Merge pull request #2861 from BEDOLAGA-DEV/release-please--branches--main

chore(main): release 3.45.2

.dockerignore

@@ -16,6 +16,10 @@ __pycache__/
 .pytest_cache/
 .coverage
 htmlcov/
+.venv/
+tests/
+.mypy_cache/
+.ruff_cache/
 
 # Environment files
 .env

.env.example

@@ -13,6 +13,11 @@ SUPPORT_USERNAME=@support
 # Имя пользователя бота (опционально, автоопределяется)
 # BOT_USERNAME=
 
+# ===== SOCKS5 ПРОКСИ =====
+# URL SOCKS5 прокси-сервера для маршрутизации трафика бота к Telegram API
+# Формат: socks5://user:password@host:port или socks5://host:port
+# PROXY_URL=socks5://127.0.0.1:1080
+
 # ===== СИСТЕМА ПОДДЕРЖКИ =====
 # Включить меню поддержки в интерфейсе
 SUPPORT_MENU_ENABLED=true
@@ -194,6 +199,9 @@ REMNAWAVE_WEBHOOK_PATH=/remnawave-webhook
 # Сгенерируйте: openssl rand -hex 32
 # ВАЖНО: этот же секрет указывается в панели Remnawave при создании вебхука
 REMNAWAVE_WEBHOOK_SECRET=
+# Уведомления администраторам о потере/восстановлении связи с нодами
+# false = не отправлять события node.connection_lost / node.connection_restored
+REMNAWAVE_WEBHOOK_NOTIFY_NODE_CONNECTION_STATUS=true
 
 # ===== УВЕДОМЛЕНИЯ ОТ ВЕБХУКОВ (что получают пользователи) =====
 # Глобальный переключатель уведомлений пользователям от вебхуков
@@ -369,6 +377,8 @@ REFERRAL_MINIMUM_TOPUP_KOPEKS=10000
 REFERRAL_FIRST_TOPUP_BONUS_KOPEKS=10000
 REFERRAL_INVITER_BONUS_KOPEKS=10000
 REFERRAL_COMMISSION_PERCENT=25
+# Макс. кол-во платежей реферала, с которых начисляется комиссия (0 = без лимита)
+REFERRAL_MAX_COMMISSION_PAYMENTS=0
 # Показывать раздел партнёрки в кабинете
 REFERRAL_PARTNER_SECTION_VISIBLE=true
 
@@ -489,11 +499,11 @@ YOOKASSA_WEBHOOK_PORT=8082
 YOOKASSA_MIN_AMOUNT_KOPEKS=5000
 YOOKASSA_MAX_AMOUNT_KOPEKS=1000000
 
-# Быстрый выбор суммы пополнения через YooKassa
-YOOKASSA_QUICK_AMOUNT_SELECTION_ENABLED=true
+# Рекуррентные платежи YooKassa (автосохранение карты для автоплатежей)
+YOOKASSA_RECURRENT_ENABLED=false
+# true = карта сохраняется обязательно, false = пользователь решает (чекбокс на стороне YooKassa)
+YOOKASSA_RECURRENT_REQUIRED=true
 
-# Отключить отображение кнопок выбора суммы пополнения (оставить только ввод вручную)
-DISABLE_TOPUP_BUTTONS=false
 # Отключить пополнение баланса через поддержку
 SUPPORT_TOPUP_ENABLED=true
 
@@ -512,6 +522,7 @@ NALOGO_STORAGE_PATH=./nalogo_tokens.json  # Путь к файлу с токен
 NALOGO_QUEUE_CHECK_INTERVAL=300           # Интервал проверки очереди чеков (секунды)
 NALOGO_QUEUE_RECEIPT_DELAY=3              # Задержка между отправкой чеков (секунды)
 NALOGO_QUEUE_MAX_ATTEMPTS=10              # Максимум попыток отправки одного чека
+# NALOGO_PROXY_URL=socks5://127.0.0.1:1080  # SOCKS прокси для nalog.ru (если не задан — используется PROXY_URL)
 
 # ===== НАСТРОЙКИ ОПИСАНИЙ ПЛАТЕЖЕЙ =====
 # Эти настройки позволяют изменить описания платежей,
@@ -603,7 +614,7 @@ PLATEGA_RETURN_URL=
 PLATEGA_FAILED_URL=
 PLATEGA_CURRENCY=RUB
 # Список ID активных методов из кабинета Platega (через запятую)
-PLATEGA_ACTIVE_METHODS=2,10,11,12,13
+PLATEGA_ACTIVE_METHODS=2,11,12,13
 PLATEGA_MIN_AMOUNT_KOPEKS=100
 PLATEGA_MAX_AMOUNT_KOPEKS=100000000
 PLATEGA_WEBHOOK_PATH=/platega-webhook
@@ -630,6 +641,13 @@ FREEKASSA_WEBHOOK_PORT=8088
 FREEKASSA_PAYMENT_SYSTEM_ID=
 # Использовать API для создания заказов (обязательно для NSPK СБП)
 FREEKASSA_USE_API=false
+# Раздельные методы оплаты (отображаются как отдельные кнопки)
+# СБП (QR код) — i=44
+FREEKASSA_SBP_ENABLED=false
+FREEKASSA_SBP_DISPLAY_NAME=СБП (QR код)
+# Карты РФ — i=36
+FREEKASSA_CARD_ENABLED=false
+FREEKASSA_CARD_DISPLAY_NAME=Карта РФ
 
 # ===== KASSA AI (api.fk.life) =====
 # Отдельная платёжная система, работает параллельно с Freekassa
@@ -648,6 +666,20 @@ KASSA_AI_WEBHOOK_PORT=8089
 # Способ оплаты: 44 = СБП (QR), 36 = Карты РФ, 43 = SberPay
 KASSA_AI_PAYMENT_SYSTEM_ID=44
 
+# ===== RIOPAY (api.riopay.online) =====
+RIOPAY_ENABLED=false
+RIOPAY_API_TOKEN=
+# Ключ для HMAC-SHA512 верификации вебхуков (если не указан, используется RIOPAY_API_TOKEN)
+RIOPAY_WEBHOOK_SECRET=
+RIOPAY_DISPLAY_NAME=RioPay
+RIOPAY_CURRENCY=RUB
+RIOPAY_MIN_AMOUNT_KOPEKS=10000
+RIOPAY_MAX_AMOUNT_KOPEKS=100000000
+RIOPAY_WEBHOOK_PATH=/riopay-webhook
+# URL для редиректа после оплаты (опционально)
+RIOPAY_SUCCESS_URL=
+RIOPAY_FAIL_URL=
+
 # ===== WATA =====
 WATA_ENABLED=false
 WATA_BASE_URL=https://api.wata.pro

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.19.0"
+  ".": "3.45.2"
 }

CONTRIBUTING.md

@@ -197,28 +197,17 @@ async def create_subscription(
 ### Документация кода
 
 ```python
-async def calculate_subscription_price(
-    period_days: int,
-    traffic_gb: int,
-    devices_count: int,
-    servers_count: int
-) -> int:
-    """
-    Рассчитывает стоимость подписки.
-    
-    Args:
-        period_days: Период подписки в днях
-        traffic_gb: Лимит трафика в ГБ (0 = безлимит)
-        devices_count: Количество устройств
-        servers_count: Количество серверов
-        
-    Returns:
-        Стоимость в копейках
-        
-    Raises:
-        ValueError: Если переданы некорректные параметры
-    """
-    # implementation
+from app.services.pricing_engine import PricingEngine
+
+pricing = PricingEngine.calculate_renewal_price(
+    subscription=subscription,
+    period_days=30,
+    user=user,
+)
+# pricing.final_total — стоимость в копейках
+# pricing.original_total — цена до скидок
+# pricing.promo_group_discount — скидка промогруппы
+# pricing.promo_offer_discount — скидка промо-оффера
 ```
 
 ### Обработка ошибок
@@ -341,20 +330,18 @@ python main.py
 ### Тестирование компонентов
 
 ```python
-# tests/test_subscription_service.py
+# tests/services/test_pricing_engine.py
 import pytest
-from app.services.subscription_service import SubscriptionService
+from app.services.pricing_engine import PricingEngine
 
-@pytest.mark.asyncio
-async def test_calculate_price():
-    price = await SubscriptionService.calculate_subscription_price(
+def test_calculate_renewal_price():
+    pricing = PricingEngine.calculate_renewal_price(
+        subscription=mock_subscription,
         period_days=30,
-        traffic_gb=100,
-        devices_count=3,
-        servers_count=1
+        user=mock_user,
     )
-    assert price > 0
-    assert isinstance(price, int)
+    assert pricing.final_total > 0
+    assert isinstance(pricing.final_total, int)
 ```
 
 ### Integration тесты

Dockerfile

@@ -4,27 +4,27 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
     && rm -rf /var/lib/apt/lists/*
 
-RUN python -m venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
+COPY --from=ghcr.io/astral-sh/uv:0.10.8 /uv /uvx /bin/
 
-COPY requirements.txt .
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
 
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir -r requirements.txt
+WORKDIR /app
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    uv sync --frozen --no-dev
 
 FROM python:3.13-slim
 
-ARG VERSION="v3.19.0" # x-release-please-version
+ARG VERSION="v3.45.2" # x-release-please-version
 ARG BUILD_DATE
 ARG VCS_REF
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    wget \
-    && rm -rf /var/lib/apt/lists/* \
-    && apt-get clean
-
-COPY --from=builder /opt/venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
+COPY --from=builder /app/.venv /app/.venv
+ENV PATH="/app/.venv/bin:$PATH"
 
 RUN groupadd -g 1000 app && \
     useradd -u 1000 -g 1000 -m -s /bin/bash app
@@ -33,8 +33,8 @@ WORKDIR /app
 
 COPY --chown=app:app . .
 
-RUN mkdir -p logs data && \
-    chown -R app:app /app logs data
+RUN mkdir -p logs data uploads/images uploads/videos uploads/thumbnails && \
+    chown -R app:app logs data uploads
 
 USER app
 
@@ -56,7 +56,7 @@ LABEL org.opencontainers.image.title="Bedolaga RemnaWave Bot" \
       org.opencontainers.image.url="https://github.com/fr1ngg/remnawave-bedolaga-telegram-bot" \
       org.opencontainers.image.vendor="fr1ngg"
 
-HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
-    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/health')" || exit 1
 
 CMD ["python", "main.py"]

app/bot.py

@@ -60,12 +60,14 @@ from app.handlers.admin import (
     welcome_text as admin_welcome_text,
 )
 from app.handlers.channel_member import register_handlers as register_channel_member_handlers
+from app.handlers.gift_activation import register_handlers as register_gift_activation_handlers
 from app.handlers.stars_payments import register_stars_handlers
 from app.middlewares.auth import AuthMiddleware
 from app.middlewares.blacklist import BlacklistMiddleware
 from app.middlewares.button_stats import ButtonStatsMiddleware
 from app.middlewares.chat_type_filter import ChatTypeFilterMiddleware
 from app.middlewares.context_binding import ContextVarsMiddleware
+from app.middlewares.display_name_restriction import DisplayNameRestrictionMiddleware
 from app.middlewares.global_error import GlobalErrorMiddleware
 from app.middlewares.logging import LoggingMiddleware
 from app.middlewares.maintenance import MaintenanceMiddleware
@@ -95,10 +97,21 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
     except Exception as e:
         logger.warning('Кеш не инициализирован', error=e)
 
-    from aiogram.client.default import DefaultBotProperties
-    from aiogram.enums import ParseMode
+    from app.bot_factory import create_bot
 
-    bot = Bot(token=settings.BOT_TOKEN, default=DefaultBotProperties(parse_mode=ParseMode.HTML))
+    bot = create_bot()
+
+    proxy_url = settings.get_proxy_url()
+    nalogo_proxy_url = settings.get_nalogo_proxy_url()
+
+    if proxy_url or nalogo_proxy_url:
+        from app.utils.proxy import mask_proxy_url
+
+        if proxy_url:
+            logger.info('Proxy configured', proxy_url=mask_proxy_url(proxy_url))
+        if nalogo_proxy_url:
+            source = 'NALOGO_PROXY_URL' if settings.NALOGO_PROXY_URL else 'PROXY_URL (fallback)'
+            logger.info('Nalogo proxy configured', proxy_url=mask_proxy_url(nalogo_proxy_url), source=source)
 
     maintenance_service.set_bot(bot)
     logger.info('Бот установлен в maintenance_service')
@@ -121,19 +134,20 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
     chat_type_filter = ChatTypeFilterMiddleware()
     dp.message.middleware(chat_type_filter)
     dp.callback_query.middleware(chat_type_filter)
+    dp.message.middleware(LoggingMiddleware())
+    dp.callback_query.middleware(LoggingMiddleware())
     dp.message.middleware(GlobalErrorMiddleware())
     dp.callback_query.middleware(GlobalErrorMiddleware())
     dp.pre_checkout_query.middleware(GlobalErrorMiddleware())
-    dp.message.middleware(LoggingMiddleware())
-    dp.callback_query.middleware(LoggingMiddleware())
     dp.message.middleware(MaintenanceMiddleware())
     dp.callback_query.middleware(MaintenanceMiddleware())
     blacklist_middleware = BlacklistMiddleware()
     dp.message.middleware(blacklist_middleware)
     dp.callback_query.middleware(blacklist_middleware)
     dp.pre_checkout_query.middleware(blacklist_middleware)
-    dp.message.middleware(ThrottlingMiddleware())
-    dp.callback_query.middleware(ThrottlingMiddleware())
+    throttling_middleware = ThrottlingMiddleware()
+    dp.message.middleware(throttling_middleware)
+    dp.callback_query.middleware(throttling_middleware)
 
     # Middleware для автоматического логирования кликов по кнопкам
     if settings.MENU_LAYOUT_ENABLED:
@@ -149,8 +163,12 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
     dp.message.middleware(AuthMiddleware())
     dp.callback_query.middleware(AuthMiddleware())
     dp.pre_checkout_query.middleware(AuthMiddleware())
+    display_name_restriction = DisplayNameRestrictionMiddleware()
+    dp.message.middleware(display_name_restriction)
+    dp.callback_query.middleware(display_name_restriction)
     dp.message.middleware(SubscriptionStatusMiddleware())
     dp.callback_query.middleware(SubscriptionStatusMiddleware())
+    dp.pre_checkout_query.middleware(SubscriptionStatusMiddleware())
     start.register_handlers(dp)
     menu.register_handlers(dp)
     subscription.register_handlers(dp)
@@ -198,6 +216,7 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
     admin_blocked_users.register_handlers(dp)
     admin_required_channels.register_handlers(dp)
     register_channel_member_handlers(dp)
+    register_gift_activation_handlers(dp)
     common.register_handlers(dp)
     register_stars_handlers(dp)
     user_contests.register_handlers(dp)
@@ -245,7 +264,7 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
     elif settings.is_cabinet_mode():
         logger.info('🏠 Режим Cabinet активен, базовый URL', MINIAPP_CUSTOM_URL=settings.MINIAPP_CUSTOM_URL)
 
-    # Load per-section button styles cache
+    # Load per-section button styles cache and menu layout cache
     if settings.is_cabinet_mode():
         try:
             from app.utils.button_styles_cache import load_button_styles_cache
@@ -254,6 +273,13 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
         except Exception as e:
             logger.warning('Failed to load button styles cache', error=e)
 
+        try:
+            from app.utils.menu_layout_cache import load_menu_layout_cache
+
+            await load_menu_layout_cache()
+        except Exception as e:
+            logger.warning('Failed to load menu layout cache', error=e)
+
     logger.info('Бот успешно настроен')
 
     return bot, dp

app/bot_factory.py

@@ -0,0 +1,20 @@
+"""Factory for creating Bot instances with proxy support."""
+
+from aiogram import Bot
+from aiogram.client.default import DefaultBotProperties
+from aiogram.enums import ParseMode
+
+from app.config import settings
+
+
+def create_bot(token: str | None = None, **kwargs) -> Bot:
+    """Create a Bot instance with SOCKS5 proxy session if PROXY_URL is configured."""
+    proxy_url = settings.get_proxy_url()
+    session = None
+    if proxy_url:
+        from aiogram.client.session.aiohttp import AiohttpSession
+
+        session = AiohttpSession(proxy=proxy_url)
+
+    kwargs.setdefault('default', DefaultBotProperties(parse_mode=ParseMode.HTML))
+    return Bot(token=token or settings.BOT_TOKEN, session=session, **kwargs)

app/cabinet/auth/__init__.py

@@ -2,21 +2,24 @@
 
 from .jwt_handler import (
     create_access_token,
+    create_auto_login_token,
     create_refresh_token,
     decode_token,
     get_token_payload,
 )
 from .password_utils import hash_password, verify_password
-from .telegram_auth import validate_telegram_init_data, validate_telegram_login_widget
+from .telegram_auth import validate_telegram_init_data, validate_telegram_login_widget, validate_telegram_oidc_token
 
 
 __all__ = [
     'create_access_token',
+    'create_auto_login_token',
     'create_refresh_token',
     'decode_token',
     'get_token_payload',
     'hash_password',
     'validate_telegram_init_data',
     'validate_telegram_login_widget',
+    'validate_telegram_oidc_token',
     'verify_password',
 ]

app/cabinet/auth/jwt_handler.py

@@ -123,6 +123,18 @@ def get_token_payload(token: str, expected_type: str = 'access') -> dict[str, An
     return payload
 
 
+def create_auto_login_token(user_id: int, ttl_hours: int = 72) -> str:
+    """Short-lived JWT for auto-login from guest purchase success page."""
+    expires = datetime.now(UTC) + timedelta(hours=ttl_hours)
+    payload = {
+        'sub': str(user_id),
+        'type': 'auto_login',
+        'exp': expires,
+        'iat': datetime.now(UTC),
+    }
+    return jwt.encode(payload, settings.get_cabinet_jwt_secret(), algorithm=JWT_ALGORITHM)
+
+
 def get_refresh_token_expires_at() -> datetime:
     """Get the expiration datetime for a new refresh token."""
     expire_days = settings.get_cabinet_refresh_token_expire_days()

app/cabinet/auth/merge_service.py

@@ -0,0 +1,154 @@
+"""Temporary merge token management for account linking.
+
+Stores short-lived tokens in Redis so the user can confirm merging
+two cabinet accounts (primary absorbs secondary) via a separate
+confirmation endpoint.
+"""
+
+import secrets
+from datetime import UTC, datetime
+from typing import Any
+
+import structlog
+
+from app.utils.cache import cache, cache_key
+
+
+logger = structlog.get_logger(__name__)
+
+MERGE_TOKEN_TTL_SECONDS = 1800  # 30 minutes
+MERGE_TOKEN_PREFIX = 'account_merge'
+
+
+async def create_merge_token(
+    primary_user_id: int,
+    secondary_user_id: int,
+    provider: str,
+    provider_id: str,
+) -> str:
+    """Generate a merge token and store its payload in Redis.
+
+    The token is a one-time confirmation handle: whoever presents it
+    within ``MERGE_TOKEN_TTL_SECONDS`` can execute the account merge.
+
+    Returns the raw token string (URL-safe base64, 32 bytes of entropy).
+    Raises ``RuntimeError`` if Redis write fails.
+    """
+    token = secrets.token_urlsafe(32)
+    value: dict[str, Any] = {
+        'primary_user_id': primary_user_id,
+        'secondary_user_id': secondary_user_id,
+        'provider': provider,
+        'provider_id': provider_id,
+        'created_at': datetime.now(UTC).isoformat(),
+    }
+    key = cache_key(MERGE_TOKEN_PREFIX, token)
+    stored = await cache.set(key, value, expire=MERGE_TOKEN_TTL_SECONDS)
+    if not stored:
+        logger.error(
+            'Failed to store merge token in Redis',
+            primary_user_id=primary_user_id,
+            secondary_user_id=secondary_user_id,
+            provider=provider,
+        )
+        raise RuntimeError('Failed to store merge token')
+
+    logger.info(
+        'Merge token created',
+        primary_user_id=primary_user_id,
+        secondary_user_id=secondary_user_id,
+        provider=provider,
+        provider_id=provider_id,
+    )
+    return token
+
+
+async def get_merge_token_data(token: str) -> dict[str, Any] | None:
+    """Read merge token payload *without* consuming it.
+
+    Intended for preview / confirmation screens where the user sees
+    what will happen before they press "Confirm".
+
+    Returns ``None`` when the token is expired, missing, or malformed.
+    """
+    key = cache_key(MERGE_TOKEN_PREFIX, token)
+    data: Any = await cache.get(key)
+    if data is None or not isinstance(data, dict):
+        return None
+    return data
+
+
+async def consume_merge_token(token: str) -> dict[str, Any] | None:
+    """Atomically read and delete a merge token (GETDEL).
+
+    This prevents double-merge race conditions: only the first caller
+    that reaches Redis will get the payload; every subsequent attempt
+    receives ``None``.
+
+    Returns the stored dict or ``None`` if already consumed / expired.
+    """
+    key = cache_key(MERGE_TOKEN_PREFIX, token)
+    data: Any = await cache.getdel(key)
+    if data is None or not isinstance(data, dict):
+        return None
+
+    logger.info(
+        'Merge token consumed',
+        primary_user_id=data.get('primary_user_id'),
+        secondary_user_id=data.get('secondary_user_id'),
+        provider=data.get('provider'),
+    )
+    return data
+
+
+_MAX_MERGE_RESTORE_ATTEMPTS = 3
+
+
+async def restore_merge_token(token: str, data: dict[str, Any]) -> bool:
+    """Re-store a consumed merge token so the user can retry after a DB failure.
+
+    Uses the remaining TTL based on the original ``created_at``.
+    Uses SETNX to avoid overwriting a fresh token.
+    Caps restore attempts to prevent infinite retry cycles.
+    Returns ``True`` if restored, ``False`` if exhausted or Redis write failed.
+    """
+    restore_count = data.get('_restore_count', 0) + 1
+    if restore_count > _MAX_MERGE_RESTORE_ATTEMPTS:
+        logger.warning(
+            'Merge token exhausted restore attempts',
+            primary_user_id=data.get('primary_user_id'),
+            secondary_user_id=data.get('secondary_user_id'),
+            restore_count=restore_count,
+        )
+        return False
+
+    # Shallow copy to avoid mutating the caller's dict
+    data = {**data, '_restore_count': restore_count}
+
+    created_at_str: str = data.get('created_at', '')
+    try:
+        created_at = datetime.fromisoformat(created_at_str)
+        if created_at.tzinfo is None:
+            created_at = created_at.replace(tzinfo=UTC)
+        elapsed = (datetime.now(UTC) - created_at).total_seconds()
+        remaining_ttl = max(1, min(int(MERGE_TOKEN_TTL_SECONDS - elapsed), MERGE_TOKEN_TTL_SECONDS))
+    except (ValueError, TypeError):
+        remaining_ttl = 60  # brief retry window — fail closed
+
+    key = cache_key(MERGE_TOKEN_PREFIX, token)
+    stored = await cache.setnx(key, data, expire=remaining_ttl)
+    if stored:
+        logger.info(
+            'Merge token restored after failed merge',
+            primary_user_id=data.get('primary_user_id'),
+            secondary_user_id=data.get('secondary_user_id'),
+            remaining_ttl=remaining_ttl,
+            restore_count=restore_count,
+        )
+    else:
+        logger.error(
+            'Failed to restore merge token to Redis (key may already exist)',
+            primary_user_id=data.get('primary_user_id'),
+            secondary_user_id=data.get('secondary_user_id'),
+        )
+    return bool(stored)

app/cabinet/auth/oauth_providers.py

@@ -1,5 +1,7 @@
 """OAuth 2.0 provider implementations for cabinet authentication."""
 
+import base64
+import hashlib
 import secrets
 from abc import ABC, abstractmethod
 from typing import Any, TypedDict
@@ -33,7 +35,7 @@ class OAuthTokenResponse(TypedDict, total=False):
     expires_in: int
     refresh_token: str
     scope: str
-    # VK-specific: email and user_id come in token response
+    # Provider-specific extra fields (optional)
     email: str
     user_id: int
 
@@ -67,15 +69,19 @@ class DiscordUserInfoResponse(TypedDict, total=False):
     avatar: str
 
 
-class VKUserInfoItem(TypedDict, total=False):
-    id: int
+class VKIDUserData(TypedDict, total=False):
+    """VK ID /oauth2/user_info response user object."""
+
+    user_id: str
     first_name: str
     last_name: str
-    photo_200: str
+    phone: str
+    avatar: str
+    email: str
 
 
-class VKUserInfoResponse(TypedDict, total=False):
-    response: list[VKUserInfoItem]
+class VKIDUserInfoResponse(TypedDict, total=False):
+    user: VKIDUserData
 
 
 # --- Models ---
@@ -97,23 +103,45 @@ class OAuthUserInfo(BaseModel):
 # --- CSRF state management (Redis) ---
 
 
-async def generate_oauth_state(provider: str) -> str:
-    """Generate a CSRF state token for OAuth flow. Stored in Redis with TTL."""
+async def generate_oauth_state(provider: str, extra_data: dict[str, str] | None = None) -> str:
+    """Generate a CSRF state token for OAuth flow.
+
+    Stores provider name and optional extra data (e.g., PKCE code_verifier) in Redis with TTL.
+    Keys prefixed with '_' are ephemeral and NOT stored in Redis (e.g., _code_challenge).
+    CacheService handles JSON serialization internally.
+    """
     state = secrets.token_urlsafe(32)
-    await cache.set(cache_key('oauth_state', state), provider, expire=STATE_TTL_SECONDS)
+    value: dict[str, Any] = {'provider': provider}
+    if extra_data:
+        # Filter out ephemeral keys (prefixed with '_') — they're only needed for the URL
+        value.update({k: v for k, v in extra_data.items() if not k.startswith('_')})
+    stored = await cache.set(cache_key('oauth_state', state), value, expire=STATE_TTL_SECONDS)
+    if not stored:
+        logger.error('Failed to store OAuth state in Redis')
+        raise RuntimeError('Failed to store OAuth state')
     return state
 
 
-async def validate_oauth_state(state: str, provider: str) -> bool:
-    """Validate and consume a CSRF state token from Redis."""
+async def validate_oauth_state(state: str, provider: str | None = None) -> dict[str, Any] | None:
+    """Validate and consume a CSRF state token from Redis.
+
+    Uses atomic GETDEL to prevent TOCTOU race conditions.
+    Returns the stored data dict (with 'provider' key + any extra data) or None if invalid.
+
+    Args:
+        state: The state token to validate.
+        provider: If provided, verifies it matches the stored provider.
+                  If None, skips provider check (used for server-complete flow).
+    """
     key = cache_key('oauth_state', state)
-    stored_provider: str | None = await cache.get(key)
-    if stored_provider is None:
-        return False
-    await cache.delete(key)
-    if stored_provider != provider:
-        return False
-    return True
+    data: Any = await cache.getdel(key)
+    if data is None:
+        return None
+    if not isinstance(data, dict):
+        return None
+    if provider is not None and data.get('provider') != provider:
+        return None
+    return data
 
 
 # --- Provider implementations ---
@@ -130,13 +158,28 @@ class OAuthProvider(ABC):
         self.client_secret = client_secret
         self.redirect_uri = redirect_uri
 
-    @abstractmethod
-    def get_authorization_url(self, state: str) -> str:
-        """Build the authorization URL for the provider."""
+    def prepare_auth_state(self) -> dict[str, str]:
+        """Return extra data to store with OAuth state (e.g., PKCE code_verifier).
+
+        Override in providers that need PKCE or other state-stored data.
+        The returned dict is stored in Redis alongside the state token
+        and passed back via validate_oauth_state().
+        """
+        return {}
 
     @abstractmethod
-    async def exchange_code(self, code: str) -> OAuthTokenResponse:
-        """Exchange authorization code for tokens."""
+    def get_authorization_url(self, state: str, **kwargs: Any) -> str:
+        """Build the authorization URL for the provider.
+
+        kwargs may contain extra data from prepare_auth_state() (e.g., code_challenge).
+        """
+
+    @abstractmethod
+    async def exchange_code(self, code: str, **kwargs: Any) -> OAuthTokenResponse:
+        """Exchange authorization code for tokens.
+
+        kwargs may contain provider-specific params (e.g., device_id, code_verifier for VK).
+        """
 
     @abstractmethod
     async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
@@ -151,7 +194,7 @@ class GoogleProvider(OAuthProvider):
     TOKEN_URL = 'https://oauth2.googleapis.com/token'
     USERINFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo'
 
-    def get_authorization_url(self, state: str) -> str:
+    def get_authorization_url(self, state: str, **kwargs: Any) -> str:
         params: dict[str, str] = {
             'client_id': self.client_id,
             'redirect_uri': self.redirect_uri,
@@ -164,7 +207,7 @@ class GoogleProvider(OAuthProvider):
         request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
         return str(request.url)
 
-    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+    async def exchange_code(self, code: str, **kwargs: Any) -> OAuthTokenResponse:
         async with httpx.AsyncClient(timeout=30) as client:
             response = await client.post(
                 self.TOKEN_URL,
@@ -209,7 +252,7 @@ class YandexProvider(OAuthProvider):
     TOKEN_URL = 'https://oauth.yandex.com/token'
     USERINFO_URL = 'https://login.yandex.ru/info'
 
-    def get_authorization_url(self, state: str) -> str:
+    def get_authorization_url(self, state: str, **kwargs: Any) -> str:
         params: dict[str, str] = {
             'client_id': self.client_id,
             'redirect_uri': self.redirect_uri,
@@ -221,7 +264,7 @@ class YandexProvider(OAuthProvider):
         request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
         return str(request.url)
 
-    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+    async def exchange_code(self, code: str, **kwargs: Any) -> OAuthTokenResponse:
         async with httpx.AsyncClient(timeout=30) as client:
             response = await client.post(
                 self.TOKEN_URL,
@@ -275,7 +318,7 @@ class DiscordProvider(OAuthProvider):
     TOKEN_URL = 'https://discord.com/api/oauth2/token'
     USERINFO_URL = 'https://discord.com/api/v10/users/@me'
 
-    def get_authorization_url(self, state: str) -> str:
+    def get_authorization_url(self, state: str, **kwargs: Any) -> str:
         params: dict[str, str] = {
             'client_id': self.client_id,
             'redirect_uri': self.redirect_uri,
@@ -287,7 +330,7 @@ class DiscordProvider(OAuthProvider):
         request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
         return str(request.url)
 
-    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+    async def exchange_code(self, code: str, **kwargs: Any) -> OAuthTokenResponse:
         async with httpx.AsyncClient(timeout=30) as client:
             response = await client.post(
                 self.TOKEN_URL,
@@ -329,35 +372,72 @@ class DiscordProvider(OAuthProvider):
 
 
 class VKProvider(OAuthProvider):
+    """VK ID OAuth 2.1 provider (id.vk.ru).
+
+    Uses OAuth 2.1 with mandatory PKCE (S256).
+    Old oauth.vk.com endpoints deprecated since September 30, 2025.
+    """
+
     name = 'vk'
     display_name = 'VK'
 
-    AUTHORIZE_URL = 'https://oauth.vk.com/authorize'
-    TOKEN_URL = 'https://oauth.vk.com/access_token'
-    USERINFO_URL = 'https://api.vk.com/method/users.get'
-    API_VERSION = '5.131'
+    AUTHORIZE_URL = 'https://id.vk.ru/authorize'
+    TOKEN_URL = 'https://id.vk.ru/oauth2/auth'
+    USERINFO_URL = 'https://id.vk.ru/oauth2/user_info'
 
-    def get_authorization_url(self, state: str) -> str:
+    @staticmethod
+    def _generate_pkce() -> tuple[str, str]:
+        """Generate PKCE code_verifier and code_challenge (S256)."""
+        code_verifier = secrets.token_urlsafe(64)
+        digest = hashlib.sha256(code_verifier.encode('ascii')).digest()
+        code_challenge = base64.urlsafe_b64encode(digest).rstrip(b'=').decode('ascii')
+        return code_verifier, code_challenge
+
+    def prepare_auth_state(self) -> dict[str, str]:
+        """Generate PKCE pair. code_verifier stored in Redis, code_challenge only goes to URL."""
+        code_verifier, code_challenge = self._generate_pkce()
+        # code_challenge is ephemeral — only needed for the authorization URL,
+        # not stored in Redis (code_verifier is the secret used during token exchange)
+        return {
+            'code_verifier': code_verifier,
+            '_code_challenge': code_challenge,
+        }
+
+    def get_authorization_url(self, state: str, **kwargs: Any) -> str:
+        code_challenge: str = kwargs.get('_code_challenge', '')
         params: dict[str, str] = {
             'client_id': self.client_id,
             'redirect_uri': self.redirect_uri,
             'response_type': 'code',
-            'scope': 'email',
+            'scope': 'vkid.personal_info email',
             'state': state,
-            'v': self.API_VERSION,
+            'code_challenge': code_challenge,
+            'code_challenge_method': 'S256',
         }
         request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
         return str(request.url)
 
-    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+    async def exchange_code(self, code: str, **kwargs: Any) -> OAuthTokenResponse:
+        device_id: str = kwargs.get('device_id', '')
+        code_verifier: str = kwargs.get('code_verifier', '')
+        state: str = kwargs.get('state', '')
+
+        if not device_id:
+            raise ValueError('device_id is required for VK ID token exchange')
+        if not code_verifier:
+            raise ValueError('code_verifier is required for VK ID token exchange')
+
         async with httpx.AsyncClient(timeout=30) as client:
-            response = await client.get(
+            response = await client.post(
                 self.TOKEN_URL,
-                params={
-                    'client_id': self.client_id,
-                    'client_secret': self.client_secret,
+                data={
+                    'grant_type': 'authorization_code',
                     'code': code,
                     'redirect_uri': self.redirect_uri,
+                    'client_id': self.client_id,
+                    'device_id': device_id,
+                    'code_verifier': code_verifier,
+                    'state': state,
                 },
             )
             response.raise_for_status()
@@ -366,33 +446,37 @@ class VKProvider(OAuthProvider):
 
     async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
         access_token = token_data['access_token']
-        user_id: int | None = token_data.get('user_id')
-        # VK returns email in token response, not in userinfo
-        email: str | None = token_data.get('email')
 
         async with httpx.AsyncClient(timeout=30) as client:
-            response = await client.get(
+            response = await client.post(
                 self.USERINFO_URL,
-                params={
+                data={
                     'access_token': access_token,
-                    'fields': 'photo_200',
-                    'v': self.API_VERSION,
+                    'client_id': self.client_id,
                 },
             )
             response.raise_for_status()
-            data: VKUserInfoResponse = response.json()
+            data: VKIDUserInfoResponse = response.json()
 
-        users: list[Any] = data.get('response', [])
-        user_data: VKUserInfoItem = users[0] if users else {}  # type: ignore[assignment]
+        user_data = data.get('user')
+        if not user_data:
+            raise ValueError('VK ID response missing user data')
+
+        user_id = user_data.get('user_id')
+        if not user_id:
+            raise ValueError('VK ID response missing user_id')
+
+        # VK ID returns email only if 'email' scope was granted and user has a verified email
+        email: str | None = user_data.get('email') or None
 
         return OAuthUserInfo(
             provider='vk',
-            provider_id=str(user_id or user_data.get('id', '')),
+            provider_id=str(user_id),
             email=email,
             email_verified=bool(email),
             first_name=user_data.get('first_name'),
             last_name=user_data.get('last_name'),
-            avatar_url=user_data.get('photo_200'),
+            avatar_url=user_data.get('avatar'),
         )
 
 

app/cabinet/auth/telegram_auth.py

@@ -1,15 +1,27 @@
 """Telegram authentication validation for cabinet."""
 
+import asyncio
 import hashlib
 import hmac
 import json
-from datetime import UTC, datetime
+from datetime import UTC, datetime, timedelta
 from typing import Any
-from urllib.parse import parse_qsl, unquote
+from urllib.parse import parse_qsl
+
+import httpx
+import jwt as pyjwt
+import structlog
 
 from app.config import settings
 
 
+logger = structlog.get_logger(__name__)
+
+
+# Maximum allowed clock skew (seconds) for auth_date — tolerates minor drift between Telegram servers and ours.
+_MAX_CLOCK_SKEW_SECONDS = 300
+
+
 def validate_telegram_login_widget(data: dict[str, Any], max_age_seconds: int = 86400) -> bool:
     """
     Validate Telegram Login Widget data.
@@ -29,17 +41,27 @@ def validate_telegram_login_widget(data: dict[str, Any], max_age_seconds: int =
     if not check_hash:
         return False
 
-    # Check auth_date is not too old
+    # Check auth_date is present and within valid range
     auth_date = auth_data.get('auth_date')
-    if auth_date:
-        try:
-            # Use UTC timestamp to avoid timezone issues
-            auth_time = datetime.fromtimestamp(int(auth_date), tz=UTC)
-            age = (datetime.now(UTC) - auth_time).total_seconds()
-            if age > max_age_seconds:
-                return False
-        except (ValueError, TypeError, OSError):
+    if not auth_date:
+        return False
+    try:
+        auth_time = datetime.fromtimestamp(int(auth_date), tz=UTC)
+        age = (datetime.now(UTC) - auth_time).total_seconds()
+        if age > max_age_seconds or age < -_MAX_CLOCK_SKEW_SECONDS:
+            logger.warning(
+                'Telegram widget auth rejected: too old',
+                age_hours=round(age / 3600, 1),
+                max_age_hours=round(max_age_seconds / 3600, 1),
+            )
             return False
+        if age > 86400:
+            logger.info(
+                'Telegram widget auth accepted with stale auth_date',
+                age_hours=round(age / 3600, 1),
+            )
+    except (ValueError, TypeError, OSError):
+        return False
 
     # Build data-check-string (sorted key=value pairs, newline-separated)
     data_check_arr = [f'{k}={v}' for k, v in sorted(auth_data.items()) if v is not None]
@@ -76,17 +98,27 @@ def validate_telegram_init_data(init_data: str, max_age_seconds: int = 86400) ->
         if not received_hash:
             return None
 
-        # Check auth_date is not too old
+        # Check auth_date is present and within valid range
         auth_date = parsed.get('auth_date')
-        if auth_date:
-            try:
-                # Use UTC timestamp to avoid timezone issues
-                auth_time = datetime.fromtimestamp(int(auth_date), tz=UTC)
-                age = (datetime.now(UTC) - auth_time).total_seconds()
-                if age > max_age_seconds:
-                    return None
-            except (ValueError, TypeError, OSError):
+        if not auth_date:
+            return None
+        try:
+            auth_time = datetime.fromtimestamp(int(auth_date), tz=UTC)
+            age = (datetime.now(UTC) - auth_time).total_seconds()
+            if age > max_age_seconds or age < -_MAX_CLOCK_SKEW_SECONDS:
+                logger.warning(
+                    'Telegram initData rejected: too old',
+                    age_hours=round(age / 3600, 1),
+                    max_age_hours=round(max_age_seconds / 3600, 1),
+                )
                 return None
+            if age > 86400:
+                logger.info(
+                    'Telegram initData accepted with stale auth_date (Telegram caching bug)',
+                    age_hours=round(age / 3600, 1),
+                )
+        except (ValueError, TypeError, OSError):
+            return None
 
         # Build data-check-string
         data_check_arr = [f'{k}={v}' for k, v in sorted(parsed.items())]
@@ -105,7 +137,7 @@ def validate_telegram_init_data(init_data: str, max_age_seconds: int = 86400) ->
         # Parse user data from the validated data
         user_data_str = parsed.get('user')
         if user_data_str:
-            user_data = json.loads(unquote(user_data_str))
+            user_data = json.loads(user_data_str)
             return user_data
 
         return parsed
@@ -125,3 +157,117 @@ def extract_telegram_user_from_init_data(init_data: str) -> dict[str, Any] | Non
         User data dict with id, first_name, last_name, username, etc. or None if invalid
     """
     return validate_telegram_init_data(init_data)
+
+
+# JWKS cache (module-level, refreshed periodically)
+_jwks_cache: dict[str, Any] = {}
+_jwks_cache_expiry: datetime | None = None
+_JWKS_CACHE_TTL_SECONDS = 3600  # 1 hour
+_JWKS_URL = 'https://oauth.telegram.org/.well-known/jwks.json'
+_OIDC_ISSUER = 'https://oauth.telegram.org'
+
+_jwks_lock = asyncio.Lock()
+_jwks_last_force_refresh: datetime | None = None
+_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS = 30
+
+
+def _build_public_keys(jwks_data: dict[str, Any]) -> dict[str, Any]:
+    """Build public key mapping from JWKS data."""
+    public_keys: dict[str, Any] = {}
+    for key_data in jwks_data.get('keys', []):
+        kid = key_data.get('kid')
+        if kid:
+            public_keys[kid] = pyjwt.algorithms.RSAAlgorithm.from_jwk(key_data)
+    return public_keys
+
+
+async def _get_jwks(force: bool = False) -> dict[str, Any]:
+    """Fetch and cache Telegram OIDC JWKS keys."""
+    global _jwks_cache, _jwks_cache_expiry
+
+    now = datetime.now(UTC)
+    if not force and _jwks_cache and _jwks_cache_expiry and now < _jwks_cache_expiry:
+        return _jwks_cache
+
+    async with _jwks_lock:
+        # Double-check after acquiring lock
+        now = datetime.now(UTC)
+        if not force and _jwks_cache and _jwks_cache_expiry and now < _jwks_cache_expiry:
+            return _jwks_cache
+
+        async with httpx.AsyncClient(timeout=10) as client:
+            response = await client.get(_JWKS_URL)
+            response.raise_for_status()
+            _jwks_cache = response.json()
+            _jwks_cache_expiry = now + timedelta(seconds=_JWKS_CACHE_TTL_SECONDS)
+            return _jwks_cache
+
+
+async def _force_refresh_jwks(kid: str) -> dict[str, Any] | None:
+    """Force JWKS refresh with cooldown protection. Returns refreshed JWKS or None if on cooldown."""
+    global _jwks_cache_expiry, _jwks_last_force_refresh
+
+    async with _jwks_lock:
+        now = datetime.now(UTC)
+        if (
+            _jwks_last_force_refresh
+            and (now - _jwks_last_force_refresh).total_seconds() < _JWKS_FORCE_REFRESH_COOLDOWN_SECONDS
+        ):
+            logger.warning('Telegram OIDC: JWKS force refresh on cooldown', kid=kid)
+            return None
+        _jwks_last_force_refresh = now
+        _jwks_cache_expiry = None
+
+    return await _get_jwks(force=True)
+
+
+async def validate_telegram_oidc_token(id_token: str, client_id: str) -> dict[str, Any] | None:
+    """
+    Validate a Telegram OIDC id_token using JWKS.
+
+    Args:
+        id_token: JWT id_token from Telegram OIDC flow
+        client_id: Expected audience (bot's numeric ID as string)
+
+    Returns:
+        Decoded claims dict if valid, None otherwise.
+        Claims include: sub, id, name, preferred_username, picture, iss, aud, exp, iat
+    """
+    try:
+        # Build public keys from JWKS
+        jwks_data = await _get_jwks()
+        public_keys = _build_public_keys(jwks_data)
+
+        # Decode header to get kid
+        unverified_header = pyjwt.get_unverified_header(id_token)
+        kid = unverified_header.get('kid')
+
+        # If kid not found, force JWKS refresh (key rotation) with cooldown
+        if kid and kid not in public_keys:
+            refreshed = await _force_refresh_jwks(kid)
+            if refreshed:
+                public_keys = _build_public_keys(refreshed)
+
+        if not kid or kid not in public_keys:
+            logger.warning('Telegram OIDC: unknown kid in id_token', kid=kid)
+            return None
+
+        claims = pyjwt.decode(
+            id_token,
+            key=public_keys[kid],
+            algorithms=['RS256'],
+            audience=client_id,
+            issuer=_OIDC_ISSUER,
+            options={'require': ['exp', 'iat', 'iss', 'aud', 'sub']},
+        )
+        return claims
+
+    except pyjwt.ExpiredSignatureError:
+        logger.warning('Telegram OIDC: id_token expired')
+        return None
+    except pyjwt.InvalidTokenError as e:
+        logger.warning('Telegram OIDC: invalid id_token', error=str(e))
+        return None
+    except httpx.HTTPError as e:
+        logger.error('Telegram OIDC: failed to fetch JWKS', error=str(e))
+        return None

app/cabinet/dependencies.py

@@ -14,6 +14,7 @@ from app.services.maintenance_service import maintenance_service
 
 from .auth.jwt_handler import get_token_payload
 from .auth.telegram_auth import validate_telegram_init_data
+from .ip_utils import get_client_ip
 
 
 logger = structlog.get_logger(__name__)
@@ -289,11 +290,11 @@ def require_permission(*permissions: str):
     ) -> User:
         from app.services.permission_service import PermissionService
 
-        ip_address = (
-            request.headers.get('X-Forwarded-For', '').split(',')[0].strip()
-            or request.headers.get('X-Real-IP', '').strip()
-            or (request.client.host if request.client else None)
-        )
+        try:
+            client_ip = get_client_ip(request)
+        except HTTPException:
+            logger.warning('Unable to determine client IP in require_permission')
+            client_ip = 'unknown'
         user_agent = request.headers.get('user-agent', '')
 
         # Extract resource_type from the first permission (section before ':')
@@ -308,7 +309,7 @@ def require_permission(*permissions: str):
                 db,
                 user,
                 perm,
-                ip_address=ip_address,
+                ip_address=client_ip,
             )
             if not allowed:
                 await PermissionService.log_action(
@@ -317,7 +318,7 @@ def require_permission(*permissions: str):
                     action=perm,
                     resource_type=resource_type,
                     status='denied',
-                    ip_address=ip_address,
+                    ip_address=client_ip,
                     user_agent=user_agent,
                     request_method=request.method,
                     request_path=str(request.url.path),
@@ -354,7 +355,7 @@ def require_permission(*permissions: str):
             action=','.join(permissions),
             resource_type=resource_type,
             status='success',
-            ip_address=ip_address,
+            ip_address=client_ip,
             user_agent=user_agent,
             request_method=request.method,
             request_path=str(request.url.path),

app/cabinet/ip_utils.py

@@ -0,0 +1,60 @@
+"""Shared IP extraction utilities for cabinet module."""
+
+from ipaddress import ip_address, ip_network
+
+from fastapi import HTTPException, Request, status
+
+from app.config import settings
+
+
+def _is_trusted_proxy(peer_ip: str, trusted: set[str]) -> bool:
+    """Check if peer IP matches any trusted proxy entry (IP or CIDR)."""
+    if not trusted:
+        return False
+    try:
+        addr = ip_address(peer_ip)
+    except ValueError:
+        return False
+    for entry in trusted:
+        try:
+            if '/' in entry:
+                if addr in ip_network(entry, strict=False):
+                    return True
+            elif addr == ip_address(entry):
+                return True
+        except ValueError:
+            continue
+    return False
+
+
+def get_client_ip(request: Request) -> str:
+    """Extract real client IP, trusting proxy headers only from known proxies.
+
+    Raises HTTPException 400 if the peer IP cannot be determined
+    (request.client is None — e.g., test harness or broken transport).
+    """
+    if not request.client:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Unable to determine client IP',
+        )
+    peer_ip = request.client.host
+    trusted_proxies = settings.get_cabinet_trusted_proxies()
+
+    if trusted_proxies and _is_trusted_proxy(peer_ip, trusted_proxies):
+        forwarded = request.headers.get('X-Forwarded-For', '').split(',')[0].strip()
+        if forwarded:
+            try:
+                ip_address(forwarded)
+                return forwarded
+            except ValueError:
+                pass  # invalid IP in header — fall through to peer_ip
+        real_ip = request.headers.get('X-Real-IP', '').strip()
+        if real_ip:
+            try:
+                ip_address(real_ip)
+                return real_ip
+            except ValueError:
+                pass
+
+    return peer_ip

app/cabinet/routes/__init__.py

@@ -2,6 +2,7 @@
 
 from fastapi import APIRouter
 
+from .account_linking import merge_router as merge_router, router as account_linking_router
 from .admin_apps import router as admin_apps_router
 from .admin_audit_log import router as admin_audit_log_router
 from .admin_ban_system import router as admin_ban_system_router
@@ -10,6 +11,12 @@ from .admin_button_styles import router as admin_button_styles_router
 from .admin_campaigns import router as admin_campaigns_router
 from .admin_channels import router as admin_channels_router
 from .admin_email_templates import router as admin_email_templates_router
+from .admin_landings import router as admin_landings_router
+from .admin_menu_layout import router as admin_menu_layout_router
+from .admin_news import router as admin_news_router
+from .admin_news_categories import router as admin_news_categories_router
+from .admin_news_media import router as admin_news_media_router
+from .admin_news_tags import router as admin_news_tags_router
 from .admin_partners import router as admin_partners_router
 from .admin_payment_methods import router as admin_payment_methods_router
 from .admin_payments import router as admin_payments_router
@@ -17,8 +24,10 @@ from .admin_pinned_messages import router as admin_pinned_messages_router
 from .admin_policies import router as admin_policies_router
 from .admin_promo_offers import router as admin_promo_offers_router
 from .admin_promocodes import promo_groups_router as admin_promo_groups_router, router as admin_promocodes_router
+from .admin_referral_network import router as admin_referral_network_router
 from .admin_remnawave import router as admin_remnawave_router
 from .admin_roles import router as admin_roles_router
+from .admin_sales_stats import router as admin_sales_stats_router
 from .admin_servers import router as admin_servers_router
 from .admin_settings import router as admin_settings_router
 from .admin_stats import router as admin_stats_router
@@ -33,8 +42,11 @@ from .auth import router as auth_router
 from .balance import router as balance_router
 from .branding import router as branding_router
 from .contests import router as contests_router
+from .gift import router as gift_router
 from .info import router as info_router
+from .landing import router as landing_router
 from .media import router as media_router
+from .news import router as news_router
 from .notifications import router as notifications_router
 from .oauth import router as oauth_router
 from .partner_application import router as partner_application_router
@@ -43,6 +55,7 @@ from .promo import router as promo_router
 from .promocode import router as promocode_router
 from .referral import router as referral_router
 from .subscription import router as subscription_router
+from .subscription_modules.multi_tariff import router as multi_tariff_subscription_router
 from .ticket_notifications import (
     admin_router as admin_ticket_notifications_router,
     router as ticket_notifications_router,
@@ -54,12 +67,15 @@ from .withdrawal import router as withdrawal_router
 
 
 # Main cabinet router
-router = APIRouter(prefix='/cabinet', tags=['Cabinet'])
+router = APIRouter(prefix='/cabinet', tags=['Cabinet'], redirect_slashes=False)
 
 # Include all sub-routers
 router.include_router(auth_router)
 router.include_router(oauth_router)
+router.include_router(account_linking_router)
+router.include_router(merge_router)
 router.include_router(subscription_router)
+router.include_router(multi_tariff_subscription_router)
 router.include_router(balance_router)
 router.include_router(referral_router)
 router.include_router(partner_application_router)
@@ -74,11 +90,16 @@ router.include_router(promo_router)
 router.include_router(notifications_router)
 router.include_router(info_router)
 router.include_router(branding_router)
+router.include_router(landing_router)
 router.include_router(media_router)
+router.include_router(news_router)
 
 # Wheel routes
 router.include_router(wheel_router)
 
+# Gift routes
+router.include_router(gift_router)
+
 # Admin routes (notifications router MUST be before tickets router to avoid route conflict)
 router.include_router(admin_ticket_notifications_router)
 router.include_router(admin_tickets_router)
@@ -87,6 +108,8 @@ router.include_router(admin_wheel_router)
 router.include_router(admin_tariffs_router)
 router.include_router(admin_servers_router)
 router.include_router(admin_stats_router)
+router.include_router(admin_referral_network_router)
+router.include_router(admin_sales_stats_router)
 router.include_router(admin_ban_system_router)
 router.include_router(admin_broadcasts_router)
 router.include_router(admin_promocodes_router)
@@ -96,6 +119,7 @@ router.include_router(admin_partners_router)
 router.include_router(admin_withdrawals_router)
 router.include_router(admin_users_router)
 router.include_router(admin_payment_methods_router)
+router.include_router(admin_landings_router)
 router.include_router(admin_payments_router)
 router.include_router(admin_promo_offers_router)
 router.include_router(admin_remnawave_router)
@@ -104,11 +128,18 @@ router.include_router(admin_updates_router)
 router.include_router(admin_traffic_router)
 router.include_router(admin_pinned_messages_router)
 router.include_router(admin_button_styles_router)
+router.include_router(admin_menu_layout_router)
 router.include_router(admin_channels_router)
 router.include_router(admin_apps_router)
 router.include_router(admin_roles_router)
 router.include_router(admin_policies_router)
 router.include_router(admin_audit_log_router)
+# Categories/tags/media routers MUST be before the main news router
+# to avoid /admin/news/{article_id} catching /admin/news/categories etc.
+router.include_router(admin_news_categories_router)
+router.include_router(admin_news_tags_router)
+router.include_router(admin_news_media_router)
+router.include_router(admin_news_router)
 
 # WebSocket route
 router.include_router(websocket_router)

app/cabinet/routes/account_linking.py

@@ -0,0 +1,893 @@
+"""Account linking and merge routes for cabinet.
+
+Router 1 (`router`): JWT-protected endpoints for linking/unlinking OAuth providers.
+  Exception: `link/server-complete` uses state-token auth instead of JWT (for Mini App external browser flow).
+Router 2 (`merge_router`): Public endpoints for merge preview and execution.
+"""
+
+import hashlib
+from datetime import UTC, datetime
+from typing import Literal, NotRequired, TypedDict
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Path, Request, status
+from pydantic import BaseModel, Field, model_validator
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.system_setting import get_setting_value
+from app.database.crud.user import (
+    OAUTH_PROVIDER_COLUMNS,
+    clear_user_oauth_provider_id,
+    get_user_by_id,
+    get_user_by_oauth_provider,
+    get_user_by_telegram_id,
+    set_user_oauth_provider_id,
+)
+from app.database.models import User
+from app.services.account_merge_service import compute_auth_methods, execute_merge, get_merge_preview
+from app.utils.cache import RateLimitCache, TokenReplayCache
+
+from ..auth.merge_service import (
+    MERGE_TOKEN_TTL_SECONDS,
+    consume_merge_token,
+    create_merge_token,
+    get_merge_token_data,
+    restore_merge_token,
+)
+from ..auth.oauth_providers import (
+    generate_oauth_state,
+    get_provider,
+    validate_oauth_state,
+)
+from ..auth.telegram_auth import (
+    validate_telegram_init_data,
+    validate_telegram_login_widget,
+    validate_telegram_oidc_token,
+)
+from ..dependencies import get_cabinet_db, get_current_cabinet_user
+from ..ip_utils import get_client_ip
+from ..schemas.auth import UserResponse
+from .auth import _create_auth_response, _store_refresh_token, _user_to_response
+
+
+logger = structlog.get_logger(__name__)
+
+
+OAuthProviderName = Literal['google', 'yandex', 'discord', 'vk']
+
+# Ensure OAuthProviderName Literal stays in sync with OAUTH_PROVIDER_COLUMNS
+_EXPECTED_PROVIDERS = {'google', 'yandex', 'discord', 'vk'}
+if set(OAUTH_PROVIDER_COLUMNS.keys()) != _EXPECTED_PROVIDERS:
+    raise RuntimeError(
+        f'OAuthProviderName Literal is out of sync with OAUTH_PROVIDER_COLUMNS: '
+        f'{set(OAUTH_PROVIDER_COLUMNS.keys())} != {_EXPECTED_PROVIDERS}'
+    )
+
+
+class OAuthStateData(TypedDict):
+    """Typed dict for Redis-stored OAuth state data."""
+
+    provider: str  # Always present
+    linking: NotRequired[str]  # 'true' if account linking flow
+    user_id: NotRequired[str]  # ID of user who initiated linking
+    code_verifier: NotRequired[str]  # PKCE code verifier (VK)
+
+
+def _get_active_providers() -> list[str]:
+    """Вернуть список активных провайдеров аутентификации (только включённые)."""
+    providers: list[str] = ['telegram']
+    if settings.is_cabinet_email_auth_enabled():
+        providers.append('email')
+    providers.extend(settings.get_enabled_oauth_provider_names())
+    return providers
+
+
+# ---------------------------------------------------------------------------
+# Schemas
+# ---------------------------------------------------------------------------
+
+
+class LinkedProvider(BaseModel):
+    provider: str
+    linked: bool
+    identifier: str | None = None
+
+
+class LinkedProvidersResponse(BaseModel):
+    providers: list[LinkedProvider]
+
+
+class LinkInitResponse(BaseModel):
+    authorize_url: str
+    state: str
+
+
+class LinkCallbackRequest(BaseModel):
+    code: str = Field(..., min_length=1, max_length=2048, description='Authorization code from provider')
+    state: str = Field(..., min_length=1, max_length=128, description='CSRF state token')
+    device_id: str | None = Field(None, max_length=256, description='Device ID from VK ID callback')
+
+
+class LinkCallbackResponse(BaseModel):
+    success: bool
+    message: str | None = None
+    merge_required: bool = False
+    merge_token: str | None = None
+
+
+class UnlinkResponse(BaseModel):
+    success: bool
+
+
+class LinkTelegramRequest(BaseModel):
+    """Request for linking Telegram account. Supply EITHER init_data, id_token, OR widget fields."""
+
+    # Mini App: Telegram WebApp initData
+    init_data: str | None = Field(None, max_length=4096, description='Telegram WebApp initData string')
+    # OIDC: id_token from Telegram Login popup
+    id_token: str | None = Field(None, max_length=4096, description='Telegram OIDC id_token (JWT)')
+    # Login Widget fields
+    id: int | None = Field(None, description='Telegram user ID from Login Widget')
+    first_name: str | None = Field(None, max_length=256, description="User's first name")
+    last_name: str | None = Field(None, max_length=256, description="User's last name")
+    username: str | None = Field(None, max_length=256, description="User's username")
+    photo_url: str | None = Field(None, max_length=2048, description="User's photo URL")
+    auth_date: int | None = Field(None, description='Unix timestamp of authentication')
+    hash: str | None = Field(None, min_length=64, max_length=64, description='Authentication hash (SHA-256 hex)')
+
+    @model_validator(mode='after')
+    def check_exclusive(self) -> 'LinkTelegramRequest':
+        has_init = self.init_data is not None
+        has_oidc = self.id_token is not None
+        has_widget = self.id is not None or self.hash is not None or self.auth_date is not None
+        modes = sum([has_init, has_oidc, has_widget])
+        if modes > 1:
+            raise ValueError('Provide exactly one of: init_data, id_token, or Login Widget fields')
+        if modes == 0:
+            raise ValueError('Provide one of: init_data, id_token, or Login Widget fields (id, auth_date, hash)')
+        if has_widget and not (self.id is not None and self.auth_date is not None and self.hash is not None):
+            raise ValueError('Login Widget mode requires id, auth_date, and hash fields')
+        return self
+
+
+class MergePreviewSubscription(BaseModel):
+    status: str
+    is_trial: bool
+    end_date: datetime | None = None
+    traffic_limit_gb: float
+    traffic_used_gb: float
+    device_limit: int
+    tariff_name: str | None = None
+    autopay_enabled: bool
+
+
+class MergePreviewUser(BaseModel):
+    id: int
+    username: str | None = None
+    first_name: str | None = None
+    email: str | None = None
+    auth_methods: list[str]
+    balance_kopeks: int = 0
+    subscription: MergePreviewSubscription | None = None
+    created_at: datetime | None = None
+
+
+class MergePreviewResponse(BaseModel):
+    primary: MergePreviewUser
+    secondary: MergePreviewUser
+    expires_in_seconds: int
+
+
+class MergeRequest(BaseModel):
+    keep_subscription_from: int = Field(..., description='User ID whose subscription to keep')
+
+
+class MergeResponse(BaseModel):
+    success: bool
+    access_token: str | None = None
+    refresh_token: str | None = None
+    user: UserResponse | None = None
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _get_provider_identifier(user: User, provider: str) -> str | None:
+    """Return the identifier (provider_id or email) for a given provider, or None."""
+    match provider:
+        case 'telegram':
+            return str(user.telegram_id) if user.telegram_id else None
+        case 'email':
+            return user.email if user.email and user.password_hash else None
+        case _:
+            column = OAUTH_PROVIDER_COLUMNS.get(provider)
+            if not column:
+                return None
+            value = getattr(user, column, None)
+            return str(value) if value else None
+
+
+def _count_auth_methods(user: User) -> int:
+    """Count how many auth methods the user has linked."""
+    return len(compute_auth_methods(user))
+
+
+async def _exchange_and_link_oauth(
+    *,
+    db: AsyncSession,
+    user: User,
+    provider: str,
+    code: str,
+    state: str,
+    state_data: OAuthStateData,
+    device_id: str | None,
+    log_context: str,
+) -> LinkCallbackResponse:
+    """Shared OAuth linking logic: exchange code, fetch user info, link or merge.
+
+    Used by both link_provider_callback (JWT-authed) and link_server_complete (state-authed).
+    """
+    oauth_provider = get_provider(provider)
+    if not oauth_provider:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Requested OAuth provider is not available',
+        )
+
+    # Exchange code for tokens
+    exchange_kwargs: dict[str, str] = {'state': state}
+    code_verifier = state_data.get('code_verifier')
+    if code_verifier:
+        exchange_kwargs['code_verifier'] = code_verifier
+    if device_id:
+        exchange_kwargs['device_id'] = device_id
+
+    try:
+        token_data = await oauth_provider.exchange_code(code, **exchange_kwargs)
+    except Exception as exc:
+        logger.error('OAuth code exchange failed', context=log_context, provider=provider, exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Failed to exchange authorization code',
+        ) from exc
+
+    # Fetch user info from provider
+    try:
+        user_info = await oauth_provider.get_user_info(token_data)
+    except Exception as exc:
+        logger.error('OAuth user info fetch failed', context=log_context, provider=provider, exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Failed to fetch user information from provider',
+        ) from exc
+
+    # Check if provider_id is already linked to THIS user
+    column = OAUTH_PROVIDER_COLUMNS[provider]
+    current_value = getattr(user, column, None)
+    if current_value and str(current_value) == user_info.provider_id:
+        return LinkCallbackResponse(success=True, message='already_linked')
+
+    # Check if provider_id is linked to ANOTHER user
+    existing_user = await get_user_by_oauth_provider(db, provider, user_info.provider_id)
+    if existing_user and existing_user.id != user.id:
+        logger.info(
+            'Account linking conflict: provider already linked to another user',
+            context=log_context,
+            provider=provider,
+            provider_id=user_info.provider_id,
+            current_user_id=user.id,
+            existing_user_id=existing_user.id,
+        )
+        merge_token = await create_merge_token(
+            primary_user_id=user.id,
+            secondary_user_id=existing_user.id,
+            provider=provider,
+            provider_id=user_info.provider_id,
+        )
+        return LinkCallbackResponse(
+            success=False,
+            merge_required=True,
+            merge_token=merge_token,
+        )
+
+    # Link the provider to current user
+    await set_user_oauth_provider_id(db, user, provider, user_info.provider_id)
+    try:
+        await db.commit()
+    except IntegrityError as exc:
+        await db.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='This provider account was just linked to another user',
+        ) from exc
+
+    logger.info(
+        'OAuth provider linked to account',
+        context=log_context,
+        provider=provider,
+        provider_id=user_info.provider_id,
+        user_id=user.id,
+    )
+    return LinkCallbackResponse(success=True, message='linked')
+
+
+# ---------------------------------------------------------------------------
+# Router 1: Account linking (JWT required)
+# ---------------------------------------------------------------------------
+
+router = APIRouter(prefix='/auth/account', tags=['Cabinet Account Linking'])
+
+
+@router.get('/linked-providers', response_model=LinkedProvidersResponse)
+async def get_linked_providers(
+    user: User = Depends(get_current_cabinet_user),
+) -> LinkedProvidersResponse:
+    """Return all auth methods with their link status for the current user."""
+    providers: list[LinkedProvider] = []
+    for provider in _get_active_providers():
+        identifier = _get_provider_identifier(user, provider)
+        providers.append(
+            LinkedProvider(
+                provider=provider,
+                linked=identifier is not None,
+                identifier=identifier,
+            )
+        )
+    return LinkedProvidersResponse(providers=providers)
+
+
+@router.get('/link/{provider}/init', response_model=LinkInitResponse)
+async def link_provider_init(
+    provider: OAuthProviderName,
+    user: User = Depends(get_current_cabinet_user),
+) -> LinkInitResponse:
+    """Start OAuth flow for linking a new provider to the current account."""
+
+    # Check if already linked
+    column = OAUTH_PROVIDER_COLUMNS[provider]
+    if getattr(user, column, None):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Provider is already linked to your account',
+        )
+
+    oauth_provider = get_provider(provider)
+    if not oauth_provider:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Requested OAuth provider is not available',
+        )
+
+    # Generate PKCE data for VK (and potentially future providers)
+    auth_extra = oauth_provider.prepare_auth_state()
+    extra_data: dict[str, str] = {
+        'linking': 'true',
+        'user_id': str(user.id),
+    }
+    if auth_extra:
+        extra_data.update(auth_extra)
+
+    state = await generate_oauth_state(provider, extra_data=extra_data)
+    # Only pass URL-safe params (prefixed with _) to authorize URL; exclude secrets like code_verifier
+    url_params = {k: v for k, v in auth_extra.items() if k.startswith('_')} if auth_extra else {}
+    authorize_url = oauth_provider.get_authorization_url(state, **url_params)
+
+    return LinkInitResponse(authorize_url=authorize_url, state=state)
+
+
+@router.post('/link/{provider}/callback', response_model=LinkCallbackResponse)
+async def link_provider_callback(
+    provider: OAuthProviderName,
+    request: LinkCallbackRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> LinkCallbackResponse:
+    """Handle OAuth callback for linking a provider to the current account."""
+    # 1. Validate CSRF state
+    state_data = await validate_oauth_state(request.state, provider)
+    if not state_data:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid or expired OAuth state',
+        )
+
+    # 1b. Validate that this state was created for account linking (not login)
+    if state_data.get('linking') != 'true' or not state_data.get('user_id'):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='OAuth state was not initiated for account linking',
+        )
+
+    # 1c. Validate that the user who initiated the link flow is the same user completing it
+    state_user_id = state_data['user_id']
+    if str(user.id) != state_user_id:
+        logger.warning(
+            'OAuth state user_id mismatch in link callback',
+            state_user_id=state_user_id,
+            current_user_id=user.id,
+            provider=provider,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='OAuth state was initiated by a different user',
+        )
+
+    # 2-7. Exchange code, fetch user info, link or merge
+    return await _exchange_and_link_oauth(
+        db=db,
+        user=user,
+        provider=provider,
+        code=request.code,
+        state=request.state,
+        state_data=state_data,
+        device_id=request.device_id,
+        log_context='link-callback',
+    )
+
+
+@router.post('/unlink/{provider}', response_model=UnlinkResponse)
+async def unlink_provider(
+    provider: OAuthProviderName,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> UnlinkResponse:
+    """Unlink an OAuth provider from the current account."""
+    column = OAUTH_PROVIDER_COLUMNS[provider]
+    if not getattr(user, column, None):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Provider is not linked to your account',
+        )
+
+    # Ensure at least one auth method remains
+    if _count_auth_methods(user) <= 1:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Cannot unlink last authentication method',
+        )
+
+    await clear_user_oauth_provider_id(db, user, provider)
+    await db.commit()
+    return UnlinkResponse(success=True)
+
+
+@router.post('/link/telegram', response_model=LinkCallbackResponse)
+async def link_telegram(
+    request: LinkTelegramRequest,
+    raw_request: Request,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> LinkCallbackResponse:
+    """Link Telegram account via WebApp initData, OIDC id_token, or Login Widget."""
+    # Rate limit
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'link_telegram', limit=10, window=60, fail_closed=True):
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail='Too many requests',
+            headers={'Retry-After': '60'},
+        )
+
+    # 1. Already has Telegram linked?
+    if user.telegram_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Telegram is already linked to your account',
+        )
+
+    # 2. Validate and extract telegram_id
+    telegram_id: int | None = None
+    telegram_username: str | None = None
+    telegram_first_name: str | None = None
+    telegram_last_name: str | None = None
+
+    if request.init_data:
+        # Mini App flow: validate initData
+        # Generous max_age: Telegram Desktop/iOS cache initData with stale auth_date
+        user_data = validate_telegram_init_data(request.init_data, max_age_seconds=86400 * 30)
+        if not user_data or not user_data.get('id'):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Invalid or expired Telegram initData',
+            )
+        telegram_id = int(user_data['id'])
+        telegram_username = user_data.get('username')
+        telegram_first_name = user_data.get('first_name')
+        telegram_last_name = user_data.get('last_name')
+    elif request.id_token:
+        # OIDC flow: validate id_token via JWKS
+        oidc_enabled_val = await get_setting_value(db, 'TELEGRAM_OIDC_ENABLED')
+        oidc_client_id_val = await get_setting_value(db, 'TELEGRAM_OIDC_CLIENT_ID')
+        oidc_client_id = oidc_client_id_val or settings.TELEGRAM_OIDC_CLIENT_ID
+        oidc_enabled = (
+            oidc_enabled_val.lower() == 'true' if oidc_enabled_val is not None else settings.TELEGRAM_OIDC_ENABLED
+        ) and bool(oidc_client_id)
+
+        if not oidc_enabled:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Telegram OIDC is not configured',
+            )
+
+        claims = await validate_telegram_oidc_token(request.id_token, oidc_client_id)
+        if not claims:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail='Invalid or expired Telegram OIDC token',
+            )
+
+        # Replay detection
+        token_hash = hashlib.sha256(request.id_token.encode()).hexdigest()
+        token_ttl = max(int(claims.get('exp', 0) - datetime.now(UTC).timestamp()), 60)
+        if await TokenReplayCache.is_token_replayed(token_hash, ttl=min(token_ttl, 600)):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail='Invalid or expired Telegram OIDC token',
+            )
+
+        try:
+            telegram_id = int(claims.get('id', claims.get('sub', 0)))
+        except (ValueError, TypeError) as exc:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail='Invalid user ID in OIDC claims',
+            ) from exc
+        if not telegram_id:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail='Missing user ID in OIDC claims',
+            )
+
+        telegram_username = claims.get('preferred_username')
+        telegram_first_name = claims.get('name', claims.get('given_name', ''))
+        telegram_last_name = claims.get('family_name')
+    elif request.id is not None and request.hash is not None and request.auth_date is not None:
+        # Login Widget flow: validate widget hash
+        widget_data = {
+            'id': request.id,
+            'auth_date': request.auth_date,
+            'hash': request.hash,
+        }
+        if request.first_name is not None:
+            widget_data['first_name'] = request.first_name
+        if request.last_name is not None:
+            widget_data['last_name'] = request.last_name
+        if request.username is not None:
+            widget_data['username'] = request.username
+        if request.photo_url is not None:
+            widget_data['photo_url'] = request.photo_url
+
+        # Generous max_age: Telegram caches auth data with stale auth_date
+        if not validate_telegram_login_widget(widget_data, max_age_seconds=86400 * 30):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Invalid or expired Telegram Login Widget data',
+            )
+        telegram_id = request.id
+        telegram_username = request.username
+        telegram_first_name = request.first_name
+        telegram_last_name = request.last_name
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Provide init_data (Mini App), id_token (OIDC), or Login Widget fields (id, auth_date, hash)',
+        )
+
+    # 3. Check if telegram_id is linked to ANOTHER user
+    existing_user = await get_user_by_telegram_id(db, telegram_id)
+    if existing_user and existing_user.id != user.id:
+        logger.info(
+            'Telegram linking conflict: telegram_id already linked to another user',
+            telegram_id=telegram_id,
+            current_user_id=user.id,
+            existing_user_id=existing_user.id,
+        )
+        merge_token = await create_merge_token(
+            primary_user_id=user.id,
+            secondary_user_id=existing_user.id,
+            provider='telegram',
+            provider_id=str(telegram_id),
+        )
+        return LinkCallbackResponse(
+            success=False,
+            merge_required=True,
+            merge_token=merge_token,
+        )
+
+    # 4. Link Telegram to current user
+    user.telegram_id = telegram_id
+    if telegram_username and not user.username:
+        user.username = telegram_username
+    if telegram_first_name and not user.first_name:
+        user.first_name = telegram_first_name
+    if telegram_last_name and not user.last_name:
+        user.last_name = telegram_last_name
+    user.updated_at = datetime.now(UTC)
+
+    try:
+        await db.commit()
+    except IntegrityError as exc:
+        await db.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='This Telegram account was just linked to another user',
+        ) from exc
+
+    logger.info(
+        'Telegram linked to account',
+        telegram_id=telegram_id,
+        user_id=user.id,
+    )
+    return LinkCallbackResponse(success=True, message='linked')
+
+
+# ---------------------------------------------------------------------------
+# Server-side OAuth linking callback (NO JWT required — auth via state token)
+# Used by Telegram Mini App where OAuth must open in external browser.
+# ---------------------------------------------------------------------------
+
+
+class ServerCompleteRequest(BaseModel):
+    code: str = Field(..., min_length=1, max_length=2048, description='Authorization code from provider')
+    state: str = Field(..., min_length=1, max_length=128, description='CSRF state token')
+    provider: OAuthProviderName | None = Field(None, description='OAuth provider name (resolved from state if omitted)')
+    device_id: str | None = Field(None, max_length=256, description='Device ID from VK ID callback')
+
+
+class ServerCompleteResponse(LinkCallbackResponse):
+    provider: str
+
+
+@router.post('/link/server-complete', response_model=ServerCompleteResponse)
+async def link_server_complete(
+    request: ServerCompleteRequest,
+    raw_request: Request,
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> ServerCompleteResponse:
+    """Complete OAuth account linking without JWT.
+
+    Authenticates via the one-time state token stored in Redis during link_provider_init.
+    Used when OAuth opens in an external browser (e.g., from Telegram Mini App).
+    Provider is resolved from the state token if not explicitly provided.
+    """
+    # Rate limit by IP (unauthenticated endpoint)
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'server_complete', limit=10, window=60, fail_closed=True):
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    # 1. Validate and consume state from Redis (one-time use).
+    #    Provider may be None — validate_oauth_state will skip provider check,
+    #    and we'll resolve it from state_data['provider'].
+    state_data = await validate_oauth_state(request.state, request.provider)
+    if not state_data:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid or expired OAuth state',
+        )
+
+    # Resolve provider from state data (canonical source)
+    state_provider: str = state_data.get('provider', '')
+    if not state_provider or state_provider not in OAUTH_PROVIDER_COLUMNS:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Could not determine OAuth provider',
+        )
+
+    # If request explicitly provides a provider, ensure it matches the state
+    if request.provider and request.provider != state_provider:
+        logger.warning(
+            'Provider mismatch in server-complete',
+            request_provider=request.provider,
+            state_provider=state_provider,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Provider does not match OAuth state',
+        )
+
+    provider_name: str = state_provider
+
+    # 2. Must be a linking state (not login)
+    if state_data.get('linking') != 'true' or not state_data.get('user_id'):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='OAuth state was not initiated for account linking',
+        )
+
+    # 3. Parse and validate user_id from state
+    try:
+        user_id = int(state_data['user_id'])
+    except (ValueError, TypeError) as exc:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid user_id in OAuth state',
+        ) from exc
+
+    # 4. Load user from DB
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='User not found',
+        )
+
+    # 5-9. Exchange code, fetch user info, link or merge
+    result = await _exchange_and_link_oauth(
+        db=db,
+        user=user,
+        provider=provider_name,
+        code=request.code,
+        state=request.state,
+        state_data=state_data,
+        device_id=request.device_id,
+        log_context='server-complete',
+    )
+
+    return ServerCompleteResponse(
+        success=result.success,
+        message=result.message,
+        merge_required=result.merge_required,
+        merge_token=result.merge_token,
+        provider=provider_name,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Router 2: Merge (NO JWT required)
+# ---------------------------------------------------------------------------
+
+merge_router = APIRouter(prefix='/auth/merge', tags=['Cabinet Account Merge'])
+
+
+@merge_router.get('/{merge_token}', response_model=MergePreviewResponse)
+async def get_merge_preview_endpoint(
+    raw_request: Request,
+    merge_token: str = Path(..., min_length=32, max_length=64),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> MergePreviewResponse:
+    """Preview the result of merging two accounts before confirming."""
+    # Rate limit by IP (unauthenticated endpoint)
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'merge_preview', limit=15, window=60, fail_closed=True):
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    token_data = await get_merge_token_data(merge_token)
+    if not token_data:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Merge token is invalid or expired',
+        )
+
+    primary_user_id: int = token_data['primary_user_id']
+    secondary_user_id: int = token_data['secondary_user_id']
+
+    try:
+        preview = await get_merge_preview(db, primary_user_id, secondary_user_id)
+    except ValueError as exc:
+        logger.error('Merge preview failed', error=str(exc))
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='One or both users not found',
+        ) from exc
+
+    # Calculate remaining TTL
+    created_at_str: str = token_data.get('created_at', '')
+    try:
+        created_at = datetime.fromisoformat(created_at_str)
+        if created_at.tzinfo is None:
+            created_at = created_at.replace(tzinfo=UTC)
+        elapsed = (datetime.now(UTC) - created_at).total_seconds()
+        expires_in_seconds = max(0, int(MERGE_TOKEN_TTL_SECONDS - elapsed))
+    except (ValueError, TypeError):
+        expires_in_seconds = 0
+
+    return MergePreviewResponse(
+        primary=MergePreviewUser(**preview['primary']),
+        secondary=MergePreviewUser(**preview['secondary']),
+        expires_in_seconds=expires_in_seconds,
+    )
+
+
+@merge_router.post('/{merge_token}', response_model=MergeResponse)
+async def execute_merge_endpoint(
+    request: MergeRequest,
+    raw_request: Request,
+    merge_token: str = Path(..., min_length=32, max_length=64),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> MergeResponse:
+    """Execute account merge. Consumes the merge token (one-time use)."""
+    # Rate limit by IP (unauthenticated endpoint)
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'merge_execute', limit=5, window=60, fail_closed=True):
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    # 1. Consume token atomically first (GETDEL — one-time use, no TOCTOU)
+    consumed = await consume_merge_token(merge_token)
+    if not consumed:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Merge token is invalid, expired, or already consumed',
+        )
+
+    primary_user_id: int = consumed['primary_user_id']
+    secondary_user_id: int = consumed['secondary_user_id']
+    provider: str = consumed.get('provider', '')
+    provider_id: str = consumed.get('provider_id', '')
+
+    # 2. Validate keep_subscription_from — restore token if invalid
+    if request.keep_subscription_from not in (primary_user_id, secondary_user_id):
+        await restore_merge_token(merge_token, consumed)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='keep_subscription_from must be one of the two user IDs being merged',
+        )
+
+    # Convert user_id to 'primary'/'secondary' string for execute_merge()
+    keep_from: Literal['primary', 'secondary'] = (
+        'primary' if request.keep_subscription_from == primary_user_id else 'secondary'
+    )
+
+    # 3. Execute merge
+    try:
+        merged_user = await execute_merge(
+            db=db,
+            primary_user_id=primary_user_id,
+            secondary_user_id=secondary_user_id,
+            keep_subscription_from=keep_from,
+            provider=provider,
+            provider_id=provider_id,
+        )
+        await db.commit()
+    except ValueError as exc:
+        await db.rollback()
+        await restore_merge_token(merge_token, consumed)
+        logger.error('Merge execution failed (ValueError)', error=str(exc))
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Account merge cannot be completed. The accounts may have already been merged or deleted.',
+        ) from exc
+    except Exception as exc:
+        await db.rollback()
+        await restore_merge_token(merge_token, consumed)
+        logger.exception('Merge execution failed')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Account merge failed due to an internal error',
+        ) from exc
+
+    # 4. Re-fetch merged user with full relationships for auth response
+    merged_user = await get_user_by_id(db, primary_user_id)
+    if not merged_user:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load merged user',
+        )
+
+    # 5. Create auth tokens for the merged user
+    try:
+        auth_response = await _create_auth_response(merged_user, db)
+        await _store_refresh_token(db, merged_user.id, auth_response.refresh_token, device_info='merge')
+    except Exception as exc:
+        logger.exception('Failed to create auth tokens after merge')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Merge succeeded but failed to create new session',
+        ) from exc
+
+    logger.info(
+        'Account merge completed successfully',
+        primary_user_id=primary_user_id,
+        secondary_user_id=secondary_user_id,
+        provider=provider,
+    )
+
+    return MergeResponse(
+        success=True,
+        access_token=auth_response.access_token,
+        refresh_token=auth_response.refresh_token,
+        user=_user_to_response(merged_user),
+    )

app/cabinet/routes/admin_broadcasts.py

@@ -411,6 +411,13 @@ async def create_broadcast(
 
     media_payload = request.media
 
+    # Validate caption length for media messages (Telegram limit: 1024 chars)
+    if media_payload and len(message_text) > 1024:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Текст слишком длинный для сообщения с медиа. Максимум 1024 символов, сейчас {len(message_text)}. Сократите текст или уберите медиафайл.',
+        )
+
     # Create broadcast record
     broadcast = BroadcastHistory(
         target_type=request.target,
@@ -446,6 +453,7 @@ async def create_broadcast(
         selected_buttons=request.selected_buttons,
         media=media_config,
         initiator_name=admin.username or f'Admin #{admin.id}',
+        custom_buttons=[btn.model_dump() for btn in request.custom_buttons] if request.custom_buttons else None,
     )
 
     # Start broadcast
@@ -644,6 +652,7 @@ async def create_combined_broadcast(
             selected_buttons=request.selected_buttons,
             media=media_config,
             initiator_name=admin_name,
+            custom_buttons=[btn.model_dump() for btn in request.custom_buttons] if request.custom_buttons else None,
         )
 
         await broadcast_service.start_broadcast(broadcast.id, telegram_config)

app/cabinet/routes/admin_campaigns.py

@@ -7,7 +7,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.config import settings
+from app.cabinet.utils.links import get_campaign_deep_link, get_campaign_web_link
 from app.database.crud.campaign import (
     create_campaign,
     delete_campaign,
@@ -29,9 +29,11 @@ from app.database.models import (
     Tariff,
     User,
 )
+from app.services.partner_stats_service import PartnerStatsService
 
 from ..dependencies import get_cabinet_db, require_permission
 from ..schemas.campaigns import (
+    AdminCampaignChartDataResponse,
     AvailablePartnerItem,
     CampaignCreateRequest,
     CampaignDetailResponse,
@@ -54,20 +56,9 @@ logger = structlog.get_logger(__name__)
 router = APIRouter(prefix='/admin/campaigns', tags=['Cabinet Admin Campaigns'])
 
 
-def _get_deep_link(start_parameter: str) -> str:
-    """Generate deep link for campaign."""
-    bot_username = settings.get_bot_username()
-    if bot_username:
-        return f'https://t.me/{bot_username}?start={start_parameter}'
-    return f'?start={start_parameter}'
-
-
-def _get_web_link(start_parameter: str) -> str | None:
-    """Generate web link for campaign."""
-    base_url = (settings.MINIAPP_CUSTOM_URL or '').rstrip('/')
-    if base_url:
-        return f'{base_url}/?campaign={start_parameter}'
-    return None
+def _safe_div(value: float | None, divisor: int = 100) -> float:
+    """Safely divide kopeks to rubles, handling None values."""
+    return (value or 0) / divisor
 
 
 def _get_partner_name(campaign: AdvertisingCampaign) -> str | None:
@@ -84,26 +75,35 @@ async def get_overview(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Get campaigns overview statistics."""
-    overview = await get_campaigns_overview(db)
+    try:
+        overview = await get_campaigns_overview(db)
 
-    # Count tariff bonuses
-    tariff_result = await db.execute(
-        select(func.count(AdvertisingCampaignRegistration.id)).where(
-            AdvertisingCampaignRegistration.bonus_type == 'tariff'
+        # Count tariff bonuses
+        tariff_result = await db.execute(
+            select(func.count(AdvertisingCampaignRegistration.id)).where(
+                AdvertisingCampaignRegistration.bonus_type == 'tariff'
+            )
         )
-    )
-    tariff_count = tariff_result.scalar() or 0
+        tariff_count = tariff_result.scalar() or 0
 
-    return CampaignsOverviewResponse(
-        total=overview['total'],
-        active=overview['active'],
-        inactive=overview['inactive'],
-        total_registrations=overview['registrations'],
-        total_balance_issued_kopeks=overview['balance_total'],
-        total_balance_issued_rubles=overview['balance_total'] / 100,
-        total_subscription_issued=overview['subscription_total'],
-        total_tariff_issued=tariff_count,
-    )
+        return CampaignsOverviewResponse(
+            total=overview['total'],
+            active=overview['active'],
+            inactive=overview['inactive'],
+            total_registrations=overview['registrations'],
+            total_balance_issued_kopeks=overview['balance_total'],
+            total_balance_issued_rubles=_safe_div(overview['balance_total']),
+            total_subscription_issued=overview['subscription_total'],
+            total_tariff_issued=tariff_count,
+        )
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error('Failed to get campaigns overview', error=str(e), exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load campaigns overview',
+        )
 
 
 @router.get('/available-servers', response_model=list[ServerSquadInfo])
@@ -183,7 +183,7 @@ async def list_campaigns(
 ):
     """Get list of all campaigns."""
     campaigns = await get_campaigns_list(db, offset=offset, limit=limit, include_inactive=include_inactive)
-    total = await get_campaigns_count(db)
+    total = await get_campaigns_count(db, is_active=True if not include_inactive else None)
 
     items = []
     for campaign in campaigns:
@@ -236,7 +236,7 @@ async def get_campaign(
         bonus_type=campaign.bonus_type,
         is_active=campaign.is_active,
         balance_bonus_kopeks=campaign.balance_bonus_kopeks or 0,
-        balance_bonus_rubles=(campaign.balance_bonus_kopeks or 0) / 100,
+        balance_bonus_rubles=_safe_div(campaign.balance_bonus_kopeks),
         subscription_duration_days=campaign.subscription_duration_days,
         subscription_traffic_gb=campaign.subscription_traffic_gb,
         subscription_device_limit=campaign.subscription_device_limit,
@@ -249,11 +249,38 @@ async def get_campaign(
         created_by=campaign.created_by,
         created_at=campaign.created_at,
         updated_at=campaign.updated_at,
-        deep_link=_get_deep_link(campaign.start_parameter),
-        web_link=_get_web_link(campaign.start_parameter),
+        deep_link=get_campaign_deep_link(campaign.start_parameter),
+        web_link=get_campaign_web_link(campaign.start_parameter),
     )
 
 
+@router.get('/{campaign_id}/chart-data', response_model=AdminCampaignChartDataResponse)
+async def get_campaign_chart_data(
+    campaign_id: int,
+    admin: User = Depends(require_permission('campaigns:stats')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get chart data for admin campaign analytics."""
+    try:
+        campaign = await get_campaign_by_id(db, campaign_id)
+        if not campaign:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail='Campaign not found',
+            )
+
+        data = await PartnerStatsService.get_admin_campaign_chart_data(db, campaign_id)
+        return AdminCampaignChartDataResponse(**data)
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error('Failed to get campaign chart data', error=str(e), campaign_id=campaign_id, exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load campaign chart data',
+        )
+
+
 @router.get('/{campaign_id}/stats', response_model=CampaignStatisticsResponse)
 async def get_campaign_stats(
     campaign_id: int,
@@ -261,41 +288,50 @@ async def get_campaign_stats(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Get detailed campaign statistics."""
-    campaign = await get_campaign_by_id(db, campaign_id)
-    if not campaign:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail='Campaign not found',
+    try:
+        campaign = await get_campaign_by_id(db, campaign_id)
+        if not campaign:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail='Campaign not found',
+            )
+
+        stats = await get_campaign_statistics(db, campaign_id)
+
+        return CampaignStatisticsResponse(
+            id=campaign.id,
+            name=campaign.name,
+            start_parameter=campaign.start_parameter,
+            bonus_type=campaign.bonus_type,
+            is_active=campaign.is_active,
+            registrations=stats['registrations'],
+            balance_issued_kopeks=stats['balance_issued'],
+            balance_issued_rubles=_safe_div(stats['balance_issued']),
+            subscription_issued=stats['subscription_issued'],
+            last_registration=stats['last_registration'],
+            total_revenue_kopeks=stats['total_revenue_kopeks'],
+            total_revenue_rubles=_safe_div(stats['total_revenue_kopeks']),
+            avg_revenue_per_user_kopeks=stats['avg_revenue_per_user_kopeks'],
+            avg_revenue_per_user_rubles=_safe_div(stats['avg_revenue_per_user_kopeks']),
+            avg_first_payment_kopeks=stats['avg_first_payment_kopeks'],
+            avg_first_payment_rubles=_safe_div(stats['avg_first_payment_kopeks']),
+            trial_users_count=stats['trial_users_count'],
+            active_trials_count=stats['active_trials_count'],
+            conversion_count=stats['conversion_count'],
+            paid_users_count=stats['paid_users_count'],
+            conversion_rate=stats['conversion_rate'],
+            trial_conversion_rate=stats['trial_conversion_rate'],
+            deep_link=get_campaign_deep_link(campaign.start_parameter),
+            web_link=get_campaign_web_link(campaign.start_parameter),
+        )
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error('Failed to get campaign stats', error=str(e), campaign_id=campaign_id, exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load campaign statistics',
         )
-
-    stats = await get_campaign_statistics(db, campaign_id)
-
-    return CampaignStatisticsResponse(
-        id=campaign.id,
-        name=campaign.name,
-        start_parameter=campaign.start_parameter,
-        bonus_type=campaign.bonus_type,
-        is_active=campaign.is_active,
-        registrations=stats['registrations'],
-        balance_issued_kopeks=stats['balance_issued'],
-        balance_issued_rubles=stats['balance_issued'] / 100,
-        subscription_issued=stats['subscription_issued'],
-        last_registration=stats['last_registration'],
-        total_revenue_kopeks=stats['total_revenue_kopeks'],
-        total_revenue_rubles=stats['total_revenue_kopeks'] / 100,
-        avg_revenue_per_user_kopeks=stats['avg_revenue_per_user_kopeks'],
-        avg_revenue_per_user_rubles=stats['avg_revenue_per_user_kopeks'] / 100,
-        avg_first_payment_kopeks=stats['avg_first_payment_kopeks'],
-        avg_first_payment_rubles=stats['avg_first_payment_kopeks'] / 100,
-        trial_users_count=stats['trial_users_count'],
-        active_trials_count=stats['active_trials_count'],
-        conversion_count=stats['conversion_count'],
-        paid_users_count=stats['paid_users_count'],
-        conversion_rate=stats['conversion_rate'],
-        trial_conversion_rate=stats['trial_conversion_rate'],
-        deep_link=_get_deep_link(campaign.start_parameter),
-        web_link=_get_web_link(campaign.start_parameter),
-    )
 
 
 @router.get('/{campaign_id}/registrations', response_model=CampaignRegistrationsResponse)
@@ -411,7 +447,7 @@ async def create_new_campaign(
     # Validate partner exists and is approved
     if request.partner_user_id is not None:
         partner_user = await db.get(User, request.partner_user_id)
-        if not partner_user or partner_user.partner_status != 'approved':
+        if not partner_user or partner_user.partner_status != PartnerStatus.APPROVED.value:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
                 detail='Partner not found or not approved',
@@ -434,9 +470,6 @@ async def create_new_campaign(
         partner_user_id=request.partner_user_id,
     )
 
-    # Reload to get tariff relationship
-    campaign = await get_campaign_by_id(db, campaign.id)
-
     logger.info('Admin created campaign', admin_id=admin.id, campaign_id=campaign.id, campaign_name=campaign.name)
 
     return await get_campaign(campaign.id, admin, db)
@@ -478,29 +511,29 @@ async def update_existing_campaign(
                     detail='Tariff not found',
                 )
 
-    # Build updates
+    # Build updates using model_fields_set to distinguish "not sent" from "sent as None"
     updates = {}
-    if request.name is not None:
+    if 'name' in request.model_fields_set:
         updates['name'] = request.name
-    if request.start_parameter is not None:
+    if 'start_parameter' in request.model_fields_set:
         updates['start_parameter'] = request.start_parameter
-    if request.bonus_type is not None:
+    if 'bonus_type' in request.model_fields_set:
         updates['bonus_type'] = request.bonus_type
-    if request.is_active is not None:
+    if 'is_active' in request.model_fields_set:
         updates['is_active'] = request.is_active
-    if request.balance_bonus_kopeks is not None:
+    if 'balance_bonus_kopeks' in request.model_fields_set:
         updates['balance_bonus_kopeks'] = request.balance_bonus_kopeks
-    if request.subscription_duration_days is not None:
+    if 'subscription_duration_days' in request.model_fields_set:
         updates['subscription_duration_days'] = request.subscription_duration_days
-    if request.subscription_traffic_gb is not None:
+    if 'subscription_traffic_gb' in request.model_fields_set:
         updates['subscription_traffic_gb'] = request.subscription_traffic_gb
-    if request.subscription_device_limit is not None:
+    if 'subscription_device_limit' in request.model_fields_set:
         updates['subscription_device_limit'] = request.subscription_device_limit
-    if request.subscription_squads is not None:
+    if 'subscription_squads' in request.model_fields_set:
         updates['subscription_squads'] = request.subscription_squads
-    if request.tariff_id is not None:
+    if 'tariff_id' in request.model_fields_set:
         updates['tariff_id'] = request.tariff_id
-    if request.tariff_duration_days is not None:
+    if 'tariff_duration_days' in request.model_fields_set:
         updates['tariff_duration_days'] = request.tariff_duration_days
 
     # Handle partner_user_id separately (allows explicit None to unassign)
@@ -509,7 +542,7 @@ async def update_existing_campaign(
         new_partner_id = request.partner_user_id
         if new_partner_id is not None:
             partner_user = await db.get(User, new_partner_id)
-            if not partner_user or partner_user.partner_status != 'approved':
+            if not partner_user or partner_user.partner_status != PartnerStatus.APPROVED.value:
                 raise HTTPException(
                     status_code=status.HTTP_400_BAD_REQUEST,
                     detail='Partner not found or not approved',
@@ -543,8 +576,13 @@ async def delete_existing_campaign(
             detail='Campaign not found',
         )
 
-    # Check if campaign has registrations
-    reg_count = len(campaign.registrations) if campaign.registrations else 0
+    # Check if campaign has registrations (COUNT query instead of loading all)
+    reg_count_result = await db.execute(
+        select(func.count(AdvertisingCampaignRegistration.id)).where(
+            AdvertisingCampaignRegistration.campaign_id == campaign_id
+        )
+    )
+    reg_count = reg_count_result.scalar() or 0
     if reg_count > 0:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,

app/cabinet/routes/admin_email_templates.py

@@ -37,7 +37,7 @@ TEMPLATE_TYPES = [
             'zh': '余额充值通知',
             'ua': 'Сповіщення про поповнення балансу',
         },
-        'context_vars': ['amount', 'balance'],
+        'context_vars': ['formatted_amount', 'formatted_balance', 'amount_rubles', 'new_balance_rubles'],
     },
     {
         'type': 'balance_change',
@@ -48,7 +48,7 @@ TEMPLATE_TYPES = [
             'zh': '余额变动通知',
             'ua': 'Сповіщення про зміну балансу',
         },
-        'context_vars': ['amount', 'balance'],
+        'context_vars': ['formatted_amount', 'formatted_balance', 'amount_rubles', 'new_balance_rubles'],
     },
     {
         'type': 'subscription_expiring',
@@ -96,7 +96,7 @@ TEMPLATE_TYPES = [
             'zh': '订阅已续期通知',
             'ua': 'Сповіщення про продовження підписки',
         },
-        'context_vars': ['new_end_date', 'tariff_name'],
+        'context_vars': ['new_expires_at', 'tariff_name', 'traffic_limit_gb', 'device_limit'],
     },
     {
         'type': 'subscription_activated',
@@ -112,7 +112,7 @@ TEMPLATE_TYPES = [
             'zh': '订阅已激活通知',
             'ua': 'Сповіщення про активацію підписки',
         },
-        'context_vars': ['tariff_name', 'end_date'],
+        'context_vars': ['expires_at', 'tariff_name', 'traffic_limit_gb', 'device_limit'],
     },
     {
         'type': 'autopay_success',
@@ -128,7 +128,7 @@ TEMPLATE_TYPES = [
             'zh': '自动续费成功通知',
             'ua': 'Сповіщення про успішний автоплатіж',
         },
-        'context_vars': ['amount', 'balance', 'new_end_date'],
+        'context_vars': ['formatted_amount', 'amount_rubles', 'new_expires_at'],
     },
     {
         'type': 'autopay_failed',
@@ -160,7 +160,7 @@ TEMPLATE_TYPES = [
             'zh': '自动续费余额不足通知',
             'ua': 'Сповіщення про нестачу коштів для автоплатежу',
         },
-        'context_vars': ['required_amount', 'balance'],
+        'context_vars': ['required_amount', 'current_balance'],
     },
     {
         'type': 'daily_debit',
@@ -171,7 +171,7 @@ TEMPLATE_TYPES = [
             'zh': '每日扣费通知',
             'ua': 'Сповіщення про добове списання',
         },
-        'context_vars': ['amount', 'balance'],
+        'context_vars': ['formatted_amount', 'formatted_balance', 'amount_rubles', 'new_balance_rubles'],
     },
     {
         'type': 'daily_insufficient_funds',
@@ -187,7 +187,7 @@ TEMPLATE_TYPES = [
             'zh': '每日扣费余额不足通知',
             'ua': 'Сповіщення про нестачу коштів для добового списання',
         },
-        'context_vars': ['required_amount', 'balance'],
+        'context_vars': ['required_amount', 'current_balance'],
     },
     {
         'type': 'ban_notification',
@@ -236,7 +236,7 @@ TEMPLATE_TYPES = [
             'zh': '推荐奖励通知',
             'ua': 'Сповіщення про нарахування реферального бонусу',
         },
-        'context_vars': ['amount', 'referral_name'],
+        'context_vars': ['formatted_bonus', 'bonus_rubles', 'referral_name'],
     },
     {
         'type': 'referral_registered',
@@ -258,7 +258,7 @@ TEMPLATE_TYPES = [
             'zh': '流量重置通知',
             'ua': 'Сповіщення про скидання трафіку',
         },
-        'context_vars': ['traffic_limit'],
+        'context_vars': ['reset_gb', 'current_limit_gb'],
     },
     {
         'type': 'payment_received',
@@ -269,7 +269,7 @@ TEMPLATE_TYPES = [
             'zh': '收到付款通知',
             'ua': 'Сповіщення про отримання платежу',
         },
-        'context_vars': ['amount', 'payment_method'],
+        'context_vars': ['formatted_amount', 'payment_method'],
     },
     {
         'type': 'email_verification',
@@ -298,6 +298,77 @@ TEMPLATE_TYPES = [
         },
         'context_vars': ['username', 'reset_url', 'expire_hours'],
     },
+    {
+        'type': 'guest_subscription_delivered',
+        'label': {
+            'ru': 'Быстрая покупка: подписка доставлена',
+            'en': 'Quick Purchase: Subscription Delivered',
+            'zh': '快捷购买：订阅已交付',
+            'ua': 'Швидка покупка: підписка доставлена',
+        },
+        'description': {
+            'ru': 'Письмо покупателю после успешной оплаты через лендинг',
+            'en': 'Email to buyer after successful landing page payment',
+            'zh': '通过落地页成功付款后发送给买家的邮件',
+            'ua': 'Лист покупцю після успішної оплати через лендінг',
+        },
+        'context_vars': ['tariff_name', 'period_days', 'cabinet_url', 'cabinet_email', 'cabinet_password'],
+    },
+    {
+        'type': 'guest_activation_required',
+        'label': {
+            'ru': 'Быстрая покупка: требуется активация',
+            'en': 'Quick Purchase: Activation Required',
+            'zh': '快捷购买：需要激活',
+            'ua': 'Швидка покупка: потрібна активація',
+        },
+        'description': {
+            'ru': 'Письмо когда у покупателя уже есть активная подписка',
+            'en': 'Email when buyer already has an active subscription',
+            'zh': '买家已有活跃订阅时发送的邮件',
+            'ua': 'Лист коли у покупця вже є активна підписка',
+        },
+        'context_vars': ['tariff_name', 'period_days', 'success_page_url', 'gift_message', 'is_gift'],
+    },
+    {
+        'type': 'guest_gift_received',
+        'label': {
+            'ru': 'Быстрая покупка: подарок получен',
+            'en': 'Quick Purchase: Gift Received',
+            'zh': '快捷购买：收到礼物',
+            'ua': 'Швидка покупка: подарунок отримано',
+        },
+        'description': {
+            'ru': 'Письмо получателю подарочной подписки',
+            'en': 'Email to gift subscription recipient',
+            'zh': '发送给礼物订阅接收者的邮件',
+            'ua': 'Лист отримувачу подарункової підписки',
+        },
+        'context_vars': [
+            'tariff_name',
+            'period_days',
+            'cabinet_url',
+            'gift_message',
+            'cabinet_email',
+            'cabinet_password',
+        ],
+    },
+    {
+        'type': 'guest_cabinet_credentials',
+        'label': {
+            'ru': 'Быстрая покупка: данные для входа',
+            'en': 'Quick Purchase: Login Credentials',
+            'zh': '快捷购买：登录凭据',
+            'ua': 'Швидка покупка: дані для входу',
+        },
+        'description': {
+            'ru': 'Письмо с логином и паролем для личного кабинета',
+            'en': 'Email with login credentials for the cabinet',
+            'zh': '包含个人中心登录信息的邮件',
+            'ua': 'Лист з логіном та паролем для особистого кабінету',
+        },
+        'context_vars': ['tariff_name', 'period_days', 'cabinet_url', 'cabinet_email', 'cabinet_password'],
+    },
 ]
 
 SAMPLE_CONTEXTS: dict[str, dict[str, Any]] = {
@@ -315,26 +386,70 @@ SAMPLE_CONTEXTS: dict[str, dict[str, Any]] = {
     },
     'subscription_expiring': {'days_left': 3, 'expires_at': '2025-01-30'},
     'subscription_expired': {},
-    'subscription_renewed': {'new_end_date': '2025-02-28', 'tariff_name': 'Premium'},
-    'subscription_activated': {'tariff_name': 'Premium', 'end_date': '2025-02-28'},
-    'autopay_success': {'formatted_amount': '300.00 ₽', 'formatted_balance': '200.00 ₽', 'new_end_date': '2025-02-28'},
+    'subscription_renewed': {
+        'new_expires_at': '2025-02-28',
+        'tariff_name': 'Premium',
+        'traffic_limit_gb': 100,
+        'device_limit': 3,
+    },
+    'subscription_activated': {
+        'expires_at': '2025-02-28',
+        'tariff_name': 'Premium',
+        'traffic_limit_gb': 100,
+        'device_limit': 3,
+    },
+    'autopay_success': {'formatted_amount': '300.00 ₽', 'amount_rubles': 300, 'new_expires_at': '2025-02-28'},
     'autopay_failed': {'reason': 'Card declined'},
-    'autopay_insufficient_funds': {'formatted_required': '300.00 ₽', 'formatted_balance': '50.00 ₽'},
-    'daily_debit': {'formatted_amount': '10.00 ₽', 'formatted_balance': '490.00 ₽'},
-    'daily_insufficient_funds': {'formatted_required': '10.00 ₽', 'formatted_balance': '5.00 ₽'},
+    'autopay_insufficient_funds': {'required_amount': '300.00 ₽', 'current_balance': '50.00 ₽'},
+    'daily_debit': {
+        'formatted_amount': '10.00 ₽',
+        'formatted_balance': '490.00 ₽',
+        'amount_rubles': 10,
+        'new_balance_rubles': 490,
+    },
+    'daily_insufficient_funds': {'required_amount': '10.00 ₽', 'current_balance': '5.00 ₽'},
     'ban_notification': {'reason': 'Violation of terms of service'},
     'unban_notification': {},
     'warning_notification': {'message': 'Please review our terms of service'},
-    'referral_bonus': {'formatted_amount': '100.00 ₽', 'referral_name': 'John'},
+    'referral_bonus': {'formatted_bonus': '100.00 ₽', 'bonus_rubles': 100, 'referral_name': 'John'},
     'referral_registered': {'referral_name': 'John'},
-    'traffic_reset': {'traffic_limit': '100 GB'},
-    'payment_received': {'formatted_amount': '500.00 ₽', 'payment_method': 'YooKassa'},
+    'traffic_reset': {'reset_gb': 50, 'current_limit_gb': 100},
+    'payment_received': {'formatted_amount': '500.00 ₽', 'amount_rubles': 500, 'payment_method': 'YooKassa'},
     'email_verification': {
         'username': 'John',
         'verification_url': 'https://example.com/verify?token=abc123',
         'expire_hours': 24,
     },
     'password_reset': {'username': 'John', 'reset_url': 'https://example.com/reset?token=abc123', 'expire_hours': 1},
+    'guest_subscription_delivered': {
+        'tariff_name': 'Premium',
+        'period_days': 30,
+        'cabinet_url': 'https://example.com/cabinet',
+        'cabinet_email': 'user@example.com',
+        'cabinet_password': 'SecurePass123',
+    },
+    'guest_activation_required': {
+        'tariff_name': 'Premium',
+        'period_days': 30,
+        'success_page_url': 'https://example.com/cabinet/buy/success/abc123',
+        'is_gift': True,
+        'gift_message': 'Happy birthday!',
+    },
+    'guest_gift_received': {
+        'tariff_name': 'Premium',
+        'period_days': 30,
+        'cabinet_url': 'https://example.com/cabinet',
+        'gift_message': 'Happy birthday!',
+        'cabinet_email': 'recipient@example.com',
+        'cabinet_password': 'SecurePass123',
+    },
+    'guest_cabinet_credentials': {
+        'tariff_name': 'Premium',
+        'period_days': 30,
+        'cabinet_url': 'https://example.com/cabinet',
+        'cabinet_email': 'user@example.com',
+        'cabinet_password': 'SecurePass123',
+    },
 }
 
 AVAILABLE_LANGUAGES = ['ru', 'en', 'zh', 'ua', 'fa']
@@ -557,8 +672,8 @@ async def preview_template(
     language = data.language if data.language in AVAILABLE_LANGUAGES else 'ru'
 
     if data.body_html:
-        # Preview custom content wrapped in base template
-        rendered_html = templates_instance._get_base_template(data.body_html, language)
+        # Preview custom content — auto-detects styled vs simple HTML
+        rendered_html = templates_instance._wrap_override_template(data.body_html, language)
         subject = data.subject or notification_type
     else:
         # Preview default template
@@ -618,14 +733,13 @@ async def send_test_email(
     sample_context = SAMPLE_CONTEXTS.get(notification_type, {})
     templates_instance = EmailNotificationTemplates()
 
-    # Check for DB override
-    from ..services.email_template_overrides import get_template_override
+    # Check for DB override (get_rendered_override substitutes sample context vars)
+    from ..services.email_template_overrides import get_rendered_override
 
-    override = await get_template_override(notification_type, language, db)
+    rendered = await get_rendered_override(notification_type, language, sample_context, db)
 
-    if override:
-        subject = override['subject']
-        body_html = templates_instance._get_base_template(override['body_html'], language)
+    if rendered:
+        subject, body_html = rendered
     else:
         try:
             from app.services.notification_delivery_service import NotificationType

app/cabinet/routes/admin_menu_layout.py

@@ -0,0 +1,398 @@
+"""Admin routes for cabinet menu layout configuration (rows + custom URL buttons).
+
+Serves a MERGED view combining ``CABINET_MENU_LAYOUT`` (row arrangement, custom buttons)
+and ``CABINET_BUTTON_STYLES`` (per-section style/emoji/enabled/labels) to the frontend.
+On save, splits the payload back into two SystemSetting keys.
+"""
+
+import json
+import re
+from typing import Literal
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.models import User
+from app.utils.button_styles_cache import (
+    ALLOWED_STYLE_VALUES,
+    BOT_LOCALES,
+    BUTTON_STYLES_KEY,
+    DEFAULT_BUTTON_STYLES,
+    get_cached_button_styles,
+    load_button_styles_cache,
+)
+from app.utils.menu_layout_cache import (
+    BUILTIN_SECTIONS,
+    DEFAULT_MENU_LAYOUT,
+    MENU_LAYOUT_KEY,
+    VALID_CUSTOM_BUTTON_STYLES,
+    get_cached_menu_layout,
+    load_menu_layout_cache,
+)
+
+from ..dependencies import get_cabinet_db, require_permission
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/admin/menu-layout', tags=['Admin Menu Layout'])
+
+# ---- Constants ---------------------------------------------------------------
+
+MAX_ROWS = 20
+MAX_BUTTONS_PER_ROW = 3
+MAX_LABEL_LENGTH = 100
+URL_PATTERN = re.compile(r'^https?://')
+
+
+# ---- Schemas -----------------------------------------------------------------
+
+
+class ButtonConfig(BaseModel):
+    """Configuration for a single button (built-in or custom URL)."""
+
+    id: str = Field(max_length=100)
+    type: Literal['builtin', 'custom']
+    style: str = Field(default='primary', max_length=20)
+    icon_custom_emoji_id: str = Field(default='', max_length=100)
+    enabled: bool = True
+    labels: dict[str, str] = Field(default_factory=dict, max_length=10)
+    url: str | None = Field(default=None, max_length=2048)
+    open_in: Literal['external', 'webapp'] = 'external'
+
+
+class RowConfig(BaseModel):
+    """Configuration for a single row of buttons."""
+
+    id: str = Field(max_length=100)
+    max_per_row: int = Field(default=2, ge=1, le=3)
+    buttons: list[ButtonConfig] = Field(default_factory=list, max_length=MAX_BUTTONS_PER_ROW)
+
+
+class MenuConfigResponse(BaseModel):
+    """Full merged menu configuration returned to the frontend."""
+
+    rows: list[RowConfig]
+
+
+class MenuConfigUpdateRequest(BaseModel):
+    """Full menu configuration submitted by the frontend."""
+
+    rows: list[RowConfig] = Field(max_length=MAX_ROWS)
+
+
+# ---- Helpers -----------------------------------------------------------------
+
+
+async def _get_setting_value(db: AsyncSession, key: str) -> str | None:
+    from sqlalchemy import select
+
+    from app.database.models import SystemSetting
+
+    result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
+    setting = result.scalar_one_or_none()
+    return setting.value if setting else None
+
+
+async def _upsert_setting(db: AsyncSession, key: str, value: str) -> None:
+    """Insert or update a SystemSetting without committing."""
+    from sqlalchemy import select
+
+    from app.database.models import SystemSetting
+
+    result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
+    setting = result.scalar_one_or_none()
+    if setting:
+        setting.value = value
+    else:
+        setting = SystemSetting(key=key, value=value)
+        db.add(setting)
+
+
+def _build_merged_response(
+    layout: dict[str, object],
+    button_styles: dict[str, dict],
+) -> MenuConfigResponse:
+    """Merge layout rows with button_styles into a unified response.
+
+    Built-in buttons get style/emoji/enabled/labels from ``button_styles``.
+    Custom URL buttons get all config from layout's ``custom_buttons``.
+    """
+    custom_buttons: dict[str, dict] = layout.get('custom_buttons', {})
+
+    # Collect row entries sorted numerically (row_1, row_2, ..., row_10, ...)
+    row_keys = sorted(
+        (k for k in layout if k.startswith('row_')),
+        key=lambda k: int(k.split('_', 1)[1]) if k.split('_', 1)[1].isdigit() else 0,
+    )
+
+    rows: list[RowConfig] = []
+    for row_key in row_keys:
+        row_data = layout[row_key]
+        if not isinstance(row_data, dict):
+            continue
+
+        raw_buttons: list[str] = row_data.get('buttons', [])
+        max_per_row: int = row_data.get('max_per_row', 2)
+        row_id: str = row_data.get('id', row_key)
+
+        merged_buttons: list[ButtonConfig] = []
+        for btn_id in raw_buttons:
+            if btn_id in BUILTIN_SECTIONS:
+                # Built-in: pull style data from button_styles cache
+                style_cfg = button_styles.get(btn_id, {})
+                merged_buttons.append(
+                    ButtonConfig(
+                        id=btn_id,
+                        type='builtin',
+                        style=style_cfg.get('style', 'primary'),
+                        icon_custom_emoji_id=style_cfg.get('icon_custom_emoji_id', ''),
+                        enabled=style_cfg.get('enabled', True),
+                        labels=style_cfg.get('labels', {}),
+                    ),
+                )
+            elif btn_id.startswith('custom_') and btn_id in custom_buttons:
+                # Custom URL button: pull config from layout's custom_buttons
+                cb = custom_buttons[btn_id]
+                merged_buttons.append(
+                    ButtonConfig(
+                        id=btn_id,
+                        type='custom',
+                        style=cb.get('style', 'primary'),
+                        icon_custom_emoji_id=cb.get('icon_custom_emoji_id', ''),
+                        enabled=cb.get('enabled', True),
+                        labels=cb.get('labels', {}),
+                        url=cb.get('url'),
+                        open_in=cb.get('open_in', 'external'),
+                    ),
+                )
+
+        rows.append(
+            RowConfig(
+                id=row_id,
+                max_per_row=max_per_row,
+                buttons=merged_buttons,
+            ),
+        )
+
+    return MenuConfigResponse(rows=rows)
+
+
+def _split_update(
+    rows: list[RowConfig],
+) -> tuple[dict[str, object], dict[str, dict]]:
+    """Split a flat list of RowConfig back into layout_data and button_styles_updates.
+
+    Returns:
+        (layout_data, button_styles_updates)
+        - layout_data: rows + custom_buttons for ``CABINET_MENU_LAYOUT``
+        - button_styles_updates: ``{section: {style, icon_custom_emoji_id, enabled, labels}}``
+          for built-in sections only
+    """
+    layout_data: dict[str, object] = {}
+    custom_buttons: dict[str, dict] = {}
+    button_styles_updates: dict[str, dict] = {}
+
+    for idx, row in enumerate(rows, start=1):
+        row_key = f'row_{idx}'
+        button_ids: list[str] = []
+
+        for btn in row.buttons:
+            button_ids.append(btn.id)
+
+            if btn.type == 'builtin' and btn.id in BUILTIN_SECTIONS:
+                button_styles_updates[btn.id] = {
+                    'style': btn.style,
+                    'icon_custom_emoji_id': btn.icon_custom_emoji_id,
+                    'enabled': btn.enabled,
+                    'labels': btn.labels,
+                }
+            elif btn.type == 'custom' and btn.id.startswith('custom_'):
+                custom_buttons[btn.id] = {
+                    'id': btn.id,
+                    'url': btn.url or '',
+                    'style': btn.style,
+                    'icon_custom_emoji_id': btn.icon_custom_emoji_id,
+                    'enabled': btn.enabled,
+                    'labels': btn.labels,
+                    'open_in': btn.open_in,
+                }
+
+        layout_data[row_key] = {
+            'id': row.id or row_key,
+            'buttons': button_ids,
+            'max_per_row': row.max_per_row,
+        }
+
+    layout_data['custom_buttons'] = custom_buttons
+    return layout_data, button_styles_updates
+
+
+def _validate_update_payload(rows: list[RowConfig]) -> None:
+    """Validate the full update payload. Raises HTTPException on failure."""
+    if len(rows) > MAX_ROWS:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Too many rows: {len(rows)}. Maximum allowed: {MAX_ROWS}.',
+        )
+
+    # Check for duplicate button IDs across all rows
+    seen_ids: set[str] = set()
+    for row in rows:
+        for btn in row.buttons:
+            if btn.id in seen_ids:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f'Duplicate button ID: "{btn.id}". Each button can only appear once.',
+                )
+            seen_ids.add(btn.id)
+
+    for row in rows:
+        if len(row.buttons) > MAX_BUTTONS_PER_ROW:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f'Row "{row.id}" has {len(row.buttons)} buttons. Maximum per row: {MAX_BUTTONS_PER_ROW}.',
+            )
+
+        for btn in row.buttons:
+            # Validate button type consistency
+            if btn.type == 'builtin' and btn.id not in BUILTIN_SECTIONS:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f'Unknown built-in section: "{btn.id}".',
+                )
+
+            if btn.type == 'custom' and not btn.id.startswith('custom_'):
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f'Custom button id must start with "custom_": "{btn.id}".',
+                )
+
+            # Validate URL for custom buttons
+            if btn.type == 'custom':
+                if not btn.url or not URL_PATTERN.match(btn.url):
+                    raise HTTPException(
+                        status_code=status.HTTP_400_BAD_REQUEST,
+                        detail=f'Custom button "{btn.id}" must have a URL starting with http:// or https://.',
+                    )
+                if btn.open_in == 'webapp' and not btn.url.startswith('https://'):
+                    raise HTTPException(
+                        status_code=status.HTTP_400_BAD_REQUEST,
+                        detail=f'Custom button "{btn.id}" with webapp mode requires an https:// URL.',
+                    )
+
+            # Validate style
+            all_allowed = ALLOWED_STYLE_VALUES | VALID_CUSTOM_BUTTON_STYLES
+            if btn.style not in all_allowed:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f'Invalid style "{btn.style}" for button "{btn.id}". '
+                    f'Allowed: {", ".join(sorted(all_allowed))}.',
+                )
+
+            # Validate labels
+            for locale_key, label_val in btn.labels.items():
+                if locale_key not in BOT_LOCALES:
+                    raise HTTPException(
+                        status_code=status.HTTP_400_BAD_REQUEST,
+                        detail=f'Invalid locale "{locale_key}" for button "{btn.id}". '
+                        f'Allowed: {", ".join(BOT_LOCALES)}.',
+                    )
+                if not isinstance(label_val, str):
+                    raise HTTPException(
+                        status_code=status.HTTP_400_BAD_REQUEST,
+                        detail=f'Label value for locale "{locale_key}" must be a string.',
+                    )
+                if len(label_val.strip()) > MAX_LABEL_LENGTH:
+                    raise HTTPException(
+                        status_code=status.HTTP_400_BAD_REQUEST,
+                        detail=f'Label for locale "{locale_key}" on button "{btn.id}" '
+                        f'exceeds {MAX_LABEL_LENGTH} characters.',
+                    )
+
+
+# ---- Routes ------------------------------------------------------------------
+
+
+@router.get('', response_model=MenuConfigResponse)
+async def get_menu_layout(
+    _admin: User = Depends(require_permission('settings:read')),
+):
+    """Return merged menu layout config (rows + button styles). Admin only."""
+    layout = get_cached_menu_layout()
+    button_styles = get_cached_button_styles()
+    return _build_merged_response(layout, button_styles)
+
+
+@router.put('', response_model=MenuConfigResponse)
+async def update_menu_layout(
+    payload: MenuConfigUpdateRequest,
+    admin: User = Depends(require_permission('settings:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Save full menu layout config. Splits into layout + button styles. Admin only."""
+    _validate_update_payload(payload.rows)
+
+    layout_data, button_styles_updates = _split_update(payload.rows)
+
+    # Save layout to CABINET_MENU_LAYOUT (without committing)
+    await _upsert_setting(db, MENU_LAYOUT_KEY, json.dumps(layout_data))
+
+    # Merge button styles updates with existing styles (don't overwrite sections not in request)
+    if button_styles_updates:
+        raw = await _get_setting_value(db, BUTTON_STYLES_KEY)
+        current_styles: dict[str, dict] = {}
+        if raw:
+            try:
+                current_styles = json.loads(raw)
+            except (json.JSONDecodeError, TypeError):
+                current_styles = {}
+
+        for section, updates in button_styles_updates.items():
+            current_styles[section] = updates
+
+        await _upsert_setting(db, BUTTON_STYLES_KEY, json.dumps(current_styles))
+
+    # Single atomic commit for both settings
+    await db.commit()
+
+    # Refresh caches after commit
+    await load_button_styles_cache()
+    await load_menu_layout_cache()
+
+    logger.info(
+        'Admin updated menu layout',
+        telegram_id=admin.telegram_id,
+        rows_count=len(payload.rows),
+        custom_buttons_count=len(layout_data.get('custom_buttons', {})),
+    )
+
+    # Return merged response from fresh caches
+    layout = get_cached_menu_layout()
+    button_styles = get_cached_button_styles()
+    return _build_merged_response(layout, button_styles)
+
+
+@router.post('/reset', response_model=MenuConfigResponse)
+async def reset_menu_layout(
+    admin: User = Depends(require_permission('settings:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Reset menu layout AND button styles to defaults. Admin only."""
+    await _upsert_setting(db, MENU_LAYOUT_KEY, json.dumps(DEFAULT_MENU_LAYOUT))
+    await _upsert_setting(db, BUTTON_STYLES_KEY, json.dumps(DEFAULT_BUTTON_STYLES))
+
+    # Single atomic commit for both settings
+    await db.commit()
+
+    # Refresh caches after commit
+    await load_button_styles_cache()
+    await load_menu_layout_cache()
+
+    logger.info('Admin reset menu layout and button styles to defaults', telegram_id=admin.telegram_id)
+
+    layout = get_cached_menu_layout()
+    button_styles = get_cached_button_styles()
+    return _build_merged_response(layout, button_styles)

app/cabinet/routes/admin_news.py

@@ -0,0 +1,343 @@
+"""Admin routes for managing news articles in cabinet."""
+
+from datetime import UTC, datetime
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.crud.news import (
+    create_news_article,
+    delete_news_article,
+    get_all_news,
+    get_all_news_count,
+    get_news_article_by_id,
+    unfeature_all_news,
+    update_news_article,
+)
+from app.database.crud.news_categories import get_category_by_id
+from app.database.crud.news_tags import get_tag_by_id
+from app.database.models import NewsArticle, User
+
+from ..dependencies import get_cabinet_db, require_permission
+from ..schemas.news import (
+    NewsArticleListItem,
+    NewsArticleResponse,
+    NewsCreateRequest,
+    NewsListResponse,
+    NewsToggleResponse,
+    NewsUpdateRequest,
+)
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/admin/news', tags=['Cabinet Admin News'])
+
+
+def _article_to_detail(article: NewsArticle) -> dict[str, Any]:
+    """Convert NewsArticle ORM instance to full detail dict.
+
+    Expects the ``author`` relationship to be eagerly loaded.
+    """
+    author_name: str | None = None
+    if article.author:
+        author_name = article.author.first_name or article.author.username or f'#{article.author.id}'
+
+    return {
+        'id': article.id,
+        'title': article.title,
+        'slug': article.slug,
+        'content': article.content,
+        'excerpt': article.excerpt,
+        'category': article.category,
+        'category_color': article.category_color,
+        'tag': article.tag,
+        'category_id': article.category_id,
+        'tag_id': article.tag_id,
+        'featured_image_url': article.featured_image_url,
+        'is_published': article.is_published,
+        'is_featured': article.is_featured,
+        'published_at': article.published_at,
+        'read_time_minutes': article.read_time_minutes,
+        'views_count': article.views_count,
+        'author_name': author_name,
+        'created_at': article.created_at,
+        'updated_at': article.updated_at,
+    }
+
+
+@router.get('', response_model=NewsListResponse)
+async def list_all_news(
+    admin: User = Depends(require_permission('news:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+    limit: int = Query(50, ge=1, le=200),
+    offset: int = Query(0, ge=0),
+) -> NewsListResponse:
+    """Get all news articles (admin view, includes unpublished)."""
+    try:
+        articles = await get_all_news(db, limit=limit, offset=offset)
+        total = await get_all_news_count(db)
+
+        items = [NewsArticleListItem.model_validate(a) for a in articles]
+
+        return NewsListResponse(items=items, total=total)
+    except HTTPException:
+        raise
+    except Exception:
+        logger.exception('Failed to list all news')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load news articles',
+        )
+
+
+@router.get('/{article_id}', response_model=NewsArticleResponse)
+async def get_article_detail(
+    article_id: int,
+    admin: User = Depends(require_permission('news:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsArticleResponse:
+    """Get a single news article by ID (admin view)."""
+    article = await get_news_article_by_id(db, article_id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Article not found',
+        )
+
+    return NewsArticleResponse(**_article_to_detail(article))
+
+
+@router.post('', response_model=NewsArticleResponse, status_code=status.HTTP_201_CREATED)
+async def create_article(
+    request: NewsCreateRequest,
+    admin: User = Depends(require_permission('news:create')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsArticleResponse:
+    """Create a new news article."""
+    try:
+        # Resolve category from FK -- sync legacy string fields from the managed entity
+        category_name = request.category
+        category_color = request.category_color
+        if request.category_id is not None:
+            cat = await get_category_by_id(db, request.category_id)
+            if not cat:
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    detail=f'Category with id={request.category_id} not found',
+                )
+            category_name = cat.name
+            category_color = cat.color
+
+        # Resolve tag from FK -- sync legacy string field from the managed entity
+        tag_name = request.tag
+        if request.tag_id is not None:
+            tag_obj = await get_tag_by_id(db, request.tag_id)
+            if not tag_obj:
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    detail=f'Tag with id={request.tag_id} not found',
+                )
+            tag_name = tag_obj.name
+
+        if request.is_featured:
+            await unfeature_all_news(db)
+        article = await create_news_article(
+            db,
+            title=request.title,
+            slug=request.slug,
+            content=request.content,
+            excerpt=request.excerpt,
+            category=category_name,
+            category_color=category_color,
+            tag=tag_name,
+            category_id=request.category_id,
+            tag_id=request.tag_id,
+            featured_image_url=request.featured_image_url,
+            is_published=request.is_published,
+            is_featured=request.is_featured,
+            read_time_minutes=request.read_time_minutes,
+            created_by=admin.id,
+        )
+    except IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='An article with this slug already exists',
+        )
+    except Exception:
+        logger.exception('Failed to create news article')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to create article',
+        )
+
+    # Reload with author relationship
+    article = await get_news_article_by_id(db, article.id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to reload article after creation',
+        )
+    return NewsArticleResponse(**_article_to_detail(article))
+
+
+@router.put('/{article_id}', response_model=NewsArticleResponse)
+async def update_article(
+    article_id: int,
+    request: NewsUpdateRequest,
+    admin: User = Depends(require_permission('news:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsArticleResponse:
+    """Update an existing news article."""
+    article = await get_news_article_by_id(db, article_id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Article not found',
+        )
+
+    try:
+        update_data = request.model_dump(exclude_unset=True)
+
+        # Resolve category from FK -- sync legacy string fields from the managed entity
+        if 'category_id' in update_data and update_data['category_id'] is not None:
+            cat = await get_category_by_id(db, update_data['category_id'])
+            if not cat:
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    detail=f'Category with id={update_data["category_id"]} not found',
+                )
+            update_data['category'] = cat.name
+            update_data['category_color'] = cat.color
+
+        # Resolve tag from FK -- sync legacy string field from the managed entity
+        if 'tag_id' in update_data and update_data['tag_id'] is not None:
+            tag_obj = await get_tag_by_id(db, update_data['tag_id'])
+            if not tag_obj:
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                    detail=f'Tag with id={update_data["tag_id"]} not found',
+                )
+            update_data['tag'] = tag_obj.name
+
+        if update_data.get('is_featured'):
+            await unfeature_all_news(db)
+        article = await update_news_article(db, article, **update_data)
+    except IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='An article with this slug already exists',
+        )
+    except Exception:
+        logger.exception('Failed to update news article', article_id=article_id)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to update article',
+        )
+
+    # Reload with author relationship (update used bulk UPDATE, author not populated)
+    article = await get_news_article_by_id(db, article.id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to reload article after update',
+        )
+    return NewsArticleResponse(**_article_to_detail(article))
+
+
+@router.delete('/{article_id}', status_code=status.HTTP_204_NO_CONTENT)
+async def remove_article(
+    article_id: int,
+    admin: User = Depends(require_permission('news:delete')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> None:
+    """Delete a news article."""
+    article = await get_news_article_by_id(db, article_id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Article not found',
+        )
+
+    try:
+        await delete_news_article(db, article)
+    except Exception:
+        logger.exception('Failed to delete news article', article_id=article_id)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to delete article',
+        )
+
+
+@router.post('/{article_id}/publish', response_model=NewsToggleResponse)
+async def toggle_publish(
+    article_id: int,
+    admin: User = Depends(require_permission('news:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsToggleResponse:
+    """Toggle the published status of a news article."""
+    article = await get_news_article_by_id(db, article_id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Article not found',
+        )
+
+    new_published = not article.is_published
+
+    update_kwargs: dict[str, Any] = {'is_published': new_published}
+    # Auto-set published_at on first publish
+    if new_published and article.published_at is None:
+        update_kwargs['published_at'] = datetime.now(UTC)
+
+    try:
+        article = await update_news_article(db, article, **update_kwargs)
+        return NewsToggleResponse(
+            id=article.id,
+            is_published=article.is_published,
+            is_featured=article.is_featured,
+            published_at=article.published_at,
+        )
+    except Exception:
+        logger.exception('Failed to toggle publish', article_id=article_id)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to toggle publish status',
+        )
+
+
+@router.post('/{article_id}/feature', response_model=NewsToggleResponse)
+async def toggle_featured(
+    article_id: int,
+    admin: User = Depends(require_permission('news:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsToggleResponse:
+    """Toggle the featured status of a news article."""
+    article = await get_news_article_by_id(db, article_id)
+    if not article:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Article not found',
+        )
+
+    try:
+        new_featured = not article.is_featured
+        # Only one article can be featured at a time — unfeature all others first
+        if new_featured:
+            await unfeature_all_news(db)
+        article = await update_news_article(db, article, is_featured=new_featured)
+        return NewsToggleResponse(
+            id=article.id,
+            is_published=article.is_published,
+            is_featured=article.is_featured,
+            published_at=article.published_at,
+        )
+    except Exception:
+        logger.exception('Failed to toggle featured', article_id=article_id)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to toggle featured status',
+        )

app/cabinet/routes/admin_news_categories.py

@@ -0,0 +1,90 @@
+"""Admin routes for managing news categories."""
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.crud.news_categories import (
+    create_category,
+    delete_category,
+    get_all_categories,
+    get_category_by_id,
+    update_category,
+)
+from app.database.models import User
+
+from ..dependencies import get_cabinet_db, require_permission
+from ..schemas.news_categories import NewsCategoryCreate, NewsCategoryResponse, NewsCategoryUpdate
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/admin/news/categories', tags=['Cabinet Admin News Categories'])
+
+
+@router.get('', response_model=list[NewsCategoryResponse])
+async def list_categories(
+    admin: User = Depends(require_permission('news:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> list[NewsCategoryResponse]:
+    """Get all news categories."""
+    categories = await get_all_categories(db)
+    return [NewsCategoryResponse.model_validate(c) for c in categories]
+
+
+@router.post('', response_model=NewsCategoryResponse, status_code=status.HTTP_201_CREATED)
+async def create_new_category(
+    request: NewsCategoryCreate,
+    admin: User = Depends(require_permission('news:create')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsCategoryResponse:
+    """Create a new news category."""
+    try:
+        category = await create_category(db, name=request.name, color=request.color)
+    except IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='Category already exists',
+        )
+    return NewsCategoryResponse.model_validate(category)
+
+
+@router.put('/{category_id}', response_model=NewsCategoryResponse)
+async def update_existing_category(
+    category_id: int,
+    request: NewsCategoryUpdate,
+    admin: User = Depends(require_permission('news:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsCategoryResponse:
+    """Update an existing news category."""
+    category = await get_category_by_id(db, category_id)
+    if not category:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Category not found',
+        )
+    try:
+        category = await update_category(db, category, **request.model_dump(exclude_unset=True))
+    except IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='Category name already exists',
+        )
+    return NewsCategoryResponse.model_validate(category)
+
+
+@router.delete('/{category_id}', status_code=status.HTTP_204_NO_CONTENT)
+async def remove_category(
+    category_id: int,
+    admin: User = Depends(require_permission('news:delete')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> None:
+    """Delete a news category. Articles using it will have category_id set to NULL."""
+    category = await get_category_by_id(db, category_id)
+    if not category:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Category not found',
+        )
+    await delete_category(db, category)

app/cabinet/routes/admin_news_media.py

@@ -0,0 +1,157 @@
+"""Admin routes for managing news article media (images/videos)."""
+
+import asyncio
+import re
+
+import structlog
+from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile, status
+from PIL import Image as PILImage
+
+from app.config import settings
+from app.database.models import User
+from app.services.news_media_service import (
+    SavedMedia,
+    delete_media_file,
+    detect_file_type,
+    ensure_upload_dirs,
+    save_image,
+    save_video,
+)
+
+from ..dependencies import require_permission
+from ..schemas.news_media import NewsMediaUploadResponse
+
+
+logger = structlog.get_logger(__name__)
+
+_BYTES_PER_MB = 1024 * 1024
+
+# Only allow UUID-hex filenames with expected extensions (path traversal defense-in-depth).
+# thumb_ prefix is NOT allowed — thumbnails are cleaned up automatically when the main file is deleted.
+_SAFE_FILENAME_RE = re.compile(r'^[0-9a-f]{32}\.(jpg|mp4|webm)$')
+
+router = APIRouter(prefix='/admin/news/media', tags=['Cabinet Admin News Media'])
+
+
+_ALLOWED_SCHEMES = frozenset({'http', 'https'})
+
+
+def _build_media_url(request: Request, relative_path: str) -> str:
+    """Build a full URL for a media file, respecting reverse proxy headers."""
+    proto = request.headers.get('X-Forwarded-Proto', request.url.scheme).split(',')[0].strip()
+    if proto not in _ALLOWED_SCHEMES:
+        proto = 'https'
+    host = request.headers.get('X-Forwarded-Host', request.headers.get('Host', request.url.netloc))
+    host = host.split(',')[0].strip()
+    return f'{proto}://{host}/uploads/{relative_path}'
+
+
+def _build_response(request: Request, saved: SavedMedia) -> NewsMediaUploadResponse:
+    """Convert SavedMedia to API response with full URLs."""
+    thumbnail_url = _build_media_url(request, saved.thumbnail_path) if saved.thumbnail_path else None
+
+    return NewsMediaUploadResponse(
+        url=_build_media_url(request, saved.relative_path),
+        thumbnail_url=thumbnail_url,
+        media_type=saved.media_type,
+        filename=saved.filename,
+        size_bytes=saved.size_bytes,
+        width=saved.width,
+        height=saved.height,
+    )
+
+
+@router.post('/upload', response_model=NewsMediaUploadResponse, status_code=status.HTTP_201_CREATED)
+async def upload_media(
+    request: Request,
+    file: UploadFile = File(...),
+    admin: User = Depends(require_permission('news:edit')),
+) -> NewsMediaUploadResponse:
+    """Upload an image or video for a news article."""
+    # Read with a hard budget to prevent memory exhaustion from huge uploads.
+    # Read slightly over the max allowed size so we can detect oversized files.
+    absolute_max_bytes = settings.MEDIA_MAX_VIDEO_SIZE_MB * _BYTES_PER_MB + 1
+    data = await file.read(absolute_max_bytes)
+    await file.close()
+    if not data:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Empty file',
+        )
+
+    if len(data) >= absolute_max_bytes:
+        raise HTTPException(
+            status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+            detail=f'File too large. Absolute maximum: {settings.MEDIA_MAX_VIDEO_SIZE_MB} MB',
+        )
+
+    # Detect type from magic bytes
+    try:
+        media_type, _ext = detect_file_type(data)
+    except ValueError:
+        raise HTTPException(
+            status_code=status.HTTP_415_UNSUPPORTED_MEDIA_TYPE,
+            detail='Unsupported file type. Allowed: JPEG, PNG, WebP, MP4, WebM',
+        ) from None
+
+    # Enforce per-type size limits
+    max_size_mb = settings.MEDIA_MAX_IMAGE_SIZE_MB if media_type == 'image' else settings.MEDIA_MAX_VIDEO_SIZE_MB
+    if len(data) > max_size_mb * _BYTES_PER_MB:
+        raise HTTPException(
+            status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+            detail=f'File too large. Maximum size for {media_type}: {max_size_mb} MB',
+        )
+
+    upload_path = settings.get_media_upload_path()
+    await asyncio.to_thread(ensure_upload_dirs, upload_path)
+
+    try:
+        if media_type == 'image':
+            saved = await save_image(
+                data,
+                upload_path,
+                max_dim=settings.MEDIA_IMAGE_MAX_DIMENSION,
+                quality=settings.MEDIA_JPEG_QUALITY,
+            )
+        else:
+            saved = await save_video(data, upload_path)
+    except (ValueError, OSError, PILImage.DecompressionBombError) as exc:
+        logger.warning('Failed to save uploaded media', media_type=media_type, error=str(exc))
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail='Failed to process uploaded file',
+        ) from None
+
+    logger.info(
+        'Media uploaded',
+        filename=saved.filename,
+        media_type=saved.media_type,
+        size_bytes=saved.size_bytes,
+        admin_id=admin.id,
+    )
+
+    return _build_response(request, saved)
+
+
+@router.delete('/{filename}', status_code=status.HTTP_204_NO_CONTENT)
+async def delete_media(
+    filename: str,
+    admin: User = Depends(require_permission('news:delete')),
+) -> None:
+    """Delete a previously uploaded media file."""
+    if not _SAFE_FILENAME_RE.match(filename):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid filename',
+        )
+
+    upload_path = settings.get_media_upload_path()
+
+    deleted = await asyncio.to_thread(delete_media_file, filename, upload_path)
+    if not deleted:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='File not found',
+        )
+
+    logger.info('Media deleted', filename=filename, admin_id=admin.id)

app/cabinet/routes/admin_news_tags.py

@@ -0,0 +1,90 @@
+"""Admin routes for managing news tags."""
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.crud.news_tags import (
+    create_tag,
+    delete_tag,
+    get_all_tags,
+    get_tag_by_id,
+    update_tag,
+)
+from app.database.models import User
+
+from ..dependencies import get_cabinet_db, require_permission
+from ..schemas.news_tags import NewsTagCreate, NewsTagResponse, NewsTagUpdate
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/admin/news/tags', tags=['Cabinet Admin News Tags'])
+
+
+@router.get('', response_model=list[NewsTagResponse])
+async def list_tags(
+    admin: User = Depends(require_permission('news:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> list[NewsTagResponse]:
+    """Get all news tags."""
+    tags = await get_all_tags(db)
+    return [NewsTagResponse.model_validate(t) for t in tags]
+
+
+@router.post('', response_model=NewsTagResponse, status_code=status.HTTP_201_CREATED)
+async def create_new_tag(
+    request: NewsTagCreate,
+    admin: User = Depends(require_permission('news:create')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsTagResponse:
+    """Create a new news tag."""
+    try:
+        tag = await create_tag(db, name=request.name, color=request.color)
+    except IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='Tag already exists',
+        )
+    return NewsTagResponse.model_validate(tag)
+
+
+@router.put('/{tag_id}', response_model=NewsTagResponse)
+async def update_existing_tag(
+    tag_id: int,
+    request: NewsTagUpdate,
+    admin: User = Depends(require_permission('news:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsTagResponse:
+    """Update an existing news tag."""
+    tag = await get_tag_by_id(db, tag_id)
+    if not tag:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Tag not found',
+        )
+    try:
+        tag = await update_tag(db, tag, **request.model_dump(exclude_unset=True))
+    except IntegrityError:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail='Tag name already exists',
+        )
+    return NewsTagResponse.model_validate(tag)
+
+
+@router.delete('/{tag_id}', status_code=status.HTTP_204_NO_CONTENT)
+async def remove_tag(
+    tag_id: int,
+    admin: User = Depends(require_permission('news:delete')),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> None:
+    """Delete a news tag. Articles using it will have tag_id set to NULL."""
+    tag = await get_tag_by_id(db, tag_id)
+    if not tag:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Tag not found',
+        )
+    await delete_tag(db, tag)

app/cabinet/routes/admin_partners.py

@@ -85,6 +85,7 @@ async def update_partner_settings(
     admin: User = Depends(require_permission('partners:settings')),
 ):
     """Update partner system settings."""
+    import asyncio
     from pathlib import Path
 
     # Update in-memory settings
@@ -104,8 +105,8 @@ async def update_partner_settings(
     # Persist to .env file
     try:
         env_file = Path('.env')
-        if env_file.exists():
-            lines = env_file.read_text().splitlines()
+        if await asyncio.to_thread(env_file.exists):
+            lines = (await asyncio.to_thread(env_file.read_text)).splitlines()
             updates: dict[str, str] = {}
 
             if request.withdrawal_enabled is not None:
@@ -143,7 +144,7 @@ async def update_partner_settings(
                 if key not in updated_keys:
                     new_lines.append(f'{key}={value}')
 
-            env_file.write_text('\n'.join(new_lines) + '\n')
+            await asyncio.to_thread(env_file.write_text, '\n'.join(new_lines) + '\n')
             logger.info('Updated partner settings in .env file', admin_id=admin.id)
     except Exception as e:
         logger.warning('Failed to update .env file', error=e)
@@ -190,6 +191,7 @@ async def list_applications(
                 telegram_channel=app.telegram_channel,
                 description=app.description,
                 expected_monthly_referrals=app.expected_monthly_referrals,
+                desired_commission_percent=app.desired_commission_percent,
                 status=app.status,
                 admin_comment=app.admin_comment,
                 approved_commission_percent=app.approved_commission_percent,
@@ -225,8 +227,7 @@ async def approve_application(
 
     # Notify user about approval
     try:
-        from aiogram import Bot
-
+        from app.bot_factory import create_bot
         from app.config import settings
         from app.services.notification_delivery_service import notification_delivery_service
 
@@ -238,7 +239,7 @@ async def approve_application(
                 tg_message = (
                     f'✅ Ваша заявка на партнёрство одобрена!\nКомиссия: {request.commission_percent}%{comment_text}'
                 )
-                bot = Bot(token=settings.BOT_TOKEN)
+                bot = create_bot()
                 try:
                     await notification_delivery_service.notify_partner_approved(
                         user=user,
@@ -278,8 +279,7 @@ async def reject_application(
 
     # Notify user about rejection
     try:
-        from aiogram import Bot
-
+        from app.bot_factory import create_bot
         from app.config import settings
         from app.services.notification_delivery_service import notification_delivery_service
 
@@ -289,7 +289,7 @@ async def reject_application(
             if user:
                 comment_text = f'\nПричина: {request.comment}' if request.comment else ''
                 tg_message = f'❌ Ваша заявка на партнёрство отклонена.{comment_text}'
-                bot = Bot(token=settings.BOT_TOKEN)
+                bot = create_bot()
                 try:
                     await notification_delivery_service.notify_partner_rejected(
                         user=user,
@@ -417,17 +417,24 @@ async def get_partner_detail(
 
     stats = await PartnerStatsService.get_referrer_detailed_stats(db, user_id)
 
-    # Get assigned campaigns
+    # Get assigned campaigns with per-campaign stats
     campaigns_result = await db.execute(
         select(AdvertisingCampaign).where(AdvertisingCampaign.partner_user_id == user_id)
     )
     campaigns = campaigns_result.scalars().all()
+
+    campaign_ids = [c.id for c in campaigns]
+    per_campaign_stats = await PartnerStatsService.get_per_campaign_stats(db, user_id, campaign_ids)
+
     campaign_list = [
         CampaignSummary(
             id=c.id,
             name=c.name,
             start_parameter=c.start_parameter,
             is_active=c.is_active,
+            registrations_count=per_campaign_stats.get(c.id, {}).get('registrations_count', 0),
+            referrals_count=per_campaign_stats.get(c.id, {}).get('referrals_count', 0),
+            earnings_kopeks=per_campaign_stats.get(c.id, {}).get('earnings_kopeks', 0),
         )
         for c in campaigns
     ]
@@ -551,6 +558,12 @@ async def assign_campaign(
         )
     await db.commit()
 
+    logger.info(
+        'Кампания привязана к партнёру',
+        campaign_id=campaign_id,
+        partner_user_id=user_id,
+        admin_id=admin.id,
+    )
     return {'success': True}
 
 
@@ -562,21 +575,32 @@ async def unassign_campaign(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Unassign a campaign from a partner."""
-    campaign = await db.get(AdvertisingCampaign, campaign_id)
-    if not campaign:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail='Кампания не найдена',
+    # Atomic check-and-unset to prevent race conditions
+    result = await db.execute(
+        update(AdvertisingCampaign)
+        .where(
+            AdvertisingCampaign.id == campaign_id,
+            AdvertisingCampaign.partner_user_id == user_id,
         )
-
-    if campaign.partner_user_id != user_id:
+        .values(partner_user_id=None, updated_at=datetime.now(UTC))
+    )
+    if result.rowcount == 0:
+        campaign = await db.get(AdvertisingCampaign, campaign_id)
+        if not campaign:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail='Кампания не найдена',
+            )
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail='Кампания не привязана к этому партнёру',
         )
-
-    campaign.partner_user_id = None
-    campaign.updated_at = datetime.now(UTC)
     await db.commit()
 
+    logger.info(
+        'Кампания откреплена от партнёра',
+        campaign_id=campaign_id,
+        partner_user_id=user_id,
+        admin_id=admin.id,
+    )
     return {'success': True}

app/cabinet/routes/admin_payment_methods.py

@@ -4,7 +4,7 @@ from datetime import datetime
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, status
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.database.models import User
@@ -60,10 +60,23 @@ class PaymentMethodConfigResponse(BaseModel):
 class PaymentMethodConfigUpdateRequest(BaseModel):
     is_enabled: bool | None = None
     display_name: str | None = Field(default=None, description='Null to reset to default')
-    sub_options: dict | None = None
+    sub_options: dict[str, bool] | None = None
     min_amount_kopeks: int | None = Field(default=None, ge=0)
     max_amount_kopeks: int | None = Field(default=None, ge=0)
     user_type_filter: str | None = Field(default=None, pattern='^(all|telegram|email)$')
+
+    @field_validator('sub_options', mode='before')
+    @classmethod
+    def validate_sub_options(cls, v: dict[str, bool] | None) -> dict[str, bool] | None:
+        if not v:
+            return None
+        if len(v) > 20:
+            raise ValueError('sub_options cannot have more than 20 keys')
+        for key in v:
+            if not isinstance(key, str) or len(key) > 50:
+                raise ValueError('sub_options keys must be strings of at most 50 characters')
+        return v
+
     first_topup_filter: str | None = Field(default=None, pattern='^(any|yes|no)$')
     promo_group_filter_mode: str | None = Field(default=None, pattern='^(all|selected)$')
     allowed_promo_group_ids: list[int] | None = None

app/cabinet/routes/admin_payments.py

@@ -1,14 +1,23 @@
 """Admin routes for payment verification in cabinet."""
 
 import math
-from datetime import datetime
+from datetime import UTC, datetime, timedelta
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.bot_factory import create_bot
 from app.database.models import PaymentMethod, User
+from app.services.payment_search_service import (
+    MAX_ALL_TIME_DAYS,
+    PeriodPreset,
+    SearchParams,
+    StatusFilter,
+    search_payments,
+    search_payments_stats,
+)
 from app.services.payment_service import PaymentService
 from app.services.payment_verification_service import (
     SUPPORTED_MANUAL_CHECK_METHODS,
@@ -50,6 +59,7 @@ class PendingPaymentResponse(BaseModel):
     user_id: int | None = None
     user_telegram_id: int | None = None
     user_username: str | None = None
+    user_email: str | None = None
 
     class Config:
         from_attributes = True
@@ -83,6 +93,16 @@ class PaymentsStatsResponse(BaseModel):
     by_method: dict
 
 
+class SearchStatsResponse(BaseModel):
+    """Statistics for payment search results."""
+
+    total: int
+    pending: int
+    paid: int
+    cancelled: int
+    by_method: dict
+
+
 # ============ Helper functions ============
 
 
@@ -206,7 +226,7 @@ def _is_checkable(record: PendingPayment) -> bool:
     if record.method == PaymentMethod.YOOKASSA:
         return status_str in {'pending', 'waiting_for_capture'}
     if record.method == PaymentMethod.CRYPTOBOT:
-        return status_str in {'active'}
+        return status_str == 'active'
     if record.method == PaymentMethod.CLOUDPAYMENTS:
         return status_str in {'pending', 'authorized'}
     if record.method == PaymentMethod.FREEKASSA:
@@ -237,6 +257,8 @@ def _get_payment_url(record: PendingPayment) -> str | None:
     elif record.method == PaymentMethod.CLOUDPAYMENTS or record.method == PaymentMethod.FREEKASSA:
         payment_url = getattr(payment, 'payment_url', None) or payment_url
 
+    if payment_url and not payment_url.startswith(('https://', 'http://')):
+        return None
     return payment_url
 
 
@@ -261,6 +283,7 @@ def _record_to_response(record: PendingPayment) -> PendingPaymentResponse:
         user_id=record.user.id if record.user else None,
         user_telegram_id=record.user.telegram_id if record.user else None,
         user_username=record.user.username if record.user else None,
+        user_email=record.user.email if record.user else None,
     )
 
 
@@ -325,6 +348,140 @@ async def get_payments_stats(
     )
 
 
+@router.get('/search', response_model=PendingPaymentListResponse)
+async def search_payments_endpoint(
+    search: str | None = Query(
+        None, max_length=256, description='Search query (invoice, @username, telegram_id, email)'
+    ),
+    status_filter: str = Query('all', description='Status filter: all, pending, paid, cancelled'),
+    method_filter: str | None = Query(None, description='Filter by payment method'),
+    period: str = Query('24h', description='Period preset: 24h, 7d, 30d, all'),
+    date_from: datetime | None = Query(None, description='Custom range start (ISO 8601)'),
+    date_to: datetime | None = Query(None, description='Custom range end (ISO 8601)'),
+    page: int = Query(1, ge=1, description='Page number'),
+    per_page: int = Query(20, ge=1, le=100, description='Items per page'),
+    admin: User = Depends(require_permission('payments:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Search payments across all providers with filters."""
+    try:
+        parsed_status = StatusFilter(status_filter)
+    except ValueError:
+        parsed_status = StatusFilter.ALL
+
+    try:
+        parsed_period = PeriodPreset(period)
+    except ValueError:
+        parsed_period = PeriodPreset.H24
+
+    parsed_method: PaymentMethod | None = None
+    if method_filter:
+        try:
+            parsed_method = PaymentMethod(method_filter)
+        except ValueError:
+            pass
+
+    # Ensure custom dates are timezone-aware
+    if date_from is not None and date_from.tzinfo is None:
+        date_from = date_from.replace(tzinfo=UTC)
+    if date_to is not None and date_to.tzinfo is None:
+        date_to = date_to.replace(tzinfo=UTC)
+
+    # Clamp custom dates to safety limit
+    min_allowed = datetime.now(UTC) - timedelta(days=MAX_ALL_TIME_DAYS)
+    if date_from is not None and date_from < min_allowed:
+        date_from = min_allowed
+    if date_from is not None and date_to is not None and date_from > date_to:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='date_from must be before date_to')
+
+    params = SearchParams(
+        search=search.strip() if search else None,
+        status_filter=parsed_status,
+        method_filter=parsed_method,
+        period=parsed_period,
+        date_from=date_from,
+        date_to=date_to,
+        page=page,
+        per_page=per_page,
+    )
+
+    page_items, total = await search_payments(db, params)
+    pages = math.ceil(total / per_page) if total > 0 else 1
+    items = [_record_to_response(p) for p in page_items]
+
+    return PendingPaymentListResponse(
+        items=items,
+        total=total,
+        page=page,
+        per_page=per_page,
+        pages=pages,
+    )
+
+
+@router.get('/search/stats', response_model=SearchStatsResponse)
+async def search_payments_stats_endpoint(
+    search: str | None = Query(
+        None, max_length=256, description='Search query (invoice, @username, telegram_id, email)'
+    ),
+    status_filter: str = Query('all', description='Status filter: all, pending, paid, cancelled'),
+    method_filter: str | None = Query(None, description='Filter by payment method'),
+    period: str = Query('24h', description='Period preset: 24h, 7d, 30d, all'),
+    date_from: datetime | None = Query(None, description='Custom range start (ISO 8601)'),
+    date_to: datetime | None = Query(None, description='Custom range end (ISO 8601)'),
+    admin: User = Depends(require_permission('payments:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get aggregated statistics for payment search results."""
+    try:
+        parsed_status = StatusFilter(status_filter)
+    except ValueError:
+        parsed_status = StatusFilter.ALL
+
+    try:
+        parsed_period = PeriodPreset(period)
+    except ValueError:
+        parsed_period = PeriodPreset.H24
+
+    parsed_method: PaymentMethod | None = None
+    if method_filter:
+        try:
+            parsed_method = PaymentMethod(method_filter)
+        except ValueError:
+            pass
+
+    # Ensure custom dates are timezone-aware
+    if date_from is not None and date_from.tzinfo is None:
+        date_from = date_from.replace(tzinfo=UTC)
+    if date_to is not None and date_to.tzinfo is None:
+        date_to = date_to.replace(tzinfo=UTC)
+
+    # Clamp custom dates to safety limit
+    min_allowed = datetime.now(UTC) - timedelta(days=MAX_ALL_TIME_DAYS)
+    if date_from is not None and date_from < min_allowed:
+        date_from = min_allowed
+    if date_from is not None and date_to is not None and date_from > date_to:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='date_from must be before date_to')
+
+    params = SearchParams(
+        search=search.strip() if search else None,
+        status_filter=parsed_status,
+        method_filter=parsed_method,
+        period=parsed_period,
+        date_from=date_from,
+        date_to=date_to,
+    )
+
+    stats = await search_payments_stats(db, params)
+
+    return SearchStatsResponse(
+        total=stats.total,
+        pending=stats.pending,
+        paid=stats.paid,
+        cancelled=stats.cancelled,
+        by_method=stats.by_method or {},
+    )
+
+
 @router.get('/{method}/{payment_id}', response_model=PendingPaymentResponse)
 async def get_pending_payment_details(
     method: str,
@@ -338,7 +495,7 @@ async def get_pending_payment_details(
     except ValueError:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'Invalid payment method: {method}',
+            detail='Invalid payment method',
         )
 
     record = await get_payment_record(db, payment_method, payment_id)
@@ -365,7 +522,7 @@ async def check_payment_status(
     except ValueError:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'Invalid payment method: {method}',
+            detail='Invalid payment method',
         )
 
     # Get current record
@@ -390,8 +547,12 @@ async def check_payment_status(
     old_is_paid = record.is_paid
 
     # Run manual check
-    payment_service = PaymentService()
-    updated = await run_manual_check(db, payment_method, payment_id, payment_service)
+    bot = create_bot()
+    try:
+        payment_service = PaymentService(bot=bot)
+        updated = await run_manual_check(db, payment_method, payment_id, payment_service)
+    finally:
+        await bot.session.close()
 
     if not updated:
         return ManualCheckResponse(

app/cabinet/routes/admin_pinned_messages.py

@@ -5,13 +5,11 @@ from datetime import UTC, datetime
 
 import structlog
 from aiogram import Bot
-from aiogram.client.default import DefaultBotProperties
-from aiogram.enums import ParseMode
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.config import settings
+from app.bot_factory import create_bot
 from app.database.models import PinnedMessage, User
 from app.services.pinned_message_service import (
     broadcast_pinned_message,
@@ -77,10 +75,7 @@ _cached_bot: Bot | None = None
 def _get_bot() -> Bot:
     global _cached_bot
     if _cached_bot is None:
-        _cached_bot = Bot(
-            token=settings.BOT_TOKEN,
-            default=DefaultBotProperties(parse_mode=ParseMode.HTML),
-        )
+        _cached_bot = create_bot()
     return _cached_bot
 
 

app/cabinet/routes/admin_promo_offers.py

@@ -4,19 +4,17 @@ from __future__ import annotations
 
 import asyncio
 from datetime import datetime
-from typing import Any
+from typing import Any, ClassVar
 
 import structlog
 from aiogram import Bot
-from aiogram.client.default import DefaultBotProperties
-from aiogram.enums import ParseMode
 from aiogram.exceptions import TelegramBadRequest, TelegramForbiddenError
 from aiogram.types import InlineKeyboardButton, InlineKeyboardMarkup
 from fastapi import APIRouter, Depends, HTTPException, Query, status
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, validator
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.config import settings
+from app.bot_factory import create_bot
 from app.database.crud.discount_offer import (
     count_discount_offers,
     list_discount_offers,
@@ -130,6 +128,20 @@ class PromoOfferBroadcastRequest(BaseModel):
     message_text: str | None = Field(None, description='Custom message text (HTML)')
     button_text: str | None = Field(None, description='Button text')
 
+    _TARGET_ALIASES: ClassVar[dict[str, str]] = {
+        'no_sub': 'no',
+        'all_users': 'all',
+        'active_subscribers': 'active',
+        'trial_users': 'trial',
+    }
+
+    @validator('target')
+    def normalize_target(cls, value: str | None) -> str | None:
+        if value is None:
+            return None
+        normalized = value.strip().lower()
+        return cls._TARGET_ALIASES.get(normalized, normalized)
+
 
 class PromoOfferBroadcastResponse(BaseModel):
     created_offers: int
@@ -369,10 +381,7 @@ async def list_offers(
 
 def _get_bot() -> Bot:
     """Create bot instance for sending notifications."""
-    return Bot(
-        token=settings.BOT_TOKEN,
-        default=DefaultBotProperties(parse_mode=ParseMode.HTML),
-    )
+    return create_bot()
 
 
 def _build_default_promo_message(

app/cabinet/routes/admin_promocodes.py

@@ -28,6 +28,7 @@ from app.database.crud.promocode import (
     get_promocodes_list,
     update_promocode,
 )
+from app.database.crud.tariff import get_tariff_by_id
 from app.database.models import PromoCode, PromoCodeType, PromoCodeUse, PromoGroup, User
 
 from ..dependencies import get_cabinet_db, require_permission
@@ -55,6 +56,8 @@ class PromoCodeResponse(BaseModel):
     valid_from: datetime
     valid_until: datetime | None = None
     promo_group_id: int | None = None
+    tariff_id: int | None = None
+    tariff_name: str | None = None
     created_by: int | None = None
     created_at: datetime
     updated_at: datetime
@@ -93,6 +96,7 @@ class PromoCodeCreateRequest(BaseModel):
     is_active: bool = True
     first_purchase_only: bool = False
     promo_group_id: int | None = None
+    tariff_id: int | None = None
 
 
 class PromoCodeUpdateRequest(BaseModel):
@@ -106,6 +110,7 @@ class PromoCodeUpdateRequest(BaseModel):
     is_active: bool | None = None
     first_purchase_only: bool | None = None
     promo_group_id: int | None = None
+    tariff_id: int | None = None
 
 
 # ============== PromoGroup Schemas ==============
@@ -168,7 +173,12 @@ def _normalize_datetime(value: datetime | None) -> datetime | None:
     return value
 
 
-def _serialize_promocode(promocode: PromoCode) -> PromoCodeResponse:
+async def _serialize_promocode(db: AsyncSession, promocode: PromoCode) -> PromoCodeResponse:
+    tariff_name = None
+    if promocode.tariff_id:
+        tariff = await get_tariff_by_id(db, promocode.tariff_id)
+        tariff_name = tariff.name if tariff else None
+
     promo_type = PromoCodeType(promocode.type)
     return PromoCodeResponse(
         id=promocode.id,
@@ -186,6 +196,8 @@ def _serialize_promocode(promocode: PromoCode) -> PromoCodeResponse:
         valid_from=promocode.valid_from,
         valid_until=promocode.valid_until,
         promo_group_id=promocode.promo_group_id,
+        tariff_id=promocode.tariff_id,
+        tariff_name=tariff_name,
         created_by=promocode.created_by,
         created_at=promocode.created_at,
         updated_at=promocode.updated_at,
@@ -315,8 +327,9 @@ async def list_promocodes(
     total = await get_promocodes_count(db, is_active=is_active) or 0
     promocodes = await get_promocodes_list(db, offset=offset, limit=limit, is_active=is_active)
 
+    serialized = [await _serialize_promocode(db, p) for p in promocodes]
     return PromoCodeListResponse(
-        items=[_serialize_promocode(promocode) for promocode in promocodes],
+        items=serialized,
         total=int(total),
         limit=limit,
         offset=offset,
@@ -335,7 +348,7 @@ async def get_promocode(
         raise HTTPException(status.HTTP_404_NOT_FOUND, 'Promo code not found')
 
     stats = await get_promocode_statistics(db, promocode_id)
-    base = _serialize_promocode(promocode)
+    base = await _serialize_promocode(db, promocode)
     recent_uses = [_serialize_recent_use(use) for use in stats.get('recent_uses', [])]
 
     return PromoCodeDetailResponse(
@@ -388,11 +401,13 @@ async def create_promocode_endpoint(
         update_fields['first_purchase_only'] = payload.first_purchase_only
     if payload.promo_group_id is not None:
         update_fields['promo_group_id'] = payload.promo_group_id
+    if payload.tariff_id is not None:
+        update_fields['tariff_id'] = payload.tariff_id
 
     if update_fields:
         promocode = await update_promocode(db, promocode, **update_fields)
 
-    return _serialize_promocode(promocode)
+    return await _serialize_promocode(db, promocode)
 
 
 @router.patch('/{promocode_id}', response_model=PromoCodeResponse)
@@ -446,11 +461,14 @@ async def update_promocode_endpoint(
     if payload.promo_group_id is not None:
         updates['promo_group_id'] = payload.promo_group_id
 
+    if payload.tariff_id is not None:
+        updates['tariff_id'] = payload.tariff_id if payload.tariff_id != 0 else None
+
     if not updates:
-        return _serialize_promocode(promocode)
+        return await _serialize_promocode(db, promocode)
 
     promocode = await update_promocode(db, promocode, **updates)
-    return _serialize_promocode(promocode)
+    return await _serialize_promocode(db, promocode)
 
 
 @router.delete(
@@ -489,44 +507,63 @@ async def admin_deactivate_discount_promocode(
     admin: User = Depends(require_permission('promocodes:edit')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> DeactivateDiscountResponse:
-    """Admin: deactivate a user's active discount promo code."""
+    """Admin: deactivate a user's active discount (promo code or promo offer)."""
     from app.database.crud.user import get_user_by_id as get_user
 
     target_user = await get_user(db, user_id)
     if not target_user:
         raise HTTPException(status.HTTP_404_NOT_FOUND, 'User not found')
 
-    from app.services.promocode_service import PromoCodeService
+    current_discount = getattr(target_user, 'promo_offer_discount_percent', 0) or 0
+    source = getattr(target_user, 'promo_offer_discount_source', None)
 
-    service = PromoCodeService()
-    result = await service.deactivate_discount_promocode(
-        db=db,
-        user_id=user_id,
-        admin_initiated=True,
-    )
+    if current_discount <= 0:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, 'User has no active discount')
 
-    if result['success']:
-        return DeactivateDiscountResponse(
-            success=True,
-            message=f'Discount promo code deactivated for user {user_id}',
-            deactivated_code=result.get('deactivated_code'),
-            discount_percent=result.get('discount_percent', 0),
+    # If source is a promo code, use the service to properly rollback usage
+    if source and source.startswith('promocode:'):
+        from app.services.promocode_service import PromoCodeService
+
+        service = PromoCodeService()
+        result = await service.deactivate_discount_promocode(
+            db=db,
             user_id=user_id,
+            admin_initiated=True,
         )
 
-    error_messages = {
-        'user_not_found': 'User not found',
-        'no_active_discount_promocode': 'User has no active discount from a promo code',
-        'discount_already_expired': 'Discount has already expired (cleaned up)',
-        'server_error': 'Server error occurred',
-    }
+        if result['success']:
+            return DeactivateDiscountResponse(
+                success=True,
+                message=f'Discount promo code deactivated for user {user_id}',
+                deactivated_code=result.get('deactivated_code'),
+                discount_percent=result.get('discount_percent', 0),
+                user_id=user_id,
+            )
 
-    error_code = result.get('error', 'server_error')
-    error_message = error_messages.get(error_code, 'Failed to deactivate promo code')
+        error_messages = {
+            'user_not_found': 'User not found',
+            'no_active_discount_promocode': 'User has no active discount from a promo code',
+            'discount_already_expired': 'Discount has already expired (cleaned up)',
+            'server_error': 'Server error occurred',
+        }
 
-    raise HTTPException(
-        status_code=status.HTTP_400_BAD_REQUEST,
-        detail=error_message,
+        error_code = result.get('error', 'server_error')
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, error_messages.get(error_code, 'Failed to deactivate'))
+
+    # For non-promocode offers (admin offers, etc.) — just clear the fields
+    old_percent = target_user.promo_offer_discount_percent
+    target_user.promo_offer_discount_percent = 0
+    target_user.promo_offer_discount_source = None
+    target_user.promo_offer_discount_expires_at = None
+    target_user.updated_at = datetime.now(UTC)
+    await db.commit()
+
+    return DeactivateDiscountResponse(
+        success=True,
+        message=f'Promo offer deactivated for user {user_id}',
+        deactivated_code=None,
+        discount_percent=old_percent,
+        user_id=user_id,
     )
 
 

app/cabinet/routes/admin_remnawave.py

@@ -5,6 +5,7 @@ from typing import Any
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.database.crud.server_squad import (
@@ -129,22 +130,22 @@ def _serialize_node(node_data: dict[str, Any]) -> NodeInfo:
         is_disabled=bool(node_data.get('is_disabled')),
         is_node_online=bool(node_data.get('is_node_online')),
         is_xray_running=bool(node_data.get('is_xray_running')),
-        users_online=node_data.get('users_online'),
+        users_online=node_data.get('users_online', 0),
         traffic_used_bytes=node_data.get('traffic_used_bytes'),
         traffic_limit_bytes=node_data.get('traffic_limit_bytes'),
         last_status_change=_parse_datetime(node_data.get('last_status_change')),
         last_status_message=node_data.get('last_status_message'),
-        xray_uptime=node_data.get('xray_uptime'),
+        xray_uptime=node_data.get('xray_uptime', 0) or 0,
         is_traffic_tracking_active=bool(node_data.get('is_traffic_tracking_active', False)),
         traffic_reset_day=node_data.get('traffic_reset_day'),
         notify_percent=node_data.get('notify_percent'),
         consumption_multiplier=float(node_data.get('consumption_multiplier', 1.0)),
-        cpu_count=node_data.get('cpu_count'),
-        cpu_model=node_data.get('cpu_model'),
-        total_ram=node_data.get('total_ram'),
         created_at=_parse_datetime(node_data.get('created_at')),
         updated_at=_parse_datetime(node_data.get('updated_at')),
         provider_uuid=node_data.get('provider_uuid'),
+        versions=node_data.get('versions'),
+        system=node_data.get('system'),
+        active_plugin_uuid=node_data.get('active_plugin_uuid'),
     )
 
 
@@ -208,11 +209,9 @@ async def get_system_statistics(
         users_by_status=stats.get('users_by_status', {}),
         server_info=ServerInfo(
             cpu_cores=server_data.get('cpu_cores', 0),
-            cpu_physical_cores=server_data.get('cpu_physical_cores', 0),
             memory_total=server_data.get('memory_total', 0),
             memory_used=server_data.get('memory_used', 0),
             memory_free=server_data.get('memory_free', 0),
-            memory_available=server_data.get('memory_available', 0),
             uptime_seconds=server_data.get('uptime_seconds', 0),
         ),
         bandwidth=Bandwidth(
@@ -397,15 +396,21 @@ async def perform_node_action(
     )
 
 
+class RestartAllNodesPayload(BaseModel):
+    force_restart: bool = False
+
+
 @router.post('/nodes/restart-all', response_model=NodeActionResponse)
 async def restart_all_nodes(
+    payload: RestartAllNodesPayload | None = None,
     admin: User = Depends(require_permission('remnawave:manage')),
 ) -> NodeActionResponse:
     """Restart all nodes."""
     service = _get_service()
     _ensure_configured(service)
 
-    success = await service.restart_all_nodes()
+    force = payload.force_restart if payload else False
+    success = await service.restart_all_nodes(force_restart=force)
 
     if success:
         logger.info('Admin restarted all nodes', telegram_id=admin.telegram_id)

app/cabinet/routes/admin_roles.py

@@ -4,12 +4,13 @@ from __future__ import annotations
 
 from datetime import datetime
 
+import sqlalchemy as sa
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.database.crud.rbac import AdminRoleCRUD, UserRoleCRUD
+from app.database.crud.rbac import SUPERADMIN_LEVEL, AdminRoleCRUD, UserRoleCRUD
 from app.database.models import User
 from app.services.permission_service import PERMISSION_REGISTRY, get_all_permissions
 
@@ -129,21 +130,26 @@ async def _role_to_response(db: AsyncSession, role) -> RoleResponse:
 
 
 async def _get_admin_level(db: AsyncSession, admin: User) -> int:
-    """Get the maximum role level of the current admin.
+    """Get the effective management level of the current admin.
 
-    Legacy config-based admins (ADMIN_IDS) get superadmin level (999+1=1000)
-    so they can manage all roles including level 999.
+    Superadmin-tier users (DB level 999 or legacy ADMIN_IDS) are promoted to
+    level 1000 so they can manage peer Superadmins.  Without this, the ``>=``
+    hierarchy guard would block 999-vs-999 operations.
     """
     from app.config import settings
 
     _perms, _names, max_level = await UserRoleCRUD.get_user_permissions(db, admin.id)
 
+    # DB-assigned Superadmins can manage peers
+    if max_level >= SUPERADMIN_LEVEL:
+        max_level = SUPERADMIN_LEVEL + 1
+
     # Legacy config-based admins always get the highest level
     if settings.is_admin(
         telegram_id=admin.telegram_id,
         email=admin.email if admin.email_verified else None,
     ):
-        max_level = max(max_level, 1000)
+        max_level = max(max_level, SUPERADMIN_LEVEL + 1)
 
     return max_level
 
@@ -177,6 +183,45 @@ async def get_permission_registry(
     ]
 
 
+@router.get('/users', response_model=list[AdminWithRolesResponse])
+async def list_rbac_users(
+    admin: User = Depends(require_permission('roles:read')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """List all users that have at least one active RBAC role."""
+    from sqlalchemy import select as _sa_select
+    from sqlalchemy.orm import selectinload as _sel
+
+    from app.database.models import UserRole as _UserRole
+
+    result = await db.execute(
+        _sa_select(_UserRole)
+        .options(_sel(_UserRole.user), _sel(_UserRole.role))
+        .where(_UserRole.is_active.is_(True))
+        .order_by(_UserRole.user_id)
+    )
+    assignments = result.scalars().all()
+
+    users_map: dict[int, AdminWithRolesResponse] = {}
+    for a in assignments:
+        if not a.user:
+            continue
+        if a.user_id not in users_map:
+            users_map[a.user_id] = AdminWithRolesResponse(
+                user_id=a.user_id,
+                telegram_id=a.user.telegram_id,
+                username=a.user.username,
+                first_name=a.user.first_name,
+                last_name=a.user.last_name,
+                email=a.user.email,
+                role_names=[],
+            )
+        if a.role:
+            users_map[a.user_id].role_names.append(a.role.name)
+
+    return list(users_map.values())
+
+
 @router.get('/roles/{role_id}/users', response_model=list[UserRoleResponse])
 async def list_role_users(
     role_id: int,
@@ -300,6 +345,15 @@ async def update_role(
 
     update_data = payload.model_dump(exclude_unset=True)
 
+    # System roles: only permissions can be extended, block is_active/level changes
+    if role.is_system:
+        blocked = {'is_active', 'level'} & update_data.keys()
+        if blocked:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=f'Cannot change {", ".join(sorted(blocked))} on a system role',
+            )
+
     # Validate level change
     if 'level' in update_data and update_data['level'] >= admin_level:
         raise HTTPException(
@@ -387,6 +441,14 @@ async def assign_role(
             detail='Role not found',
         )
 
+    # Superadmin role is managed exclusively via ADMIN_IDS/ADMIN_EMAILS env config
+    if role.level >= SUPERADMIN_LEVEL:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Superadmin role is managed via ADMIN_IDS/ADMIN_EMAILS environment variables. '
+            'Add the user there and restart the bot.',
+        )
+
     admin_level = await _get_admin_level(db, admin)
 
     # Cannot assign a role with level >= own level
@@ -444,13 +506,11 @@ async def revoke_role(
     admin: User = Depends(require_permission('roles:assign')),
     db: AsyncSession = Depends(get_cabinet_db),
 ):
-    """Revoke a role assignment. Cannot remove the last superadmin."""
-    from sqlalchemy import select as sa_select
-
+    """Revoke a role assignment. Superadmin roles are managed via env config."""
     from app.database.models import UserRole
 
-    # Load the assignment to check hierarchy
-    result = await db.execute(sa_select(UserRole).where(UserRole.id == assignment_id))
+    # Lock the assignment row (FOR UPDATE held until commit)
+    result = await db.execute(sa.select(UserRole).where(UserRole.id == assignment_id).with_for_update())
     user_role = result.scalar_one_or_none()
     if not user_role:
         raise HTTPException(
@@ -465,6 +525,14 @@ async def revoke_role(
             detail='Associated role not found',
         )
 
+    # Superadmin role is managed exclusively via env config
+    if role.level >= SUPERADMIN_LEVEL:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Superadmin role is managed via ADMIN_IDS/ADMIN_EMAILS environment variables. '
+            'Remove the user from env and restart the bot.',
+        )
+
     admin_level = await _get_admin_level(db, admin)
 
     # Cannot revoke a role at or above own level
@@ -474,23 +542,9 @@ async def revoke_role(
             detail='Cannot revoke a role at or above your own level',
         )
 
-    # Protect last superadmin (level 999)
-    superadmin_level = 999
-    if role.level == superadmin_level:
-        superadmin_count = await UserRoleCRUD.get_superadmin_count(db)
-        if superadmin_count <= 1:
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail='Cannot remove the last superadmin',
-            )
-
-    revoked = await UserRoleCRUD.revoke_role(db, assignment_id)
-    if not revoked:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail='Failed to revoke role',
-        )
-
+    # Revoke directly on the locked object (avoid CRUD re-fetch without FOR UPDATE)
+    user_role.is_active = False
+    await db.flush()
     await db.commit()
 
     logger.info(
@@ -500,4 +554,5 @@ async def revoke_role(
         target_user_id=user_role.user_id,
         role_name=role.name,
     )
+
     return {'message': 'Role revoked', 'assignment_id': assignment_id}

app/cabinet/routes/admin_stats.py

@@ -3,6 +3,7 @@
 import sys
 import time
 from datetime import UTC, datetime, timedelta
+from typing import Any
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, status
@@ -13,7 +14,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.database.crud.campaign import get_campaign_statistics, get_campaigns_count, get_campaigns_list
 from app.database.crud.server_squad import get_server_statistics
 from app.database.crud.subscription import get_subscriptions_statistics
-from app.database.crud.transaction import get_revenue_by_period, get_transactions_statistics
+from app.database.crud.transaction import REAL_PAYMENT_METHODS, get_revenue_by_period, get_transactions_statistics
 from app.database.models import (
     ReferralEarning,
     Subscription,
@@ -49,15 +50,11 @@ class NodeStatus(BaseModel):
     is_disabled: bool
     users_online: int
     traffic_used_bytes: int | None = None
-    uptime: str | None = None
-    xray_version: str | None = None
-    node_version: str | None = None
     last_status_message: str | None = None
-    xray_uptime: str | None = None
+    xray_uptime: int = 0
     is_xray_running: bool | None = None
-    cpu_count: int | None = None
-    cpu_model: str | None = None
-    total_ram: str | None = None
+    versions: dict[str, str] | None = None
+    system: dict[str, Any] | None = None
     country_code: str | None = None
 
 
@@ -262,6 +259,9 @@ async def get_dashboard_stats(
         month_start = now.replace(day=1, hour=0, minute=0, second=0, microsecond=0)
 
         trans_stats = await get_transactions_statistics(db, month_start, now)
+        all_time_stats = await get_transactions_statistics(
+            db, start_date=datetime(2020, 1, 1, tzinfo=UTC), end_date=now
+        )
 
         # Get revenue chart data (last 30 days)
         revenue_data = await get_revenue_by_period(db, days=30)
@@ -272,6 +272,14 @@ async def get_dashboard_stats(
         # Get tariff statistics
         tariff_stats = await _get_tariff_stats(db)
 
+        # Derive income_today from revenue_chart to ensure consistency with chart
+        today_str = now.date().isoformat()
+        income_today_from_chart = sum(
+            item.get('amount_kopeks', 0) for item in revenue_data if str(item.get('date', '')) == today_str
+        )
+        # Use chart-derived value if available, otherwise fall back to trans_stats
+        income_today_kopeks = income_today_from_chart or trans_stats.get('today', {}).get('income_kopeks', 0)
+
         # Build response
         return DashboardStats(
             nodes=nodes_data,
@@ -287,14 +295,15 @@ async def get_dashboard_stats(
                 trial_to_paid_conversion=sub_stats.get('trial_to_paid_conversion', 0.0),
             ),
             financial=FinancialStats(
-                income_today_kopeks=trans_stats.get('today', {}).get('income_kopeks', 0),
-                income_today_rubles=trans_stats.get('today', {}).get('income_kopeks', 0) / 100,
+                income_today_kopeks=income_today_kopeks,
+                income_today_rubles=income_today_kopeks / 100,
                 income_month_kopeks=trans_stats.get('totals', {}).get('income_kopeks', 0),
                 income_month_rubles=trans_stats.get('totals', {}).get('income_kopeks', 0) / 100,
-                income_total_kopeks=trans_stats.get('totals', {}).get('income_kopeks', 0),
-                income_total_rubles=trans_stats.get('totals', {}).get('income_kopeks', 0) / 100,
-                subscription_income_kopeks=trans_stats.get('totals', {}).get('subscription_income_kopeks', 0),
-                subscription_income_rubles=trans_stats.get('totals', {}).get('subscription_income_kopeks', 0) / 100,
+                income_total_kopeks=all_time_stats.get('totals', {}).get('income_kopeks', 0),
+                income_total_rubles=all_time_stats.get('totals', {}).get('income_kopeks', 0) / 100,
+                subscription_income_kopeks=abs(all_time_stats.get('totals', {}).get('subscription_income_kopeks', 0)),
+                subscription_income_rubles=abs(all_time_stats.get('totals', {}).get('subscription_income_kopeks', 0))
+                / 100,
             ),
             servers=ServerStats(
                 total_servers=server_stats.get('total_servers', 0),
@@ -457,15 +466,11 @@ async def _get_nodes_overview() -> NodesOverview:
                 is_disabled=n.get('is_disabled', False),
                 users_online=n.get('users_online', 0) or 0,
                 traffic_used_bytes=n.get('traffic_used_bytes'),
-                uptime=n.get('uptime'),
-                xray_version=n.get('xray_version'),
-                node_version=n.get('node_version'),
                 last_status_message=n.get('last_status_message'),
-                xray_uptime=n.get('xray_uptime'),
+                xray_uptime=n.get('xray_uptime', 0) or 0,
                 is_xray_running=n.get('is_xray_running'),
-                cpu_count=n.get('cpu_count'),
-                cpu_model=n.get('cpu_model'),
-                total_ram=n.get('total_ram'),
+                versions=n.get('versions'),
+                system=n.get('system'),
                 country_code=n.get('country_code'),
             )
             for n in nodes
@@ -686,53 +691,6 @@ async def get_top_referrers(
             if row.referrer_id in referrers_data:
                 referrers_data[row.referrer_id]['earnings_month'] = row.total or 0
 
-        # Also add REFERRAL_REWARD transactions
-        trans_total_query = await db.execute(
-            select(Transaction.user_id.label('referrer_id'), func.sum(Transaction.amount_kopeks).label('total'))
-            .where(Transaction.type == TransactionType.REFERRAL_REWARD.value)
-            .group_by(Transaction.user_id)
-        )
-        for row in trans_total_query:
-            if row.referrer_id in referrers_data:
-                referrers_data[row.referrer_id]['earnings_total'] = referrers_data[row.referrer_id].get(
-                    'earnings_total', 0
-                ) + (row.total or 0)
-
-        trans_today_query = await db.execute(
-            select(Transaction.user_id.label('referrer_id'), func.sum(Transaction.amount_kopeks).label('total'))
-            .where(
-                and_(Transaction.type == TransactionType.REFERRAL_REWARD.value, Transaction.created_at >= today_start)
-            )
-            .group_by(Transaction.user_id)
-        )
-        for row in trans_today_query:
-            if row.referrer_id in referrers_data:
-                referrers_data[row.referrer_id]['earnings_today'] = referrers_data[row.referrer_id].get(
-                    'earnings_today', 0
-                ) + (row.total or 0)
-
-        trans_week_query = await db.execute(
-            select(Transaction.user_id.label('referrer_id'), func.sum(Transaction.amount_kopeks).label('total'))
-            .where(and_(Transaction.type == TransactionType.REFERRAL_REWARD.value, Transaction.created_at >= week_ago))
-            .group_by(Transaction.user_id)
-        )
-        for row in trans_week_query:
-            if row.referrer_id in referrers_data:
-                referrers_data[row.referrer_id]['earnings_week'] = referrers_data[row.referrer_id].get(
-                    'earnings_week', 0
-                ) + (row.total or 0)
-
-        trans_month_query = await db.execute(
-            select(Transaction.user_id.label('referrer_id'), func.sum(Transaction.amount_kopeks).label('total'))
-            .where(and_(Transaction.type == TransactionType.REFERRAL_REWARD.value, Transaction.created_at >= month_ago))
-            .group_by(Transaction.user_id)
-        )
-        for row in trans_month_query:
-            if row.referrer_id in referrers_data:
-                referrers_data[row.referrer_id]['earnings_month'] = referrers_data[row.referrer_id].get(
-                    'earnings_month', 0
-                ) + (row.total or 0)
-
         # Get user info for all referrers
         referrer_ids = list(referrers_data.keys())
         if referrer_ids:
@@ -944,8 +902,8 @@ async def get_recent_payments(
                     email=user.email,
                     username=user.username,
                     display_name=display_name,
-                    amount_kopeks=trans.amount_kopeks,
-                    amount_rubles=trans.amount_kopeks / 100,
+                    amount_kopeks=abs(trans.amount_kopeks),
+                    amount_rubles=abs(trans.amount_kopeks) / 100,
                     type=trans.type,
                     type_display=type_display.get(trans.type, trans.type),
                     payment_method=trans.payment_method,
@@ -969,22 +927,24 @@ async def get_recent_payments(
         total_count = total_count_result.scalar() or 0
 
         today_total_result = await db.execute(
-            select(func.coalesce(func.sum(Transaction.amount_kopeks), 0)).where(
+            select(func.coalesce(func.sum(func.abs(Transaction.amount_kopeks)), 0)).where(
                 and_(
-                    Transaction.type == TransactionType.DEPOSIT.value,
+                    Transaction.type.in_([TransactionType.DEPOSIT.value, TransactionType.SUBSCRIPTION_PAYMENT.value]),
                     Transaction.is_completed == True,
                     Transaction.created_at >= today_start,
+                    Transaction.payment_method.in_(REAL_PAYMENT_METHODS),
                 )
             )
         )
         total_today = today_total_result.scalar() or 0
 
         week_total_result = await db.execute(
-            select(func.coalesce(func.sum(Transaction.amount_kopeks), 0)).where(
+            select(func.coalesce(func.sum(func.abs(Transaction.amount_kopeks)), 0)).where(
                 and_(
-                    Transaction.type == TransactionType.DEPOSIT.value,
+                    Transaction.type.in_([TransactionType.DEPOSIT.value, TransactionType.SUBSCRIPTION_PAYMENT.value]),
                     Transaction.is_completed == True,
                     Transaction.created_at >= week_ago,
+                    Transaction.payment_method.in_(REAL_PAYMENT_METHODS),
                 )
             )
         )

app/cabinet/routes/admin_tariffs.py

@@ -1,10 +1,14 @@
 """Admin routes for managing tariffs in cabinet."""
 
+import asyncio
+
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, status
-from sqlalchemy import func, select
+from sqlalchemy import and_, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import joinedload
 
+from app.config import settings
 from app.database.crud.server_squad import get_all_server_squads
 from app.database.crud.tariff import (
     create_tariff,
@@ -17,14 +21,16 @@ from app.database.crud.tariff import (
     set_tariff_promo_groups,
     update_tariff,
 )
-from app.database.models import PromoGroup, Subscription, Tariff, Transaction, TransactionType, User
+from app.database.models import PromoGroup, Subscription, SubscriptionStatus, Tariff, Transaction, TransactionType, User
 
 from ..dependencies import get_cabinet_db, require_permission
 from ..schemas.tariffs import (
+    ExternalSquadInfoResponse,
     PeriodPrice,
     PromoGroupInfo,
     ServerInfo,
     ServerTrafficLimit,
+    SyncSquadsResponse,
     TariffCreateRequest,
     TariffDetailResponse,
     TariffListItem,
@@ -126,6 +132,7 @@ async def list_tariffs(
                 is_daily=tariff.is_daily,
                 daily_price_kopeks=tariff.daily_price_kopeks,
                 allow_traffic_topup=tariff.allow_traffic_topup,
+                show_in_gift=tariff.show_in_gift,
                 traffic_limit_gb=tariff.traffic_limit_gb,
                 device_limit=tariff.device_limit,
                 tier_level=tariff.tier_level,
@@ -158,6 +165,30 @@ async def get_available_servers(
     ]
 
 
+@router.get('/available-external-squads', response_model=list[ExternalSquadInfoResponse])
+async def get_available_external_squads(
+    admin: User = Depends(require_permission('tariffs:read')),
+):
+    """Fetch external squads from RemnaWave panel."""
+    from app.services.remnawave_service import RemnaWaveService
+
+    try:
+        service = RemnaWaveService()
+        async with service.get_api_client() as api:
+            squads = await api.get_external_squads()
+            return [
+                {
+                    'uuid': s.uuid,
+                    'name': s.name,
+                    'members_count': s.members_count,
+                }
+                for s in squads
+            ]
+    except Exception:
+        logger.warning('Failed to fetch external squads from RemnaWave', exc_info=True)
+        return []
+
+
 @router.put('/order')
 async def update_tariff_order(
     request: TariffSortOrderRequest,
@@ -238,6 +269,10 @@ async def get_tariff(
         daily_price_kopeks=tariff.daily_price_kopeks,
         # Режим сброса трафика
         traffic_reset_mode=tariff.traffic_reset_mode,
+        # Внешний сквад
+        external_squad_uuid=tariff.external_squad_uuid,
+        # Показывать в подарках
+        show_in_gift=tariff.show_in_gift,
         created_at=tariff.created_at,
         updated_at=tariff.updated_at,
     )
@@ -276,7 +311,7 @@ async def create_new_tariff(
         period_prices=period_prices_dict,
         allowed_squads=request.allowed_squads,
         server_traffic_limits=server_limits_dict,
-        promo_group_ids=request.promo_group_ids if request.promo_group_ids else None,
+        promo_group_ids=request.promo_group_ids or None,
         # Произвольное количество дней
         custom_days_enabled=request.custom_days_enabled,
         price_per_day_kopeks=request.price_per_day_kopeks,
@@ -292,6 +327,10 @@ async def create_new_tariff(
         daily_price_kopeks=request.daily_price_kopeks,
         # Режим сброса трафика
         traffic_reset_mode=request.traffic_reset_mode,
+        # Внешний сквад
+        external_squad_uuid=request.external_squad_uuid,
+        # Показывать в подарках
+        show_in_gift=request.show_in_gift,
     )
 
     logger.info('Admin created tariff', admin_id=admin.id, tariff_id=tariff.id, tariff_name=tariff.name)
@@ -318,6 +357,10 @@ async def update_existing_tariff(
             detail='Tariff not found',
         )
 
+    # Capture old values for change detection
+    old_squads = list(tariff.allowed_squads) if tariff.allowed_squads else []
+    old_external_squad = tariff.external_squad_uuid
+
     # Build updates dict
     updates = {}
     if request.name is not None:
@@ -381,6 +424,12 @@ async def update_existing_tariff(
     # Режим сброса трафика (None допускается как значение для сброса к глобальной настройке)
     if 'traffic_reset_mode' in request.model_fields_set:
         updates['traffic_reset_mode'] = request.traffic_reset_mode
+    # Внешний сквад (None допускается для сброса)
+    if 'external_squad_uuid' in request.model_fields_set:
+        updates['external_squad_uuid'] = request.external_squad_uuid
+    # Показывать в подарках
+    if request.show_in_gift is not None:
+        updates['show_in_gift'] = request.show_in_gift
 
     if updates:
         await update_tariff(db, tariff, **updates)
@@ -394,6 +443,18 @@ async def update_existing_tariff(
     # Перезагружаем периоды из БД для синхронизации с ботом
     await load_period_prices_from_db(db)
 
+    # Auto-sync squads to active subscriptions in Remnawave when squads changed
+    new_squads = tariff.allowed_squads or []
+    squads_changed = request.allowed_squads is not None and sorted(old_squads) != sorted(new_squads)
+    ext_squad_changed = (
+        'external_squad_uuid' in request.model_fields_set and tariff.external_squad_uuid != old_external_squad
+    )
+    if squads_changed or ext_squad_changed:
+        asyncio.create_task(
+            _background_sync_squads(tariff_id, admin.id),
+            name=f'sync-squads-tariff-{tariff_id}',
+        )
+
     return await get_tariff(tariff_id, admin, db)
 
 
@@ -554,3 +615,225 @@ async def get_tariff_stats(
         revenue_kopeks=revenue_kopeks,
         revenue_rubles=revenue_kopeks / 100,
     )
+
+
+async def _background_sync_squads(tariff_id: int, admin_id: int) -> None:
+    """Run squad sync in background with its own DB session (fire-and-forget)."""
+    from app.database.database import AsyncSessionLocal
+    from app.services.remnawave_service import RemnaWaveService
+
+    try:
+        async with AsyncSessionLocal() as db:
+            tariff = await get_tariff_by_id(db, tariff_id)
+            if not tariff:
+                return
+
+            result = await db.execute(
+                select(Subscription)
+                .join(User, Subscription.user_id == User.id)
+                .options(joinedload(Subscription.user))
+                .where(
+                    and_(
+                        Subscription.tariff_id == tariff_id,
+                        Subscription.status.in_([SubscriptionStatus.ACTIVE.value, SubscriptionStatus.TRIAL.value]),
+                        User.remnawave_uuid.isnot(None),
+                    )
+                )
+            )
+            subscriptions = list(result.unique().scalars().all())
+
+            if not subscriptions:
+                return
+
+            new_squads = tariff.allowed_squads or []
+            ext_squad_uuid = tariff.external_squad_uuid
+
+            service = RemnaWaveService()
+            updated = 0
+            failed = 0
+
+            async with service.get_api_client() as api:
+                semaphore = asyncio.Semaphore(5)
+
+                async def _sync_one(sub: Subscription) -> None:
+                    nonlocal updated, failed
+                    remnawave_uuid = (
+                        getattr(sub, 'remnawave_uuid', None)
+                        if settings.is_multi_tariff_enabled()
+                        else (sub.user.remnawave_uuid if sub.user else None)
+                    )
+                    if not remnawave_uuid:
+                        return
+                    async with semaphore:
+                        try:
+                            await api.update_user(
+                                uuid=remnawave_uuid,
+                                active_internal_squads=new_squads,
+                                external_squad_uuid=ext_squad_uuid,
+                            )
+                            sub.connected_squads = new_squads
+                            updated += 1
+                        except Exception as e:
+                            failed += 1
+                            logger.warning(
+                                'Background sync: failed to sync squads for user',
+                                user_id=sub.user_id,
+                                error=str(e),
+                            )
+
+                await asyncio.gather(*[_sync_one(sub) for sub in subscriptions])
+
+            await db.commit()
+            logger.info(
+                'Background squad sync completed after tariff update',
+                admin_id=admin_id,
+                tariff_id=tariff_id,
+                tariff_name=tariff.name,
+                total=len(subscriptions),
+                updated=updated,
+                failed=failed,
+            )
+    except Exception:
+        logger.exception('Background squad sync failed', tariff_id=tariff_id)
+
+
+_SYNC_SQUADS_CONCURRENCY = 5
+_SYNC_SQUADS_MAX_CONSECUTIVE_FAILURES = 10
+
+
+@router.post('/{tariff_id}/sync-squads', response_model=SyncSquadsResponse)
+async def sync_tariff_squads(
+    tariff_id: int,
+    admin: User = Depends(require_permission('tariffs:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Sync squads from tariff to all active/trial subscriptions in Remnawave panel.
+
+    Updates connected_squads and external_squad_uuid for every active or trial
+    subscription linked to this tariff.  Only users that have a remnawave_uuid
+    (i.e. already exist in the panel) are touched.
+    """
+    tariff = await get_tariff_by_id(db, tariff_id)
+    if not tariff:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Tariff not found',
+        )
+
+    # Fetch active + trial subscriptions for this tariff whose users exist in Remnawave
+    result = await db.execute(
+        select(Subscription)
+        .join(User, Subscription.user_id == User.id)
+        .options(joinedload(Subscription.user))
+        .where(
+            and_(
+                Subscription.tariff_id == tariff_id,
+                Subscription.status.in_([SubscriptionStatus.ACTIVE.value, SubscriptionStatus.TRIAL.value]),
+                User.remnawave_uuid.isnot(None),
+            )
+        )
+    )
+    subscriptions = list(result.unique().scalars().all())
+
+    if not subscriptions:
+        return SyncSquadsResponse(
+            tariff_id=tariff_id,
+            tariff_name=tariff.name,
+            total_subscriptions=0,
+            updated_count=0,
+            failed_count=0,
+            skipped_count=0,
+        )
+
+    new_squads = tariff.allowed_squads or []
+    # None means "clear external squad" — intentional when tariff has none
+    ext_squad_uuid = tariff.external_squad_uuid
+
+    # Sync to Remnawave panel with concurrency limit and circuit breaker
+    from app.services.remnawave_service import RemnaWaveService
+
+    service = RemnaWaveService()
+    updated_count = 0
+    failed_count = 0
+    skipped_count = 0
+    consecutive_failures = 0
+    errors: list[str] = []
+    aborted = False
+
+    async with service.get_api_client() as api:
+        semaphore = asyncio.Semaphore(_SYNC_SQUADS_CONCURRENCY)
+
+        async def _sync_one(sub: Subscription) -> str:
+            # Counter mutations are safe: no `await` between read-modify-write
+            # and the check within each branch (single-threaded asyncio event loop).
+            nonlocal updated_count, failed_count, skipped_count, consecutive_failures, aborted
+
+            if aborted:
+                skipped_count += 1
+                return 'skipped'
+
+            remnawave_uuid = (
+                getattr(sub, 'remnawave_uuid', None)
+                if settings.is_multi_tariff_enabled()
+                else (sub.user.remnawave_uuid if sub.user else None)
+            )
+            if not remnawave_uuid:
+                skipped_count += 1
+                return 'skipped'
+
+            async with semaphore:
+                if aborted:
+                    skipped_count += 1
+                    return 'skipped'
+
+                try:
+                    await api.update_user(
+                        uuid=remnawave_uuid,
+                        active_internal_squads=new_squads,
+                        external_squad_uuid=ext_squad_uuid,
+                    )
+                    # Update local DB only on successful API call
+                    sub.connected_squads = new_squads
+                    updated_count += 1
+                    consecutive_failures = 0
+                    return 'ok'
+                except Exception as e:
+                    failed_count += 1
+                    consecutive_failures += 1
+                    errors.append(f'user_id={sub.user_id}: sync failed')
+                    logger.warning(
+                        'Failed to sync squads for user in Remnawave',
+                        user_id=sub.user_id,
+                        remnawave_uuid=remnawave_uuid,
+                        error=str(e),
+                    )
+                    if consecutive_failures >= _SYNC_SQUADS_MAX_CONSECUTIVE_FAILURES:
+                        aborted = True
+                        errors.append(f'Aborted after {_SYNC_SQUADS_MAX_CONSECUTIVE_FAILURES} consecutive failures')
+                    return 'error'
+
+        await asyncio.gather(*[_sync_one(sub) for sub in subscriptions])
+
+    # Commit local DB changes only for successfully synced subscriptions
+    await db.commit()
+
+    logger.info(
+        'Admin synced squads for tariff',
+        admin_id=admin.id,
+        tariff_id=tariff_id,
+        tariff_name=tariff.name,
+        total=len(subscriptions),
+        updated=updated_count,
+        failed=failed_count,
+        skipped=skipped_count,
+    )
+
+    return SyncSquadsResponse(
+        tariff_id=tariff_id,
+        tariff_name=tariff.name,
+        total_subscriptions=len(subscriptions),
+        updated_count=updated_count,
+        failed_count=failed_count,
+        skipped_count=skipped_count,
+        errors=errors[:20],
+    )

app/cabinet/routes/admin_tickets.py

@@ -5,7 +5,7 @@ from datetime import UTC, datetime
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Query, status
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, model_validator
 from sqlalchemy import desc, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
@@ -90,6 +90,19 @@ class AdminReplyRequest(BaseModel):
     """Admin reply to ticket."""
 
     message: str = Field(..., min_length=1, max_length=4000, description='Reply message')
+    media_type: str | None = Field(None, description='Media type: photo, video, or document')
+    media_file_id: str | None = Field(None, max_length=255, description='Telegram file_id from media upload')
+    media_caption: str | None = Field(None, max_length=1000, description='Caption for media')
+
+    @model_validator(mode='after')
+    def validate_media_fields(self) -> 'AdminReplyRequest':
+        if self.media_file_id and not self.media_type:
+            raise ValueError('media_type is required when media_file_id is provided')
+        if self.media_type and not self.media_file_id:
+            raise ValueError('media_file_id is required when media_type is provided')
+        if self.media_type and self.media_type not in {'photo', 'video', 'document'}:
+            raise ValueError('media_type must be one of: photo, video, document')
+        return self
 
 
 class AdminStatusUpdateRequest(BaseModel):
@@ -246,6 +259,7 @@ async def update_ticket_settings(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Update ticket system settings."""
+    import asyncio
     from pathlib import Path
 
     from app.services.support_settings_service import SupportSettingsService
@@ -280,8 +294,8 @@ async def update_ticket_settings(
     # Try to persist to .env file
     try:
         env_file = Path('.env')
-        if env_file.exists():
-            lines = env_file.read_text().splitlines()
+        if await asyncio.to_thread(env_file.exists):
+            lines = (await asyncio.to_thread(env_file.read_text)).splitlines()
             updates = {}
 
             if request.sla_enabled is not None:
@@ -314,7 +328,7 @@ async def update_ticket_settings(
                 if key not in updated_keys:
                     new_lines.append(f'{key}={value}')
 
-            env_file.write_text('\n'.join(new_lines) + '\n')
+            await asyncio.to_thread(env_file.write_text, '\n'.join(new_lines) + '\n')
             logger.info('Updated ticket settings in .env file')
     except Exception as e:
         logger.warning('Failed to update .env file', error=e)
@@ -442,11 +456,16 @@ async def reply_to_ticket(
         )
 
     # Create admin message
+    has_media = bool(request.media_file_id)
     message = TicketMessage(
         ticket_id=ticket.id,
         user_id=ticket.user_id,
         message_text=request.message,
         is_from_admin=True,
+        has_media=has_media,
+        media_type=request.media_type if has_media else None,
+        media_file_id=request.media_file_id if has_media else None,
+        media_caption=request.media_caption if has_media else None,
         created_at=datetime.now(UTC),
     )
     db.add(message)
@@ -460,14 +479,9 @@ async def reply_to_ticket(
 
     # Try to notify user via Telegram
     try:
-        from aiogram import Bot
-        from aiogram.client.default import DefaultBotProperties
-        from aiogram.enums import ParseMode
+        from app.bot_factory import create_bot
 
-        bot = Bot(
-            token=settings.BOT_TOKEN,
-            default=DefaultBotProperties(parse_mode=ParseMode.HTML),
-        )
+        bot = create_bot()
         try:
             from app.handlers.admin.tickets import notify_user_about_ticket_reply
 

app/cabinet/routes/admin_traffic.py

@@ -7,16 +7,13 @@ import time
 from datetime import UTC, datetime, timedelta
 
 import structlog
-from aiogram import Bot
-from aiogram.client.default import DefaultBotProperties
-from aiogram.enums import ParseMode
 from aiogram.types import BufferedInputFile
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import and_, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
-from app.config import settings
+from app.bot_factory import create_bot
 from app.database.models import Subscription, Transaction, TransactionType, User
 from app.services.remnawave_service import RemnaWaveService
 
@@ -24,6 +21,8 @@ from ..dependencies import get_cabinet_db, require_permission
 from ..schemas.traffic import (
     ExportCsvRequest,
     ExportCsvResponse,
+    SubscriptionEnrichmentInfo,
+    SubscriptionTrafficInfo,
     TrafficEnrichmentResponse,
     TrafficNodeInfo,
     TrafficUsageResponse,
@@ -159,15 +158,42 @@ def _compute_date_range(period_days: int) -> tuple[str, str]:
 
 
 async def _load_user_map(db: AsyncSession) -> dict[str, User]:
-    """Load all users with remnawave_uuid, eagerly loading subscription + tariff."""
-    stmt = (
+    """Load all users with remnawave_uuid, eagerly loading subscription + tariff.
+
+    In multi-tariff mode UUIDs live on Subscription rows, not on User.
+    Both sources are merged so the caller gets a complete uuid → User map.
+    """
+    from app.config import settings
+
+    # Build user map from both user-level and subscription-level UUIDs
+    user_map: dict[str, User] = {}
+
+    # Legacy: user-level UUIDs
+    stmt_users = (
         select(User)
         .where(User.remnawave_uuid.isnot(None))
-        .options(selectinload(User.subscription).selectinload(Subscription.tariff))
+        .options(selectinload(User.subscriptions).selectinload(Subscription.tariff))
     )
-    result = await db.execute(stmt)
-    users = result.scalars().all()
-    return {u.remnawave_uuid: u for u in users if u.remnawave_uuid}
+    result_users = await db.execute(stmt_users)
+    users = result_users.scalars().all()
+    for u in users:
+        if u.remnawave_uuid:
+            user_map[u.remnawave_uuid] = u
+
+    # Multi-tariff: subscription-level UUIDs
+    if settings.is_multi_tariff_enabled():
+        stmt_subs = (
+            select(Subscription)
+            .where(Subscription.remnawave_uuid.isnot(None))
+            .options(selectinload(Subscription.user).selectinload(User.subscriptions).selectinload(Subscription.tariff))
+        )
+        result_subs = await db.execute(stmt_subs)
+        subs = result_subs.scalars().all()
+        for sub in subs:
+            if sub.remnawave_uuid and sub.user and sub.remnawave_uuid not in user_map:
+                user_map[sub.remnawave_uuid] = sub.user
+
+    return user_map
 
 
 def _build_traffic_items(
@@ -205,19 +231,23 @@ def _build_traffic_items(
             ):
                 continue
 
-        sub = user.subscription
+        subs = getattr(user, 'subscriptions', None) or []
+
+        # Primary subscription for backward-compat top-level fields
+        primary_sub = next((s for s in subs if s.is_active), subs[0] if subs else None)
         tariff_name = None
         subscription_status = None
         traffic_limit_gb = 0.0
         device_limit = 1
 
-        if sub:
-            subscription_status = _get_status(sub)
-            traffic_limit_gb = float(sub.traffic_limit_gb or 0)
-            device_limit = sub.device_limit or 1
-            if sub.tariff:
-                tariff_name = sub.tariff.name
+        if primary_sub:
+            subscription_status = _get_status(primary_sub)
+            traffic_limit_gb = float(primary_sub.traffic_limit_gb or 0)
+            device_limit = primary_sub.device_limit or 1
+            if primary_sub.tariff:
+                tariff_name = primary_sub.tariff.name
 
+        # Filtering uses primary sub values (keeps existing filter semantics)
         if tariff_filter is not None:
             if (tariff_name or '') not in tariff_filter:
                 continue
@@ -232,6 +262,18 @@ def _build_traffic_items(
 
         total_bytes = sum(traffic.values())
 
+        # Build per-subscription detail list for multi-subscription display
+        subscriptions_traffic = [
+            SubscriptionTrafficInfo(
+                subscription_id=sub.id,
+                tariff_name=sub.tariff.name if sub.tariff else None,
+                status=_get_status(sub),
+                traffic_limit_gb=float(sub.traffic_limit_gb or 0),
+                device_limit=sub.device_limit or 1,
+            )
+            for sub in subs
+        ]
+
         items.append(
             UserTrafficItem(
                 user_id=user.id,
@@ -245,6 +287,7 @@ def _build_traffic_items(
                 device_limit=device_limit,
                 node_traffic=traffic,
                 total_bytes=total_bytes,
+                subscriptions=subscriptions_traffic,
             )
         )
 
@@ -308,15 +351,21 @@ async def get_traffic_usage(
     # Collect all available tariff names (before filtering)
     available_tariffs = sorted(
         {
-            u.subscription.tariff.name
+            sub.tariff.name
             for u in user_map.values()
-            if u.subscription and u.subscription.tariff and u.subscription.tariff.name
+            for sub in (getattr(u, 'subscriptions', None) or [])
+            if sub.tariff and sub.tariff.name
         }
     )
 
     # Collect all available statuses (before filtering)
     available_statuses = sorted(
-        {_get_status(sub) for u in user_map.values() if (sub := u.subscription) and _get_status(sub)}
+        {
+            _get_status(sub)
+            for u in user_map.values()
+            for sub in (getattr(u, 'subscriptions', None) or [])
+            if _get_status(sub)
+        }
     )
 
     # Parse tariff filter
@@ -469,27 +518,42 @@ async def _build_enrichment(db: AsyncSession, user_map: dict[str, User]) -> dict
     enrichment: dict[int, UserTrafficEnrichment] = {}
     for uuid, user in user_map.items():
         uid = user.id
-        sub = user.subscription
+        subs_list = getattr(user, 'subscriptions', None) or []
+
+        # Primary subscription for backward-compat top-level date fields
+        primary_sub = next((s for s in subs_list if s.is_active), subs_list[0] if subs_list else None)
 
         start_date = None
         end_date = None
-        if sub:
-            if sub.start_date:
-                start_date = sub.start_date.isoformat()
-            if sub.end_date:
-                end_date = sub.end_date.isoformat()
+        if primary_sub:
+            if primary_sub.start_date:
+                start_date = primary_sub.start_date.isoformat()
+            if primary_sub.end_date:
+                end_date = primary_sub.end_date.isoformat()
 
         last_node_name = None
         last_uuid = last_node_uuid_by_user.get(uid)
         if last_uuid:
             last_node_name = node_uuid_to_name.get(last_uuid)
 
+        # Build per-subscription enrichment list for multi-subscription display
+        subscriptions_enrichment = [
+            SubscriptionEnrichmentInfo(
+                subscription_id=sub.id,
+                tariff_name=sub.tariff.name if sub.tariff else None,
+                start_date=sub.start_date.isoformat() if sub.start_date else None,
+                end_date=sub.end_date.isoformat() if sub.end_date else None,
+            )
+            for sub in subs_list
+        ]
+
         enrichment[uid] = UserTrafficEnrichment(
             devices_connected=devices_by_user.get(uid, 0),
             total_spent_kopeks=spending_map.get(uid, 0),
             subscription_start_date=start_date,
             subscription_end_date=end_date,
             last_node_name=last_node_name,
+            subscriptions=subscriptions_enrichment,
         )
 
     return enrichment
@@ -680,10 +744,7 @@ async def export_traffic_csv(
     filename = f'traffic_usage_{period_label}_{timestamp}.csv'
 
     try:
-        bot = Bot(
-            token=settings.BOT_TOKEN,
-            default=DefaultBotProperties(parse_mode=ParseMode.HTML),
-        )
+        bot = create_bot()
         async with bot:
             await bot.send_document(
                 chat_id=admin.telegram_id,

app/cabinet/routes/admin_withdrawals.py

@@ -199,8 +199,7 @@ async def approve_withdrawal(
 
     # Notify user about approval
     try:
-        from aiogram import Bot
-
+        from app.bot_factory import create_bot
         from app.config import settings
         from app.services.notification_delivery_service import notification_delivery_service
 
@@ -211,7 +210,7 @@ async def approve_withdrawal(
                 formatted_amount = settings.format_price(withdrawal.amount_kopeks)
                 comment_text = f'\n{request.comment}' if request.comment else ''
                 tg_message = f'✅ Ваш запрос на вывод {formatted_amount} одобрен.{comment_text}'
-                bot = Bot(token=settings.BOT_TOKEN)
+                bot = create_bot()
                 try:
                     await notification_delivery_service.notify_withdrawal_approved(
                         user=user,
@@ -251,8 +250,7 @@ async def reject_withdrawal(
 
     # Notify user about rejection
     try:
-        from aiogram import Bot
-
+        from app.bot_factory import create_bot
         from app.config import settings
         from app.services.notification_delivery_service import notification_delivery_service
 
@@ -263,7 +261,7 @@ async def reject_withdrawal(
                 formatted_amount = settings.format_price(withdrawal.amount_kopeks)
                 comment_text = f'\nПричина: {request.comment}' if request.comment else ''
                 tg_message = f'❌ Ваш запрос на вывод {formatted_amount} отклонён.{comment_text}'
-                bot = Bot(token=settings.BOT_TOKEN)
+                bot = create_bot()
                 try:
                     await notification_delivery_service.notify_withdrawal_rejected(
                         user=user,

app/cabinet/routes/balance.py

@@ -4,13 +4,17 @@ import math
 import time
 from decimal import ROUND_HALF_UP, Decimal, InvalidOperation
 
-import httpx
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import desc, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.bot_factory import create_bot
 from app.config import settings
+from app.database.crud.saved_payment_method import (
+    deactivate_payment_method,
+    get_active_payment_methods_by_user,
+)
 from app.database.crud.user import get_user_by_id
 from app.database.models import PaymentMethod, Transaction, User
 from app.services.payment_method_config_service import get_enabled_methods_for_user
@@ -32,6 +36,8 @@ from ..schemas.balance import (
     PaymentMethodResponse,
     PendingPaymentListResponse,
     PendingPaymentResponse,
+    SavedCardResponse,
+    SavedCardsListResponse,
     StarsInvoiceRequest,
     StarsInvoiceResponse,
     TopUpRequest,
@@ -99,8 +105,8 @@ async def get_transactions(
     for t in transactions:
         # Determine sign based on transaction type
         # Credits (positive): DEPOSIT, REFERRAL_REWARD, REFUND, POLL_REWARD
-        # Debits (negative): SUBSCRIPTION_PAYMENT, WITHDRAWAL
-        is_debit = t.type in ['subscription_payment', 'withdrawal']
+        # Debits (negative): SUBSCRIPTION_PAYMENT, WITHDRAWAL, GIFT_PAYMENT
+        is_debit = t.type in ['subscription_payment', 'withdrawal', 'gift_payment']
         amount_kopeks = -abs(t.amount_kopeks) if is_debit else abs(t.amount_kopeks)
 
         items.append(
@@ -195,7 +201,7 @@ async def get_payment_methods(
                         'description': description,
                     }
                 )
-            options = formatted_options if formatted_options else None
+            options = formatted_options or None
 
         methods.append(
             PaymentMethodResponse(
@@ -241,13 +247,16 @@ async def create_stars_invoice(
             detail='Maximum amount is 10,000.00 RUB',
         )
 
-    # Calculate Stars amount
+    # Calculate Stars amount and normalize kopeks to match exact star value
     try:
         amount_rubles = request.amount_kopeks / 100
         stars_amount = settings.rubles_to_stars(amount_rubles)
 
         if stars_amount <= 0:
             stars_amount = 1
+
+        # Normalize kopeks so credited amount = stars * rate (no rounding mismatch)
+        normalized_kopeks = round(stars_amount * settings.get_stars_rate() * 100)
     except Exception as e:
         logger.error('Error calculating Stars amount', error=e)
         raise HTTPException(
@@ -256,54 +265,41 @@ async def create_stars_invoice(
         )
 
     # Create payload for tracking payment
-    payload = f'balance_topup_{user.id}_{request.amount_kopeks}_{int(time.time())}'
+    payload = f'balance_topup_{user.id}_{normalized_kopeks}_{int(time.time())}'
 
     # Create invoice through Telegram Bot API
     try:
-        bot_token = settings.BOT_TOKEN
-        api_url = f'https://api.telegram.org/bot{bot_token}/createInvoiceLink'
+        from aiogram.exceptions import TelegramAPIError
+        from aiogram.types import LabeledPrice
 
-        async with httpx.AsyncClient() as client:
-            response = await client.post(
-                api_url,
-                json={
-                    'title': 'Пополнение баланса VPN',
-                    'description': f'Пополнение баланса на {amount_rubles:.2f} ₽ ({stars_amount} ⭐)',
-                    'payload': payload,
-                    'provider_token': '',  # Empty for Stars
-                    'currency': 'XTR',
-                    'prices': [{'label': 'Пополнение баланса', 'amount': stars_amount}],
-                },
+        async with create_bot() as bot:
+            invoice_url = await bot.create_invoice_link(
+                title='Пополнение баланса VPN',
+                description=f'Пополнение баланса на {normalized_kopeks / 100:.2f} ₽ ({stars_amount} ⭐)',
+                payload=payload,
+                provider_token='',
+                currency='XTR',
+                prices=[LabeledPrice(label='Пополнение баланса', amount=stars_amount)],
             )
 
-            result = response.json()
+        logger.info(
+            'Created Stars invoice for balance top-up: user=, amount= kopeks, stars',
+            user_id=user.id,
+            amount_kopeks=request.amount_kopeks,
+            stars_amount=stars_amount,
+        )
 
-            if not result.get('ok'):
-                logger.error('Telegram API error', result=result)
-                raise HTTPException(
-                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                    detail='Failed to create Stars invoice',
-                )
+        return StarsInvoiceResponse(
+            invoice_url=invoice_url,
+            stars_amount=stars_amount,
+            amount_kopeks=normalized_kopeks,
+        )
 
-            invoice_url = result['result']
-            logger.info(
-                'Created Stars invoice for balance top-up: user=, amount= kopeks, stars',
-                user_id=user.id,
-                amount_kopeks=request.amount_kopeks,
-                stars_amount=stars_amount,
-            )
-
-            return StarsInvoiceResponse(
-                invoice_url=invoice_url,
-                stars_amount=stars_amount,
-                amount_kopeks=request.amount_kopeks,
-            )
-
-    except httpx.HTTPError as e:
-        logger.error('HTTP error creating Stars invoice', error=e)
+    except TelegramAPIError as e:
+        logger.error('Error creating Stars invoice', error=e)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail='Failed to connect to Telegram API',
+            detail='Failed to create Stars invoice',
         )
 
 
@@ -314,6 +310,12 @@ async def create_topup(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Create payment for balance top-up."""
+    if getattr(user, 'restriction_topup', False):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Balance top-up is restricted for this account',
+        )
+
     # Validate payment method
     methods = await get_payment_methods(user=user, db=db)
     method = next((m for m in methods if m.id == request.payment_method), None)
@@ -340,6 +342,9 @@ async def create_topup(
     amount_rubles = request.amount_kopeks / 100
     payment_url = None
     payment_id = None
+    cabinet_return_url = f'{settings.CABINET_URL.rstrip("/")}/balance/top-up/result?method={request.payment_method}'
+    cabinet_success_url = f'{cabinet_return_url}&status=success'
+    cabinet_failed_url = f'{cabinet_return_url}&status=failed'
 
     try:
         if request.payment_method == 'yookassa':
@@ -355,7 +360,7 @@ async def create_topup(
             option = (request.payment_option or '').strip().lower()
             # Use description with telegram_id for tax receipts
             description = settings.get_balance_payment_description(
-                request.amount_kopeks, telegram_user_id=user.telegram_id
+                request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
             )
             if option == 'sbp':
                 result = await payment_service.create_yookassa_sbp_payment(
@@ -364,6 +369,7 @@ async def create_topup(
                     amount_kopeks=request.amount_kopeks,
                     description=description,
                     metadata=yookassa_metadata,
+                    return_url=cabinet_return_url,
                 )
             else:
                 result = await payment_service.create_yookassa_payment(
@@ -372,11 +378,12 @@ async def create_topup(
                     amount_kopeks=request.amount_kopeks,
                     description=description,
                     metadata=yookassa_metadata,
+                    return_url=cabinet_return_url,
                 )
 
             if result:
                 payment_url = result.get('confirmation_url')
-                payment_id = result.get('yookassa_payment_id')
+                payment_id = str(result.get('local_payment_id') or result.get('yookassa_payment_id') or 'pending')
             else:
                 raise HTTPException(
                     status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -416,7 +423,7 @@ async def create_topup(
                 amount_usd=amount_usd,
                 asset=settings.CRYPTOBOT_DEFAULT_ASSET,
                 description=settings.get_balance_payment_description(
-                    request.amount_kopeks, telegram_user_id=user.telegram_id
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
                 ),
                 payload=f'cabinet_topup_{user.id}_{request.amount_kopeks}',
             )
@@ -477,10 +484,12 @@ async def create_topup(
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
                 description=settings.get_balance_payment_description(
-                    request.amount_kopeks, telegram_user_id=user.telegram_id
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
                 ),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
                 payment_method_code=method_code,
+                return_url=cabinet_success_url,
+                failed_url=cabinet_failed_url,
             )
 
             if result and result.get('redirect_url'):
@@ -504,8 +513,12 @@ async def create_topup(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
+                return_url=cabinet_return_url,
+                success_url=cabinet_success_url,
             )
 
             if result and result.get('payment_url'):
@@ -529,7 +542,9 @@ async def create_topup(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
             )
 
@@ -553,16 +568,17 @@ async def create_topup(
             option = (request.payment_option or '').strip().lower()
             if option not in {'card', 'sbp'}:
                 option = 'sbp'
-            provider_method = 'card' if option == 'card' else 'sbp'
 
             payment_service = PaymentService()
             result = await payment_service.create_pal24_payment(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
-                payment_method=provider_method,
+                payment_method=option,
             )
 
             if result:
@@ -601,8 +617,12 @@ async def create_topup(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
+                return_url=cabinet_success_url,
+                failed_url=cabinet_failed_url,
             )
 
             if result and result.get('payment_url'):
@@ -626,9 +646,13 @@ async def create_topup(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 telegram_id=user.telegram_id,
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
+                return_url=cabinet_success_url,
+                failed_url=cabinet_failed_url,
             )
 
             if result and result.get('payment_url'):
@@ -652,7 +676,9 @@ async def create_topup(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
             )
 
@@ -672,14 +698,22 @@ async def create_topup(
                     detail='KassaAI payment method is unavailable',
                 )
 
+            # Use payment_option to select sbp or card
+            KASSA_AI_OPTION_MAP = {'sbp': 44, 'card': 36, 'sberpay': 43}
+            option = (request.payment_option or '').strip().lower()
+            ps_id = KASSA_AI_OPTION_MAP.get(option)  # None = use env default
+
             payment_service = PaymentService()
             result = await payment_service.create_kassa_ai_payment(
                 db=db,
                 user_id=user.id,
                 amount_kopeks=request.amount_kopeks,
-                description=settings.get_balance_payment_description(request.amount_kopeks),
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
                 email=getattr(user, 'email', None),
                 language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
+                payment_system_id=ps_id,
             )
 
             if result and result.get('payment_url'):
@@ -691,6 +725,35 @@ async def create_topup(
                     detail='Failed to create KassaAI payment',
                 )
 
+        elif request.payment_method == 'riopay':
+            if not settings.is_riopay_enabled():
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail='RioPay payment method is unavailable',
+                )
+
+            payment_service = PaymentService()
+            result = await payment_service.create_riopay_payment(
+                db=db,
+                user_id=user.id,
+                amount_kopeks=request.amount_kopeks,
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
+                language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
+                success_url=cabinet_success_url,
+                fail_url=cabinet_failed_url,
+            )
+
+            if result and result.get('payment_url'):
+                payment_url = result.get('payment_url')
+                payment_id = str(result.get('local_payment_id') or result.get('riopay_order_id') or 'pending')
+            else:
+                raise HTTPException(
+                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                    detail='Failed to create RioPay payment',
+                )
+
         elif request.payment_method == 'tribute':
             if not settings.TRIBUTE_ENABLED or not settings.TRIBUTE_DONATE_LINK:
                 raise HTTPException(
@@ -702,6 +765,35 @@ async def create_topup(
             payment_url = f'{settings.TRIBUTE_DONATE_LINK}&user_id={user_identifier}'
             payment_id = f'tribute_{user_identifier}_{request.amount_kopeks}'
 
+        elif request.payment_method == 'severpay':
+            if not settings.is_severpay_enabled():
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail='SeverPay payment method is unavailable',
+                )
+
+            payment_service = PaymentService()
+            result = await payment_service.create_severpay_payment(
+                db=db,
+                user_id=user.id,
+                amount_kopeks=request.amount_kopeks,
+                description=settings.get_balance_payment_description(
+                    request.amount_kopeks, telegram_user_id=user.telegram_id, user_db_id=user.id
+                ),
+                email=getattr(user, 'email', None),
+                language=getattr(user, 'language', None) or settings.DEFAULT_LANGUAGE,
+                return_url=cabinet_success_url,
+            )
+
+            if result and result.get('payment_url'):
+                payment_url = result.get('payment_url')
+                payment_id = str(result.get('local_payment_id') or result.get('order_id') or 'pending')
+            else:
+                raise HTTPException(
+                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                    detail='Failed to create SeverPay payment',
+                )
+
         else:
             # For other payment methods, redirect to bot
             raise HTTPException(
@@ -842,6 +934,17 @@ def _get_status_info(record: PendingPayment) -> tuple[str, str]:
         }
         return mapping.get(status, ('❓', 'Неизвестно'))
 
+    if record.method == PaymentMethod.RIOPAY:
+        mapping = {
+            'pending': ('⏳', 'Ожидает оплаты'),
+            'success': ('✅', 'Оплачено'),
+            'failed': ('❌', 'Ошибка'),
+            'canceled': ('❌', 'Отменено'),
+            'expired': ('⌛', 'Истёк'),
+            'amount_mismatch': ('⚠️', 'Несовпадение суммы'),
+        }
+        return mapping.get(status, ('❓', 'Неизвестно'))
+
     return '❓', 'Неизвестно'
 
 
@@ -865,13 +968,15 @@ def _is_checkable(record: PendingPayment) -> bool:
     if record.method == PaymentMethod.YOOKASSA:
         return status in {'pending', 'waiting_for_capture'}
     if record.method == PaymentMethod.CRYPTOBOT:
-        return status in {'active'}
+        return status == 'active'
     if record.method == PaymentMethod.CLOUDPAYMENTS:
         return status in {'pending', 'authorized'}
     if record.method == PaymentMethod.FREEKASSA:
         return status in {'pending', 'created', 'processing'}
     if record.method == PaymentMethod.KASSA_AI:
         return status in {'pending', 'created', 'processing'}
+    if record.method == PaymentMethod.RIOPAY:
+        return status in {'pending'}
     return False
 
 
@@ -895,7 +1000,12 @@ def _get_payment_url(record: PendingPayment) -> str | None:
         )
     elif record.method == PaymentMethod.PLATEGA:
         payment_url = getattr(payment, 'redirect_url', None) or payment_url
-    elif record.method in (PaymentMethod.CLOUDPAYMENTS, PaymentMethod.FREEKASSA, PaymentMethod.KASSA_AI):
+    elif record.method in (
+        PaymentMethod.CLOUDPAYMENTS,
+        PaymentMethod.FREEKASSA,
+        PaymentMethod.KASSA_AI,
+        PaymentMethod.RIOPAY,
+    ):
         payment_url = getattr(payment, 'payment_url', None) or payment_url
 
     return payment_url
@@ -956,6 +1066,93 @@ async def get_pending_payments(
     )
 
 
+@router.get('/pending-payments/{method}/latest', response_model=PendingPaymentResponse)
+async def get_latest_payment_by_method(
+    method: str,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get user's most recent payment for a given method (any status, not just pending)."""
+    try:
+        payment_method = PaymentMethod(method)
+    except ValueError:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Invalid payment method: {method}',
+        )
+
+    from datetime import UTC, datetime, timedelta
+
+    from sqlalchemy.orm import selectinload
+
+    from app.database.models import (
+        CloudPaymentsPayment,
+        CryptoBotPayment,
+        FreekassaPayment,
+        HeleketPayment,
+        KassaAiPayment,
+        MulenPayPayment,
+        Pal24Payment,
+        PlategaPayment,
+        RioPayPayment,
+        WataPayment,
+        YooKassaPayment,
+    )
+
+    model_map: dict[PaymentMethod, type] = {
+        PaymentMethod.YOOKASSA: YooKassaPayment,
+        PaymentMethod.CRYPTOBOT: CryptoBotPayment,
+        PaymentMethod.HELEKET: HeleketPayment,
+        PaymentMethod.MULENPAY: MulenPayPayment,
+        PaymentMethod.PAL24: Pal24Payment,
+        PaymentMethod.WATA: WataPayment,
+        PaymentMethod.PLATEGA: PlategaPayment,
+        PaymentMethod.CLOUDPAYMENTS: CloudPaymentsPayment,
+        PaymentMethod.FREEKASSA: FreekassaPayment,
+        PaymentMethod.KASSA_AI: KassaAiPayment,
+        PaymentMethod.RIOPAY: RioPayPayment,
+    }
+
+    model = model_map.get(payment_method)
+    if not model:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Unsupported payment method: {method}',
+        )
+
+    cutoff = datetime.now(UTC) - timedelta(hours=1)
+    stmt = (
+        select(model)
+        .options(selectinload(model.user))
+        .where(model.user_id == user.id, model.created_at >= cutoff)
+        .order_by(desc(model.created_at))
+        .limit(1)
+    )
+    result = await db.execute(stmt)
+    payment = result.scalars().first()
+
+    if not payment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No recent payments found',
+        )
+
+    record = PendingPayment(
+        local_id=payment.id,
+        method=payment_method,
+        identifier=str(getattr(payment, 'correlation_id', None) or payment.id),
+        amount_kopeks=payment.amount_kopeks,
+        status=payment.status or '',
+        is_paid=bool(payment.is_paid),
+        created_at=payment.created_at,
+        expires_at=getattr(payment, 'expires_at', None),
+        user=payment.user,
+        payment=payment,
+    )
+
+    return _record_to_response(record)
+
+
 @router.get('/pending-payments/{method}/{payment_id}', response_model=PendingPaymentResponse)
 async def get_pending_payment_details(
     method: str,
@@ -1035,8 +1232,12 @@ async def check_payment_status(
     old_is_paid = record.is_paid
 
     # Run manual check
-    payment_service = PaymentService()
-    updated = await run_manual_check(db, payment_method, payment_id, payment_service)
+    bot = create_bot()
+    try:
+        payment_service = PaymentService(bot=bot)
+        updated = await run_manual_check(db, payment_method, payment_id, payment_service)
+    finally:
+        await bot.session.close()
 
     if not updated:
         return ManualCheckResponse(
@@ -1062,3 +1263,55 @@ async def check_payment_status(
         old_status=old_status,
         new_status=updated.status,
     )
+
+
+@router.get('/saved-cards', response_model=SavedCardsListResponse)
+async def get_saved_cards(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get user's saved payment methods (cards) for recurrent payments."""
+    recurrent_enabled = settings.YOOKASSA_RECURRENT_ENABLED
+
+    if not recurrent_enabled:
+        return SavedCardsListResponse(cards=[], recurrent_enabled=False)
+
+    methods = await get_active_payment_methods_by_user(db, user.id)
+
+    cards = [
+        SavedCardResponse(
+            id=m.id,
+            method_type=m.method_type,
+            card_last4=m.card_last4,
+            card_type=m.card_type,
+            title=m.title,
+            created_at=m.created_at,
+        )
+        for m in methods
+    ]
+
+    return SavedCardsListResponse(cards=cards, recurrent_enabled=True)
+
+
+@router.delete('/saved-cards/{card_id}', status_code=status.HTTP_200_OK)
+async def delete_saved_card(
+    card_id: int,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Unlink (deactivate) a saved payment method."""
+    if not settings.YOOKASSA_RECURRENT_ENABLED:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Recurrent payments are not enabled',
+        )
+
+    success = await deactivate_payment_method(db, card_id, user.id)
+
+    if not success:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Saved card not found',
+        )
+
+    return {'success': True, 'message': 'Card unlinked successfully'}

app/cabinet/routes/branding.py

@@ -1,17 +1,20 @@
 """Branding routes for cabinet - logo, project name, and theme colors management."""
 
+import asyncio
 import json
 import os
 from pathlib import Path
+from typing import Literal
 
 import structlog
 from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
 from fastapi.responses import FileResponse
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
+from app.database.crud.system_setting import get_setting_value
 from app.database.models import SystemSetting, User
 
 from ..dependencies import get_cabinet_db, require_permission
@@ -37,6 +40,24 @@ YANDEX_METRIKA_ID_KEY = 'CABINET_YANDEX_METRIKA_ID'  # Stores counter ID (numeri
 GOOGLE_ADS_ID_KEY = 'CABINET_GOOGLE_ADS_ID'  # Stores conversion ID (e.g. "AW-123456789")
 GOOGLE_ADS_LABEL_KEY = 'CABINET_GOOGLE_ADS_LABEL'  # Stores conversion label (alphanumeric)
 LITE_MODE_ENABLED_KEY = 'CABINET_LITE_MODE_ENABLED'  # Stores "true" or "false"
+GIFT_ENABLED_KEY = 'CABINET_GIFT_ENABLED'  # Stores "true" or "false"
+ANIMATION_CONFIG_KEY = 'CABINET_ANIMATION_CONFIG'  # Stores JSON with animation config
+TELEGRAM_WIDGET_SIZE_KEY = 'TELEGRAM_WIDGET_SIZE'
+TELEGRAM_WIDGET_RADIUS_KEY = 'TELEGRAM_WIDGET_RADIUS'
+TELEGRAM_WIDGET_USERPIC_KEY = 'TELEGRAM_WIDGET_USERPIC'
+TELEGRAM_WIDGET_REQUEST_ACCESS_KEY = 'TELEGRAM_WIDGET_REQUEST_ACCESS'
+TELEGRAM_OIDC_ENABLED_KEY = 'TELEGRAM_OIDC_ENABLED'
+TELEGRAM_OIDC_CLIENT_ID_KEY = 'TELEGRAM_OIDC_CLIENT_ID'
+
+# Default animation config
+DEFAULT_ANIMATION_CONFIG = {
+    'enabled': True,
+    'type': 'aurora',
+    'settings': {},
+    'opacity': 1.0,
+    'blur': 0,
+    'reducedOnMobile': True,
+}
 
 # Allowed image types
 ALLOWED_CONTENT_TYPES = {'image/png', 'image/jpeg', 'image/jpg', 'image/webp', 'image/svg+xml'}
@@ -121,6 +142,92 @@ class AnimationEnabledUpdate(BaseModel):
     enabled: bool
 
 
+ALLOWED_BG_TYPES = (
+    'aurora',
+    'sparkles',
+    'vortex',
+    'shooting-stars',
+    'background-beams',
+    'background-beams-collision',
+    'gradient-animation',
+    'wavy',
+    'background-lines',
+    'boxes',
+    'meteors',
+    'grid',
+    'dots',
+    'spotlight',
+    'ripple',
+    'none',
+)
+
+MAX_SETTINGS_KEYS = 20
+MAX_SETTINGS_VALUE_LEN = 200
+
+
+def _validate_settings(v: dict) -> dict:
+    """Validate settings dict: flat structure, bounded size, no nested objects."""
+    if len(v) > MAX_SETTINGS_KEYS:
+        raise ValueError(f'Settings must have at most {MAX_SETTINGS_KEYS} keys')
+    for key, val in v.items():
+        if not isinstance(key, str) or len(key) > 50:
+            raise ValueError('Setting keys must be strings under 50 characters')
+        if isinstance(val, dict | list):
+            raise ValueError('Nested objects/arrays not allowed in settings')
+        if isinstance(val, str) and len(val) > MAX_SETTINGS_VALUE_LEN:
+            raise ValueError(f'String setting values must be under {MAX_SETTINGS_VALUE_LEN} characters')
+    return v
+
+
+class AnimationConfigResponse(BaseModel):
+    """Full animation config."""
+
+    enabled: bool = True
+    type: str = 'aurora'
+    settings: dict = Field(default_factory=dict)
+    opacity: float = Field(default=1.0, ge=0.0, le=1.0)
+    blur: float = Field(default=0, ge=0, le=100)
+    reducedOnMobile: bool = True
+
+
+class AnimationConfigUpdate(BaseModel):
+    """Request to update animation config (partial update)."""
+
+    enabled: bool | None = None
+    type: (
+        Literal[
+            'aurora',
+            'sparkles',
+            'vortex',
+            'shooting-stars',
+            'background-beams',
+            'background-beams-collision',
+            'gradient-animation',
+            'wavy',
+            'background-lines',
+            'boxes',
+            'meteors',
+            'grid',
+            'dots',
+            'spotlight',
+            'ripple',
+            'none',
+        ]
+        | None
+    ) = None
+    settings: dict | None = None
+    opacity: float | None = Field(default=None, ge=0.0, le=1.0)
+    blur: float | None = Field(default=None, ge=0, le=100)
+    reducedOnMobile: bool | None = None
+
+    @field_validator('settings')
+    @classmethod
+    def validate_settings(cls, v: dict | None) -> dict | None:
+        if v is None:
+            return v
+        return _validate_settings(v)
+
+
 class FullscreenEnabledResponse(BaseModel):
     """Fullscreen enabled setting."""
 
@@ -137,6 +244,7 @@ class EmailAuthEnabledResponse(BaseModel):
     """Email auth enabled setting."""
 
     enabled: bool = True
+    verification_enabled: bool = True
 
 
 class EmailAuthEnabledUpdate(BaseModel):
@@ -145,6 +253,20 @@ class EmailAuthEnabledUpdate(BaseModel):
     enabled: bool
 
 
+class TelegramWidgetConfigResponse(BaseModel):
+    """Public Telegram Login Widget configuration."""
+
+    bot_username: str
+    size: Literal['large', 'medium', 'small'] = 'large'
+    radius: int = Field(default=8, ge=0, le=20)
+    userpic: bool = True
+    request_access: bool = True
+
+    # OIDC fields (frontend decides which flow to use)
+    oidc_enabled: bool = False
+    oidc_client_id: str = ''
+
+
 class LiteModeEnabledResponse(BaseModel):
     """Lite mode enabled setting."""
 
@@ -157,6 +279,18 @@ class LiteModeEnabledUpdate(BaseModel):
     enabled: bool
 
 
+class GiftEnabledResponse(BaseModel):
+    """Gift feature enabled setting."""
+
+    enabled: bool = False
+
+
+class GiftEnabledUpdate(BaseModel):
+    """Request to update gift feature setting."""
+
+    enabled: bool
+
+
 class AnalyticsCountersResponse(BaseModel):
     """Analytics counter settings."""
 
@@ -198,13 +332,6 @@ def ensure_branding_dir():
     BRANDING_DIR.mkdir(parents=True, exist_ok=True)
 
 
-async def get_setting_value(db: AsyncSession, key: str) -> str | None:
-    """Get a setting value from database."""
-    result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
-    setting = result.scalar_one_or_none()
-    return setting.value if setting else None
-
-
 async def set_setting_value(db: AsyncSession, key: str, value: str):
     """Set a setting value in database."""
     result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
@@ -276,7 +403,7 @@ async def get_logo():
     """
     logo_path = get_logo_path()
 
-    if logo_path is None or not logo_path.exists():
+    if logo_path is None or not await asyncio.to_thread(logo_path.exists):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail='No custom logo set')
 
     # Determine media type from file extension
@@ -345,7 +472,7 @@ async def upload_logo(
         )
 
     # Ensure directory exists
-    ensure_branding_dir()
+    await asyncio.to_thread(ensure_branding_dir)
 
     # Determine file extension from content type
     ext_map = {
@@ -358,12 +485,12 @@ async def upload_logo(
     extension = ext_map.get(file.content_type, '.png')
 
     # Remove old logo files with any extension
-    for old_file in BRANDING_DIR.glob('logo.*'):
-        old_file.unlink()
+    for old_file in await asyncio.to_thread(lambda: list(BRANDING_DIR.glob('logo.*'))):
+        await asyncio.to_thread(old_file.unlink)
 
     # Save new logo
     logo_path = BRANDING_DIR / f'logo{extension}'
-    logo_path.write_bytes(content)
+    await asyncio.to_thread(logo_path.write_bytes, content)
 
     # Mark that we have a custom logo
     await set_setting_value(db, BRANDING_LOGO_KEY, 'custom')
@@ -392,8 +519,8 @@ async def delete_logo(
 ):
     """Delete custom logo and revert to letter. Admin only."""
     # Remove logo files
-    for old_file in BRANDING_DIR.glob('logo.*'):
-        old_file.unlink()
+    for old_file in await asyncio.to_thread(lambda: list(BRANDING_DIR.glob('logo.*'))):
+        await asyncio.to_thread(old_file.unlink)
 
     # Update setting
     await set_setting_value(db, BRANDING_LOGO_KEY, 'default')
@@ -598,6 +725,69 @@ async def update_animation_enabled(
     return AnimationEnabledResponse(enabled=payload.enabled)
 
 
+# ============ Animation Config Routes (new JSON-based) ============
+
+
+@router.get('/animation-config', response_model=AnimationConfigResponse)
+async def get_animation_config(
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get full animation config. Public endpoint."""
+    config_value = await get_setting_value(db, ANIMATION_CONFIG_KEY)
+
+    if config_value is not None:
+        try:
+            config = json.loads(config_value)
+            return AnimationConfigResponse(**config)
+        except (json.JSONDecodeError, TypeError):
+            pass
+
+    # Auto-migrate from old ANIMATION_ENABLED_KEY
+    old_value = await get_setting_value(db, ANIMATION_ENABLED_KEY)
+    if old_value is not None:
+        config = {**DEFAULT_ANIMATION_CONFIG, 'enabled': old_value.lower() == 'true'}
+        await set_setting_value(db, ANIMATION_CONFIG_KEY, json.dumps(config))
+        return AnimationConfigResponse(**config)
+
+    return AnimationConfigResponse(**DEFAULT_ANIMATION_CONFIG)
+
+
+@router.patch('/animation-config', response_model=AnimationConfigResponse)
+async def update_animation_config(
+    payload: AnimationConfigUpdate,
+    admin: User = Depends(require_permission('settings:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Update animation config (partial update). Admin only."""
+    # Get current config
+    config_value = await get_setting_value(db, ANIMATION_CONFIG_KEY)
+    if config_value:
+        try:
+            current = json.loads(config_value)
+        except (json.JSONDecodeError, TypeError):
+            current = dict(DEFAULT_ANIMATION_CONFIG)
+    else:
+        current = dict(DEFAULT_ANIMATION_CONFIG)
+
+    # Merge only provided fields
+    update_data = payload.model_dump(exclude_none=True)
+    current.update(update_data)
+
+    await set_setting_value(db, ANIMATION_CONFIG_KEY, json.dumps(current))
+
+    # Also sync old key for backwards compat
+    await set_setting_value(db, ANIMATION_ENABLED_KEY, str(current.get('enabled', True)).lower())
+
+    logger.info(
+        'Admin updated animation config',
+        telegram_id=admin.telegram_id,
+        type=current.get('type'),
+        enabled=current.get('enabled'),
+    )
+
+    return AnimationConfigResponse(**current)
+
+
 # ============ Fullscreen Routes ============
 
 
@@ -649,10 +839,16 @@ async def get_email_auth_enabled(
 
     if email_auth_value is not None:
         enabled = email_auth_value.lower() == 'true'
-        return EmailAuthEnabledResponse(enabled=enabled)
+        return EmailAuthEnabledResponse(
+            enabled=enabled,
+            verification_enabled=settings.is_cabinet_email_verification_enabled(),
+        )
 
     # Default: check config setting
-    return EmailAuthEnabledResponse(enabled=settings.is_cabinet_email_auth_enabled())
+    return EmailAuthEnabledResponse(
+        enabled=settings.is_cabinet_email_auth_enabled(),
+        verification_enabled=settings.is_cabinet_email_verification_enabled(),
+    )
 
 
 @router.patch('/email-auth', response_model=EmailAuthEnabledResponse)
@@ -666,7 +862,51 @@ async def update_email_auth_enabled(
 
     logger.info('Admin set email auth enabled', telegram_id=admin.telegram_id, enabled=payload.enabled)
 
-    return EmailAuthEnabledResponse(enabled=payload.enabled)
+    return EmailAuthEnabledResponse(
+        enabled=payload.enabled,
+        verification_enabled=settings.is_cabinet_email_verification_enabled(),
+    )
+
+
+# ============ Telegram Widget Config Routes ============
+
+
+@router.get('/telegram-widget', response_model=TelegramWidgetConfigResponse)
+async def get_telegram_widget_config(
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """
+    Get Telegram Login Widget configuration.
+    This is a public endpoint - no authentication required.
+    Returns widget display settings and bot username for the login page.
+    """
+    bot_username = settings.BOT_USERNAME or ''
+
+    size_val = await get_setting_value(db, TELEGRAM_WIDGET_SIZE_KEY)
+    radius_val = await get_setting_value(db, TELEGRAM_WIDGET_RADIUS_KEY)
+    userpic_val = await get_setting_value(db, TELEGRAM_WIDGET_USERPIC_KEY)
+    request_access_val = await get_setting_value(db, TELEGRAM_WIDGET_REQUEST_ACCESS_KEY)
+
+    oidc_enabled_val = await get_setting_value(db, TELEGRAM_OIDC_ENABLED_KEY)
+    oidc_client_id_val = await get_setting_value(db, TELEGRAM_OIDC_CLIENT_ID_KEY)
+    oidc_client_id = oidc_client_id_val or settings.TELEGRAM_OIDC_CLIENT_ID
+    oidc_enabled = (
+        oidc_enabled_val.lower() == 'true' if oidc_enabled_val is not None else settings.TELEGRAM_OIDC_ENABLED
+    ) and bool(oidc_client_id)
+
+    return TelegramWidgetConfigResponse(
+        bot_username=bot_username,
+        size=size_val if size_val in ('large', 'medium', 'small') else settings.TELEGRAM_WIDGET_SIZE,
+        radius=max(0, min(int(radius_val), 20))
+        if radius_val and radius_val.isdigit()
+        else settings.TELEGRAM_WIDGET_RADIUS,
+        userpic=userpic_val.lower() == 'true' if userpic_val is not None else settings.TELEGRAM_WIDGET_USERPIC,
+        request_access=request_access_val.lower() == 'true'
+        if request_access_val is not None
+        else settings.TELEGRAM_WIDGET_REQUEST_ACCESS,
+        oidc_enabled=oidc_enabled,
+        oidc_client_id=oidc_client_id if oidc_enabled else '',
+    )
 
 
 # ============ Analytics Counters Routes ============
@@ -767,3 +1007,30 @@ async def update_lite_mode_enabled(
     logger.info('Admin set lite mode enabled', telegram_id=admin.telegram_id, enabled=payload.enabled)
 
     return LiteModeEnabledResponse(enabled=payload.enabled)
+
+
+# ============ Gift Feature Routes ============
+
+
+@router.get('/gift-enabled', response_model=GiftEnabledResponse)
+async def get_gift_enabled(
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get gift feature enabled setting. Public endpoint."""
+    value = await get_setting_value(db, GIFT_ENABLED_KEY)
+    if value is not None:
+        enabled = value.lower() == 'true'
+        return GiftEnabledResponse(enabled=enabled)
+    return GiftEnabledResponse(enabled=False)
+
+
+@router.patch('/gift-enabled', response_model=GiftEnabledResponse)
+async def update_gift_enabled(
+    payload: GiftEnabledUpdate,
+    admin: User = Depends(require_permission('settings:edit')),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Update gift feature enabled setting. Admin only."""
+    await set_setting_value(db, GIFT_ENABLED_KEY, str(payload.enabled).lower())
+    logger.info('Admin set gift enabled', telegram_id=admin.telegram_id, enabled=payload.enabled)
+    return GiftEnabledResponse(enabled=payload.enabled)

app/cabinet/routes/contests.py

@@ -9,14 +9,28 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.config import settings
 from app.database.crud.contest import (
     create_attempt,
     get_active_rounds,
     get_attempt,
     increment_winner_count,
 )
-from app.database.crud.subscription import get_subscription_by_user_id
+from app.database.crud.subscription import get_active_subscriptions_by_user_id, get_subscription_by_user_id
 from app.database.models import SubscriptionStatus, User
+
+
+async def _resolve_subscription_for_prize(db, user_id: int):
+    """Resolve best subscription for applying contest prize (days/traffic)."""
+    if settings.is_multi_tariff_enabled():
+        active_subs = await get_active_subscriptions_by_user_id(db, user_id)
+        # Prefer non-daily with most days left
+        non_daily = [s for s in active_subs if not (s.tariff and getattr(s.tariff, 'is_daily', False))]
+        eligible = non_daily or active_subs
+        return max(eligible, key=lambda s: s.days_left) if eligible else None
+    return await get_subscription_by_user_id(db, user_id)
+
+
 from app.services.contest_rotation_service import (
     GAME_ANAGRAM,
     GAME_BLITZ,
@@ -86,6 +100,7 @@ def _user_allowed(subscription) -> bool:
     return subscription.status in {
         SubscriptionStatus.ACTIVE.value,
         SubscriptionStatus.TRIAL.value,
+        SubscriptionStatus.LIMITED.value,
     }
 
 
@@ -97,7 +112,7 @@ async def _award_prize(db: AsyncSession, user_id: int, prize_type: str, prize_va
         except ValueError:
             return 'Error: invalid prize value'
 
-        subscription = await get_subscription_by_user_id(db, user_id)
+        subscription = await _resolve_subscription_for_prize(db, user_id)
         if not subscription:
             return 'Error: subscription not found'
 
@@ -121,7 +136,10 @@ async def _award_prize(db: AsyncSession, user_id: int, prize_type: str, prize_va
         if not user:
             return 'Error: user not found'
 
-        user.balance += amount
+        from app.database.crud.user import lock_user_for_update
+
+        user = await lock_user_for_update(db, user)
+        user.balance_kopeks += int(round(amount * 100))
         await db.commit()
         await db.refresh(user)
 
@@ -147,7 +165,7 @@ async def get_contests_count(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Get count of contests available for the user."""
-    subscription = await get_subscription_by_user_id(db, user.id)
+    subscription = await _resolve_subscription_for_prize(db, user.id)
 
     if not _user_allowed(subscription):
         return ContestsCountResponse(count=0)
@@ -179,7 +197,7 @@ async def get_contests(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Get list of available contests/games."""
-    subscription = await get_subscription_by_user_id(db, user.id)
+    subscription = await _resolve_subscription_for_prize(db, user.id)
 
     if not _user_allowed(subscription):
         raise HTTPException(
@@ -226,7 +244,7 @@ async def get_contest_game(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Get game data for a specific contest round."""
-    subscription = await get_subscription_by_user_id(db, user.id)
+    subscription = await _resolve_subscription_for_prize(db, user.id)
 
     if not _user_allowed(subscription):
         raise HTTPException(
@@ -346,7 +364,7 @@ async def submit_contest_answer(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Submit answer for a contest round."""
-    subscription = await get_subscription_by_user_id(db, user.id)
+    subscription = await _resolve_subscription_for_prize(db, user.id)
 
     if not _user_allowed(subscription):
         raise HTTPException(

app/cabinet/routes/gift.py

@@ -0,0 +1,806 @@
+"""Gift subscription routes for cabinet."""
+
+import asyncio
+import re
+from datetime import UTC, datetime
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.config import settings
+from app.database.crud.system_setting import get_setting_value
+from app.database.crud.tariff import get_tariff_by_id
+from app.database.crud.transaction import create_transaction, emit_transaction_side_effects
+from app.database.crud.user import subtract_user_balance
+from app.database.models import (
+    GuestPurchase,
+    GuestPurchaseStatus,
+    PaymentMethod,
+    Tariff,
+    TransactionType,
+    User,
+)
+from app.services.guest_purchase_service import (
+    GuestPurchaseError,
+    create_purchase,
+    fulfill_purchase,
+)
+from app.services.payment_method_config_service import get_enabled_methods_for_user
+from app.utils.cache import RateLimitCache
+from app.utils.promo_offer import get_user_active_promo_discount_percent
+
+from ..dependencies import get_cabinet_db, get_current_cabinet_user
+from ..schemas.gift import (
+    ActivateGiftRequest,
+    ActivateGiftResponse,
+    GiftConfigPaymentMethod,
+    GiftConfigResponse,
+    GiftConfigSubOption,
+    GiftConfigTariff,
+    GiftConfigTariffPeriod,
+    GiftPurchaseRequest,
+    GiftPurchaseResponse,
+    GiftPurchaseStatusResponse,
+    PendingGiftResponse,
+    ReceivedGiftResponse,
+    SentGiftResponse,
+)
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/gift', tags=['Cabinet Gift'])
+
+GIFT_ENABLED_KEY = 'CABINET_GIFT_ENABLED'
+
+_EMAIL_RE = re.compile(r'^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$')
+_TELEGRAM_RE = re.compile(r'^@?[a-zA-Z][a-zA-Z0-9_]{4,31}$')
+
+
+async def _is_gift_enabled(db: AsyncSession) -> bool:
+    """Check if the gift feature is enabled via system settings."""
+    value = await get_setting_value(db, GIFT_ENABLED_KEY)
+    if value is not None:
+        return value.lower() == 'true'
+    return False
+
+
+@router.get('/config', response_model=GiftConfigResponse)
+async def get_gift_config(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get gift subscription configuration: tariffs, payment methods, balance."""
+    enabled = await _is_gift_enabled(db)
+    if not enabled:
+        return GiftConfigResponse(
+            is_enabled=False,
+            balance_kopeks=user.balance_kopeks,
+        )
+
+    # Load active tariffs visible in gift section
+    result = await db.execute(
+        select(Tariff)
+        .where(Tariff.is_active.is_(True), Tariff.show_in_gift.is_(True))
+        .order_by(Tariff.display_order, Tariff.id)
+    )
+    tariffs_db = result.scalars().all()
+
+    # Get user's promo group for discount calculation
+    promo_group = user.get_primary_promo_group() if hasattr(user, 'get_primary_promo_group') else None
+    if promo_group is None:
+        promo_group = getattr(user, 'promo_group', None)
+    promo_group_name = promo_group.name if promo_group else None
+
+    # Get active promo offer discount
+    promo_offer_discount_percent = get_user_active_promo_discount_percent(user)
+
+    tariffs: list[GiftConfigTariff] = []
+    for tariff in tariffs_db:
+        period_days_list = tariff.get_available_periods()
+        periods: list[GiftConfigTariffPeriod] = []
+        for days in period_days_list:
+            base_price = tariff.get_price_for_period(days)
+            if base_price is None:
+                continue
+
+            original_price = base_price
+            price = base_price
+
+            # Apply promo group discount
+            from app.services.pricing_engine import PricingEngine
+
+            promo_group_discount = 0
+            if promo_group:
+                promo_group_discount = promo_group.get_discount_percent('period', days)
+                if promo_group_discount > 0:
+                    price = PricingEngine.apply_discount(price, promo_group_discount)
+
+            # Apply active promo offer discount (stacks on top)
+            if promo_offer_discount_percent > 0:
+                price = PricingEngine.apply_discount(price, promo_offer_discount_percent)
+
+            # Ensure minimum price of 1 kopek after all discounts
+            price = max(1, price)
+
+            # Calculate combined discount percent
+            combined_discount = 0
+            if original_price > 0 and original_price != price:
+                combined_discount = int((original_price - price) * 100 / original_price)
+
+            periods.append(
+                GiftConfigTariffPeriod(
+                    days=days,
+                    price_kopeks=price,
+                    price_label=settings.format_price(price),
+                    original_price_kopeks=original_price if combined_discount > 0 else None,
+                    discount_percent=combined_discount if combined_discount > 0 else None,
+                )
+            )
+        if not periods:
+            continue
+        tariffs.append(
+            GiftConfigTariff(
+                id=tariff.id,
+                name=tariff.name,
+                description=tariff.description,
+                traffic_limit_gb=tariff.traffic_limit_gb,
+                device_limit=tariff.device_limit,
+                periods=periods,
+            )
+        )
+
+    # Load payment methods available for this user
+    enabled_methods = await get_enabled_methods_for_user(db, user=user)
+    payment_methods: list[GiftConfigPaymentMethod] = []
+    for method_data in enabled_methods:
+        sub_options = None
+        raw_options = method_data.get('options')
+        if raw_options:
+            sub_options = [GiftConfigSubOption(id=opt['id'], name=opt.get('name', opt['id'])) for opt in raw_options]
+        payment_methods.append(
+            GiftConfigPaymentMethod(
+                method_id=method_data['id'],
+                display_name=method_data['name'],
+                min_amount_kopeks=method_data.get('min_amount_kopeks'),
+                max_amount_kopeks=method_data.get('max_amount_kopeks'),
+                sub_options=sub_options,
+            )
+        )
+
+    return GiftConfigResponse(
+        is_enabled=True,
+        tariffs=tariffs,
+        payment_methods=payment_methods,
+        balance_kopeks=user.balance_kopeks,
+        currency_symbol=getattr(settings, 'CURRENCY_SYMBOL', '\u20bd'),
+        promo_group_name=promo_group_name,
+        active_discount_percent=promo_offer_discount_percent if promo_offer_discount_percent > 0 else None,
+        active_discount_expires_at=(
+            getattr(user, 'promo_offer_discount_expires_at', None) if promo_offer_discount_percent > 0 else None
+        ),
+    )
+
+
+@router.post('/purchase', response_model=GiftPurchaseResponse)
+async def create_gift_purchase(
+    body: GiftPurchaseRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Create a gift subscription purchase from the cabinet."""
+    enabled = await _is_gift_enabled(db)
+    if not enabled:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Gift feature is not enabled',
+        )
+
+    # Rate limit: 5 gift purchases per 60 seconds per user
+    is_limited = await RateLimitCache.is_rate_limited(user.id, 'gift_purchase', limit=5, window=60)
+    if is_limited:
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    # Check if user has purchase restrictions
+    if getattr(user, 'restriction_subscription', False):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Purchases are restricted for this account',
+        )
+
+    # Recipient is optional — when omitted, buyer gets a code to share manually
+    has_recipient = bool(body.recipient_type and body.recipient_value)
+
+    if has_recipient:
+        # Validate recipient format
+        if body.recipient_type == 'email' and not _EMAIL_RE.match(body.recipient_value):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Invalid email format',
+            )
+        if body.recipient_type == 'telegram' and not _TELEGRAM_RE.match(body.recipient_value):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Invalid Telegram username format',
+            )
+
+        # Prevent self-gift
+        if body.recipient_type == 'telegram':
+            normalized_recipient = body.recipient_value.lstrip('@').lower()
+            if user.username and user.username.lower() == normalized_recipient:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail='Cannot gift to yourself',
+                )
+        elif body.recipient_type == 'email':
+            if user.email and user.email.lower() == body.recipient_value.lower():
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail='Cannot gift to yourself',
+                )
+
+    # Find tariff and validate period
+    tariff = await get_tariff_by_id(db, body.tariff_id)
+    if tariff is None or not tariff.is_active or not tariff.show_in_gift:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Tariff not found or inactive',
+        )
+
+    # Validate that period has a configured price before locking
+    if tariff.get_price_for_period(body.period_days) is None:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Price is not configured for this period',
+        )
+
+    # Lock user BEFORE price computation to prevent TOCTOU on promo offer
+    from app.database.crud.user import lock_user_for_pricing
+
+    user = await lock_user_for_pricing(db, user.id)
+
+    from app.services.pricing_engine import pricing_engine
+
+    pricing_result = await pricing_engine.calculate_tariff_purchase_price(
+        tariff,
+        body.period_days,
+        device_limit=tariff.device_limit,
+        user=user,
+    )
+    price_kopeks = max(1, pricing_result.final_total)
+    consume_promo = pricing_result.promo_offer_discount > 0
+
+    # Determine buyer contact info
+    if user.email:
+        buyer_contact_type = 'email'
+        buyer_contact_value = user.email
+    elif user.username:
+        buyer_contact_type = 'telegram'
+        buyer_contact_value = f'@{user.username}'
+    else:
+        buyer_contact_type = 'telegram'
+        buyer_contact_value = f'id:{user.telegram_id or user.id}'
+
+    # Pre-check: try to resolve Telegram username — DB first, then Bot API.
+    # Only relevant when a recipient is explicitly specified.
+    recipient_warning: str | None = None
+    pre_resolved_telegram_id: int | None = None
+    if has_recipient and body.recipient_type == 'telegram':
+        tg_username = body.recipient_value.lstrip('@')
+        normalized_username = tg_username.lower()
+
+        # 1) Check local DB — user may already be registered in the bot
+        db_result = await db.execute(
+            select(User.telegram_id).where(
+                func.lower(User.username) == normalized_username,
+                User.telegram_id.isnot(None),
+            )
+        )
+        db_telegram_id = db_result.scalar_one_or_none()
+
+        if db_telegram_id is not None:
+            pre_resolved_telegram_id = db_telegram_id
+        else:
+            # 2) Fall back to Bot API (works for public usernames the bot has seen)
+            try:
+                from app.bot_factory import create_bot
+
+                async with create_bot() as bot:
+                    chat = await asyncio.wait_for(bot.get_chat(chat_id=f'@{tg_username}'), timeout=5.0)
+                    pre_resolved_telegram_id = chat.id
+            except Exception:
+                recipient_warning = 'telegram_unresolvable'
+                logger.warning(
+                    'Telegram username not resolvable for gift',
+                    username=tg_username,
+                    buyer_id=user.id,
+                )
+
+    # Gateway mode: create payment via external provider
+    if body.payment_mode == 'gateway':
+        if not body.payment_method:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='payment_method is required for gateway mode',
+            )
+
+        purchase_kwargs: dict = (
+            {
+                'gift_recipient_type': body.recipient_type,
+                'gift_recipient_value': body.recipient_value,
+                'gift_message': body.gift_message,
+            }
+            if has_recipient
+            else {
+                'gift_message': body.gift_message,
+            }
+        )
+
+        try:
+            purchase = await create_purchase(
+                db,
+                landing=None,
+                tariff=tariff,
+                period_days=body.period_days,
+                amount_kopeks=price_kopeks,
+                contact_type=buyer_contact_type,
+                contact_value=buyer_contact_value,
+                payment_method=body.payment_method,
+                is_gift=True,
+                source='cabinet',
+                buyer_user_id=user.id,
+                commit=False,
+                **purchase_kwargs,
+            )
+        except GuestPurchaseError as exc:
+            raise HTTPException(status_code=exc.status_code, detail=exc.message) from exc
+
+        # Persist warning so it survives the gateway redirect
+        if recipient_warning:
+            purchase.recipient_warning = recipient_warning
+
+        # Build return URL for after payment
+        cabinet_base = (settings.CABINET_URL or '').rstrip('/')
+        return_url = f'{cabinet_base}/gift/result?token={purchase.token[:12]}'
+
+        from app.services.payment_service import PaymentService
+
+        # Stars payments need a Bot instance to create invoice links
+        bot = None
+        if body.payment_method == 'telegram_stars':
+            from app.bot_factory import create_bot
+
+            bot = create_bot()
+
+        try:
+            payment_service = PaymentService(bot=bot)
+            payment_result = await payment_service.create_guest_payment(
+                db=db,
+                amount_kopeks=price_kopeks,
+                payment_method=body.payment_method,
+                description=f'Gift: {tariff.name} ({body.period_days}d)',
+                purchase_token=purchase.token,
+                return_url=return_url,
+            )
+        finally:
+            if bot:
+                await bot.session.close()
+
+        if payment_result is None:
+            await db.rollback()
+            raise HTTPException(
+                status_code=status.HTTP_502_BAD_GATEWAY,
+                detail='Payment provider is unavailable, please try again later',
+            )
+
+        payment_url = payment_result.get('payment_url')
+        if not payment_url:
+            await db.rollback()
+            logger.error(
+                'Gift payment created but no payment_url returned',
+                purchase_token=purchase.token[:5],
+                provider=payment_result.get('provider'),
+            )
+            raise HTTPException(
+                status_code=status.HTTP_502_BAD_GATEWAY,
+                detail='Payment provider returned an invalid response',
+            )
+
+        # Consume promo offer discount before committing gateway purchase
+        if consume_promo and getattr(user, 'promo_offer_discount_percent', 0):
+            user.promo_offer_discount_percent = 0
+            user.promo_offer_discount_source = None
+            user.promo_offer_discount_expires_at = None
+
+        await db.commit()
+        await db.refresh(purchase)
+
+        return GiftPurchaseResponse(
+            status='created',
+            purchase_token=purchase.token[:12],
+            payment_url=payment_url,
+            warning=recipient_warning,
+        )
+
+    # Balance mode (skip for 100% discount)
+    if price_kopeks > 0 and user.balance_kopeks < price_kopeks:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Insufficient balance',
+        )
+
+    # Create purchase record
+    balance_purchase_kwargs: dict = (
+        {
+            'gift_recipient_type': body.recipient_type,
+            'gift_recipient_value': body.recipient_value,
+            'gift_message': body.gift_message,
+        }
+        if has_recipient
+        else {
+            'gift_message': body.gift_message,
+        }
+    )
+
+    try:
+        purchase = await create_purchase(
+            db,
+            landing=None,
+            tariff=tariff,
+            period_days=body.period_days,
+            amount_kopeks=price_kopeks,
+            contact_type=buyer_contact_type,
+            contact_value=buyer_contact_value,
+            payment_method='balance',
+            is_gift=True,
+            source='cabinet',
+            buyer_user_id=user.id,
+            commit=False,
+            **balance_purchase_kwargs,
+        )
+    except GuestPurchaseError as exc:
+        raise HTTPException(status_code=exc.status_code, detail=exc.message) from exc
+
+    # Persist warning on purchase record
+    if recipient_warning:
+        purchase.recipient_warning = recipient_warning
+
+    # Subtract balance (consume promo offer if one was applied)
+    balance_ok = await subtract_user_balance(
+        db,
+        user,
+        price_kopeks,
+        description=f'Gift: {tariff.name} ({body.period_days}d)',
+        create_transaction=False,
+        consume_promo_offer=consume_promo,
+    )
+    if not balance_ok:
+        await db.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Insufficient balance',
+        )
+
+    # Transaction description: include recipient when specified
+    tx_description = f'Gift: {tariff.name} ({body.period_days}d)'
+    if has_recipient:
+        tx_description += f' -> {body.recipient_value}'
+
+    # Create transaction record
+    transaction = await create_transaction(
+        db,
+        user_id=user.id,
+        type=TransactionType.GIFT_PAYMENT,
+        amount_kopeks=price_kopeks,
+        description=tx_description,
+        payment_method=PaymentMethod.BALANCE,
+        commit=False,
+    )
+
+    # Mark purchase as paid
+    purchase.status = GuestPurchaseStatus.PAID.value
+    purchase.paid_at = datetime.now(UTC)
+
+    await db.commit()
+
+    # Emit deferred side-effects after atomic commit
+    await emit_transaction_side_effects(
+        db,
+        transaction,
+        amount_kopeks=price_kopeks,
+        user_id=user.id,
+        type=TransactionType.GIFT_PAYMENT,
+        payment_method=PaymentMethod.BALANCE,
+        description=tx_description,
+    )
+
+    # Capture token before fulfill_purchase — session state may change after rollback inside fulfill
+    purchase_token = purchase.token
+
+    # Only fulfill immediately when a specific recipient was provided.
+    # Code-only gifts (no recipient) stay in PAID status until someone activates via code.
+    if has_recipient:
+        try:
+            await fulfill_purchase(db, purchase_token, pre_resolved_telegram_id=pre_resolved_telegram_id)
+        except Exception:
+            logger.exception(
+                'Gift purchase fulfillment failed (purchase is paid, will retry)',
+                purchase_id=purchase.id,
+            )
+
+    return GiftPurchaseResponse(
+        status='ok',
+        purchase_token=purchase_token[:12],
+        warning=recipient_warning,
+    )
+
+
+@router.get('/pending', response_model=list[PendingGiftResponse])
+async def get_pending_gifts(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get pending gift purchases that the current user can activate."""
+    result = await db.execute(
+        select(GuestPurchase)
+        .options(selectinload(GuestPurchase.tariff))
+        .where(
+            GuestPurchase.user_id == user.id,
+            GuestPurchase.is_gift.is_(True),
+            GuestPurchase.status == GuestPurchaseStatus.PENDING_ACTIVATION.value,
+        )
+        .order_by(GuestPurchase.created_at.desc())
+        .limit(100)
+    )
+    purchases = result.scalars().all()
+
+    pending: list[PendingGiftResponse] = []
+    for p in purchases:
+        # Determine sender display name
+        sender_display = None
+        if p.contact_value:
+            sender_display = p.contact_value
+
+        pending.append(
+            PendingGiftResponse(
+                token=p.token[:12],
+                tariff_name=p.tariff.name if p.tariff else None,
+                period_days=p.period_days,
+                gift_message=p.gift_message,
+                sender_display=sender_display,
+                created_at=p.created_at,
+            )
+        )
+
+    return pending
+
+
+@router.get('/purchase/{token}', response_model=GiftPurchaseStatusResponse)
+async def get_gift_purchase_status(
+    token: str,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get the status of a cabinet gift purchase."""
+    if len(token) >= 64:
+        token_filter = GuestPurchase.token == token
+    else:
+        token_filter = GuestPurchase.token.startswith(token)
+
+    result = await db.execute(select(GuestPurchase).options(selectinload(GuestPurchase.tariff)).where(token_filter))
+    purchase = result.scalars().first()
+    if purchase is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Purchase not found',
+        )
+
+    # Uniform 404 prevents token existence oracle
+    if purchase.buyer_user_id != user.id:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Purchase not found',
+        )
+
+    tariff_name = purchase.tariff.name if purchase.tariff else None
+
+    recipient_contact_value = None
+    if purchase.gift_recipient_value:
+        recipient_contact_value = purchase.gift_recipient_value
+
+    is_code_only = purchase.is_gift and not purchase.gift_recipient_type
+
+    return GiftPurchaseStatusResponse(
+        status=purchase.status,
+        is_gift=True,
+        is_code_only=is_code_only,
+        purchase_token=purchase.token[:12] if is_code_only else None,
+        recipient_contact_value=recipient_contact_value,
+        gift_message=purchase.gift_message,
+        tariff_name=tariff_name,
+        period_days=purchase.period_days,
+        warning=purchase.recipient_warning,
+    )
+
+
+@router.get('/sent', response_model=list[SentGiftResponse])
+async def get_sent_gifts(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get all gifts the current user has sent."""
+    result = await db.execute(
+        select(GuestPurchase)
+        .options(selectinload(GuestPurchase.tariff), selectinload(GuestPurchase.user))
+        .where(
+            GuestPurchase.buyer_user_id == user.id,
+            GuestPurchase.is_gift.is_(True),
+        )
+        .order_by(GuestPurchase.created_at.desc())
+        .limit(100)
+    )
+    purchases = result.scalars().all()
+
+    sent: list[SentGiftResponse] = []
+    for p in purchases:
+        activated_by_username = None
+        if p.status == GuestPurchaseStatus.DELIVERED.value and p.user and p.user.username:
+            activated_by_username = f'@{p.user.username}'
+
+        sent.append(
+            SentGiftResponse(
+                token=p.token[:12],
+                tariff_name=p.tariff.name if p.tariff else None,
+                period_days=p.period_days,
+                device_limit=p.tariff.device_limit if p.tariff else 1,
+                status=p.status,
+                gift_recipient_value=p.gift_recipient_value,
+                gift_message=p.gift_message,
+                activated_by_username=activated_by_username,
+                created_at=p.created_at,
+            )
+        )
+
+    return sent
+
+
+@router.get('/received', response_model=list[ReceivedGiftResponse])
+async def get_received_gifts(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get all gifts the current user has received."""
+    result = await db.execute(
+        select(GuestPurchase)
+        .options(selectinload(GuestPurchase.tariff), selectinload(GuestPurchase.buyer))
+        .where(
+            GuestPurchase.user_id == user.id,
+            GuestPurchase.is_gift.is_(True),
+        )
+        .order_by(GuestPurchase.created_at.desc())
+        .limit(100)
+    )
+    purchases = result.scalars().all()
+
+    received: list[ReceivedGiftResponse] = []
+    for p in purchases:
+        sender_display = None
+        if p.buyer and p.buyer.username:
+            sender_display = f'@{p.buyer.username}'
+        elif p.contact_value:
+            sender_display = p.contact_value
+
+        received.append(
+            ReceivedGiftResponse(
+                token=p.token[:12],
+                tariff_name=p.tariff.name if p.tariff else None,
+                period_days=p.period_days,
+                device_limit=p.tariff.device_limit if p.tariff else 1,
+                status=p.status,
+                sender_display=sender_display,
+                gift_message=p.gift_message,
+                created_at=p.created_at,
+            )
+        )
+
+    return received
+
+
+@router.post('/activate', response_model=ActivateGiftResponse)
+async def activate_gift_by_code(
+    body: ActivateGiftRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Activate a gift subscription by its code (token)."""
+    from app.services.guest_purchase_service import activate_purchase as svc_activate
+
+    # Bug 2 fix: rate limit activation attempts to prevent brute-force token enumeration
+    is_limited = await RateLimitCache.is_rate_limited(user.id, 'gift_activate', limit=10, window=60)
+    if is_limited:
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    code = body.code.strip()
+    if code.upper().startswith('GIFT-') or code.upper().startswith('GIFT_'):
+        code = code[5:]
+
+    if len(code) < 8:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Code too short')
+
+    # Support both full token and prefix-based lookup (displayed codes are truncated)
+    if len(code) >= 64:
+        # Full token — exact match
+        token_filter = GuestPurchase.token == code
+    else:
+        # Prefix match — for short display codes like GIFT-XXXXXXXXXXXX
+        token_filter = GuestPurchase.token.startswith(code)
+
+    result = await db.execute(
+        select(GuestPurchase)
+        .options(selectinload(GuestPurchase.tariff))
+        .where(token_filter, GuestPurchase.is_gift.is_(True))
+        .with_for_update()
+    )
+    purchase = result.scalars().first()
+
+    if purchase is None or not purchase.is_gift:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Gift not found',
+        )
+
+    # Bug 1 fix: check ownership BEFORE leaking any status/tariff info
+    if purchase.user_id is not None and purchase.user_id != user.id:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Gift not found',
+        )
+
+    # Prevent self-activation: buyer cannot activate their own gift
+    if purchase.buyer_user_id is not None and purchase.buyer_user_id == user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Cannot activate your own gift',
+        )
+
+    if purchase.status == GuestPurchaseStatus.DELIVERED.value:
+        return ActivateGiftResponse(
+            status='activated',
+            tariff_name=purchase.tariff.name if purchase.tariff else None,
+            period_days=purchase.period_days,
+        )
+
+    # Code-only gifts are in PAID status; directed gifts are in PENDING_ACTIVATION
+    activatable_statuses = {
+        GuestPurchaseStatus.PENDING_ACTIVATION.value,
+        GuestPurchaseStatus.PAID.value,
+    }
+    if purchase.status not in activatable_statuses:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='This gift cannot be activated',
+        )
+
+    # For code-only gifts (user_id is None), link the purchase to the activating user
+    if purchase.user_id is None:
+        purchase.user_id = user.id
+
+    # Transition PAID → PENDING_ACTIVATION so activate_purchase() accepts it
+    if purchase.status == GuestPurchaseStatus.PAID.value:
+        purchase.status = GuestPurchaseStatus.PENDING_ACTIVATION.value
+
+    await db.flush()
+
+    try:
+        await svc_activate(db, purchase.token, skip_notification=True)
+    except GuestPurchaseError as exc:
+        raise HTTPException(status_code=exc.status_code, detail=exc.message) from exc
+
+    return ActivateGiftResponse(
+        status='activated',
+        tariff_name=purchase.tariff.name if purchase.tariff else None,
+        period_days=purchase.period_days,
+    )

app/cabinet/routes/info.py

@@ -91,7 +91,7 @@ class SupportConfigResponse(BaseModel):
     """Support/tickets configuration for miniapp."""
 
     tickets_enabled: bool
-    support_type: str  # "tickets", "profile", "url"
+    support_type: str  # "tickets", "profile", "url", "both"
     support_url: str | None = None
     support_username: str | None = None
 
@@ -160,7 +160,7 @@ async def get_rules(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Get service rules - uses same function as bot."""
-    requested_lang = language.split('-')[0].lower()
+    requested_lang = language.split('-', maxsplit=1)[0].lower()
 
     # Use the same function as bot to ensure consistent content
     content = await get_current_rules_content(db, requested_lang)
@@ -299,7 +299,7 @@ async def get_support_config():
         support_type = 'profile'
     else:  # both
         tickets_enabled = True
-        support_type = 'tickets'
+        support_type = 'both'
 
     return SupportConfigResponse(
         tickets_enabled=tickets_enabled,

app/cabinet/routes/landing.py

@@ -0,0 +1,696 @@
+"""Public landing page routes for guest quick-purchase flow."""
+
+import re
+from datetime import UTC, datetime, timedelta
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Path, Query, Request, status
+from pydantic import BaseModel, Field, model_validator
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.cabinet.dependencies import get_cabinet_db
+from app.cabinet.ip_utils import get_client_ip
+from app.cabinet.utils.locale import DEFAULT_LOCALE, resolve_locale_text
+from app.config import settings
+from app.database.crud.landing import get_active_landing_by_slug, get_purchase_by_token
+from app.database.models import GuestPurchase, GuestPurchaseStatus, LandingPage, Tariff
+from app.services.guest_purchase_service import (
+    GuestPurchaseError,
+    activate_purchase as activate_guest_purchase,
+    create_purchase,
+    validate_and_calculate,
+)
+from app.services.payment_method_config_service import _get_method_defaults
+from app.services.payment_service import PaymentService
+from app.utils.cache import RateLimitCache
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/landing', tags=['Landing Pages'])
+
+
+# ============ Schemas ============
+
+
+class LandingFeature(BaseModel):
+    icon: str = ''
+    title: str = ''
+    description: str = ''
+
+
+class LandingTariffPeriod(BaseModel):
+    days: int
+    label: str
+    price_kopeks: int
+    price_label: str
+    original_price_kopeks: int | None = None  # set if discount active
+    original_price_label: str | None = None
+    discount_percent: int | None = None  # effective discount for this tariff
+
+
+class LandingTariff(BaseModel):
+    id: int
+    name: str
+    description: str | None = None
+    traffic_limit_gb: int
+    device_limit: int
+    tier_level: int
+    periods: list[LandingTariffPeriod]
+
+
+class LandingPaymentMethodSubOption(BaseModel):
+    id: str
+    name: str
+
+
+class LandingPaymentMethod(BaseModel):
+    method_id: str
+    display_name: str
+    description: str | None = None
+    icon_url: str | None = None
+    sort_order: int = 0
+    min_amount_kopeks: int | None = None
+    max_amount_kopeks: int | None = None
+    currency: str | None = None
+    # Enabled sub-options with display labels (e.g. СБП, Карта).
+    # None or empty means no sub-option selection needed.
+    sub_options: list[LandingPaymentMethodSubOption] | None = None
+
+
+class LandingDiscountInfo(BaseModel):
+    percent: int  # default discount
+    ends_at: str  # ISO datetime
+    badge_text: str | None = None  # resolved locale text
+
+
+class LandingConfigResponse(BaseModel):
+    slug: str
+    title: str
+    subtitle: str | None = None
+    features: list[LandingFeature]
+    footer_text: str | None = None
+    tariffs: list[LandingTariff]
+    payment_methods: list[LandingPaymentMethod]
+    gift_enabled: bool
+    custom_css: str | None = None
+    meta_title: str | None = None
+    meta_description: str | None = None
+    discount: LandingDiscountInfo | None = None  # null if no active discount
+    background_config: dict | None = None
+
+
+_EMAIL_RE = re.compile(r'^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$')
+_TELEGRAM_RE = re.compile(r'^@?[a-zA-Z][a-zA-Z0-9_]{4,31}$')
+
+
+def _validate_contact(contact_type: str, contact_value: str) -> None:
+    """Validate contact value matches the declared type format."""
+    if contact_type == 'email' and not _EMAIL_RE.match(contact_value):
+        raise ValueError('Invalid email format')
+    if contact_type == 'telegram' and not _TELEGRAM_RE.match(contact_value):
+        raise ValueError('Invalid Telegram username format')
+
+
+class PurchaseRequest(BaseModel):
+    tariff_id: int
+    period_days: int
+    contact_type: str = Field(pattern=r'^(email|telegram)$')
+    contact_value: str = Field(min_length=1, max_length=255)
+    payment_method: str = Field(min_length=1, max_length=50, pattern=r'^[a-z0-9_]+$')
+    is_gift: bool = False
+    gift_recipient_type: str | None = Field(default=None, pattern=r'^(email|telegram)$')
+    gift_recipient_value: str | None = Field(default=None, max_length=255)
+    gift_message: str | None = Field(default=None, max_length=1000)
+
+    @model_validator(mode='after')
+    def validate_contacts(self) -> 'PurchaseRequest':
+        _validate_contact(self.contact_type, self.contact_value)
+        if self.is_gift:
+            if not self.gift_recipient_type or not self.gift_recipient_value:
+                raise ValueError('Gift recipient type and value are required for gift purchases')
+            _validate_contact(self.gift_recipient_type, self.gift_recipient_value)
+        return self
+
+
+class PurchaseResponse(BaseModel):
+    purchase_token: str
+    payment_url: str
+
+
+class PurchaseStatusResponse(BaseModel):
+    status: str
+    subscription_url: str | None = None
+    subscription_crypto_link: str | None = None
+    is_gift: bool = False
+    contact_value: str | None = None
+    recipient_contact_value: str | None = None
+    period_days: int | None = None
+    tariff_name: str | None = None
+    gift_message: str | None = None
+    contact_type: str | None = None
+    cabinet_email: str | None = None
+    cabinet_password: str | None = None
+    auto_login_token: str | None = None
+    recipient_in_bot: bool | None = None
+    bot_link: str | None = None
+
+
+# ============ Helpers ============
+
+
+def _mask_contact(value: str) -> str:
+    """Mask contact value to avoid leaking PII in API responses."""
+    if '@' in value and not value.startswith('@'):
+        # Email: show first 2 chars + mask + domain
+        local, domain = value.rsplit('@', 1)
+        return f'{local[:2]}***@{domain}'
+    if value.startswith('@'):
+        # Telegram: show first 3 chars + mask
+        return f'{value[:3]}***'
+    return value[:3] + '***'
+
+
+_SUBSCRIPTION_URL_EXPIRY_HOURS = 24
+
+
+def _build_purchase_status_response(purchase: GuestPurchase) -> PurchaseStatusResponse:
+    """Build a PurchaseStatusResponse from a GuestPurchase record."""
+    tariff_name = purchase.tariff.name if purchase.tariff else None
+
+    within_ttl = False
+    subscription_url = None
+    subscription_crypto_link = None
+    if purchase.delivered_at and purchase.subscription_url and not purchase.is_gift:
+        age = datetime.now(UTC) - purchase.delivered_at
+        if age < timedelta(hours=_SUBSCRIPTION_URL_EXPIRY_HOURS):
+            within_ttl = True
+            subscription_url = purchase.subscription_url
+            subscription_crypto_link = purchase.subscription_crypto_link
+
+    masked_contact = _mask_contact(purchase.contact_value) if purchase.contact_value else None
+
+    recipient_contact_value = None
+    gift_message = None
+    if purchase.is_gift:
+        if purchase.gift_recipient_value:
+            recipient_contact_value = _mask_contact(purchase.gift_recipient_value)
+        gift_message = purchase.gift_message
+
+    # Determine effective contact type for the recipient
+    if purchase.is_gift and purchase.gift_recipient_type:
+        effective_contact_type = purchase.gift_recipient_type
+    else:
+        effective_contact_type = purchase.contact_type
+
+    # Cabinet credentials for email self-purchases (not gifts)
+    cabinet_email = None
+    cabinet_password = None
+    auto_login_token = None
+    is_terminal = purchase.status in (GuestPurchaseStatus.DELIVERED.value, GuestPurchaseStatus.PENDING_ACTIVATION.value)
+    is_email_self_purchase = effective_contact_type == 'email' and not purchase.is_gift
+
+    if is_terminal and is_email_self_purchase:
+        cabinet_email = purchase.contact_value
+        # For PENDING_ACTIVATION: cap credential exposure at 72h from paid_at
+        pending_within_ttl = (
+            purchase.status == GuestPurchaseStatus.PENDING_ACTIVATION.value
+            and purchase.paid_at
+            and (datetime.now(UTC) - purchase.paid_at) < timedelta(hours=72)
+        )
+        if within_ttl or pending_within_ttl:
+            cabinet_password = purchase.cabinet_password
+            auto_login_token = purchase.auto_login_token
+
+    # For telegram gifts: indicate whether recipient is known to the bot
+    recipient_in_bot: bool | None = None
+    bot_link: str | None = None
+    if purchase.is_gift and effective_contact_type == 'telegram':
+        recipient_in_bot = purchase.user is not None and purchase.user.telegram_id is not None
+        if not recipient_in_bot:
+            bot_username = settings.get_bot_username()
+            if bot_username:
+                bot_link = f'https://t.me/{bot_username}'
+
+    return PurchaseStatusResponse(
+        status=purchase.status,
+        subscription_url=subscription_url,
+        subscription_crypto_link=subscription_crypto_link,
+        is_gift=purchase.is_gift,
+        contact_value=masked_contact,
+        recipient_contact_value=recipient_contact_value,
+        period_days=purchase.period_days,
+        tariff_name=tariff_name,
+        gift_message=gift_message,
+        contact_type=effective_contact_type,
+        cabinet_email=cabinet_email,
+        cabinet_password=cabinet_password,
+        auto_login_token=auto_login_token,
+        recipient_in_bot=recipient_in_bot,
+        bot_link=bot_link,
+    )
+
+
+def _period_label(days: int) -> str:
+    """Human-readable label for a period in days."""
+    if days == 1:
+        return '1 day'
+    if days <= 6:
+        return f'{days} days'
+    if days == 7:
+        return '1 week'
+    if days == 14:
+        return '2 weeks'
+    if days == 30:
+        return '1 month'
+    if days == 60:
+        return '2 months'
+    if days == 90:
+        return '3 months'
+    if days == 180:
+        return '6 months'
+    if days == 365:
+        return '1 year'
+    if days == 456:
+        return '1 year + 3 mo.'
+
+    months = days // 30
+    remainder = days % 30
+    if months > 0 and remainder == 0:
+        return f'{months} mo.'
+    if months > 0:
+        return f'{months} mo. + {remainder} d.'
+    return f'{days} days'
+
+
+def _get_active_discount(landing: LandingPage, lang: str) -> LandingDiscountInfo | None:
+    """Return discount info if currently active, else None."""
+    if not landing.discount_percent or not landing.discount_starts_at or not landing.discount_ends_at:
+        return None
+    now = datetime.now(UTC)
+    if not (landing.discount_starts_at <= now < landing.discount_ends_at):
+        return None
+    badge = resolve_locale_text(landing.discount_badge_text, lang) if landing.discount_badge_text else None
+    return LandingDiscountInfo(
+        percent=landing.discount_percent,
+        ends_at=landing.discount_ends_at.isoformat(),
+        badge_text=badge or None,
+    )
+
+
+async def _load_landing_tariffs(
+    db: AsyncSession, landing: LandingPage, discount: LandingDiscountInfo | None = None
+) -> list[LandingTariff]:
+    """Load tariffs for a landing page, filtered by allowed IDs and periods."""
+    allowed_ids = landing.allowed_tariff_ids or []
+    if not allowed_ids:
+        return []
+
+    result = await db.execute(
+        select(Tariff)
+        .where(Tariff.id.in_(allowed_ids), Tariff.is_active.is_(True))
+        .order_by(Tariff.display_order, Tariff.id)
+    )
+    tariffs = result.scalars().all()
+
+    allowed_periods = landing.allowed_periods or {}
+    landing_tariffs = []
+
+    for tariff in tariffs:
+        # Determine which periods to show
+        tariff_period_override = allowed_periods.get(str(tariff.id))
+        if tariff_period_override is not None:
+            period_days_list = sorted(tariff_period_override)
+        else:
+            period_days_list = tariff.get_available_periods()
+
+        periods = []
+        for days in period_days_list:
+            price = tariff.get_price_for_period(days)
+            if price is None:
+                continue
+
+            original_price_kopeks = None
+            original_price_label = None
+            effective_discount = None
+
+            if discount:
+                # Per-tariff override takes priority (read from landing model, not response DTO)
+                overrides = landing.discount_overrides or {}
+                tariff_override = overrides.get(str(tariff.id))
+                effective_discount = tariff_override if tariff_override is not None else discount.percent
+                original_price_kopeks = price
+                original_price_label = settings.format_price(price)
+                from app.services.pricing_engine import PricingEngine
+
+                price = max(1, PricingEngine.apply_discount(price, effective_discount))
+
+            periods.append(
+                LandingTariffPeriod(
+                    days=days,
+                    label=_period_label(days),
+                    price_kopeks=price,
+                    price_label=settings.format_price(price),
+                    original_price_kopeks=original_price_kopeks,
+                    original_price_label=original_price_label,
+                    discount_percent=effective_discount,
+                )
+            )
+
+        if not periods:
+            continue
+
+        landing_tariffs.append(
+            LandingTariff(
+                id=tariff.id,
+                name=tariff.name,
+                description=tariff.description,
+                traffic_limit_gb=tariff.traffic_limit_gb,
+                device_limit=tariff.device_limit,
+                tier_level=tariff.tier_level,
+                periods=periods,
+            )
+        )
+
+    return landing_tariffs
+
+
+# ============ Routes ============
+
+# IMPORTANT: /purchase/{token} must come BEFORE /{slug} to avoid shadowing
+# (FastAPI checks routes in definition order; "purchase" would match {slug})
+
+
+@router.get('/purchase/{token}', response_model=PurchaseStatusResponse)
+async def get_purchase_status(
+    token: str,
+    raw_request: Request,
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get the status of a guest purchase by token.
+
+    No authentication required.
+    """
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'purchase_status', limit=30, window=60, fail_closed=True):
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    purchase = await get_purchase_by_token(db, token)
+    if purchase is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Purchase not found',
+        )
+
+    response = _build_purchase_status_response(purchase)
+
+    # Cleanup: null expired credentials from DB
+    needs_cleanup = False
+    if purchase.delivered_at and (purchase.cabinet_password or purchase.auto_login_token):
+        age = datetime.now(UTC) - purchase.delivered_at
+        if age >= timedelta(hours=_SUBSCRIPTION_URL_EXPIRY_HOURS):
+            needs_cleanup = True
+    elif (
+        purchase.status == GuestPurchaseStatus.PENDING_ACTIVATION.value
+        and purchase.paid_at
+        and (purchase.cabinet_password or purchase.auto_login_token)
+        and (datetime.now(UTC) - purchase.paid_at) >= timedelta(hours=72)
+    ):
+        needs_cleanup = True
+
+    if needs_cleanup:
+        purchase.cabinet_password = None
+        purchase.auto_login_token = None
+        await db.commit()
+
+    return response
+
+
+@router.post('/activate/{token}', response_model=PurchaseStatusResponse)
+async def activate_purchase(
+    token: str,
+    raw_request: Request,
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Activate a pending guest purchase, replacing the user's current subscription.
+
+    No authentication required (token is the secret).
+    """
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'activate_purchase', limit=5, window=60, fail_closed=True):
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    try:
+        purchase = await activate_guest_purchase(db, token)
+    except GuestPurchaseError as exc:
+        raise HTTPException(status_code=exc.status_code, detail=exc.message) from exc
+
+    return _build_purchase_status_response(purchase)
+
+
+@router.get('/{slug}', response_model=LandingConfigResponse)
+async def get_landing_config(
+    raw_request: Request,
+    slug: str = Path(max_length=100),
+    lang: str = Query(DEFAULT_LOCALE, max_length=5, description='Locale: ru, en, zh, fa'),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get public landing page configuration with tariffs and payment methods.
+
+    No authentication required. Pass ``?lang=en`` to get localized text.
+    """
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'landing_config', limit=60, window=60, fail_closed=True):
+        raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail='Too many requests')
+
+    landing = await get_active_landing_by_slug(db, slug)
+    if landing is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Landing page not found',
+        )
+
+    discount = _get_active_discount(landing, lang)
+    tariffs = await _load_landing_tariffs(db, landing, discount)
+
+    # Build payment methods from landing config
+    raw_methods = landing.payment_methods or []
+    method_defaults = _get_method_defaults()
+
+    payment_methods: list[LandingPaymentMethod] = []
+    for m in raw_methods:
+        method_id = m.get('method_id', '')
+        raw_sub_options = m.get('sub_options')  # dict[str, bool] | None
+
+        # Resolve sub-options: filter enabled ones and attach display names
+        resolved_sub_options: list[LandingPaymentMethodSubOption] | None = None
+        method_def = method_defaults.get(method_id)
+        available = method_def.get('available_sub_options') if method_def else None
+        if available:
+            resolved = []
+            for opt in available:
+                opt_id = opt['id']
+                # If landing has explicit sub_options config, respect it; otherwise all enabled
+                if raw_sub_options is None or raw_sub_options.get(opt_id, True):
+                    resolved.append(LandingPaymentMethodSubOption(id=opt_id, name=opt['name']))
+            if resolved:
+                resolved_sub_options = resolved
+
+        payment_methods.append(
+            LandingPaymentMethod(
+                method_id=method_id,
+                display_name=m.get('display_name', ''),
+                description=m.get('description'),
+                icon_url=m.get('icon_url'),
+                sort_order=m.get('sort_order', 0),
+                min_amount_kopeks=m.get('min_amount_kopeks'),
+                max_amount_kopeks=m.get('max_amount_kopeks'),
+                currency=m.get('currency'),
+                sub_options=resolved_sub_options,
+            )
+        )
+
+    # Resolve locale dicts to flat strings for the requested language
+    features = [
+        LandingFeature(
+            icon=f.get('icon', ''),
+            title=resolve_locale_text(f.get('title'), lang),
+            description=resolve_locale_text(f.get('description'), lang),
+        )
+        for f in (landing.features or [])
+    ]
+
+    return LandingConfigResponse(
+        slug=landing.slug,
+        title=resolve_locale_text(landing.title, lang),
+        subtitle=resolve_locale_text(landing.subtitle, lang) or None,
+        features=features,
+        footer_text=resolve_locale_text(landing.footer_text, lang) or None,
+        tariffs=tariffs,
+        payment_methods=payment_methods,
+        gift_enabled=landing.gift_enabled,
+        custom_css=landing.custom_css,
+        meta_title=resolve_locale_text(landing.meta_title, lang) or None,
+        meta_description=resolve_locale_text(landing.meta_description, lang) or None,
+        discount=discount,
+        background_config=landing.background_config,
+    )
+
+
+@router.post('/{slug}/purchase', response_model=PurchaseResponse)
+async def create_landing_purchase(
+    slug: str,
+    body: PurchaseRequest,
+    raw_request: Request,
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Create a guest purchase on a landing page.
+
+    No authentication required.
+    """
+    client_ip = get_client_ip(raw_request)
+    if await RateLimitCache.is_ip_rate_limited(client_ip, 'landing_purchase', limit=30, window=60, fail_closed=True):
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail='Too many purchase attempts, please try again later',
+        )
+
+    landing = await get_active_landing_by_slug(db, slug)
+    if landing is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Landing page not found',
+        )
+
+    if body.is_gift and not landing.gift_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Gift purchases are not enabled for this landing page',
+        )
+
+    # Validate payment method is available on this landing.
+    # The frontend may send a suffixed method ID (e.g. "platega_2", "yookassa_sbp")
+    # to select a specific sub-option. We match against the base method_id and
+    # validate the suffix against known & enabled sub-options.
+    raw_methods = landing.payment_methods or []
+    method_defaults = _get_method_defaults()
+
+    method_config = next((m for m in raw_methods if m.get('method_id') == body.payment_method), None)
+    if method_config is None:
+        # Try matching by prefix: "platega_2" → base "platega"
+        # Sort by length descending so "freekassa_sbp" is checked before "freekassa"
+        sorted_methods = sorted(raw_methods, key=lambda m: len(m.get('method_id', '')), reverse=True)
+        for m in sorted_methods:
+            mid = m.get('method_id', '')
+            if body.payment_method.startswith(mid + '_'):
+                suffix = body.payment_method[len(mid) + 1 :]
+                # Validate suffix is a known sub-option
+                method_def = method_defaults.get(mid)
+                available = (method_def.get('available_sub_options') if method_def else None) or []
+                valid_ids = {opt['id'] for opt in available}
+                if suffix not in valid_ids:
+                    break  # invalid suffix → reject
+                # Validate suffix is enabled on this landing
+                raw_sub_options = m.get('sub_options')  # dict[str, bool] | None
+                if raw_sub_options is not None and not raw_sub_options.get(suffix, True):
+                    break  # disabled sub-option → reject
+                method_config = m
+                break
+    if method_config is None:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Payment method is not available on this landing page',
+        )
+
+    # Validate tariff + period + calculate price
+    try:
+        tariff, amount_kopeks = await validate_and_calculate(db, landing, body.tariff_id, body.period_days)
+    except GuestPurchaseError as exc:
+        raise HTTPException(status_code=exc.status_code, detail=exc.message) from exc
+
+    # Gift purchases require the tariff to be visible in the gift section
+    if body.is_gift and not tariff.show_in_gift:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='This tariff is not available for gift purchases',
+        )
+
+    # Validate amount against per-method min/max limits (before creating purchase record)
+    min_amount = method_config.get('min_amount_kopeks')
+    max_amount = method_config.get('max_amount_kopeks')
+    if min_amount is not None and amount_kopeks < min_amount:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Amount is below the minimum ({settings.format_price(min_amount)}) for this payment method',
+        )
+    if max_amount is not None and amount_kopeks > max_amount:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Amount exceeds the maximum ({settings.format_price(max_amount)}) for this payment method',
+        )
+
+    # Create purchase record (no commit yet — wait for payment creation)
+    purchase = await create_purchase(
+        db,
+        landing=landing,
+        tariff=tariff,
+        period_days=body.period_days,
+        amount_kopeks=amount_kopeks,
+        contact_type=body.contact_type,
+        contact_value=body.contact_value,
+        payment_method=body.payment_method,
+        is_gift=body.is_gift,
+        gift_recipient_type=body.gift_recipient_type,
+        gift_recipient_value=body.gift_recipient_value,
+        gift_message=body.gift_message,
+        commit=False,
+    )
+
+    # Determine return URL: per-method override → default cabinet URL
+    cabinet_base = (settings.CABINET_URL or '').rstrip('/')
+    default_return_url = f'{cabinet_base}/buy/success/{purchase.token}'
+    method_return_url = method_config.get('return_url')
+    if method_return_url:
+        # Allow {token} placeholder in custom return URLs
+        return_url = method_return_url.replace('{token}', purchase.token)
+    else:
+        return_url = default_return_url
+
+    payment_service = PaymentService()
+    payment_result = await payment_service.create_guest_payment(
+        db=db,
+        amount_kopeks=amount_kopeks,
+        payment_method=body.payment_method,
+        description=f'{tariff.name} — {body.period_days}d',
+        purchase_token=purchase.token,
+        return_url=return_url,
+    )
+
+    if payment_result is None:
+        await db.rollback()
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail='Payment provider is unavailable, please try again later',
+        )
+
+    payment_url = payment_result.get('payment_url')
+    if not payment_url:
+        await db.rollback()
+        logger.error(
+            'Payment created but no payment_url returned',
+            purchase_token=purchase.token[:5],
+            provider=payment_result.get('provider'),
+        )
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail='Payment provider returned an invalid response',
+        )
+
+    await db.commit()
+    await db.refresh(purchase)
+
+    return PurchaseResponse(
+        purchase_token=purchase.token,
+        payment_url=payment_url,
+    )

app/cabinet/routes/media.py

@@ -3,13 +3,11 @@
 import mimetypes
 
 import structlog
-from aiogram import Bot
-from aiogram.client.default import DefaultBotProperties
-from aiogram.enums import ParseMode
 from aiogram.types import BufferedInputFile
 from fastapi import APIRouter, Depends, File, Form, HTTPException, Request, Response, UploadFile, status
 from pydantic import BaseModel
 
+from app.bot_factory import create_bot
 from app.config import settings
 from app.database.models import User
 
@@ -98,10 +96,7 @@ async def upload_media(
     target_chat_id = _resolve_target_chat_id()
     upload = BufferedInputFile(file_bytes, filename=file.filename or 'upload')
 
-    bot = Bot(
-        token=settings.BOT_TOKEN,
-        default=DefaultBotProperties(parse_mode=ParseMode.HTML),
-    )
+    bot = create_bot()
 
     try:
         if media_type_normalized == 'photo':
@@ -158,10 +153,7 @@ async def download_media(
     Download media file by file_id.
     Used to display images/documents in ticket messages.
     """
-    bot = Bot(
-        token=settings.BOT_TOKEN,
-        default=DefaultBotProperties(parse_mode=ParseMode.HTML),
-    )
+    bot = create_bot()
 
     try:
         file = await bot.get_file(file_id)

app/cabinet/routes/news.py

@@ -0,0 +1,177 @@
+"""Public news routes for cabinet - user-facing news/blog section."""
+
+import time
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Path, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.crud.news import (
+    get_news_article_by_slug,
+    get_news_categories,
+    get_published_news,
+    get_published_news_count,
+    increment_views,
+)
+from app.database.models import NewsArticle, User
+
+from ..dependencies import get_cabinet_db, get_current_cabinet_user
+from ..schemas.news import (
+    NewsArticleListItem,
+    NewsArticleResponse,
+    NewsListResponse,
+)
+
+
+logger = structlog.get_logger(__name__)
+
+# Slug constraint: alphanumeric, hyphens, underscores, max 500 chars
+_SLUG_MAX_LENGTH: int = 500
+_SLUG_PATTERN: str = r'^[a-zA-Z0-9_-]+$'
+
+# --- View counter deduplication ---
+# In-memory TTL cache to prevent a single user from inflating view counts.
+# Key: (user_id, article_id), Value: timestamp of last counted view.
+# Views from the same user on the same article within _VIEW_DEDUP_SECONDS are ignored.
+_VIEW_DEDUP_SECONDS: int = 300  # 5 minutes
+_VIEW_DEDUP_MAX_SIZE: int = 10_000  # max entries before eviction
+_view_dedup_cache: dict[tuple[int, int], float] = {}
+
+
+def _should_count_view(user_id: int, article_id: int) -> bool:
+    """Return True if this view should be counted (not a duplicate within TTL)."""
+    now = time.monotonic()
+    key = (user_id, article_id)
+    last_seen = _view_dedup_cache.get(key)
+
+    if last_seen is not None and (now - last_seen) < _VIEW_DEDUP_SECONDS:
+        return False
+
+    # Evict stale entries if cache grows too large
+    if len(_view_dedup_cache) >= _VIEW_DEDUP_MAX_SIZE:
+        cutoff = now - _VIEW_DEDUP_SECONDS
+        stale_keys = [k for k, v in _view_dedup_cache.items() if v < cutoff]
+        for k in stale_keys:
+            del _view_dedup_cache[k]
+
+    _view_dedup_cache[key] = now
+    return True
+
+
+router = APIRouter(prefix='/news', tags=['Cabinet News'])
+
+
+def _article_to_response(article: NewsArticle, *, include_content: bool = True) -> dict[str, Any]:
+    """Convert NewsArticle ORM instance to response dict.
+
+    ``author_name`` is only resolved when ``include_content=True`` (single-article
+    detail view) because the author relationship is not eagerly loaded for list
+    queries -- accessing it there would trigger a lazy-load or raise
+    ``MissingGreenlet`` in async context.
+    """
+    data: dict[str, Any] = {
+        'id': article.id,
+        'title': article.title,
+        'slug': article.slug,
+        'excerpt': article.excerpt,
+        'category': article.category,
+        'category_color': article.category_color,
+        'tag': article.tag,
+        'featured_image_url': article.featured_image_url,
+        'is_published': article.is_published,
+        'is_featured': article.is_featured,
+        'published_at': article.published_at,
+        'read_time_minutes': article.read_time_minutes,
+        'views_count': article.views_count,
+    }
+
+    if include_content:
+        author_name: str | None = None
+        if article.author:
+            author_name = article.author.first_name or article.author.username or f'#{article.author.id}'
+        data['content'] = article.content
+        data['author_name'] = author_name
+        data['created_at'] = article.created_at
+        data['updated_at'] = article.updated_at
+
+    return data
+
+
+# NOTE: /categories MUST be declared before /{slug} to avoid route conflict
+@router.get('/categories', response_model=list[str])
+async def list_categories(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> list[str]:
+    """Get list of distinct news categories."""
+    try:
+        return await get_news_categories(db)
+    except Exception:
+        logger.exception('Failed to get news categories')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load categories',
+        )
+
+
+@router.get('', response_model=NewsListResponse)
+async def list_published_news(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    category: str | None = Query(None, max_length=100),
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+) -> NewsListResponse:
+    """Get paginated list of published news articles.
+
+    SQLAlchemy AsyncSession does not support concurrent operations, so
+    queries run sequentially.
+    """
+    try:
+        articles = await get_published_news(db, category=category, limit=limit, offset=offset)
+        total = await get_published_news_count(db, category=category)
+        categories = await get_news_categories(db)
+
+        items = [NewsArticleListItem(**_article_to_response(a, include_content=False)) for a in articles]
+
+        return NewsListResponse(items=items, total=total, categories=categories)
+    except HTTPException:
+        raise
+    except Exception:
+        logger.exception('Failed to list published news')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load news',
+        )
+
+
+@router.get('/{slug}', response_model=NewsArticleResponse)
+async def get_article_by_slug(
+    slug: str = Path(..., max_length=_SLUG_MAX_LENGTH, pattern=_SLUG_PATTERN),
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> NewsArticleResponse:
+    """Get a single published news article by slug. Increments view count."""
+    article = await get_news_article_by_slug(db, slug)
+
+    if not article or not article.is_published:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Article not found',
+        )
+
+    # Build response dict while session attributes are still loaded.
+    # increment_views() calls db.commit() which expires all ORM attributes;
+    # accessing them afterwards triggers lazy-load → MissingGreenlet in async.
+    response_data = _article_to_response(article, include_content=True)
+
+    # Increment views with per-user deduplication (5-min TTL).
+    if _should_count_view(user.id, article.id):
+        try:
+            new_count = await increment_views(db, article.id)
+            response_data['views_count'] = new_count
+        except Exception:
+            logger.warning('Failed to increment views', article_id=article.id)
+
+    return NewsArticleResponse(**response_data)

app/cabinet/routes/oauth.py

@@ -24,6 +24,7 @@ from ..auth.oauth_providers import (
     validate_oauth_state,
 )
 from ..dependencies import get_cabinet_db
+from ..routes.account_linking import OAuthProviderName
 from ..schemas.auth import AuthResponse
 from .auth import _create_auth_response, _process_campaign_bonus, _store_refresh_token
 
@@ -39,6 +40,8 @@ async def _finalize_oauth_login(
     provider: str,
     campaign_slug: str | None = None,
     referral_code: str | None = None,
+    *,
+    is_new_user: bool = False,
 ) -> AuthResponse:
     """Update last login, create tokens, store refresh token."""
     user.cabinet_last_login = datetime.now(UTC)
@@ -46,10 +49,10 @@ async def _finalize_oauth_login(
     auth_response = await _create_auth_response(user, db)
     await _store_refresh_token(db, user.id, auth_response.refresh_token, device_info=f'oauth:{provider}')
 
-    # Process referral code (before campaign bonus, which may also set referrer)
+    # Process referral code (only for new users — existing users cannot be assigned a referrer)
     from .auth import _process_referral_code, _user_to_response
 
-    await _process_referral_code(db, user, referral_code)
+    await _process_referral_code(db, user, referral_code, is_new_user=is_new_user)
 
     auth_response.campaign_bonus = await _process_campaign_bonus(db, user, campaign_slug)
     if auth_response.campaign_bonus:
@@ -75,12 +78,15 @@ class OAuthAuthorizeResponse(BaseModel):
 
 
 class OAuthCallbackRequest(BaseModel):
-    code: str = Field(..., description='Authorization code from provider')
-    state: str = Field(..., description='CSRF state token')
+    code: str = Field(..., min_length=1, max_length=2048, description='Authorization code from provider')
+    state: str = Field(..., min_length=1, max_length=128, description='CSRF state token')
+    device_id: str | None = Field(None, max_length=256, description='Device ID from VK ID callback')
     campaign_slug: str | None = Field(
         None, min_length=1, max_length=64, pattern=r'^[a-zA-Z0-9_-]+$', description='Campaign slug from web link'
     )
-    referral_code: str | None = Field(None, max_length=32, description='Referral code of inviter')
+    referral_code: str | None = Field(
+        None, max_length=32, pattern=r'^[a-zA-Z0-9_-]+$', description='Referral code of inviter'
+    )
 
 
 # --- Endpoints ---
@@ -99,48 +105,68 @@ async def get_oauth_providers():
 
 
 @router.get('/{provider}/authorize', response_model=OAuthAuthorizeResponse)
-async def get_oauth_authorize_url(provider: str):
+async def get_oauth_authorize_url(provider: OAuthProviderName):
     """Get authorization URL for an OAuth provider."""
     oauth_provider = get_provider(provider)
     if not oauth_provider:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'OAuth provider "{provider}" is not enabled',
+            detail='Requested OAuth provider is not available',
         )
 
-    state = await generate_oauth_state(provider)
-    authorize_url = oauth_provider.get_authorization_url(state)
+    # Generate extra state data (e.g., PKCE code_verifier for VK)
+    auth_extra = oauth_provider.prepare_auth_state()
+    state = await generate_oauth_state(provider, extra_data=auth_extra or None)
+    # Only pass URL-safe params (prefixed with _) to authorize URL; exclude secrets like code_verifier
+    url_params = {k: v for k, v in auth_extra.items() if k.startswith('_')} if auth_extra else {}
+    authorize_url = oauth_provider.get_authorization_url(state, **url_params)
 
     return OAuthAuthorizeResponse(authorize_url=authorize_url, state=state)
 
 
 @router.post('/{provider}/callback', response_model=AuthResponse)
 async def oauth_callback(
-    provider: str,
+    provider: OAuthProviderName,
     request: OAuthCallbackRequest,
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Handle OAuth callback: exchange code, find/create user, return JWT."""
-    # 1. Validate CSRF state
-    if not await validate_oauth_state(request.state, provider):
+    # 1. Validate CSRF state and retrieve stored data (e.g., PKCE code_verifier)
+    state_data = await validate_oauth_state(request.state, provider)
+    if not state_data:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail='Invalid or expired OAuth state',
         )
 
+    # 1b. Reject linking-flow state tokens (must use link_provider_callback instead)
+    if state_data.get('linking') == 'true':
+        logger.warning('Linking-flow state token used in login callback', provider=provider)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='OAuth state was initiated for account linking, not login',
+        )
+
     # 2. Get provider instance
     oauth_provider = get_provider(provider)
     if not oauth_provider:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'OAuth provider "{provider}" is not enabled',
+            detail='Requested OAuth provider is not available',
         )
 
-    # 3. Exchange code for tokens
+    # 3. Exchange code for tokens (pass PKCE code_verifier and device_id if present)
+    exchange_kwargs: dict[str, str] = {'state': request.state}
+    code_verifier = state_data.get('code_verifier')
+    if code_verifier:
+        exchange_kwargs['code_verifier'] = code_verifier
+    if request.device_id:
+        exchange_kwargs['device_id'] = request.device_id
+
     try:
-        token_data = await oauth_provider.exchange_code(request.code)
+        token_data = await oauth_provider.exchange_code(request.code, **exchange_kwargs)
     except Exception as exc:
-        logger.error('OAuth code exchange failed for', provider=provider, exc=exc)
+        logger.error('OAuth code exchange failed', provider=provider, exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail='Failed to exchange authorization code',
@@ -150,7 +176,7 @@ async def oauth_callback(
     try:
         user_info: OAuthUserInfo = await oauth_provider.get_user_info(token_data)
     except Exception as exc:
-        logger.error('OAuth user info fetch failed for', provider=provider, exc=exc)
+        logger.error('OAuth user info fetch failed', provider=provider, exc_info=True)
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail='Failed to fetch user information from provider',
@@ -159,7 +185,7 @@ async def oauth_callback(
     # 5. Find user by provider ID
     user = await get_user_by_oauth_provider(db, provider, user_info.provider_id)
     if user:
-        logger.info('OAuth login via for existing user', provider=provider, user_id=user.id)
+        logger.info('OAuth login for existing user', provider=provider, user_id=user.id)
         return await _finalize_oauth_login(db, user, provider, request.campaign_slug, request.referral_code)
 
     # 6. Find user by email (if verified) and link provider
@@ -167,7 +193,7 @@ async def oauth_callback(
         user = await get_user_by_email(db, user_info.email)
         if user:
             await set_user_oauth_provider_id(db, user, provider, user_info.provider_id)
-            logger.info('OAuth login via linked to existing email user', provider=provider, user_id=user.id)
+            logger.info('OAuth provider linked to existing email user', provider=provider, user_id=user.id)
             return await _finalize_oauth_login(db, user, provider, request.campaign_slug, request.referral_code)
 
     # 7. Resolve referral code for new user
@@ -190,8 +216,10 @@ async def oauth_callback(
                     )
                 else:
                     referrer_id = referrer.id
-        except Exception as e:
-            logger.warning('Failed to resolve referral code during OAuth', referral_code=request.referral_code, error=e)
+        except Exception:
+            logger.warning(
+                'Failed to resolve referral code during OAuth', referral_code=request.referral_code, exc_info=True
+            )
 
     # 8. Create new user
     user = await create_user_by_oauth(
@@ -205,5 +233,20 @@ async def oauth_callback(
         username=user_info.username,
         referred_by_id=referrer_id,
     )
-    logger.info('OAuth new user created via with id', provider=provider, user_id=user.id)
-    return await _finalize_oauth_login(db, user, provider, request.campaign_slug, request.referral_code)
+    logger.info('New OAuth user created', provider=provider, user_id=user.id)
+
+    # Commit user before panel sync (sync does its own commit/rollback)
+    await db.commit()
+
+    # Sync existing panel subscriptions by email (if verified)
+    if user_info.email and user_info.email_verified:
+        try:
+            from app.cabinet.routes.auth import _sync_subscription_from_panel_by_email
+
+            await _sync_subscription_from_panel_by_email(db, user)
+        except Exception:
+            logger.warning('Failed to sync panel subscription for new OAuth user', user_id=user.id, exc_info=True)
+
+    return await _finalize_oauth_login(
+        db, user, provider, request.campaign_slug, request.referral_code, is_new_user=True
+    )

app/cabinet/routes/partner_application.py

@@ -5,16 +5,24 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.cabinet.utils.links import get_campaign_deep_link, get_campaign_web_link
 from app.config import settings
 from app.database.models import AdvertisingCampaign, User
 from app.services.partner_application_service import partner_application_service
+from app.services.partner_stats_service import PartnerStatsService
 
 from ..dependencies import get_cabinet_db, get_current_cabinet_user
 from ..schemas.partners import (
+    CampaignReferralItem,
+    DailyStatItem,
     PartnerApplicationInfo,
     PartnerApplicationRequest,
+    PartnerCampaignDetailedStats,
     PartnerCampaignInfo,
     PartnerStatusResponse,
+    PeriodChange,
+    PeriodComparison,
+    PeriodStats,
 )
 
 
@@ -23,22 +31,6 @@ logger = structlog.get_logger(__name__)
 router = APIRouter(prefix='/referral/partner', tags=['Cabinet Partner'])
 
 
-def _get_campaign_deep_link(start_parameter: str) -> str | None:
-    """Generate Telegram deep link for campaign."""
-    bot_username = settings.get_bot_username()
-    if bot_username:
-        return f'https://t.me/{bot_username}?start={start_parameter}'
-    return None
-
-
-def _get_campaign_web_link(start_parameter: str) -> str | None:
-    """Generate web link for campaign."""
-    base_url = (settings.MINIAPP_CUSTOM_URL or '').rstrip('/')
-    if base_url:
-        return f'{base_url}/?campaign={start_parameter}'
-    return None
-
-
 @router.get('/status', response_model=PartnerStatusResponse)
 async def get_partner_status(
     user: User = Depends(get_current_cabinet_user),
@@ -57,6 +49,7 @@ async def get_partner_status(
             telegram_channel=latest_app.telegram_channel,
             description=latest_app.description,
             expected_monthly_referrals=latest_app.expected_monthly_referrals,
+            desired_commission_percent=latest_app.desired_commission_percent,
             admin_comment=latest_app.admin_comment,
             approved_commission_percent=latest_app.approved_commission_percent,
             created_at=latest_app.created_at,
@@ -76,7 +69,14 @@ async def get_partner_status(
                 AdvertisingCampaign.is_active.is_(True),
             )
         )
-        for c in result.scalars().all():
+        campaign_models = result.scalars().all()
+
+        # Fetch per-campaign stats in one batch
+        campaign_ids = [c.id for c in campaign_models]
+        campaign_stats = await PartnerStatsService.get_per_campaign_stats(db, user.id, campaign_ids)
+
+        for c in campaign_models:
+            stats = campaign_stats.get(c.id, {})
             campaigns.append(
                 PartnerCampaignInfo(
                     id=c.id,
@@ -86,8 +86,11 @@ async def get_partner_status(
                     balance_bonus_kopeks=c.balance_bonus_kopeks or 0,
                     subscription_duration_days=c.subscription_duration_days,
                     subscription_traffic_gb=c.subscription_traffic_gb,
-                    deep_link=_get_campaign_deep_link(c.start_parameter),
-                    web_link=_get_campaign_web_link(c.start_parameter),
+                    deep_link=get_campaign_deep_link(c.start_parameter),
+                    web_link=get_campaign_web_link(c.start_parameter),
+                    registrations_count=stats.get('registrations_count', 0),
+                    referrals_count=stats.get('referrals_count', 0),
+                    earnings_kopeks=stats.get('earnings_kopeks', 0),
                 )
             )
 
@@ -99,6 +102,56 @@ async def get_partner_status(
     )
 
 
+@router.get('/campaigns/{campaign_id}/stats', response_model=PartnerCampaignDetailedStats)
+async def get_campaign_stats(
+    campaign_id: int,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get detailed stats for a single campaign belonging to the current partner."""
+    if not user.is_partner:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Partner status required',
+        )
+
+    # Verify campaign belongs to this partner
+    campaign_result = await db.execute(
+        select(AdvertisingCampaign).where(
+            AdvertisingCampaign.id == campaign_id,
+            AdvertisingCampaign.partner_user_id == user.id,
+        )
+    )
+    campaign = campaign_result.scalar_one_or_none()
+    if not campaign:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Campaign not found or not assigned to you',
+        )
+
+    raw = await PartnerStatsService.get_campaign_detailed_stats(db, user.id, campaign_id)
+
+    return PartnerCampaignDetailedStats(
+        campaign_id=raw['campaign_id'],
+        campaign_name=campaign.name,
+        registrations_count=raw['registrations_count'],
+        referrals_count=raw['referrals_count'],
+        earnings_kopeks=raw['earnings_kopeks'],
+        conversion_rate=raw['conversion_rate'],
+        earnings_today=raw['earnings_today'],
+        earnings_week=raw['earnings_week'],
+        earnings_month=raw['earnings_month'],
+        daily_stats=[DailyStatItem(**d) for d in raw['daily_stats']],
+        period_comparison=PeriodComparison(
+            current=PeriodStats(**raw['period_comparison']['current']),
+            previous=PeriodStats(**raw['period_comparison']['previous']),
+            referrals_change=PeriodChange(**raw['period_comparison']['referrals_change']),
+            earnings_change=PeriodChange(**raw['period_comparison']['earnings_change']),
+        ),
+        top_referrals=[CampaignReferralItem(**r) for r in raw['top_referrals']],
+    )
+
+
 @router.post('/apply', response_model=PartnerApplicationInfo)
 async def apply_for_partner(
     request: PartnerApplicationRequest,
@@ -114,6 +167,7 @@ async def apply_for_partner(
         telegram_channel=request.telegram_channel,
         description=request.description,
         expected_monthly_referrals=request.expected_monthly_referrals,
+        desired_commission_percent=request.desired_commission_percent,
     )
 
     if not application:
@@ -124,12 +178,11 @@ async def apply_for_partner(
 
     # Уведомляем админов о новой заявке
     try:
-        from aiogram import Bot
-
+        from app.bot_factory import create_bot
         from app.services.admin_notification_service import AdminNotificationService
 
         if getattr(settings, 'ADMIN_NOTIFICATIONS_ENABLED', False) and settings.BOT_TOKEN:
-            bot = Bot(token=settings.BOT_TOKEN)
+            bot = create_bot()
             try:
                 notification_service = AdminNotificationService(bot)
                 await notification_service.send_partner_application_notification(
@@ -140,6 +193,7 @@ async def apply_for_partner(
                         'website_url': request.website_url,
                         'description': request.description,
                         'expected_monthly_referrals': request.expected_monthly_referrals,
+                        'desired_commission_percent': request.desired_commission_percent,
                     },
                 )
             finally:
@@ -155,6 +209,7 @@ async def apply_for_partner(
         telegram_channel=application.telegram_channel,
         description=application.description,
         expected_monthly_referrals=application.expected_monthly_referrals,
+        desired_commission_percent=application.desired_commission_percent,
         admin_comment=application.admin_comment,
         approved_commission_percent=application.approved_commission_percent,
         created_at=application.created_at,

app/cabinet/routes/promo.py

@@ -204,15 +204,11 @@ async def get_loyalty_tiers(
     total_spent_kopeks = await get_user_total_spent_kopeks(db, user.id)
     total_spent_rubles = total_spent_kopeks / 100
 
-    # Get user's current promo group
-    await db.refresh(user, ['promo_group', 'user_promo_groups'])
-    current_promo_group = user.get_primary_promo_group() if hasattr(user, 'get_primary_promo_group') else None
-    current_tier_name = current_promo_group.name if current_promo_group else None
-
     # Get all auto-assign promo groups (sorted by threshold ascending)
     auto_groups = await get_auto_assign_promo_groups(db)
 
     tiers: list[LoyaltyTierInfo] = []
+    current_tier_name: str | None = None
     next_tier_name: str | None = None
     next_tier_threshold: float | None = None
 
@@ -220,7 +216,15 @@ async def get_loyalty_tiers(
         threshold_kopeks = group.auto_assign_total_spent_kopeks or 0
         threshold_rubles = threshold_kopeks / 100
         is_achieved = total_spent_kopeks >= threshold_kopeks
-        is_current = current_promo_group and current_promo_group.id == group.id
+
+        # Track highest achieved tier as "current" (by spending, not by assignment)
+        if is_achieved:
+            current_tier_name = group.name
+
+        # Find next tier (first not achieved)
+        if not is_achieved and next_tier_name is None:
+            next_tier_name = group.name
+            next_tier_threshold = threshold_rubles
 
         # Get period discounts
         period_discounts = {}
@@ -241,15 +245,16 @@ async def get_loyalty_tiers(
                 traffic_discount_percent=group.traffic_discount_percent or 0,
                 device_discount_percent=group.device_discount_percent or 0,
                 period_discounts=period_discounts,
-                is_current=is_current,
+                is_current=False,
                 is_achieved=is_achieved,
             )
         )
 
-        # Find next tier (first not achieved)
-        if not is_achieved and next_tier_name is None:
-            next_tier_name = group.name
-            next_tier_threshold = threshold_rubles
+    # Mark only the highest achieved tier as "current"
+    for tier in reversed(tiers):
+        if tier.is_achieved:
+            tier.is_current = True
+            break
 
     # Calculate progress to next tier
     progress_percent = 0.0
@@ -304,7 +309,7 @@ async def claim_promo_offer(
 
     # Handle test access offers
     if effect_type == 'test_access':
-        await db.refresh(user, ['subscription'])
+        await db.refresh(user, ['subscriptions'])
         success, newly_added, expires_at, error_code = await promo_offer_service.grant_test_access(
             db,
             user,

app/cabinet/routes/promocode.py

@@ -20,6 +20,7 @@ class PromocodeActivateRequest(BaseModel):
     """Request to activate a promo code."""
 
     code: str = Field(..., min_length=1, max_length=50, description='Promo code to activate')
+    subscription_id: int | None = Field(None, description='Subscription ID for multi-tariff promo codes')
 
 
 class PromocodeActivateResponse(BaseModel):
@@ -41,7 +42,7 @@ class PromocodeDeactivateResponse(BaseModel):
     discount_percent: int = 0
 
 
-@router.post('/activate', response_model=PromocodeActivateResponse)
+@router.post('/activate')
 async def activate_promocode(
     request: PromocodeActivateRequest,
     user: User = Depends(get_current_cabinet_user),
@@ -50,7 +51,17 @@ async def activate_promocode(
     """Activate a promo code for the current user."""
     promocode_service = PromoCodeService()
 
-    result = await promocode_service.activate_promocode(db=db, user_id=user.id, code=request.code.strip())
+    result = await promocode_service.activate_promocode(
+        db=db, user_id=user.id, code=request.code.strip(), subscription_id=request.subscription_id
+    )
+
+    if result.get('error') == 'select_subscription':
+        return {
+            'success': False,
+            'error': 'select_subscription',
+            'eligible_subscriptions': result.get('eligible_subscriptions', []),
+            'code': result.get('code', request.code.strip()),
+        }
 
     if result['success']:
         balance_before_rubles = result.get('balance_before_kopeks', 0) / 100
@@ -68,10 +79,15 @@ async def activate_promocode(
     error_messages = {
         'not_found': 'Promo code not found',
         'expired': 'Promo code has expired',
+        'inactive': 'Promo code is deactivated',
+        'not_yet_valid': 'Promo code is not yet active',
         'used': 'Promo code has been fully used',
         'already_used_by_user': 'You have already used this promo code',
         'active_discount_exists': 'You already have an active discount. Deactivate it first via /deactivate-discount',
+        'no_subscription_for_days': 'This promo code requires an active or expired subscription',
+        'subscription_not_found': 'Subscription not found',
         'not_first_purchase': 'This promo code is only available for first purchase',
+        'daily_limit': 'Too many promo code activations today',
         'user_not_found': 'User not found',
         'server_error': 'Server error occurred',
     }

app/cabinet/routes/referral.py

@@ -9,7 +9,15 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
 from app.config import settings
-from app.database.models import AdvertisingCampaign, ReferralEarning, User
+from app.database.models import (
+    AdvertisingCampaign,
+    ReferralEarning,
+    Subscription,
+    SubscriptionStatus,
+    User,
+    WithdrawalRequest,
+    WithdrawalRequestStatus,
+)
 
 from ..dependencies import get_cabinet_db, get_current_cabinet_user
 from ..schemas.referral import (
@@ -38,12 +46,15 @@ async def get_referral_info(
     total_result = await db.execute(total_query)
     total_referrals = total_result.scalar() or 0
 
-    # Get active referrals (with subscription)
+    # Get active referrals (with active subscription right now)
     active_query = (
-        select(func.count())
-        .select_from(User)
-        .where(User.referred_by_id == user.id)
-        .where(User.has_had_paid_subscription == True)
+        select(func.count(func.distinct(User.id)))
+        .join(Subscription, User.id == Subscription.user_id)
+        .where(
+            User.referred_by_id == user.id,
+            Subscription.status == SubscriptionStatus.ACTIVE.value,
+            Subscription.end_date > func.now(),
+        )
     )
     active_result = await db.execute(active_query)
     active_referrals = active_result.scalar() or 0
@@ -60,18 +71,42 @@ async def get_referral_info(
     if commission_percent is None:
         commission_percent = settings.REFERRAL_COMMISSION_PERCENT
 
-    # Build referral link
-    bot_username = settings.get_bot_username() or 'bot'
-    referral_link = f'https://t.me/{bot_username}?start={user.referral_code}'
+    # Get withdrawn amount (approved + completed withdrawal requests)
+    withdrawn_query = select(func.coalesce(func.sum(WithdrawalRequest.amount_kopeks), 0)).where(
+        WithdrawalRequest.user_id == user.id,
+        WithdrawalRequest.status.in_([WithdrawalRequestStatus.APPROVED.value, WithdrawalRequestStatus.COMPLETED.value]),
+    )
+    withdrawn_result = await db.execute(withdrawn_query)
+    withdrawn = withdrawn_result.scalar() or 0
+
+    # Get pending withdrawal amount
+    pending_query = select(func.coalesce(func.sum(WithdrawalRequest.amount_kopeks), 0)).where(
+        WithdrawalRequest.user_id == user.id,
+        WithdrawalRequest.status == WithdrawalRequestStatus.PENDING.value,
+    )
+    pending_result = await db.execute(pending_query)
+    pending = pending_result.scalar() or 0
+
+    # Доступный баланс: мин(кошелёк, заработано - выведено - в ожидании)
+    referral_entitlement = max(0, total_earnings - withdrawn - pending)
+    available_balance = min(user.balance_kopeks, referral_entitlement)
+
+    # Build referral links
+    referral_link = (settings.get_cabinet_referral_link(user.referral_code) or '') if user.referral_code else ''
+    bot_referral_link = settings.get_bot_referral_link(user.referral_code) if user.referral_code else ''
 
     return ReferralInfoResponse(
         referral_code=user.referral_code or '',
         referral_link=referral_link,
+        bot_referral_link=bot_referral_link,
         total_referrals=total_referrals,
         active_referrals=active_referrals,
         total_earnings_kopeks=total_earnings,
         total_earnings_rubles=total_earnings / 100,
         commission_percent=commission_percent,
+        available_balance_kopeks=available_balance,
+        available_balance_rubles=available_balance / 100,
+        withdrawn_kopeks=withdrawn,
     )
 
 
@@ -84,7 +119,11 @@ async def get_referral_list(
 ):
     """Get list of invited users."""
     # Base query with eager loading of subscription relationship
-    query = select(User).options(selectinload(User.subscription)).where(User.referred_by_id == user.id)
+    query = (
+        select(User)
+        .options(selectinload(User.subscriptions).selectinload(Subscription.tariff))
+        .where(User.referred_by_id == user.id)
+    )
 
     # Get total count
     count_query = select(func.count()).select_from(User).where(User.referred_by_id == user.id)
@@ -104,7 +143,7 @@ async def get_referral_list(
             username=r.username,
             first_name=r.first_name,
             created_at=r.created_at,
-            has_subscription=r.subscription is not None,
+            has_subscription=bool(getattr(r, 'subscriptions', None)),
             has_paid=r.has_had_paid_subscription,
         )
         for r in referrals
@@ -209,5 +248,6 @@ async def get_referral_terms():
         first_topup_bonus_rubles=settings.REFERRAL_FIRST_TOPUP_BONUS_KOPEKS / 100,
         inviter_bonus_kopeks=settings.REFERRAL_INVITER_BONUS_KOPEKS,
         inviter_bonus_rubles=settings.REFERRAL_INVITER_BONUS_KOPEKS / 100,
+        max_commission_payments=settings.REFERRAL_MAX_COMMISSION_PAYMENTS,
         partner_section_visible=settings.REFERRAL_PARTNER_SECTION_VISIBLE,
     )

app/cabinet/routes/subscription_modules/__init__.py

@@ -0,0 +1,30 @@
+"""Subscription sub-modules for cabinet API.
+
+Each module contains a subset of endpoints from the original monolithic subscription.py.
+The main subscription.py includes all sub-routers for backward compatibility.
+"""
+
+from .autopay import router as autopay_router
+from .daily import router as daily_router
+from .devices import router as devices_router
+from .multi_tariff import router as multi_tariff_router
+from .purchase import router as purchase_router
+from .renewal import router as renewal_router
+from .servers import router as servers_router
+from .status import router as status_router
+from .tariff_switch import router as tariff_switch_router
+from .traffic import router as traffic_router
+
+
+__all__ = [
+    'autopay_router',
+    'daily_router',
+    'devices_router',
+    'multi_tariff_router',
+    'purchase_router',
+    'renewal_router',
+    'servers_router',
+    'status_router',
+    'tariff_switch_router',
+    'traffic_router',
+]

app/cabinet/routes/subscription_modules/autopay.py

@@ -0,0 +1,78 @@
+"""Autopay settings endpoint.
+
+PATCH /subscription/autopay
+"""
+
+from __future__ import annotations
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.models import User
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from ...schemas.subscription import AutopayUpdateRequest
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.patch('/autopay')
+async def update_autopay(
+    request: AutopayUpdateRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = Query(None, description='Subscription ID for multi-tariff'),
+):
+    """Update autopay settings."""
+    from .helpers import resolve_subscription
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+
+    if request.enabled:
+        # Classic subscriptions cannot use autopay when tariff mode is enabled
+        from app.config import settings
+
+        if settings.is_tariffs_mode() and not subscription.tariff_id:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Autopay is not available for classic subscriptions. Please purchase a tariff.',
+            )
+
+        # Триальные подписки — пробник, автопродление не имеет смысла
+        if subscription.is_trial:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Autopay is not available for trial subscriptions',
+            )
+
+        # Суточные подписки имеют свой механизм продления (DailySubscriptionService),
+        # глобальный autopay для них запрещён
+        await db.refresh(subscription, ['tariff'])
+        if subscription.tariff and getattr(subscription.tariff, 'is_daily', False):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Autopay is not available for daily subscriptions',
+            )
+
+    subscription.autopay_enabled = request.enabled
+
+    if request.days_before is not None:
+        subscription.autopay_days_before = request.days_before
+
+    await db.commit()
+
+    return {
+        'message': 'Autopay settings updated',
+        'autopay_enabled': subscription.autopay_enabled,
+        'autopay_days_before': subscription.autopay_days_before,
+    }

app/cabinet/routes/subscription_modules/daily.py

@@ -0,0 +1,183 @@
+"""Daily subscription management endpoints.
+
+POST /subscription/pause
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query as QueryParam, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.tariff import get_tariff_by_id
+from app.database.models import User
+from app.services.subscription_service import SubscriptionService
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from .helpers import resolve_subscription
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.post('/pause')
+async def toggle_subscription_pause(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Toggle pause/resume for daily subscription."""
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+
+    tariff_id = getattr(subscription, 'tariff_id', None)
+    if not tariff_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Subscription has no tariff',
+        )
+
+    tariff = await get_tariff_by_id(db, tariff_id)
+    if not tariff or not getattr(tariff, 'is_daily', False):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Pause is only available for daily tariffs',
+        )
+
+    # Determine current state
+    from app.database.models import SubscriptionStatus
+
+    is_currently_paused = getattr(subscription, 'is_daily_paused', False)
+    was_disabled = subscription.status in (
+        SubscriptionStatus.DISABLED.value,
+        SubscriptionStatus.EXPIRED.value,
+        SubscriptionStatus.LIMITED.value,
+    )
+
+    # System-DISABLED subs (insufficient balance) should always be treated as needing resume,
+    # even if is_daily_paused is False (it's set by the system, not the user)
+    if was_disabled and not is_currently_paused:
+        new_paused_state = False  # Force resume path
+    else:
+        new_paused_state = not is_currently_paused
+
+    raw_daily_price = getattr(tariff, 'daily_price_kopeks', 0)
+
+    # Lock user BEFORE discount computation to prevent TOCTOU on promo group
+    # IMPORTANT: must happen BEFORE modifying subscription — lock_user_for_pricing
+    # reloads subscriptions via selectinload which resets in-memory changes
+    from app.database.crud.user import lock_user_for_pricing
+
+    user = await lock_user_for_pricing(db, user.id)
+
+    # Re-fetch subscription after lock (selectinload may have replaced the ORM object)
+    subscription = await resolve_subscription(db, user, subscription_id)
+    if not subscription:
+        raise HTTPException(status_code=404, detail='Subscription not found after lock')
+
+    subscription.is_daily_paused = new_paused_state
+
+    # Apply group discount to daily price (consistent with DailySubscriptionService and miniapp resume)
+    from app.services.pricing_engine import PricingEngine
+
+    promo_group = PricingEngine.resolve_promo_group(user)
+    daily_group_pct = promo_group.get_discount_percent('period', 1) if promo_group else 0
+    daily_price = (
+        PricingEngine.apply_discount(raw_daily_price, daily_group_pct) if daily_group_pct > 0 else raw_daily_price
+    )
+
+    # If resuming, check balance and charge
+    if not new_paused_state:
+        if daily_price > 0 and user.balance_kopeks < daily_price:
+            raise HTTPException(
+                status_code=status.HTTP_402_PAYMENT_REQUIRED,
+                detail={
+                    'code': 'insufficient_balance',
+                    'message': 'Insufficient balance to resume daily subscription',
+                    'required': daily_price,
+                    'balance': user.balance_kopeks,
+                },
+            )
+
+        # Charge daily fee FIRST, then restore ACTIVE status
+        if was_disabled:
+            if daily_price > 0:
+                from app.database.crud.user import subtract_user_balance
+
+                deducted = await subtract_user_balance(
+                    db,
+                    user,
+                    daily_price,
+                    f'Суточная оплата тарифа «{tariff.name}» (возобновление)',
+                    mark_as_paid_subscription=True,
+                )
+                if not deducted:
+                    raise HTTPException(
+                        status_code=status.HTTP_402_PAYMENT_REQUIRED,
+                        detail={
+                            'code': 'insufficient_balance',
+                            'message': 'Balance deduction failed',
+                            'required': daily_price,
+                            'balance': user.balance_kopeks,
+                        },
+                    )
+
+                from app.database.crud.transaction import create_transaction
+                from app.database.models import TransactionType
+
+                try:
+                    await create_transaction(
+                        db=db,
+                        user_id=user.id,
+                        type=TransactionType.SUBSCRIPTION_PAYMENT,
+                        amount_kopeks=daily_price,
+                        description=f'Суточная оплата тарифа «{tariff.name}» (возобновление)',
+                    )
+                except Exception as exc:
+                    logger.warning('Failed to create resume transaction', error=exc)
+
+            # Balance deducted successfully — now activate
+            subscription.status = SubscriptionStatus.ACTIVE.value
+            subscription.last_daily_charge_at = datetime.now(UTC)
+            subscription.end_date = datetime.now(UTC) + timedelta(days=1)
+
+    await db.commit()
+    await db.refresh(subscription)
+    await db.refresh(user)
+
+    # Sync with RemnaWave only when resuming from DISABLED state
+    if not new_paused_state and was_disabled:
+        try:
+            subscription_service = SubscriptionService()
+            await subscription_service.create_remnawave_user(
+                db,
+                subscription,
+                reset_traffic=False,
+                reset_reason=None,
+            )
+        except Exception as e:
+            logger.error('Error syncing RemnaWave user on resume', error=e)
+
+    if new_paused_state:
+        message = 'Daily subscription paused'
+    else:
+        message = 'Daily subscription resumed'
+
+    return {
+        'success': True,
+        'message': message,
+        'is_paused': new_paused_state,
+        'balance_kopeks': user.balance_kopeks,
+        'balance_label': settings.format_price(user.balance_kopeks),
+    }

app/cabinet/routes/subscription_modules/helpers.py

@@ -0,0 +1,234 @@
+"""Shared helper functions for subscription modules."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from typing import TYPE_CHECKING, Any
+
+import structlog
+
+from app.config import settings
+
+
+if TYPE_CHECKING:
+    from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.models import Subscription, User
+
+from ...schemas.subscription import (
+    ServerInfo,
+    SubscriptionResponse,
+)
+
+
+logger = structlog.get_logger(__name__)
+
+
+async def resolve_subscription(
+    db: AsyncSession,
+    user: User,
+    subscription_id: int | None,
+) -> Subscription | None:
+    """Resolve target subscription: by ID in multi-tariff mode, or legacy fallback.
+
+    Args:
+        db: Database session.
+        user: Current user.
+        subscription_id: Optional subscription ID (from query param).
+
+    Returns:
+        Target Subscription or None if not found.
+
+    Raises:
+        HTTPException: If subscription_id provided but not found for this user.
+    """
+    from fastapi import HTTPException
+
+    from app.database.crud.subscription import get_subscription_by_id_for_user
+
+    if subscription_id and settings.is_multi_tariff_enabled():
+        subscription = await get_subscription_by_id_for_user(db, subscription_id, user.id)
+        if not subscription:
+            raise HTTPException(status_code=404, detail='Subscription not found')
+        return subscription
+
+    if settings.is_multi_tariff_enabled() and not subscription_id:
+        from app.database.crud.subscription import get_active_subscriptions_by_user_id
+
+        active_subs = await get_active_subscriptions_by_user_id(db, user.id)
+        if active_subs:
+            non_daily = [s for s in active_subs if not getattr(s, 'is_daily_tariff', False)]
+            pool = non_daily or active_subs
+            return max(pool, key=lambda s: s.days_left)
+        return None
+
+    await db.refresh(user, ['subscriptions'])
+    return user.subscription
+
+
+def _get_addon_discount_percent(
+    user: User | None,
+    category: str,
+    period_days_hint: int | None = None,
+) -> int:
+    """Get addon discount percent for user — delegates to PricingEngine."""
+    from app.services.pricing_engine import PricingEngine
+
+    return PricingEngine.get_addon_discount_percent(user, category, period_days_hint)
+
+
+def _apply_addon_discount(
+    user: User,
+    category: str,
+    amount: int,
+    period_days: int | None = None,
+) -> dict[str, int]:
+    """Apply addon discount to amount.
+
+    Returns dict with keys: discounted, discount, percent
+    """
+    from app.utils.pricing_utils import apply_percentage_discount
+
+    percent = _get_addon_discount_percent(user, category, period_days)
+    if percent <= 0 or amount <= 0:
+        return {'discounted': amount, 'discount': 0, 'percent': 0}
+
+    discounted_amount, discount_value = apply_percentage_discount(amount, percent)
+    return {
+        'discounted': discounted_amount,
+        'discount': discount_value,
+        'percent': percent,
+    }
+
+
+def _subscription_to_response(
+    subscription: Subscription,
+    servers: list[ServerInfo] | None = None,
+    tariff_name: str | None = None,
+    traffic_purchases: list[dict[str, Any]] | None = None,
+    user: User | None = None,
+) -> SubscriptionResponse:
+    """Convert Subscription model to response."""
+    now = datetime.now(UTC)
+
+    # Use actual_status property for correct status (same as bot uses)
+    actual_status = subscription.actual_status
+    is_expired = actual_status == 'expired'
+    is_active = actual_status in ('active', 'trial')
+    is_limited = actual_status == 'limited'
+
+    # Calculate time remaining
+    days_left = 0
+    hours_left = 0
+    minutes_left = 0
+    time_left_display = ''
+
+    if subscription.end_date and not is_expired:
+        time_delta = subscription.end_date - now
+        total_seconds = max(0, int(time_delta.total_seconds()))
+
+        days_left = total_seconds // 86400  # 86400 seconds in a day
+        remaining_seconds = total_seconds % 86400
+        hours_left = remaining_seconds // 3600
+        minutes_left = (remaining_seconds % 3600) // 60
+
+        # Create human-readable display
+        if days_left > 0:
+            time_left_display = f'{days_left}d {hours_left}h'
+        elif hours_left > 0:
+            time_left_display = f'{hours_left}h {minutes_left}m'
+        elif minutes_left > 0:
+            time_left_display = f'{minutes_left}m'
+        else:
+            time_left_display = '0m'
+    else:
+        time_left_display = '0m'
+
+    traffic_limit_gb = subscription.traffic_limit_gb or 0
+    traffic_used_gb = subscription.traffic_used_gb or 0.0
+
+    if traffic_limit_gb > 0:
+        traffic_used_percent = min(100, (traffic_used_gb / traffic_limit_gb) * 100)
+    else:
+        traffic_used_percent = 0
+
+    # Check if this is a daily tariff
+    is_daily_paused = getattr(subscription, 'is_daily_paused', False) or False
+    tariff_id = getattr(subscription, 'tariff_id', None)
+
+    # Use subscription's is_daily_tariff property if available
+    is_daily = False
+    daily_price_kopeks = None
+
+    if hasattr(subscription, 'is_daily_tariff'):
+        is_daily = subscription.is_daily_tariff
+    elif tariff_id and hasattr(subscription, 'tariff') and subscription.tariff:
+        is_daily = getattr(subscription.tariff, 'is_daily', False)
+
+    # Get daily_price_kopeks, tariff_name, traffic_reset_mode from tariff
+    traffic_reset_mode = None
+    if tariff_id and hasattr(subscription, 'tariff') and subscription.tariff:
+        daily_price_kopeks = getattr(subscription.tariff, 'daily_price_kopeks', None)
+        # Применяем скидку промогруппы + promo-offer для отображения
+        if daily_price_kopeks and daily_price_kopeks > 0 and user:
+            from app.services.pricing_engine import PricingEngine
+            from app.utils.promo_offer import get_user_active_promo_discount_percent
+
+            _promo_group = user.get_primary_promo_group() if hasattr(user, 'get_primary_promo_group') else None
+            _group_pct = _promo_group.get_discount_percent('period', 1) if _promo_group else 0
+            _offer_pct = get_user_active_promo_discount_percent(user)
+            if _group_pct > 0 or _offer_pct > 0:
+                daily_price_kopeks, _, _ = PricingEngine.apply_stacked_discounts(
+                    daily_price_kopeks, _group_pct, _offer_pct
+                )
+        if not tariff_name:  # Only set if not passed as parameter
+            tariff_name = getattr(subscription.tariff, 'name', None)
+        traffic_reset_mode = (
+            getattr(subscription.tariff, 'traffic_reset_mode', None) or settings.DEFAULT_TRAFFIC_RESET_STRATEGY
+        )
+
+    # Calculate next daily charge time (24 hours after last charge)
+    next_daily_charge_at = None
+    if is_daily and not is_daily_paused:
+        last_charge = getattr(subscription, 'last_daily_charge_at', None)
+        if last_charge:
+            next_charge = last_charge + timedelta(days=1)
+            # Если время списания уже прошло — не показываем (DailySubscriptionService обработает)
+            if next_charge > datetime.now(UTC):
+                next_daily_charge_at = next_charge
+
+    # Проверяем настройку скрытия ссылки (скрывается только текст, кнопки работают)
+    hide_link = settings.should_hide_subscription_link()
+
+    return SubscriptionResponse(
+        id=subscription.id,
+        status=actual_status,  # Use actual_status instead of raw status
+        is_trial=subscription.is_trial or actual_status == 'trial',
+        start_date=subscription.start_date,
+        end_date=subscription.end_date,
+        days_left=days_left,
+        hours_left=hours_left,
+        minutes_left=minutes_left,
+        time_left_display=time_left_display,
+        traffic_limit_gb=traffic_limit_gb,
+        traffic_used_gb=round(traffic_used_gb, 2),
+        traffic_used_percent=round(traffic_used_percent, 1),
+        device_limit=subscription.device_limit or 0,
+        connected_squads=subscription.connected_squads or [],
+        servers=servers or [],
+        autopay_enabled=subscription.autopay_enabled or False,
+        autopay_days_before=subscription.autopay_days_before or 3,
+        subscription_url=subscription.subscription_url,
+        hide_subscription_link=hide_link,
+        is_active=is_active,
+        is_expired=is_expired,
+        is_limited=is_limited,
+        traffic_purchases=traffic_purchases or [],
+        is_daily=is_daily,
+        is_daily_paused=is_daily_paused,
+        daily_price_kopeks=daily_price_kopeks,
+        next_daily_charge_at=next_daily_charge_at,
+        tariff_id=tariff_id,
+        tariff_name=tariff_name,
+        traffic_reset_mode=traffic_reset_mode,
+    )

app/cabinet/routes/subscription_modules/multi_tariff.py

@@ -0,0 +1,156 @@
+"""Multi-tariff subscription endpoints for cabinet API.
+
+GET /subscriptions — list all user subscriptions (multi-tariff)
+GET /subscriptions/{id} — get specific subscription details
+"""
+
+from __future__ import annotations
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.subscription import (
+    decrement_subscription_server_counts,
+    get_all_subscriptions_by_user_id,
+    get_subscription_by_id_for_user,
+)
+from app.database.models import SubscriptionStatus, User
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix='/subscriptions', tags=['Cabinet Multi-Tariff'], redirect_slashes=False)
+
+
+class SubscriptionListItem(BaseModel):
+    id: int
+    status: str
+    tariff_id: int | None = None
+    tariff_name: str | None = None
+    traffic_limit_gb: int = 0
+    traffic_used_gb: float = 0.0
+    device_limit: int = 1
+    end_date: str | None = None
+    subscription_url: str | None = None
+    subscription_crypto_link: str | None = None
+    is_trial: bool = False
+    is_daily: bool = False
+    is_daily_paused: bool = False
+    autopay_enabled: bool = False
+    connected_squads: list[str] | None = None
+
+
+class SubscriptionsListResponse(BaseModel):
+    subscriptions: list[SubscriptionListItem]
+    multi_tariff_enabled: bool
+
+
+def _subscription_to_list_item(sub) -> SubscriptionListItem:
+    tariff_name = None
+    if sub.tariff:
+        tariff_name = sub.tariff.name
+
+    return SubscriptionListItem(
+        id=sub.id,
+        status=sub.actual_status,
+        tariff_id=sub.tariff_id,
+        tariff_name=tariff_name,
+        traffic_limit_gb=sub.traffic_limit_gb or 0,
+        traffic_used_gb=sub.traffic_used_gb or 0.0,
+        device_limit=sub.device_limit or 1,
+        end_date=sub.end_date.isoformat() if sub.end_date else None,
+        subscription_url=sub.subscription_url,
+        subscription_crypto_link=sub.subscription_crypto_link,
+        is_trial=sub.is_trial or False,
+        is_daily=bool(sub.tariff and getattr(sub.tariff, 'is_daily', False)),
+        is_daily_paused=bool(getattr(sub, 'is_daily_paused', False)),
+        autopay_enabled=sub.autopay_enabled or False,
+        connected_squads=sub.connected_squads,
+    )
+
+
+@router.get('', response_model=SubscriptionsListResponse)
+async def list_subscriptions(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> SubscriptionsListResponse:
+    """List all user subscriptions. Returns all subscriptions regardless of multi-tariff mode."""
+    subscriptions = await get_all_subscriptions_by_user_id(db, user.id)
+    items = [_subscription_to_list_item(sub) for sub in subscriptions]
+    return SubscriptionsListResponse(
+        subscriptions=items,
+        multi_tariff_enabled=settings.is_multi_tariff_enabled(),
+    )
+
+
+@router.get('/{subscription_id}', response_model=SubscriptionListItem)
+async def get_subscription_detail(
+    subscription_id: int,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> SubscriptionListItem:
+    """Get specific subscription details with ownership check."""
+    subscription = await get_subscription_by_id_for_user(db, subscription_id, user.id)
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Subscription not found',
+        )
+    return _subscription_to_list_item(subscription)
+
+
+@router.delete('/{subscription_id}')
+async def delete_subscription(
+    subscription_id: int,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+) -> dict:
+    """Delete an expired/disabled subscription. Active subscriptions cannot be deleted."""
+    subscription = await get_subscription_by_id_for_user(db, subscription_id, user.id)
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Subscription not found',
+        )
+
+    # Only expired/disabled subscriptions can be deleted
+    deletable_statuses = {
+        SubscriptionStatus.EXPIRED.value,
+        SubscriptionStatus.DISABLED.value,
+    }
+    if getattr(subscription, 'actual_status', subscription.status) not in deletable_statuses:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Only expired or disabled subscriptions can be deleted',
+        )
+
+    # Delete from RemnaWave panel (stops webhooks / phantom notifications)
+    if subscription.remnawave_uuid:
+        try:
+            from app.services.subscription_service import SubscriptionService
+
+            service = SubscriptionService()
+            await service.delete_remnawave_user(subscription.remnawave_uuid)
+        except Exception as e:
+            logger.warning('Failed to delete RemnaWave user on subscription delete', error=e)
+
+    # Decrement server counts
+    await decrement_subscription_server_counts(db, subscription)
+
+    # Delete the subscription
+    await db.delete(subscription)
+    await db.commit()
+
+    logger.info(
+        'Subscription deleted by user',
+        subscription_id=subscription_id,
+        user_id=user.id,
+        tariff_id=subscription.tariff_id,
+    )
+
+    return {'message': 'Subscription deleted'}

app/cabinet/routes/subscription_modules/renewal.py

@@ -0,0 +1,269 @@
+"""Subscription renewal endpoints.
+
+GET /subscription/renewal-options
+POST /subscription/renew
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.tariff import get_tariff_by_id
+from app.database.models import PaymentMethod, SubscriptionStatus, User
+from app.services.pricing_engine import pricing_engine
+from app.services.subscription_renewal_service import (
+    SubscriptionRenewalChargeError,
+    SubscriptionRenewalService,
+)
+from app.services.user_cart_service import user_cart_service
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from ...schemas.subscription import (
+    RenewalOptionResponse,
+    RenewalRequest,
+)
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.get('/renewal-options', response_model=list[RenewalOptionResponse])
+async def get_renewal_options(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = Query(None, description='Subscription ID for multi-tariff'),
+):
+    """Get available subscription renewal options with prices."""
+    from .helpers import resolve_subscription
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+    if not subscription:
+        return []
+
+    # Classic subscriptions cannot be renewed when tariff mode is enabled
+    if settings.is_tariffs_mode() and not subscription.tariff_id:
+        return []
+
+    _non_renewable = {SubscriptionStatus.DISABLED.value, SubscriptionStatus.PENDING.value}
+    _actual_status = getattr(subscription, 'actual_status', subscription.status)
+    if _actual_status in _non_renewable:
+        return []
+
+    # Determine available periods
+    if subscription.tariff_id and subscription.tariff and subscription.tariff.period_prices:
+        periods = sorted(int(k) for k in subscription.tariff.period_prices.keys())
+    else:
+        periods = settings.get_available_renewal_periods()
+
+    options = []
+
+    for period in periods:
+        pricing = await pricing_engine.calculate_renewal_price(db, subscription, period, user=user)
+
+        if pricing.final_total <= 0 and pricing.original_total <= 0:
+            continue
+
+        original_price = pricing.original_total
+        combined_discount = 0
+        if original_price > 0 and original_price != pricing.final_total:
+            combined_discount = int((original_price - pricing.final_total) * 100 / original_price)
+
+        options.append(
+            RenewalOptionResponse(
+                period_days=period,
+                price_kopeks=pricing.final_total,
+                price_rubles=pricing.final_total / 100,
+                discount_percent=combined_discount,
+                original_price_kopeks=original_price if combined_discount > 0 else None,
+            )
+        )
+
+    return options
+
+
+@router.post('/renew')
+async def renew_subscription(
+    request: RenewalRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = Query(None, description='Subscription ID for multi-tariff'),
+):
+    """Renew subscription (pay from balance)."""
+    if getattr(user, 'restriction_subscription', False):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Subscription renewal is restricted for this account',
+        )
+
+    # Support subscription_id from both query param and body (backward compat)
+    from .helpers import resolve_subscription
+
+    _sub_id = subscription_id or request.subscription_id
+    subscription = await resolve_subscription(db, user, _sub_id)
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+
+    # Classic subscriptions cannot be renewed when tariff mode is enabled
+    if settings.is_tariffs_mode() and not subscription.tariff_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Classic subscriptions cannot be renewed. Please purchase a tariff.',
+        )
+
+    _non_renewable = {SubscriptionStatus.DISABLED.value, SubscriptionStatus.PENDING.value}
+    _actual_status = getattr(subscription, 'actual_status', subscription.status)
+    if _actual_status in _non_renewable:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Cannot renew subscription with status: {_actual_status}',
+        )
+
+    if subscription.tariff_id and subscription.tariff and subscription.tariff.period_prices:
+        available_periods = [int(p) for p in subscription.tariff.period_prices.keys()]
+    else:
+        available_periods = settings.get_available_renewal_periods()
+
+    if request.period_days not in available_periods:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Selected renewal period is not available',
+        )
+
+    # Lock user row to prevent TOCTOU on promo-offer state
+    from app.database.crud.user import lock_user_for_pricing
+
+    user = await lock_user_for_pricing(db, user.id)
+
+    # Unified pricing via PricingEngine
+    pricing = await pricing_engine.calculate_renewal_price(
+        db,
+        subscription,
+        request.period_days,
+        user=user,
+    )
+    price_kopeks = pricing.final_total
+    promo_offer_discount_value = pricing.promo_offer_discount
+    promo_offer_discount_percent = pricing.breakdown.get('offer_discount_pct', 0)
+
+    if price_kopeks <= 0 and pricing.original_total <= 0:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid renewal period',
+        )
+
+    original_price_kopeks = pricing.original_total
+    discount_percent = 0
+    if original_price_kopeks > 0 and original_price_kopeks != price_kopeks:
+        discount_percent = int((original_price_kopeks - price_kopeks) * 100 / original_price_kopeks)
+
+    tariff = subscription.tariff if subscription.tariff_id else None
+
+    # Check balance (skip for 100% discount)
+    if price_kopeks > 0 and user.balance_kopeks < price_kopeks:
+        missing = price_kopeks - user.balance_kopeks
+
+        # Get tariff info for cart
+        tariff_id = subscription.tariff_id
+        tariff_name = None
+        tariff_traffic_limit_gb = None
+        tariff_allowed_squads = None
+
+        if tariff_id:
+            tariff = await get_tariff_by_id(db, tariff_id)
+            if tariff:
+                tariff_name = tariff.name
+                tariff_traffic_limit_gb = tariff.traffic_limit_gb
+                tariff_allowed_squads = tariff.allowed_squads or []
+
+        # Save cart for auto-purchase after balance top-up
+        cart_data: dict[str, Any] = {
+            'cart_mode': 'extend',
+            'subscription_id': subscription.id,
+            'tariff_id': tariff_id,
+            'period_days': request.period_days,
+            'total_price': price_kopeks,
+            'user_id': user.id,
+            'saved_cart': True,
+            'missing_amount': missing,
+            'return_to_cart': True,
+            'description': f'Продление подписки на {request.period_days} дней'
+            + (f' ({tariff_name})' if tariff_name else ''),
+            'discount_percent': discount_percent,
+            'consume_promo_offer': promo_offer_discount_value > 0,
+            'source': 'cabinet',
+        }
+
+        # Add subscription parameters for auto-purchase
+        if tariff_id:
+            cart_data['traffic_limit_gb'] = tariff_traffic_limit_gb
+            # Сохраняем актуальный device_limit подписки (включая докупленные устройства)
+            cart_data['device_limit'] = subscription.device_limit
+            cart_data['allowed_squads'] = tariff_allowed_squads
+        else:
+            # Classic mode: сохраняем текущие параметры подписки для корректной автопокупки
+            cart_data['device_limit'] = subscription.device_limit
+            cart_data['traffic_limit_gb'] = subscription.traffic_limit_gb
+
+        try:
+            await user_cart_service.save_user_cart(user.id, cart_data)
+            logger.info('Cart saved for auto-renewal (cabinet) user', user_id=user.id)
+        except Exception as e:
+            logger.error('Error saving cart for auto-renewal (cabinet)', error=e)
+
+        raise HTTPException(
+            status_code=status.HTTP_402_PAYMENT_REQUIRED,
+            detail={
+                'code': 'insufficient_funds',
+                'message': f'Недостаточно средств. Не хватает {settings.format_price(missing)}',
+                'missing_amount': missing,
+                'cart_saved': True,
+                'cart_mode': 'extend',
+            },
+        )
+
+    # Centralized renewal: balance deduction, extension, RemnaWave sync, admin notification,
+    # server price recording, and compensating refund on failure.
+    renewal_description = f'Продление подписки на {request.period_days} дней' + (f' ({tariff.name})' if tariff else '')
+    renewal_service = SubscriptionRenewalService()
+
+    try:
+        result = await renewal_service.finalize(
+            db,
+            user,
+            subscription,
+            pricing,
+            description=renewal_description,
+            payment_method=PaymentMethod.BALANCE,
+        )
+    except SubscriptionRenewalChargeError:
+        raise HTTPException(
+            status_code=status.HTTP_402_PAYMENT_REQUIRED,
+            detail={
+                'code': 'insufficient_funds',
+                'message': 'Недостаточно средств (concurrent check)',
+            },
+        )
+
+    response: dict[str, Any] = {
+        'message': 'Subscription renewed successfully',
+        'new_end_date': result.subscription.end_date.isoformat(),
+        'amount_paid_kopeks': price_kopeks,
+    }
+
+    # Add discount info to response
+    if promo_offer_discount_value > 0:
+        response['promo_discount_percent'] = promo_offer_discount_percent
+        response['promo_discount_amount_kopeks'] = promo_offer_discount_value
+        response['original_price_kopeks'] = original_price_kopeks
+
+    return response

app/cabinet/routes/subscription_modules/servers.py

@@ -0,0 +1,261 @@
+"""Server/country management endpoints.
+
+GET /subscription/countries
+POST /subscription/countries
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query as QueryParam, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database.models import User
+from app.services.subscription_service import SubscriptionService
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from .helpers import resolve_subscription
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.get('/countries')
+async def get_available_countries(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Get available countries/servers for the user."""
+    from app.database.crud.server_squad import get_available_server_squads
+    from app.utils.pricing_utils import apply_percentage_discount, calculate_prorated_price
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    promo_group_id = user.promo_group_id
+    available_servers = await get_available_server_squads(db, promo_group_id=promo_group_id)
+
+    connected_squads = []
+    days_left = 0
+    if subscription:
+        connected_squads = subscription.connected_squads or []
+        if subscription.end_date:
+            delta = subscription.end_date - datetime.now(UTC)
+            days_left = max(0, delta.days)
+
+    # Get discount from promo group via PricingEngine (respects apply_discounts_to_addons flag)
+    from app.services.pricing_engine import PricingEngine
+
+    servers_discount_percent = PricingEngine.get_addon_discount_percent(user, 'servers', None)
+
+    countries = []
+    for server in available_servers:
+        base_price = server.price_kopeks
+
+        # Apply discount
+        if servers_discount_percent > 0:
+            discounted_price, _ = apply_percentage_discount(base_price, servers_discount_percent)
+        else:
+            discounted_price = base_price
+
+        # Calculate prorated price if subscription exists
+        prorated_price = discounted_price
+        if subscription and subscription.end_date:
+            prorated_price, _ = calculate_prorated_price(
+                discounted_price,
+                subscription.end_date,
+            )
+
+        countries.append(
+            {
+                'uuid': server.squad_uuid,
+                'name': server.display_name,
+                'country_code': server.country_code,
+                'base_price_kopeks': base_price,
+                'price_kopeks': prorated_price,  # Prorated price with discount
+                'price_per_month_kopeks': discounted_price,  # Monthly price with discount
+                'price_rubles': prorated_price / 100,
+                'is_available': server.is_available and not server.is_full,
+                'is_connected': server.squad_uuid in connected_squads,
+                'has_discount': servers_discount_percent > 0,
+                'discount_percent': servers_discount_percent,
+            }
+        )
+
+    return {
+        'countries': countries,
+        'connected_count': len(connected_squads),
+        'has_subscription': subscription is not None,
+        'days_left': days_left,
+        'discount_percent': servers_discount_percent,
+    }
+
+
+@router.post('/countries')
+async def update_countries(
+    request: dict[str, Any],
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Update subscription countries/servers."""
+    from app.database.crud.server_squad import add_user_to_servers, get_available_server_squads, get_server_ids_by_uuids
+    from app.database.crud.subscription import add_subscription_servers
+    from app.database.crud.transaction import create_transaction
+    from app.database.crud.user import subtract_user_balance
+    from app.database.models import TransactionType
+    from app.utils.pricing_utils import apply_percentage_discount, calculate_prorated_price
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+
+    if subscription.is_trial:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Country management is not available for trial subscriptions',
+        )
+
+    selected_countries = request.get('countries', [])
+    if not selected_countries:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='At least one country must be selected',
+        )
+
+    current_countries = subscription.connected_squads or []
+    promo_group_id = user.promo_group_id
+
+    available_servers = await get_available_server_squads(db, promo_group_id=promo_group_id)
+    allowed_country_ids = {server.squad_uuid for server in available_servers}
+
+    # Validate selected countries
+    for country_uuid in selected_countries:
+        if country_uuid not in allowed_country_ids:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f'Country {country_uuid} is not available',
+            )
+
+    added = [c for c in selected_countries if c not in current_countries]
+    removed = [c for c in current_countries if c not in selected_countries]
+
+    if not added and not removed:
+        return {
+            'message': 'No changes detected',
+            'connected_squads': current_countries,
+        }
+
+    # Lock user row to prevent TOCTOU on promo-offer state
+    from app.database.crud.user import lock_user_for_pricing
+
+    user = await lock_user_for_pricing(db, user.id)
+
+    # Calculate cost for added servers
+    total_cost = 0
+    added_names = []
+    removed_names = []
+
+    from app.services.pricing_engine import PricingEngine
+
+    servers_discount_percent = PricingEngine.get_addon_discount_percent(user, 'servers', None)
+
+    added_server_prices = []
+
+    for server in available_servers:
+        if server.squad_uuid in added:
+            server_price_per_month = server.price_kopeks
+            if servers_discount_percent > 0:
+                discounted_per_month, _ = apply_percentage_discount(
+                    server_price_per_month,
+                    servers_discount_percent,
+                )
+            else:
+                discounted_per_month = server_price_per_month
+
+            charged_price, charged_days = calculate_prorated_price(
+                discounted_per_month,
+                subscription.end_date,
+            )
+
+            total_cost += charged_price
+            added_names.append(server.display_name)
+            added_server_prices.append(charged_price)
+
+        if server.squad_uuid in removed:
+            removed_names.append(server.display_name)
+
+    # Check balance
+    if total_cost > 0 and user.balance_kopeks < total_cost:
+        raise HTTPException(
+            status_code=status.HTTP_402_PAYMENT_REQUIRED,
+            detail=f'Insufficient balance. Need {total_cost / 100:.2f} RUB, have {user.balance_kopeks / 100:.2f} RUB',
+        )
+
+    # Deduct balance and update subscription
+    if added and total_cost > 0:
+        success = await subtract_user_balance(db, user, total_cost, f'Adding countries: {", ".join(added_names)}')
+        if not success:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail='Failed to charge balance',
+            )
+
+        await create_transaction(
+            db=db,
+            user_id=user.id,
+            type=TransactionType.SUBSCRIPTION_PAYMENT,
+            amount_kopeks=total_cost,
+            description=f'Adding countries to subscription: {", ".join(added_names)}',
+        )
+
+    # Add servers to subscription
+    if added:
+        added_server_ids = await get_server_ids_by_uuids(db, added)
+        if added_server_ids:
+            await add_subscription_servers(db, subscription, added_server_ids, added_server_prices)
+            try:
+                await add_user_to_servers(db, added_server_ids)
+            except Exception as e:
+                logger.error('Ошибка обновления счётчика серверов', error=e)
+
+    # Update connected squads
+    subscription.connected_squads = selected_countries
+    subscription.updated_at = datetime.now(UTC)
+    await db.commit()
+
+    # Sync with RemnaWave
+    try:
+        from app.config import settings
+
+        subscription_service = SubscriptionService()
+        _has_panel = (
+            getattr(subscription, 'remnawave_uuid', None)
+            if settings.is_multi_tariff_enabled()
+            else getattr(user, 'remnawave_uuid', None)
+        )
+        if _has_panel:
+            await subscription_service.update_remnawave_user(db, subscription, sync_squads=True)
+        else:
+            await subscription_service.create_remnawave_user(db, subscription)
+    except Exception as e:
+        logger.error('Failed to sync countries with RemnaWave', error=e)
+
+    await db.refresh(subscription)
+
+    return {
+        'message': 'Countries updated successfully',
+        'added': added_names,
+        'removed': removed_names,
+        'amount_paid_kopeks': total_cost,
+        'connected_squads': subscription.connected_squads,
+    }

app/cabinet/routes/subscription_modules/status.py

@@ -0,0 +1,526 @@
+"""Subscription status endpoints.
+
+GET /subscription — subscription info
+GET /subscription/connection-link
+GET /subscription/happ-downloads
+GET /subscription/app-config
+"""
+
+from __future__ import annotations
+
+import base64
+import re
+from datetime import UTC, datetime
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.tariff import get_tariff_by_id
+from app.database.models import ServerSquad, User
+from app.services.remnawave_service import RemnaWaveService
+from app.services.system_settings_service import bot_configuration_service
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from ...schemas.subscription import (
+    ServerInfo,
+    SubscriptionStatusResponse,
+)
+from .helpers import _subscription_to_response, resolve_subscription
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.get('/info', response_model=SubscriptionStatusResponse)
+async def get_subscription(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = Query(None, description='Subscription ID for multi-tariff'),
+):
+    """Get current user's subscription details."""
+    # Reload user from current session to get fresh data
+    # (user object is from different session in get_current_cabinet_user)
+    from app.database.crud.user import get_user_by_id
+
+    fresh_user = await get_user_by_id(db, user.id)
+
+    if not fresh_user:
+        return SubscriptionStatusResponse(has_subscription=False, subscription=None)
+
+    subscription = await resolve_subscription(db, fresh_user, subscription_id)
+
+    if not subscription:
+        # Return 200 with has_subscription: false instead of 404
+        return SubscriptionStatusResponse(has_subscription=False, subscription=None)
+
+    # Load tariff for daily subscription check and tariff name
+    tariff_name = None
+    if subscription.tariff_id:
+        tariff = await get_tariff_by_id(db, subscription.tariff_id)
+        if tariff:
+            subscription.tariff = tariff
+            tariff_name = tariff.name
+
+    # Fetch server names for connected squads
+    servers: list[ServerInfo] = []
+    connected_squads = subscription.connected_squads or []
+    if connected_squads:
+        result = await db.execute(select(ServerSquad).where(ServerSquad.squad_uuid.in_(connected_squads)))
+        server_squads = result.scalars().all()
+        servers = [
+            ServerInfo(uuid=sq.squad_uuid, name=sq.display_name, country_code=sq.country_code) for sq in server_squads
+        ]
+
+    # Fetch traffic purchases (monthly packages)
+    traffic_purchases_data = []
+    from app.database.models import TrafficPurchase
+
+    now = datetime.now(UTC)
+    purchases_query = (
+        select(TrafficPurchase)
+        .where(TrafficPurchase.subscription_id == subscription.id)
+        .where(TrafficPurchase.expires_at > now)
+        .order_by(TrafficPurchase.expires_at.asc())
+    )
+    purchases_result = await db.execute(purchases_query)
+    purchases = purchases_result.scalars().all()
+
+    for purchase in purchases:
+        time_remaining = purchase.expires_at - now
+        days_remaining = max(0, int(time_remaining.total_seconds() / 86400))
+        total_duration_seconds = (purchase.expires_at - purchase.created_at).total_seconds()
+        elapsed_seconds = (now - purchase.created_at).total_seconds()
+        progress_percent = min(
+            100.0, max(0.0, (elapsed_seconds / total_duration_seconds * 100) if total_duration_seconds > 0 else 0)
+        )
+
+        traffic_purchases_data.append(
+            {
+                'id': purchase.id,
+                'traffic_gb': purchase.traffic_gb,
+                'expires_at': purchase.expires_at,
+                'created_at': purchase.created_at,
+                'days_remaining': days_remaining,
+                'progress_percent': round(progress_percent, 1),
+            }
+        )
+
+    subscription_data = _subscription_to_response(
+        subscription, servers, tariff_name, traffic_purchases_data, user=fresh_user
+    )
+    return SubscriptionStatusResponse(has_subscription=True, subscription=subscription_data)
+
+
+# ============ Connection Link ============
+
+
+@router.get('/connection-link')
+async def get_connection_link(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = Query(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Get subscription connection link and instructions."""
+    from app.utils.subscription_utils import (
+        convert_subscription_link_to_happ_scheme,
+        get_display_subscription_link,
+        get_happ_cryptolink_redirect_link,
+    )
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+
+    subscription_url = subscription.subscription_url
+    if not subscription_url:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Subscription link not yet generated',
+        )
+
+    display_link = get_display_subscription_link(subscription)
+    happ_redirect = get_happ_cryptolink_redirect_link(subscription_url) if settings.is_happ_cryptolink_mode() else None
+    happ_scheme_link = (
+        convert_subscription_link_to_happ_scheme(subscription_url) if settings.is_happ_cryptolink_mode() else None
+    )
+
+    connect_mode = settings.CONNECT_BUTTON_MODE
+    hide_subscription_link = settings.should_hide_subscription_link()
+
+    return {
+        'subscription_url': subscription_url if not hide_subscription_link else None,
+        'display_link': display_link if not hide_subscription_link else None,
+        'happ_redirect_link': happ_redirect,
+        'happ_scheme_link': happ_scheme_link,
+        'connect_mode': connect_mode,
+        'hide_link': hide_subscription_link,
+        'instructions': {
+            'steps': [
+                'Copy the subscription link',
+                'Open your VPN application',
+                "Find 'Add subscription' or 'Import' option",
+                'Paste the copied link',
+            ]
+        },
+    }
+
+
+# ============ hApp Downloads ============
+
+
+@router.get('/happ-downloads')
+async def get_happ_downloads(
+    user: User = Depends(get_current_cabinet_user),
+) -> dict[str, Any]:
+    """Get hApp download links for different platforms."""
+    platforms = {
+        'ios': {
+            'name': 'iOS (iPhone/iPad)',
+            'icon': '🍎',
+            'link': settings.get_happ_download_link('ios'),
+        },
+        'android': {
+            'name': 'Android',
+            'icon': '🤖',
+            'link': settings.get_happ_download_link('android'),
+        },
+        'macos': {
+            'name': 'macOS',
+            'icon': '🖥️',
+            'link': settings.get_happ_download_link('macos'),
+        },
+        'windows': {
+            'name': 'Windows',
+            'icon': '💻',
+            'link': settings.get_happ_download_link('windows'),
+        },
+    }
+
+    # Filter out platforms without links
+    available_platforms = {k: v for k, v in platforms.items() if v['link']}
+
+    return {
+        'platforms': available_platforms,
+        'happ_enabled': bool(available_platforms),
+    }
+
+
+# ============ App Config for Connection ============
+
+
+def _get_remnawave_config_uuid() -> str | None:
+    """Get RemnaWave config UUID from system settings or env."""
+    try:
+        return bot_configuration_service.get_current_value('CABINET_REMNA_SUB_CONFIG')
+    except Exception:
+        return settings.CABINET_REMNA_SUB_CONFIG
+
+
+def _extract_scheme_from_buttons(buttons: list[dict[str, Any]]) -> tuple[str, bool]:
+    """Extract URL scheme from buttons list.
+
+    Returns:
+        Tuple of (scheme, uses_crypto_link).
+        uses_crypto_link=True when the template is {{HAPP_CRYPT4_LINK}},
+        meaning subscription_crypto_link should be used as payload.
+    """
+    for btn in buttons:
+        if not isinstance(btn, dict):
+            continue
+        link = btn.get('link', '') or btn.get('url', '') or btn.get('buttonLink', '')
+        if not link:
+            continue
+        link_upper = link.upper()
+
+        # Check for {{HAPP_CRYPT4_LINK}} -- uses crypto link as payload
+        if '{{HAPP_CRYPT4_LINK}}' in link_upper or 'HAPP_CRYPT4_LINK' in link_upper:
+            scheme = re.sub(r'\{\{HAPP_CRYPT4_LINK\}\}', '', link, flags=re.IGNORECASE)
+            if scheme and '://' in scheme:
+                return scheme, True
+
+        # Check for {{SUBSCRIPTION_LINK}} -- uses plain subscription_url as payload
+        if '{{SUBSCRIPTION_LINK}}' in link_upper or 'SUBSCRIPTION_LINK' in link_upper:
+            scheme = re.sub(r'\{\{SUBSCRIPTION_LINK\}\}', '', link, flags=re.IGNORECASE)
+            if scheme and '://' in scheme:
+                return scheme, False
+
+        # Also check for type="subscriptionLink" buttons with custom schemes
+        btn_type = btn.get('type', '')
+        if btn_type == 'subscriptionLink' and '://' in link and not link.startswith('http'):
+            scheme = link.split('{{')[0] if '{{' in link else link
+            if scheme and '://' in scheme:
+                return scheme, False
+    return '', False
+
+
+def _get_url_scheme_for_app(app: dict[str, Any]) -> tuple[str, bool]:
+    """Get URL scheme for app - from config, buttons, or fallback by name.
+
+    Returns:
+        Tuple of (scheme, uses_crypto_link).
+        uses_crypto_link=True means the app template uses {{HAPP_CRYPT4_LINK}},
+        so subscription_crypto_link should be used as the deep link payload.
+    """
+    # 1. Check urlScheme field (cabinet format stores usesCryptoLink alongside)
+    scheme = str(app.get('urlScheme', '')).strip()
+    if scheme:
+        uses_crypto = bool(app.get('usesCryptoLink', False))
+        return scheme, uses_crypto
+
+    # 2. Extract from buttons in blocks (RemnaWave format)
+    blocks = app.get('blocks', [])
+    for block in blocks:
+        if not isinstance(block, dict):
+            continue
+        buttons = block.get('buttons', [])
+        scheme, uses_crypto = _extract_scheme_from_buttons(buttons)
+        if scheme:
+            return scheme, uses_crypto
+
+    # 3. Check buttons directly in app (alternative structure)
+    direct_buttons = app.get('buttons', [])
+    if direct_buttons:
+        scheme, uses_crypto = _extract_scheme_from_buttons(direct_buttons)
+        if scheme:
+            return scheme, uses_crypto
+
+    # No scheme found
+    logger.debug(
+        '_get_url_scheme_for_app: No scheme found for app has blocks: has buttons: has urlScheme',
+        get=app.get('name'),
+        get_2=bool(app.get('blocks')),
+        get_3=bool(app.get('buttons')),
+        get_4=bool(app.get('urlScheme')),
+    )
+    return '', False
+
+
+async def _load_app_config_async() -> dict[str, Any] | None:
+    """Load app config from RemnaWave API (if configured).
+
+    Returns None when no Remnawave config is set or API fails.
+    """
+    remnawave_uuid = _get_remnawave_config_uuid()
+
+    if remnawave_uuid:
+        try:
+            service = RemnaWaveService()
+            async with service.get_api_client() as api:
+                config = await api.get_subscription_page_config(remnawave_uuid)
+                if config and config.config:
+                    logger.debug('Loaded app config from RemnaWave', remnawave_uuid=remnawave_uuid)
+                    raw = dict(config.config)
+                    raw['_isRemnawave'] = True
+                    return raw
+        except Exception as e:
+            logger.warning('Failed to load RemnaWave config', error=e)
+
+    return None
+
+
+def _create_deep_link(
+    app: dict[str, Any], subscription_url: str, subscription_crypto_link: str | None = None
+) -> str | None:
+    """Create deep link for app with subscription URL.
+
+    Uses urlScheme from RemnaWave config (e.g. "happ://add/", "v2rayng://install-config?url=")
+    combined with the appropriate payload URL.
+
+    Two Happ schemes exist in RemnaWave:
+      - happ://add/{{SUBSCRIPTION_LINK}}       -> uses plain subscription_url
+      - happ://crypt4/{{HAPP_CRYPT4_LINK}}     -> uses subscription_crypto_link
+    """
+    if not isinstance(app, dict):
+        return None
+
+    if not subscription_url and not subscription_crypto_link:
+        return None
+
+    scheme, uses_crypto = _get_url_scheme_for_app(app)
+    if not scheme:
+        logger.debug('_create_deep_link: no urlScheme for app', get=app.get('name', 'unknown'))
+        return None
+
+    # Pick the correct payload based on which template the app uses
+    if uses_crypto:
+        if not subscription_crypto_link:
+            logger.debug(
+                '_create_deep_link: app requires crypto link but none available', get=app.get('name', 'unknown')
+            )
+            return None
+        payload = subscription_crypto_link
+    else:
+        if not subscription_url:
+            logger.debug(
+                '_create_deep_link: app requires subscription_url but none available', get=app.get('name', 'unknown')
+            )
+            return None
+        payload = subscription_url
+
+    if app.get('isNeedBase64Encoding'):
+        try:
+            payload = base64.b64encode(payload.encode('utf-8')).decode('utf-8')
+        except Exception as e:
+            logger.warning('Failed to encode payload to base64', error=e)
+
+    return f'{scheme}{payload}'
+
+
+def _resolve_button_url(
+    url: str,
+    subscription_url: str | None,
+    subscription_crypto_link: str | None,
+) -> str:
+    """Resolve template variables in button URLs.
+
+    Matches remnawave/subscription-page frontend TemplateEngine:
+    - {{SUBSCRIPTION_LINK}} -> plain subscription URL
+    - {{HAPP_CRYPT3_LINK}} -> crypto link
+    - {{HAPP_CRYPT4_LINK}} -> crypto link
+    """
+    if not url:
+        return url
+    result = url
+    if subscription_url:
+        result = result.replace('{{SUBSCRIPTION_LINK}}', subscription_url)
+    if subscription_crypto_link:
+        result = result.replace('{{HAPP_CRYPT3_LINK}}', subscription_crypto_link)
+        result = result.replace('{{HAPP_CRYPT4_LINK}}', subscription_crypto_link)
+    return result
+
+
+@router.get('/app-config')
+async def get_app_config(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = Query(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Get app configuration for connection with deep links."""
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    subscription_url = None
+    subscription_crypto_link = None
+    if subscription:
+        subscription_url = subscription.subscription_url
+        subscription_crypto_link = subscription.subscription_crypto_link
+
+    # Generate crypto link on the fly if subscription_url exists but crypto link is missing.
+    # This covers synced users where enrich_happ_links was not called.
+    if subscription_url and not subscription_crypto_link:
+        try:
+            service = RemnaWaveService()
+            async with service.get_api_client() as api:
+                encrypted = await api.encrypt_happ_crypto_link(subscription_url)
+                if encrypted:
+                    subscription_crypto_link = encrypted
+                    if subscription:
+                        subscription.subscription_crypto_link = encrypted
+                        await db.commit()
+                        logger.info(
+                            'Generated and saved crypto link for user',
+                            user_id=user.id,
+                        )
+        except Exception as e:
+            logger.debug('Could not generate crypto link', error=e)
+
+    config = await _load_app_config_async()
+
+    if not config:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='App configuration not set up.',
+        )
+
+    config.pop('_isRemnawave', None)
+    hide_link = settings.should_hide_subscription_link()
+
+    # Build platformNames from displayName of each platform
+    platform_names: dict[str, Any] = {}
+    for pk, pd in config.get('platforms', {}).items():
+        if isinstance(pd, dict) and 'displayName' in pd:
+            platform_names[pk] = pd['displayName']
+    fallback_names = {
+        'ios': {'en': 'iPhone/iPad'},
+        'android': {'en': 'Android'},
+        'macos': {'en': 'macOS'},
+        'windows': {'en': 'Windows'},
+        'linux': {'en': 'Linux'},
+        'androidTV': {'en': 'Android TV'},
+        'appleTV': {'en': 'Apple TV'},
+    }
+    for k, v in fallback_names.items():
+        if k not in platform_names:
+            platform_names[k] = v
+
+    # Serve original blocks/svgLibrary enriched with deep links and resolved URLs.
+    platforms: dict[str, Any] = {}
+    for platform_key, platform_data in config.get('platforms', {}).items():
+        if not isinstance(platform_data, dict):
+            continue
+        apps = platform_data.get('apps', [])
+        if not isinstance(apps, list):
+            continue
+
+        enriched_apps = []
+        for app in apps:
+            if not isinstance(app, dict):
+                continue
+
+            # Generate deep link
+            deep_link = None
+            if subscription_url or subscription_crypto_link:
+                deep_link = _create_deep_link(app, subscription_url, subscription_crypto_link)
+            app['deepLink'] = deep_link
+
+            # Resolve templates only for subscriptionLink and copyButton (not external)
+            for block in app.get('blocks', []):
+                if not isinstance(block, dict):
+                    continue
+                for btn in block.get('buttons', []):
+                    if not isinstance(btn, dict):
+                        continue
+                    btn_type = btn.get('type', '')
+                    if btn_type in ('subscriptionLink', 'copyButton'):
+                        url = btn.get('url', '') or btn.get('link', '')
+                        if url and '{{' in url:
+                            resolved = _resolve_button_url(
+                                url,
+                                subscription_url,
+                                subscription_crypto_link,
+                            )
+                            # Only set resolvedUrl if ALL templates were resolved;
+                            # otherwise let the frontend fall through to deepLink/subscriptionUrl
+                            if '{{' not in resolved:
+                                btn['resolvedUrl'] = resolved
+
+            enriched_apps.append(app)
+
+        if enriched_apps:
+            platform_output = {k: v for k, v in platform_data.items() if k != 'apps'}
+            platform_output['apps'] = enriched_apps
+            platforms[platform_key] = platform_output
+
+    return {
+        'isRemnawave': True,
+        'platforms': platforms,
+        'svgLibrary': config.get('svgLibrary', {}),
+        'baseTranslations': config.get('baseTranslations'),
+        'baseSettings': config.get('baseSettings'),
+        'uiConfig': config.get('uiConfig', {}),
+        'platformNames': platform_names,
+        'hasSubscription': bool(subscription_url or subscription_crypto_link),
+        'subscriptionUrl': subscription_url,
+        'subscriptionCryptoLink': subscription_crypto_link,
+        'hideLink': hide_link,
+        'branding': config.get('brandingSettings', {}),
+    }

app/cabinet/routes/subscription_modules/tariff_switch.py

@@ -0,0 +1,500 @@
+"""Tariff switching endpoints.
+
+POST /subscription/tariff/switch/preview
+POST /subscription/tariff/switch
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query as QueryParam, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.tariff import get_tariff_by_id
+from app.database.crud.transaction import create_transaction
+from app.database.crud.user import subtract_user_balance
+from app.database.models import PaymentMethod, Subscription, TransactionType, User
+from app.services.pricing_engine import pricing_engine
+from app.services.remnawave_service import RemnaWaveService
+from app.services.subscription_service import SubscriptionService
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from ...schemas.subscription import TariffPurchaseRequest
+from .helpers import _subscription_to_response, resolve_subscription
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.post('/tariff/switch/preview')
+async def preview_tariff_switch(
+    request: TariffPurchaseRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Preview tariff switch - shows cost calculation."""
+    if not settings.is_tariffs_mode():
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Tariffs mode is not enabled',
+        )
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription or not subscription.tariff_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='No active subscription with tariff',
+        )
+
+    # Use actual_status for correct status check (handles time-based expiration)
+    actual_status = subscription.actual_status
+    if actual_status == 'expired':
+        # For expired subscriptions, user should purchase a new tariff, not switch
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail={
+                'code': 'subscription_expired',
+                'message': 'Subscription is expired. Please purchase a new tariff instead of switching.',
+                'use_purchase_flow': True,
+            },
+        )
+    if actual_status not in ('active', 'trial'):
+        # For disabled/pending subscriptions, block switching with generic error
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail={
+                'code': 'subscription_not_active',
+                'message': f'Subscription is not active (status: {actual_status}). Cannot switch tariff.',
+            },
+        )
+
+    current_tariff = await get_tariff_by_id(db, subscription.tariff_id)
+    new_tariff = await get_tariff_by_id(db, request.tariff_id)
+
+    if not new_tariff or not new_tariff.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Tariff not found or inactive',
+        )
+
+    if subscription.tariff_id == request.tariff_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Already on this tariff',
+        )
+
+    # Check tariff availability for user's promo group
+    # Use get_primary_promo_group() for correct promo group resolution
+    promo_group = user.get_primary_promo_group() if hasattr(user, 'get_primary_promo_group') else None
+    if promo_group is None:
+        promo_group = getattr(user, 'promo_group', None)
+    promo_group_id = promo_group.id if promo_group else None
+    if not new_tariff.is_available_for_promo_group(promo_group_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Tariff not available for your promo group',
+        )
+
+    # Calculate remaining days
+    remaining_days = 0
+    if subscription.end_date and subscription.end_date > datetime.now(UTC):
+        delta = subscription.end_date - datetime.now(UTC)
+        remaining_days = max(0, delta.days)
+
+    # Calculate switch cost (PricingEngine handles all cases: periodic<->periodic, daily->periodic, periodic->daily)
+    switch_result = pricing_engine.calculate_tariff_switch_cost(
+        current_tariff,
+        new_tariff,
+        remaining_days,
+        user=user,
+    )
+    upgrade_cost = switch_result.upgrade_cost
+    is_upgrade = switch_result.is_upgrade
+    base_upgrade_cost = switch_result.raw_cost
+    discount_value = switch_result.discount_value
+    period_discount_percent = switch_result.effective_discount_pct
+
+    balance = user.balance_kopeks or 0
+    has_enough = balance >= upgrade_cost
+    missing = max(0, upgrade_cost - balance) if not has_enough else 0
+
+    response: dict[str, Any] = {
+        'can_switch': has_enough,
+        'current_tariff_id': current_tariff.id if current_tariff else None,
+        'current_tariff_name': current_tariff.name if current_tariff else None,
+        'new_tariff_id': new_tariff.id,
+        'new_tariff_name': new_tariff.name,
+        'remaining_days': remaining_days,
+        'upgrade_cost_kopeks': upgrade_cost,
+        'upgrade_cost_label': settings.format_price(upgrade_cost) if upgrade_cost > 0 else 'Бесплатно',
+        'balance_kopeks': balance,
+        'balance_label': settings.format_price(balance),
+        'has_enough_balance': has_enough,
+        'missing_amount_kopeks': missing,
+        'missing_amount_label': settings.format_price(missing) if missing > 0 else '',
+        'is_upgrade': is_upgrade,
+    }
+
+    # Add discount info if applicable
+    if period_discount_percent > 0 and discount_value > 0:
+        response['discount_percent'] = period_discount_percent
+        response['discount_kopeks'] = discount_value
+        response['base_upgrade_cost_kopeks'] = base_upgrade_cost
+
+    return response
+
+
+@router.post('/tariff/switch')
+async def switch_tariff(
+    request: TariffPurchaseRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Switch to a different tariff without changing end date."""
+    if not settings.is_tariffs_mode():
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Tariffs mode is not enabled',
+        )
+
+    resolved = await resolve_subscription(db, user, subscription_id)
+
+    if not resolved or not resolved.tariff_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='No active subscription with tariff',
+        )
+
+    # Guard: prevent switching to a tariff the user already owns (multi-tariff)
+    if settings.is_multi_tariff_enabled() and request.tariff_id:
+        from app.database.crud.subscription import get_subscription_by_user_and_tariff
+
+        existing_target = await get_subscription_by_user_and_tariff(db, user.id, request.tariff_id)
+        if existing_target and existing_target.id != resolved.id:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail='You already have an active subscription for the target tariff',
+            )
+
+    # Lock subscription row to prevent concurrent tariff switches
+    locked_result = await db.execute(
+        select(Subscription)
+        .where(Subscription.id == resolved.id)
+        .with_for_update()
+        .execution_options(populate_existing=True)
+    )
+    subscription = locked_result.scalar_one()
+
+    # Use actual_status for correct status check (handles time-based expiration)
+    actual_status = subscription.actual_status
+    if actual_status == 'expired':
+        # For expired subscriptions, user should purchase a new tariff, not switch
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail={
+                'code': 'subscription_expired',
+                'message': 'Subscription is expired. Please purchase a new tariff instead of switching.',
+                'use_purchase_flow': True,
+            },
+        )
+    if actual_status not in ('active', 'trial'):
+        # For disabled/pending subscriptions, block switching with generic error
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail={
+                'code': 'subscription_not_active',
+                'message': f'Subscription is not active (status: {actual_status}). Cannot switch tariff.',
+            },
+        )
+
+    current_tariff = await get_tariff_by_id(db, subscription.tariff_id)
+    new_tariff = await get_tariff_by_id(db, request.tariff_id)
+
+    if not new_tariff or not new_tariff.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='Tariff not found or inactive',
+        )
+
+    if subscription.tariff_id == request.tariff_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Already on this tariff',
+        )
+
+    # Check tariff availability
+    # Use get_primary_promo_group() for correct promo group resolution
+    promo_group = user.get_primary_promo_group() if hasattr(user, 'get_primary_promo_group') else None
+    if promo_group is None:
+        promo_group = getattr(user, 'promo_group', None)
+    promo_group_id = promo_group.id if promo_group else None
+    if not new_tariff.is_available_for_promo_group(promo_group_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Tariff not available',
+        )
+
+    # Lock user BEFORE price computation to prevent TOCTOU on promo offer
+    from app.database.crud.user import lock_user_for_pricing
+
+    user = await lock_user_for_pricing(db, user.id)
+
+    # Calculate remaining days
+    remaining_days = 0
+    if subscription.end_date and subscription.end_date > datetime.now(UTC):
+        delta = subscription.end_date - datetime.now(UTC)
+        remaining_days = max(0, delta.days)
+
+    # Calculate cost (PricingEngine handles all cases: periodic<->periodic, daily->periodic, periodic->daily)
+    switch_result = pricing_engine.calculate_tariff_switch_cost(
+        current_tariff,
+        new_tariff,
+        remaining_days,
+        user=user,
+    )
+    upgrade_cost = switch_result.upgrade_cost
+    base_upgrade_cost = switch_result.raw_cost
+    discount_value = switch_result.discount_value
+    period_discount_percent = switch_result.effective_discount_pct
+    new_period_days = switch_result.new_period_days
+
+    # Validate daily price for switching TO daily
+    new_is_daily = getattr(new_tariff, 'is_daily', False)
+    current_is_daily = getattr(current_tariff, 'is_daily', False) if current_tariff else False
+    switching_to_daily = not current_is_daily and new_is_daily
+    switching_from_daily = current_is_daily and not new_is_daily
+
+    if switching_to_daily and (getattr(new_tariff, 'daily_price_kopeks', 0) or 0) <= 0:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Daily tariff has invalid price',
+        )
+
+    # Charge if upgrade
+    switch_transaction = None
+    if upgrade_cost > 0:
+        if user.balance_kopeks < upgrade_cost:
+            missing = upgrade_cost - user.balance_kopeks
+            raise HTTPException(
+                status_code=status.HTTP_402_PAYMENT_REQUIRED,
+                detail={
+                    'code': 'insufficient_funds',
+                    'message': f'Insufficient funds. Missing {settings.format_price(missing)}',
+                    'missing_amount': missing,
+                },
+            )
+
+        if switching_to_daily:
+            description = f"Переход на суточный тариф '{new_tariff.name}'"
+        elif switching_from_daily:
+            description = f"Переход с суточного на тариф '{new_tariff.name}' ({new_period_days} дней)"
+        else:
+            description = f"Переход на тариф '{new_tariff.name}' (доплата за {remaining_days} дней)"
+
+        # Add discount info to description if applicable
+        if period_discount_percent > 0 and discount_value > 0:
+            description += f' (скидка {period_discount_percent}%)'
+
+        success = await subtract_user_balance(
+            db,
+            user,
+            upgrade_cost,
+            description,
+            consume_promo_offer=switch_result.offer_discount_pct > 0,
+            mark_as_paid_subscription=True,
+            commit=False,
+        )
+        if not success:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail='Failed to charge balance',
+            )
+
+        # Create transaction (commit=False to keep FOR UPDATE lock held)
+        switch_transaction = await create_transaction(
+            db=db,
+            user_id=user.id,
+            type=TransactionType.SUBSCRIPTION_PAYMENT,
+            amount_kopeks=upgrade_cost,
+            description=description,
+            payment_method=PaymentMethod.BALANCE,
+            commit=False,
+        )
+    else:
+        # Free switch (downgrade) — record in history
+        description = f"Переход на тариф '{new_tariff.name}'"
+        await create_transaction(
+            db=db,
+            user_id=user.id,
+            type=TransactionType.SUBSCRIPTION_PAYMENT,
+            amount_kopeks=0,
+            description=description,
+            commit=False,
+        )
+
+    # Update subscription
+    old_tariff_name = current_tariff.name if current_tariff else 'Unknown'
+
+    # Reset device limit to new tariff base (extra purchased devices are not carried over)
+    from app.database.crud.subscription import calc_device_limit_on_tariff_switch
+
+    # Re-load subscription to avoid MissingGreenlet from expired lazy relationship
+    # (subtract_user_balance re-selects User with populate_existing=True which expires relationships)
+    await db.refresh(subscription)
+
+    subscription.tariff_id = new_tariff.id
+    subscription.traffic_limit_gb = new_tariff.traffic_limit_gb
+    subscription.device_limit = calc_device_limit_on_tariff_switch(
+        current_device_limit=subscription.device_limit,
+        old_tariff_device_limit=current_tariff.device_limit if current_tariff else None,
+        new_tariff_device_limit=new_tariff.device_limit,
+        max_device_limit=new_tariff.max_device_limit,
+    )
+    subscription.connected_squads = new_tariff.allowed_squads or []
+
+    # Reset purchased traffic and delete TrafficPurchase records on tariff switch
+    from sqlalchemy import delete as sql_delete
+
+    from app.database.models import TrafficPurchase
+
+    await db.execute(sql_delete(TrafficPurchase).where(TrafficPurchase.subscription_id == subscription.id))
+    subscription.purchased_traffic_gb = 0
+    subscription.traffic_reset_at = None
+
+    if settings.RESET_TRAFFIC_ON_TARIFF_SWITCH:
+        subscription.traffic_used_gb = 0.0
+
+    if switching_to_daily:
+        # Switching TO daily - reset end_date to 1 day, set last_daily_charge_at
+        subscription.end_date = datetime.now(UTC) + timedelta(days=1)
+        subscription.last_daily_charge_at = datetime.now(UTC)
+        subscription.is_daily_paused = False
+    elif switching_from_daily:
+        subscription.end_date = datetime.now(UTC) + timedelta(days=new_period_days)
+        subscription.is_daily_paused = False
+
+    subscription.updated_at = datetime.now(UTC)
+    await db.commit()
+
+    # Emit deferred side-effects after atomic commit
+    if upgrade_cost > 0 and switch_transaction:
+        from app.database.crud.transaction import emit_transaction_side_effects
+
+        await emit_transaction_side_effects(
+            db,
+            switch_transaction,
+            amount_kopeks=upgrade_cost,
+            user_id=user.id,
+            type=TransactionType.SUBSCRIPTION_PAYMENT,
+            payment_method=PaymentMethod.BALANCE,
+        )
+
+    # Sync with RemnaWave (optionally reset traffic based on admin setting)
+    should_reset_traffic = settings.RESET_TRAFFIC_ON_TARIFF_SWITCH
+    # Refresh subscription after commit (all objects are expired)
+    await db.refresh(subscription)
+
+    try:
+        subscription_service = SubscriptionService()
+        _has_panel = (
+            getattr(subscription, 'remnawave_uuid', None)
+            if settings.is_multi_tariff_enabled()
+            else getattr(user, 'remnawave_uuid', None)
+        )
+        if _has_panel:
+            await subscription_service.update_remnawave_user(
+                db,
+                subscription,
+                reset_traffic=should_reset_traffic,
+                reset_reason='смена тарифа',
+                sync_squads=True,
+            )
+        else:
+            await subscription_service.create_remnawave_user(
+                db,
+                subscription,
+                reset_traffic=should_reset_traffic,
+                reset_reason='смена тарифа',
+            )
+    except Exception as e:
+        logger.error('Failed to sync tariff switch with RemnaWave', error=e)
+
+    # Reset all devices on tariff switch
+    devices_reset = False
+    _switch_uuid = (
+        subscription.remnawave_uuid
+        if settings.is_multi_tariff_enabled() and subscription.remnawave_uuid
+        else user.remnawave_uuid
+    )
+    if _switch_uuid:
+        try:
+            service = RemnaWaveService()
+            async with service.get_api_client() as api:
+                await api.reset_user_devices(_switch_uuid)
+                devices_reset = True
+                logger.info('Reset all devices for user on tariff switch', user_id=user.id)
+        except Exception as e:
+            logger.error('Failed to reset devices on tariff switch', error=e)
+
+    await db.refresh(user)
+    await db.refresh(subscription)
+
+    # Отправляем уведомление админам о смене тарифа
+    try:
+        from aiogram import Bot
+
+        from app.services.admin_notification_service import AdminNotificationService
+
+        if getattr(settings, 'ADMIN_NOTIFICATIONS_ENABLED', False) and settings.BOT_TOKEN:
+            bot = Bot(token=settings.BOT_TOKEN)
+            try:
+                notification_service = AdminNotificationService(bot)
+                await notification_service.send_subscription_purchase_notification(
+                    db=db,
+                    user=user,
+                    subscription=subscription,
+                    transaction=switch_transaction if upgrade_cost > 0 else None,
+                    period_days=remaining_days if remaining_days > 0 else new_period_days,
+                    was_trial_conversion=False,
+                    amount_kopeks=upgrade_cost,
+                    purchase_type='tariff_switch',
+                )
+            finally:
+                await bot.session.close()
+    except Exception as e:
+        logger.error('Failed to send admin notification for tariff switch', error=e)
+
+    # Refresh expired objects after db.commit() in _record_subscription_event
+    await db.refresh(subscription)
+    await db.refresh(user)
+
+    response: dict[str, Any] = {
+        'success': True,
+        'message': f"Switched from '{old_tariff_name}' to '{new_tariff.name}'"
+        + (' (devices reset)' if devices_reset else ''),
+        'subscription': _subscription_to_response(subscription, user=user),
+        'old_tariff_name': old_tariff_name,
+        'new_tariff_id': new_tariff.id,
+        'new_tariff_name': new_tariff.name,
+        'charged_kopeks': upgrade_cost,
+        'balance_kopeks': user.balance_kopeks,
+        'balance_label': settings.format_price(user.balance_kopeks),
+    }
+
+    # Add discount info if applicable
+    if period_discount_percent > 0 and discount_value > 0:
+        response['discount_percent'] = period_discount_percent
+        response['discount_kopeks'] = discount_value
+        response['base_charged_kopeks'] = base_upgrade_cost
+
+    return response

app/cabinet/routes/subscription_modules/traffic.py

@@ -0,0 +1,770 @@
+"""Traffic management endpoints.
+
+GET /subscription/traffic-packages
+POST /subscription/traffic
+PUT /subscription/traffic
+POST /subscription/refresh-traffic
+POST /subscription/traffic/save-cart
+"""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from typing import Any
+
+import structlog
+from fastapi import APIRouter, Depends, HTTPException, Query as QueryParam, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.tariff import get_tariff_by_id
+from app.database.crud.transaction import create_transaction
+from app.database.crud.user import subtract_user_balance
+from app.database.models import TransactionType, User
+from app.services.pricing_engine import pricing_engine
+from app.services.remnawave_service import RemnaWaveService
+from app.services.subscription_service import SubscriptionService
+from app.services.user_cart_service import user_cart_service
+from app.utils.cache import RateLimitCache, cache, cache_key
+
+from ...dependencies import get_cabinet_db, get_current_cabinet_user
+from ...schemas.subscription import (
+    TrafficPackageResponse,
+    TrafficPurchaseRequest,
+)
+from .helpers import _apply_addon_discount, resolve_subscription
+
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter()
+
+
+@router.get('/traffic-packages', response_model=list[TrafficPackageResponse])
+async def get_traffic_packages(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+):
+    """Get available traffic packages."""
+    from app.database.crud.tariff import get_tariff_by_id
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+    if not subscription:
+        return []
+
+    # Режим тарифов - берём пакеты из тарифа
+    if settings.is_tariffs_mode() and subscription.tariff_id:
+        tariff = await get_tariff_by_id(db, subscription.tariff_id)
+        if not tariff:
+            return []
+
+        # Проверяем, разрешена ли докупка для этого тарифа
+        if not getattr(tariff, 'traffic_topup_enabled', False):
+            return []
+
+        # Проверяем безлимит
+        if tariff.traffic_limit_gb == 0:
+            return []
+
+        packages = tariff.get_traffic_topup_packages() if hasattr(tariff, 'get_traffic_topup_packages') else {}
+        result = []
+
+        for gb, price in packages.items():
+            if price <= 0:
+                continue
+            result.append(
+                TrafficPackageResponse(
+                    gb=gb,
+                    price_kopeks=price,
+                    price_rubles=price / 100,
+                    is_unlimited=False,
+                )
+            )
+
+        return sorted(result, key=lambda x: x.gb)
+
+    # Classic режим - глобальные настройки
+    if not settings.is_traffic_topup_enabled():
+        return []
+
+    # Проверяем настройку тарифа пользователя (allow_traffic_topup)
+    if subscription.tariff_id:
+        tariff = await get_tariff_by_id(db, subscription.tariff_id)
+        if tariff and not tariff.allow_traffic_topup:
+            return []
+
+    packages = settings.get_traffic_topup_packages()
+    result = []
+
+    for pkg in packages:
+        if not pkg.get('enabled', True):
+            continue
+        if pkg['price'] <= 0:
+            continue
+
+        result.append(
+            TrafficPackageResponse(
+                gb=pkg['gb'],
+                price_kopeks=pkg['price'],
+                price_rubles=pkg['price'] / 100,
+                is_unlimited=pkg['gb'] == 0,
+            )
+        )
+
+    return result
+
+
+@router.post('/traffic')
+async def purchase_traffic(
+    request: TrafficPurchaseRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+):
+    """Purchase additional traffic."""
+    if getattr(user, 'restriction_subscription', False):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Subscription purchases are restricted for this account',
+        )
+
+    from app.database.crud.subscription import add_subscription_traffic
+    from app.database.crud.tariff import get_tariff_by_id
+    from app.utils.pricing_utils import calculate_prorated_price
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+    tariff = None
+    base_price_kopeks = 0
+    is_tariff_mode = settings.is_tariffs_mode() and subscription.tariff_id
+
+    # Режим тарифов
+    if is_tariff_mode:
+        tariff = await get_tariff_by_id(db, subscription.tariff_id)
+        if not tariff:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail='Tariff not found',
+            )
+
+        # Проверяем, разрешена ли докупка
+        if not getattr(tariff, 'traffic_topup_enabled', False):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Traffic top-up is disabled for this tariff',
+            )
+
+        # Проверяем безлимит
+        if tariff.traffic_limit_gb == 0:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Cannot add traffic to unlimited subscription',
+            )
+
+        # Проверяем лимит докупки
+        max_topup_limit = getattr(tariff, 'max_topup_traffic_gb', 0) or 0
+        if max_topup_limit > 0:
+            current_traffic = subscription.traffic_limit_gb or 0
+            new_traffic = current_traffic + request.gb
+            if new_traffic > max_topup_limit:
+                available_gb = max(0, max_topup_limit - current_traffic)
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=f'Traffic limit exceeded. Max: {max_topup_limit} GB, available: {available_gb} GB',
+                )
+
+        # Получаем цену из тарифа
+        packages = tariff.get_traffic_topup_packages() if hasattr(tariff, 'get_traffic_topup_packages') else {}
+        if request.gb not in packages:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f'Traffic package {request.gb}GB is not available',
+            )
+        base_price_kopeks = packages[request.gb]
+        if base_price_kopeks <= 0:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f'Traffic package {request.gb}GB has no price configured',
+            )
+
+    else:
+        # Classic режим
+        if not settings.is_traffic_topup_enabled():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Traffic top-up feature is disabled',
+            )
+
+        # Проверяем настройку тарифа (allow_traffic_topup)
+        if subscription.tariff_id:
+            tariff = await get_tariff_by_id(db, subscription.tariff_id)
+            if tariff and not tariff.allow_traffic_topup:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail='Traffic top-up is not available for your tariff',
+                )
+
+        # Получаем цену из глобальных настроек
+        packages = settings.get_traffic_topup_packages()
+        matching_pkg = next((pkg for pkg in packages if pkg['gb'] == request.gb and pkg.get('enabled', True)), None)
+        if not matching_pkg:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Invalid traffic package',
+            )
+        base_price_kopeks = matching_pkg['price']
+        if base_price_kopeks <= 0:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Traffic package has no price configured',
+            )
+
+    # На тарифах пакеты трафика покупаются на 1 месяц (30 дней),
+    # цена в тарифе уже месячная — не умножаем на оставшиеся месяцы подписки.
+    # Пропорциональный расчёт применяем только в классическом режиме.
+    if is_tariff_mode:
+        prorated_price = base_price_kopeks
+        days_charged = 30
+    else:
+        prorated_price, days_charged = calculate_prorated_price(
+            base_price_kopeks,
+            subscription.end_date,
+        )
+
+    # Lock user row to prevent TOCTOU on promo-offer state
+    from app.database.crud.user import lock_user_for_pricing
+
+    user = await lock_user_for_pricing(db, user.id)
+
+    # Apply discount from promo group using proper method
+    period_hint_days = days_charged if days_charged > 0 else 30
+    discount_result = _apply_addon_discount(user, 'traffic', prorated_price, period_hint_days)
+    final_price = discount_result['discounted']
+    traffic_discount_percent = discount_result['percent']
+    discount_value = discount_result['discount']
+
+    # Ensure minimum price after discount (except for 100% discount)
+    if traffic_discount_percent < 100 and final_price > 0:
+        final_price = max(100, final_price)
+
+    # Проверяем баланс
+    if final_price > 0 and user.balance_kopeks < final_price:
+        missing = final_price - user.balance_kopeks
+
+        # Save cart for auto-purchase after balance top-up
+        cart_data = {
+            'cart_mode': 'add_traffic',
+            'subscription_id': subscription.id,
+            'traffic_gb': request.gb,
+            'price_kopeks': final_price,
+            'base_price_kopeks': prorated_price,
+            'discount_percent': traffic_discount_percent,
+            'source': 'cabinet',
+            'description': f'Докупка {request.gb} ГБ трафика',
+        }
+
+        try:
+            await user_cart_service.save_user_cart(user.id, cart_data)
+            logger.info(
+                'Cart saved for traffic purchase (cabinet) user + discount',
+                user_id=user.id,
+                gb=request.gb,
+                traffic_discount_percent=traffic_discount_percent,
+            )
+        except Exception as e:
+            logger.error('Error saving cart for traffic purchase (cabinet)', error=e)
+
+        raise HTTPException(
+            status_code=status.HTTP_402_PAYMENT_REQUIRED,
+            detail={
+                'code': 'insufficient_funds',
+                'message': f'Недостаточно средств. Не хватает {settings.format_price(missing)}',
+                'missing_amount': missing,
+                'cart_saved': True,
+                'cart_mode': 'add_traffic',
+            },
+        )
+
+    # Формируем описание
+    if traffic_discount_percent > 0:
+        traffic_description = f'Докупка {request.gb} ГБ трафика (скидка {traffic_discount_percent}%)'
+    else:
+        traffic_description = f'Докупка {request.gb} ГБ трафика'
+
+    # Списываем баланс
+    success = await subtract_user_balance(db, user, final_price, traffic_description)
+    if not success:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to charge balance',
+        )
+
+    # Добавляем трафик (add_subscription_traffic обновляет purchased_traffic_gb, traffic_reset_at и коммитит)
+    await add_subscription_traffic(db, subscription, request.gb)
+
+    # Реактивируем подписку если она была DISABLED/EXPIRED (например, после LIMITED/EXPIRED в RemnaWave)
+    from app.database.crud.subscription import reactivate_subscription
+
+    await reactivate_subscription(db, subscription)
+
+    # Синхронизируем с RemnaWave
+    try:
+        subscription_service = SubscriptionService()
+        _panel_uuid = (
+            subscription.remnawave_uuid
+            if settings.is_multi_tariff_enabled() and subscription.remnawave_uuid
+            else getattr(user, 'remnawave_uuid', None)
+        )
+        if _panel_uuid:
+            await subscription_service.update_remnawave_user(db, subscription)
+            if subscription.status == 'active':
+                await subscription_service.enable_remnawave_user(_panel_uuid)
+        else:
+            await subscription_service.create_remnawave_user(db, subscription)
+    except Exception as e:
+        logger.error('Failed to sync traffic with RemnaWave', error=e)
+
+    # Создаём транзакцию
+    await create_transaction(
+        db=db,
+        user_id=user.id,
+        type=TransactionType.SUBSCRIPTION_PAYMENT,
+        amount_kopeks=final_price,
+        description=traffic_description,
+    )
+
+    await db.refresh(user)
+    await db.refresh(subscription)
+
+    # Отправляем уведомление админам
+    try:
+        from aiogram import Bot
+
+        from app.services.admin_notification_service import AdminNotificationService
+
+        if getattr(settings, 'ADMIN_NOTIFICATIONS_ENABLED', False) and settings.BOT_TOKEN:
+            bot = Bot(token=settings.BOT_TOKEN)
+            try:
+                notification_service = AdminNotificationService(bot)
+                old_traffic = subscription.traffic_limit_gb - request.gb
+                await notification_service.send_subscription_update_notification(
+                    db=db,
+                    user=user,
+                    subscription=subscription,
+                    update_type='traffic',
+                    old_value=old_traffic,
+                    new_value=subscription.traffic_limit_gb,
+                    price_paid=final_price,
+                )
+            finally:
+                await bot.session.close()
+    except Exception as e:
+        logger.error('Failed to send admin notification for traffic purchase', error=e)
+
+    response: dict[str, Any] = {
+        'success': True,
+        'message': 'Traffic purchased successfully',
+        'gb_added': request.gb,
+        'new_traffic_limit_gb': subscription.traffic_limit_gb,
+        'amount_paid_kopeks': final_price,
+        'new_balance_kopeks': user.balance_kopeks,
+    }
+
+    if traffic_discount_percent > 0:
+        response['discount_percent'] = traffic_discount_percent
+        response['discount_kopeks'] = discount_value
+        response['base_price_kopeks'] = prorated_price
+
+    return response
+
+
+@router.post('/traffic/save-cart')
+async def save_traffic_cart(
+    request: TrafficPurchaseRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, bool]:
+    """Save cart for traffic purchase (for insufficient balance flow)."""
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='У вас нет активной подписки',
+        )
+
+    if subscription.status not in ['active', 'trial']:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Ваша подписка неактивна',
+        )
+
+    if subscription.is_trial:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Докупка трафика недоступна на пробном периоде',
+        )
+
+    if subscription.traffic_limit_gb == 0:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='У вас уже безлимитный трафик',
+        )
+
+    # Get traffic price from tariff or settings
+    tariff = None
+    base_price_kopeks = 0
+    is_tariff_mode = settings.is_tariffs_mode() and subscription.tariff_id
+
+    if is_tariff_mode:
+        tariff = await get_tariff_by_id(db, subscription.tariff_id)
+        if not tariff:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail='Тариф не найден',
+            )
+
+        if not getattr(tariff, 'traffic_topup_enabled', False):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Докупка трафика недоступна на вашем тарифе',
+            )
+
+        packages = tariff.get_traffic_topup_packages() if hasattr(tariff, 'get_traffic_topup_packages') else {}
+        if request.gb not in packages:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=f'Пакет трафика {request.gb} ГБ недоступен',
+            )
+        base_price_kopeks = packages[request.gb]
+    else:
+        if not settings.is_traffic_topup_enabled():
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Докупка трафика отключена',
+            )
+
+        packages = settings.get_traffic_topup_packages()
+        matching_pkg = next((pkg for pkg in packages if pkg['gb'] == request.gb and pkg.get('enabled', True)), None)
+        if not matching_pkg:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='Недоступный пакет трафика',
+            )
+        base_price_kopeks = matching_pkg['price']
+
+    # Calculate prorated price (days-based), then apply discount
+    from app.utils.pricing_utils import calculate_prorated_price as _calc_prorated
+
+    now = datetime.now(UTC)
+    days_left = max(1, (subscription.end_date - now).days)
+    prorated_price, _ = _calc_prorated(
+        base_price_kopeks,
+        subscription.end_date,
+    )
+    discount_result = _apply_addon_discount(user, 'traffic', prorated_price, days_left)
+    final_price = discount_result['discounted']
+    traffic_discount_percent = discount_result['percent']
+
+    # Save cart for auto-purchase after balance top-up
+    cart_data = {
+        'cart_mode': 'add_traffic',
+        'subscription_id': subscription.id,
+        'traffic_gb': request.gb,
+        'price_kopeks': final_price,
+        'base_price_kopeks': base_price_kopeks,
+        'discount_percent': traffic_discount_percent,
+        'source': 'cabinet',
+        'description': f'Докупка {request.gb} ГБ трафика',
+    }
+    await user_cart_service.save_user_cart(user.id, cart_data)
+    logger.info('Cart saved for traffic purchase (cabinet save-cart) user +', user_id=user.id, gb=request.gb)
+
+    return {'success': True, 'cart_saved': True}
+
+
+# ============ Traffic Switch (Change Traffic Package) ============
+
+
+@router.put('/traffic')
+async def switch_traffic_package(
+    request: TrafficPurchaseRequest,
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+) -> dict[str, Any]:
+    """Switch to a different traffic package (change limit)."""
+    from app.utils.pricing_utils import calculate_prorated_price
+
+    subscription = await resolve_subscription(db, user, subscription_id)
+
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No subscription found',
+        )
+
+    if subscription.is_trial:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Traffic management is only available for paid subscriptions',
+        )
+
+    current_traffic = subscription.traffic_limit_gb or 0
+    new_traffic = request.gb
+
+    if current_traffic == new_traffic:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Already on this traffic package',
+        )
+
+    # Get available packages
+    packages = settings.get_traffic_packages()
+    current_pkg = next((p for p in packages if p['gb'] == current_traffic and p.get('enabled', True)), None)
+    new_pkg = next((p for p in packages if p['gb'] == new_traffic and p.get('enabled', True)), None)
+
+    if not new_pkg:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid traffic package',
+        )
+
+    # Calculate price difference (only charge for upgrade)
+    current_price = current_pkg['price'] if current_pkg else 0
+    new_price = new_pkg['price']
+
+    if new_price > current_price:
+        # Upgrade - charge difference
+        price_diff = new_price - current_price
+
+        # Lock user row to prevent TOCTOU on promo-offer state
+        from app.database.crud.user import lock_user_for_pricing
+
+        user = await lock_user_for_pricing(db, user.id)
+
+        # Apply promo discount via PricingEngine
+        price_diff, _discount_val, traffic_discount_percent = pricing_engine.calculate_traffic_discount(
+            price_diff,
+            user,
+        )
+
+        # Prorated calculation
+        final_price, days_charged = calculate_prorated_price(price_diff, subscription.end_date)
+
+        if final_price > 0 and user.balance_kopeks < final_price:
+            raise HTTPException(
+                status_code=status.HTTP_402_PAYMENT_REQUIRED,
+                detail=f'Insufficient balance. Need {final_price / 100:.2f} RUB',
+            )
+
+        # Charge balance
+        description = f'Traffic upgrade from {current_traffic}GB to {new_traffic}GB'
+        success = await subtract_user_balance(db, user, final_price, description)
+        if not success:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail='Failed to charge balance',
+            )
+
+        # Create transaction
+        await create_transaction(
+            db=db,
+            user_id=user.id,
+            type=TransactionType.SUBSCRIPTION_PAYMENT,
+            amount_kopeks=final_price,
+            description=description,
+        )
+
+        charged = final_price
+    else:
+        # Downgrade - no charge, no refund
+        charged = 0
+
+    # Update subscription — delete TrafficPurchase records before resetting purchased_traffic_gb
+    from sqlalchemy import delete as sql_delete
+
+    from app.database.models import TrafficPurchase
+
+    await db.execute(sql_delete(TrafficPurchase).where(TrafficPurchase.subscription_id == subscription.id))
+    subscription.traffic_limit_gb = new_traffic
+    subscription.purchased_traffic_gb = 0  # Reset purchased traffic on switch
+    subscription.traffic_reset_at = None  # Reset traffic reset date
+    subscription.updated_at = datetime.now(UTC)
+    await db.commit()
+
+    # Sync with RemnaWave
+    try:
+        subscription_service = SubscriptionService()
+        _panel_uuid2 = (
+            subscription.remnawave_uuid
+            if settings.is_multi_tariff_enabled() and subscription.remnawave_uuid
+            else getattr(user, 'remnawave_uuid', None)
+        )
+        if _panel_uuid2:
+            await subscription_service.update_remnawave_user(db, subscription)
+        else:
+            await subscription_service.create_remnawave_user(db, subscription)
+    except Exception as e:
+        logger.error('Failed to sync traffic switch with RemnaWave', error=e)
+
+    await db.refresh(user)
+    await db.refresh(subscription)
+
+    return {
+        'success': True,
+        'message': f'Traffic changed from {current_traffic}GB to {new_traffic}GB',
+        'old_traffic_gb': current_traffic,
+        'new_traffic_gb': new_traffic,
+        'charged_kopeks': charged,
+        'balance_kopeks': user.balance_kopeks,
+        'balance_label': settings.format_price(user.balance_kopeks),
+    }
+
+
+# ============ Traffic Refresh ============
+
+# Rate limit: 1 request per 60 seconds per user
+TRAFFIC_REFRESH_RATE_LIMIT = 1
+TRAFFIC_REFRESH_RATE_WINDOW = 60  # seconds
+TRAFFIC_CACHE_TTL = 60  # Cache traffic data for 60 seconds
+
+
+@router.post('/refresh-traffic')
+async def refresh_traffic(
+    user: User = Depends(get_current_cabinet_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    subscription_id: int | None = QueryParam(None, description='Subscription ID for multi-tariff'),
+):
+    """
+    Refresh traffic usage from RemnaWave panel.
+    Rate limited to 1 request per 60 seconds.
+    """
+    subscription = await resolve_subscription(db, user, subscription_id)
+    if not subscription:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='No active subscription',
+        )
+
+    # Use per-subscription key when subscription_id is available so that refreshing
+    # Sub B is not blocked by a previous refresh of Sub A (multi-tariff mode).
+    cache_suffix = f'{user.id}_{subscription_id}' if subscription_id is not None else str(user.id)
+
+    # Check rate limit
+    is_limited = await RateLimitCache.is_rate_limited(
+        cache_suffix,
+        'traffic_refresh',
+        TRAFFIC_REFRESH_RATE_LIMIT,
+        TRAFFIC_REFRESH_RATE_WINDOW,
+    )
+
+    if is_limited:
+        # Check if we have cached data
+        traffic_cache_key = cache_key('traffic', cache_suffix)
+        cached_data = await cache.get(traffic_cache_key)
+
+        if cached_data:
+            return {
+                'success': True,
+                'cached': True,
+                'rate_limited': True,
+                'retry_after_seconds': TRAFFIC_REFRESH_RATE_WINDOW,
+                **cached_data,
+            }
+
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail=f'Rate limited. Try again in {TRAFFIC_REFRESH_RATE_WINDOW} seconds.',
+            headers={'Retry-After': str(TRAFFIC_REFRESH_RATE_WINDOW)},
+        )
+
+    # Fetch traffic from RemnaWave
+    try:
+        remnawave_service = RemnaWaveService()
+
+        # Resolve panel UUID for traffic lookup
+        _traffic_uuid = (
+            subscription.remnawave_uuid
+            if settings.is_multi_tariff_enabled() and subscription.remnawave_uuid
+            else user.remnawave_uuid
+        )
+        if user.telegram_id and not settings.is_multi_tariff_enabled():
+            traffic_stats = await remnawave_service.get_user_traffic_stats(user.telegram_id)
+        elif _traffic_uuid:
+            traffic_stats = await remnawave_service.get_user_traffic_stats_by_uuid(_traffic_uuid)
+        else:
+            traffic_stats = None
+
+        if not traffic_stats:
+            # Return current database values if RemnaWave unavailable
+            traffic_data = {
+                'traffic_used_bytes': int((subscription.traffic_used_gb or 0) * (1024**3)),
+                'traffic_used_gb': round(subscription.traffic_used_gb or 0, 2),
+                'traffic_limit_bytes': int((subscription.traffic_limit_gb or 0) * (1024**3)),
+                'traffic_limit_gb': subscription.traffic_limit_gb or 0,
+                'traffic_used_percent': round(
+                    ((subscription.traffic_used_gb or 0) / (subscription.traffic_limit_gb or 1)) * 100
+                    if subscription.traffic_limit_gb
+                    else 0,
+                    1,
+                ),
+                'is_unlimited': (subscription.traffic_limit_gb or 0) == 0,
+            }
+            return {
+                'success': True,
+                'cached': False,
+                'source': 'database',
+                **traffic_data,
+            }
+
+        # Update subscription with fresh data
+        used_gb = traffic_stats.get('used_traffic_gb', 0)
+        if abs((subscription.traffic_used_gb or 0) - used_gb) > 0.01:
+            subscription.traffic_used_gb = used_gb
+            subscription.updated_at = datetime.now(UTC)
+            await db.commit()
+
+        # Calculate percentage
+        limit_gb = subscription.traffic_limit_gb or 0
+        if limit_gb > 0:
+            percent = min(100, (used_gb / limit_gb) * 100)
+        else:
+            percent = 0
+
+        traffic_data = {
+            'traffic_used_bytes': traffic_stats.get('used_traffic_bytes', 0),
+            'traffic_used_gb': round(used_gb, 2),
+            'traffic_limit_bytes': traffic_stats.get('traffic_limit_bytes', 0),
+            'traffic_limit_gb': limit_gb,
+            'traffic_used_percent': round(percent, 1),
+            'is_unlimited': limit_gb == 0,
+            'lifetime_used_bytes': traffic_stats.get('lifetime_used_traffic_bytes', 0),
+            'lifetime_used_gb': round(traffic_stats.get('lifetime_used_traffic_gb', 0), 2),
+        }
+
+        # Cache the result
+        traffic_cache_key = cache_key('traffic', cache_suffix)
+        await cache.set(traffic_cache_key, traffic_data, TRAFFIC_CACHE_TTL)
+
+        return {
+            'success': True,
+            'cached': False,
+            'source': 'remnawave',
+            **traffic_data,
+        }
+
+    except Exception as e:
+        logger.error('Error refreshing traffic for user', user_id=user.id, error=e)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to refresh traffic data',
+        )

app/cabinet/routes/websocket.py

@@ -317,7 +317,8 @@ async def notify_user_balance_change(
 
 async def notify_user_subscription_activated(
     user_id: int,
-    expires_at: str,
+    subscription_id: int | None = None,
+    expires_at: str = '',
     tariff_name: str = '',
 ) -> None:
     """Уведомить пользователя об активации подписки."""
@@ -325,6 +326,7 @@ async def notify_user_subscription_activated(
         user_id,
         {
             'type': 'subscription.activated',
+            'subscription_id': subscription_id,
             'expires_at': expires_at,
             'tariff_name': tariff_name,
         },
@@ -359,7 +361,8 @@ async def notify_user_subscription_expired(user_id: int) -> None:
 
 async def notify_user_subscription_renewed(
     user_id: int,
-    new_expires_at: str,
+    subscription_id: int | None = None,
+    new_expires_at: str = '',
     amount_kopeks: int = 0,
 ) -> None:
     """Уведомить пользователя о продлении подписки."""
@@ -367,6 +370,7 @@ async def notify_user_subscription_renewed(
         user_id,
         {
             'type': 'subscription.renewed',
+            'subscription_id': subscription_id,
             'new_expires_at': new_expires_at,
             'amount_kopeks': amount_kopeks,
             'amount_rubles': amount_kopeks / 100,

app/cabinet/routes/wheel.py

@@ -5,7 +5,6 @@ API роуты колеса удачи для пользователей.
 import math
 import time
 
-import httpx
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel
@@ -50,6 +49,24 @@ async def get_wheel_config(
     # Проверяем доступность
     availability = await wheel_service.check_availability(db, user)
 
+    # Проверяем наличие подписки (multi-tariff aware)
+    if settings.is_multi_tariff_enabled():
+        from app.database.crud.subscription import get_active_subscriptions_by_user_id
+
+        active_subs = await get_active_subscriptions_by_user_id(db, user.id)
+        # Check if user has any active subscription for wheel access
+        if active_subs:
+            _non_daily = [s for s in active_subs if not getattr(s, 'is_daily_tariff', False)]
+            _pool = _non_daily or active_subs
+            subscription = max(_pool, key=lambda s: s.days_left)
+        else:
+            subscription = None
+    else:
+        from app.database.crud.subscription import get_subscription_by_user_id
+
+        subscription = await get_subscription_by_user_id(db, user.id)
+    has_subscription = subscription is not None and subscription.is_active
+
     prizes_display = [
         WheelPrizeDisplay(
             id=p.id,
@@ -61,6 +78,14 @@ async def get_wheel_config(
         for p in prizes
     ]
 
+    # Build eligible subscriptions for frontend picker
+    eligible_subs_display = None
+    if availability.eligible_subscriptions:
+        eligible_subs_display = [
+            {'id': s.id, 'tariff_name': s.tariff_name, 'days_left': s.days_left}
+            for s in availability.eligible_subscriptions
+        ]
+
     return WheelConfigResponse(
         is_enabled=config.is_enabled,
         name=config.name,
@@ -77,6 +102,8 @@ async def get_wheel_config(
         can_pay_days=availability.can_pay_days,
         user_balance_kopeks=availability.user_balance_kopeks,
         required_balance_kopeks=availability.required_balance_kopeks,
+        has_subscription=has_subscription,
+        eligible_subscriptions=eligible_subs_display,
     )
 
 
@@ -108,7 +135,7 @@ async def spin_wheel(
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Крутить колесо удачи."""
-    result = await wheel_service.spin(db, user, request.payment_type.value)
+    result = await wheel_service.spin(db, user, request.payment_type.value, subscription_id=request.subscription_id)
 
     if not result.success:
         # Возвращаем ошибку в теле ответа, а не HTTP exception
@@ -213,6 +240,28 @@ async def create_stars_invoice(
             detail='Оплата Stars не включена',
         )
 
+    # Проверяем наличие активной подписки (multi-tariff aware)
+    if settings.is_multi_tariff_enabled():
+        from app.database.crud.subscription import get_active_subscriptions_by_user_id
+
+        active_subs = await get_active_subscriptions_by_user_id(db, user.id)
+        # Check if user has any active subscription for Stars invoice
+        if active_subs:
+            _non_daily = [s for s in active_subs if not getattr(s, 'is_daily_tariff', False)]
+            _pool = _non_daily or active_subs
+            subscription = max(_pool, key=lambda s: s.days_left)
+        else:
+            subscription = None
+    else:
+        from app.database.crud.subscription import get_subscription_by_user_id
+
+        subscription = await get_subscription_by_user_id(db, user.id)
+    if not subscription or not subscription.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Для использования колеса необходима активная подписка',
+        )
+
     # Проверяем лимит спинов
     spins_today = await get_user_spins_today(db, user.id)
     if config.daily_spin_limit > 0 and spins_today >= config.daily_spin_limit:
@@ -234,44 +283,31 @@ async def create_stars_invoice(
 
     # Создаем invoice через Telegram Bot API
     try:
-        bot_token = settings.BOT_TOKEN
-        api_url = f'https://api.telegram.org/bot{bot_token}/createInvoiceLink'
+        from aiogram.exceptions import TelegramAPIError
+        from aiogram.types import LabeledPrice
 
-        async with httpx.AsyncClient() as client:
-            response = await client.post(
-                api_url,
-                json={
-                    'title': 'Колесо удачи',
-                    'description': f'Спин колеса удачи ({stars_amount} ⭐)',
-                    'payload': payload,
-                    'provider_token': '',  # Пустой для Stars
-                    'currency': 'XTR',
-                    'prices': [{'label': 'Спин колеса', 'amount': stars_amount}],
-                },
+        from app.bot_factory import create_bot
+
+        async with create_bot() as bot:
+            invoice_url = await bot.create_invoice_link(
+                title='Колесо удачи',
+                description=f'Спин колеса удачи ({stars_amount} ⭐)',
+                payload=payload,
+                provider_token='',
+                currency='XTR',
+                prices=[LabeledPrice(label='Спин колеса', amount=stars_amount)],
             )
 
-            result = response.json()
+        logger.info('Created Stars invoice for wheel spin: user=, stars', user_id=user.id, stars_amount=stars_amount)
 
-            if not result.get('ok'):
-                logger.error('Telegram API error', result=result)
-                raise HTTPException(
-                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                    detail='Ошибка создания инвойса',
-                )
+        return StarsInvoiceResponse(
+            invoice_url=invoice_url,
+            stars_amount=stars_amount,
+        )
 
-            invoice_url = result['result']
-            logger.info(
-                'Created Stars invoice for wheel spin: user=, stars', user_id=user.id, stars_amount=stars_amount
-            )
-
-            return StarsInvoiceResponse(
-                invoice_url=invoice_url,
-                stars_amount=stars_amount,
-            )
-
-    except httpx.HTTPError as e:
-        logger.error('HTTP error creating invoice', error=e)
+    except TelegramAPIError as e:
+        logger.error('Error creating invoice', error=e)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail='Ошибка соединения с Telegram',
+            detail='Ошибка создания инвойса',
         )

app/cabinet/routes/withdrawal.py

@@ -70,12 +70,11 @@ async def create_withdrawal(
 
     # Уведомляем админов о запросе на вывод
     try:
-        from aiogram import Bot
-
+        from app.bot_factory import create_bot
         from app.services.admin_notification_service import AdminNotificationService
 
         if getattr(settings, 'ADMIN_NOTIFICATIONS_ENABLED', False) and settings.BOT_TOKEN:
-            bot = Bot(token=settings.BOT_TOKEN)
+            bot = create_bot()
             try:
                 notification_service = AdminNotificationService(bot)
                 await notification_service.send_withdrawal_request_notification(

app/cabinet/schemas/auth.py

@@ -8,27 +8,43 @@ from pydantic import BaseModel, EmailStr, Field
 class TelegramAuthRequest(BaseModel):
     """Request for Telegram WebApp initData authentication."""
 
-    init_data: str = Field(..., description='Telegram WebApp initData string')
+    init_data: str = Field(..., max_length=4096, description='Telegram WebApp initData string')
     campaign_slug: str | None = Field(
         None, min_length=1, max_length=64, pattern=r'^[a-zA-Z0-9_-]+$', description='Campaign slug from web link'
     )
-    referral_code: str | None = Field(None, max_length=32, description='Referral code of inviter')
+    referral_code: str | None = Field(
+        None, max_length=32, pattern=r'^[a-zA-Z0-9_-]+$', description='Referral code of inviter'
+    )
 
 
 class TelegramWidgetAuthRequest(BaseModel):
     """Request for Telegram Login Widget authentication."""
 
     id: int = Field(..., description='Telegram user ID')
-    first_name: str = Field(..., description="User's first name")
-    last_name: str | None = Field(None, description="User's last name")
-    username: str | None = Field(None, description="User's username")
-    photo_url: str | None = Field(None, description="User's photo URL")
+    first_name: str = Field(..., max_length=64, description="User's first name")
+    last_name: str | None = Field(None, max_length=64, description="User's last name")
+    username: str | None = Field(None, max_length=32, description="User's username")
+    photo_url: str | None = Field(None, max_length=512, description="User's photo URL")
     auth_date: int = Field(..., description='Unix timestamp of authentication')
-    hash: str = Field(..., description='Authentication hash')
+    hash: str = Field(..., min_length=64, max_length=64, description='Authentication hash')
     campaign_slug: str | None = Field(
         None, min_length=1, max_length=64, pattern=r'^[a-zA-Z0-9_-]+$', description='Campaign slug from web link'
     )
-    referral_code: str | None = Field(None, max_length=32, description='Referral code of inviter')
+    referral_code: str | None = Field(
+        None, max_length=32, pattern=r'^[a-zA-Z0-9_-]+$', description='Referral code of inviter'
+    )
+
+
+class TelegramOIDCAuthRequest(BaseModel):
+    """Request for Telegram OIDC authentication (popup flow)."""
+
+    id_token: str = Field(..., max_length=4096, description='JWT id_token from Telegram OIDC popup')
+    campaign_slug: str | None = Field(
+        None, min_length=1, max_length=64, pattern=r'^[a-zA-Z0-9_-]+$', description='Campaign slug from web link'
+    )
+    referral_code: str | None = Field(
+        None, max_length=32, pattern=r'^[a-zA-Z0-9_-]+$', description='Referral code of inviter'
+    )
 
 
 class EmailRegisterRequest(BaseModel):
@@ -41,7 +57,7 @@ class EmailRegisterRequest(BaseModel):
 class EmailVerifyRequest(BaseModel):
     """Request to verify email with token."""
 
-    token: str = Field(..., description='Email verification token')
+    token: str = Field(..., max_length=2048, description='Email verification token')
     campaign_slug: str | None = Field(
         None, min_length=1, max_length=64, pattern=r'^[a-zA-Z0-9_-]+$', description='Campaign slug from web link'
     )
@@ -51,7 +67,7 @@ class EmailLoginRequest(BaseModel):
     """Request to login with email and password."""
 
     email: EmailStr = Field(..., description='Email address')
-    password: str = Field(..., description='Password')
+    password: str = Field(..., min_length=1, max_length=128, description='Password')
     campaign_slug: str | None = Field(
         None, min_length=1, max_length=64, pattern=r'^[a-zA-Z0-9_-]+$', description='Campaign slug from web link'
     )
@@ -60,7 +76,7 @@ class EmailLoginRequest(BaseModel):
 class RefreshTokenRequest(BaseModel):
     """Request to refresh access token."""
 
-    refresh_token: str = Field(..., description='Refresh token')
+    refresh_token: str = Field(..., max_length=2048, description='Refresh token')
 
 
 class PasswordForgotRequest(BaseModel):
@@ -72,10 +88,16 @@ class PasswordForgotRequest(BaseModel):
 class PasswordResetRequest(BaseModel):
     """Request to reset password with token."""
 
-    token: str = Field(..., description='Password reset token')
+    token: str = Field(..., max_length=2048, description='Password reset token')
     password: str = Field(..., min_length=8, max_length=128, description='New password (min 8 chars)')
 
 
+class AutoLoginRequest(BaseModel):
+    """Request for auto-login from guest purchase success page."""
+
+    token: str = Field(..., max_length=2048, description='Auto-login JWT token')
+
+
 class TokenResponse(BaseModel):
     """Token pair response."""
 
@@ -112,8 +134,10 @@ class EmailRegisterStandaloneRequest(BaseModel):
     email: EmailStr = Field(..., description='Email address')
     password: str = Field(..., min_length=8, max_length=128, description='Password (min 8 chars)')
     first_name: str | None = Field(None, max_length=64, description='First name')
-    language: str = Field('ru', description='Preferred language')
-    referral_code: str | None = Field(None, max_length=32, description='Referral code of inviter')
+    language: str = Field('ru', max_length=5, pattern=r'^[a-z]{2}$', description='Preferred language (ISO 639-1)')
+    referral_code: str | None = Field(
+        None, max_length=32, pattern=r'^[a-zA-Z0-9_-]+$', description='Referral code of inviter'
+    )
 
 
 class CampaignBonusInfo(BaseModel):
@@ -154,7 +178,7 @@ class EmailChangeRequest(BaseModel):
 class EmailChangeVerifyRequest(BaseModel):
     """Request to verify email change with code."""
 
-    code: str = Field(..., min_length=6, max_length=6, description='6-digit verification code')
+    code: str = Field(..., min_length=6, max_length=6, pattern=r'^\d{6}$', description='6-digit verification code')
 
 
 class EmailChangeResponse(BaseModel):
@@ -163,3 +187,28 @@ class EmailChangeResponse(BaseModel):
     message: str = Field(..., description='Success message')
     new_email: str = Field(..., description='New email address pending verification')
     expires_in_minutes: int = Field(..., description='Code expiration time in minutes')
+
+
+class DeepLinkTokenResponse(BaseModel):
+    """Response with deep link auth token."""
+
+    token: str = Field(..., description='One-time auth token')
+    bot_username: str = Field(..., description='Bot username for deep link')
+    expires_in: int = Field(..., description='Token TTL in seconds')
+
+
+class DeepLinkPollRequest(BaseModel):
+    """Request to poll deep link auth status.
+
+    Deep link auth is always for existing bot users — referral codes are not applicable here.
+    Only campaign_slug is supported (campaign bonus can apply to existing users).
+    """
+
+    token: str = Field(..., min_length=16, max_length=128, description='Deep link auth token')
+    campaign_slug: str | None = Field(
+        None,
+        min_length=1,
+        max_length=64,
+        pattern=r'^[a-zA-Z0-9_-]+$',
+        description='Campaign slug captured from cabinet URL',
+    )

app/cabinet/schemas/balance.py

@@ -3,7 +3,7 @@
 from datetime import datetime
 from typing import Any
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 
 class BalanceResponse(BaseModel):
@@ -26,8 +26,7 @@ class TransactionResponse(BaseModel):
     created_at: datetime
     completed_at: datetime | None = None
 
-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
 
 
 class TransactionListResponse(BaseModel):
@@ -114,8 +113,7 @@ class PendingPaymentResponse(BaseModel):
     user_telegram_id: int | None = None
     user_username: str | None = None
 
-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
 
 
 class PendingPaymentListResponse(BaseModel):
@@ -137,3 +135,23 @@ class ManualCheckResponse(BaseModel):
     status_changed: bool = False
     old_status: str | None = None
     new_status: str | None = None
+
+
+class SavedCardResponse(BaseModel):
+    """Saved payment method (card) for recurrent payments."""
+
+    id: int
+    method_type: str
+    card_last4: str | None = None
+    card_type: str | None = None
+    title: str | None = None
+    created_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class SavedCardsListResponse(BaseModel):
+    """List of saved payment methods."""
+
+    cards: list[SavedCardResponse]
+    recurrent_enabled: bool = False

app/cabinet/schemas/broadcasts.py

@@ -3,7 +3,7 @@
 from datetime import datetime
 from typing import Literal
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 
 
 # ============ Channel Types ============
@@ -75,6 +75,27 @@ class BroadcastButtonsResponse(BaseModel):
     buttons: list[BroadcastButton]
 
 
+class CustomBroadcastButton(BaseModel):
+    """Custom button for broadcast message."""
+
+    label: str = Field(..., min_length=1, max_length=64)
+    action_type: Literal['callback', 'url'] = 'callback'
+    action_value: str = Field(..., min_length=1, max_length=256)
+
+    @field_validator('action_value')
+    @classmethod
+    def validate_action_value(cls, v: str, info) -> str:
+        action_type = info.data.get('action_type', 'callback')
+        if action_type == 'url':
+            if not v.startswith(('https://', 'tg://')):
+                raise ValueError('URL must start with https:// or tg://')
+        elif action_type == 'callback':
+            # Telegram API limits callback_data to 64 bytes
+            if len(v.encode('utf-8')) > 64:
+                raise ValueError('Callback data must be at most 64 bytes')
+        return v
+
+
 # ============ Media ============
 
 
@@ -95,6 +116,7 @@ class BroadcastCreateRequest(BaseModel):
     target: str
     message_text: str = Field(..., min_length=1, max_length=4000)
     selected_buttons: list[str] = Field(default_factory=lambda: ['home'])
+    custom_buttons: list[CustomBroadcastButton] = Field(default_factory=list, max_length=10)
     media: BroadcastMediaRequest | None = None
 
 
@@ -187,6 +209,7 @@ class CombinedBroadcastCreateRequest(BaseModel):
     # Telegram-specific fields
     message_text: str | None = Field(default=None, max_length=4000)
     selected_buttons: list[str] = Field(default_factory=lambda: ['home'])
+    custom_buttons: list[CustomBroadcastButton] = Field(default_factory=list, max_length=10)
     media: BroadcastMediaRequest | None = None
 
     # Email-specific fields

app/cabinet/schemas/campaigns.py

@@ -3,7 +3,7 @@
 from datetime import datetime
 from typing import Literal
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 
 CampaignBonusType = Literal['balance', 'subscription', 'none', 'tariff']
@@ -31,8 +31,7 @@ class CampaignListItem(BaseModel):
     partner_name: str | None = None
     created_at: datetime
 
-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
 
 
 class CampaignListResponse(BaseModel):
@@ -73,8 +72,7 @@ class CampaignDetailResponse(BaseModel):
     deep_link: str | None = None
     web_link: str | None = None
 
-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
 
 
 class CampaignCreateRequest(BaseModel):
@@ -179,8 +177,7 @@ class CampaignRegistrationItem(BaseModel):
     has_subscription: bool = False
     has_paid: bool = False
 
-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
 
 
 class CampaignRegistrationsResponse(BaseModel):
@@ -220,3 +217,61 @@ class ServerSquadInfo(BaseModel):
     squad_uuid: str
     display_name: str
     country_code: str | None = None
+
+
+# --- Admin campaign chart data schemas ---
+
+
+class AdminDailyStatItem(BaseModel):
+    """Daily stat item for admin campaign charts."""
+
+    date: str
+    referrals_count: int = 0  # actually registrations, named for frontend compat
+    earnings_kopeks: int = 0  # actually revenue, named for frontend compat
+
+
+class AdminPeriodStats(BaseModel):
+    """Period stats for admin campaign comparison."""
+
+    days: int
+    referrals_count: int = 0
+    earnings_kopeks: int = 0
+
+
+class AdminPeriodChange(BaseModel):
+    """Change metrics between periods."""
+
+    absolute: int = 0
+    percent: float = 0.0
+    trend: str = 'stable'
+
+
+class AdminPeriodComparison(BaseModel):
+    """Comparison of current vs previous period."""
+
+    current: AdminPeriodStats
+    previous: AdminPeriodStats
+    referrals_change: AdminPeriodChange
+    earnings_change: AdminPeriodChange
+
+
+class AdminTopRegistrationItem(BaseModel):
+    """Top user by spending in a campaign."""
+
+    id: int
+    full_name: str
+    created_at: datetime
+    has_paid: bool = False
+    is_active: bool = False
+    total_earnings_kopeks: int = 0  # actually total spending, named for frontend compat
+
+
+class AdminCampaignChartDataResponse(BaseModel):
+    """Chart data for admin campaign stats page."""
+
+    campaign_id: int
+    total_deposits_kopeks: int = 0
+    total_spending_kopeks: int = 0
+    daily_stats: list[AdminDailyStatItem] = []
+    period_comparison: AdminPeriodComparison
+    top_registrations: list[AdminTopRegistrationItem] = []

app/cabinet/schemas/gift.py

@@ -0,0 +1,131 @@
+"""Schemas for cabinet gift subscription feature."""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field, model_validator
+
+
+class GiftConfigSubOption(BaseModel):
+    id: str
+    name: str
+
+
+class GiftConfigTariffPeriod(BaseModel):
+    days: int
+    price_kopeks: int
+    price_label: str
+    original_price_kopeks: int | None = None
+    discount_percent: int | None = None
+
+
+class GiftConfigTariff(BaseModel):
+    id: int
+    name: str
+    description: str | None = None
+    traffic_limit_gb: int
+    device_limit: int
+    periods: list[GiftConfigTariffPeriod]
+
+
+class GiftConfigPaymentMethod(BaseModel):
+    method_id: str
+    display_name: str
+    description: str | None = None
+    icon_url: str | None = None
+    min_amount_kopeks: int | None = None
+    max_amount_kopeks: int | None = None
+    sub_options: list[GiftConfigSubOption] | None = None
+
+
+class GiftConfigResponse(BaseModel):
+    is_enabled: bool
+    tariffs: list[GiftConfigTariff] = []
+    payment_methods: list[GiftConfigPaymentMethod] = []
+    balance_kopeks: int = 0
+    currency_symbol: str = '\u20bd'
+    promo_group_name: str | None = None
+    active_discount_percent: int | None = None
+    active_discount_expires_at: datetime | None = None
+
+
+class GiftPurchaseRequest(BaseModel):
+    tariff_id: int = Field(gt=0)
+    period_days: int = Field(gt=0, le=3650)
+    recipient_type: str | None = Field(default=None, pattern=r'^(email|telegram)$')
+    recipient_value: str | None = Field(default=None, max_length=255)
+    gift_message: str | None = Field(default=None, max_length=1000)
+    payment_mode: str = Field(pattern=r'^(balance|gateway)$')
+    payment_method: str | None = Field(default=None, max_length=50)
+
+    @model_validator(mode='after')
+    def validate_payment(self) -> GiftPurchaseRequest:
+        if self.payment_mode == 'gateway' and not self.payment_method:
+            raise ValueError('payment_method is required for gateway mode')
+        return self
+
+
+class GiftPurchaseResponse(BaseModel):
+    status: str
+    purchase_token: str
+    payment_url: str | None = None
+    warning: str | None = None
+
+
+class GiftPurchaseStatusResponse(BaseModel):
+    status: str
+    is_gift: bool = True
+    is_code_only: bool = False
+    purchase_token: str | None = None
+    recipient_contact_value: str | None = None
+    gift_message: str | None = None
+    tariff_name: str | None = None
+    period_days: int | None = None
+    warning: str | None = None
+
+
+class PendingGiftResponse(BaseModel):
+    token: str
+    tariff_name: str | None = None
+    period_days: int
+    gift_message: str | None = None
+    sender_display: str | None = None
+    created_at: datetime | None = None
+
+
+class SentGiftResponse(BaseModel):
+    """A gift the current user has sent."""
+
+    token: str
+    tariff_name: str | None = None
+    period_days: int
+    device_limit: int = 1
+    status: str
+    gift_recipient_value: str | None = None
+    gift_message: str | None = None
+    activated_by_username: str | None = None
+    created_at: datetime | None = None
+
+
+class ReceivedGiftResponse(BaseModel):
+    """A gift the current user has received."""
+
+    token: str
+    tariff_name: str | None = None
+    period_days: int
+    device_limit: int = 1
+    status: str
+    sender_display: str | None = None
+    gift_message: str | None = None
+    created_at: datetime | None = None
+
+
+class ActivateGiftRequest(BaseModel):
+    code: str = Field(min_length=1, max_length=100)
+
+
+class ActivateGiftResponse(BaseModel):
+    status: str
+    tariff_name: str | None = None
+    period_days: int | None = None

app/cabinet/schemas/news.py

@@ -0,0 +1,332 @@
+"""Schemas for news articles in cabinet.
+
+Security notes:
+- featured_image_url is validated to only accept http/https schemes.
+- category_color is validated as a strict hex color (#RGB, #RRGGBB, etc.).
+- Slug is sanitized to only allow [a-zA-Z0-9_-].
+- Content is server-side sanitized to strip <script>, event handlers, and
+  dangerous URI schemes as a defense-in-depth measure. The frontend also
+  sanitizes via DOMPurify, but server-side sanitization protects against
+  alternative consumers (mobile apps, RSS, email digests) and compromised
+  frontends.
+"""
+
+import re
+from datetime import datetime
+from urllib.parse import urlparse
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+
+# Pre-compiled regex for hex color validation (reused across validators)
+_HEX_COLOR_RE: re.Pattern[str] = re.compile(r'^#([0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$')
+
+# Pre-compiled regex for collapsing repeated hyphens in slugs
+_MULTI_HYPHEN_RE: re.Pattern[str] = re.compile(r'-+')
+
+# Maximum slug length (matches DB column constraint)
+_MAX_SLUG_LENGTH: int = 500
+
+# Allowed URL schemes for user-supplied URLs (featured_image_url)
+_SAFE_URL_SCHEMES: frozenset[str] = frozenset({'http', 'https'})
+
+# Cyrillic-to-Latin transliteration map for slug generation
+_TRANSLIT_MAP: dict[str, str] = {
+    'а': 'a',
+    'б': 'b',
+    'в': 'v',
+    'г': 'g',
+    'д': 'd',
+    'е': 'e',
+    'ё': 'yo',
+    'ж': 'zh',
+    'з': 'z',
+    'и': 'i',
+    'й': 'y',
+    'к': 'k',
+    'л': 'l',
+    'м': 'm',
+    'н': 'n',
+    'о': 'o',
+    'п': 'p',
+    'р': 'r',
+    'с': 's',
+    'т': 't',
+    'у': 'u',
+    'ф': 'f',
+    'х': 'kh',
+    'ц': 'ts',
+    'ч': 'ch',
+    'ш': 'sh',
+    'щ': 'shch',
+    'ъ': '',
+    'ы': 'y',
+    'ь': '',
+    'э': 'e',
+    'ю': 'yu',
+    'я': 'ya',
+}
+
+
+def _slugify(title: str) -> str:
+    """Generate a URL-safe slug from a title, transliterating Cyrillic."""
+    slug = title.lower()
+    result: list[str] = []
+    for ch in slug:
+        if ch in _TRANSLIT_MAP:
+            result.append(_TRANSLIT_MAP[ch])
+        elif ch.isascii() and (ch.isalnum() or ch in '-_'):
+            result.append(ch)
+        elif ch == ' ':
+            result.append('-')
+    slug = ''.join(result)
+    slug = _MULTI_HYPHEN_RE.sub('-', slug).strip('-')
+    return slug[:_MAX_SLUG_LENGTH] or 'untitled'
+
+
+def _validate_hex_color(v: str) -> str:
+    """Validate a hex color string. Raises ValueError on invalid input."""
+    if not _HEX_COLOR_RE.match(v):
+        msg = 'category_color must be a valid hex color (e.g. #00e5a0)'
+        raise ValueError(msg)
+    return v
+
+
+def _validate_safe_url(v: str) -> str:
+    """Validate that a URL uses http or https scheme only.
+
+    Prevents javascript:, data:, vbscript:, and other dangerous URI schemes
+    from being stored in the database and later rendered in <img> or <a> tags.
+    """
+    try:
+        parsed = urlparse(v)
+    except Exception:
+        msg = 'Invalid URL format'
+        raise ValueError(msg)
+
+    if parsed.scheme not in _SAFE_URL_SCHEMES:
+        msg = f'URL scheme must be http or https, got: {parsed.scheme!r}'
+        raise ValueError(msg)
+
+    if not parsed.netloc:
+        msg = 'URL must have a valid host'
+        raise ValueError(msg)
+
+    return v
+
+
+# --- Server-side HTML content sanitization ---
+# Pre-compiled patterns for stripping the most dangerous HTML constructs.
+# This is a defense-in-depth measure: the frontend also sanitizes via DOMPurify.
+# Uses regex rather than a full HTML parser to avoid adding a new dependency.
+# Strips: <script>, <style>, <object>, <embed>, <applet>, <base>, <form>,
+# <link>, <meta> tags and all on* event handler attributes.
+_DANGEROUS_TAGS_RE: re.Pattern[str] = re.compile(
+    r'<\s*/?\s*(script|style|object|embed|applet|base|form|link(?:\s)|meta)\b[^>]*>',
+    re.IGNORECASE | re.DOTALL,
+)
+# Match on* event handler attributes, e.g. onclick="...", onerror='...'
+_EVENT_HANDLER_RE: re.Pattern[str] = re.compile(
+    r'\s+on[a-z]+\s*=\s*(?:"[^"]*"|\'[^\']*\'|[^\s>]+)',
+    re.IGNORECASE,
+)
+# Match javascript:, vbscript:, data: in href/src attributes
+_DANGEROUS_URI_RE: re.Pattern[str] = re.compile(
+    r'((?:href|src)\s*=\s*["\'])\s*(javascript|vbscript|data)\s*:',
+    re.IGNORECASE,
+)
+
+
+def _sanitize_html_content(html: str) -> str:
+    """Strip dangerous HTML constructs from article content.
+
+    This is NOT a replacement for DOMPurify on the frontend. It is a
+    defense-in-depth layer that removes the most obvious XSS vectors
+    at the storage boundary. A full HTML sanitizer (nh3, bleach) would
+    be stronger, but this avoids adding a new dependency.
+    """
+    if not html:
+        return html
+
+    # 1. Remove dangerous tags and their content
+    result = _DANGEROUS_TAGS_RE.sub('', html)
+
+    # Also strip <script>...</script> content (tag + body)
+    result = re.sub(r'<script\b[^>]*>[\s\S]*?</script>', '', result, flags=re.IGNORECASE)
+    result = re.sub(r'<style\b[^>]*>[\s\S]*?</style>', '', result, flags=re.IGNORECASE)
+
+    # 2. Remove event handler attributes
+    result = _EVENT_HANDLER_RE.sub('', result)
+
+    # 3. Neutralize dangerous URI schemes in href/src
+    result = _DANGEROUS_URI_RE.sub(r'\1about:', result)
+
+    return result
+
+
+class NewsArticleResponse(BaseModel):
+    """Full news article response (detail view)."""
+
+    id: int
+    title: str
+    slug: str
+    content: str
+    excerpt: str | None
+    category: str
+    category_color: str
+    tag: str | None
+    category_id: int | None = None
+    tag_id: int | None = None
+    featured_image_url: str | None
+    is_published: bool
+    is_featured: bool
+    published_at: datetime | None
+    read_time_minutes: int
+    views_count: int
+    author_name: str | None = None
+    created_at: datetime
+    updated_at: datetime | None
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class NewsArticleListItem(BaseModel):
+    """Compact news article for list views."""
+
+    id: int
+    title: str
+    slug: str
+    excerpt: str | None
+    category: str
+    category_color: str
+    tag: str | None
+    category_id: int | None = None
+    tag_id: int | None = None
+    featured_image_url: str | None
+    is_published: bool
+    is_featured: bool
+    published_at: datetime | None
+    read_time_minutes: int
+    views_count: int
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class NewsListResponse(BaseModel):
+    """Paginated list of news articles."""
+
+    items: list[NewsArticleListItem]
+    total: int
+    categories: list[str] = Field(default_factory=list)
+
+
+class NewsCreateRequest(BaseModel):
+    """Request to create a news article."""
+
+    title: str = Field(..., min_length=1, max_length=500)
+    slug: str | None = Field(None, min_length=1, max_length=500)
+    content: str = Field(default='', max_length=500_000)
+    excerpt: str | None = Field(None, max_length=1000)
+    category: str = Field(..., min_length=1, max_length=100)
+    category_color: str = Field(default='#00e5a0', max_length=20)
+    tag: str | None = Field(None, max_length=50)
+    category_id: int | None = None
+    tag_id: int | None = None
+    featured_image_url: str | None = Field(None, max_length=2000)
+    is_published: bool = False
+    is_featured: bool = False
+    read_time_minutes: int = Field(default=1, ge=1, le=60)
+
+    @field_validator('content')
+    @classmethod
+    def sanitize_content(cls, v: str) -> str:
+        """Strip dangerous HTML from article content (defense-in-depth)."""
+        return _sanitize_html_content(v)
+
+    @field_validator('category_color')
+    @classmethod
+    def validate_hex_color(cls, v: str) -> str:
+        return _validate_hex_color(v)
+
+    @field_validator('featured_image_url')
+    @classmethod
+    def validate_featured_image_url(cls, v: str | None) -> str | None:
+        """Reject javascript:, data:, and other dangerous URL schemes."""
+        if v is not None:
+            return _validate_safe_url(v)
+        return v
+
+    @model_validator(mode='before')
+    @classmethod
+    def auto_generate_slug(cls, data: dict) -> dict:  # type: ignore[type-arg]
+        """Generate slug from title when not explicitly provided."""
+        if isinstance(data, dict) and not data.get('slug'):
+            title = data.get('title', '')
+            data['slug'] = _slugify(title) if isinstance(title, str) else 'untitled'
+        return data
+
+    @field_validator('slug')
+    @classmethod
+    def sanitize_slug(cls, v: str | None) -> str | None:
+        """Ensure slug contains only URL-safe characters, transliterating Cyrillic."""
+        if v is not None:
+            return _slugify(v)
+        return v
+
+
+class NewsUpdateRequest(BaseModel):
+    """Request to update a news article."""
+
+    title: str | None = Field(None, min_length=1, max_length=500)
+    slug: str | None = Field(None, min_length=1, max_length=500)
+    content: str | None = Field(None, max_length=500_000)
+    excerpt: str | None = None
+    category: str | None = Field(None, min_length=1, max_length=100)
+    category_color: str | None = Field(None, max_length=20)
+    tag: str | None = None
+    category_id: int | None = None
+    tag_id: int | None = None
+    featured_image_url: str | None = Field(None, max_length=2000)
+    is_published: bool | None = None
+    is_featured: bool | None = None
+    read_time_minutes: int | None = Field(None, ge=1, le=60)
+
+    @field_validator('content')
+    @classmethod
+    def sanitize_content(cls, v: str | None) -> str | None:
+        """Strip dangerous HTML from article content (defense-in-depth)."""
+        if v is not None:
+            return _sanitize_html_content(v)
+        return v
+
+    @field_validator('category_color')
+    @classmethod
+    def validate_hex_color(cls, v: str | None) -> str | None:
+        if v is not None:
+            return _validate_hex_color(v)
+        return v
+
+    @field_validator('featured_image_url')
+    @classmethod
+    def validate_featured_image_url(cls, v: str | None) -> str | None:
+        """Reject javascript:, data:, and other dangerous URL schemes."""
+        if v is not None:
+            return _validate_safe_url(v)
+        return v
+
+    @field_validator('slug')
+    @classmethod
+    def sanitize_slug(cls, v: str | None) -> str | None:
+        """Ensure slug contains only URL-safe characters, transliterating Cyrillic."""
+        if v is not None:
+            return _slugify(v)
+        return v
+
+
+class NewsToggleResponse(BaseModel):
+    """Response after toggling publish/featured status."""
+
+    id: int
+    is_published: bool
+    is_featured: bool
+    published_at: datetime | None

app/cabinet/schemas/news_categories.py

@@ -0,0 +1,48 @@
+"""Schemas for news categories."""
+
+import re
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+
+_HEX_COLOR_RE: re.Pattern[str] = re.compile(r'^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$')
+
+
+class NewsCategoryCreate(BaseModel):
+    """Request to create a news category."""
+
+    name: str = Field(..., min_length=1, max_length=100)
+    color: str = Field(default='#00e5a0', max_length=20)
+
+    @field_validator('color')
+    @classmethod
+    def validate_color(cls, v: str) -> str:
+        if not _HEX_COLOR_RE.match(v):
+            msg = 'Invalid hex color'
+            raise ValueError(msg)
+        return v
+
+
+class NewsCategoryUpdate(BaseModel):
+    """Request to update a news category."""
+
+    name: str | None = Field(None, min_length=1, max_length=100)
+    color: str | None = Field(None, max_length=20)
+
+    @field_validator('color')
+    @classmethod
+    def validate_color(cls, v: str | None) -> str | None:
+        if v is not None and not _HEX_COLOR_RE.match(v):
+            msg = 'Invalid hex color'
+            raise ValueError(msg)
+        return v
+
+
+class NewsCategoryResponse(BaseModel):
+    """News category response."""
+
+    id: int
+    name: str
+    color: str
+
+    model_config = ConfigDict(from_attributes=True)

app/cabinet/schemas/news_media.py

@@ -0,0 +1,17 @@
+"""Schemas for news media upload responses."""
+
+from typing import Literal
+
+from pydantic import BaseModel
+
+
+class NewsMediaUploadResponse(BaseModel):
+    """Response returned after a successful media upload."""
+
+    url: str
+    thumbnail_url: str | None = None
+    media_type: Literal['image', 'video']
+    filename: str
+    size_bytes: int
+    width: int | None = None
+    height: int | None = None

app/cabinet/schemas/news_tags.py

@@ -0,0 +1,48 @@
+"""Schemas for news tags."""
+
+import re
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+
+_HEX_COLOR_RE: re.Pattern[str] = re.compile(r'^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$')
+
+
+class NewsTagCreate(BaseModel):
+    """Request to create a news tag."""
+
+    name: str = Field(..., min_length=1, max_length=50)
+    color: str = Field(default='#94a3b8', max_length=20)
+
+    @field_validator('color')
+    @classmethod
+    def validate_color(cls, v: str) -> str:
+        if not _HEX_COLOR_RE.match(v):
+            msg = 'Invalid hex color'
+            raise ValueError(msg)
+        return v
+
+
+class NewsTagUpdate(BaseModel):
+    """Request to update a news tag."""
+
+    name: str | None = Field(None, min_length=1, max_length=50)
+    color: str | None = Field(None, max_length=20)
+
+    @field_validator('color')
+    @classmethod
+    def validate_color(cls, v: str | None) -> str | None:
+        if v is not None and not _HEX_COLOR_RE.match(v):
+            msg = 'Invalid hex color'
+            raise ValueError(msg)
+        return v
+
+
+class NewsTagResponse(BaseModel):
+    """News tag response."""
+
+    id: int
+    name: str
+    color: str
+
+    model_config = ConfigDict(from_attributes=True)

app/cabinet/schemas/partners.py

@@ -2,7 +2,7 @@
 
 from datetime import datetime
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, ConfigDict, Field
 
 
 # ==================== User-facing ====================
@@ -16,6 +16,7 @@ class PartnerApplicationRequest(BaseModel):
     telegram_channel: str | None = Field(None, max_length=255)
     description: str | None = Field(None, max_length=2000)
     expected_monthly_referrals: int | None = Field(None, ge=0, le=2_000_000_000)
+    desired_commission_percent: int | None = Field(None, ge=1, le=100)
 
 
 class PartnerApplicationInfo(BaseModel):
@@ -28,13 +29,13 @@ class PartnerApplicationInfo(BaseModel):
     telegram_channel: str | None = None
     description: str | None = None
     expected_monthly_referrals: int | None = None
+    desired_commission_percent: int | None = None
     admin_comment: str | None = None
     approved_commission_percent: int | None = None
     created_at: datetime
     processed_at: datetime | None = None
 
-    class Config:
-        from_attributes = True
+    model_config = ConfigDict(from_attributes=True)
 
 
 class PartnerCampaignInfo(BaseModel):
@@ -49,6 +50,10 @@ class PartnerCampaignInfo(BaseModel):
     subscription_traffic_gb: int | None = None
     deep_link: str | None = None
     web_link: str | None = None
+    # Per-campaign statistics
+    registrations_count: int = 0
+    referrals_count: int = 0
+    earnings_kopeks: int = 0
 
 
 class PartnerStatusResponse(BaseModel):
@@ -60,6 +65,75 @@ class PartnerStatusResponse(BaseModel):
     campaigns: list[PartnerCampaignInfo] = []
 
 
+# ==================== Campaign detailed stats ====================
+
+
+class DailyStatItem(BaseModel):
+    """Single day of campaign stats."""
+
+    date: str
+    referrals_count: int = 0
+    earnings_kopeks: int = 0
+
+
+class PeriodStats(BaseModel):
+    """Stats for a single period."""
+
+    days: int
+    referrals_count: int = 0
+    earnings_kopeks: int = 0
+
+
+class PeriodChange(BaseModel):
+    """Change metrics between periods."""
+
+    absolute: int = 0
+    percent: float = 0.0
+    trend: str = 'stable'
+
+
+class PeriodComparison(BaseModel):
+    """Comparison between current and previous period."""
+
+    current: PeriodStats
+    previous: PeriodStats
+    referrals_change: PeriodChange
+    earnings_change: PeriodChange
+
+
+class CampaignReferralItem(BaseModel):
+    """Referral user in campaign stats."""
+
+    id: int
+    full_name: str
+    created_at: datetime
+    has_paid: bool = False
+    is_active: bool = False
+    total_earnings_kopeks: int = 0
+
+
+class PartnerCampaignDetailedStats(BaseModel):
+    """Detailed stats for a single campaign."""
+
+    campaign_id: int
+    campaign_name: str
+    # Summary
+    registrations_count: int = 0
+    referrals_count: int = 0
+    earnings_kopeks: int = 0
+    conversion_rate: float = 0.0
+    # Period earnings
+    earnings_today: int = 0
+    earnings_week: int = 0
+    earnings_month: int = 0
+    # Daily chart (30 days)
+    daily_stats: list[DailyStatItem] = []
+    # Period comparison (this week vs last week)
+    period_comparison: PeriodComparison
+    # Top referrals
+    top_referrals: list[CampaignReferralItem] = []
+
+
 # ==================== Admin-facing ====================
 
 
@@ -76,6 +150,7 @@ class AdminPartnerApplicationItem(BaseModel):
     telegram_channel: str | None = None
     description: str | None = None
     expected_monthly_referrals: int | None = None
+    desired_commission_percent: int | None = None
     status: str
     admin_comment: str | None = None
     approved_commission_percent: int | None = None
@@ -132,6 +207,9 @@ class CampaignSummary(BaseModel):
     name: str
     start_parameter: str
     is_active: bool
+    registrations_count: int = 0
+    referrals_count: int = 0
+    earnings_kopeks: int = 0
 
 
 class AdminPartnerDetailResponse(BaseModel):

app/cabinet/schemas/referral.py

@@ -10,11 +10,15 @@ class ReferralInfoResponse(BaseModel):
 
     referral_code: str
     referral_link: str
+    bot_referral_link: str = ''
     total_referrals: int
     active_referrals: int
     total_earnings_kopeks: int
     total_earnings_rubles: float
     commission_percent: int
+    available_balance_kopeks: int = 0
+    available_balance_rubles: float = 0
+    withdrawn_kopeks: int = 0
 
 
 class ReferralItemResponse(BaseModel):
@@ -77,4 +81,5 @@ class ReferralTermsResponse(BaseModel):
     first_topup_bonus_rubles: float
     inviter_bonus_kopeks: int
     inviter_bonus_rubles: float
+    max_commission_payments: int = 0
     partner_section_visible: bool = True

app/cabinet/schemas/remnawave.py

@@ -47,11 +47,9 @@ class ServerInfo(BaseModel):
     """Server hardware info."""
 
     cpu_cores: int
-    cpu_physical_cores: int
     memory_total: int
     memory_used: int
     memory_free: int
-    memory_available: int
     uptime_seconds: int
 
 
@@ -108,22 +106,22 @@ class NodeInfo(BaseModel):
     is_disabled: bool
     is_node_online: bool
     is_xray_running: bool
-    users_online: int | None = None
+    users_online: int = 0
     traffic_used_bytes: int | None = None
     traffic_limit_bytes: int | None = None
     last_status_change: datetime | None = None
     last_status_message: str | None = None
-    xray_uptime: str | None = None
+    xray_uptime: int = 0
     is_traffic_tracking_active: bool = False
     traffic_reset_day: int | None = None
     notify_percent: int | None = None
     consumption_multiplier: float = 1.0
-    cpu_count: int | None = None
-    cpu_model: str | None = None
-    total_ram: str | None = None
     created_at: datetime | None = None
     updated_at: datetime | None = None
     provider_uuid: str | None = None
+    versions: dict[str, str] | None = None
+    system: dict[str, Any] | None = None
+    active_plugin_uuid: str | None = None
 
 
 class NodesListResponse(BaseModel):

app/cabinet/schemas/subscription.py

@@ -48,6 +48,7 @@ class SubscriptionData(BaseModel):
     hide_subscription_link: bool = False  # Скрывать ли отображение ссылки (но кнопки работают)
     is_active: bool
     is_expired: bool
+    is_limited: bool = False
     traffic_purchases: list[TrafficPurchaseInfo] = []
     # Daily tariff fields
     is_daily: bool = False
@@ -87,6 +88,10 @@ class RenewalRequest(BaseModel):
     """Request to renew subscription."""
 
     period_days: int = Field(..., ge=1, le=3650, description='Renewal period in days')
+    subscription_id: int | None = Field(
+        default=None,
+        description='ID of subscription to renew (required in multi-tariff mode)',
+    )
 
 
 class TrafficPackageResponse(BaseModel):

app/cabinet/schemas/tariffs.py

@@ -54,6 +54,7 @@ class TariffListItem(BaseModel):
     is_daily: bool = False
     daily_price_kopeks: int = 0
     allow_traffic_topup: bool = True
+    show_in_gift: bool = True
     traffic_limit_gb: int
     device_limit: int
     tier_level: int
@@ -111,7 +112,11 @@ class TariffDetailResponse(BaseModel):
     is_daily: bool = False
     daily_price_kopeks: int = 0
     # Режим сброса трафика
-    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, NO_RESET, None = глобальная настройка
+    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, MONTH_ROLLING, NO_RESET, None = глобальная настройка
+    # Внешний сквад RemnaWave
+    external_squad_uuid: str | None = None
+    # Показывать в подарках
+    show_in_gift: bool = True
     created_at: datetime
     updated_at: datetime | None = None
 
@@ -119,6 +124,17 @@ class TariffDetailResponse(BaseModel):
         from_attributes = True
 
 
+class ExternalSquadInfoResponse(BaseModel):
+    """External squad info from RemnaWave."""
+
+    uuid: str
+    name: str
+    members_count: int
+
+
+UUID_PATTERN = r'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
+
+
 class TariffCreateRequest(BaseModel):
     """Request to create a tariff."""
 
@@ -154,7 +170,11 @@ class TariffCreateRequest(BaseModel):
     is_daily: bool = False
     daily_price_kopeks: int = Field(0, ge=0)
     # Режим сброса трафика
-    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, NO_RESET, None = глобальная настройка
+    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, MONTH_ROLLING, NO_RESET, None = глобальная настройка
+    # Внешний сквад RemnaWave
+    external_squad_uuid: str | None = Field(None, pattern=UUID_PATTERN)
+    # Показывать в подарках
+    show_in_gift: bool = True
 
 
 class TariffUpdateRequest(BaseModel):
@@ -191,7 +211,11 @@ class TariffUpdateRequest(BaseModel):
     is_daily: bool | None = None
     daily_price_kopeks: int | None = Field(None, ge=0)
     # Режим сброса трафика
-    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, NO_RESET, None = глобальная настройка
+    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, MONTH_ROLLING, NO_RESET, None = глобальная настройка
+    # Внешний сквад RemnaWave
+    external_squad_uuid: str | None = Field(None, pattern=UUID_PATTERN)
+    # Показывать в подарках
+    show_in_gift: bool | None = None
 
 
 class TariffSortOrderRequest(BaseModel):
@@ -226,3 +250,15 @@ class TariffStatsResponse(BaseModel):
     trial_subscriptions: int
     revenue_kopeks: int
     revenue_rubles: float
+
+
+class SyncSquadsResponse(BaseModel):
+    """Response after syncing squads for tariff subscriptions."""
+
+    tariff_id: int
+    tariff_name: str
+    total_subscriptions: int
+    updated_count: int
+    failed_count: int
+    skipped_count: int
+    errors: list[str] = Field(default_factory=list)

app/cabinet/schemas/traffic.py

@@ -9,18 +9,31 @@ class TrafficNodeInfo(BaseModel):
     country_code: str
 
 
+class SubscriptionTrafficInfo(BaseModel):
+    """Per-subscription traffic metadata for multi-subscription display."""
+
+    subscription_id: int
+    tariff_name: str | None
+    status: str | None
+    traffic_limit_gb: float
+    device_limit: int
+
+
 class UserTrafficItem(BaseModel):
     user_id: int
     telegram_id: int | None
     username: str | None
     email: str | None
     full_name: str
+    # Primary subscription fields (backward compat — reflect the active/first sub)
     tariff_name: str | None
     subscription_status: str | None
     traffic_limit_gb: float
     device_limit: int
     node_traffic: dict[str, int]  # {node_uuid: total_bytes}
     total_bytes: int
+    # All subscriptions for multi-subscription display
+    subscriptions: list[SubscriptionTrafficInfo] = Field(default_factory=list)
 
 
 class TrafficUsageResponse(BaseModel):
@@ -34,12 +47,24 @@ class TrafficUsageResponse(BaseModel):
     available_statuses: list[str]
 
 
+class SubscriptionEnrichmentInfo(BaseModel):
+    """Per-subscription enrichment (dates) for multi-subscription display."""
+
+    subscription_id: int
+    tariff_name: str | None
+    start_date: str | None
+    end_date: str | None
+
+
 class UserTrafficEnrichment(BaseModel):
     devices_connected: int = 0
     total_spent_kopeks: int = 0
+    # Primary subscription dates (backward compat — reflect the active/first sub)
     subscription_start_date: str | None = None
     subscription_end_date: str | None = None
     last_node_name: str | None = None
+    # All subscriptions for multi-subscription display
+    subscriptions: list[SubscriptionEnrichmentInfo] = Field(default_factory=list)
 
 
 class TrafficEnrichmentResponse(BaseModel):

app/cabinet/schemas/users.py

@@ -1,13 +1,13 @@
 """Schemas for Admin Users management in cabinet."""
 
 from datetime import datetime
-from enum import Enum
+from enum import StrEnum
 from typing import Any
 
 from pydantic import BaseModel, Field
 
 
-class UserStatusEnum(str, Enum):
+class UserStatusEnum(StrEnum):
     """User status enum."""
 
     ACTIVE = 'active'
@@ -15,17 +15,18 @@ class UserStatusEnum(str, Enum):
     DELETED = 'deleted'
 
 
-class SubscriptionStatusEnum(str, Enum):
+class SubscriptionStatusEnum(StrEnum):
     """Subscription status enum."""
 
     TRIAL = 'trial'
     ACTIVE = 'active'
     EXPIRED = 'expired'
     DISABLED = 'disabled'
+    LIMITED = 'limited'
     PENDING = 'pending'
 
 
-class SortByEnum(str, Enum):
+class SortByEnum(StrEnum):
     """Sort options for users list."""
 
     CREATED_AT = 'created_at'
@@ -176,9 +177,12 @@ class UserDetailResponse(BaseModel):
     last_activity: datetime | None = None
     cabinet_last_login: datetime | None = None
 
-    # Subscription
+    # Subscription (legacy single, kept for backward compat)
     subscription: UserSubscriptionInfo | None = None
 
+    # All subscriptions (multi-tariff)
+    subscriptions: list[UserSubscriptionInfo] = []
+
     # Promo group
     promo_group: UserPromoGroupInfo | None = None
 
@@ -281,9 +285,12 @@ class UpdateSubscriptionRequest(BaseModel):
     """Request to update user subscription."""
 
     action: str = Field(
-        ..., description='Action: extend, set_end_date, change_tariff, set_traffic, toggle_autopay, cancel'
+        ..., description='Action: extend, shorten, set_end_date, change_tariff, set_traffic, toggle_autopay, cancel'
     )
 
+    # Target subscription (required in multi-tariff mode for non-create actions)
+    subscription_id: int | None = Field(None, description='Subscription ID to target (multi-tariff)')
+
     # For extend action
     days: int | None = Field(None, ge=1, le=3650, description='Days to extend')
 
@@ -386,6 +393,37 @@ class UpdateReferralCommissionResponse(BaseModel):
     message: str
 
 
+class AssignReferrerRequest(BaseModel):
+    """Request to manually assign a referrer to a user."""
+
+    referrer_id: int = Field(..., gt=0, description='ID of the referrer user')
+
+
+class AssignReferrerResponse(BaseModel):
+    """Response after referrer assignment."""
+
+    success: bool
+    old_referrer_id: int | None = None
+    new_referrer_id: int | None = None
+    message: str
+
+
+class RemoveReferrerResponse(BaseModel):
+    """Response after removing a user's referrer."""
+
+    success: bool
+    old_referrer_id: int | None = None
+    message: str
+
+
+class RemoveReferralResponse(BaseModel):
+    """Response after removing a specific referral from a user."""
+
+    success: bool
+    removed_user_id: int
+    message: str
+
+
 class DeviceInfo(BaseModel):
     """Individual device info."""
 
@@ -607,6 +645,10 @@ class PanelSyncStatusResponse(BaseModel):
     remnawave_uuid: str | None = None
     last_sync: datetime | None = None
 
+    # Multi-tariff context
+    subscription_id: int | None = None
+    subscription_tariff_name: str | None = None
+
     # Bot data
     bot_subscription_status: str | None = None
     bot_subscription_end_date: datetime | None = None
@@ -696,3 +738,40 @@ class DisableUserResponse(BaseModel):
     panel_deactivated: bool = False
     user_blocked: bool = False
     panel_error: str | None = None
+
+
+# === Gifts ===
+
+
+class AdminUserGiftItem(BaseModel):
+    """Gift item for admin user detail view."""
+
+    id: int
+    token: str
+    status: str
+    tariff_name: str | None = None
+    period_days: int
+    device_limit: int = 1
+    amount_kopeks: int
+    payment_method: str | None = None
+    gift_recipient_type: str | None = None
+    gift_recipient_value: str | None = None
+    gift_message: str | None = None
+    buyer_user_id: int | None = None
+    buyer_username: str | None = None
+    buyer_full_name: str | None = None
+    receiver_user_id: int | None = None
+    receiver_username: str | None = None
+    receiver_full_name: str | None = None
+    created_at: datetime | None = None
+    paid_at: datetime | None = None
+    delivered_at: datetime | None = None
+
+
+class AdminUserGiftsResponse(BaseModel):
+    """Response with sent and received gifts for admin user detail."""
+
+    sent: list[AdminUserGiftItem] = []
+    received: list[AdminUserGiftItem] = []
+    sent_total: int = 0
+    received_total: int = 0

app/cabinet/schemas/wheel.py

@@ -1,7 +1,7 @@
 """Схемы для колеса удачи (Fortune Wheel)."""
 
 from datetime import datetime
-from enum import Enum
+from enum import StrEnum
 
 from pydantic import BaseModel, Field
 
@@ -9,14 +9,14 @@ from pydantic import BaseModel, Field
 # ==================== ENUMS ====================
 
 
-class WheelPaymentType(str, Enum):
+class WheelPaymentType(StrEnum):
     """Способы оплаты спина."""
 
     TELEGRAM_STARS = 'telegram_stars'
     SUBSCRIPTION_DAYS = 'subscription_days'
 
 
-class WheelPrizeType(str, Enum):
+class WheelPrizeType(StrEnum):
     """Типы призов."""
 
     SUBSCRIPTION_DAYS = 'subscription_days'
@@ -60,6 +60,8 @@ class WheelConfigResponse(BaseModel):
     can_pay_days: bool = False
     user_balance_kopeks: int = 0
     required_balance_kopeks: int = 0
+    has_subscription: bool = False
+    eligible_subscriptions: list[dict] | None = None
 
 
 class SpinAvailabilityResponse(BaseModel):
@@ -80,6 +82,7 @@ class SpinRequest(BaseModel):
     """Запрос на спин."""
 
     payment_type: WheelPaymentType
+    subscription_id: int | None = None
 
 
 class SpinResultResponse(BaseModel):

app/cabinet/services/email_service.py

@@ -1,8 +1,10 @@
 """Email service for sending verification and password reset emails."""
 
+import html
 import smtplib
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
+from email.utils import formatdate, make_msgid
 
 import structlog
 
@@ -15,14 +17,33 @@ logger = structlog.get_logger(__name__)
 class EmailService:
     """Service for sending emails via SMTP."""
 
-    def __init__(self):
-        self.host = settings.SMTP_HOST
-        self.port = settings.SMTP_PORT
-        self.user = settings.SMTP_USER
-        self.password = settings.SMTP_PASSWORD
-        self.from_email = settings.get_smtp_from_email()
-        self.from_name = settings.SMTP_FROM_NAME
-        self.use_tls = settings.SMTP_USE_TLS
+    @property
+    def host(self) -> str | None:
+        return settings.SMTP_HOST
+
+    @property
+    def port(self) -> int:
+        return settings.SMTP_PORT
+
+    @property
+    def user(self) -> str | None:
+        return settings.SMTP_USER
+
+    @property
+    def password(self) -> str | None:
+        return settings.SMTP_PASSWORD
+
+    @property
+    def from_email(self) -> str | None:
+        return settings.get_smtp_from_email()
+
+    @property
+    def from_name(self) -> str:
+        return settings.SMTP_FROM_NAME
+
+    @property
+    def use_tls(self) -> bool:
+        return settings.SMTP_USE_TLS
 
     def is_configured(self) -> bool:
         """Check if SMTP is properly configured."""
@@ -30,7 +51,7 @@ class EmailService:
 
     def _get_smtp_connection(self) -> smtplib.SMTP:
         """Create and return SMTP connection."""
-        smtp = smtplib.SMTP(self.host, self.port)
+        smtp = smtplib.SMTP(self.host, self.port, timeout=30)
         smtp.ehlo()
 
         if self.use_tls:
@@ -69,11 +90,24 @@ class EmailService:
             logger.warning('SMTP is not configured, cannot send email')
             return False
 
+        sender_email = self.from_email
+        if not sender_email or '@' not in sender_email:
+            logger.error('Invalid or missing SMTP from_email, cannot send email', from_email=sender_email)
+            return False
+
+        # Defensive: strip newlines to prevent header injection
+        to_email = to_email.strip().replace('\n', '').replace('\r', '')
+        subject = subject.replace('\n', '').replace('\r', '')
+
         try:
             msg = MIMEMultipart('alternative')
             msg['Subject'] = subject
-            msg['From'] = f'{self.from_name} <{self.from_email}>'
+            safe_from_name = self.from_name.replace('\n', '').replace('\r', '') if self.from_name else ''
+            safe_from_email = sender_email.replace('\n', '').replace('\r', '')
+            msg['From'] = f'{safe_from_name} <{safe_from_email}>'
             msg['To'] = to_email
+            msg['Date'] = formatdate(localtime=False)
+            msg['Message-ID'] = make_msgid(domain=safe_from_email.split('@')[-1])
 
             # Plain text version
             if body_text is None:
@@ -93,7 +127,7 @@ class EmailService:
             msg.attach(part2)
 
             with self._get_smtp_connection() as smtp:
-                smtp.sendmail(self.from_email, to_email, msg.as_string())
+                smtp.sendmail(safe_from_email, to_email, msg.as_string())
 
             logger.info('Email sent successfully to', to_email=to_email)
             return True
@@ -133,10 +167,13 @@ class EmailService:
         full_url = f'{verification_url}?token={verification_token}'
         expire_hours = settings.get_cabinet_email_verification_expire_hours()
 
+        # Escape user-provided values for HTML context
+        safe_username = html.escape(username) if username else None
+
         # Localized content
         texts = {
             'ru': {
-                'greeting': f'Здравствуйте{", " + username if username else ""}!',
+                'greeting': f'Здравствуйте{", " + safe_username if safe_username else ""}!',
                 'subject': 'Подтверждение email адреса',
                 'intro': 'Спасибо за регистрацию! Пожалуйста, подтвердите ваш email адрес, нажав на кнопку ниже:',
                 'button': 'Подтвердить email',
@@ -146,7 +183,7 @@ class EmailService:
                 'regards': 'С уважением,',
             },
             'en': {
-                'greeting': f'Hello{", " + username if username else ""}!',
+                'greeting': f'Hello{", " + safe_username if safe_username else ""}!',
                 'subject': 'Verify your email address',
                 'intro': 'Thank you for registering! Please verify your email address by clicking the button below:',
                 'button': 'Verify Email',
@@ -156,7 +193,7 @@ class EmailService:
                 'regards': 'Best regards,',
             },
             'zh': {
-                'greeting': f'您好{", " + username if username else ""}!',
+                'greeting': f'您好{", " + safe_username if safe_username else ""}!',
                 'subject': '验证您的邮箱地址',
                 'intro': '感谢您的注册！请点击下方按钮验证您的邮箱地址：',
                 'button': '验证邮箱',
@@ -166,7 +203,7 @@ class EmailService:
                 'regards': '此致,',
             },
             'ua': {
-                'greeting': f'Вітаємо{", " + username if username else ""}!',
+                'greeting': f'Вітаємо{", " + safe_username if safe_username else ""}!',
                 'subject': 'Підтвердження email адреси',
                 'intro': 'Дякуємо за реєстрацію! Будь ласка, підтвердіть вашу email адресу, натиснувши на кнопку нижче:',
                 'button': 'Підтвердити email',
@@ -176,7 +213,7 @@ class EmailService:
                 'regards': 'З повагою,',
             },
             'fa': {
-                'greeting': f'سلام{", " + username if username else ""}!',
+                'greeting': f'سلام{", " + safe_username if safe_username else ""}!',
                 'subject': 'تایید آدرس ایمیل',
                 'intro': 'از ثبت‌نام شما سپاسگزاریم! لطفاً با کلیک روی دکمه زیر ایمیل خود را تایید کنید:',
                 'button': 'تایید ایمیل',
@@ -260,10 +297,13 @@ class EmailService:
         full_url = f'{reset_url}?token={reset_token}'
         expire_hours = settings.get_cabinet_password_reset_expire_hours()
 
+        # Escape user-provided values for HTML context
+        safe_username = html.escape(username) if username else None
+
         # Localized content
         texts = {
             'ru': {
-                'greeting': f'Здравствуйте{", " + username if username else ""}!',
+                'greeting': f'Здравствуйте{", " + safe_username if safe_username else ""}!',
                 'subject': 'Сброс пароля',
                 'intro': 'Мы получили запрос на сброс вашего пароля. Нажмите на кнопку ниже, чтобы установить новый пароль:',
                 'button': 'Сбросить пароль',
@@ -273,7 +313,7 @@ class EmailService:
                 'regards': 'С уважением,',
             },
             'en': {
-                'greeting': f'Hello{", " + username if username else ""}!',
+                'greeting': f'Hello{", " + safe_username if safe_username else ""}!',
                 'subject': 'Reset your password',
                 'intro': 'We received a request to reset your password. Click the button below to set a new password:',
                 'button': 'Reset Password',
@@ -283,7 +323,7 @@ class EmailService:
                 'regards': 'Best regards,',
             },
             'zh': {
-                'greeting': f'您好{", " + username if username else ""}!',
+                'greeting': f'您好{", " + safe_username if safe_username else ""}!',
                 'subject': '重置您的密码',
                 'intro': '我们收到了重置您密码的请求。点击下方按钮设置新密码：',
                 'button': '重置密码',
@@ -293,7 +333,7 @@ class EmailService:
                 'regards': '此致,',
             },
             'ua': {
-                'greeting': f'Вітаємо{", " + username if username else ""}!',
+                'greeting': f'Вітаємо{", " + safe_username if safe_username else ""}!',
                 'subject': 'Скидання пароля',
                 'intro': 'Ми отримали запит на скидання вашого пароля. Натисніть на кнопку нижче, щоб встановити новий пароль:',
                 'button': 'Скинути пароль',
@@ -303,7 +343,7 @@ class EmailService:
                 'regards': 'З повагою,',
             },
             'fa': {
-                'greeting': f'سلام{", " + username if username else ""}!',
+                'greeting': f'سلام{", " + safe_username if safe_username else ""}!',
                 'subject': 'بازنشانی رمز عبور',
                 'intro': 'درخواستی برای بازنشانی رمز عبور شما دریافت شد. برای تعیین رمز جدید روی دکمه زیر بزنید:',
                 'button': 'بازنشانی رمز عبور',
@@ -385,9 +425,12 @@ class EmailService:
 
         expire_minutes = settings.get_cabinet_email_change_code_expire_minutes()
 
+        # Escape user-provided values for HTML context
+        safe_username = html.escape(username) if username else None
+
         texts = {
             'ru': {
-                'greeting': f'Здравствуйте{", " + username if username else ""}!',
+                'greeting': f'Здравствуйте{", " + safe_username if safe_username else ""}!',
                 'subject': 'Код подтверждения для смены email',
                 'intro': 'Вы запросили смену email адреса. Используйте код ниже для подтверждения:',
                 'code_label': 'Ваш код подтверждения:',
@@ -396,7 +439,7 @@ class EmailService:
                 'regards': 'С уважением,',
             },
             'en': {
-                'greeting': f'Hello{", " + username if username else ""}!',
+                'greeting': f'Hello{", " + safe_username if safe_username else ""}!',
                 'subject': 'Email change verification code',
                 'intro': 'You requested to change your email address. Use the code below to confirm:',
                 'code_label': 'Your verification code:',
@@ -405,7 +448,7 @@ class EmailService:
                 'regards': 'Best regards,',
             },
             'zh': {
-                'greeting': f'您好{", " + username if username else ""}!',
+                'greeting': f'您好{", " + safe_username if safe_username else ""}!',
                 'subject': '邮箱更换验证码',
                 'intro': '您请求更换邮箱地址。请使用以下验证码确认：',
                 'code_label': '您的验证码：',
@@ -414,7 +457,7 @@ class EmailService:
                 'regards': '此致,',
             },
             'ua': {
-                'greeting': f'Вітаємо{", " + username if username else ""}!',
+                'greeting': f'Вітаємо{", " + safe_username if safe_username else ""}!',
                 'subject': 'Код підтвердження для зміни email',
                 'intro': 'Ви запросили зміну email адреси. Використовуйте код нижче для підтвердження:',
                 'code_label': 'Ваш код підтвердження:',
@@ -423,7 +466,7 @@ class EmailService:
                 'regards': 'З повагою,',
             },
             'fa': {
-                'greeting': f'سلام{", " + username if username else ""}!',
+                'greeting': f'سلام{", " + safe_username if safe_username else ""}!',
                 'subject': 'کد تایید تغییر ایمیل',
                 'intro': 'شما درخواست تغییر ایمیل داده‌اید. برای تایید از کد زیر استفاده کنید:',
                 'code_label': 'کد تایید شما:',

app/cabinet/services/email_template_overrides.py

@@ -4,6 +4,7 @@ Service for managing email template overrides stored in the database.
 Custom templates override the hardcoded defaults from email_templates.py.
 """
 
+import html
 from datetime import UTC, datetime
 from typing import Any
 
@@ -195,15 +196,16 @@ async def get_rendered_override(
     # Simple variable substitution for context vars like {username}, {verification_url}, etc.
     if context:
         for key, value in context.items():
-            body_html = body_html.replace(f'{{{key}}}', str(value))
+            body_html = body_html.replace(f'{{{key}}}', html.escape(str(value)))
 
-    rendered = templates._get_base_template(body_html, language)
+    rendered = templates._wrap_override_template(body_html, language)
     subject = override['subject']
 
     # Also substitute in subject
     if context:
         for key, value in context.items():
-            subject = subject.replace(f'{{{key}}}', str(value))
+            safe_value = str(value).replace('\r', '').replace('\n', '')
+            subject = subject.replace(f'{{{key}}}', safe_value)
 
     return (subject, rendered)
 

app/cabinet/services/email_templates.py

@@ -62,6 +62,10 @@ class EmailNotificationTemplates:
             NotificationType.PAYMENT_RECEIVED: self._payment_received_template,
             NotificationType.EMAIL_VERIFICATION: self._email_verification_template,
             NotificationType.PASSWORD_RESET: self._password_reset_template,
+            NotificationType.GUEST_SUBSCRIPTION_DELIVERED: self._guest_subscription_delivered_template,
+            NotificationType.GUEST_ACTIVATION_REQUIRED: self._guest_activation_required_template,
+            NotificationType.GUEST_GIFT_RECEIVED: self._guest_gift_received_template,
+            NotificationType.GUEST_CABINET_CREDENTIALS: self._guest_cabinet_credentials_template,
         }
 
         template_func = template_map.get(notification_type)
@@ -70,6 +74,39 @@ class EmailNotificationTemplates:
 
         return template_func(language, context)
 
+    def _wrap_override_template(self, content: str, language: str = 'ru') -> str:
+        """Wrap override template content appropriately based on its structure.
+
+        Three-tier detection:
+        1. Full HTML document (<!DOCTYPE or <html>) — return as-is, no wrapping
+        2. Styled content (has <style> tag or background CSS) — minimal HTML wrapper
+           without forced colors, headers, or footers
+        3. Simple HTML fragment — wrap with base template (header, footer, white bg)
+           for backward compatibility
+        """
+        content_stripped = content.strip()
+        content_lower = content_stripped.lower()
+
+        # Tier 1: Full HTML document — return as-is
+        if content_lower.startswith('<!doctype') or content_lower.startswith('<html'):
+            return content_stripped
+
+        # Tier 2: Styled content — minimal wrapper without forced styling
+        if '<style' in content_lower or 'background' in content_lower:
+            return f"""<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="margin: 0; padding: 0;">
+    {content}
+</body>
+</html>"""
+
+        # Tier 3: Simple HTML fragment — use base template for structure
+        return self._get_base_template(content, language)
+
     def _get_base_template(self, content: str, language: str = 'ru') -> str:
         """Wrap content in base HTML template."""
         footer_texts = {
@@ -314,18 +351,26 @@ class EmailNotificationTemplates:
         """Template for subscription expiring notification."""
         days_left = context.get('days_left', 0)
         expires_at = context.get('expires_at', '')
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        tariff_suffix_ru = f' «{tariff_name}»' if tariff_name else ''
+        tariff_suffix_en = f' "{tariff_name}"' if tariff_name else ''
+        tariff_line_ru = f'<p>Тариф: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_en = f'<p>Plan: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_zh = f'<p>套餐: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_ua = f'<p>Тариф: <strong>{tariff_name}</strong></p>' if tariff_name else ''
 
         subjects = {
-            'ru': f'Подписка истекает через {days_left} дн.',
-            'en': f'Subscription expires in {days_left} day(s)',
+            'ru': f'Подписка{tariff_suffix_ru} истекает через {days_left} дн.',
+            'en': f'Subscription{tariff_suffix_en} expires in {days_left} day(s)',
             'zh': f'订阅将在 {days_left} 天后到期',
-            'ua': f'Підписка закінчується через {days_left} дн.',
+            'ua': f'Підписка{tariff_suffix_ru} закінчується через {days_left} дн.',
         }
 
         bodies = {
             'ru': f"""
                 <h2>Подписка скоро истекает</h2>
                 <div class="highlight warning">
+                    {tariff_line_ru}
                     <p>Ваша подписка истекает через <strong>{days_left}</strong> дн.</p>
                     <p>Дата истечения: <strong>{expires_at}</strong></p>
                 </div>
@@ -335,6 +380,7 @@ class EmailNotificationTemplates:
             'en': f"""
                 <h2>Subscription Expiring Soon</h2>
                 <div class="highlight warning">
+                    {tariff_line_en}
                     <p>Your subscription expires in <strong>{days_left}</strong> day(s).</p>
                     <p>Expiration date: <strong>{expires_at}</strong></p>
                 </div>
@@ -344,6 +390,7 @@ class EmailNotificationTemplates:
             'zh': f"""
                 <h2>订阅即将到期</h2>
                 <div class="highlight warning">
+                    {tariff_line_zh}
                     <p>您的订阅将在 <strong>{days_left}</strong> 天后到期。</p>
                     <p>到期日期: <strong>{expires_at}</strong></p>
                 </div>
@@ -353,6 +400,7 @@ class EmailNotificationTemplates:
             'ua': f"""
                 <h2>Підписка скоро закінчується</h2>
                 <div class="highlight warning">
+                    {tariff_line_ua}
                     <p>Ваша підписка закінчується через <strong>{days_left}</strong> дн.</p>
                     <p>Дата закінчення: <strong>{expires_at}</strong></p>
                 </div>
@@ -368,17 +416,26 @@ class EmailNotificationTemplates:
 
     def _subscription_expired_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
         """Template for subscription expired notification."""
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        tariff_suffix_ru = f' «{tariff_name}»' if tariff_name else ''
+        tariff_suffix_en = f' "{tariff_name}"' if tariff_name else ''
+        tariff_line_ru = f'<p>Тариф: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_en = f'<p>Plan: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_zh = f'<p>套餐: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_ua = f'<p>Тариф: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+
         subjects = {
-            'ru': 'Подписка истекла',
-            'en': 'Subscription Expired',
+            'ru': f'Подписка{tariff_suffix_ru} истекла',
+            'en': f'Subscription{tariff_suffix_en} Expired',
             'zh': '订阅已到期',
-            'ua': 'Підписка закінчилась',
+            'ua': f'Підписка{tariff_suffix_ru} закінчилась',
         }
 
         bodies = {
             'ru': f"""
                 <h2>Подписка истекла</h2>
                 <div class="highlight danger">
+                    {tariff_line_ru}
                     <p>Ваша подписка истекла. Доступ к VPN отключён.</p>
                 </div>
                 <p>Оформите новую подписку, чтобы продолжить использование сервиса.</p>
@@ -387,6 +444,7 @@ class EmailNotificationTemplates:
             'en': f"""
                 <h2>Subscription Expired</h2>
                 <div class="highlight danger">
+                    {tariff_line_en}
                     <p>Your subscription has expired. VPN access has been disabled.</p>
                 </div>
                 <p>Purchase a new subscription to continue using our service.</p>
@@ -395,6 +453,7 @@ class EmailNotificationTemplates:
             'zh': f"""
                 <h2>订阅已到期</h2>
                 <div class="highlight danger">
+                    {tariff_line_zh}
                     <p>您的订阅已到期。VPN访问已被禁用。</p>
                 </div>
                 <p>请购买新订阅以继续使用我们的服务。</p>
@@ -403,6 +462,7 @@ class EmailNotificationTemplates:
             'ua': f"""
                 <h2>Підписка закінчилась</h2>
                 <div class="highlight danger">
+                    {tariff_line_ua}
                     <p>Ваша підписка закінчилась. Доступ до VPN вимкнено.</p>
                 </div>
                 <p>Оформіть нову підписку, щоб продовжити використання сервісу.</p>
@@ -418,18 +478,24 @@ class EmailNotificationTemplates:
     def _subscription_renewed_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
         """Template for subscription renewed notification."""
         new_expires_at = context.get('new_expires_at', '')
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        tariff_suffix_ru = f' «{tariff_name}»' if tariff_name else ''
+        tariff_suffix_en = f' "{tariff_name}"' if tariff_name else ''
+        tariff_line_ru = f'<p>Тариф: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_en = f'<p>Plan: <strong>{tariff_name}</strong></p>' if tariff_name else ''
 
         subjects = {
-            'ru': 'Подписка продлена',
-            'en': 'Subscription Renewed',
+            'ru': f'Подписка{tariff_suffix_ru} продлена',
+            'en': f'Subscription{tariff_suffix_en} Renewed',
             'zh': '订阅已续订',
-            'ua': 'Підписку продовжено',
+            'ua': f'Підписку{tariff_suffix_ru} продовжено',
         }
 
         bodies = {
             'ru': f"""
                 <h2>Подписка успешно продлена!</h2>
                 <div class="highlight success">
+                    {tariff_line_ru}
                     <p>Ваша подписка была успешно продлена.</p>
                     <p>Новая дата истечения: <strong>{new_expires_at}</strong></p>
                 </div>
@@ -439,6 +505,7 @@ class EmailNotificationTemplates:
             'en': f"""
                 <h2>Subscription Successfully Renewed!</h2>
                 <div class="highlight success">
+                    {tariff_line_en}
                     <p>Your subscription has been successfully renewed.</p>
                     <p>New expiration date: <strong>{new_expires_at}</strong></p>
                 </div>
@@ -455,18 +522,24 @@ class EmailNotificationTemplates:
     def _subscription_activated_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
         """Template for subscription activated notification."""
         expires_at = context.get('expires_at', '')
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        tariff_suffix_ru = f' «{tariff_name}»' if tariff_name else ''
+        tariff_suffix_en = f' "{tariff_name}"' if tariff_name else ''
+        tariff_line_ru = f'<p>Тариф: <strong>{tariff_name}</strong></p>' if tariff_name else ''
+        tariff_line_en = f'<p>Plan: <strong>{tariff_name}</strong></p>' if tariff_name else ''
 
         subjects = {
-            'ru': 'Подписка активирована',
-            'en': 'Subscription Activated',
+            'ru': f'Подписка{tariff_suffix_ru} активирована',
+            'en': f'Subscription{tariff_suffix_en} Activated',
             'zh': '订阅已激活',
-            'ua': 'Підписку активовано',
+            'ua': f'Підписку{tariff_suffix_ru} активовано',
         }
 
         bodies = {
             'ru': f"""
                 <h2>Подписка активирована!</h2>
                 <div class="highlight success">
+                    {tariff_line_ru}
                     <p>Ваша VPN подписка успешно активирована.</p>
                     <p>Действует до: <strong>{expires_at}</strong></p>
                 </div>
@@ -476,6 +549,7 @@ class EmailNotificationTemplates:
             'en': f"""
                 <h2>Subscription Activated!</h2>
                 <div class="highlight success">
+                    {tariff_line_en}
                     <p>Your VPN subscription has been successfully activated.</p>
                     <p>Valid until: <strong>{expires_at}</strong></p>
                 </div>
@@ -1185,8 +1259,8 @@ class EmailNotificationTemplates:
 
     def _email_verification_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
         """Template for email verification."""
-        username = context.get('username', '')
-        verification_url = context.get('verification_url', '#')
+        username = html.escape(context.get('username', ''))
+        verification_url = html.escape(context.get('verification_url', '#'))
         expire_hours = context.get('expire_hours', 24)
 
         subjects = {
@@ -1257,8 +1331,8 @@ class EmailNotificationTemplates:
 
     def _password_reset_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
         """Template for password reset."""
-        username = context.get('username', '')
-        reset_url = context.get('reset_url', '#')
+        username = html.escape(context.get('username', ''))
+        reset_url = html.escape(context.get('reset_url', '#'))
         expire_hours = context.get('expire_hours', 1)
 
         subjects = {
@@ -1327,6 +1401,460 @@ class EmailNotificationTemplates:
             'body_html': self._get_base_template(bodies.get(language, bodies['ru']), language),
         }
 
+    # ============================================================================
+    # Guest Purchase Templates
+    # ============================================================================
+
+    def _guest_subscription_delivered_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
+        """Template for guest subscription delivered notification."""
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        period_days = context.get('period_days', 0)
+        cabinet_url = html.escape(context.get('cabinet_url', ''))
+        cabinet_email = html.escape(context.get('cabinet_email', ''))
+        cabinet_password = context.get('cabinet_password', '')
+
+        subjects = {
+            'ru': 'Ваша VPN подписка готова',
+            'en': 'Your VPN subscription is ready',
+            'zh': '您的VPN订阅已准备就绪',
+            'ua': 'Ваша VPN підписка готова',
+            'fa': 'اشتراک VPN شما آماده است',
+        }
+
+        creds_block_ru = (
+            f"""
+                <div class="highlight">
+                    <p><strong>Данные для входа в личный кабинет:</strong></p>
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>Пароль:</strong> <code>{cabinet_password}</code></p>
+                </div>
+        """
+            if cabinet_password
+            else ''
+        )
+
+        creds_block_en = (
+            f"""
+                <div class="highlight">
+                    <p><strong>Your cabinet login credentials:</strong></p>
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>Password:</strong> <code>{cabinet_password}</code></p>
+                </div>
+        """
+            if cabinet_password
+            else ''
+        )
+
+        creds_block_zh = (
+            f"""
+                <div class="highlight">
+                    <p><strong>个人中心登录信息：</strong></p>
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>密码:</strong> <code>{cabinet_password}</code></p>
+                </div>
+        """
+            if cabinet_password
+            else ''
+        )
+
+        creds_block_ua = (
+            f"""
+                <div class="highlight">
+                    <p><strong>Дані для входу в особистий кабінет:</strong></p>
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>Пароль:</strong> <code>{cabinet_password}</code></p>
+                </div>
+        """
+            if cabinet_password
+            else ''
+        )
+
+        creds_block_fa = (
+            f"""
+                <div class="highlight">
+                    <p><strong>اطلاعات ورود به پنل کاربری:</strong></p>
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>رمز عبور:</strong> <code>{cabinet_password}</code></p>
+                </div>
+        """
+            if cabinet_password
+            else ''
+        )
+
+        bodies = {
+            'ru': f"""
+                <h2>Ваша VPN подписка готова!</h2>
+                <div class="highlight success">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Период: <strong>{period_days} дней</strong></p>
+                </div>
+                {creds_block_ru}
+                <p>Подписка активирована в вашем личном кабинете.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти в личный кабинет</a></p>
+            """,
+            'en': f"""
+                <h2>Your VPN subscription is ready!</h2>
+                <div class="highlight success">
+                    <p>Plan: <strong>{tariff_name}</strong></p>
+                    <p>Period: <strong>{period_days} days</strong></p>
+                </div>
+                {creds_block_en}
+                <p>Your subscription has been activated in your cabinet.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Go to Cabinet</a></p>
+            """,
+            'zh': f"""
+                <h2>您的VPN订阅已准备就绪！</h2>
+                <div class="highlight success">
+                    <p>套餐: <strong>{tariff_name}</strong></p>
+                    <p>期限: <strong>{period_days} 天</strong></p>
+                </div>
+                {creds_block_zh}
+                <p>订阅已在您的个人中心激活。</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">前往个人中心</a></p>
+            """,
+            'ua': f"""
+                <h2>Ваша VPN підписка готова!</h2>
+                <div class="highlight success">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Період: <strong>{period_days} днів</strong></p>
+                </div>
+                {creds_block_ua}
+                <p>Підписка активована у вашому особистому кабінеті.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти до кабінету</a></p>
+            """,
+            'fa': f"""
+                <h2>اشتراک VPN شما آماده است!</h2>
+                <div class="highlight success">
+                    <p>طرح: <strong>{tariff_name}</strong></p>
+                    <p>مدت: <strong>{period_days} روز</strong></p>
+                </div>
+                {creds_block_fa}
+                <p>اشتراک شما در پنل کاربری فعال شده است.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">رفتن به پنل کاربری</a></p>
+            """,
+        }
+
+        return {
+            'subject': subjects.get(language, subjects['ru']),
+            'body_html': self._get_base_template(bodies.get(language, bodies['ru']), language),
+        }
+
+    def _guest_activation_required_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
+        """Template for guest purchase pending activation (user already has a subscription)."""
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        period_days = context.get('period_days', 0)
+        success_page_url = html.escape(context.get('success_page_url', ''))
+        gift_message = context.get('gift_message')
+        is_gift = context.get('is_gift', False)
+
+        gift_block_ru = ''
+        gift_block_en = ''
+        gift_block_zh = ''
+        gift_block_ua = ''
+        gift_block_fa = ''
+        if is_gift and gift_message:
+            escaped_msg = html.escape(gift_message)
+            gift_block_ru = f'<div class="highlight"><p><em>Сообщение: {escaped_msg}</em></p></div>'
+            gift_block_en = f'<div class="highlight"><p><em>Message: {escaped_msg}</em></p></div>'
+            gift_block_zh = f'<div class="highlight"><p><em>留言: {escaped_msg}</em></p></div>'
+            gift_block_ua = f'<div class="highlight"><p><em>Повідомлення: {escaped_msg}</em></p></div>'
+            gift_block_fa = f'<div class="highlight"><p><em>پیام: {escaped_msg}</em></p></div>'
+
+        subjects = {
+            'ru': 'Требуется активация подписки',
+            'en': 'Subscription activation required',
+            'zh': '需要激活订阅',
+            'ua': 'Потрібна активація підписки',
+            'fa': 'فعال‌سازی اشتراک لازم است',
+        }
+
+        bodies = {
+            'ru': f"""
+                <h2>Требуется активация подписки</h2>
+                {gift_block_ru}
+                <div class="highlight">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Период: <strong>{period_days} дней</strong></p>
+                </div>
+                <p class="warning">У вас уже есть активная подписка. Активация новой заменит текущую.</p>
+                <p style="text-align: center;"><a href="{success_page_url}" class="button">Активировать подписку</a></p>
+            """,
+            'en': f"""
+                <h2>Subscription activation required</h2>
+                {gift_block_en}
+                <div class="highlight">
+                    <p>Plan: <strong>{tariff_name}</strong></p>
+                    <p>Period: <strong>{period_days} days</strong></p>
+                </div>
+                <p class="warning">You already have an active subscription. Activating will replace your current one.</p>
+                <p style="text-align: center;"><a href="{success_page_url}" class="button">Activate subscription</a></p>
+            """,
+            'zh': f"""
+                <h2>需要激活订阅</h2>
+                {gift_block_zh}
+                <div class="highlight">
+                    <p>套餐: <strong>{tariff_name}</strong></p>
+                    <p>期限: <strong>{period_days} 天</strong></p>
+                </div>
+                <p class="warning">您已有活跃订阅。激活新订阅将替换当前订阅。</p>
+                <p style="text-align: center;"><a href="{success_page_url}" class="button">激活订阅</a></p>
+            """,
+            'ua': f"""
+                <h2>Потрібна активація підписки</h2>
+                {gift_block_ua}
+                <div class="highlight">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Період: <strong>{period_days} днів</strong></p>
+                </div>
+                <p class="warning">У вас вже є активна підписка. Активація нової замінить поточну.</p>
+                <p style="text-align: center;"><a href="{success_page_url}" class="button">Активувати підписку</a></p>
+            """,
+            'fa': f"""
+                <h2>فعال‌سازی اشتراک لازم است</h2>
+                {gift_block_fa}
+                <div class="highlight">
+                    <p>طرح: <strong>{tariff_name}</strong></p>
+                    <p>مدت: <strong>{period_days} روز</strong></p>
+                </div>
+                <p class="warning">شما از قبل اشتراک فعالی دارید. فعال‌سازی اشتراک جدید جایگزین فعلی خواهد شد.</p>
+                <p style="text-align: center;"><a href="{success_page_url}" class="button">فعال‌سازی اشتراک</a></p>
+            """,
+        }
+
+        return {
+            'subject': subjects.get(language, subjects['ru']),
+            'body_html': self._get_base_template(bodies.get(language, bodies['ru']), language),
+        }
+
+    def _guest_gift_received_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
+        """Template for gift subscription received notification."""
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        period_days = context.get('period_days', 0)
+        gift_message = context.get('gift_message')
+        cabinet_password = context.get('cabinet_password')
+        cabinet_email = html.escape(context.get('cabinet_email', ''))
+        cabinet_url = html.escape(context.get('cabinet_url', ''))
+
+        # Credentials block for gift recipients who got a new cabinet account
+        cred_block = {'ru': '', 'en': '', 'zh': '', 'ua': '', 'fa': ''}
+        if cabinet_password and cabinet_email:
+            escaped_pw = html.escape(cabinet_password)
+            cred_block = {
+                'ru': f"""
+                    <div class="highlight">
+                        <p><strong>Данные для входа в личный кабинет:</strong></p>
+                        <p>Email: <code>{cabinet_email}</code></p>
+                        <p>Пароль: <code>{escaped_pw}</code></p>
+                    </div>
+                    <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти в личный кабинет</a></p>
+                """,
+                'en': f"""
+                    <div class="highlight">
+                        <p><strong>Your cabinet login credentials:</strong></p>
+                        <p>Email: <code>{cabinet_email}</code></p>
+                        <p>Password: <code>{escaped_pw}</code></p>
+                    </div>
+                    <p style="text-align: center;"><a href="{cabinet_url}" class="button">Go to Cabinet</a></p>
+                """,
+                'zh': f"""
+                    <div class="highlight">
+                        <p><strong>个人中心登录信息：</strong></p>
+                        <p>邮箱: <code>{cabinet_email}</code></p>
+                        <p>密码: <code>{escaped_pw}</code></p>
+                    </div>
+                    <p style="text-align: center;"><a href="{cabinet_url}" class="button">前往个人中心</a></p>
+                """,
+                'ua': f"""
+                    <div class="highlight">
+                        <p><strong>Дані для входу в особистий кабінет:</strong></p>
+                        <p>Email: <code>{cabinet_email}</code></p>
+                        <p>Пароль: <code>{escaped_pw}</code></p>
+                    </div>
+                    <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти до кабінету</a></p>
+                """,
+                'fa': f"""
+                    <div class="highlight">
+                        <p><strong>اطلاعات ورود به پنل کاربری:</strong></p>
+                        <p>ایمیل: <code dir="ltr">{cabinet_email}</code></p>
+                        <p>رمز عبور: <code dir="ltr">{escaped_pw}</code></p>
+                    </div>
+                    <p style="text-align: center;"><a href="{cabinet_url}" class="button">رفتن به پنل کاربری</a></p>
+                """,
+            }
+
+        gift_block_ru = ''
+        gift_block_en = ''
+        gift_block_zh = ''
+        gift_block_ua = ''
+        gift_block_fa = ''
+        if gift_message:
+            escaped_msg = html.escape(gift_message)
+            gift_block_ru = f'<div class="highlight"><p><em>Сообщение: {escaped_msg}</em></p></div>'
+            gift_block_en = f'<div class="highlight"><p><em>Message: {escaped_msg}</em></p></div>'
+            gift_block_zh = f'<div class="highlight"><p><em>留言: {escaped_msg}</em></p></div>'
+            gift_block_ua = f'<div class="highlight"><p><em>Повідомлення: {escaped_msg}</em></p></div>'
+            gift_block_fa = f'<div class="highlight"><p><em>پیام: {escaped_msg}</em></p></div>'
+
+        subjects = {
+            'ru': 'Вам подарили VPN подписку!',
+            'en': "You've been gifted a VPN subscription!",
+            'zh': '您收到了VPN订阅礼物！',
+            'ua': 'Вам подарували VPN підписку!',
+            'fa': 'یک اشتراک VPN به شما هدیه داده شده است!',
+        }
+
+        bodies = {
+            'ru': f"""
+                <h2>Вам подарили VPN подписку!</h2>
+                {gift_block_ru}
+                <div class="highlight success">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Период: <strong>{period_days} дней</strong></p>
+                </div>
+                <p>Подписка активирована в личном кабинете.</p>
+                {cred_block['ru']}
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти в личный кабинет</a></p>
+            """,
+            'en': f"""
+                <h2>You've been gifted a VPN subscription!</h2>
+                {gift_block_en}
+                <div class="highlight success">
+                    <p>Plan: <strong>{tariff_name}</strong></p>
+                    <p>Period: <strong>{period_days} days</strong></p>
+                </div>
+                <p>Your subscription has been activated in the cabinet.</p>
+                {cred_block['en']}
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Go to Cabinet</a></p>
+            """,
+            'zh': f"""
+                <h2>您收到了VPN订阅礼物！</h2>
+                {gift_block_zh}
+                <div class="highlight success">
+                    <p>套餐: <strong>{tariff_name}</strong></p>
+                    <p>期限: <strong>{period_days} 天</strong></p>
+                </div>
+                <p>订阅已在个人中心激活。</p>
+                {cred_block['zh']}
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">前往个人中心</a></p>
+            """,
+            'ua': f"""
+                <h2>Вам подарували VPN підписку!</h2>
+                {gift_block_ua}
+                <div class="highlight success">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Період: <strong>{period_days} днів</strong></p>
+                </div>
+                <p>Підписка активована в особистому кабінеті.</p>
+                {cred_block['ua']}
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти до кабінету</a></p>
+            """,
+            'fa': f"""
+                <h2>یک اشتراک VPN به شما هدیه داده شده است!</h2>
+                {gift_block_fa}
+                <div class="highlight success">
+                    <p>طرح: <strong>{tariff_name}</strong></p>
+                    <p>مدت: <strong>{period_days} روز</strong></p>
+                </div>
+                <p>اشتراک در پنل کاربری فعال شده است.</p>
+                {cred_block['fa']}
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">رفتن به پنل کاربری</a></p>
+            """,
+        }
+
+        return {
+            'subject': subjects.get(language, subjects['ru']),
+            'body_html': self._get_base_template(bodies.get(language, bodies['ru']), language),
+        }
+
+    def _guest_cabinet_credentials_template(self, language: str, context: dict[str, Any]) -> dict[str, str]:
+        """Template for cabinet login credentials email (sent separately from subscription)."""
+        cabinet_email = html.escape(context.get('cabinet_email', ''))
+        cabinet_password = html.escape(context.get('cabinet_password', ''))
+        cabinet_url = html.escape(context.get('cabinet_url', ''))
+        tariff_name = html.escape(context.get('tariff_name', ''))
+        period_days = context.get('period_days', 0)
+
+        subjects = {
+            'ru': 'Данные для входа в личный кабинет',
+            'en': 'Your cabinet login credentials',
+            'zh': '您的个人中心登录信息',
+            'ua': 'Дані для входу в особистий кабінет',
+            'fa': 'اطلاعات ورود به پنل کاربری',
+        }
+
+        bodies = {
+            'ru': f"""
+                <h2>Данные для входа в личный кабинет</h2>
+                <div class="highlight success">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Период: <strong>{period_days} дней</strong></p>
+                </div>
+                <div class="highlight">
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>Пароль:</strong> <code>{cabinet_password}</code></p>
+                </div>
+                <p>Сохраните эти данные для входа. Вы можете изменить пароль в настройках кабинета.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти в личный кабинет</a></p>
+            """,
+            'en': f"""
+                <h2>Your cabinet login credentials</h2>
+                <div class="highlight success">
+                    <p>Plan: <strong>{tariff_name}</strong></p>
+                    <p>Period: <strong>{period_days} days</strong></p>
+                </div>
+                <div class="highlight">
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>Password:</strong> <code>{cabinet_password}</code></p>
+                </div>
+                <p>Save these credentials. You can change your password in cabinet settings.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Go to Cabinet</a></p>
+            """,
+            'zh': f"""
+                <h2>您的个人中心登录信息</h2>
+                <div class="highlight success">
+                    <p>套餐: <strong>{tariff_name}</strong></p>
+                    <p>期限: <strong>{period_days} 天</strong></p>
+                </div>
+                <div class="highlight">
+                    <p><strong>邮箱:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>密码:</strong> <code>{cabinet_password}</code></p>
+                </div>
+                <p>请保存这些登录信息。您可以在个人中心设置中更改密码。</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">前往个人中心</a></p>
+            """,
+            'ua': f"""
+                <h2>Дані для входу в особистий кабінет</h2>
+                <div class="highlight success">
+                    <p>Тариф: <strong>{tariff_name}</strong></p>
+                    <p>Період: <strong>{period_days} днів</strong></p>
+                </div>
+                <div class="highlight">
+                    <p><strong>Email:</strong> <code>{cabinet_email}</code></p>
+                    <p><strong>Пароль:</strong> <code>{cabinet_password}</code></p>
+                </div>
+                <p>Збережіть ці дані. Ви можете змінити пароль у налаштуваннях кабінету.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">Перейти до кабінету</a></p>
+            """,
+            'fa': f"""
+                <h2>اطلاعات ورود به پنل کاربری</h2>
+                <div class="highlight success">
+                    <p>طرح: <strong>{tariff_name}</strong></p>
+                    <p>مدت: <strong>{period_days} روز</strong></p>
+                </div>
+                <div class="highlight">
+                    <p><strong>ایمیل:</strong> <code dir="ltr">{cabinet_email}</code></p>
+                    <p><strong>رمز عبور:</strong> <code dir="ltr">{cabinet_password}</code></p>
+                </div>
+                <p>این اطلاعات را ذخیره کنید. می‌توانید رمز عبور خود را در تنظیمات پنل تغییر دهید.</p>
+                <p style="text-align: center;"><a href="{cabinet_url}" class="button">رفتن به پنل کاربری</a></p>
+            """,
+        }
+
+        return {
+            'subject': subjects.get(language, subjects['ru']),
+            'body_html': self._get_base_template(bodies.get(language, bodies['ru']), language),
+        }
+
 
 # Singleton instance
 email_notification_templates = EmailNotificationTemplates()

app/cabinet/utils/links.py

@@ -0,0 +1,19 @@
+"""Shared utility for generating campaign deep links and web links."""
+
+from app.config import settings
+
+
+def get_campaign_deep_link(start_parameter: str) -> str:
+    """Generate a Telegram deep link for a campaign."""
+    bot_username = settings.get_bot_username()
+    if bot_username:
+        return f'https://t.me/{bot_username}?start={start_parameter}'
+    return f'?start={start_parameter}'
+
+
+def get_campaign_web_link(start_parameter: str) -> str | None:
+    """Generate a web app link for a campaign."""
+    base_url = (settings.MINIAPP_CUSTOM_URL or '').rstrip('/')
+    if base_url:
+        return f'{base_url}/?campaign={start_parameter}'
+    return None