restrict moderator access

filters/admin.py

@@ -17,3 +17,22 @@ class IsAdminFilter(BaseFilter):
                 return result.scalar()
         except (Exception,):
             return False
+
+
+class IsSuperAdminFilter(BaseFilter):
+    async def __call__(self, event: Message | CallbackQuery) -> bool:
+        if not event.from_user:
+            return False
+
+        try:
+            async with async_session_maker() as session:
+                admin = (
+                    await session.execute(
+                        select(Admin).where(Admin.tg_id == event.from_user.id)
+                    )
+                ).scalar_one_or_none()
+                if not admin:
+                    return False
+                return admin.role != "moderator"
+        except (Exception,):
+            return False

handlers/admin/panel/keyboard.py

@@ -21,6 +21,8 @@ class AdminPanelCallback(CallbackData, prefix="admin_panel"):
 
 async def build_panel_kb(admin_role: str) -> InlineKeyboardMarkup:
     builder = InlineKeyboardBuilder()
+    is_super = admin_role == "superadmin"
+    is_moderator = admin_role == "moderator"
 
     builder.row(
         InlineKeyboardButton(
@@ -33,19 +35,19 @@ async def build_panel_kb(admin_role: str) -> InlineKeyboardMarkup:
         ),
     )
 
-    if admin_role == "superadmin":
-        builder.button(
+    if is_super:
+        builder.row(InlineKeyboardButton(
             text="🖥️ Управление серверами",
             callback_data=AdminPanelCallback(action="clusters").pack(),
-        )
-        builder.button(
+        ))
+        builder.row(InlineKeyboardButton(
             text="💸Управление тарифами",
             callback_data=AdminPanelCallback(action="tariffs").pack(),
-        )
-        builder.button(
+        ))
+        builder.row(InlineKeyboardButton(
             text="🤖 Управление ботом",
             callback_data=AdminPanelCallback(action="management").pack(),
-        )
+        ))
 
     builder.row(
         InlineKeyboardButton(
@@ -58,7 +60,7 @@ async def build_panel_kb(admin_role: str) -> InlineKeyboardMarkup:
         ),
     )
 
-    if admin_role == "superadmin":
+    if is_super:
         builder.row(
             InlineKeyboardButton(
                 text="🎁 Подарки",
@@ -80,50 +82,44 @@ async def build_panel_kb(admin_role: str) -> InlineKeyboardMarkup:
             ),
         )
     else:
-        builder.button(
+        builder.row(InlineKeyboardButton(
             text="🎁 Подарки",
             callback_data=AdminPanelCallback(action="gifts").pack(),
-        )
+        ))
 
     module_buttons = await run_hooks("admin_panel", admin_role=admin_role)
     builder = insert_hook_buttons(builder, module_buttons)
 
-    builder.button(
-        text="⚙️ Настройки",
-        callback_data=AdminPanelCallback(action="settings").pack(),
-    )
+    if not is_moderator:
+        builder.row(InlineKeyboardButton(
+            text="⚙️ Настройки",
+            callback_data=AdminPanelCallback(action="settings").pack(),
+        ))
 
-    builder.button(
-        text=MAIN_MENU,
-        callback_data="profile",
-    )
-
-    if admin_role == "superadmin":
-        builder.adjust(2, 1, 1, 1, 2, 1, 2, 2, 1, 1)
-    else:
-        builder.adjust(2, 2, 1, 1, 1, 1)
+    builder.row(InlineKeyboardButton(text=MAIN_MENU, callback_data="profile"))
 
     markup = builder.as_markup()
 
-    ads_callback = AdminPanelCallback(action="ads").pack()
-    emoji_button = InlineKeyboardButton(
-        text="😀 Эмоджи",
-        callback_data=AdminPanelCallback(action="emoji").pack(),
-        style="primary",
-    )
+    if is_super:
+        ads_callback = AdminPanelCallback(action="ads").pack()
+        emoji_button = InlineKeyboardButton(
+            text="😀 Эмоджи",
+            callback_data=AdminPanelCallback(action="emoji").pack(),
+            style="primary",
+        )
 
-    inserted = False
-    for index, row in enumerate(markup.inline_keyboard):
-        for button in row:
-            if getattr(button, "callback_data", None) == ads_callback:
-                markup.inline_keyboard.insert(index + 1, [emoji_button])
-                inserted = True
+        inserted = False
+        for index, row in enumerate(markup.inline_keyboard):
+            for button in row:
+                if getattr(button, "callback_data", None) == ads_callback:
+                    markup.inline_keyboard.insert(index + 1, [emoji_button])
+                    inserted = True
+                    break
+            if inserted:
                 break
-        if inserted:
-            break
 
-    if not inserted:
-        markup.inline_keyboard.append([emoji_button])
+        if not inserted:
+            markup.inline_keyboard.append([emoji_button])
 
     return markup
 

handlers/admin/settings/__init__.py

@@ -1,5 +1,7 @@
 from aiogram import Router
 
+from filters.admin import IsSuperAdminFilter
+
 from .settings_buttons import router as settings_buttons_router
 from .settings_cashboxes import router as settings_cashboxes_router
 from .settings_manage import router as settings_manage_router
@@ -10,6 +12,8 @@ from .settings_tariffs import router as settings_tariffs_router
 
 
 router = Router(name="admin_settings")
+router.callback_query.filter(IsSuperAdminFilter())
+router.message.filter(IsSuperAdminFilter())
 router.include_router(settings_manage_router)
 router.include_router(settings_buttons_router)
 router.include_router(settings_cashboxes_router)

handlers/payments/pay.py

@@ -216,7 +216,7 @@ async def balance_history_handler(callback_query: CallbackQuery, session: Any):
 
     if records:
         language_code = getattr(callback_query.from_user, "language_code", None)
-        history_text = f"{BALANCE_HISTORY_HEADER}</b>\n\n<blockquote>"
+        history_text = f"{BALANCE_HISTORY_HEADER}\n\n<blockquote>"
         for record in records:
             amount_rub = record["amount"] or 0
             formatted_amount = await format_for_user(session, callback_query.from_user.id, amount_rub, language_code)