06feb3fff5
fix: disable redirect_slashes globally to prevent HTTP 307 on subscription endpoints
2026-03-23 18:40:23 +03:00
77456efb75
fix: add X-CSRF-Token and X-Telegram-Init-Data to CORS allow_headers
...
The security hardening commit changed allow_headers from ['*'] to
['Authorization', 'Content-Type'], but the frontend sends X-CSRF-Token
on all POST/PUT/DELETE/PATCH requests and X-Telegram-Init-Data on all
requests. The missing headers caused preflight OPTIONS requests to fail
with 400 "Disallowed CORS origin".
2026-03-07 04:30:29 +03:00
e96fe1ecd8
fix: comprehensive security hardening from 7-agent review
...
Schema validation:
- Add max_length to init_data (4096), widget fields (first_name 64,
last_name 64, username 32, photo_url 512, hash 64)
- Add max_length=2048 to all token fields (verify, refresh, reset, auto-login)
- Add max_length=128 to EmailLoginRequest.password (bcrypt DoS prevention)
- Add pattern to OAuthCallbackRequest.referral_code (was missing)
- Add pattern=r'^\d{6}$' to EmailChangeVerifyRequest.code
- Add pattern/max_length to language field (ISO 639-1)
Auth endpoints:
- Add user.status check to auto-login (banned users could authenticate)
- Add exception chaining (from e) to refresh and auto-login endpoints
- Add IP rate limiting to initData, register standalone, verify email,
forgot password, and reset password endpoints
CORS:
- Add PATCH to allow_methods in both unified_app and webapi (38+ PATCH
endpoints were blocked for cross-origin requests)
JWKS:
- Fix race condition: move force-refresh cooldown check and cache
invalidation inside asyncio.Lock via dedicated _force_refresh_jwks()
2026-03-07 03:47:58 +03:00
6495384bcf
fix: transaction boundary and CORS in webapi
...
- Revert OIDC flush to commit before _store_refresh_token
(matches widget/initData pattern, prevents rollback losing user updates)
- Fix CORS wildcard+credentials in webapi/app.py (same as unified_app fix)
2026-03-07 03:33:37 +03:00
9a2aea038a
chore: add uv package manager and ruff linter configuration
...
- Add pyproject.toml with uv and ruff configuration
- Pin Python version to 3.13 via .python-version
- Add Makefile commands: lint, format, fix
- Apply ruff formatting to entire codebase
- Remove unused imports (base64 in yookassa/simple_subscription)
- Update .gitignore for new config files
2026-01-24 17:45:27 +03:00
0e24a5505c
feat(subscription): добавлены новые функции для управления тарифами и трафиком
...
- Обновлены схемы и маршруты для поддержки покупки тарифов и управления трафиком.
- Реализована синхронизация тарифов и серверов из RemnaWave при запуске.
- Добавлены новые параметры в тарифы: server_traffic_limits и allow_traffic_topup.
- Обновлены настройки и логика для проверки доступности докупки трафика в зависимости от тарифа.
- Внедрены новые эндпоинты для работы с колесом удачи и обработка платежей через Stars.
Обновлён .env.example с новыми параметрами для режима продаж подписок.
2026-01-12 07:41:10 +03:00
6b69ec750e
feat: add cabinet (personal account) backend API
...
- Add JWT authentication for cabinet users
- Add Telegram WebApp authentication
- Add subscription management endpoints
- Add balance and transactions endpoints
- Add referral system endpoints
- Add tickets support for cabinet
- Add webhooks and websocket for real-time updates
- Add email verification service
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-01 23:20:20 +03:00
1b736b381d
refactor(nalogo): упростить настройку чеков и использовать локальное время
...
- Удалена избыточная настройка NALOGO_RECEIPTS_ENABLED
- Удален эндпоинт /settings/support/nalogo_receipts_enabled
- Удалены методы is_nalogo_receipts_enabled и set_nalogo_receipts_enabled из SupportSettingsService
- Упрощена логика создания чеков
2025-12-27 19:29:04 +03:00
44247dee03
Update app.py
2025-12-22 14:47:40 +03:00
025d50675f
test
2025-12-19 02:14:57 +03:00
5ca0f5fc27
Еще правки
2025-12-18 00:13:57 +03:00
afd4fe8d1d
Конкурсы +АПИ
2025-12-14 14:37:29 +03:00
2761255e65
Ensure ReDoc loads reliably
2025-11-28 03:58:59 +03:00
14c89c7aab
Expand notification events
2025-11-25 01:43:07 +03:00
49b8a96a84
Handle missing creator on welcome text creation
2025-11-25 01:25:41 +03:00
2679172ae4
Fix referrer query predicate
2025-11-25 00:54:05 +03:00
eab4cce251
Add subscription events universal migration
2025-11-23 04:33:44 +03:00
86ebff4948
Serve proxy media with detected content type
2025-11-23 04:09:04 +03:00
045d44f451
Update app.py
2025-11-05 20:09:34 +03:00
08e0b3a657
Validate promo groups before updating server
2025-11-03 07:19:03 +03:00
da46c18210
Revert "Add automatic Telegram Stars rate fetching and toggle"
2025-11-01 00:55:55 +03:00
61a93f86b3
Add dynamic Telegram Stars rate with auto refresh
2025-11-01 00:25:55 +03:00
30ec07f7fe
Avoid loading poll responses in list endpoint
2025-10-24 09:39:39 +03:00
fa3ed3af81
Add system log endpoints to admin API
2025-10-24 09:20:34 +03:00
5f316f85b3
feat: expose monitoring logs through web api
2025-10-24 09:06:08 +03:00
d0ce5438a8
Add admin API and service for dynamic main menu buttons
2025-10-08 05:59:37 +03:00
422686dd2c
Revert "Add user API tokens and verification endpoint"
2025-10-08 01:26:42 +03:00
cdff9c4666
Add user API token management and external verification endpoint
2025-10-08 01:24:12 +03:00
64a4ece0fe
Allow FAQ creation API to pass display order and status
2025-10-07 06:28:26 +03:00
a2cb7527f8
feat(api): add promo offers endpoints and docs
2025-10-06 04:27:21 +03:00
3b392a671d
Revert "Implement targeted promotional offer campaigns"
2025-10-04 10:04:49 +03:00
3f8ea7f8fd
Add promotional offer broadcasting support
2025-10-04 09:59:17 +03:00
f919368d0b
Document miniapp deployment and reverse proxy setup
2025-10-01 02:32:36 +03:00
60d23bedde
Revert "Add tariff-based subscription mode"
2025-10-01 02:06:18 +03:00
70ad084bcd
Add tariff-aware subscription API handling
2025-10-01 02:04:20 +03:00
f40454313f
add ads compaigns remote route
2025-09-28 14:21:53 +05:00
71ac7ea464
backup logic and add documentation to stats route
2025-09-28 14:04:17 +05:00
3ba9598b5e
update api
2025-09-28 13:35:13 +05:00
3d9a75ff51
Fix RemnaWave API docs registration
2025-09-28 05:28:41 +03:00
4bc1c402e9
feat: document remnawave endpoints in swagger
2025-09-28 05:09:24 +03:00
562766a637
Revert "Revert "Add RemnaWave management endpoints to web API""
2025-09-28 04:57:10 +03:00
1e14a0919f
Revert "Add Remnawave component management API"
2025-09-28 04:56:33 +03:00
c10e34ad43
Add Remnawave component management API
2025-09-28 04:53:01 +03:00
8d5e2037d3
Revert "Replace ReDoc docs with Scalar UI"
2025-09-28 04:30:38 +03:00
870ee2fb66
Replace ReDoc docs with Scalar UI
2025-09-28 04:27:43 +03:00
b6bdeeefdd
Revert "Revert "Enable API key auth in web API docs""
2025-09-28 04:02:28 +03:00
be3fc7aa09
Revert "Enable API key auth in web API docs"
2025-09-28 03:02:22 +03:00
7ff7a051d9
Enable API key auth in web API docs
2025-09-28 02:59:07 +03:00
e71b7f4533
Revert "Revert "Add administrative web API and database support""
2025-09-26 05:18:41 +03:00
0a3913a2aa
Revert "Add administrative web API and database support"
2025-09-26 05:18:21 +03:00
c0mrade