parts)
     record_payload = build_payment_record_payload(
         user_id=callback.from_user.id,
@@ -502,6 +583,43 @@ async def pay_platega_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="platega",
+        pending_status="pending_platega",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await platega_service.try_reuse_pending_transaction(
+            reusable_payment,
+            user_id=callback.from_user.id,
+            sale_mode=parts.sale_mode,
+            variant=platega_variant,
+        )
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -532,7 +650,6 @@ async def pay_platega_callback_handler(
     )
     transaction_id = first_value(response_data, "transactionId", "id")
     redirect_url = first_value(response_data, "redirect", "url", "paymentUrl")
-    provider_status = str((response_data or {}).get("status") or payment_record.status)
     # Platega requires *both* a transaction id and a redirect url to count as a
     # usable payment — neither field is sufficient on its own. Skipping the
     # persistence step when the redirect is missing matches the pre-refactor
@@ -549,7 +666,6 @@ async def pay_platega_callback_handler(
         api_success=success,
         payment_url=redirect_url,
         provider_payment_id=persistable_id,
-        new_status=provider_status if persistable_id else None,
         log_prefix=_LOG,
     )
 
@@ -592,11 +708,12 @@ async def _create_webapp_payment(ctx: WebAppPaymentContext, variant: str) -> web
             months=ctx.months,
             sale_mode=ctx.sale_mode,
             traffic_gb=ctx.traffic_gb,
+            hwid_device_count=ctx.hwid_device_count,
         )
         payment = await create_webapp_payment_record(
             ctx,
             amount=ctx.price,
-            currency=settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+            currency=ctx.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
             status="pending_platega",
             provider="platega",
         )
@@ -616,7 +733,7 @@ async def _create_webapp_payment(ctx: WebAppPaymentContext, variant: str) -> web
         )
         success, response_data = await service.create_transaction(
             amount=ctx.price,
-            currency=settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
+            currency=ctx.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB",
             description=ctx.description,
             payload=payload,
             payment_method=platega_method_id,
@@ -634,7 +751,6 @@ async def _create_webapp_payment(ctx: WebAppPaymentContext, variant: str) -> web
             first_value(response_data, "redirect", "url", "paymentUrl") if success else None
         ),
         provider_payment_id=first_value(response_data, "transactionId", "id"),
-        new_status=str((response_data or {}).get("status") or payment.status),
         log_prefix="Platega",
     )
 
@@ -647,6 +763,19 @@ async def create_crypto_webapp_payment(ctx: WebAppPaymentContext) -> web.Respons
     return await _create_webapp_payment(ctx, "platega_crypto")
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: PlategaService = ctx.request.app.get("platega_service")
+    if not service or not service.configured:
+        return None
+    variant = "crypto" if ctx.method == "platega_crypto" else "sbp"
+    return await service.try_reuse_pending_transaction(
+        payment,
+        user_id=ctx.user_id,
+        sale_mode=ctx.sale_mode,
+        variant=variant,
+    )
+
+
 def _platega_presentation_manifest(subsection: str, default_icon: str, prefix: str) -> tuple:
     return tuple(
         ProviderManifestField(
@@ -757,6 +886,18 @@ _CONFIG_MANIFEST = (
         subsection="Platega",
         attr="CRYPTO_METHOD",
     ),
+    ProviderManifestField(
+        "PLATEGA_SUPPORTED_CURRENCIES",
+        "string",
+        "Supported currencies",
+        description=(
+            "Comma-separated payment currencies enabled for your Platega merchant. "
+            "Public docs expose currency per method/limits but do not publish a fixed global list."
+        ),
+        placeholder="RUB",
+        subsection="Platega",
+        attr="SUPPORTED_CURRENCIES",
+    ),
     ProviderManifestField(
         "PLATEGA_RETURN_URL", "url", "Return URL", subsection="Platega", attr="RETURN_URL"
     ),
@@ -789,10 +930,17 @@ SBP_SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/platega",
     webhook_route=platega_webhook_route,
     create_webapp_payment=create_sbp_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=PlategaConfig,
     presentation_class=PlategaSbpPresentation,
     manifest_fields=_CONFIG_MANIFEST
     + _platega_presentation_manifest("Platega", "CreditCard", "PLATEGA_SBP"),
+    supported_currencies_resolver=lambda config: getattr(config, "SUPPORTED_CURRENCIES", "RUB"),
+    currency_support_note=(
+        "Platega currencies are merchant/method-specific; configure the codes "
+        "enabled for your account."
+    ),
+    currency_support_url="https://docs.platega.io/",
 )
 
 CRYPTO_SPEC = PaymentProviderSpec(
@@ -815,9 +963,16 @@ CRYPTO_SPEC = PaymentProviderSpec(
     service_key="platega_service",
     callback_prefix="pay_platega_crypto",
     create_webapp_payment=create_crypto_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=PlategaConfig,
     presentation_class=PlategaCryptoPresentation,
     manifest_fields=_platega_presentation_manifest("Platega", "Bitcoin", "PLATEGA_CRYPTO"),
+    supported_currencies_resolver=lambda config: getattr(config, "SUPPORTED_CURRENCIES", "RUB"),
+    currency_support_note=(
+        "Platega currencies are merchant/method-specific; configure the codes "
+        "enabled for your account."
+    ),
+    currency_support_url="https://docs.platega.io/",
 )
 
 SPECS = (SBP_SPEC, CRYPTO_SPEC)

backend/bot/payment_providers/registry.py

@@ -2,7 +2,18 @@ from __future__ import annotations
 
 from typing import Any, Dict, Iterable, List, Mapping, Optional
 
-from . import cryptopay, freekassa, heleket, platega, severpay, stars, wata, yookassa
+from . import (
+    cryptopay,
+    freekassa,
+    heleket,
+    lava,
+    paykilla,
+    platega,
+    severpay,
+    stars,
+    wata,
+    yookassa,
+)
 from .base import (
     PaymentProviderPresentation,
     PaymentProviderSpec,
@@ -21,6 +32,8 @@ PAYMENT_PROVIDER_SPECS: tuple[PaymentProviderSpec, ...] = (
     stars.SPEC,
     cryptopay.SPEC,
     heleket.SPEC,
+    paykilla.SPEC,
+    lava.SPEC,
 )
 
 

backend/bot/payment_providers/severpay.py

@@ -16,6 +16,10 @@ from bot.middlewares.i18n import JsonI18n
 from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal
 
 from .base import (
@@ -24,6 +28,8 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
+    parse_supported_currency_codes,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -45,11 +51,13 @@ from .shared import (
     notify_user_payment_failed,
     parse_payment_callback,
     payment_failed,
+    payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
     post_json_request,
     quote_hwid_callback_parts,
     render_link_or_fail,
+    render_payment_link,
 )
 
 _LOG = "severpay"
@@ -69,6 +77,7 @@ class SeverPayConfig(ProviderEnvConfig):
     RETURN_URL: Optional[str] = None
     BASE_URL: str = Field(default="https://severpay.io/api/merchant")
     LIFETIME_MINUTES: Optional[int] = None
+    SUPPORTED_CURRENCIES: str = Field(default="RUB,USD")
 
     @field_validator("MID", "LIFETIME_MINUTES", mode="before")
     @classmethod
@@ -129,7 +138,7 @@ class SeverPayService(HttpClientMixin):
         self.referral_service = referral_service
         self._default_return_url = default_return_url
 
-        self._init_http_client(total_timeout=15)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
 
         if not self.configured:
             logging.warning(
@@ -201,9 +210,19 @@ class SeverPayService(HttpClientMixin):
             logging.error("SeverPayService is not configured. Cannot create payment.")
             return False, {"message": "service_not_configured"}
 
+        currency_code = normalize_payment_currency_code(
+            currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+        )
+        supported = parse_supported_currency_codes(self.config.SUPPORTED_CURRENCIES)
+        if supported and currency_code not in supported:
+            return False, {
+                "message": "unsupported_currency",
+                "currency": currency_code,
+                "supported_currencies": list(supported),
+            }
+
         session = await self._get_session()
         url = f"{self.base_url}/payin/create"
-        currency_code = (currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper()
 
         body = {
             "order_id": str(payment_db_id),
@@ -231,6 +250,48 @@ class SeverPayService(HttpClientMixin):
             return True, response_data.get("data") or response_data
         return False, response_data
 
+    async def get_payment(self, provider_payment_id: str) -> Tuple[bool, Dict[str, Any]]:
+        if not self.configured:
+            return False, {"message": "service_not_configured"}
+
+        provider_payment_id = str(provider_payment_id or "").strip()
+        if not provider_payment_id:
+            return False, {"message": "missing_payment_id"}
+
+        identifier: Dict[str, Any]
+        if provider_payment_id.isdigit():
+            identifier = {"id": int(provider_payment_id)}
+        else:
+            identifier = {"uid": provider_payment_id}
+
+        session = await self._get_session()
+        success, response_data = await post_json_request(
+            session,
+            f"{self.base_url}/payin/get",
+            body=self._build_signed_body(identifier),
+            log_prefix="SeverPay get_payment",
+            is_success=lambda status, data: status == 200 and bool((data or {}).get("status")),
+        )
+        if success:
+            return True, response_data.get("data") or response_data
+        return False, response_data
+
+    async def try_reuse_pending_payment(self, payment: Any) -> Optional[str]:
+        provider_payment_id = str(getattr(payment, "provider_payment_id", None) or "").strip()
+        payment_url = str(getattr(payment, "provider_payment_url", None) or "").strip()
+        if not provider_payment_id or not payment_url:
+            return None
+
+        success, data = await self.get_payment(provider_payment_id)
+        if not success or str(data.get("status") or "").lower() not in {"new", "process"}:
+            return None
+        returned_ids = {str(data.get("id") or ""), str(data.get("uid") or "")}
+        if provider_payment_id not in returned_ids:
+            return None
+        if str(data.get("order_id") or "") != str(payment.payment_id):
+            return None
+        return payment_url
+
     async def webhook_route(self, request: web.Request) -> web.Response:
         if not self.configured:
             return web.json_response({"status": False, "msg": "severpay_disabled"}, status=503)
@@ -428,13 +489,13 @@ async def pay_severpay_callback_handler(
         user_id=callback.from_user.id,
         parts=parts,
         subscription_service=severpay_service.subscription_service,
-        currency="rub",
+        currency=default_currency_key_for_settings(settings),
     )
     if not parts:
         await notify_callback_parse_error(callback, translator)
         return
 
-    currency_code = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+    currency_code = default_payment_currency_code_for_settings(settings)
     payment_description = describe_payment(translator, parts)
     record_payload = build_payment_record_payload(
         user_id=callback.from_user.id,
@@ -448,6 +509,38 @@ async def pay_severpay_callback_handler(
         hwid_quote=hwid_quote,
     )
 
+    reuse_amounts = payment_record_amounts(
+        months=parts.months,
+        sale_mode=parts.sale_mode,
+        hwid_device_count=hwid_quote.get("device_count") if hwid_quote else None,
+    )
+    reusable_payment = await payment_dal.find_recent_pending_provider_payment(
+        session,
+        user_id=callback.from_user.id,
+        provider="severpay",
+        pending_status="pending_severpay",
+        amount=parts.price,
+        currency=currency_code,
+        sale_mode=parts.sale_mode,
+        months=reuse_amounts.months,
+        purchased_gb=reuse_amounts.purchased_gb,
+        purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
+        tariff_key=reuse_amounts.tariff_key,
+    )
+    if reusable_payment is not None:
+        reusable_url = await severpay_service.try_reuse_pending_payment(reusable_payment)
+        if reusable_url:
+            await render_payment_link(
+                callback,
+                translator=translator,
+                current_lang=current_lang,
+                i18n=i18n,
+                parts=parts,
+                payment_url=reusable_url,
+                log_prefix=_LOG,
+            )
+            return
+
     try:
         payment_record = await payment_dal.create_payment_record(session, record_payload)
         await session.commit()
@@ -503,7 +596,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     if not service or not service.configured:
         return payment_unavailable()
 
-    currency = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+    currency = ctx.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
     try:
         payment = await create_webapp_payment_record(
             ctx,
@@ -535,6 +628,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: SeverPayService = ctx.request.app.get("severpay_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_payment(payment)
+
+
 _PRESENTATION_MANIFEST = tuple(
     ProviderManifestField(
         key=key,
@@ -627,6 +727,18 @@ _CONFIG_MANIFEST = (
         max=4320,
         attr="LIFETIME_MINUTES",
     ),
+    ProviderManifestField(
+        "SEVERPAY_SUPPORTED_CURRENCIES",
+        "string",
+        "Supported currencies",
+        description=(
+            "Comma-separated currencies enabled for your SeverPay merchant. "
+            "The public PayIn docs show USD examples but do not publish a fixed global list."
+        ),
+        placeholder="RUB,USD",
+        subsection="SeverPay",
+        attr="SUPPORTED_CURRENCIES",
+    ),
 )
 
 
@@ -648,7 +760,13 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/severpay",
     webhook_route=severpay_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=SeverPayConfig,
     presentation_class=SeverPayPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies_resolver=lambda config: getattr(config, "SUPPORTED_CURRENCIES", "RUB,USD"),
+    currency_support_note=(
+        "SeverPay PayIn requires a currency; keep this list aligned with your merchant account."
+    ),
+    currency_support_url="https://docs.severpay.io/ru/payin/create",
 )

backend/bot/payment_providers/shared/__init__.py

@@ -42,6 +42,7 @@ from .common import (
     payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
+    reusable_webapp_payment_response,
     sale_mode_base,
     sale_mode_is_hwid_devices,
     sale_mode_is_traffic,
@@ -117,6 +118,7 @@ __all__ = [
     "payment_link_message_text",
     "payment_link_response",
     "payment_record_amounts",
+    "reusable_webapp_payment_response",
     "payment_units_for_activation",
     "payment_unavailable",
     "post_json_request",

backend/bot/payment_providers/shared/callbacks.py

@@ -8,8 +8,10 @@ from aiogram import types
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from bot.keyboards.inline.user_keyboards import (
+    HWID_RENEWAL_TOKEN,
     get_payment_url_keyboard,
     payment_methods_back_callback,
+    sale_mode_has_token,
 )
 from bot.middlewares.i18n import JsonI18n
 from db.dal import payment_dal
@@ -123,6 +125,27 @@ async def quote_hwid_callback_parts(
     subscription_service,
     currency: str = "rub",
 ) -> tuple[Optional[PaymentCallbackParts], Optional[dict]]:
+    base = sale_mode_base(parts.sale_mode)
+    if base == "subscription" and sale_mode_has_token(parts.sale_mode, HWID_RENEWAL_TOKEN):
+        try:
+            months = int(parts.months)
+        except (TypeError, ValueError):
+            return None, None
+        quote = await subscription_service.quote_hwid_device_renewal_for_subscription(
+            session,
+            user_id=user_id,
+            target_tariff_key=sale_mode_tariff_key(parts.sale_mode),
+            months=months,
+            currency=currency,
+        )
+        if not quote:
+            return parts, None
+        quoted_parts = PaymentCallbackParts(
+            months=months,
+            price=float(parts.price or 0) + float(quote.get("price") or 0),
+            sale_mode=parts.sale_mode,
+        )
+        return quoted_parts, quote
     if not sale_mode_is_hwid_devices(parts.sale_mode):
         return parts, None
     device_count = parse_positive_int_units(parts.months)
@@ -262,6 +285,7 @@ async def safe_store_provider_payment_id(
     payment: Payment,
     *,
     provider_payment_id: str,
+    provider_payment_url: Optional[str] = None,
     new_status: Optional[str] = None,
     log_prefix: str,
 ) -> bool:
@@ -277,6 +301,7 @@ async def safe_store_provider_payment_id(
             payment.payment_id,
             str(provider_payment_id),
             new_status or payment.status,
+            provider_payment_url=provider_payment_url,
         )
         await session.commit()
         return True
@@ -331,11 +356,12 @@ async def render_link_or_fail(
     payment as ``failed_creation``. Every link-style provider used to inline
     this same sequence.
     """
-    if api_success and provider_payment_id:
+    if api_success and provider_payment_id and payment_url:
         await safe_store_provider_payment_id(
             session,
             payment,
             provider_payment_id=provider_payment_id,
+            provider_payment_url=payment_url,
             new_status=new_status,
             log_prefix=log_prefix,
         )

backend/bot/payment_providers/shared/common.py

@@ -100,6 +100,11 @@ def build_payment_record_payload(
     base = sale_mode_base(sale_mode)
     is_traffic = sale_mode_is_traffic(sale_mode)
     is_hwid = sale_mode_is_hwid_devices(sale_mode)
+    hwid_devices = int(float(months)) if is_hwid else None
+    if hwid_quote:
+        quote_devices = parse_positive_int_units(hwid_quote.get("device_count"))
+        if quote_devices is not None:
+            hwid_devices = quote_devices
     payload = {
         "user_id": user_id,
         "amount": amount,
@@ -111,9 +116,9 @@ def build_payment_record_payload(
         "sale_mode": sale_mode,
         "tariff_key": sale_mode_tariff_key(sale_mode),
         "purchased_gb": float(months) if is_traffic else None,
-        "purchased_hwid_devices": int(float(months)) if is_hwid else None,
+        "purchased_hwid_devices": hwid_devices,
     }
-    if hwid_quote and is_hwid:
+    if hwid_quote and hwid_devices is not None:
         payload.update(
             {
                 "hwid_valid_from": hwid_quote.get("valid_from"),
@@ -164,14 +169,20 @@ def payment_record_amounts(
     months: Any,
     sale_mode: str,
     traffic_gb: Optional[float] = None,
+    hwid_device_count: Optional[int] = None,
 ) -> PaymentRecordAmounts:
     traffic_sale = sale_mode_is_traffic(sale_mode)
     hwid_devices_sale = sale_mode_is_hwid_devices(sale_mode)
     units = traffic_gb if traffic_sale and traffic_gb is not None else months
+    purchased_hwid_devices = int(float(months)) if hwid_devices_sale else None
+    if not hwid_devices_sale and hwid_device_count is not None:
+        parsed_hwid_devices = parse_positive_int_units(hwid_device_count)
+        if parsed_hwid_devices is not None:
+            purchased_hwid_devices = parsed_hwid_devices
     return PaymentRecordAmounts(
         months=int(float(units)) if traffic_sale else int(float(months)),
         purchased_gb=float(units) if traffic_sale else None,
-        purchased_hwid_devices=int(float(months)) if hwid_devices_sale else None,
+        purchased_hwid_devices=purchased_hwid_devices,
         tariff_key=sale_mode_tariff_key(sale_mode),
         traffic_sale=traffic_sale,
         hwid_devices_sale=hwid_devices_sale,
@@ -281,6 +292,7 @@ async def create_webapp_payment_record(
         months=ctx.months,
         sale_mode=ctx.sale_mode,
         traffic_gb=ctx.traffic_gb,
+        hwid_device_count=ctx.hwid_device_count,
     )
     return await create_base_payment_record(
         ctx.session,
@@ -303,6 +315,45 @@ async def create_webapp_payment_record(
     )
 
 
+async def reusable_webapp_payment_response(
+    ctx: WebAppPaymentContext,
+    provider_spec: Any,
+    *,
+    since_minutes: Optional[int] = None,
+) -> Optional[web.Response]:
+    resolver = getattr(provider_spec, "reuse_webapp_payment", None)
+    if resolver is None:
+        return None
+
+    amounts = payment_record_amounts(
+        months=ctx.months,
+        sale_mode=ctx.sale_mode,
+        traffic_gb=ctx.traffic_gb,
+        hwid_device_count=ctx.hwid_device_count,
+    )
+    payment = await payment_dal.find_recent_pending_provider_payment(
+        ctx.session,
+        user_id=ctx.user_id,
+        provider=provider_spec.provider_key,
+        pending_status=provider_spec.pending_status,
+        amount=ctx.price,
+        currency=ctx.currency,
+        sale_mode=ctx.sale_mode,
+        months=amounts.months,
+        purchased_gb=amounts.purchased_gb,
+        purchased_hwid_devices=amounts.purchased_hwid_devices,
+        tariff_key=amounts.tariff_key,
+        since_minutes=since_minutes,
+    )
+    if payment is None:
+        return None
+
+    payment_url = await resolver(ctx, payment)
+    if not payment_url:
+        return None
+    return payment_link_response(payment_url=payment_url, payment_id=payment.payment_id)
+
+
 async def mark_payment_failed_creation(session: AsyncSession, payment_id: int) -> None:
     await payment_dal.update_payment_status_by_db_id(session, payment_id, "failed_creation")
     await session.commit()

backend/bot/payment_providers/shared/http_client.py

@@ -1,12 +1,16 @@
 from __future__ import annotations
 
+import asyncio
 import json
 import logging
-from typing import Any, Callable, Dict, Mapping, Optional, Tuple
+from typing import Any, Callable, Dict, List, Mapping, Optional, Set, Tuple, Union
 
-from aiohttp import ClientSession, ClientTimeout
+from aiohttp import ClientError, ClientSession, ClientTimeout, TraceConfig
 
 SuccessCheck = Callable[[int, Any], bool]
+TimeoutSource = Union[float, Callable[[], float]]
+_TRANSPORT_ATTEMPTS = 2
+_DEFAULT_TIMEOUT_SECONDS = 20.0
 
 
 def http_ok(status: int, _body: Any) -> bool:
@@ -14,6 +18,29 @@ def http_ok(status: int, _body: Any) -> bool:
     return status == 200
 
 
+def _trace_request_ctx(trace_config_ctx: Any) -> Optional[dict]:
+    ctx = getattr(trace_config_ctx, "trace_request_ctx", None)
+    return ctx if isinstance(ctx, dict) else None
+
+
+async def _mark_request_headers_sent(session, trace_config_ctx, params) -> None:
+    ctx = _trace_request_ctx(trace_config_ctx)
+    if ctx is not None:
+        ctx["headers_sent"] = True
+
+
+def _payment_trace_config() -> TraceConfig:
+    trace_config = TraceConfig()
+    trace_config.on_request_headers_sent.append(_mark_request_headers_sent)
+    return trace_config
+
+
+def _should_retry_transport_error(exc: Exception, trace_ctx: Mapping[str, Any]) -> bool:
+    if trace_ctx.get("headers_sent"):
+        return False
+    return isinstance(exc, (asyncio.TimeoutError, ClientError, OSError))
+
+
 async def post_json_request(
     session: ClientSession,
     url: str,
@@ -29,34 +56,47 @@ async def post_json_request(
     returns ``(False, {"status": ..., "message": ..., "raw": ...?})`` so callers
     can decide what to do (typically: mark the payment as ``failed_creation``).
     """
-    try:
-        async with session.post(
-            url,
-            json=body,
-            headers=dict(headers) if headers else None,
-        ) as response:
-            response_text = await response.text()
-            try:
-                response_data = json.loads(response_text) if response_text else {}
-            except json.JSONDecodeError:
-                logging.error("%s: invalid JSON response: %s", log_prefix, response_text)
-                return False, {
-                    "status": response.status,
-                    "message": "invalid_json",
-                    "raw": response_text,
-                }
-            if not is_success(response.status, response_data):
-                logging.error(
-                    "%s: API returned error (status=%s, body=%s)",
+    for attempt in range(1, _TRANSPORT_ATTEMPTS + 1):
+        trace_ctx: dict[str, Any] = {"headers_sent": False}
+        try:
+            async with session.post(
+                url,
+                json=body,
+                headers=dict(headers) if headers else None,
+                trace_request_ctx=trace_ctx,
+            ) as response:
+                response_text = await response.text()
+                try:
+                    response_data = json.loads(response_text) if response_text else {}
+                except json.JSONDecodeError:
+                    logging.error("%s: invalid JSON response: %s", log_prefix, response_text)
+                    return False, {
+                        "status": response.status,
+                        "message": "invalid_json",
+                        "raw": response_text,
+                    }
+                if not is_success(response.status, response_data):
+                    logging.error(
+                        "%s: API returned error (status=%s, body=%s)",
+                        log_prefix,
+                        response.status,
+                        response_data,
+                    )
+                    return False, {"status": response.status, "message": response_data}
+                return True, response_data
+        except Exception as exc:
+            if attempt < _TRANSPORT_ATTEMPTS and _should_retry_transport_error(exc, trace_ctx):
+                logging.warning(
+                    "%s: transport failed before request headers were sent; retrying (%s/%s): %s",  # noqa: E501
                     log_prefix,
-                    response.status,
-                    response_data,
+                    attempt + 1,
+                    _TRANSPORT_ATTEMPTS,
+                    exc,
                 )
-                return False, {"status": response.status, "message": response_data}
-            return True, response_data
-    except Exception as exc:
-        logging.exception("%s: request failed.", log_prefix)
-        return False, {"message": str(exc)}
+                continue
+            logging.exception("%s: request failed.", log_prefix)
+            return False, {"message": str(exc)}
+    return False, {"message": "request_failed"}
 
 
 def first_value(data: Optional[Mapping[str, Any]], *keys: str) -> Optional[str]:
@@ -76,20 +116,69 @@ class HttpClientMixin:
     Each subclass calls ``self._init_http_client(total_timeout=...)`` from
     ``__init__`` and inherits ``_get_session`` / ``close``. The session is
     created on first use and recreated transparently if it was closed.
+
+    ``total_timeout`` may be a callable so the timeout follows runtime
+    settings changes (admin overrides apply in-process without a restart).
+    When the value changes, the next request gets a fresh session; the old
+    session stays open until its own in-flight requests cannot outlive it.
+
+    Provider API calls are traced so callers can retry transport failures only
+    when aiohttp has not sent request headers yet.
     """
 
-    _timeout: ClientTimeout
+    _timeout_source: TimeoutSource
     _session: Optional[ClientSession]
+    _stale_sessions: List[ClientSession]
+    _session_cleanup_tasks: Set["asyncio.Task[None]"]
 
-    def _init_http_client(self, *, total_timeout: float = 20.0) -> None:
-        self._timeout = ClientTimeout(total=total_timeout)
+    def _init_http_client(self, *, total_timeout: TimeoutSource = _DEFAULT_TIMEOUT_SECONDS) -> None:
+        self._timeout_source = total_timeout
         self._session = None
+        self._stale_sessions = []
+        self._session_cleanup_tasks = set()
+
+    def _current_timeout_seconds(self) -> float:
+        source = self._timeout_source
+        try:
+            seconds = float(source() if callable(source) else source)
+        except Exception:
+            return _DEFAULT_TIMEOUT_SECONDS
+        return seconds if seconds > 0 else _DEFAULT_TIMEOUT_SECONDS
 
     async def _get_session(self) -> ClientSession:
-        if self._session is None or self._session.closed:
-            self._session = ClientSession(timeout=self._timeout)
-        return self._session
+        timeout_seconds = self._current_timeout_seconds()
+        session = self._session
+        if session is not None and not session.closed and session.timeout.total != timeout_seconds:
+            self._session = None
+            self._stale_sessions.append(session)
+            task = asyncio.create_task(self._close_stale_session(session))
+            self._session_cleanup_tasks.add(task)
+            task.add_done_callback(self._session_cleanup_tasks.discard)
+            session = None
+        if session is None or session.closed:
+            session = ClientSession(
+                timeout=ClientTimeout(total=timeout_seconds),
+                trace_configs=[_payment_trace_config()],
+            )
+            self._session = session
+        return session
+
+    async def _close_stale_session(self, session: ClientSession) -> None:
+        # Any request started on this session is bound by its total timeout,
+        # so after that long it is safe to close without cutting one off.
+        await asyncio.sleep((session.timeout.total or _DEFAULT_TIMEOUT_SECONDS) + 1.0)
+        if session in self._stale_sessions:
+            self._stale_sessions.remove(session)
+        if not session.closed:
+            await session.close()
 
     async def close(self) -> None:
-        if self._session and not self._session.closed:
-            await self._session.close()
+        for task in list(self._session_cleanup_tasks):
+            task.cancel()
+        self._session_cleanup_tasks.clear()
+        sessions = [self._session, *self._stale_sessions]
+        self._session = None
+        self._stale_sessions = []
+        for session in sessions:
+            if session and not session.closed:
+                await session.close()

backend/bot/payment_providers/shared/success.py

@@ -156,6 +156,28 @@ def append_hwid_renewal_note(
     return f"{text}\n\n{note}"
 
 
+def append_hwid_renewed_note(
+    text: str,
+    translator: Translator,
+    *,
+    count: Any,
+    valid_until: Optional[datetime],
+) -> str:
+    try:
+        count_int = int(count or 0)
+    except (TypeError, ValueError):
+        count_int = 0
+    if count_int <= 0:
+        return text
+    date_text = valid_until.strftime("%Y-%m-%d") if valid_until else ""
+    note = translator(
+        "payment_successful_hwid_devices_renewed_note",
+        count=format_human_units(count_int),
+        date=date_text,
+    )
+    return f"{text}\n\n{note}"
+
+
 async def send_success_message_to_user(
     *,
     bot: Bot,
@@ -320,8 +342,37 @@ async def finalize_successful_payment(
             req.log_prefix,
             req.payment.payment_id,
         )
+        try:
+            await payment_dal.update_payment_status_by_db_id(
+                req.session,
+                req.payment.payment_id,
+                "activation_failed",
+            )
+            await req.session.commit()
+        except Exception:
+            await req.session.rollback()
+            logging.exception(
+                "%s: failed to mark payment %s activation_failed.",
+                req.log_prefix,
+                req.payment.payment_id,
+            )
         return None
 
+    try:
+        from bot.app.web.webapp.cache_helpers import invalidate_webapp_user_caches
+
+        await invalidate_webapp_user_caches(
+            req.settings,
+            req.user_id,
+            include_devices=True,
+        )
+    except Exception:
+        logging.exception(
+            "%s: failed to invalidate webapp caches for user %s.",
+            req.log_prefix,
+            req.user_id,
+        )
+
     db_user, language = await resolve_user_language(
         req.session,
         user_id=req.user_id,
@@ -363,12 +414,20 @@ async def finalize_successful_payment(
         )
     )
     if is_subscription and activation:
-        success_text = append_hwid_renewal_note(
-            success_text,
-            translator,
-            count=activation.get("hwid_devices_renewal_recommended_count"),
-            valid_until=activation.get("hwid_devices_valid_until"),
-        )
+        if activation.get("hwid_devices_renewed_count"):
+            success_text = append_hwid_renewed_note(
+                success_text,
+                translator,
+                count=activation.get("hwid_devices_renewed_count"),
+                valid_until=final_end_date or activation.get("hwid_devices_renewed_until"),
+            )
+        else:
+            success_text = append_hwid_renewal_note(
+                success_text,
+                translator,
+                count=activation.get("hwid_devices_renewal_recommended_count"),
+                valid_until=activation.get("hwid_devices_valid_until"),
+            )
     if req.text_prefix:
         success_text = f"{req.text_prefix}\n{success_text}"
 

backend/bot/payment_providers/shared/webapp.py

@@ -39,13 +39,16 @@ async def finalize_webapp_link_payment(
             log_prefix="Wata",
         )
     """
-    if api_success and provider_payment_id:
+    # Reuse logic needs both a provider id and a redirect URL; persisting only
+    # the id creates orphan records that match find_recent but fail verification.
+    if api_success and provider_payment_id and payment_url:
         try:
             await payment_dal.update_provider_payment_and_status(
                 session,
                 payment.payment_id,
                 str(provider_payment_id),
                 new_status or payment.status,
+                provider_payment_url=payment_url,
             )
             await session.commit()
         except Exception:

backend/bot/payment_providers/shared/webhooks.py

@@ -51,7 +51,7 @@ async def notify_user_payment_failed(
     message_key: str = "payment_failed",
 ) -> None:
     """Send the localized ``payment_failed`` text to the user; never raises."""
-    db_user = payment.user or await user_dal.get_user_by_id(session, payment.user_id)
+    db_user = await user_dal.get_user_by_id(session, payment.user_id)
     language = (
         db_user.language_code if db_user and db_user.language_code else settings.DEFAULT_LANGUAGE
     )

backend/bot/payment_providers/stars.py

@@ -344,6 +344,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
             months=ctx.months,
             sale_mode=ctx.sale_mode,
             traffic_gb=ctx.traffic_gb,
+            hwid_device_count=ctx.hwid_device_count,
         )
         payment = await create_webapp_payment_record(
             ctx,
@@ -484,4 +485,6 @@ SPEC = PaymentProviderSpec(
     telegram_emoji="⭐",
     presentation_class=StarsPresentation,
     manifest_fields=_PRESENTATION_MANIFEST,
+    supported_currencies=("XTR",),
+    currency_support_note="Telegram Stars use Telegram's XTR currency and separate Stars prices.",
 )

backend/bot/payment_providers/wata.py

@@ -19,6 +19,10 @@ from bot.services.referral_service import ReferralService
 from bot.services.subscription_service import SubscriptionService
 from bot.utils.request_security import ip_in_allowlist, request_client_ip
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal
 
 from .base import (
@@ -27,6 +31,7 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -49,7 +54,6 @@ from .shared import (
     notify_user_payment_failed,
     parse_payment_callback,
     payment_failed,
-    payment_link_response,
     payment_record_amounts,
     payment_unavailable,
     payment_units_for_activation,
@@ -58,11 +62,11 @@ from .shared import (
     render_link_or_fail,
     render_payment_link,
     safe_callback_answer,
-    sale_mode_base,
 )
 
 router = Router(name="user_subscription_payments_wata_router")
 _LOG = "wata"
+WATA_SUPPORTED_CURRENCIES = ("RUB", "USD", "EUR")
 _WATA_IN_PROGRESS_STATUSES = {"created", "pending"}
 _WATA_LINK_OPENED_STATUSES = {"opened", "open"}
 _WATA_LINK_DEFAULT_TTL_MINUTES = 15
@@ -200,7 +204,7 @@ class WataService(HttpClientMixin):
         self._default_return_url = default_return_url
         self._cached_public_key_pem = None  # populated by webhook on first verify
 
-        self._init_http_client(total_timeout=10)
+        self._init_http_client(total_timeout=lambda: self.settings.PAYMENT_REQUEST_TIMEOUT_SECONDS)
         if not self.configured:
             logging.warning("WataService initialized but not fully configured. Payments disabled.")
 
@@ -258,13 +262,23 @@ class WataService(HttpClientMixin):
             logging.error("WataService is not configured. Cannot create payment link.")
             return False, {"message": "service_not_configured"}
 
+        currency_code = normalize_payment_currency_code(
+            currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+        )
+        if currency_code not in WATA_SUPPORTED_CURRENCIES:
+            return False, {
+                "message": "unsupported_currency",
+                "currency": currency_code,
+                "supported_currencies": list(WATA_SUPPORTED_CURRENCIES),
+            }
+
         session = await self._get_session()
         expires_at = (
             datetime.now(timezone.utc) + timedelta(minutes=self.payment_link_ttl_minutes)
         ).replace(microsecond=0)
         body: Dict[str, Any] = {
             "amount": float(format_decimal_amount(amount)),
-            "currency": (currency or self.settings.DEFAULT_CURRENCY_SYMBOL or "RUB").upper(),
+            "currency": currency_code,
             "description": description,
             "orderId": str(payment_db_id),
             "successRedirectUrl": self.return_url,
@@ -345,6 +359,19 @@ class WataService(HttpClientMixin):
         if not success or not isinstance(data, dict):
             return None
 
+        returned_ids = {
+            str(data.get("id") or "").strip(),
+            str(data.get("paymentLinkId") or "").strip(),
+            str(data.get("payment_link_id") or "").strip(),
+        }
+        returned_ids.discard("")
+        if returned_ids and provider_payment_id not in returned_ids:
+            return None
+
+        order_id = first_value(data, "orderId", "order_id")
+        if order_id is not None and str(order_id) != str(payment.payment_id):
+            return None
+
         status = _normalized_wata_status(data) or str(data.get("status") or "").strip().lower()
         if status and status not in _WATA_LINK_OPENED_STATUSES:
             return None
@@ -863,27 +890,25 @@ async def pay_wata_callback_handler(
         user_id=callback.from_user.id,
         parts=parts,
         subscription_service=wata_service.subscription_service,
-        currency="rub",
+        currency=default_currency_key_for_settings(settings),
     )
     if not parts:
         await notify_callback_parse_error(callback, translator)
         return
 
-    currency_code = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
+    currency_code = default_payment_currency_code_for_settings(settings)
     payment_description = describe_payment(translator, parts)
 
     reuse_amounts = payment_record_amounts(months=parts.months, sale_mode=parts.sale_mode)
-    months_for_lookup = (
-        reuse_amounts.months if sale_mode_base(parts.sale_mode) == "subscription" else None
-    )
     reusable_payment = await payment_dal.find_recent_pending_provider_payment(
         session,
         user_id=callback.from_user.id,
         provider="wata",
         pending_status="pending_wata",
         amount=parts.price,
+        currency=currency_code,
         sale_mode=parts.sale_mode,
-        months=months_for_lookup,
+        months=reuse_amounts.months,
         purchased_gb=reuse_amounts.purchased_gb,
         purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
         tariff_key=reuse_amounts.tariff_key,
@@ -956,45 +981,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     if not service or not service.configured:
         return payment_unavailable()
 
-    currency = settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
-
-    reuse_amounts = payment_record_amounts(
-        months=ctx.months,
-        sale_mode=ctx.sale_mode,
-        traffic_gb=ctx.traffic_gb,
-    )
-    months_for_lookup = (
-        reuse_amounts.months if sale_mode_base(ctx.sale_mode) == "subscription" else None
-    )
-    try:
-        reusable_payment = await payment_dal.find_recent_pending_provider_payment(
-            ctx.session,
-            user_id=ctx.user_id,
-            provider="wata",
-            pending_status="pending_wata",
-            amount=ctx.price,
-            sale_mode=ctx.sale_mode,
-            months=months_for_lookup,
-            purchased_gb=reuse_amounts.purchased_gb,
-            purchased_hwid_devices=reuse_amounts.purchased_hwid_devices,
-            tariff_key=reuse_amounts.tariff_key,
-            since_minutes=service.payment_link_ttl_minutes,
-        )
-    except Exception:
-        logging.exception("Wata WebApp: lookup of reusable payment failed")
-        reusable_payment = None
-
-    if reusable_payment is not None:
-        try:
-            reusable_url = await service.try_reuse_pending_link(reusable_payment)
-        except Exception:
-            logging.exception("Wata WebApp: failed to verify reusable link")
-            reusable_url = None
-        if reusable_url:
-            return payment_link_response(
-                payment_url=reusable_url,
-                payment_id=reusable_payment.payment_id,
-            )
+    currency = ctx.currency or settings.DEFAULT_CURRENCY_SYMBOL or "RUB"
 
     try:
         payment = await create_webapp_payment_record(
@@ -1027,6 +1014,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     )
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: WataService = ctx.request.app.get("wata_service")
+    if not service or not service.configured:
+        return None
+    return await service.try_reuse_pending_link(payment)
+
+
 async def wata_webhook_route(request: web.Request) -> web.Response:
     service: WataService = request.app["wata_service"]
     return await service.webhook_route(request)
@@ -1187,7 +1181,13 @@ SPEC = PaymentProviderSpec(
     webhook_path=lambda source: "/webhook/wata",
     webhook_route=wata_webhook_route,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=WataConfig,
     presentation_class=WataPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies=WATA_SUPPORTED_CURRENCIES,
+    currency_support_note=(
+        "WATA H2H payment links and widget document RUB, USD and EUR as payment currencies."
+    ),
+    currency_support_url="https://wata.pro/api",
 )

backend/bot/payment_providers/yookassa.py

@@ -40,6 +40,10 @@ from bot.utils.config_link import prepare_config_links
 from bot.utils.install_links import ensure_user_install_guide_links
 from bot.utils.request_security import ip_in_allowlist, request_client_ip
 from config.settings import Settings
+from config.tariffs_config import (
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import payment_dal, user_billing_dal, user_dal
 from db.models import Payment
 
@@ -49,6 +53,7 @@ from .base import (
     ProviderManifestField,
     ServiceFactoryContext,
     WebAppPaymentContext,
+    normalize_payment_currency_code,
     provider_env_file,
     provider_runtime_enabled,
 )
@@ -234,6 +239,11 @@ class YooKassaService:
                 "internal_message": "Service settings (Settings object) not initialized.",
             }
 
+        currency = normalize_payment_currency_code(currency)
+        if currency != "RUB":
+            logging.error("YooKassa currency %s is not supported by this integration", currency)
+            return None
+
         customer_contact_for_receipt = {}
         if receipt_email:
             customer_contact_for_receipt["email"] = receipt_email
@@ -372,6 +382,10 @@ class YooKassaService:
                         "title": pm_title,
                         "card_last4": last4_val,
                     }
+                confirmation = getattr(payment_info_yk, "confirmation", None)
+                confirmation_url = (
+                    getattr(confirmation, "confirmation_url", None) if confirmation else None
+                )
                 return {
                     "id": payment_info_yk.id,
                     "status": payment_info_yk.status,
@@ -389,6 +403,7 @@ class YooKassaService:
                     and hasattr(payment_info_yk.captured_at, "isoformat")
                     else None,
                     "payment_method": pm_payload,
+                    "confirmation_url": confirmation_url,
                     "test_mode": getattr(payment_info_yk, "test", None),
                 }
             else:
@@ -438,6 +453,36 @@ def _metadata_value_present(value: Optional[Any]) -> bool:
     return value is not None and str(value).strip() != ""
 
 
+def _metadata_int(value: Optional[Any]) -> Optional[int]:
+    if not _metadata_value_present(value):
+        return None
+    try:
+        return int(float(str(value).strip()))
+    except (TypeError, ValueError):
+        return None
+
+
+def _metadata_float(value: Optional[Any]) -> Optional[float]:
+    if not _metadata_value_present(value):
+        return None
+    try:
+        return float(str(value).strip())
+    except (TypeError, ValueError):
+        return None
+
+
+def _metadata_datetime(value: Optional[Any]) -> Optional[datetime]:
+    if not _metadata_value_present(value):
+        return None
+    try:
+        parsed = datetime.fromisoformat(str(value).strip().replace("Z", "+00:00"))
+    except (TypeError, ValueError):
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed
+
+
 def _resolve_yookassa_activation_amounts(
     *,
     sale_mode_base: str,
@@ -549,6 +594,11 @@ async def process_successful_payment(
         months_for_record = int(subscription_months) if sale_mode_base == "subscription" else 0
         payment_value = float(amount_data.get("value", 0.0))
         yk_payment_id_from_hook = payment_info_from_webhook.get("id")
+        hwid_valid_from = _metadata_datetime(metadata.get("hwid_valid_from"))
+        hwid_valid_until = _metadata_datetime(metadata.get("hwid_valid_until"))
+        hwid_pricing_period_months = _metadata_int(metadata.get("hwid_pricing_period_months"))
+        hwid_proration_ratio = _metadata_float(metadata.get("hwid_proration_ratio"))
+        hwid_full_price = _metadata_float(metadata.get("hwid_full_price"))
 
         if _is_hwid_device_sale_base(sale_mode_base) and hwid_devices_count <= 0:
             logging.error(
@@ -564,6 +614,19 @@ async def process_successful_payment(
                     yk_payment_id_from_hook,
                 )
             return
+        if sale_mode_base == "subscription" and hwid_devices_count > 0:
+            if (
+                not hwid_valid_from
+                or not hwid_valid_until
+                or hwid_valid_from >= hwid_valid_until
+                or hwid_full_price is None
+            ):
+                logging.error(
+                    "YooKassa subscription+HWID payment %s has invalid HWID metadata: %s",
+                    yk_payment_id_from_hook,
+                    metadata,
+                )
+                return
 
         payment_record = None
         # If this is an auto-renewal (no payment_db_id in metadata), ensure a payment record exists
@@ -590,6 +653,16 @@ async def process_successful_payment(
                         or f"Auto-renewal for {months_for_record or subscription_months} months",
                         provider="yookassa",
                         provider_payment_id=yk_payment_id_from_hook,
+                        sale_mode=sale_mode,
+                        tariff_key=_sale_mode_tariff_key(sale_mode),
+                        purchased_hwid_devices=(
+                            hwid_devices_count if hwid_devices_count > 0 else None
+                        ),
+                        hwid_valid_from=hwid_valid_from,
+                        hwid_valid_until=hwid_valid_until,
+                        hwid_pricing_period_months=hwid_pricing_period_months,
+                        hwid_proration_ratio=hwid_proration_ratio,
+                        hwid_full_price=hwid_full_price,
                     )
                 payment_db_id = payment_record.payment_id
             except Exception as e_ensure:
@@ -885,7 +958,10 @@ async def process_successful_payment(
             i18n=i18n,
             user_id=user_id,
             amount=payment_value,
-            currency=settings.DEFAULT_CURRENCY_SYMBOL,
+            currency=amount_data.get(
+                "currency",
+                default_payment_currency_code_for_settings(settings),
+            ),
             months_for_admin=int(subscription_months) if sale_mode_base == "subscription" else 0,
             traffic_gb_for_admin=(
                 traffic_amount_gb if is_traffic_sale_base(sale_mode_base) else None
@@ -1302,6 +1378,36 @@ def _parse_offer_payload(payload: str) -> Optional[Tuple[float, float, str]]:
         return None
 
 
+def _parse_saved_list_payload(payload: str) -> Optional[Tuple[float, float, int, str]]:
+    parts = payload.split(":")
+    if len(parts) < 2:
+        return None
+    try:
+        months = float(parts[0])
+        price = float(parts[1])
+    except (ValueError, IndexError):
+        return None
+
+    page = 0
+    sale_mode = "subscription"
+    if len(parts) > 2:
+        try:
+            page = int(parts[2])
+            sale_mode = parts[3] if len(parts) > 3 else "subscription"
+        except ValueError:
+            sale_mode = parts[2]
+    return months, price, page, sale_mode
+
+
+def _metadata_iso(value: Any) -> Optional[str]:
+    if value is None:
+        return None
+    if hasattr(value, "isoformat"):
+        return value.isoformat()
+    text = str(value).strip()
+    return text or None
+
+
 def _format_saved_payment_method_title(
     get_text, network: Optional[str], last4: Optional[str], is_default: bool
 ) -> str:
@@ -1350,6 +1456,9 @@ async def _initiate_yk_payment(
         return False
 
     sale_base = _sale_mode_base(sale_mode)
+    hwid_device_count = None
+    if hwid_quote:
+        hwid_device_count = parse_positive_int_units(hwid_quote.get("device_count"))
     payment_description = (
         get_text("payment_description_traffic", traffic_gb=_format_value(months))
         if sale_base in {"traffic", "traffic_package", "topup", "premium_topup"}
@@ -1366,12 +1475,14 @@ async def _initiate_yk_payment(
         "status": "pending_yookassa",
         "description": payment_description,
         "subscription_duration_months": int(months) if sale_base == "subscription" else None,
-        "sale_mode": sale_base,
+        "sale_mode": sale_mode,
         "tariff_key": sale_mode.split("@", 1)[1].split("|", 1)[0] if "@" in sale_mode else None,
         "purchased_gb": float(months)
         if sale_base in {"traffic", "traffic_package", "topup", "premium_topup"}
         else None,
-        "purchased_hwid_devices": int(months) if sale_base in HWID_DEVICE_SALE_BASES else None,
+        "purchased_hwid_devices": (
+            int(months) if sale_base in HWID_DEVICE_SALE_BASES else hwid_device_count
+        ),
         "hwid_valid_from": hwid_quote.get("valid_from") if hwid_quote else None,
         "hwid_valid_until": hwid_quote.get("valid_until") if hwid_quote else None,
         "hwid_pricing_period_months": hwid_quote.get("pricing_period_months")
@@ -1417,6 +1528,19 @@ async def _initiate_yk_payment(
         yookassa_metadata["traffic_gb"] = str(months)
     if sale_base in HWID_DEVICE_SALE_BASES:
         yookassa_metadata["hwid_devices"] = str(months)
+    elif hwid_device_count:
+        yookassa_metadata["hwid_devices"] = str(hwid_device_count)
+    if hwid_quote and hwid_device_count:
+        hwid_metadata = {
+            "hwid_valid_from": _metadata_iso(hwid_quote.get("valid_from")),
+            "hwid_valid_until": _metadata_iso(hwid_quote.get("valid_until")),
+            "hwid_pricing_period_months": hwid_quote.get("pricing_period_months"),
+            "hwid_proration_ratio": hwid_quote.get("proration_ratio"),
+            "hwid_full_price": hwid_quote.get("full_price"),
+        }
+        yookassa_metadata.update(
+            {key: str(value) for key, value in hwid_metadata.items() if value is not None}
+        )
     if payment_method_id:
         yookassa_metadata["used_saved_payment_method_id"] = payment_method_id
 
@@ -1484,7 +1608,7 @@ async def _initiate_yk_payment(
             await payment_dal.update_payment_status_by_db_id(
                 session,
                 payment_db_id=db_payment_record.payment_id,
-                new_status=payment_response_yk.get("status", "pending"),
+                new_status="pending_yookassa",
                 yk_payment_id=payment_response_yk.get("id"),
             )
             if selected_method_internal_id is not None:
@@ -1552,12 +1676,11 @@ async def _initiate_yk_payment(
         return True
 
     if payment_response_yk and payment_method_id:
-        status_to_store = payment_response_yk.get("status", "pending")
         try:
             await payment_dal.update_payment_status_by_db_id(
                 session,
                 payment_db_id=db_payment_record.payment_id,
-                new_status=status_to_store,
+                new_status="pending_yookassa",
                 yk_payment_id=payment_response_yk.get("id"),
             )
             if selected_method_internal_id is not None:
@@ -1696,24 +1819,8 @@ async def pay_yk_callback_handler(
 
     months, price_rub, sale_mode = parsed
     hwid_quote = None
-    if _sale_mode_base(sale_mode) in HWID_DEVICE_SALE_BASES:
-        quoted_parts, hwid_quote = await quote_hwid_callback_parts(
-            session=session,
-            user_id=callback.from_user.id,
-            parts=PaymentCallbackParts(months=months, price=price_rub, sale_mode=sale_mode),
-            subscription_service=yookassa_service.subscription_service,
-            currency="rub",
-        )
-        if not quoted_parts:
-            try:
-                await callback.answer(get_text("error_try_again"), show_alert=True)
-            except Exception:
-                pass
-            return
-        months = quoted_parts.months
-        price_rub = quoted_parts.price
     user_id = callback.from_user.id
-    currency_code_for_yk = "RUB"
+    currency_code_for_yk = default_payment_currency_code_for_settings(settings)
     autopay_enabled = bool(
         settings.yookassa_autopayments_active
         and _sale_mode_base(sale_mode) == "subscription"
@@ -1773,6 +1880,22 @@ async def pay_yk_callback_handler(
             pass
         return
 
+    quoted_parts, hwid_quote = await quote_hwid_callback_parts(
+        session=session,
+        user_id=callback.from_user.id,
+        parts=PaymentCallbackParts(months=months, price=price_rub, sale_mode=sale_mode),
+        subscription_service=yookassa_service.subscription_service,
+        currency=default_currency_key_for_settings(settings),
+    )
+    if not quoted_parts:
+        try:
+            await callback.answer(get_text("error_try_again"), show_alert=True)
+        except Exception:
+            pass
+        return
+    months = quoted_parts.months
+    price_rub = quoted_parts.price
+
     await _initiate_yk_payment(
         callback,
         settings=settings,
@@ -1850,8 +1973,24 @@ async def pay_yk_new_card_handler(
         return
 
     months, price_rub, sale_mode = parsed
+    hwid_quote = None
+    quoted_parts, hwid_quote = await quote_hwid_callback_parts(
+        session=session,
+        user_id=callback.from_user.id,
+        parts=PaymentCallbackParts(months=months, price=price_rub, sale_mode=sale_mode),
+        subscription_service=yookassa_service.subscription_service,
+        currency=default_currency_key_for_settings(settings),
+    )
+    if not quoted_parts:
+        try:
+            await callback.answer(get_text("error_try_again"), show_alert=True)
+        except Exception:
+            pass
+        return
+    months = quoted_parts.months
+    price_rub = quoted_parts.price
     user_id = callback.from_user.id
-    currency_code_for_yk = "RUB"
+    currency_code_for_yk = default_payment_currency_code_for_settings(settings)
     autopay_enabled = bool(
         settings.yookassa_autopayments_active
         and _sale_mode_base(sale_mode) == "subscription"
@@ -1876,6 +2015,7 @@ async def pay_yk_new_card_handler(
         save_payment_method=autopay_enabled and autopay_require_binding,
         back_callback=payment_methods_back_callback(_format_value(months), sale_mode, price_rub),
         sale_mode=sale_mode,
+        hwid_quote=hwid_quote,
     )
     try:
         await callback.answer()
@@ -1915,27 +2055,15 @@ async def pay_yk_saved_list_handler(
             pass
         return
 
-    parts = data_payload.split(":")
-    if len(parts) < 2:
+    parsed_saved_list = _parse_saved_list_payload(data_payload)
+    if not parsed_saved_list:
         logging.error(f"pay_yk_saved_list payload missing components: {callback.data}")
         try:
             await callback.answer(get_text("error_try_again"), show_alert=True)
         except Exception:
             pass
         return
-
-    try:
-        months = float(parts[0])
-        price_rub = float(parts[1])
-        page = int(parts[2]) if len(parts) > 2 else 0
-        sale_mode = parts[3] if len(parts) > 3 else "subscription"
-    except (ValueError, IndexError):
-        logging.error(f"pay_yk_saved_list payload parsing error: {callback.data}")
-        try:
-            await callback.answer(get_text("error_try_again"), show_alert=True)
-        except Exception:
-            pass
-        return
+    months, price_rub, page, sale_mode = parsed_saved_list
 
     autopay_enabled = bool(
         settings.yookassa_autopayments_active
@@ -2125,6 +2253,24 @@ async def pay_yk_use_saved_handler(
 
     method_identifier = parts[2]
     user_id = callback.from_user.id
+    base_months = months
+    base_price_rub = price_rub
+    hwid_quote = None
+    quoted_parts, hwid_quote = await quote_hwid_callback_parts(
+        session=session,
+        user_id=user_id,
+        parts=PaymentCallbackParts(months=months, price=price_rub, sale_mode=sale_mode),
+        subscription_service=yookassa_service.subscription_service,
+        currency=default_currency_key_for_settings(settings),
+    )
+    if not quoted_parts:
+        try:
+            await callback.answer(get_text("error_try_again"), show_alert=True)
+        except Exception:
+            pass
+        return
+    months = quoted_parts.months
+    price_rub = quoted_parts.price
 
     try:
         saved_methods = await user_billing_dal.list_user_payment_methods(
@@ -2154,7 +2300,7 @@ async def pay_yk_use_saved_handler(
             pass
         return
 
-    currency_code_for_yk = "RUB"
+    currency_code_for_yk = default_payment_currency_code_for_settings(settings)
 
     await _initiate_yk_payment(
         callback,
@@ -2169,10 +2315,13 @@ async def pay_yk_use_saved_handler(
         price_rub=price_rub,
         currency_code_for_yk=currency_code_for_yk,
         save_payment_method=False,
-        back_callback=f"pay_yk_saved_list:{_format_value(months)}:{price_rub}:{sale_mode}",
+        back_callback=(
+            f"pay_yk_saved_list:{_format_value(base_months)}:{base_price_rub}:0:{sale_mode}"
+        ),
         payment_method_id=selected_method.provider_payment_method_id,
         selected_method_internal_id=selected_method.method_id,
         sale_mode=sale_mode,
+        hwid_quote=hwid_quote,
     )
     try:
         await callback.answer()
@@ -2260,7 +2409,7 @@ async def payment_method_bind(
     metadata = {"user_id": str(callback.from_user.id), "bind_only": "1"}
     resp = await yookassa_service.create_payment(
         amount=1.00,
-        currency="RUB",
+        currency=default_payment_currency_code_for_settings(settings),
         description="Bind card",
         metadata=metadata,
         receipt_email=yookassa_service.config.DEFAULT_RECEIPT_EMAIL,
@@ -2734,17 +2883,19 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
     service: YooKassaService = ctx.request.app["yookassa_service"]
     if not service or not service.configured:
         return payment_unavailable()
+    currency = (ctx.currency or "RUB").upper()
 
     try:
         amounts = payment_record_amounts(
             months=ctx.months,
             sale_mode=ctx.sale_mode,
             traffic_gb=ctx.traffic_gb,
+            hwid_device_count=ctx.hwid_device_count,
         )
         payment = await create_webapp_payment_record(
             ctx,
             amount=ctx.price,
-            currency="RUB",
+            currency=currency,
             status="pending_yookassa",
             provider="yookassa",
         )
@@ -2761,13 +2912,13 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         }
         if amounts.traffic_sale:
             metadata["traffic_gb"] = format_number_for_payload(ctx.traffic_gb or ctx.months)
-        if amounts.hwid_devices_sale:
-            metadata["hwid_devices"] = str(int(float(ctx.months)))
+        if amounts.purchased_hwid_devices:
+            metadata["hwid_devices"] = str(int(amounts.purchased_hwid_devices))
         if amounts.tariff_key:
             metadata["tariff_key"] = amounts.tariff_key
         response = await service.create_payment(
             amount=ctx.price,
-            currency="RUB",
+            currency=currency,
             description=ctx.description,
             metadata=metadata,
             receipt_email=service.config.DEFAULT_RECEIPT_EMAIL,
@@ -2781,7 +2932,7 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         await payment_dal.update_payment_status_by_db_id(
             ctx.session,
             payment.payment_id,
-            response.get("status", "pending"),
+            "pending_yookassa",
             yk_payment_id=response.get("id"),
         )
         await ctx.session.commit()
@@ -2792,6 +2943,36 @@ async def create_webapp_payment(ctx: WebAppPaymentContext) -> web.Response:
         return payment_failed()
 
 
+async def reuse_webapp_payment(ctx: WebAppPaymentContext, payment: Any) -> Optional[str]:
+    service: YooKassaService = ctx.request.app.get("yookassa_service")
+    if not service or not service.configured:
+        return None
+
+    provider_payment_id = str(
+        getattr(payment, "yookassa_payment_id", None)
+        or getattr(payment, "provider_payment_id", None)
+        or ""
+    ).strip()
+    if not provider_payment_id:
+        return None
+
+    info = await service.get_payment_info(provider_payment_id)
+    if not info or str(info.get("status") or "").strip().lower() != "pending":
+        return None
+    if bool(info.get("paid")):
+        return None
+
+    metadata = info.get("metadata") or {}
+    expected_metadata = {
+        "user_id": str(ctx.user_id),
+        "payment_db_id": str(payment.payment_id),
+        "sale_mode": str(ctx.sale_mode),
+    }
+    if any(str(metadata.get(key) or "") != value for key, value in expected_metadata.items()):
+        return None
+    return str(info.get("confirmation_url") or "").strip() or None
+
+
 _PRESENTATION_MANIFEST = tuple(
     ProviderManifestField(
         key=key,
@@ -2926,7 +3107,14 @@ SPEC = PaymentProviderSpec(
     webhook_route=yookassa_webhook_route,
     webhook_requires_base_url=True,
     create_webapp_payment=create_webapp_payment,
+    reuse_webapp_payment=reuse_webapp_payment,
     config_class=YooKassaConfig,
     presentation_class=YooKassaPresentation,
     manifest_fields=_CONFIG_MANIFEST + _PRESENTATION_MANIFEST,
+    supported_currencies=("RUB",),
+    currency_support_note=(
+        "YooKassa public payment API examples and limits are RUB-based; "
+        "treat non-RUB as unsupported unless your YooKassa contract confirms otherwise."
+    ),
+    currency_support_url="https://yookassa.ru/developers/payment-acceptance/integration-scenarios/smart-payment",
 )

backend/bot/services/backup_restore_service.py

@@ -9,11 +9,16 @@ import shutil
 import subprocess
 import tempfile
 import zipfile
+from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path, PurePosixPath
 from typing import Any, Optional
 
+from sqlalchemy import inspect, text
+from sqlalchemy.engine import Connection
+from sqlalchemy.ext.asyncio import create_async_engine
+
 from bot.services.backup_archive import (
     BACKUP_APP_ID,
     BACKUP_FILENAME_PREFIX,
@@ -29,6 +34,8 @@ from bot.services.backup_worker import (
     DEFAULT_COMPOSE_EXCLUDED_DIRS,
 )
 from config.settings import Settings
+from db.migrator import MIGRATIONS, run_database_migrations
+from db.models import Base
 
 logger = logging.getLogger(__name__)
 
@@ -42,6 +49,23 @@ BACKUP_MAX_COMPRESSION_RATIO = 200
 BACKUP_ZIP_BOMB_MIN_BYTES = 100 * 1024 * 1024
 COMPOSE_PRE_RESTORE_PREFIX = "minishop-pre-restore-"
 SAFE_ARCHIVE_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.@+-]{0,220}\.zip$")
+DB_RESTORE_MIGRATION_ADVISORY_LOCK_ID = 817512404897421337
+
+
+def _applied_migration_ids(connection: Connection) -> set[str]:
+    inspector = inspect(connection)
+    if "schema_migrations" not in inspector.get_table_names():
+        return set()
+    return {row[0] for row in connection.execute(text("SELECT id FROM schema_migrations"))}
+
+
+def _create_missing_tables_and_migrate(connection: Connection) -> list[str]:
+    before = _applied_migration_ids(connection)
+    Base.metadata.create_all(connection)
+    run_database_migrations(connection)
+    after = _applied_migration_ids(connection)
+    newly_applied = after - before
+    return [migration.id for migration in MIGRATIONS if migration.id in newly_applied]
 
 
 class BackupArchiveError(ValueError):
@@ -92,6 +116,7 @@ class BackupRestoreResult:
     compose_files_restored: int = 0
     compose_target_dir: Optional[str] = None
     compose_pre_restore_archive: Optional[str] = None
+    database_migrations_applied: list[str] = field(default_factory=list)
     warnings: list[str] = field(default_factory=list)
 
     def to_payload(self) -> dict[str, Any]:
@@ -103,6 +128,7 @@ class BackupRestoreResult:
             "compose_files_restored": self.compose_files_restored,
             "compose_target_dir": self.compose_target_dir,
             "compose_pre_restore_archive": self.compose_pre_restore_archive,
+            "database_migrations_applied": self.database_migrations_applied,
             "warnings": self.warnings,
         }
 
@@ -242,9 +268,11 @@ class BackupRestoreService:
                     compose_pre_restore_archive = self._snapshot_current_compose(compose_target_dir)
 
                 database_restored = False
+                database_migrations_applied: list[str] = []
                 if db_member is not None:
                     dump_path = self._extract_database_dump(archive, db_member, temp_dir)
                     self._run_pg_restore(dump_path)
+                    database_migrations_applied = self._run_post_restore_migrations()
                     database_restored = True
 
                 compose_files_restored = 0
@@ -265,9 +293,50 @@ class BackupRestoreService:
             compose_pre_restore_archive=str(compose_pre_restore_archive)
             if compose_pre_restore_archive
             else None,
+            database_migrations_applied=database_migrations_applied,
             warnings=warnings,
         )
 
+    def _run_post_restore_migrations(self) -> list[str]:
+        try:
+            asyncio.get_running_loop()
+        except RuntimeError:
+            run_migrations = lambda: asyncio.run(self._run_post_restore_migrations_async())
+        else:
+            run_migrations = self._run_post_restore_migrations_in_thread
+
+        try:
+            return run_migrations()
+        except BackupRestoreError:
+            raise
+        except Exception as exc:
+            raise BackupRestoreError(
+                f"Database restore completed, but post-restore migrations failed: {str(exc)[:500]}"
+            ) from exc
+
+    def _run_post_restore_migrations_in_thread(self) -> list[str]:
+        with ThreadPoolExecutor(max_workers=1, thread_name_prefix="backup-restore-migrate") as pool:
+            return pool.submit(
+                lambda: asyncio.run(self._run_post_restore_migrations_async())
+            ).result()
+
+    async def _run_post_restore_migrations_async(self) -> list[str]:
+        engine = create_async_engine(
+            self.settings.DATABASE_URL,
+            echo=False,
+            pool_pre_ping=True,
+            pool_size=1,
+            max_overflow=0,
+        )
+        try:
+            async with engine.begin() as connection:
+                await connection.execute(
+                    text(f"SELECT pg_advisory_xact_lock({DB_RESTORE_MIGRATION_ADVISORY_LOCK_ID})")
+                )
+                return await connection.run_sync(_create_missing_tables_and_migrate)
+        finally:
+            await engine.dispose()
+
     def _run_pg_restore(self, dump_path: Path) -> None:
         pg_restore_path = str(getattr(self.settings, "BACKUP_PG_RESTORE_PATH", "pg_restore") or "")
         pg_restore_path = pg_restore_path or "pg_restore"

backend/bot/services/config_health_service.py

@@ -0,0 +1,511 @@
+"""Detect common deployment misconfigurations for the admin panel.
+
+Each check returns :class:`ConfigAlert` items the admin UI renders as
+banners on the dashboard and inside the affected sections. Local checks
+(filesystem, settings flags) run on every request; network checks
+(Telegram webhook, Remnawave panel) are cached for a couple of minutes so
+the dashboard stays fast and external APIs are not hammered.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import time
+import uuid
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from bot.utils.request_security import ip_in_allowlist
+
+logger = logging.getLogger(__name__)
+
+APP_ROOT = Path(__file__).resolve().parents[3]
+
+NETWORK_CHECKS_TTL_SECONDS = 120.0
+NETWORK_CHECK_TIMEOUT_SECONDS = 8.0
+_WEBHOOK_ERROR_RECENT_SECONDS = 3600
+_WEBHOOK_PENDING_THRESHOLD = 50
+
+SEVERITY_ERROR = "error"
+SEVERITY_WARNING = "warning"
+
+# Admin section ids the frontend routes alerts to.
+SECTION_SETTINGS = "settings"
+SECTION_PAYMENTS = "payments"
+SECTION_BACKUPS = "backups"
+SECTION_TARIFFS = "tariffs"
+SECTION_APPEARANCE = "appearance"
+SECTION_TRANSLATIONS = "translations"
+SECTION_USERS = "users"
+
+_DATA_DIR_SECTIONS = (
+    SECTION_BACKUPS,
+    SECTION_TARIFFS,
+    SECTION_APPEARANCE,
+    SECTION_TRANSLATIONS,
+    SECTION_SETTINGS,
+)
+
+# Every message key an alert can carry. Tests assert each has
+# ``admin_health_<key>`` entries in both locale files.
+ALL_MESSAGE_KEYS = (
+    "data_dir_missing",
+    "data_dir_not_writable",
+    "backups_dir_not_writable",
+    "tariffs_config_invalid",
+    "locale_overrides_invalid",
+    "subscription_page_config_invalid",
+    "provider_not_configured",
+    "provider_webhook_needs_base_url",
+    "no_payment_methods",
+    "mini_app_url_missing",
+    "mini_app_url_not_https",
+    "redis_not_configured",
+    "smtp_incomplete",
+    "proxy_not_trusted",
+    "bot_token_invalid",
+    "telegram_api_error",
+    "telegram_webhook_missing",
+    "telegram_webhook_mismatch",
+    "telegram_webhook_error",
+    "telegram_webhook_pending",
+    "panel_api_not_configured",
+    "panel_api_unreachable",
+)
+
+
+@dataclass(frozen=True)
+class ConfigAlert:
+    id: str
+    severity: str
+    sections: Tuple[str, ...]
+    params: Dict[str, Any] = field(default_factory=dict)
+    # Locale key suffix; defaults to ``id``. Per-provider alerts carry ids
+    # like ``provider_not_configured:wata`` but share one message key.
+    message_key: Optional[str] = None
+
+    def as_payload(self) -> Dict[str, Any]:
+        return {
+            "id": self.id,
+            "severity": self.severity,
+            "sections": list(self.sections),
+            "message_key": self.message_key or self.id,
+            "params": dict(self.params),
+        }
+
+
+# ─── Filesystem checks ─────────────────────────────────────────────
+
+
+def _dir_is_writable(path: Path) -> bool:
+    probe = path / f".health-probe-{uuid.uuid4().hex}.tmp"
+    try:
+        probe.write_text("ok", encoding="utf-8")
+        probe.unlink()
+        return True
+    except OSError:
+        try:
+            probe.unlink()
+        except OSError:
+            pass
+        return False
+
+
+def _resolve_data_path(value: str) -> Path:
+    path = Path(value)
+    return path if path.is_absolute() else APP_ROOT / path
+
+
+def data_dir_alerts(settings: Any, app_root: Path = APP_ROOT) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+    data_dir = app_root / "data"
+    if not data_dir.is_dir():
+        return [
+            ConfigAlert(
+                id="data_dir_missing",
+                severity=SEVERITY_ERROR,
+                sections=_DATA_DIR_SECTIONS,
+                params={"path": str(data_dir)},
+            )
+        ]
+    if not _dir_is_writable(data_dir):
+        alerts.append(
+            ConfigAlert(
+                id="data_dir_not_writable",
+                severity=SEVERITY_ERROR,
+                sections=_DATA_DIR_SECTIONS,
+                params={"path": str(data_dir)},
+            )
+        )
+
+    backup_dir = _resolve_data_path(str(getattr(settings, "BACKUP_DIR", "") or "data/backups"))
+    if backup_dir.is_dir() and not _dir_is_writable(backup_dir):
+        alerts.append(
+            ConfigAlert(
+                id="backups_dir_not_writable",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_BACKUPS,),
+                params={"path": str(backup_dir)},
+            )
+        )
+    return alerts
+
+
+def config_file_alerts(settings: Any) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+
+    tariffs_path = _resolve_data_path(
+        str(getattr(settings, "TARIFFS_CONFIG_PATH", "") or "data/tariffs.json")
+    )
+    if tariffs_path.is_file():
+        try:
+            from config.tariffs_config import load_tariffs_config
+
+            load_tariffs_config(tariffs_path)
+        except Exception as exc:
+            alerts.append(
+                ConfigAlert(
+                    id="tariffs_config_invalid",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_TARIFFS,),
+                    params={"path": str(tariffs_path), "error": str(exc)[:300]},
+                )
+            )
+
+    locale_overrides_path = APP_ROOT / "data" / "locales-overrides.json"
+    if locale_overrides_path.is_file():
+        try:
+            json.loads(locale_overrides_path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            alerts.append(
+                ConfigAlert(
+                    id="locale_overrides_invalid",
+                    severity=SEVERITY_WARNING,
+                    sections=(SECTION_TRANSLATIONS,),
+                    params={"path": str(locale_overrides_path), "error": str(exc)[:300]},
+                )
+            )
+
+    try:
+        from config.subscription_guides_config import (
+            SubscriptionGuidesConfigError,
+            subscription_guides_admin_config_json,
+        )
+
+        try:
+            subscription_guides_admin_config_json(settings)
+        except SubscriptionGuidesConfigError as exc:
+            alerts.append(
+                ConfigAlert(
+                    id="subscription_page_config_invalid",
+                    severity=SEVERITY_WARNING,
+                    sections=(SECTION_SETTINGS,),
+                    params={"error": str(exc)[:300]},
+                )
+            )
+    except Exception:  # pragma: no cover - defensive import guard
+        logger.exception("Subscription guides config check failed unexpectedly")
+
+    return alerts
+
+
+# ─── Settings checks ───────────────────────────────────────────────
+
+
+def payment_provider_alerts(settings: Any, app: Any) -> List[ConfigAlert]:
+    from bot.payment_providers import iter_provider_specs
+
+    alerts: List[ConfigAlert] = []
+    any_enabled = False
+    seen_services: set = set()
+    for spec in iter_provider_specs():
+        try:
+            enabled = spec.is_effectively_enabled(settings)
+        except Exception:  # pragma: no cover - provider config errors
+            logger.exception("Provider %s enabled check failed", spec.id)
+            continue
+        if not enabled:
+            continue
+        any_enabled = True
+        if spec.service_key in seen_services:
+            continue
+        if spec.service_key:
+            seen_services.add(spec.service_key)
+        if not spec.is_service_configured(app):
+            alerts.append(
+                ConfigAlert(
+                    id=f"provider_not_configured:{spec.id}",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_SETTINGS,),
+                    params={"provider": spec.label},
+                    message_key="provider_not_configured",
+                )
+            )
+        if spec.webhook_requires_base_url and not getattr(settings, "WEBHOOK_BASE_URL", None):
+            alerts.append(
+                ConfigAlert(
+                    id=f"provider_webhook_needs_base_url:{spec.id}",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_SETTINGS,),
+                    params={"provider": spec.label},
+                    message_key="provider_webhook_needs_base_url",
+                )
+            )
+    if not any_enabled:
+        alerts.append(
+            ConfigAlert(
+                id="no_payment_methods",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS, SECTION_PAYMENTS),
+            )
+        )
+    return alerts
+
+
+def settings_alerts(settings: Any) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+
+    mini_app_url = str(getattr(settings, "SUBSCRIPTION_MINI_APP_URL", "") or "").strip()
+    if not mini_app_url:
+        alerts.append(
+            ConfigAlert(
+                id="mini_app_url_missing",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+    elif not mini_app_url.lower().startswith("https://"):
+        alerts.append(
+            ConfigAlert(
+                id="mini_app_url_not_https",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS,),
+                params={"url": mini_app_url},
+            )
+        )
+
+    if not getattr(settings, "REDIS_URL", None):
+        alerts.append(
+            ConfigAlert(
+                id="redis_not_configured",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+
+    smtp_partial = any(
+        getattr(settings, key, None)
+        for key in ("SMTP_USERNAME", "SMTP_PASSWORD", "SMTP_FROM_EMAIL")
+    )
+    if smtp_partial and not getattr(settings, "email_auth_configured", False):
+        alerts.append(
+            ConfigAlert(
+                id="smtp_incomplete",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+
+    return alerts
+
+
+def proxy_alerts(request: Any, settings: Any) -> List[ConfigAlert]:
+    """Warn when the admin request itself came through an untrusted proxy.
+
+    In that case provider webhooks with IP allowlists will see the proxy
+    address instead of the real sender and may reject valid callbacks.
+    """
+    headers = getattr(request, "headers", None) or {}
+    forwarded = headers.get("X-Forwarded-For")
+    remote = getattr(request, "remote", None)
+    if not forwarded or not remote:
+        return []
+    if ip_in_allowlist(remote, getattr(settings, "trusted_proxies", None)):
+        return []
+    return [
+        ConfigAlert(
+            id="proxy_not_trusted",
+            severity=SEVERITY_WARNING,
+            sections=(SECTION_SETTINGS,),
+            params={"remote": str(remote)},
+        )
+    ]
+
+
+# ─── Network checks (cached) ───────────────────────────────────────
+
+
+async def telegram_alerts(bot: Any, settings: Any) -> List[ConfigAlert]:
+    if bot is None:
+        return []
+    try:
+        info = await asyncio.wait_for(bot.get_webhook_info(), timeout=NETWORK_CHECK_TIMEOUT_SECONDS)
+    except Exception as exc:
+        if exc.__class__.__name__ in {"TelegramUnauthorizedError", "TelegramNotFound"}:
+            return [
+                ConfigAlert(
+                    id="bot_token_invalid",
+                    severity=SEVERITY_ERROR,
+                    sections=(SECTION_SETTINGS,),
+                )
+            ]
+        return [
+            ConfigAlert(
+                id="telegram_api_error",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"error": str(exc)[:300]},
+            )
+        ]
+
+    alerts: List[ConfigAlert] = []
+    actual_url = str(getattr(info, "url", "") or "")
+    base_url = str(getattr(settings, "WEBHOOK_BASE_URL", "") or "").rstrip("/")
+    expected_url = (
+        f"{base_url}{getattr(settings, 'telegram_webhook_path', '/tg/webhook')}" if base_url else ""
+    )
+    if not actual_url:
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_missing",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS,),
+            )
+        )
+    elif expected_url and actual_url != expected_url:
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_mismatch",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"actual": actual_url, "expected": expected_url},
+            )
+        )
+
+    pending = int(getattr(info, "pending_update_count", 0) or 0)
+    last_error_date = getattr(info, "last_error_date", None)
+    last_error_ts: Optional[float] = None
+    if last_error_date is not None:
+        last_error_ts = (
+            last_error_date.timestamp()
+            if hasattr(last_error_date, "timestamp")
+            else float(last_error_date)
+        )
+    if (
+        pending > 0
+        and last_error_ts
+        and (time.time() - last_error_ts) < _WEBHOOK_ERROR_RECENT_SECONDS
+    ):
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_error",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"error": str(getattr(info, "last_error_message", "") or "")[:300]},
+            )
+        )
+
+    if pending > _WEBHOOK_PENDING_THRESHOLD:
+        alerts.append(
+            ConfigAlert(
+                id="telegram_webhook_pending",
+                severity=SEVERITY_WARNING,
+                sections=(SECTION_SETTINGS,),
+                params={"count": pending},
+            )
+        )
+    return alerts
+
+
+async def panel_alerts(panel_service: Any, settings: Any) -> List[ConfigAlert]:
+    if not getattr(settings, "PANEL_API_URL", None) or not getattr(settings, "PANEL_API_KEY", None):
+        return [
+            ConfigAlert(
+                id="panel_api_not_configured",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS, SECTION_USERS, SECTION_TARIFFS),
+            )
+        ]
+    if panel_service is None:
+        return []
+    try:
+        stats = await asyncio.wait_for(
+            panel_service.get_system_stats(), timeout=NETWORK_CHECK_TIMEOUT_SECONDS
+        )
+    except Exception as exc:
+        logger.debug("Panel health check failed: %s", exc)
+        stats = None
+    if stats is None:
+        return [
+            ConfigAlert(
+                id="panel_api_unreachable",
+                severity=SEVERITY_ERROR,
+                sections=(SECTION_SETTINGS, SECTION_USERS),
+                params={"url": str(getattr(settings, "PANEL_API_URL", "") or "")},
+            )
+        ]
+    return []
+
+
+# ─── Aggregation ───────────────────────────────────────────────────
+
+_network_cache: Dict[int, Tuple[float, List[ConfigAlert]]] = {}
+_network_cache_lock = asyncio.Lock()
+
+
+def local_alerts(request: Any, settings: Any, app: Any) -> List[ConfigAlert]:
+    alerts: List[ConfigAlert] = []
+    for collect in (
+        lambda: data_dir_alerts(settings),
+        lambda: config_file_alerts(settings),
+        lambda: payment_provider_alerts(settings, app),
+        lambda: settings_alerts(settings),
+        lambda: proxy_alerts(request, settings),
+    ):
+        try:
+            alerts.extend(collect())
+        except Exception:  # pragma: no cover - one broken check must not hide others
+            logger.exception("Config health check failed")
+    return alerts
+
+
+async def network_alerts(app: Any, settings: Any, *, refresh: bool = False) -> List[ConfigAlert]:
+    cache_key = id(settings)
+    now = time.monotonic()
+    if not refresh:
+        cached = _network_cache.get(cache_key)
+        if cached and (now - cached[0]) < NETWORK_CHECKS_TTL_SECONDS:
+            return cached[1]
+
+    async with _network_cache_lock:
+        if not refresh:
+            cached = _network_cache.get(cache_key)
+            if cached and (time.monotonic() - cached[0]) < NETWORK_CHECKS_TTL_SECONDS:
+                return cached[1]
+
+        results = await asyncio.gather(
+            telegram_alerts(app.get("bot"), settings),
+            panel_alerts(app.get("panel_service"), settings),
+            return_exceptions=True,
+        )
+        alerts: List[ConfigAlert] = []
+        for result in results:
+            if isinstance(result, BaseException):
+                logger.exception("Network config health check failed", exc_info=result)
+                continue
+            alerts.extend(result)
+        _network_cache[cache_key] = (time.monotonic(), alerts)
+        return alerts
+
+
+async def collect_config_alerts(request: Any, *, refresh: bool = False) -> List[Dict[str, Any]]:
+    app = request.app
+    settings = app["settings"]
+    alerts = local_alerts(request, settings, app)
+    alerts.extend(await network_alerts(app, settings, refresh=refresh))
+    order = {SEVERITY_ERROR: 0, SEVERITY_WARNING: 1}
+    alerts.sort(key=lambda alert: (order.get(alert.severity, 2), alert.id))
+    return [alert.as_payload() for alert in alerts]

backend/bot/services/email_auth_service.py

@@ -10,15 +10,16 @@ from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from email.message import EmailMessage
 from email.utils import formataddr
-from typing import Optional
+from typing import Optional, Sequence
 
 from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from bot.middlewares.i18n import JsonI18n
-from bot.services.email_templates import EmailContent, render_login_code
+from bot.services.email_templates import EmailContent, EmailInlineImage, render_login_code
+from bot.services.message_audit import log_user_message_delivery
 from config.settings import Settings
-from db.dal import security_dal
+from db.dal import security_dal, user_dal
 from db.models import EmailVerificationCode
 
 logger = logging.getLogger(__name__)
@@ -60,11 +61,39 @@ def normalize_email(value: str) -> str:
     return (value or "").strip().lower()
 
 
+def email_domain(value: Optional[str]) -> str:
+    email = normalize_email(value or "")
+    if "@" not in email:
+        return ""
+    return email.rsplit("@", 1)[1].strip().lower().rstrip(".")
+
+
 def is_valid_email(value: str) -> bool:
     email = normalize_email(value)
     return bool(email and len(email) <= 254 and EMAIL_RE.match(email))
 
 
+def _split_disposable_domain_values(value: str) -> list[str]:
+    return [item.strip() for item in re.split(r"[,;\s]+", value or "") if item.strip()]
+
+
+def is_disposable_email(value: Optional[str], settings: Settings) -> bool:
+    domain = email_domain(value)
+    if not domain:
+        return False
+    blocked_domains = getattr(settings, "disposable_email_domains", None)
+    if blocked_domains is None:
+        blocked_domains = _split_disposable_domain_values(
+            str(getattr(settings, "DISPOSABLE_EMAIL_DOMAINS", "") or "")
+        )
+    blocked_domains = blocked_domains or []
+    for blocked in blocked_domains:
+        normalized = str(blocked or "").strip().lower().lstrip("@.")
+        if normalized and (domain == normalized or domain.endswith(f".{normalized}")):
+            return True
+    return False
+
+
 def _email_throttle_identifier(email: str, purpose: str, target_user_id: Optional[int]) -> str:
     target_part = "none" if target_user_id is None else str(target_user_id)
     return f"{purpose}:{target_part}:{email}"
@@ -222,6 +251,28 @@ class EmailAuthService:
             magic_link=magic_link,
             purpose=purpose,
         )
+        resolved_target_user_id = target_user_id
+        if resolved_target_user_id is None:
+            try:
+                existing_user = await user_dal.get_user_by_email(session, normalized_email)
+                resolved_target_user_id = (
+                    int(existing_user.user_id) if existing_user is not None else None
+                )
+            except Exception:
+                logger.exception(
+                    "Failed to resolve email auth target user for audit log: %s",
+                    normalized_email,
+                )
+        await log_user_message_delivery(
+            session,
+            target_user_id=resolved_target_user_id,
+            event_type="email_login_code_sent"
+            if purpose == "login"
+            else "email_verification_code_sent",
+            channel="email",
+            recipient=normalized_email,
+            content=f"purpose={purpose} magic_link={bool(magic_link)}",
+        )
         return EmailCodeRequestResult(ok=True)
 
     async def verify_code(
@@ -430,6 +481,7 @@ class EmailAuthService:
         subject: str,
         body: str,
         html_body: Optional[str] = None,
+        inline_images: Sequence[EmailInlineImage] = (),
     ) -> None:
         await asyncio.to_thread(
             self._send_custom_email_sync,
@@ -437,6 +489,7 @@ class EmailAuthService:
             subject=subject,
             body=body,
             html_body=html_body,
+            inline_images=inline_images,
         )
 
     async def send_rendered_email(
@@ -450,6 +503,7 @@ class EmailAuthService:
             subject=content.subject,
             body=content.text,
             html_body=content.html,
+            inline_images=content.inline_images,
         )
 
     def _send_code_email_sync(
@@ -470,17 +524,13 @@ class EmailAuthService:
             i18n=self.i18n,
         )
 
-        message = EmailMessage()
-        message["Subject"] = content.subject
-        message["From"] = formataddr(
-            (
-                self.settings.SMTP_FROM_NAME or self.settings.WEBAPP_TITLE,
-                self.settings.SMTP_FROM_EMAIL or "",
-            )
+        message = self._build_email_message(
+            email=email,
+            subject=content.subject,
+            body=content.text,
+            html_body=content.html,
+            inline_images=content.inline_images,
         )
-        message["To"] = email
-        message.set_content(content.text)
-        message.add_alternative(content.html, subtype="html")
 
         context = ssl.create_default_context()
         smtp_host = self.settings.SMTP_HOST
@@ -531,19 +581,15 @@ class EmailAuthService:
         subject: str,
         body: str,
         html_body: Optional[str] = None,
+        inline_images: Sequence[EmailInlineImage] = (),
     ) -> None:
-        message = EmailMessage()
-        message["Subject"] = subject
-        message["From"] = formataddr(
-            (
-                self.settings.SMTP_FROM_NAME or self.settings.WEBAPP_TITLE,
-                self.settings.SMTP_FROM_EMAIL or "",
-            )
+        message = self._build_email_message(
+            email=email,
+            subject=subject,
+            body=body,
+            html_body=html_body,
+            inline_images=inline_images,
         )
-        message["To"] = email
-        message.set_content(body)
-        if html_body:
-            message.add_alternative(html_body, subtype="html")
 
         context = ssl.create_default_context()
         smtp_host = self.settings.SMTP_HOST
@@ -587,6 +633,64 @@ class EmailAuthService:
         if last_error:
             raise last_error
 
+    def _build_email_message(
+        self,
+        *,
+        email: str,
+        subject: str,
+        body: str,
+        html_body: Optional[str] = None,
+        inline_images: Sequence[EmailInlineImage] = (),
+    ) -> EmailMessage:
+        message = EmailMessage()
+        message["Subject"] = subject
+        message["From"] = formataddr(
+            (
+                self.settings.SMTP_FROM_NAME or self.settings.WEBAPP_TITLE,
+                self.settings.SMTP_FROM_EMAIL or "",
+            )
+        )
+        message["To"] = email
+        message.set_content(body)
+        if html_body:
+            message.add_alternative(html_body, subtype="html")
+            self._attach_inline_images(message, inline_images)
+        return message
+
+    @staticmethod
+    def _attach_inline_images(
+        message: EmailMessage,
+        inline_images: Sequence[EmailInlineImage],
+    ) -> None:
+        if not inline_images:
+            return
+        html_part = message.get_body(("html",))
+        if html_part is None:
+            return
+
+        for image in inline_images:
+            content_type = (image.content_type or "").split(";", 1)[0].strip().lower()
+            if "/" not in content_type:
+                continue
+            maintype, subtype = content_type.split("/", 1)
+            if maintype != "image" or not subtype:
+                continue
+
+            body = bytes(image.data or b"")
+            content_id = (image.content_id or "").strip()
+            if not body or not content_id:
+                continue
+
+            cid_header = content_id
+            if not (cid_header.startswith("<") and cid_header.endswith(">")):
+                cid_header = f"<{cid_header}>"
+            html_part.add_related(
+                body,
+                maintype=maintype,
+                subtype=subtype,
+                cid=cid_header,
+            )
+
     def _send_message_via_smtp(
         self,
         *,

backend/bot/services/email_templates.py

@@ -10,13 +10,16 @@ copy goes through the shared `JsonI18n` instance so translations live in
 from __future__ import annotations
 
 import html
+import io
 import re
 from dataclasses import dataclass
-from typing import Optional, Sequence, Tuple
+from pathlib import Path
+from typing import TYPE_CHECKING, Optional, Sequence, Tuple
 from urllib.parse import urlsplit
 
-from bot.middlewares.i18n import JsonI18n, get_i18n_instance, normalize_locale_language_code
-from config.settings import Settings
+if TYPE_CHECKING:
+    from bot.middlewares.i18n import JsonI18n
+    from config.settings import Settings
 
 _BG = "#05070a"
 _CARD_BG = "#0e1116"
@@ -26,6 +29,28 @@ _TEXT_MUTED = "#9aa3b2"
 _TEXT_DIM = "#5d6573"
 _DEFAULT_ACCENT = "#00fe7a"
 _HEX_RE = re.compile(r"^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$")
+_EMAIL_LOGO_CONTENT_ID = "webapp-logo"
+_WEBAPP_UPLOADED_LOGO_PATH = "/webapp-uploaded-logo"
+_WEBAPP_UPLOADED_LOGO_DIR = Path(__file__).resolve().parents[3] / "data" / "webapp-logo" / "uploads"
+_WEBAPP_LOGO_MAX_BYTES = 2 * 1024 * 1024
+_UPLOADED_LOGO_RE = re.compile(r"logo-[0-9a-f]{16}\.(?:gif|ico|jpe?g|png|svg|webp)")
+_LOGO_CONTENT_TYPES = {
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+}
+_EMAIL_LOGO_PNG_FALLBACK_EXTENSIONS = {".ico", ".webp"}
+
+
+@dataclass(frozen=True)
+class EmailInlineImage:
+    content_id: str
+    content_type: str
+    data: bytes
 
 
 @dataclass(frozen=True)
@@ -33,6 +58,13 @@ class EmailContent:
     subject: str
     text: str
     html: str
+    inline_images: Tuple[EmailInlineImage, ...] = ()
+
+
+@dataclass(frozen=True)
+class _EmailLayout:
+    html: str
+    inline_images: Tuple[EmailInlineImage, ...] = ()
 
 
 def _safe_color(value: Optional[str]) -> str:
@@ -44,11 +76,22 @@ def _safe_color(value: Optional[str]) -> str:
     return _DEFAULT_ACCENT
 
 
+def _theme_accent(settings: Settings) -> str:
+    primary = _safe_color(getattr(settings, "WEBAPP_PRIMARY_COLOR", None))
+    try:
+        catalog = getattr(settings, "webapp_themes_catalog", None)
+        if catalog is None:
+            return primary
+        from config.webapp_themes_config import effective_webapp_theme_accent
+
+        return _safe_color(effective_webapp_theme_accent(catalog, primary))
+    except Exception:
+        return primary
+
+
 def _public_logo_url(settings: Settings) -> Optional[str]:
     """Email recipients can't reach the in-app /webapp-logo proxy, so only a
     stored public https URL can be used directly. Anything else is dropped."""
-    if getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False):
-        return None
     raw = (settings.WEBAPP_LOGO_URL or "").strip()
     if not raw:
         return None
@@ -58,20 +101,107 @@ def _public_logo_url(settings: Settings) -> Optional[str]:
     return raw
 
 
+def _uploaded_logo_filename(url: str) -> Optional[str]:
+    parsed = urlsplit(str(url or ""))
+    path = parsed.path if parsed.scheme or parsed.netloc else str(url or "")
+    prefix = f"{_WEBAPP_UPLOADED_LOGO_PATH}/"
+    if not path.startswith(prefix):
+        return None
+    filename = path.removeprefix(prefix)
+    return filename if _UPLOADED_LOGO_RE.fullmatch(filename) else None
+
+
+def _inline_uploaded_logo(settings: Settings) -> Optional[EmailInlineImage]:
+    filename = _uploaded_logo_filename((settings.WEBAPP_LOGO_URL or "").strip())
+    if not filename:
+        return None
+
+    content_type = _LOGO_CONTENT_TYPES.get(Path(filename).suffix.lower())
+    if not content_type:
+        return None
+
+    try:
+        uploads_dir = _WEBAPP_UPLOADED_LOGO_DIR.resolve()
+        logo_path = (uploads_dir / filename).resolve()
+        logo_path.relative_to(uploads_dir)
+        body = logo_path.read_bytes()
+    except (OSError, ValueError):
+        return None
+
+    if not body or len(body) > _WEBAPP_LOGO_MAX_BYTES:
+        return None
+
+    content_type, body = _email_logo_payload(filename, content_type, body)
+
+    return EmailInlineImage(
+        content_id=_EMAIL_LOGO_CONTENT_ID,
+        content_type=content_type,
+        data=body,
+    )
+
+
+def _email_logo_payload(filename: str, content_type: str, body: bytes) -> Tuple[str, bytes]:
+    suffix = Path(filename).suffix.lower()
+    if suffix not in _EMAIL_LOGO_PNG_FALLBACK_EXTENSIONS:
+        return content_type, body
+
+    png_body = _static_raster_logo_to_png(body)
+    if png_body and len(png_body) <= _WEBAPP_LOGO_MAX_BYTES:
+        return "image/png", png_body
+    return content_type, body
+
+
+def _static_raster_logo_to_png(body: bytes) -> Optional[bytes]:
+    try:
+        from PIL import Image, ImageOps, UnidentifiedImageError
+    except ImportError:
+        return None
+
+    try:
+        with Image.open(io.BytesIO(body)) as image:
+            image.seek(0)
+            if getattr(image, "is_animated", False):
+                return None
+            source = ImageOps.exif_transpose(image).convert("RGBA")
+    except (OSError, UnidentifiedImageError, ValueError, EOFError):
+        return None
+
+    if source.width < 1 or source.height < 1 or source.width > 8192 or source.height > 8192:
+        return None
+
+    output = io.BytesIO()
+    source.save(output, format="PNG", optimize=True)
+    return output.getvalue()
+
+
+def _email_logo(settings: Settings) -> Tuple[Optional[str], Tuple[EmailInlineImage, ...]]:
+    inline_logo = _inline_uploaded_logo(settings)
+    if inline_logo:
+        return f"cid:{inline_logo.content_id}", (inline_logo,)
+
+    public_url = _public_logo_url(settings)
+    if public_url:
+        return public_url, ()
+
+    return None, ()
+
+
 def _brand_title(settings: Settings) -> str:
     title = (settings.WEBAPP_TITLE or "").strip()
     return title or "Subscription"
 
 
 def _normalize_lang(language_code: Optional[str], settings: Settings) -> str:
-    return normalize_locale_language_code(
-        language_code or settings.DEFAULT_LANGUAGE or "ru",
-        prefer_known_base=False,
-    )
+    value = str(language_code or settings.DEFAULT_LANGUAGE or "ru").strip().lower()
+    return value.replace("_", "-") or "ru"
 
 
 def _resolve_i18n(i18n: Optional[JsonI18n]) -> JsonI18n:
-    return i18n or get_i18n_instance()
+    if i18n is not None:
+        return i18n
+    from bot.middlewares.i18n import get_i18n_instance
+
+    return get_i18n_instance()
 
 
 def _t_html(i18n: JsonI18n, lang: str, key: str, **kwargs) -> str:
@@ -89,25 +219,28 @@ def _t_text(i18n: JsonI18n, lang: str, key: str, **kwargs) -> str:
 def _layout(
     *,
     settings: Settings,
+    language_code: str,
     preheader: str,
     heading: str,
     intro_html: str,
     body_html: str,
     footer_html: str,
-) -> str:
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent: Optional[str] = None,
+) -> _EmailLayout:
+    accent = _safe_color(accent) if accent else _theme_accent(settings)
     brand_title = html.escape(_brand_title(settings))
-    logo_url = _public_logo_url(settings)
+    logo_url, inline_images = _email_logo(settings)
+    html_lang = html.escape((language_code or "en").replace("_", "-"), quote=True)
     logo_block = ""
     if logo_url:
         logo_block = (
             f'<img src="{html.escape(logo_url, quote=True)}" width="64" height="64" '
             f'alt="" style="display:block;border:0;outline:none;text-decoration:none;'
-            f'border-radius:16px;">'
+            f'border-radius:16px;background:transparent;background-color:transparent;">'
         )
 
-    return f"""<!DOCTYPE html>
-<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
+    layout_html = f"""<!DOCTYPE html>
+<html lang="{html_lang}" xmlns="http://www.w3.org/1999/xhtml">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -146,6 +279,16 @@ def _layout(
 </body>
 </html>
 """  # noqa: E501
+    return _EmailLayout(html=layout_html, inline_images=inline_images)
+
+
+def _email_content(*, subject: str, text: str, layout: _EmailLayout) -> EmailContent:
+    return EmailContent(
+        subject=subject,
+        text=text,
+        html=layout.html,
+        inline_images=layout.inline_images,
+    )
 
 
 def _info_rows_html(rows: Sequence[Tuple[str, str]]) -> str:
@@ -253,7 +396,7 @@ def render_login_code(
     i18n = _resolve_i18n(i18n)
     lang = _normalize_lang(language_code, settings)
     minutes = _format_minutes(settings.EMAIL_CODE_TTL_SECONDS)
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent = _theme_accent(settings)
     brand = _brand_title(settings)
     template_prefix = "email_set_password_code" if purpose == "set_password" else "email_login_code"
     safe_magic_link = (magic_link or "").strip() if template_prefix == "email_login_code" else ""
@@ -307,13 +450,15 @@ def render_login_code(
 
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=preheader,
         heading=heading,
         intro_html=html.escape(intro),
         body_html=body_html,
         footer_html=footer,
+        accent=accent,
     )
-    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+    return _email_content(subject=subject, text="\n".join(text_lines), layout=rendered)
 
 
 def render_account_merged(
@@ -359,13 +504,14 @@ def render_account_merged(
 
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=preheader,
         heading=heading,
         intro_html=html.escape(intro),
         body_html=body_html,
         footer_html=footer,
     )
-    return EmailContent(subject=subject, text=text, html=rendered)
+    return _email_content(subject=subject, text=text, layout=rendered)
 
 
 def render_payment_success(
@@ -384,7 +530,7 @@ def render_payment_success(
 ) -> EmailContent:
     i18n = _resolve_i18n(i18n)
     lang = _normalize_lang(language_code, settings)
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent = _theme_accent(settings)
     brand = _brand_title(settings)
     sale_base = (sale_mode or "").split("@", 1)[0].split("|", 1)[0]
     is_traffic = sale_base in {
@@ -492,13 +638,15 @@ def render_payment_success(
 
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=preheader,
         heading=heading,
         intro_html=html.escape(intro),
         body_html="".join(body_parts),
         footer_html=footer,
+        accent=accent,
     )
-    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+    return _email_content(subject=subject, text="\n".join(text_lines), layout=rendered)
 
 
 def render_user_notification(
@@ -515,7 +663,7 @@ def render_user_notification(
 ) -> EmailContent:
     i18n = _resolve_i18n(i18n)
     lang = _normalize_lang(language_code, settings)
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent = _theme_accent(settings)
     brand = _brand_title(settings)
     safe_dashboard_url = (dashboard_url or "").strip()
     final_subject = (subject or "").strip() or _t_text(
@@ -542,11 +690,13 @@ def render_user_notification(
 
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=final_subject,
         heading=final_heading,
         intro_html=html.escape(final_intro),
         body_html="".join(body_parts),
         footer_html=footer,
+        accent=accent,
     )
     text_lines = [final_subject, "", _telegram_html_to_text(message_text)]
     if safe_dashboard_url:
@@ -558,7 +708,7 @@ def render_user_notification(
                 ),
             ]
         )
-    return EmailContent(subject=final_subject, text="\n".join(text_lines), html=rendered)
+    return _email_content(subject=final_subject, text="\n".join(text_lines), layout=rendered)
 
 
 def render_subscription_expiring(
@@ -572,7 +722,7 @@ def render_subscription_expiring(
 ) -> EmailContent:
     i18n = _resolve_i18n(i18n)
     lang = _normalize_lang(language_code, settings)
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent = _theme_accent(settings)
     brand = _brand_title(settings)
     safe_dashboard_url = (dashboard_url or "").strip()
     days = max(0, int(days_left))
@@ -615,13 +765,15 @@ def render_subscription_expiring(
 
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=preheader,
         heading=heading,
         intro_html=html.escape(intro),
         body_html="".join(body_parts),
         footer_html=footer,
+        accent=accent,
     )
-    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+    return _email_content(subject=subject, text="\n".join(text_lines), layout=rendered)
 
 
 def _subscription_lifecycle_title(
@@ -668,7 +820,7 @@ def render_subscription_lifecycle_notification(
 ) -> EmailContent:
     i18n = _resolve_i18n(i18n)
     lang = _normalize_lang(language_code, settings)
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent = _theme_accent(settings)
     brand = _brand_title(settings)
     safe_dashboard_url = (dashboard_url or "").strip()
     end_date = end_date_text or "—"
@@ -702,11 +854,13 @@ def render_subscription_lifecycle_notification(
 
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=subject,
         heading=subject,
         intro_html=html.escape(intro),
         body_html="".join(body_parts),
         footer_html=footer,
+        accent=accent,
     )
 
     text_lines = [subject, "", message_text]
@@ -722,7 +876,7 @@ def render_subscription_lifecycle_notification(
                 ),
             ]
         )
-    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+    return _email_content(subject=subject, text="\n".join(text_lines), layout=rendered)
 
 
 def _support_email(
@@ -738,31 +892,44 @@ def _support_email(
     ticket_url: Optional[str],
     cta_label: str,
 ) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
     lang = _normalize_lang(language, settings)
     brand = _brand_title(settings)
-    accent = _safe_color(settings.WEBAPP_PRIMARY_COLOR)
+    accent = _theme_accent(settings)
     safe_url = (ticket_url or "").strip()
-    footer = _t_html(_resolve_i18n(i18n), lang, "email_footer_auto", brand=brand)
+    footer = _t_html(i18n, lang, "email_footer_auto", brand=brand)
+    localized_rows = [
+        (_t_text(i18n, lang, label) if str(label).startswith("email_") else str(label), value)
+        for label, value in rows
+    ]
     preview_block = (
         f'<div style="margin:0 0 16px 0;background:{_BG};border:1px solid {_BORDER};'
         f"border-radius:14px;padding:14px 16px;font-size:14px;line-height:1.55;color:{_TEXT};"
         f'white-space:pre-wrap;">{html.escape(body_preview or "")}</div>'
     )
-    body_parts = [_info_rows_html(rows), preview_block]
+    body_parts = [_info_rows_html(localized_rows), preview_block]
     if safe_url:
         body_parts.append(_cta_button_html(label=cta_label, url=safe_url, accent=accent))
     rendered = _layout(
         settings=settings,
+        language_code=lang,
         preheader=intro,
         heading=heading,
         intro_html=html.escape(intro),
         body_html="".join(body_parts),
         footer_html=footer,
+        accent=accent,
     )
-    text_lines = [intro, "", *[f"{label}: {value}" for label, value in rows], "", body_preview]
+    text_lines = [
+        intro,
+        "",
+        *[f"{label}: {value}" for label, value in localized_rows],
+        "",
+        body_preview,
+    ]
     if safe_url:
         text_lines.extend(["", safe_url])
-    return EmailContent(subject=subject, text="\n".join(text_lines), html=rendered)
+    return _email_content(subject=subject, text="\n".join(text_lines), layout=rendered)
 
 
 def render_support_new_ticket_admin(
@@ -777,23 +944,25 @@ def render_support_new_ticket_admin(
     snapshot_rows: Sequence[Tuple[str, str]],
     ticket_url: Optional[str],
 ) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language, settings)
     rows = [
-        ("Ticket", f"#{ticket_id}"),
-        ("User", user_display),
-        ("Subject", subject),
+        ("email_support_row_ticket", f"#{ticket_id}"),
+        ("email_support_row_user", user_display),
+        ("email_support_row_subject", subject),
         *snapshot_rows,
     ]
     return _support_email(
         settings,
         i18n,
-        language,
-        subject=f"New support ticket #{ticket_id}",
-        heading=f"New support ticket #{ticket_id}",
-        intro="A user opened a new support ticket.",
+        lang,
+        subject=_t_text(i18n, lang, "email_support_new_ticket_admin_subject", ticket_id=ticket_id),
+        heading=_t_text(i18n, lang, "email_support_new_ticket_admin_heading", ticket_id=ticket_id),
+        intro=_t_text(i18n, lang, "email_support_new_ticket_admin_intro"),
         rows=rows,
         body_preview=body_preview,
         ticket_url=ticket_url,
-        cta_label="Open ticket",
+        cta_label=_t_text(i18n, lang, "email_support_cta_open_ticket"),
     )
 
 
@@ -809,23 +978,25 @@ def render_support_user_reply_admin(
     snapshot_rows: Sequence[Tuple[str, str]],
     ticket_url: Optional[str],
 ) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language, settings)
     rows = [
-        ("Ticket", f"#{ticket_id}"),
-        ("User", user_display),
-        ("Subject", subject),
+        ("email_support_row_ticket", f"#{ticket_id}"),
+        ("email_support_row_user", user_display),
+        ("email_support_row_subject", subject),
         *snapshot_rows,
     ]
     return _support_email(
         settings,
         i18n,
-        language,
-        subject=f"New user reply in ticket #{ticket_id}",
-        heading=f"User replied in ticket #{ticket_id}",
-        intro="A user sent a new support message.",
+        lang,
+        subject=_t_text(i18n, lang, "email_support_user_reply_admin_subject", ticket_id=ticket_id),
+        heading=_t_text(i18n, lang, "email_support_user_reply_admin_heading", ticket_id=ticket_id),
+        intro=_t_text(i18n, lang, "email_support_user_reply_admin_intro"),
         rows=rows,
         body_preview=body_preview,
         ticket_url=ticket_url,
-        cta_label="Open ticket",
+        cta_label=_t_text(i18n, lang, "email_support_cta_open_ticket"),
     )
 
 
@@ -839,17 +1010,22 @@ def render_support_admin_reply_user(
     body_preview: str,
     ticket_url: Optional[str],
 ) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language, settings)
     return _support_email(
         settings,
         i18n,
-        language,
-        subject=f"New reply for ticket #{ticket_id}",
-        heading=f"New reply for ticket #{ticket_id}",
-        intro="Support has replied to your ticket.",
-        rows=[("Ticket", f"#{ticket_id}"), ("Subject", subject)],
+        lang,
+        subject=_t_text(i18n, lang, "email_support_admin_reply_user_subject", ticket_id=ticket_id),
+        heading=_t_text(i18n, lang, "email_support_admin_reply_user_heading", ticket_id=ticket_id),
+        intro=_t_text(i18n, lang, "email_support_admin_reply_user_intro"),
+        rows=[
+            ("email_support_row_ticket", f"#{ticket_id}"),
+            ("email_support_row_subject", subject),
+        ],
         body_preview=body_preview,
         ticket_url=ticket_url,
-        cta_label="Open in Mini App",
+        cta_label=_t_text(i18n, lang, "email_support_cta_open_mini_app"),
     )
 
 
@@ -863,15 +1039,24 @@ def render_support_ticket_closed_user(
     body_preview: str = "",
     ticket_url: Optional[str],
 ) -> EmailContent:
+    i18n = _resolve_i18n(i18n)
+    lang = _normalize_lang(language, settings)
     return _support_email(
         settings,
         i18n,
-        language,
-        subject=f"Ticket #{ticket_id} was closed",
-        heading=f"Ticket #{ticket_id} was closed",
-        intro="Your support ticket has been closed.",
-        rows=[("Ticket", f"#{ticket_id}"), ("Subject", subject)],
-        body_preview=body_preview or "The ticket is closed.",
+        lang,
+        subject=_t_text(
+            i18n, lang, "email_support_ticket_closed_user_subject", ticket_id=ticket_id
+        ),
+        heading=_t_text(
+            i18n, lang, "email_support_ticket_closed_user_heading", ticket_id=ticket_id
+        ),
+        intro=_t_text(i18n, lang, "email_support_ticket_closed_user_intro"),
+        rows=[
+            ("email_support_row_ticket", f"#{ticket_id}"),
+            ("email_support_row_subject", subject),
+        ],
+        body_preview=body_preview or _t_text(i18n, lang, "email_support_ticket_closed_user_body"),
         ticket_url=ticket_url,
-        cta_label="Open in Mini App",
+        cta_label=_t_text(i18n, lang, "email_support_cta_open_mini_app"),
     )

backend/bot/services/locale_override_service.py

@@ -108,6 +108,7 @@ LOCALE_GROUPS = [
         "prefixes": (
             "admin_user_",
             "admin_users_",
+            "admin_hwid_",
             "admin_ban_",
             "admin_unban_",
             "admin_banned_",
@@ -115,6 +116,7 @@ LOCALE_GROUPS = [
             "admin_traffic_grant_",
             "admin_view_banned_",
             "user_card_",
+            "user_hwid_",
             "user_premium_",
             "user_regular_",
             "user_traffic_",
@@ -203,7 +205,6 @@ LOCALE_GROUPS = [
             "admin_settings_field_subscription_mini_app_url",
             "admin_settings_field_support_link",
             "admin_settings_field_server_status_url",
-            "admin_settings_field_terms_",
             "admin_settings_field_privacy_",
             "admin_settings_field_user_agreement_",
             "appearance_",
@@ -231,6 +232,7 @@ LOCALE_GROUPS = [
             "admin_settings_field_cryptopay_",
             "admin_settings_field_wata_",
             "admin_settings_field_heleket_",
+            "admin_settings_field_lava_",
         ),
     },
     {

backend/bot/services/message_audit.py

@@ -0,0 +1,57 @@
+import logging
+from datetime import datetime, timezone
+from typing import Optional
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from db.dal import message_log_dal
+
+logger = logging.getLogger(__name__)
+
+
+def _clean_piece(value: Optional[object]) -> str:
+    return str(value or "").strip()
+
+
+async def log_user_message_delivery(
+    session: AsyncSession,
+    *,
+    target_user_id: Optional[int],
+    event_type: str,
+    channel: str,
+    content: str,
+    recipient: Optional[str] = None,
+    timestamp: Optional[datetime] = None,
+) -> None:
+    """Add a best-effort user log entry for important outbound messages."""
+    clean_event = _clean_piece(event_type)
+    clean_channel = _clean_piece(channel)
+    if not clean_event or not clean_channel:
+        return
+
+    parts = [f"channel={clean_channel}"]
+    clean_recipient = _clean_piece(recipient)
+    if clean_recipient:
+        parts.append(f"recipient={clean_recipient}")
+    clean_content = _clean_piece(content)
+    if clean_content:
+        parts.append(clean_content)
+
+    try:
+        await message_log_dal.create_message_log_no_commit(
+            session,
+            {
+                "user_id": None,
+                "event_type": clean_event,
+                "content": " | ".join(parts)[:4000],
+                "is_admin_event": False,
+                "target_user_id": int(target_user_id) if target_user_id is not None else None,
+                "timestamp": timestamp or datetime.now(timezone.utc),
+            },
+        )
+    except Exception:
+        logger.exception(
+            "Failed to add outbound message audit log for user %s event %s",
+            target_user_id,
+            clean_event,
+        )

backend/bot/services/notification_service.py

@@ -237,11 +237,12 @@ class NotificationService:
         text: str,
         path: str,
         fallback_url: str,
+        web_app_button: bool = True,
     ) -> InlineKeyboardButton:
         webapp_url = self._support_webapp_url(path)
-        if webapp_url:
+        if webapp_url and web_app_button:
             return InlineKeyboardButton(text=text, web_app=WebAppInfo(url=webapp_url))
-        return InlineKeyboardButton(text=text, url=fallback_url)
+        return InlineKeyboardButton(text=text, url=webapp_url or fallback_url)
 
     def _support_text(self, language: Optional[str], key: str, fallback: str) -> str:
         if not self.i18n:
@@ -273,10 +274,10 @@ class NotificationService:
             return []
         rows = []
         for key, label in (
-            ("tariff", "Tariff"),
-            ("end_date", "End date"),
-            ("remaining", "Remaining"),
-            ("panel_status", "Panel status"),
+            ("tariff", "email_support_row_tariff"),
+            ("end_date", "email_support_row_end_date"),
+            ("remaining", "email_support_row_remaining"),
+            ("panel_status", "email_support_row_panel_status"),
         ):
             value = snapshot.get(key)
             if value:
@@ -316,7 +317,14 @@ class NotificationService:
             return enabled
         return self._coerce_bool_setting(raw_value, enabled)
 
-    def _support_keyboard(self, ticket, user, *, admin: bool = True) -> InlineKeyboardMarkup:
+    def _support_keyboard(
+        self,
+        ticket,
+        user,
+        *,
+        admin: bool = True,
+        web_app_buttons: bool = True,
+    ) -> InlineKeyboardMarkup:
         ticket_path = (
             f"/admin/support/{ticket.ticket_id}" if admin else f"/support/{ticket.ticket_id}"
         )
@@ -326,6 +334,7 @@ class NotificationService:
                     text="Открыть тикет",
                     path=ticket_path,
                     fallback_url=self._support_ticket_url(ticket.ticket_id, admin=admin),
+                    web_app_button=web_app_buttons,
                 )
             ]
         ]
@@ -342,12 +351,35 @@ class NotificationService:
                         text="Карточка пользователя",
                         path=user_card_path,
                         fallback_url=self._support_ticket_url(ticket.ticket_id, admin=True),
+                        web_app_button=web_app_buttons,
                     )
                 )
             if profile_row:
                 rows.append(profile_row)
         return InlineKeyboardMarkup(inline_keyboard=rows)
 
+    def _support_log_thread_id(self) -> Optional[int]:
+        return getattr(self.settings, "LOG_SUPPORT_THREAD_ID", None)
+
+    def _support_thread_is_configured(self) -> bool:
+        return bool(getattr(self.settings, "LOG_CHAT_ID", None) and self._support_log_thread_id())
+
+    async def _send_admin_support_telegram(
+        self,
+        message: str,
+        *,
+        admin_markup: InlineKeyboardMarkup,
+        log_markup: InlineKeyboardMarkup,
+    ) -> None:
+        thread_id = self._support_log_thread_id()
+        if not self._support_thread_is_configured():
+            await self._send_to_admins(message, reply_markup=admin_markup)
+        await self._send_to_log_channel(
+            message,
+            thread_id=thread_id,
+            reply_markup=log_markup,
+        )
+
     def _support_user_keyboard(self, ticket, user) -> InlineKeyboardMarkup:
         button_text = self._support_text(
             getattr(user, "language_code", None),
@@ -415,12 +447,12 @@ class NotificationService:
             f"статус: {hd.quote(str(snapshot.get('panel_status') or '—'))}\n\n"
             f"<b>Текст обращения</b>\n{hd.quote(preview)}"
         )
-        keyboard = self._support_keyboard(ticket, user, admin=True)
-        await self._send_to_admins(message, reply_markup=keyboard)
-        await self._send_to_log_channel(
+        admin_keyboard = self._support_keyboard(ticket, user, admin=True)
+        log_keyboard = self._support_keyboard(ticket, user, admin=True, web_app_buttons=False)
+        await self._send_admin_support_telegram(
             message,
-            thread_id=getattr(self.settings, "LOG_SUPPORT_THREAD_ID", None),
-            reply_markup=keyboard,
+            admin_markup=admin_keyboard,
+            log_markup=log_keyboard,
         )
         await self._send_admin_support_email(
             render_support_new_ticket_admin,
@@ -456,13 +488,13 @@ class NotificationService:
             f"💬 <b>Ответ пользователя в тикете #{ticket.ticket_id}</b>\n"
             f"{hd.quote(user_display)}{unread_line}\n\n{hd.quote(preview)}"
         )
-        keyboard = self._support_keyboard(ticket, user, admin=True)
         if send_telegram and getattr(self.settings, "LOG_SUPPORT", True):
-            await self._send_to_admins(text, reply_markup=keyboard)
-            await self._send_to_log_channel(
+            admin_keyboard = self._support_keyboard(ticket, user, admin=True)
+            log_keyboard = self._support_keyboard(ticket, user, admin=True, web_app_buttons=False)
+            await self._send_admin_support_telegram(
                 text,
-                thread_id=getattr(self.settings, "LOG_SUPPORT_THREAD_ID", None),
-                reply_markup=keyboard,
+                admin_markup=admin_keyboard,
+                log_markup=log_keyboard,
             )
         if send_email:
             await self._send_admin_support_email(

backend/bot/services/panel_api_service.py

@@ -15,6 +15,40 @@ from config.settings import Settings
 from db.dal import panel_sync_dal
 from db.models import PanelSyncStatus
 
+# Static endpoint prefixes used as log/metric labels instead of the raw request
+# path. Endpoints embed user identifiers (telegram id, username, email, uuids),
+# so logging the path verbatim would leak private data into log files; the
+# label keeps only the constant prefix. Longest prefixes first so e.g.
+# "/users/by-email/..." does not collapse into "/users".
+_ENDPOINT_LOG_LABELS = (
+    "/users/by-telegram-id",
+    "/users/by-username",
+    "/users/by-email",
+    "/users",
+    "/subscriptions/subpage-config",
+    "/subscription-page-configs",
+    "/hwid/devices/delete",
+    "/hwid/devices",
+    "/system/stats/bandwidth",
+    "/system/stats/nodes",
+    "/system/stats",
+    "/system/tools/happ/encrypt",
+    "/bandwidth-stats/users",
+    "/bandwidth-stats/nodes",
+    "/internal-squads",
+    "/hosts",
+    "/nodes",
+)
+
+
+def _endpoint_log_label(endpoint: str) -> str:
+    """Map a request endpoint to a constant, identifier-free label for logs."""
+    path = "/" + endpoint.split("?", 1)[0].strip("/")
+    for label in _ENDPOINT_LOG_LABELS:
+        if path == label or path.startswith(label + "/"):
+            return label
+    return "/other"
+
 
 class PanelApiService:
     # Status codes returned by _request_once for failures we consider transient
@@ -22,6 +56,11 @@ class PanelApiService:
     _TRANSIENT_STATUS_CODES = (-1, -3)
     _SAFE_METHODS = frozenset({"GET", "HEAD"})
     _RETRY_BACKOFF_SECONDS = 0.5
+    _MIN_TIMEOUT_SECONDS = 0.1
+    _DEFAULT_TOTAL_TIMEOUT_SECONDS = 25.0
+    _DEFAULT_CONNECT_TIMEOUT_SECONDS = 8.0
+    _DEFAULT_SOCK_CONNECT_TIMEOUT_SECONDS = 8.0
+    _DEFAULT_SOCK_READ_TIMEOUT_SECONDS = 15.0
 
     def __init__(self, settings: Settings):
         self.settings = settings
@@ -70,17 +109,46 @@ class PanelApiService:
 
     async def _get_session(self) -> aiohttp.ClientSession:
         if self._session is None or self._session.closed:
-            # Separate connect/read timeouts so a stuck panel does not hold a
-            # bot worker for the full window; total caps worst-case latency.
-            timeout = aiohttp.ClientTimeout(
-                total=15,
-                connect=3,
-                sock_connect=3,
-                sock_read=10,
-            )
-            self._session = aiohttp.ClientSession(timeout=timeout)
+            self._session = aiohttp.ClientSession(timeout=self._client_timeout())
         return self._session
 
+    @classmethod
+    def _timeout_setting(cls, settings: Settings, name: str, default: float) -> float:
+        raw_value = getattr(settings, name, default)
+        try:
+            value = float(raw_value)
+        except (TypeError, ValueError):
+            return default
+        if value <= 0:
+            return default
+        return max(cls._MIN_TIMEOUT_SECONDS, value)
+
+    def _client_timeout(self) -> aiohttp.ClientTimeout:
+        # Separate connect/read timeouts so a slow panel route has more room,
+        # while genuinely stuck requests still cannot pin a worker forever.
+        return aiohttp.ClientTimeout(
+            total=self._timeout_setting(
+                self.settings,
+                "PANEL_API_TOTAL_TIMEOUT_SECONDS",
+                self._DEFAULT_TOTAL_TIMEOUT_SECONDS,
+            ),
+            connect=self._timeout_setting(
+                self.settings,
+                "PANEL_API_CONNECT_TIMEOUT_SECONDS",
+                self._DEFAULT_CONNECT_TIMEOUT_SECONDS,
+            ),
+            sock_connect=self._timeout_setting(
+                self.settings,
+                "PANEL_API_SOCK_CONNECT_TIMEOUT_SECONDS",
+                self._DEFAULT_SOCK_CONNECT_TIMEOUT_SECONDS,
+            ),
+            sock_read=self._timeout_setting(
+                self.settings,
+                "PANEL_API_SOCK_READ_TIMEOUT_SECONDS",
+                self._DEFAULT_SOCK_READ_TIMEOUT_SECONDS,
+            ),
+        )
+
     async def close_session(self):
         if self._session and not self._session.closed:
             await self._session.close()
@@ -121,6 +189,15 @@ class PanelApiService:
         for attempt in range(max_attempts):
             result = await self._request_once(method, endpoint, log_full_response, **kwargs)
             if attempt + 1 < max_attempts and self._is_transient_error(result):
+                logging.warning(
+                    "Retrying transient Panel API request method=%s endpoint=%s "
+                    "attempt=%s/%s status_code=%s",
+                    method.upper(),
+                    _endpoint_log_label(endpoint),
+                    attempt + 1,
+                    max_attempts,
+                    result.get("status_code") if isinstance(result, dict) else None,
+                )
                 await asyncio.sleep(self._RETRY_BACKOFF_SECONDS)
                 continue
             return result
@@ -137,6 +214,7 @@ class PanelApiService:
         headers = await self._prepare_headers()
 
         url_for_request = f"{self.base_url.rstrip('/')}/{endpoint.lstrip('/')}"
+        endpoint_label = _endpoint_log_label(endpoint)
 
         current_params = kwargs.get("params")
         url_with_params_for_log = url_for_request
@@ -158,8 +236,8 @@ class PanelApiService:
                 )
             except Exception:
                 log_prefix += f" | Payload: {str(json_payload_for_log)[:300]}..."
+        started = time.monotonic()
         try:
-            started = time.monotonic()
             async with aiohttp_session.request(
                 method.upper(), url_for_request, headers=headers, **kwargs
             ) as response:
@@ -169,7 +247,7 @@ class PanelApiService:
                     "metric panel_latency_seconds=%.3f method=%s endpoint=%s status=%s",
                     time.monotonic() - started,
                     method.upper(),
-                    endpoint,
+                    endpoint_label,
                     response_status,
                 )
 
@@ -228,17 +306,67 @@ class PanelApiService:
                     return {"error": True, "status_code": response_status, "details": error_details}
 
         except aiohttp.ClientConnectorError as e:
-            logging.error(f"Panel API ClientConnectorError to {url_for_request}: {e}")
+            logging.info(
+                "metric panel_latency_seconds=%.3f method=%s endpoint=%s status=connect_error",
+                time.monotonic() - started,
+                method.upper(),
+                endpoint_label,
+            )
+            logging.error(
+                "Panel API ClientConnectorError method=%s endpoint=%s: %s",
+                method.upper(),
+                endpoint_label,
+                e,
+            )
             return {"error": True, "status_code": -1, "message": f"Connection error: {str(e)}"}
+        except aiohttp.ServerTimeoutError as e:
+            logging.info(
+                "metric panel_latency_seconds=%.3f method=%s endpoint=%s status=timeout",
+                time.monotonic() - started,
+                method.upper(),
+                endpoint_label,
+            )
+            logging.warning(
+                "Panel API timeout method=%s endpoint=%s: %s", method.upper(), endpoint_label, e
+            )
+            return {"error": True, "status_code": -3, "message": f"Request timed out: {str(e)}"}
         except aiohttp.ClientError as e:
-            logging.exception("Panel API ClientError to %s.", url_for_request)
+            logging.info(
+                "metric panel_latency_seconds=%.3f method=%s endpoint=%s status=client_error",
+                time.monotonic() - started,
+                method.upper(),
+                endpoint_label,
+            )
+            logging.exception(
+                "Panel API ClientError method=%s endpoint=%s.", method.upper(), endpoint_label
+            )
             return {"error": True, "status_code": -2, "message": f"Client error: {str(e)}"}
         except asyncio.TimeoutError:
-            logging.error(f"Panel API request to {url_for_request} timed out.")
+            logging.info(
+                "metric panel_latency_seconds=%.3f method=%s endpoint=%s status=timeout",
+                time.monotonic() - started,
+                method.upper(),
+                endpoint_label,
+            )
+            logging.error(
+                "Panel API request timed out method=%s endpoint=%s.",
+                method.upper(),
+                endpoint_label,
+            )
             return {"error": True, "status_code": -3, "message": "Request timed out"}
         except Exception as e:
+            logging.info(
+                "metric panel_latency_seconds=%.3f method=%s endpoint=%s status=unexpected_error",
+                time.monotonic() - started,
+                method.upper(),
+                endpoint_label,
+            )
             logging.error(
-                f"Unexpected Panel API request error to {url_for_request}: {e}", exc_info=True
+                "Unexpected Panel API request error method=%s endpoint=%s: %s",
+                method.upper(),
+                endpoint_label,
+                e,
+                exc_info=True,
             )
             return {"error": True, "status_code": -4, "message": f"Unexpected error: {str(e)}"}
 
@@ -885,7 +1013,14 @@ class PanelApiService:
         await self._devices_cache.invalidate_remote(f"user:{user_uuid}")
 
     async def get_internal_squads(self) -> Optional[List[Dict[str, Any]]]:
-        return await self._squads_cache.get_or_load("list", self._get_internal_squads_uncached)
+        squads = await self._squads_cache.get_or_load("list", self._get_internal_squads_uncached)
+        if squads is not None:
+            return squads
+        stale_squads = self._squads_cache.get_stale("list")
+        if stale_squads is not None:
+            logging.warning("Using stale internal squads cache after panel fetch failed.")
+            return stale_squads
+        return None
 
     async def _get_internal_squads_uncached(self) -> Optional[List[Dict[str, Any]]]:
         response_data = await self._request("GET", "/internal-squads", log_full_response=False)

backend/bot/services/panel_dry_run_api_service.py

@@ -0,0 +1,622 @@
+import json
+import logging
+import re
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime
+from typing import Any, Dict, List, Optional
+
+from config.settings import Settings
+
+from .panel_api_service import PanelApiService
+
+logger = logging.getLogger(__name__)
+
+_USER_ACTION_RE = re.compile(
+    r"^/users/(?P<user_uuid>[^/]+)/actions/(?P<action>enable|disable|reset-traffic)$"
+)
+_INTERNAL_SQUAD_BULK_RE = re.compile(
+    r"^/internal-squads/(?P<squad_uuid>[^/]+)/bulk-actions/"
+    r"(?P<action>add-users|remove-users)$"
+)
+_LIVE_POST_ENDPOINTS = frozenset({"/system/tools/happ/encrypt"})
+_KNOWN_TRAFFIC_STRATEGIES = frozenset({"NO_RESET", "DAY", "WEEK", "MONTH"})
+
+# Constant path templates for intercepted endpoints. The logged path is rebuilt
+# from these literals (never from the raw endpoint) so user/squad UUIDs and any
+# other id-like segment can never reach the log as clear text.
+_USER_ACTION_TEMPLATES = {
+    "enable": "/users/<id>/actions/enable",
+    "disable": "/users/<id>/actions/disable",
+    "reset-traffic": "/users/<id>/actions/reset-traffic",
+}
+_SQUAD_BULK_TEMPLATES = {
+    "add-users": "/internal-squads/<id>/bulk-actions/add-users",
+    "remove-users": "/internal-squads/<id>/bulk-actions/remove-users",
+}
+# Exact intercepted endpoints that carry no id and are safe to log verbatim.
+# Mapped to themselves so the logged value comes from this literal table, not
+# from the (tainted) request endpoint.
+_SAFE_LITERAL_ENDPOINTS = {
+    "/users": "/users",
+    "/hwid/devices/delete": "/hwid/devices/delete",
+}
+
+# Panel payloads can carry proxy credentials (e.g. trojanPassword, ssPassword,
+# vless/vmess uuids) and PII (email, telegramId). Redact such values before they
+# reach the dry-run log so secrets are never written in clear text.
+_SENSITIVE_KEY_RE = re.compile(
+    r"pass|pwd|secret|token|key|credential|auth|cookie|session|"
+    r"email|mail|phone|telegram|mnemonic",
+    re.IGNORECASE,
+)
+# Field names the dry-run validator understands. Keys are echoed into the log
+# only via this table (value == name), so the logged key is always a literal and
+# never the raw, source-derived dict key. Unknown keys collapse to "<field>".
+_FIELD_LABELS = {
+    name: name
+    for name in (
+        "uuid",
+        "username",
+        "status",
+        "expireAt",
+        "trafficLimitBytes",
+        "trafficLimitStrategy",
+        "hwidDeviceLimit",
+        "telegramId",
+        "email",
+        "description",
+        "tag",
+        "activeInternalSquads",
+        "activeUserInbounds",
+        "externalSquadUuid",
+        "userUuid",
+        "userUuids",
+        "users",
+        "hwid",
+    )
+}
+_REDACTED = "***"
+_UNKNOWN_FIELD = "<field>"
+_UNKNOWN_ENDPOINT = "<other>"
+
+
+@dataclass
+class _DryRunValidation:
+    errors: List[str] = field(default_factory=list)
+
+    @property
+    def ok(self) -> bool:
+        return not self.errors
+
+    def add(self, message: str) -> None:
+        self.errors.append(message)
+
+
+class PanelDryRunApiService(PanelApiService):
+    """Panel API client that reads live data but never mutates Remnawave users."""
+
+    def __init__(self, settings: Settings):
+        super().__init__(settings)
+        self._synthetic_users: Dict[str, Dict[str, Any]] = {}
+
+    async def _request(
+        self, method: str, endpoint: str, log_full_response: bool = False, **kwargs
+    ) -> Optional[Dict[str, Any]]:
+        method_upper = method.upper()
+        normalized_endpoint = self._normalize_endpoint(endpoint)
+        if not self._should_intercept(method_upper, normalized_endpoint):
+            return await super()._request(
+                method_upper,
+                endpoint,
+                log_full_response=log_full_response,
+                **kwargs,
+            )
+
+        validation = await self._validate_dry_run_request(
+            method_upper,
+            normalized_endpoint,
+            kwargs.get("json"),
+        )
+        if not validation.ok:
+            self._log_dry_run(
+                "BLOCKED",
+                method_upper,
+                normalized_endpoint,
+                kwargs.get("json"),
+                errors=validation.errors,
+            )
+            return {
+                "error": True,
+                "status_code": 400,
+                "errorCode": "DRY_RUN_VALIDATION_FAILED",
+                "message": "Panel dry-run validation failed.",
+                "details": {"errors": validation.errors},
+            }
+
+        response = await self._dry_run_response(
+            method_upper,
+            normalized_endpoint,
+            kwargs.get("json"),
+        )
+        self._log_dry_run("OK", method_upper, normalized_endpoint, kwargs.get("json"))
+        return {"response": response, "dryRun": True}
+
+    @staticmethod
+    def _normalize_endpoint(endpoint: str) -> str:
+        return f"/{str(endpoint or '').lstrip('/')}"
+
+    @staticmethod
+    def _safe_endpoint(endpoint: str) -> str:
+        """Map the request path to a constant log label.
+
+        Every return value comes from a literal template/table, never from the
+        (tainted) endpoint itself, so user/squad UUIDs and any other id-like
+        segment can never reach the log as clear text. The raw path is only
+        matched against, not echoed.
+        """
+        raw = str(endpoint or "")
+        if match := _USER_ACTION_RE.match(raw):
+            return _USER_ACTION_TEMPLATES.get(match.group("action"), "/users/<id>/actions/<action>")
+        if match := _INTERNAL_SQUAD_BULK_RE.match(raw):
+            return _SQUAD_BULK_TEMPLATES.get(
+                match.group("action"), "/internal-squads/<id>/bulk-actions/<action>"
+            )
+        literal = _SAFE_LITERAL_ENDPOINTS.get(raw)
+        if literal is not None:
+            return literal
+        if raw.startswith("/users/"):
+            return "/users/<id>"
+        if raw.startswith("/internal-squads/"):
+            return "/internal-squads/<id>"
+        return _UNKNOWN_ENDPOINT
+
+    @staticmethod
+    def _summarize_leaf(value: Any) -> Any:
+        """Reduce a scalar to a non-sensitive type token.
+
+        Leaf values can carry PII or proxy credentials, so the log never echoes
+        them — only their JSON type. ``None`` is kept so absent fields stay
+        distinguishable from present ones.
+        """
+        if value is None:
+            return None
+        if isinstance(value, bool):
+            return "<bool>"
+        if isinstance(value, int):
+            return "<int>"
+        if isinstance(value, float):
+            return "<float>"
+        if isinstance(value, str):
+            return "<str>"
+        return f"<{type(value).__name__}>"
+
+    @staticmethod
+    def _safe_key(key: Any) -> str:
+        """Return a constant label for a payload key.
+
+        Known field names are echoed from the ``_FIELD_LABELS`` table (the value,
+        not the source-derived key); anything else collapses to ``<field>``. This
+        keeps the raw dict key out of the log entirely.
+        """
+        if isinstance(key, str):
+            return _FIELD_LABELS.get(key, _UNKNOWN_FIELD)
+        return _UNKNOWN_FIELD
+
+    @classmethod
+    def _redact(cls, value: Any, _depth: int = 0) -> Any:
+        """Recursively summarize values, keeping only the JSON shape.
+
+        Keys are replaced by constant labels, sensitive keys collapse to a
+        placeholder, and every scalar leaf becomes a type token. The result shows
+        which fields a mutation would touch without logging any source-derived
+        string (key or value).
+        """
+        if _depth > 6:
+            return "..."
+        if isinstance(value, dict):
+            return {
+                cls._safe_key(k): (
+                    _REDACTED
+                    if isinstance(k, str) and _SENSITIVE_KEY_RE.search(k)
+                    else cls._redact(v, _depth + 1)
+                )
+                for k, v in value.items()
+            }
+        if isinstance(value, (list, tuple)):
+            return [cls._redact(item, _depth + 1) for item in value]
+        return cls._summarize_leaf(value)
+
+    @classmethod
+    def _payload_preview(cls, payload: Any) -> str:
+        redacted = cls._redact(payload)
+        try:
+            text = json.dumps(redacted, ensure_ascii=False, default=str, sort_keys=True)
+        except Exception:
+            text = str(redacted)
+        if len(text) > 1200:
+            return f"{text[:1200]}..."
+        return text
+
+    def _log_dry_run(
+        self,
+        status: str,
+        method: str,
+        endpoint: str,
+        payload: Any,
+        *,
+        errors: Optional[List[str]] = None,
+    ) -> None:
+        logger.info(
+            "[PANEL DRY-RUN %s] would %s %s payload=%s%s",
+            status,
+            method,
+            self._safe_endpoint(endpoint),
+            self._payload_preview(payload),
+            f" errors={errors}" if errors else "",
+        )
+
+    @staticmethod
+    def _should_intercept(method: str, endpoint: str) -> bool:
+        if method in PanelApiService._SAFE_METHODS:
+            return False
+        if method == "POST" and endpoint in _LIVE_POST_ENDPOINTS:
+            return False
+        return True
+
+    async def _validate_dry_run_request(
+        self,
+        method: str,
+        endpoint: str,
+        payload: Any,
+    ) -> _DryRunValidation:
+        validation = _DryRunValidation()
+        data = payload if isinstance(payload, dict) else {}
+        if payload is not None and not isinstance(payload, dict):
+            validation.add("JSON payload must be an object.")
+            return validation
+
+        if method == "POST" and endpoint == "/users":
+            await self._validate_create_user_payload(data, validation)
+            return validation
+        if method == "PATCH" and endpoint == "/users":
+            await self._validate_update_user_payload(data, validation)
+            return validation
+        if method == "POST" and (match := _USER_ACTION_RE.match(endpoint)):
+            user_uuid = match.group("user_uuid")
+            self._validate_non_empty_string(user_uuid, "user uuid", validation)
+            await self._validate_remote_user(user_uuid, validation)
+            return validation
+        if method == "DELETE" and endpoint.startswith("/users/"):
+            user_uuid = endpoint.removeprefix("/users/").strip()
+            self._validate_non_empty_string(user_uuid, "user uuid", validation)
+            await self._validate_remote_user(user_uuid, validation)
+            return validation
+        if method == "POST" and endpoint == "/hwid/devices/delete":
+            user_uuid = self._validate_non_empty_string(
+                data.get("userUuid"),
+                "userUuid",
+                validation,
+            )
+            self._validate_non_empty_string(data.get("hwid"), "hwid", validation)
+            await self._validate_remote_user(user_uuid, validation)
+            return validation
+        if match := _INTERNAL_SQUAD_BULK_RE.match(endpoint):
+            squad_uuid = match.group("squad_uuid")
+            self._validate_non_empty_string(squad_uuid, "squad uuid", validation)
+            user_uuids = self._validate_string_list(data.get("userUuids"), "userUuids", validation)
+            if not user_uuids:
+                user_uuids = self._validate_string_list(data.get("users"), "users", validation)
+            await self._validate_remote_squads([squad_uuid], validation)
+            for user_uuid in user_uuids:
+                await self._validate_remote_user(user_uuid, validation)
+            return validation
+
+        if payload is None:
+            return validation
+        self._validate_json_serializable(payload, validation)
+        return validation
+
+    async def _validate_create_user_payload(
+        self,
+        payload: Dict[str, Any],
+        validation: _DryRunValidation,
+    ) -> None:
+        username = self._validate_non_empty_string(payload.get("username"), "username", validation)
+        if username and (
+            not (3 <= len(username) <= 36) or not re.match(r"^[A-Za-z0-9_-]+$", username)
+        ):
+            validation.add("username must be 3-36 chars and contain only A-Z, 0-9, _ or -.")
+        self._validate_user_mutation_payload(payload, validation, require_uuid=False)
+        await self._validate_remote_squads(
+            self._validate_string_list(
+                payload.get("activeInternalSquads"),
+                "activeInternalSquads",
+                validation,
+                required=False,
+            ),
+            validation,
+        )
+        if not bool(getattr(self.settings, "PANEL_DRY_RUN_SYNTHETIC_CREATE", True)):
+            validation.add("PANEL_DRY_RUN_SYNTHETIC_CREATE is disabled.")
+        if self._remote_validation_enabled and username:
+            await self._validate_create_uniqueness(payload, validation)
+
+    async def _validate_update_user_payload(
+        self,
+        payload: Dict[str, Any],
+        validation: _DryRunValidation,
+    ) -> None:
+        user_uuid = self._validate_non_empty_string(payload.get("uuid"), "uuid", validation)
+        self._validate_user_mutation_payload(payload, validation, require_uuid=True)
+        await self._validate_remote_user(user_uuid, validation)
+        await self._validate_remote_squads(
+            self._validate_string_list(
+                payload.get("activeInternalSquads"),
+                "activeInternalSquads",
+                validation,
+                required=False,
+            ),
+            validation,
+        )
+
+    def _validate_user_mutation_payload(
+        self,
+        payload: Dict[str, Any],
+        validation: _DryRunValidation,
+        *,
+        require_uuid: bool,
+    ) -> None:
+        if require_uuid:
+            self._validate_non_empty_string(payload.get("uuid"), "uuid", validation)
+        if "expireAt" in payload:
+            self._validate_datetime(payload.get("expireAt"), "expireAt", validation)
+        if "trafficLimitBytes" in payload:
+            self._validate_non_negative_int(
+                payload.get("trafficLimitBytes"),
+                "trafficLimitBytes",
+                validation,
+            )
+        if "trafficLimitStrategy" in payload:
+            strategy = self._validate_non_empty_string(
+                payload.get("trafficLimitStrategy"),
+                "trafficLimitStrategy",
+                validation,
+            )
+            if strategy and strategy.upper() not in _KNOWN_TRAFFIC_STRATEGIES:
+                validation.add(f"trafficLimitStrategy {strategy!r} is not supported.")
+        if "hwidDeviceLimit" in payload:
+            self._validate_non_negative_int(
+                payload.get("hwidDeviceLimit"),
+                "hwidDeviceLimit",
+                validation,
+            )
+        if "telegramId" in payload:
+            self._validate_positive_int(payload.get("telegramId"), "telegramId", validation)
+        if "email" in payload and payload.get("email") is not None:
+            self._validate_non_empty_string(payload.get("email"), "email", validation)
+        if "externalSquadUuid" in payload and payload.get("externalSquadUuid") is not None:
+            self._validate_non_empty_string(
+                payload.get("externalSquadUuid"),
+                "externalSquadUuid",
+                validation,
+            )
+        self._validate_json_serializable(payload, validation)
+
+    @property
+    def _remote_validation_enabled(self) -> bool:
+        return bool(getattr(self.settings, "PANEL_DRY_RUN_VALIDATE_REMOTE", True))
+
+    async def _validate_remote_user(
+        self,
+        user_uuid: Optional[str],
+        validation: _DryRunValidation,
+    ) -> Optional[Dict[str, Any]]:
+        if not user_uuid or not self._remote_validation_enabled:
+            return self._synthetic_users.get(str(user_uuid or ""))
+        user = self._synthetic_users.get(str(user_uuid))
+        if user:
+            return user
+        try:
+            user = await super().get_user_by_uuid(str(user_uuid), log_response=False)
+        except Exception as exc:
+            validation.add(f"failed to validate panel user {user_uuid}: {type(exc).__name__}")
+            return None
+        if not user:
+            validation.add(f"panel user {user_uuid} was not found.")
+        return user
+
+    async def _validate_remote_squads(
+        self,
+        squad_uuids: List[str],
+        validation: _DryRunValidation,
+    ) -> None:
+        if not squad_uuids or not self._remote_validation_enabled:
+            return
+        try:
+            squads = await super().get_internal_squads()
+        except Exception as exc:
+            validation.add(f"failed to validate panel squads: {type(exc).__name__}")
+            return
+        if squads is None:
+            validation.add("failed to validate panel squads: empty panel response.")
+            return
+        known = {
+            str(squad.get("uuid") or squad.get("id") or "").strip()
+            for squad in squads
+            if isinstance(squad, dict)
+        }
+        missing = sorted({squad_uuid for squad_uuid in squad_uuids if squad_uuid not in known})
+        if missing:
+            validation.add(f"panel squads were not found: {', '.join(missing)}.")
+
+    async def _validate_create_uniqueness(
+        self,
+        payload: Dict[str, Any],
+        validation: _DryRunValidation,
+    ) -> None:
+        checks = (
+            ("username", "username", payload.get("username")),
+            ("telegramId", "telegram_id", payload.get("telegramId")),
+            ("email", "email", payload.get("email")),
+        )
+        for label, argument_name, value in checks:
+            if value in (None, ""):
+                continue
+            try:
+                users = await super().get_users_by_filter(**{argument_name: value})
+            except Exception as exc:
+                validation.add(f"failed to validate unique {label}: {type(exc).__name__}")
+                continue
+            if users:
+                validation.add(f"panel user with {label} {value!r} already exists.")
+
+    @staticmethod
+    def _validate_non_empty_string(
+        value: Any,
+        name: str,
+        validation: _DryRunValidation,
+    ) -> Optional[str]:
+        if not isinstance(value, str) or not value.strip():
+            validation.add(f"{name} must be a non-empty string.")
+            return None
+        return value.strip()
+
+    @staticmethod
+    def _validate_string_list(
+        value: Any,
+        name: str,
+        validation: _DryRunValidation,
+        *,
+        required: bool = True,
+    ) -> List[str]:
+        if value is None:
+            if required:
+                validation.add(f"{name} must be a list of strings.")
+            return []
+        if not isinstance(value, list):
+            validation.add(f"{name} must be a list of strings.")
+            return []
+        result = []
+        for item in value:
+            if not isinstance(item, str) or not item.strip():
+                validation.add(f"{name} contains an empty or non-string value.")
+                continue
+            result.append(item.strip())
+        return result
+
+    @staticmethod
+    def _validate_non_negative_int(
+        value: Any,
+        name: str,
+        validation: _DryRunValidation,
+    ) -> None:
+        try:
+            parsed = int(value)
+        except (TypeError, ValueError):
+            validation.add(f"{name} must be an integer.")
+            return
+        if parsed < 0:
+            validation.add(f"{name} must be >= 0.")
+
+    @staticmethod
+    def _validate_positive_int(value: Any, name: str, validation: _DryRunValidation) -> None:
+        try:
+            parsed = int(value)
+        except (TypeError, ValueError):
+            validation.add(f"{name} must be an integer.")
+            return
+        if parsed <= 0:
+            validation.add(f"{name} must be > 0.")
+
+    @staticmethod
+    def _validate_datetime(value: Any, name: str, validation: _DryRunValidation) -> None:
+        if not isinstance(value, str) or not value.strip():
+            validation.add(f"{name} must be an ISO datetime string.")
+            return
+        try:
+            datetime.fromisoformat(value.replace("Z", "+00:00"))
+        except ValueError:
+            validation.add(f"{name} must be a valid ISO datetime string.")
+
+    @staticmethod
+    def _validate_json_serializable(value: Any, validation: _DryRunValidation) -> None:
+        try:
+            json.dumps(value, default=str)
+        except (TypeError, ValueError):
+            validation.add("payload must be JSON serializable.")
+
+    async def _dry_run_response(
+        self,
+        method: str,
+        endpoint: str,
+        payload: Any,
+    ) -> Dict[str, Any]:
+        data = payload if isinstance(payload, dict) else {}
+        if method == "POST" and endpoint == "/users":
+            return self._dry_run_create_user_response(data)
+        if method == "PATCH" and endpoint == "/users":
+            return await self._dry_run_patch_user_response(data)
+        if method == "POST" and (match := _USER_ACTION_RE.match(endpoint)):
+            return self._dry_run_user_action_response(
+                match.group("user_uuid"),
+                match.group("action"),
+            )
+        if method == "DELETE" and endpoint.startswith("/users/"):
+            return {"uuid": endpoint.removeprefix("/users/"), "deleted": True, "dryRun": True}
+        if method == "POST" and endpoint == "/hwid/devices/delete":
+            return {"userUuid": data.get("userUuid"), "hwid": data.get("hwid"), "dryRun": True}
+        if match := _INTERNAL_SQUAD_BULK_RE.match(endpoint):
+            return {
+                "squadUuid": match.group("squad_uuid"),
+                "action": match.group("action"),
+                "users": data.get("userUuids") or data.get("users") or [],
+                "dryRun": True,
+            }
+        return {"dryRun": True}
+
+    def _dry_run_create_user_response(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        identity = ":".join(
+            str(payload.get(key) or "") for key in ("username", "telegramId", "email")
+        )
+        user_uuid = str(uuid.uuid5(uuid.NAMESPACE_URL, f"remnawave-minishop:dry-run:{identity}"))
+        short_uuid = user_uuid.split("-")[0]
+        response = {
+            **payload,
+            "uuid": user_uuid,
+            "shortUuid": short_uuid,
+            "subscriptionUuid": short_uuid,
+            "subscriptionUrl": self._subscription_url(short_uuid),
+            "dryRun": True,
+        }
+        self._synthetic_users[user_uuid] = response
+        return response
+
+    async def _dry_run_patch_user_response(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        user_uuid = str(payload.get("uuid") or "")
+        existing = self._synthetic_users.get(user_uuid)
+        if not existing and self._remote_validation_enabled:
+            try:
+                existing = await super().get_user_by_uuid(user_uuid, log_response=False)
+            except Exception:
+                existing = None
+        response = {**(existing or {"uuid": user_uuid}), **payload, "dryRun": True}
+        if user_uuid in self._synthetic_users:
+            self._synthetic_users[user_uuid] = response
+        return response
+
+    @staticmethod
+    def _dry_run_user_action_response(user_uuid: str, action: str) -> Dict[str, Any]:
+        response: Dict[str, Any] = {"uuid": user_uuid, "action": action, "dryRun": True}
+        if action == "enable":
+            response["status"] = "ACTIVE"
+        elif action == "disable":
+            response["status"] = "DISABLED"
+        elif action == "reset-traffic":
+            response["userTraffic"] = {"usedTrafficBytes": 0}
+        return response
+
+    def _subscription_url(self, short_uuid: str) -> Optional[str]:
+        if not self.settings.PANEL_API_URL:
+            return None
+        return f"{self.settings.PANEL_API_URL.rstrip('/')}/sub/{short_uuid}"

backend/bot/services/promo_code_service.py

@@ -38,8 +38,12 @@ class PromoCodeService:
         user_lang: str,
     ) -> Tuple[bool, datetime | str]:
         _ = lambda k, **kw: self.i18n.gettext(user_lang, k, **kw)
-        code_input_upper = (code_input or "").strip().upper()[:100]
-        code_display = html_escape(code_input_upper[:100], quote=False)
+        preserve_case = bool(
+            getattr(self.settings, "MIGRATION_REMNASHOP_PROMO_CODE_COMPAT_ENABLED", False)
+        )
+        code_input_clean = (code_input or "").strip()[:100]
+        lookup_code = code_input_clean if preserve_case else code_input_clean.upper()
+        code_display = html_escape(lookup_code[:100], quote=False)
         throttle_identifier = self._throttle_identifier(user_id)
 
         throttle = await security_dal.check_throttle(
@@ -54,7 +58,7 @@ class PromoCodeService:
             )
 
         promo_data = await promo_code_dal.get_active_promo_code_by_code_str(
-            session, code_input_upper
+            session, lookup_code, preserve_case=preserve_case
         )
 
         if not promo_data:
@@ -74,6 +78,8 @@ class PromoCodeService:
                 )
             return False, _("promo_code_not_found", code=code_display)
 
+        applied_code = str(promo_data.code or lookup_code)
+        code_display = html_escape(applied_code[:100], quote=False)
         existing_activation = await promo_code_dal.get_user_activation_for_promo(
             session, promo_data.promo_code_id, user_id
         )
@@ -81,12 +87,17 @@ class PromoCodeService:
             return False, _("promo_code_already_used_by_user", code=code_display)
 
         bonus_days = promo_data.bonus_days
+        default_tariff_key = None
+        tariffs_config = getattr(self.settings, "tariffs_config", None)
+        if tariffs_config:
+            default_tariff_key = getattr(tariffs_config, "default_tariff", None)
 
         new_end_date = await self.subscription_service.extend_active_subscription_days(
             session=session,
             user_id=user_id,
             bonus_days=bonus_days,
-            reason=f"promo code {code_input_upper}",
+            reason=f"promo code {applied_code}",
+            tariff_key=default_tariff_key,
         )
 
         if new_end_date:
@@ -109,7 +120,7 @@ class PromoCodeService:
                     user = await user_dal.get_user_by_id(session, user_id)
                     await notification_service.notify_promo_activation(
                         user_id=user_id,
-                        promo_code=code_input_upper,
+                        promo_code=applied_code,
                         bonus_days=bonus_days,
                         username=user.username if user else None,
                         email=getattr(user, "email", None) if user else None,

backend/bot/services/referral_service.py

@@ -197,6 +197,9 @@ class ReferralService:
                                     "status_from_panel": "ACTIVE_BONUS",
                                     "traffic_limit_bytes": self.settings.user_traffic_limit_bytes,
                                     "auto_renew_enabled": False,
+                                    # Short bonus grant: warn only hours before it
+                                    # ends, not days ahead. A real payment clears this.
+                                    "suppress_early_expiry_notifications": True,
                                 }
                                 try:
                                     await subscription_dal.deactivate_other_active_subscriptions(

backend/bot/services/settings_override_service.py

@@ -28,10 +28,7 @@ from db.dal import app_settings_dal
 logger = logging.getLogger(__name__)
 
 APPEARANCE_OVERRIDE_KEYS = {
-    "WEBAPP_LOGO_USE_EMOJI",
     "WEBAPP_LOGO_URL",
-    "WEBAPP_LOGO_EMOJI",
-    "WEBAPP_LOGO_EMOJI_FONT",
     "WEBAPP_FAVICON_USE_CUSTOM",
     "WEBAPP_FAVICON_URL",
     "WEBAPP_LOGO_FAVICON_URL",
@@ -167,12 +164,6 @@ def _appearance_snapshot(settings: Settings) -> Dict[str, Any]:
         snapshot["WEBAPP_FAVICON_URL"] = favicon_url
     if getattr(settings, "WEBAPP_FAVICON_USE_CUSTOM", False):
         snapshot["WEBAPP_FAVICON_USE_CUSTOM"] = True
-    if getattr(settings, "WEBAPP_LOGO_USE_EMOJI", False):
-        snapshot["WEBAPP_LOGO_USE_EMOJI"] = True
-        snapshot["WEBAPP_LOGO_EMOJI"] = getattr(settings, "WEBAPP_LOGO_EMOJI", "")
-        emoji_font = getattr(settings, "WEBAPP_LOGO_EMOJI_FONT", "")
-        if emoji_font and emoji_font != "system":
-            snapshot["WEBAPP_LOGO_EMOJI_FONT"] = emoji_font
     primary_color = getattr(settings, "WEBAPP_PRIMARY_COLOR", None)
     if primary_color and primary_color != "#00fe7a":
         snapshot["WEBAPP_PRIMARY_COLOR"] = primary_color

backend/bot/services/subscription_lifecycle_notifications.py

@@ -13,6 +13,7 @@ from bot.keyboards.inline.user_keyboards import get_subscribe_only_markup
 from bot.middlewares.i18n import JsonI18n
 from bot.services.email_auth_service import EmailAuthService
 from bot.services.email_templates import render_subscription_lifecycle_notification
+from bot.services.message_audit import log_user_message_delivery
 from bot.services.telegram_notifications import (
     TELEGRAM_NOTIFICATIONS_BLOCKED,
     TELEGRAM_NOTIFICATIONS_ENABLED,
@@ -188,6 +189,18 @@ class SubscriptionLifecycleNotificationService:
             self._channel_key(stage.key, "telegram"),
             sent_at=sent_at,
         )
+        await log_user_message_delivery(
+            session,
+            target_user_id=getattr(sub, "user_id", None),
+            event_type="telegram_subscription_notification_sent",
+            channel="telegram",
+            recipient=str(chat_id),
+            content=(
+                f"stage={stage.key} message_key={stage.message_key} "
+                f"subscription_id={getattr(sub, 'subscription_id', '')}"
+            ),
+            timestamp=sent_at,
+        )
         if user:
             status = normalize_telegram_notification_status(
                 getattr(user, "telegram_notifications_status", None)
@@ -253,6 +266,18 @@ class SubscriptionLifecycleNotificationService:
             self._channel_key(stage.key, "email"),
             sent_at=sent_at,
         )
+        await log_user_message_delivery(
+            session,
+            target_user_id=getattr(sub, "user_id", None),
+            event_type="email_subscription_notification_sent",
+            channel="email",
+            recipient=recipient,
+            content=(
+                f"stage={stage.key} message_key={stage.message_key} "
+                f"subscription_id={getattr(sub, 'subscription_id', '')}"
+            ),
+            timestamp=sent_at,
+        )
         return True
 
     async def _already_sent(

backend/bot/services/subscription_notification_worker.py

@@ -13,6 +13,7 @@ from sqlalchemy.orm import selectinload, sessionmaker
 from bot.infra.redis import redis_lock
 from bot.keyboards.inline.user_keyboards import get_subscribe_only_markup
 from bot.middlewares.i18n import JsonI18n
+from bot.services.message_audit import log_user_message_delivery
 from bot.services.panel_api_service import PanelApiService
 from bot.services.subscription_lifecycle_notifications import (
     SubscriptionLifecycleNotificationService,
@@ -152,6 +153,15 @@ class SubscriptionNotificationWorker:
                     hours_before=hours_before,
                 )
 
+            # Trial and registration/referral-bonus subscriptions last only a
+            # few days, so a multi-day "ending soon" reminder would fire almost
+            # the moment they are granted and needlessly alarm newcomers. Skip
+            # the day-before stages for them — they still get the hours-before
+            # reminder above and the expiry/after-expiry notices below. Paying
+            # for a real subscription clears the flag and restores all stages.
+            if bool(getattr(sub, "suppress_early_expiry_notifications", False)):
+                return None
+
             days_before_limit = max(
                 0,
                 int(getattr(self.settings, "SUBSCRIPTION_NOTIFY_DAYS_BEFORE", 0) or 0),
@@ -331,6 +341,17 @@ class SubscriptionNotificationWorker:
                     parse_mode="HTML",
                 )
                 telegram_sent = True
+                await log_user_message_delivery(
+                    session,
+                    target_user_id=user_id,
+                    event_type="telegram_traffic_warning_sent",
+                    channel="telegram",
+                    recipient=str(telegram_chat_id),
+                    content=(
+                        "kind=trial warning_key=trial_traffic_depleted "
+                        f"used_bytes={used} limit_bytes={limit}"
+                    ),
+                )
             except Exception as exc:
                 status = telegram_notification_status_from_error(exc)
                 if status and user and user_id:
@@ -355,6 +376,12 @@ class SubscriptionNotificationWorker:
                 subject_key="email_trial_traffic_depleted_subject",
                 message_text=message_text,
                 dashboard_url=(getattr(self.settings, "SUBSCRIPTION_MINI_APP_URL", "") or None),
+                session=session,
+                audit_event_type="email_traffic_warning_sent",
+                audit_content=(
+                    "kind=trial warning_key=trial_traffic_depleted "
+                    f"used_bytes={used} limit_bytes={limit}"
+                ),
             )
         return {"telegram": telegram_sent, "email": email_sent}
 

backend/bot/services/subscription_service_impl/_runtime.py

@@ -11,7 +11,11 @@ from bot.middlewares.i18n import JsonI18n
 from bot.utils.config_link import prepare_config_links
 from bot.utils.date_utils import add_months, month_start
 from config.settings import Settings
-from config.tariffs_config import Tariff
+from config.tariffs_config import (
+    Tariff,
+    default_currency_key_for_settings,
+    default_payment_currency_code_for_settings,
+)
 from db.dal import (
     payment_dal,
     promo_code_dal,

backend/bot/services/subscription_service_impl/devices.py

@@ -31,6 +31,49 @@ class HwidDeviceMixin:
             )
             return int(getattr(sub, "extra_hwid_devices", 0) or 0)
 
+    async def sync_hwid_device_limit_to_panel(
+        self,
+        session: AsyncSession,
+        user_id: int,
+    ) -> Optional[int]:
+        """Push the current local HWID device limit override to the panel."""
+        db_user = await user_dal.get_user_by_id(session, user_id)
+        if not db_user or not db_user.panel_user_uuid:
+            return None
+        sub = await subscription_dal.get_active_subscription_by_user_id(
+            session, user_id, db_user.panel_user_uuid
+        )
+        if not sub:
+            return None
+
+        tariff = self._resolve_tariff(sub.tariff_key) if sub.tariff_key else None
+        base_hwid_limit = (
+            int(sub.hwid_device_limit)
+            if sub.hwid_device_limit is not None
+            else self._base_hwid_limit_for_tariff(tariff)
+        )
+        extra_hwid_devices = await self._active_hwid_extra_devices_for_sub(session, sub)
+        sub.extra_hwid_devices = extra_hwid_devices
+        effective_hwid_limit = self._effective_hwid_limit(base_hwid_limit, extra_hwid_devices)
+        if effective_hwid_limit is None:
+            return None
+
+        panel_payload = self._build_panel_update_payload(
+            panel_user_uuid=db_user.panel_user_uuid,
+            expire_at=sub.end_date,
+            status="ACTIVE",
+            hwid_device_limit=effective_hwid_limit,
+            include_default_squads=False,
+        )
+        panel_payload.update(self._panel_identity_payload_for_user(db_user))
+        try:
+            await self.panel_service.update_user_details_on_panel(
+                db_user.panel_user_uuid, panel_payload
+            )
+        except Exception:
+            logging.exception("sync_hwid_device_limit_to_panel failed for user %s", user_id)
+        return effective_hwid_limit
+
     async def _hwid_topup_validity_window(
         self,
         session: AsyncSession,
@@ -70,9 +113,67 @@ class HwidDeviceMixin:
         package_set = tariff.hwid_device_packages
         if not package_set:
             return None
-        packages = package_set.for_currency("stars" if currency == "stars" else "rub")
+        packages = package_set.for_currency(currency)
         return next((pkg for pkg in packages if int(pkg.count) == int(device_count)), None)
 
+    @staticmethod
+    def _quote_hwid_full_period_package_price(
+        tariff: Tariff,
+        *,
+        device_count: int,
+        period_months: int,
+        currency: str,
+    ) -> Optional[Dict[str, Any]]:
+        package_set = tariff.hwid_device_packages
+        if not package_set:
+            return None
+        try:
+            target_count = int(device_count)
+            months = max(1, int(period_months))
+        except (TypeError, ValueError):
+            return None
+        if target_count <= 0:
+            return None
+
+        packages = [
+            package
+            for package in package_set.for_currency(currency)
+            if int(getattr(package, "count", 0) or 0) > 0
+        ]
+        if not packages:
+            return None
+
+        best: Dict[int, tuple[float, List[Any]]] = {0: (0.0, [])}
+        for count in range(1, target_count + 1):
+            best_for_count: Optional[tuple[float, List[Any]]] = None
+            for package in packages:
+                package_count = int(package.count)
+                previous = best.get(count - package_count)
+                if previous is None:
+                    continue
+                price = previous[0] + float(package.price_for_period(months))
+                selected = [*previous[1], package]
+                if best_for_count is None or price < best_for_count[0]:
+                    best_for_count = (price, selected)
+            if best_for_count is not None:
+                best[count] = best_for_count
+
+        resolved = best.get(target_count)
+        if resolved is None:
+            return None
+        full_price, selected_packages = resolved
+        rounded_price = HwidDeviceMixin._round_hwid_price(full_price, currency=currency)
+        if currency == "stars":
+            rounded_price = float(int(math.ceil(rounded_price)))
+        return {
+            "price": rounded_price,
+            "full_price": float(full_price),
+            "pricing_period_months": months,
+            "proration_ratio": 1.0,
+            "currency": currency,
+            "package_counts": [int(package.count) for package in selected_packages],
+        }
+
     def _quote_hwid_package_price(
         self,
         *,
@@ -85,16 +186,10 @@ class HwidDeviceMixin:
     ) -> Dict[str, Any]:
         period_months = max(1, int(getattr(sub, "duration_months", None) or 1))
         full_price = float(package.price_for_period(period_months))
-        period_start = self._as_aware_utc(getattr(sub, "start_date", None))
-        period_end = self._as_aware_utc(getattr(sub, "end_date", None)) or valid_until
-        inferred_period_start = add_months(period_end, -period_months)
-        if not period_start or period_start >= period_end or period_start < inferred_period_start:
-            period_start = inferred_period_start
-
-        basis_seconds = max(1.0, (period_end - period_start).total_seconds())
+        basis_seconds = max(1.0, float(period_months * 30 * 24 * 60 * 60))
         billable_start = max(now, valid_from)
         billable_seconds = max(0.0, (valid_until - billable_start).total_seconds())
-        ratio = billable_seconds / basis_seconds
+        ratio = min(1.0, billable_seconds / basis_seconds)
         raw_price = full_price * ratio
         price = self._round_hwid_price(raw_price, currency=currency)
         min_price = getattr(package, "min_price", None)
@@ -150,7 +245,7 @@ class HwidDeviceMixin:
             if sub.hwid_device_limit is not None
             else self._base_hwid_limit_for_tariff(tariff)
         )
-        if base_hwid_limit == 0:
+        if base_hwid_limit in (None, 0):
             return None
 
         package = self._find_hwid_package(tariff, purchased_devices, currency)
@@ -173,7 +268,7 @@ class HwidDeviceMixin:
             valid_from=valid_from,
             valid_until=valid_until,
             now=now,
-            currency="stars" if currency == "stars" else "rub",
+            currency=currency,
         )
         quote.update(
             {
@@ -187,6 +282,80 @@ class HwidDeviceMixin:
         )
         return quote
 
+    async def quote_hwid_device_renewal_for_subscription(
+        self,
+        session: AsyncSession,
+        *,
+        user_id: int,
+        target_tariff_key: str,
+        months: int,
+        currency: str = "rub",
+        now: Optional[datetime] = None,
+    ) -> Optional[Dict[str, Any]]:
+        try:
+            period_months = int(months)
+        except (TypeError, ValueError):
+            return None
+        if period_months <= 0:
+            return None
+
+        db_user = await user_dal.get_user_by_id(session, user_id)
+        if not db_user or not db_user.panel_user_uuid:
+            return None
+        sub = await subscription_dal.get_active_subscription_by_user_id(
+            session, user_id, db_user.panel_user_uuid
+        )
+        if not sub or not sub.end_date:
+            return None
+
+        now = now or datetime.now(timezone.utc)
+        subscription_end = self._as_aware_utc(sub.end_date)
+        if not subscription_end or subscription_end <= now:
+            return None
+
+        try:
+            tariff = self._resolve_tariff(target_tariff_key)
+        except Exception:
+            return None
+        if not tariff or tariff.billing_model != "period":
+            return None
+        base_hwid_limit = self._base_hwid_limit_for_tariff(tariff)
+        if base_hwid_limit in (None, 0):
+            return None
+
+        entitlement_summary = await tariff_dal.get_hwid_device_entitlement_summary(
+            session,
+            subscription_id=sub.subscription_id,
+            at=now,
+        )
+        active_devices = int(entitlement_summary.get("active_devices") or 0)
+        if active_devices <= 0:
+            return None
+
+        price_quote = self._quote_hwid_full_period_package_price(
+            tariff,
+            device_count=active_devices,
+            period_months=period_months,
+            currency=currency,
+        )
+        if not price_quote:
+            return None
+
+        valid_from = subscription_end
+        valid_until = add_months(valid_from, period_months)
+        price_quote.update(
+            {
+                "subscription_id": sub.subscription_id,
+                "tariff_key": tariff.key,
+                "device_count": active_devices,
+                "renewal": True,
+                "valid_from": valid_from,
+                "valid_until": valid_until,
+                "active_until": entitlement_summary.get("active_until"),
+            }
+        )
+        return price_quote
+
     async def activate_hwid_device_topup(
         self,
         session: AsyncSession,
@@ -227,7 +396,11 @@ class HwidDeviceMixin:
                 )
                 return None
             packages = (
-                [*tariff.hwid_device_packages.rub, *tariff.hwid_device_packages.stars]
+                [
+                    package
+                    for currency_packages in tariff.hwid_device_packages.root.values()
+                    for package in currency_packages
+                ]
                 if tariff.hwid_device_packages
                 else []
             )
@@ -244,7 +417,7 @@ class HwidDeviceMixin:
             if sub.hwid_device_limit is not None
             else self._base_hwid_limit_for_tariff(tariff)
         )
-        if base_hwid_limit == 0:
+        if base_hwid_limit in (None, 0):
             logging.info(
                 "Skipping HWID top-up for user %s because current limit is unlimited", user_id
             )

backend/bot/services/subscription_service_impl/lifecycle.py

@@ -178,6 +178,7 @@ class SubscriptionLifecycleMixin:
         user_id: int,
         target_tariff_key: str,
         mode: str,
+        payment_id: Optional[int] = None,
     ) -> Optional[Dict[str, Any]]:
         config = self._tariffs_config()
         if not config:
@@ -248,9 +249,9 @@ class SubscriptionLifecycleMixin:
                 traffic_used_bytes=used_sub,
             )
             update_data["period_start_at"] = None
-            update_data["effective_monthly_price_rub"] = (
-                target.period_price(1, "rub") or target.min_period_price_rub()
-            )
+            update_data["effective_monthly_price_rub"] = target.period_price(
+                1, default_currency_key_for_settings(self.settings)
+            ) or target.min_period_price(default_currency_key_for_settings(self.settings))
             if mode == "recalc_days" and options.get("recalc_days") is not None:
                 update_data["end_date"] = now + timedelta(days=int(options["recalc_days"]))
         else:
@@ -336,7 +337,7 @@ class SubscriptionLifecycleMixin:
                 "from_tariff_key": before_tariff_key,
                 "to_tariff_key": target.key,
                 "mode": mode,
-                "payment_id": None,
+                "payment_id": payment_id,
                 "days_before": options.get("remaining_days"),
                 "days_after": (updated.end_date - now).days
                 if updated.end_date and target.billing_model == "period"
@@ -454,27 +455,11 @@ class SubscriptionLifecycleMixin:
                 user_id,
                 tariff_key,
                 "paid_diff",
+                payment_id=payment_db_id,
             )
             if result:
                 sub = await subscription_dal.get_active_subscription_by_user_id(session, user_id)
                 if sub:
-                    await tariff_dal.create_tariff_change(
-                        session,
-                        {
-                            "subscription_id": sub.subscription_id,
-                            "from_tariff_key": None,
-                            "to_tariff_key": tariff_key,
-                            "mode": "paid_diff",
-                            "payment_id": payment_db_id,
-                            "days_before": None,
-                            "days_after": (sub.end_date - datetime.now(timezone.utc)).days
-                            if sub.end_date
-                            else None,
-                            "converted_bytes": None,
-                            "eff_price_before": None,
-                            "eff_price_after": sub.effective_monthly_price_rub,
-                        },
-                    )
                     result["end_date"] = sub.end_date
                     result["is_active"] = sub.is_active
                     db_user = await user_dal.get_user_by_id(session, user_id)
@@ -494,10 +479,29 @@ class SubscriptionLifecycleMixin:
         await self._record_payment_context(
             session,
             payment_db_id,
-            sale_mode=sale_mode_base,
+            sale_mode=sale_mode,
             tariff_key=tariff.key if tariff else tariff_key,
             purchased_gb=None,
         )
+        payment = await payment_dal.get_payment_by_db_id(session, payment_db_id)
+        try:
+            hwid_renewal_devices = int(getattr(payment, "purchased_hwid_devices", 0) or 0)
+        except (TypeError, ValueError):
+            hwid_renewal_devices = 0
+        try:
+            hwid_renewal_price = (
+                float(getattr(payment, "hwid_full_price", 0) or 0)
+                if hwid_renewal_devices > 0
+                else 0.0
+            )
+        except (TypeError, ValueError):
+            hwid_renewal_price = 0.0
+        hwid_renewal_valid_from = self._as_aware_utc(
+            getattr(payment, "hwid_valid_from", None) if payment else None
+        )
+        hwid_renewal_valid_until = self._as_aware_utc(
+            getattr(payment, "hwid_valid_until", None) if payment else None
+        )
 
         db_user = await user_dal.get_user_by_id(session, user_id)
         if not db_user:
@@ -569,6 +573,26 @@ class SubscriptionLifecycleMixin:
                 promo_code_id_from_payment = None
 
         final_end_date = start_date + timedelta(days=duration_days_total)
+        if hwid_renewal_devices > 0 and hwid_renewal_valid_until and applied_promo_bonus_days:
+            hwid_renewal_valid_until = hwid_renewal_valid_until + timedelta(
+                days=applied_promo_bonus_days
+            )
+            if payment:
+                payment.hwid_valid_until = hwid_renewal_valid_until
+        elif applied_promo_bonus_days > 0 and current_active_sub:
+            try:
+                await tariff_dal.extend_hwid_device_purchases_for_subscription_bonus(
+                    session,
+                    subscription_id=current_active_sub.subscription_id,
+                    at=datetime.now(timezone.utc),
+                    subscription_end_before=start_date,
+                    delta=timedelta(days=applied_promo_bonus_days),
+                )
+            except Exception:
+                logging.exception(
+                    "Failed to extend HWID device purchases for promo payment bonus of user %s",
+                    user_id,
+                )
         await subscription_dal.deactivate_other_active_subscriptions(
             session, panel_user_uuid, panel_sub_link_id
         )
@@ -614,7 +638,8 @@ class SubscriptionLifecycleMixin:
             premium_topup_balance_bytes,
             premium_topup_used_bytes,
         )
-        effective_monthly_price = float(payment_amount) / max(1, months_int)
+        subscription_amount_for_pricing = max(0.0, float(payment_amount) - hwid_renewal_price)
+        effective_monthly_price = subscription_amount_for_pricing / max(1, months_int)
         regular_bonus_carry = int(getattr(current_active_sub, "regular_bonus_bytes", 0) or 0)
         regular_unl_carry = bool(getattr(current_active_sub, "regular_unlimited_override", False))
         traffic_limit_bytes = self._traffic_limit_for_period_tariff(
@@ -641,6 +666,9 @@ class SubscriptionLifecycleMixin:
             "traffic_limit_bytes": traffic_limit_bytes,
             "provider": provider,
             "skip_notifications": False,
+            # A real payment restores the full reminder spectrum, clearing any
+            # trial/bonus suppression carried over on this panel subscription.
+            "suppress_early_expiry_notifications": False,
             "auto_renew_enabled": auto_renew_should_enable,
             "tariff_key": tariff.key if tariff else None,
             "tier_baseline_bytes": tier_baseline_bytes,
@@ -695,6 +723,31 @@ class SubscriptionLifecycleMixin:
 
         final_subscription_url = updated_panel_user.get("subscriptionUrl")
         final_panel_short_uuid = updated_panel_user.get("shortUuid", panel_short_uuid)
+        hwid_devices_renewed_count = 0
+        hwid_devices_renewed_until = None
+        if hwid_renewal_devices > 0:
+            if (
+                hwid_renewal_valid_from
+                and hwid_renewal_valid_until
+                and hwid_renewal_valid_from < hwid_renewal_valid_until
+            ):
+                await tariff_dal.create_hwid_device_purchase(
+                    session,
+                    subscription_id=new_or_updated_sub.subscription_id,
+                    payment_id=payment_db_id,
+                    purchased_devices=hwid_renewal_devices,
+                    valid_from=hwid_renewal_valid_from,
+                    valid_until=hwid_renewal_valid_until,
+                )
+                hwid_devices_renewed_count = hwid_renewal_devices
+                hwid_devices_renewed_until = hwid_renewal_valid_until
+            else:
+                logging.warning(
+                    "Skipping HWID renewal purchase for payment %s: invalid window %s -> %s",
+                    payment_db_id,
+                    hwid_renewal_valid_from,
+                    hwid_renewal_valid_until,
+                )
 
         await self._send_payment_success_email(
             db_user=db_user,
@@ -715,8 +768,12 @@ class SubscriptionLifecycleMixin:
             "subscription_url": final_subscription_url,
             "applied_promo_bonus_days": applied_promo_bonus_days,
             "tariff_key": tariff.key if tariff else None,
-            "hwid_devices_renewal_recommended_count": extra_hwid_devices,
-            "hwid_devices_valid_until": hwid_devices_valid_until,
+            "hwid_devices_renewal_recommended_count": 0
+            if hwid_devices_renewed_count
+            else extra_hwid_devices,
+            "hwid_devices_valid_until": hwid_devices_renewed_until or hwid_devices_valid_until,
+            "hwid_devices_renewed_count": hwid_devices_renewed_count,
+            "hwid_devices_renewed_until": hwid_devices_renewed_until,
         }
 
     async def extend_active_subscription_days(
@@ -725,6 +782,8 @@ class SubscriptionLifecycleMixin:
         user_id: int,
         bonus_days: int,
         reason: str = "bonus",
+        extend_hwid_devices: bool = True,
+        tariff_key: Optional[str] = None,
     ) -> Optional[datetime]:
         reason_lower = (reason or "").lower()
         apply_main_traffic_limit = any(
@@ -751,6 +810,17 @@ class SubscriptionLifecycleMixin:
         preserve_tariff_limits = bool(
             active_sub and active_sub.tariff_key and self._tariffs_config()
         )
+        bonus_tariff = None
+        if not active_sub and tariff_key and self._tariffs_config():
+            try:
+                bonus_tariff = self._resolve_tariff(tariff_key)
+            except Exception:
+                logging.warning(
+                    "Unable to resolve bonus tariff %s for user %s.",
+                    tariff_key,
+                    user_id,
+                    exc_info=True,
+                )
         if not active_sub or not active_sub.end_date:
             logging.info(
                 f"No active subscription found for user {user_id}. Creating new one for {bonus_days} days."  # noqa: E501
@@ -760,10 +830,16 @@ class SubscriptionLifecycleMixin:
 
             # Apply main traffic limit for admin/referral/promo bonuses, fallback to trial limit otherwise  # noqa: E501
             traffic_limit = (
-                self.settings.user_traffic_limit_bytes
+                self._traffic_limit_for_period_tariff(bonus_tariff)
+                if bonus_tariff
+                else self.settings.user_traffic_limit_bytes
                 if apply_main_traffic_limit
                 else self.settings.trial_traffic_limit_bytes
             )
+            premium_baseline_bytes = bonus_tariff.premium_monthly_bytes if bonus_tariff else 0
+            base_hwid_limit = (
+                self._base_hwid_limit_for_tariff(bonus_tariff) if bonus_tariff else None
+            )
 
             bonus_sub_payload = {
                 "user_id": user_id,
@@ -776,6 +852,24 @@ class SubscriptionLifecycleMixin:
                 "status_from_panel": "ACTIVE_BONUS",
                 "traffic_limit_bytes": traffic_limit,
                 "auto_renew_enabled": False,
+                "tariff_key": bonus_tariff.key if bonus_tariff else None,
+                "tier_baseline_bytes": bonus_tariff.monthly_bytes if bonus_tariff else None,
+                "topup_balance_bytes": 0,
+                "regular_bonus_bytes": 0,
+                "regular_unlimited_override": False,
+                "premium_baseline_bytes": premium_baseline_bytes,
+                "premium_topup_balance_bytes": 0,
+                "premium_topup_used_bytes": 0,
+                "premium_used_bytes": 0,
+                "premium_is_limited": False,
+                "premium_period_start_at": None,
+                "period_start_at": None,
+                "is_throttled": False,
+                "hwid_device_limit": base_hwid_limit,
+                "extra_hwid_devices": 0,
+                # Registration/referral bonus grants are short-lived, like a
+                # trial: only warn a few hours before they end, not days ahead.
+                "suppress_early_expiry_notifications": True,
             }
             await subscription_dal.deactivate_other_active_subscriptions(
                 session, panel_uuid, panel_sub_uuid
@@ -792,6 +886,21 @@ class SubscriptionLifecycleMixin:
             updated_sub_model = await subscription_dal.update_subscription_end_date(
                 session, active_sub.subscription_id, new_end_date_obj
             )
+            if updated_sub_model and extend_hwid_devices:
+                try:
+                    await tariff_dal.extend_hwid_device_purchases_for_subscription_bonus(
+                        session,
+                        subscription_id=active_sub.subscription_id,
+                        at=now_utc,
+                        subscription_end_before=current_end_date,
+                        delta=timedelta(days=bonus_days),
+                    )
+                except Exception:
+                    logging.exception(
+                        "Failed to extend HWID device purchases for %s bonus of user %s",
+                        reason,
+                        user_id,
+                    )
 
             if (
                 apply_main_traffic_limit
@@ -810,13 +919,35 @@ class SubscriptionLifecycleMixin:
             panel_update_payload = self._build_panel_update_payload(
                 expire_at=new_end_date_obj,
                 traffic_limit_bytes=(
-                    self.settings.user_traffic_limit_bytes
+                    updated_sub_model.traffic_limit_bytes
+                    if bonus_tariff
+                    else self.settings.user_traffic_limit_bytes
                     if apply_main_traffic_limit and not preserve_tariff_limits
                     else None
                 ),
+                traffic_limit_strategy=(
+                    "MONTH"
+                    if bonus_tariff and bonus_tariff.billing_model == "period"
+                    else self.settings.USER_TRAFFIC_STRATEGY
+                    if bonus_tariff
+                    else None
+                ),
+                hwid_device_limit=(
+                    self._effective_hwid_limit(updated_sub_model.hwid_device_limit, 0)
+                    if bonus_tariff
+                    else None
+                ),
                 include_uuid=False,
                 include_default_squads=False,
             )
+            if bonus_tariff:
+                panel_update_payload["activeInternalSquads"] = self._panel_squads_for_tariff(
+                    bonus_tariff
+                )
+                if self.settings.parsed_user_external_squad_uuid:
+                    panel_update_payload["externalSquadUuid"] = (
+                        self.settings.parsed_user_external_squad_uuid
+                    )
 
             panel_update_success = await self.panel_service.update_user_details_on_panel(
                 panel_uuid,

backend/bot/services/subscription_service_impl/payments.py

@@ -13,7 +13,9 @@ class PaymentContextMixin:
         "platega": "Platega",
         "severpay": "SeverPay",
         "wata": "Wata",
+        "lava": "LAVA",
         "cryptopay": "Crypto Pay",
+        "paykilla": "PayKilla",
         "telegram_stars": "Telegram Stars",
     }
 
@@ -38,7 +40,8 @@ class PaymentContextMixin:
         payment.sale_mode = sale_mode
         payment.tariff_key = tariff_key
         payment.purchased_gb = purchased_gb
-        payment.purchased_hwid_devices = purchased_hwid_devices
+        if purchased_hwid_devices is not None:
+            payment.purchased_hwid_devices = purchased_hwid_devices
         if hwid_valid_from is not None:
             payment.hwid_valid_from = hwid_valid_from
         if hwid_valid_until is not None:
@@ -62,6 +65,9 @@ class PaymentContextMixin:
     async def has_had_any_subscription(self, session: AsyncSession, user_id: int) -> bool:
         return await subscription_dal.has_any_subscription_for_user(session, user_id)
 
+    async def has_trial_blocking_subscription(self, session: AsyncSession, user_id: int) -> bool:
+        return await subscription_dal.has_trial_blocking_subscription_for_user(session, user_id)
+
     async def has_active_subscription(self, session: AsyncSession, user_id: int) -> bool:
         """Return True if user currently has an active subscription (end_date in future)."""
         try:
@@ -120,7 +126,7 @@ class PaymentContextMixin:
                 months=int(months or 0),
                 traffic_gb=traffic_gb,
                 amount=float(payment_amount or 0),
-                currency=self.settings.DEFAULT_CURRENCY_SYMBOL,
+                currency=default_payment_currency_code_for_settings(self.settings),
                 end_date_text=end_date_text,
                 dashboard_url=dashboard_url,
                 provider_label=provider_label,

backend/bot/services/subscription_service_impl/renewal.py

@@ -41,19 +41,81 @@ class RenewalMixin:
             return False
 
         months = sub.duration_months or 1
-        amount = self.settings.subscription_options.get(months)
+        currency = default_payment_currency_code_for_settings(self.settings)
+        tariff_key = str(getattr(sub, "tariff_key", "") or "").strip() or None
+        sale_mode = f"subscription@{tariff_key}" if tariff_key else "subscription"
+        amount = None
+        tariffs_config = (
+            self._tariffs_config() if callable(getattr(self, "_tariffs_config", None)) else None
+        )
+        if tariffs_config and callable(getattr(self, "_resolve_tariff", None)):
+            try:
+                tariff = self._resolve_tariff(getattr(sub, "tariff_key", None))
+            except Exception:
+                tariff = None
+            if tariff and tariff.billing_model == "period":
+                amount = tariff.period_price(
+                    months,
+                    default_currency_key_for_settings(self.settings),
+                )
+        if amount is None:
+            amount = self.settings.subscription_options.get(months)
         if not amount:
             logging.error(f"Auto-renew price missing for {months} months")
             return False
 
+        hwid_quote = None
+        quote_hwid_renewal = getattr(
+            self,
+            "quote_hwid_device_renewal_for_subscription",
+            None,
+        )
+        if tariff_key and callable(quote_hwid_renewal):
+            try:
+                hwid_quote = await quote_hwid_renewal(
+                    session,
+                    user_id=sub.user_id,
+                    target_tariff_key=tariff_key,
+                    months=int(months),
+                    currency=default_currency_key_for_settings(self.settings),
+                )
+            except Exception:
+                logging.exception(
+                    "Failed to quote HWID devices for auto-renew user %s",
+                    sub.user_id,
+                )
+                hwid_quote = None
+        if hwid_quote:
+            amount = float(amount) + float(hwid_quote.get("price") or 0)
+
         metadata = {
             "user_id": str(sub.user_id),
             "auto_renew_for_subscription_id": str(sub.subscription_id),
             "subscription_months": str(months),
+            "sale_mode": sale_mode,
         }
+        if hwid_quote:
+            metadata["hwid_devices"] = str(int(hwid_quote.get("device_count") or 0))
+            for source_key, metadata_key in (
+                ("valid_from", "hwid_valid_from"),
+                ("valid_until", "hwid_valid_until"),
+            ):
+                value = hwid_quote.get(source_key)
+                if value:
+                    metadata[metadata_key] = (
+                        value.isoformat() if hasattr(value, "isoformat") else str(value)
+                    )
+            for key in (
+                "pricing_period_months",
+                "proration_ratio",
+                "full_price",
+            ):
+                value = hwid_quote.get(key)
+                if value is not None:
+                    metadata[f"hwid_{key}"] = str(value)
         resp = await yk.create_payment(
             amount=float(amount),
-            currency="RUB",
+            currency=currency,
             description=f"Auto-renewal for {months} months",
             metadata=metadata,
             payment_method_id=default_pm.provider_payment_method_id,

backend/bot/services/subscription_service_impl/tariffs.py

@@ -112,15 +112,14 @@ class TariffMixin:
         regular_unlimited_override: bool,
         traffic_used_bytes: int,
     ) -> int:
-        """Numeric cap sent to the panel; ``regular_unlimited_override`` uses a large practical ceiling."""  # noqa: E501
+        """Numeric cap sent to the panel; Remnawave treats ``0`` as unlimited."""
         floor = (
             int(tier_baseline_bytes or 0)
             + max(0, int(topup_balance_bytes or 0))
             + max(0, int(regular_bonus_bytes or 0))
         )
         if regular_unlimited_override:
-            used = max(0, int(traffic_used_bytes or 0))
-            return max(floor, used + 512 * (1024**3), 1024**5)
+            return 0
         return floor
 
     async def premium_access_for_tariff(self, tariff: Optional[Tariff]) -> Dict[str, Any]:
@@ -315,7 +314,7 @@ class TariffMixin:
     @staticmethod
     def _effective_hwid_limit(base_limit: Optional[int], extra_devices: int = 0) -> Optional[int]:
         if base_limit is None:
-            return None
+            return 0
         base_int = max(0, int(base_limit))
         if base_int == 0:
             return 0
@@ -331,11 +330,12 @@ class TariffMixin:
         remaining_days = max(0, (sub.end_date - now).days) if sub.end_date else 0
         effective = float(sub.effective_monthly_price_rub or 0)
         current_model = current_tariff.billing_model if current_tariff else "period"
+        default_currency = default_currency_key_for_settings(self.settings)
 
         if current_model == "period" and target_tariff.billing_model == "period":
             target_monthly = (
-                target_tariff.period_price(1, "rub")
-                or target_tariff.min_period_price_rub()
+                target_tariff.period_price(1, default_currency)
+                or target_tariff.min_period_price(default_currency)
                 or effective
                 or 1
             )
@@ -355,11 +355,14 @@ class TariffMixin:
                 "remaining_days": remaining_days,
                 "recalc_days": max(0, days_after),
                 "paid_diff_rub": paid_diff,
+                "paid_diff": paid_diff,
                 "target_monthly_rub": float(target_monthly),
+                "target_monthly_price": float(target_monthly),
+                "currency": default_currency,
             }
 
         if current_model == "period" and target_tariff.billing_model == "traffic":
-            rub_per_gb = target_tariff.rub_per_gb_for_conversion()
+            rub_per_gb = target_tariff.currency_per_gb_for_conversion(default_currency)
             remaining_value = remaining_days * (effective / 30) if effective else 0
             converted_gb = math.floor(remaining_value / rub_per_gb) if rub_per_gb else 0
             return {
@@ -367,9 +370,15 @@ class TariffMixin:
                 "remaining_days": remaining_days,
                 "converted_gb": max(0, converted_gb),
                 "rub_per_gb": rub_per_gb,
+                "currency_per_gb": rub_per_gb,
+                "currency": default_currency,
             }
 
-        return {"mode": "traffic_to_period", "remaining_days": remaining_days}
+        return {
+            "mode": "traffic_to_period",
+            "remaining_days": remaining_days,
+            "currency": default_currency,
+        }
 
     @staticmethod
     def _aware_utc(value: Optional[datetime]) -> Optional[datetime]:
@@ -434,6 +443,7 @@ class TariffMixin:
         credit = await self._hwid_conversion_credit(session, sub, at=now)
         value_rub = float(credit.get("value_rub") or 0)
         options["converted_hwid_value_rub"] = round(value_rub, 2)
+        options["converted_hwid_value"] = round(value_rub, 2)
         options["convertible_hwid_purchase_ids"] = list(credit.get("purchase_ids") or [])
         options["nonconverted_hwid_devices"] = int(credit.get("skipped_devices") or 0)
         if value_rub <= 0:

backend/bot/services/subscription_service_impl/trial.py

@@ -22,7 +22,7 @@ class TrialSubscriptionMixin:
                 "message_key": "user_not_found_for_trial",
             }
 
-        if await self.has_had_any_subscription(session, user_id):
+        if await self.has_trial_blocking_subscription(session, user_id):
             return {
                 "eligible": False,
                 "activated": False,
@@ -63,6 +63,8 @@ class TrialSubscriptionMixin:
             "traffic_limit_bytes": self.settings.trial_traffic_limit_bytes,
             "auto_renew_enabled": False,
             "provider": "trial",
+            # Short trial: only warn a few hours before it ends, not days ahead.
+            "suppress_early_expiry_notifications": True,
         }
         try:
             await subscription_dal.upsert_subscription(session, trial_sub_data)

backend/bot/services/tariff_worker.py

@@ -13,6 +13,7 @@ from sqlalchemy.orm import sessionmaker
 
 from bot.infra.redis import redis_lock
 from bot.middlewares.i18n import JsonI18n
+from bot.services.message_audit import log_user_message_delivery
 from bot.services.panel_api_service import PanelApiService
 from bot.services.subscription_service import SubscriptionService
 from bot.services.user_email_notifications import send_user_notification_email
@@ -111,6 +112,8 @@ class TariffTrafficWorker:
         subject_key: str,
         message_text: str,
         kind: str,
+        warning_key: str,
+        audit_content: str,
     ) -> None:
         try:
             user = await user_dal.get_user_by_id(session, user_id)
@@ -131,6 +134,9 @@ class TariffTrafficWorker:
                 if kind == "premium"
                 else "email_traffic_warning_regular_cta"
             ),
+            session=session,
+            audit_event_type="email_traffic_warning_sent",
+            audit_content=f"{audit_content} subject_key={subject_key} warning_key={warning_key}",
         )
 
     async def run(self) -> None:
@@ -602,6 +608,15 @@ class TariffTrafficWorker:
                     **usage,
                 )
                 subject_key = "email_traffic_warning_regular_depleted_subject"
+            warning_key = (
+                "traffic_warning_regular_almost"
+                if level < 100
+                else "traffic_warning_regular_depleted"
+            )
+            audit_content = (
+                f"kind=regular warning_key={warning_key} level={level} "
+                f"used_bytes={used_val} limit_bytes={limit_val}"
+            )
             if self.bot:
                 try:
                     markup = self._traffic_topup_markup(user_lang, "regular")
@@ -611,6 +626,14 @@ class TariffTrafficWorker:
                         reply_markup=markup,
                         parse_mode="HTML",
                     )
+                    await log_user_message_delivery(
+                        session,
+                        target_user_id=sub.user_id,
+                        event_type="telegram_traffic_warning_sent",
+                        channel="telegram",
+                        recipient=str(sub.user_id),
+                        content=audit_content,
+                    )
                 except Exception:
                     logging.exception("Failed to send traffic warning to user %s", sub.user_id)
             await self._send_traffic_warning_email(
@@ -619,6 +642,8 @@ class TariffTrafficWorker:
                 subject_key=subject_key,
                 message_text=text,
                 kind="regular",
+                warning_key=warning_key,
+                audit_content=audit_content,
             )
         if ratio >= 1.0 and not sub.is_throttled:
             logging.info(
@@ -1066,6 +1091,11 @@ class TariffTrafficWorker:
                 servers=servers,
                 **usage,
             )
+            warning_key = "traffic_warning_premium_depleted"
+            audit_content = (
+                f"kind=premium warning_key={warning_key} "
+                f"used_bytes={used_val} limit_bytes={limit_val}"
+            )
             if self.bot:
                 try:
                     markup = self._traffic_topup_markup(user_lang, "premium")
@@ -1075,6 +1105,14 @@ class TariffTrafficWorker:
                         reply_markup=markup,
                         parse_mode="HTML",
                     )
+                    await log_user_message_delivery(
+                        session,
+                        target_user_id=sub.user_id,
+                        event_type="telegram_traffic_warning_sent",
+                        channel="telegram",
+                        recipient=str(sub.user_id),
+                        content=audit_content,
+                    )
                 except Exception:
                     logging.exception(
                         "Failed to send premium traffic depleted warning to user %s", sub.user_id
@@ -1085,6 +1123,8 @@ class TariffTrafficWorker:
                 subject_key="email_traffic_warning_premium_depleted_subject",
                 message_text=text,
                 kind="premium",
+                warning_key=warning_key,
+                audit_content=audit_content,
             )
             return
 
@@ -1134,6 +1174,11 @@ class TariffTrafficWorker:
                 servers=servers,
                 **usage,
             )
+            warning_key = "traffic_warning_premium_almost"
+            audit_content = (
+                f"kind=premium warning_key={warning_key} level={int(level)} "
+                f"used_bytes={used_val} limit_bytes={limit_val}"
+            )
             if self.bot:
                 try:
                     markup = self._traffic_topup_markup(user_lang, "premium")
@@ -1143,6 +1188,14 @@ class TariffTrafficWorker:
                         reply_markup=markup,
                         parse_mode="HTML",
                     )
+                    await log_user_message_delivery(
+                        session,
+                        target_user_id=sub.user_id,
+                        event_type="telegram_traffic_warning_sent",
+                        channel="telegram",
+                        recipient=str(sub.user_id),
+                        content=audit_content,
+                    )
                 except Exception:
                     logging.exception(
                         "Failed to send premium traffic warning to user %s", sub.user_id
@@ -1153,6 +1206,8 @@ class TariffTrafficWorker:
                 subject_key="email_traffic_warning_premium_almost_subject",
                 message_text=text,
                 kind="premium",
+                warning_key=warning_key,
+                audit_content=audit_content,
             )
 
     async def _premium_node_uuids_for_tariff(self, tariff) -> list[str]:

backend/bot/services/telegram_notifications.py

@@ -4,7 +4,6 @@ from typing import Any, Optional
 
 from aiogram import Bot
 from aiogram.exceptions import TelegramBadRequest, TelegramForbiddenError
-from aiogram.types import InlineKeyboardButton, InlineKeyboardMarkup, WebAppInfo
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from bot.middlewares.i18n import JsonI18n
@@ -128,37 +127,6 @@ async def mark_telegram_notifications_enabled_for_telegram_user(
     )
 
 
-def _translate(
-    i18n: Optional[JsonI18n],
-    language: str,
-    key: str,
-    fallback: str,
-    **kwargs: Any,
-) -> str:
-    if not i18n:
-        return fallback.format(**kwargs) if kwargs else fallback
-    return i18n.gettext(language, key, **kwargs) or fallback
-
-
-def _probe_keyboard(
-    settings: Settings,
-    i18n: Optional[JsonI18n],
-    language: str,
-) -> Optional[InlineKeyboardMarkup]:
-    app_url = str(getattr(settings, "SUBSCRIPTION_MINI_APP_URL", "") or "").strip()
-    if not app_url:
-        return None
-    text = _translate(
-        i18n,
-        language,
-        "telegram_notifications_open_app_button",
-        "Open app",
-    )
-    return InlineKeyboardMarkup(
-        inline_keyboard=[[InlineKeyboardButton(text=text, web_app=WebAppInfo(url=app_url))]]
-    )
-
-
 async def probe_telegram_notifications(
     *,
     session: AsyncSession,
@@ -187,20 +155,8 @@ async def probe_telegram_notifications(
             "start_link": telegram_notifications_start_link(bot_username),
         }
 
-    language = str(getattr(user, "language_code", "") or settings.DEFAULT_LANGUAGE)
-    text = _translate(
-        i18n,
-        language,
-        "telegram_notifications_enabled_message",
-        "Telegram notifications are enabled.",
-    )
     try:
-        await bot.send_message(
-            int(telegram_id),
-            text,
-            reply_markup=_probe_keyboard(settings, i18n, language),
-            disable_web_page_preview=True,
-        )
+        await bot.get_chat(int(telegram_id))
     except Exception as exc:
         status = telegram_notification_status_from_error(exc)
         if status:
@@ -211,7 +167,7 @@ async def probe_telegram_notifications(
                 "start_link": telegram_notifications_start_link(bot_username),
             }
         logger.warning(
-            "Telegram notification probe failed for user %s / telegram %s: %s",
+            "Telegram notification chat probe failed for user %s / telegram %s: %s",
             user.user_id,
             telegram_id,
             exc,

backend/bot/services/telemetry_worker.py

@@ -0,0 +1,221 @@
+"""Anonymous install telemetry beacon (self-hosted friendly, opt-out).
+
+Once per ``TELEMETRY_INTERVAL_HOURS`` the worker sends a single obfuscation-free
+but fully anonymous "heartbeat" to a PostHog ingestion endpoint so the project
+maintainer can see how many installs are active and which versions/OSes are in
+use. No personal data, bot tokens, domains or user identities are sent — only
+an opaque per-install UUID plus coarse environment facts.
+
+Operators can opt out in three independent ways, any of which stops the beacon:
+  * ``TELEMETRY_ENABLED=false`` in ``.env``
+  * the *System → Anonymous install analytics* toggle in the web admin (stored
+    as a DB override and re-read every tick, so no restart is required)
+  * leaving ``TELEMETRY_ENDPOINT`` / ``TELEMETRY_API_KEY`` empty in the image
+
+Delivery is strictly fire-and-forget: every failure is swallowed so telemetry
+can never delay, block or crash the worker.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import platform
+import uuid
+from typing import Any, Dict, List
+
+import aiohttp
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import sessionmaker
+
+from bot.infra.redis import redis_lock
+from bot.utils.app_version import (
+    resolve_app_version,
+    resolve_app_version_tag,
+    resolve_build_provenance,
+    resolve_image_modified,
+)
+from config.settings import Settings
+from db.dal import app_settings_dal, user_dal
+
+logger = logging.getLogger(__name__)
+
+INSTALLATION_ID_KEY = "TELEMETRY_INSTALLATION_ID"
+TELEMETRY_ENABLED_KEY = "TELEMETRY_ENABLED"
+HEARTBEAT_EVENT = "installation_heartbeat"
+INITIAL_DELAY_SECONDS = 300
+HTTP_TIMEOUT_SECONDS = 10
+
+# Report the user count as a coarse range so individual installs stay anonymous
+# and the property keeps a low cardinality for breakdowns.
+_USER_BUCKETS = (
+    (0, "0"),
+    (10, "1-10"),
+    (50, "11-50"),
+    (200, "51-200"),
+    (1000, "201-1000"),
+    (5000, "1001-5000"),
+)
+
+
+def _bucket_users(count: int) -> str:
+    for upper, label in _USER_BUCKETS:
+        if count <= upper:
+            return label
+    return "5000+"
+
+
+class TelemetryWorker:
+    def __init__(self, settings: Settings, session_factory: sessionmaker):
+        self.settings = settings
+        self.session_factory = session_factory
+        self._stopped = asyncio.Event()
+
+    def stop(self) -> None:
+        self._stopped.set()
+
+    def _delivery_configured(self) -> bool:
+        return bool(
+            str(self.settings.TELEMETRY_ENDPOINT or "").strip()
+            and str(self.settings.TELEMETRY_API_KEY or "").strip()
+        )
+
+    async def run(self) -> None:
+        if not self._delivery_configured():
+            logger.info("Telemetry endpoint/key not configured; anonymous beacon disabled")
+            return
+        logger.info(
+            "Anonymous install telemetry is ON (endpoint=%s, every %sh). "
+            "It sends an opaque install id, version, OS and a user-count range — "
+            "no personal data. Opt out via TELEMETRY_ENABLED=false or "
+            "Admin -> System -> Anonymous install analytics. "
+            "See docs/configuration/telemetry.md.",
+            self.settings.TELEMETRY_ENDPOINT,
+            self.settings.TELEMETRY_INTERVAL_HOURS,
+        )
+        await self._sleep(INITIAL_DELAY_SECONDS)
+        while not self._stopped.is_set():
+            try:
+                await self._beacon_tick()
+            except Exception:
+                logger.exception("Telemetry beacon tick failed")
+            await self._sleep(self._interval_seconds())
+
+    def _interval_seconds(self) -> int:
+        return max(1, int(self.settings.TELEMETRY_INTERVAL_HOURS or 24)) * 3600
+
+    async def _sleep(self, seconds: float) -> None:
+        try:
+            await asyncio.wait_for(self._stopped.wait(), timeout=seconds)
+        except asyncio.TimeoutError:
+            pass
+
+    async def _beacon_tick(self) -> None:
+        # A short-lived lock keeps a single beacon per interval even when the
+        # worker is scaled to several replicas. Without Redis the lock yields
+        # True, which is correct for the common single-worker deployment.
+        async with redis_lock(
+            self.settings,
+            "telemetry-beacon",
+            ttl_seconds=max(60, self._interval_seconds() // 2),
+        ) as acquired:
+            if not acquired:
+                return
+            async with self.session_factory() as session:
+                if not await self._is_enabled(session):
+                    return
+                installation_id = await self._get_or_create_installation_id(session)
+                payload = await self._build_payload(session, installation_id)
+                await session.commit()
+            await self._send(payload)
+
+    async def _is_enabled(self, session: AsyncSession) -> bool:
+        # The web admin writes the toggle as a DB override. The worker process
+        # does not apply overrides onto its in-memory Settings, so read it
+        # straight from the table; the env default applies when unset.
+        present, value = await app_settings_dal.get_override_value(session, TELEMETRY_ENABLED_KEY)
+        if present:
+            return bool(value)
+        return bool(self.settings.TELEMETRY_ENABLED)
+
+    async def _get_or_create_installation_id(self, session: AsyncSession) -> str:
+        present, value = await app_settings_dal.get_override_value(session, INSTALLATION_ID_KEY)
+        if present and value:
+            return str(value)
+        installation_id = str(uuid.uuid4())
+        await app_settings_dal.upsert_override(
+            session,
+            key=INSTALLATION_ID_KEY,
+            value=installation_id,
+            updated_by=None,
+        )
+        return installation_id
+
+    def _enabled_payment_providers(self) -> List[str]:
+        try:
+            from bot.payment_providers import iter_provider_specs
+
+            providers = [
+                str(spec.id)
+                for spec in iter_provider_specs()
+                if spec.is_effectively_enabled(self.settings)
+            ]
+            return sorted(set(providers))
+        except Exception:
+            logger.debug("Telemetry: failed to enumerate payment providers", exc_info=True)
+            return []
+
+    async def _build_payload(self, session: AsyncSession, installation_id: str) -> Dict[str, Any]:
+        try:
+            user_count = await user_dal.count_all_users(session)
+        except Exception:
+            logger.debug("Telemetry: failed to count users", exc_info=True)
+            user_count = 0
+
+        version = resolve_app_version()
+        version_tag = resolve_app_version_tag()
+        build_provenance = resolve_build_provenance()
+        image_modified = resolve_image_modified()
+        # Person properties (``$set``) snapshot the latest state per install, so
+        # "version breakdown" in PostHog is a person-property breakdown.
+        person_props = {
+            "app_version": version,
+            "app_version_tag": version_tag,
+            "build_provenance": build_provenance,
+            "image_modified": image_modified,
+            "os": platform.system().lower() or "unknown",
+            "arch": platform.machine().lower() or "unknown",
+            "python_version": platform.python_version(),
+            "locale": str(self.settings.DEFAULT_LANGUAGE or ""),
+            "users_bucket": _bucket_users(int(user_count or 0)),
+            "webapp_enabled": bool(self.settings.WEBAPP_ENABLED),
+            "panel_configured": bool(str(self.settings.PANEL_API_URL or "").strip()),
+            "payment_providers": self._enabled_payment_providers(),
+        }
+        properties = {
+            **person_props,
+            "$lib": "remnawave-minishop",
+            "$lib_version": version,
+            "$set": person_props,
+        }
+        return {
+            "api_key": str(self.settings.TELEMETRY_API_KEY or "").strip(),
+            "event": HEARTBEAT_EVENT,
+            "distinct_id": installation_id,
+            "properties": properties,
+        }
+
+    async def _send(self, payload: Dict[str, Any]) -> None:
+        url = str(self.settings.TELEMETRY_ENDPOINT or "").strip().rstrip("/") + "/capture/"
+        timeout = aiohttp.ClientTimeout(total=HTTP_TIMEOUT_SECONDS)
+        try:
+            async with aiohttp.ClientSession(timeout=timeout) as http:
+                async with http.post(url, json=payload) as resp:
+                    if resp.status >= 400:
+                        body = (await resp.text())[:200]
+                        logger.warning("Telemetry beacon rejected: HTTP %s %s", resp.status, body)
+                    else:
+                        logger.debug("Telemetry beacon delivered (HTTP %s)", resp.status)
+        except Exception:
+            # Never let telemetry surface as an error to operators.
+            logger.debug("Telemetry beacon delivery failed", exc_info=True)