Webapp hardening + perf / CSP nonce-only / plugin-builder API guard + token autogen / cookie Secure / XSS fixes (QR, postMessage) / auth-me SWR dedup / SSR fetch cache / entry-capture redesign (gift/partner/referral) / payment webhooks (yoomoney sign, tribute trb_user_id) / email-only partners+referrals / INSTALL guide

database/identities.py

@@ -378,10 +378,15 @@ async def ensure_billing_user_for_identity(session: AsyncSession, identity: Iden
     res = await session.execute(select(User).where(User.identity_id == identity.id))
     row = res.scalars().first()
     if row is not None:
+        if row.tg_id is None:
+            synthetic = -int(row.id)
+            await session.execute(update(User).where(User.id == row.id).values(tg_id=synthetic))
         return int(row.id)
     new_u = User(identity_id=identity.id, tg_id=None)
     session.add(new_u)
     await session.flush()
+    synthetic = -int(new_u.id)
+    await session.execute(update(User).where(User.id == new_u.id).values(tg_id=synthetic))
     return int(new_u.id)
 
 

database/site_revision.py

@@ -19,12 +19,10 @@ async def get_site_revision(session: AsyncSession) -> int:
 
 
 async def bump_site_revision(session: AsyncSession) -> int:
-    """Инкрементирует глобальный счётчик контента сайта. Клиенты опрашивают его
-    и инвалидируют свои кэши при изменении значения."""
     result = await session.execute(select(Setting).where(Setting.key == _KEY))
     setting = result.scalar_one_or_none()
     if setting is None:
-        session.add(Setting(key=_KEY, value=1, description="Счётчик ревизии контента сайта — инкремент на любом сохранении"))
+        session.add(Setting(key=_KEY, value=1))
         return 1
     try:
         current = int(setting.value or 0)

database/web_notifications.py

@@ -89,7 +89,7 @@ async def count_unread_for_identity(
         .select_from(WebNotification)
         .where(
             WebNotification.identity_id == identity_id,
-            WebNotification.read is False,
+            WebNotification.read == False,  # noqa: E712 SQLAlchemy expression
         )
     )
     return result.scalar() or 0
@@ -103,7 +103,7 @@ async def mark_all_read_for_identity(
         update(WebNotification)
         .where(
             WebNotification.identity_id == identity_id,
-            WebNotification.read is False,
+            WebNotification.read == False,  # noqa: E712 SQLAlchemy expression
         )
         .values(read=True)
     )