Merge pull request #2584 from BEDOLAGA-DEV/release-please--branches--main

chore(main): release 3.9.0
2026-02-09 23:08:05 +03:00 · 2026-02-09 20:07:13 +00:00 · 2026-02-09 22:42:36 +03:00 · 2026-02-09 22:30:26 +03:00 · 2026-02-09 21:54:15 +03:00 · 2026-02-09 21:39:53 +03:00
107 changed files with 5843 additions and 1595 deletions
@@ -152,7 +152,7 @@ REMNAWAVE_API_KEY=your_api_key_here

 # Тип авторизации: "api_key", "basic_auth", "caddy"
 REMNAWAVE_AUTH_TYPE=api_key
-REMNAWAVE_CADDY_TOKEN=YWRtaW46cGFzc3dvcmQ=
+REMNAWAVE_CADDY_TOKEN=

 # Для панелей с Basic Auth (опционально)
 REMNAWAVE_USERNAME=
@@ -544,7 +544,6 @@ PAL24_SHOP_ID=
 PAL24_SIGNATURE_TOKEN=
 PAL24_BASE_URL=https://pal24.pro/api/v1/
 PAL24_WEBHOOK_PATH=/pal24-webhook
-PAL24_WEBHOOK_PORT=8084
 PAL24_PAYMENT_DESCRIPTION="Пополнение баланса"
 PAL24_MIN_AMOUNT_KOPEKS=10000
 PAL24_MAX_AMOUNT_KOPEKS=100000000
@@ -741,7 +740,7 @@ MAINTENANCE_MESSAGE=Ведутся технические работы. Серв
 # ===== ЛОКАЛИЗАЦИЯ =====
 # Укажите язык из AVAILABLE_LANGUAGES. При некорректном значении используется ru.
 DEFAULT_LANGUAGE=ru
-AVAILABLE_LANGUAGES=ru,en,ua,zh
+AVAILABLE_LANGUAGES=ru,en,ua,zh,fa
 # Включить выбор языка при старте и отображение кнопки в меню
 LANGUAGE_SELECTION_ENABLED=true

@@ -830,7 +829,7 @@ WEBHOOK_MAX_QUEUE_SIZE=1024
 WEBHOOK_WORKERS=4
 WEBHOOK_ENQUEUE_TIMEOUT=0.1
 WEBHOOK_WORKER_SHUTDOWN_TIMEOUT=30.0
-BOT_RUN_MODE=polling  # polling, webhook или both
+BOT_RUN_MODE=polling  # polling или webhook

 # ===== КОНКУРСНАЯ СИСТЕМА =====
 CONTESTS_ENABLED=false
@@ -838,15 +837,9 @@ CONTESTS_BUTTON_VISIBLE=false
 # Реферальные конкурсы (турниры среди рефералов)
 REFERRAL_CONTESTS_ENABLED=false

-# ===== АВТОАКТИВАЦИЯ ПОСЛЕ ПОПОЛНЕНИЯ =====
+# ===== АВТОПОКУПКА ПОСЛЕ ПОПОЛНЕНИЯ =====
 # Автоматическая покупка из сохранённой корзины после пополнения баланса
 AUTO_PURCHASE_AFTER_TOPUP_ENABLED=false
-# Умная автоактивация: система сама решает — продлить или создать подписку
-# Работает даже без сохранённой корзины. Выбирает максимальный период <= баланса
-AUTO_ACTIVATE_AFTER_TOPUP_ENABLED=false
-# Показывать предупреждение об активации подписки после пополнения баланса
-# Если true - после пополнения показывает сообщение с кнопками: "Активировать", "Продлить", "Добавить устройства"
-SHOW_ACTIVATION_PROMPT_AFTER_TOPUP=false

 # ===== КНОПКА АКТИВАЦИИ =====
 ACTIVATE_BUTTON_VISIBLE=false
@@ -36,15 +36,15 @@ jobs:
          TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:latest,fr1ngg/remnawave-bedolaga-telegram-bot:${VERSION}"
          echo "🏷️ Собираем релизную версию: $VERSION"
        elif [[ $GITHUB_REF == refs/heads/main ]]; then
-          VERSION="v3.4.0-$(git rev-parse --short HEAD)"
+          VERSION="v3.7.0-$(git rev-parse --short HEAD)" # x-release-please-version
          TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:latest,fr1ngg/remnawave-bedolaga-telegram-bot:${VERSION}"
          echo "🚀 Собираем версию из main: $VERSION"
        elif [[ $GITHUB_REF == refs/heads/dev ]]; then
-          VERSION="v3.4.0-dev-$(git rev-parse --short HEAD)"
+          VERSION="v3.7.0-dev-$(git rev-parse --short HEAD)" # x-release-please-version
          TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:dev,fr1ngg/remnawave-bedolaga-telegram-bot:${VERSION}"
          echo "🧪 Собираем dev версию: $VERSION"
        else
-          VERSION="v3.4.0-pr-$(git rev-parse --short HEAD)"
+          VERSION="v3.7.0-pr-$(git rev-parse --short HEAD)" # x-release-please-version
          TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:pr-$(git rev-parse --short HEAD)"
          echo "🔀 Собираем PR версию: $VERSION"
        fi
@@ -49,13 +49,13 @@ jobs:
            VERSION=${GITHUB_REF#refs/tags/}
            echo "🏷️ Building release version: $VERSION"
          elif [[ $GITHUB_REF == refs/heads/main ]]; then
-            VERSION="v3.4.0-$(git rev-parse --short HEAD)"
+            VERSION="v3.7.0-$(git rev-parse --short HEAD)" # x-release-please-version
            echo "🚀 Building main version: $VERSION"
          elif [[ $GITHUB_REF == refs/heads/dev ]]; then
-            VERSION="v3.4.0-dev-$(git rev-parse --short HEAD)"
+            VERSION="v3.7.0-dev-$(git rev-parse --short HEAD)" # x-release-please-version
            echo "🧪 Building dev version: $VERSION"
          else
-            VERSION="v3.4.0-pr-$(git rev-parse --short HEAD)"
+            VERSION="v3.7.0-pr-$(git rev-parse --short HEAD)" # x-release-please-version
            echo "🔀 Building PR version: $VERSION"
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
@@ -20,6 +20,5 @@ jobs:
      - uses: googleapis/release-please-action@v4
        id: release
        with:
-          release-type: python
-          extra-files: |
-            pyproject.toml
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "3.4.0"
+  ".": "3.9.0"
 }
@@ -0,0 +1,171 @@
+# Changelog
+
+## [3.9.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.8.0...v3.9.0) (2026-02-09)
+
+
+### New Features
+
+* add lite mode functionality with endpoints for retrieval and update ([7b0403a](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/7b0403a307702c24efefc5c14af8cb2fb7525671))
+* add Persian (fa) locale with complete translations ([29a3b39](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/29a3b395b6e67e4ce2437b75120b78c76b69ff4f))
+* allow tariff deletion with active subscriptions ([ebd6bee](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ebd6bee05ed7d9187de9394c64dfd745bb06b65a))
+* **localization:** add Persian (fa) locale support and wire it across app flows ([cc54a7a](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/cc54a7ad2fb98fe6e662e1923027f4989ae72868))
+
+
+### Bug Fixes
+
+* nullify payment FK references before deleting transactions in user restoration ([0b86f37](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/0b86f379b4e55e499ca3d189137e2aed865774b5))
+* prevent sync from overwriting end_date for non-ACTIVE panel users ([49871f8](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/49871f82f37d84979ea9ec91055e3f046d5854be))
+* promo code max_uses=0 conversion and trial UX after promo activation ([1cae713](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/1cae7130bc87493ab8c7691b3c22ead8189dab55))
+* skip users with active subscriptions in admin inactive cleanup ([e79f598](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/e79f598d17ffa76372e6f88d2a498accf8175c76))
+* use selection.period.days instead of selection.period_days ([4541016](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/45410168afe683675003a1c41c17074a54ce04f1))
+
+
+### Performance
+
+* cache logo file_id to avoid re-uploading on every message ([142ff14](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/142ff14a502e629446be7d67fab880d12bee149d))
+
+
+### Refactoring
+
+* remove "both" mode from BOT_RUN_MODE, keep only polling and webhook ([efa3a5d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/efa3a5d4579f24dabeeba01a4f2e981144dd6022))
+* remove Flask, use FastAPI exclusively for all webhooks ([119f463](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/119f463c36a95685c3bc6cdf704e746b0ba20d56))
+* remove smart auto-activation & activation prompt, fix production bugs ([a3903a2](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a3903a252efdd0db4b42ca3fd6771f1627050a7f))
+
+## [3.8.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.7.2...v3.8.0) (2026-02-08)
+
+
+### New Features
+
+* add admin device management endpoints ([c57de10](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/c57de1081a9e905ba191f64c37221c36713c82a6))
+* add admin traffic packages and device limit management ([2f90f91](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/2f90f9134df58b8c0a329c20060efcf07d5d92f9))
+* add admin updates endpoint for bot and cabinet releases ([11b8ab1](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/11b8ab1959e83fafe405be0b76dfa3dd1580a68b))
+* add endpoint for updating user referral commission percent ([da6f746](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/da6f746b093be8cdbf4e2889c50b35087fbc90de))
+* add enrichment data to CSV export ([f2dbab6](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/f2dbab617155cdc41573d885f0e55222e5b9825b))
+* add server-side sorting for enrichment columns ([15c7cc2](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/15c7cc2a58e1f1935d10712a981466629db251d1))
+* add system info endpoint for admin dashboard ([02c30f8](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/02c30f8e7eb6ba90ed8983cfd82199a22b473bbf))
+* add traffic usage enrichment endpoint with devices, spending, dates, last node ([5cf3f2f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5cf3f2f76eb2cd93282f845ea0850f6707bfcc09))
+* admin panel enhancements & bug fixes ([e6ebf81](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/e6ebf81752499df8eb0a710072785e3d603dba33))
+
+
+### Bug Fixes
+
+* add debug logging for bulk device response structure ([46da31d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/46da31d89c55c225dec9136d225f2db967cf8961))
+* add email field to traffic table for OAuth/email users ([94fcf20](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/94fcf20d17c54efd67fa7bd47eff1afdd1507e08))
+* add email/UUID fallback for OAuth user panel sync ([165965d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/165965d8ea60a002c061fd75f88b759f2da66d7d))
+* add enrichment device mapping debug logs ([5be82f2](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5be82f2d78aed9b54d74e86f261baa5655e5dcd9))
+* include additional devices in tariff renewal price and display ([17e9259](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/17e9259eb1d41dbf1d313b6a7d500f6458359393))
+* paginate bulk device endpoint to fetch all HWID devices ([4648a82](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/4648a82da959410603c92055bcde7f96131e0c29))
+* read bot version from pyproject.toml when VERSION env is not set ([9828ff0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/9828ff0845ec1d199a6fa63fe490ad3570cf9c8f))
+* revert device pagination, add raw user data field discovery ([8f7fa76](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/8f7fa76e6ab34a3ad2f61f4e1f06026fd3fbf4e3))
+* use bulk device endpoint instead of per-user calls ([5f219c3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5f219c33e6d49b0e3e4405a57f8344a4237f1002))
+* use correct pagination params (start/size) for bulk HWID devices ([17af51c](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/17af51ce0bdfa45197384988d56960a1918ab709))
+* use per-user panel endpoints for reliable device counts and last node data ([9d39901](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/9d39901f78ece55c740a5df2603601e5d0b1caca))
+
+## [3.7.2](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.7.1...v3.7.2) (2026-02-08)
+
+
+### Bug Fixes
+
+* handle FK violation in create_yookassa_payment when user is deleted ([55d281b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/55d281b0e37a6e8977ceff792cccb8669560945b))
+* remove dots from Remnawave username sanitization ([d6fa86b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/d6fa86b870eccbf22327cd205539dd2084f0014e))
+
+## [3.7.1](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.7.0...v3.7.1) (2026-02-08)
+
+
+### Bug Fixes
+
+* release-please config — remove blocked workflow files ([d88ca98](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/d88ca980ec67e303e37f0094a2912471929b4cef))
+* remove workflow files and pyproject.toml from release-please extra-files ([5070bb3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5070bb34e8a09b2641783f5e818bb624469ad610))
+* resolve HWID reset and webhook FK violation ([5f3e426](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5f3e426750c2adcb097b92f1a9e7725b1c5c5eba))
+* resolve HWID reset context manager bug and webhook FK violation ([a9eee19](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a9eee19c95efdc38ecf5fa28f7402a2bbba7dd07))
+* resolve merge conflict in release-please config ([0ef4f55](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/0ef4f55304751571754f2027105af3e507f75dfd))
+* resolve multiple production errors and performance issues ([071c23d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/071c23dd5297c20527442cb5d348d498ebf20af4))
+
+## [3.7.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.6.0...v3.7.0) (2026-02-07)
+
+
+### Features
+
+* add admin traffic usage API ([aa1cd38](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/aa1cd3829c5c3671e220d49dd7ec2d83563e2cf9))
+* add admin traffic usage API with per-node statistics ([6c2c25d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/6c2c25d2ccb27446c822e4ed94d9351bfeaf4549))
+* add node/status filters and custom date range to traffic page ([ad260d9](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ad260d9fe0b232c9d65176502476212902909660))
+* add node/status filters, custom date range, connected devices to traffic page ([9ea533a](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/9ea533a864e345647754f316bd27971fba1420af))
+* add node/status filters, date range, devices to traffic page ([ad6522f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ad6522f547e68ef5965e70d395ca381b0a032093))
+* add risk columns to traffic CSV export ([7c1a142](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/7c1a1426537e43d14eff0a1c3faeca484611b58b))
+* add tariff filter, fix traffic data aggregation ([fa01819](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/fa01819674b2d2abb0d05b470559b09eb43abef8))
+* node/status filters + custom date range for traffic page ([a161e2f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a161e2f904732b459fef98a67abfaae1214ecfd4))
+* tariff filter + fix traffic data aggregation ([1021c2c](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/1021c2cdcd07cf2194e59af7b59491108339e61f))
+* traffic filters, date range & risk columns in CSV export ([4c40b5b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/4c40b5b370616a9ab40cbf0cccdbc0ac4a3f8278))
+
+
+### Bug Fixes
+
+* close unclosed HTML tags in version notification ([0b61c7f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/0b61c7fe482e7bbfbb3421307a96d54addfd91ee))
+* close unclosed HTML tags when truncating version notification ([b674550](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b6745508da861af9b2ff05d89b4ac9a3933da510))
+* correct response parsing for non-legacy node-users endpoint ([a076dfb](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a076dfb5503a349450b5aa8aac3c6f40070b715d))
+* correct response parsing for non-legacy node-users endpoint ([91ac90c](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/91ac90c2aecfb990679b3d0c835314dde448886a))
+* handle mixed types in traffic sort ([eeed2d6](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/eeed2d6369b07860505c59bcff391e7b17e0ffb7))
+* handle mixed types in traffic sort for string fields ([a194be0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a194be0843856b3376167d9ba8a8ef737280998c))
+* resolve 429 rate limiting on traffic page ([b12544d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b12544d3ea8f4bbd2d8c941f83ee3ac412157adb))
+* resolve 429 rate limiting on traffic page ([924d6bc](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/924d6bc09c815c1d188ea1d0e7974f7e803c1d3f))
+* use legacy per-node endpoint for traffic aggregation ([cc1c8ba](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/cc1c8bacb42a9089021b7ae0fecd1f2717953efb))
+* use legacy per-node endpoint with correct response format ([b707b79](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b707b7995b90c6465910a35e9a4403e1408c6568))
+* use PaymentService for cabinet YooKassa payments ([61bb8fc](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/61bb8fcafd94509568f134ccdba7769b66cc7d5d))
+* use PaymentService for cabinet YooKassa payments to save local DB record ([ff5bba3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ff5bba3fc5d1e1b08d008b64215e487a9eb70960))
+
+## [3.6.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.5.0...v3.6.0) (2026-02-07)
+
+
+### Features
+
+* add OAuth 2.0 authorization (Google, Yandex, Discord, VK) ([97be4af](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/97be4afbffd809fe2786a6d248fc4d3f770cb8cf))
+* add panel info, node usage endpoints and campaign to user detail ([287a43b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/287a43ba6527ff3464a527821d746a68e5371bbe))
+* add panel info, node usage endpoints and campaign to user detail ([0703212](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/070321230bcb868e4bc7a39c287ed3431a4aef4a))
+* add TRIAL_DISABLED_FOR setting to disable trial by user type ([c4794db](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/c4794db1dd78f7c48b5da896bdb2f000e493e079))
+* add user_id filter to admin tickets endpoint ([8886d0d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/8886d0dea20aa5a31c6b6f0c3391b3c012b4b34d))
+* add user_id filter to admin tickets endpoint ([d3819c4](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/d3819c492f88794e4466c2da986fd3a928d7f3df))
+* block registration with disposable email addresses ([9ca24ef](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/9ca24efe434278925c0c1f8d2f2d644a67985c89))
+* block registration with disposable email addresses ([116c845](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/116c8453bb371b5eacf5c9d07f497eb449a355cc))
+* disable trial by user type (email/telegram/all) ([4e7438b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/4e7438b9f9c01e30c48fcf2bbe191e9b11598185))
+* migrate OAuth state storage from in-memory to Redis ([e9b98b8](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/e9b98b837a8552360ef4c41f6cd7a5779aa8b0a7))
+* OAuth 2.0 authorization (Google, Yandex, Discord, VK) ([3cbb9ef](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/3cbb9ef024695352959ef9a82bf8b81f0ba1d940))
+* return 30-day daily breakdown for node usage ([7102c50](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/7102c50f52d583add863331e96f3a9de189f581a))
+* return 30-day daily breakdown for node usage ([e4c65ca](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/e4c65ca220994cf08ed3510f51d9e2808bb2d154))
+
+
+### Bug Fixes
+
+* increase OAuth HTTP timeout to 30s ([333a3c5](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/333a3c590120a64f6b2963efab1edd861274840c))
+* parse bandwidth stats series format for node usage ([557dbf3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/557dbf3ebe777d2137e0e28303dc2a803b15c1c6))
+* parse bandwidth stats series format for node usage ([462f7a9](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/462f7a99b9d5c0b7436dbc3d6ab5db6c6cfa3118))
+* pass tariff object instead of tariff_id to set_tariff_promo_groups ([1ffb8a5](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/1ffb8a5b85455396006e1fcddd48f4c9a2ca2700))
+* query per-node legacy endpoint for user traffic breakdown ([b94e3ed](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b94e3edf80e747077992c03882119c7559ad1c31))
+* query per-node legacy endpoint for user traffic breakdown ([51ca3e4](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/51ca3e42b75c1870c76a1b25f667629855cfe886))
+* reduce node usage to 2 API calls to avoid 429 rate limit ([c68c4e5](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/c68c4e59846abba9c7c78ae91ec18e2e0e329e3c))
+* reduce node usage to 2 API calls to avoid 429 rate limit ([f00a051](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/f00a051bb323e5ba94a3c38939870986726ed58e))
+* use accessible nodes API and fix date format for node usage ([943e9a8](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/943e9a86aaa449cd3154b0919cfdc52d2a35b509))
+* use accessible nodes API and fix date format for node usage ([c4da591](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/c4da59173155e2eeb69eca21416f816fcbd1fa9c))
+
+## [3.5.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.4.0...v3.5.0) (2026-02-06)
+
+
+### Features
+
+* add tariff reorder API endpoint ([4c2e11e](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/4c2e11e64bed41592f5a12061dcca74ce43e0806))
+* pass platform-level fields from RemnaWave config to frontend ([095bc00](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/095bc00b33d7082558a8b7252906db2850dce9da))
+* serve original RemnaWave config from app-config endpoint ([43762ce](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/43762ce8f4fa7142a1ca62a92b97a027dab2564d))
+* tariff reorder API endpoint ([085a617](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/085a61721a8175b3f4fd744614c446d73346f2b7))
+
+
+### Bug Fixes
+
+* enforce blacklist via middleware ([561708b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/561708b7772ec5b84d6ee049aeba26dc70675583))
+* enforce blacklist via middleware instead of per-handler checks ([966a599](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/966a599c2c778dce9eea3c61adf6067fb33119f6))
+* exclude signature field from Telegram initData HMAC validation ([5b64046](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5b6404613772610c595e55bde1249cdf6ec3269d))
+* improve button URL resolution and pass uiConfig to frontend ([0ed98c3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/0ed98c39b6c95911a38a26a32d0ffbcf9cfd7c80))
+* restore unquote for user data parsing in telegram auth ([c2cabbe](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/c2cabbee097a41a95d16c34d43ab7e70d076c4dc))
+
+
+### Reverts
+
+* remove signature pop from HMAC validation ([4234769](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/4234769e92104a6c4f8f1d522e1fca25bc7b20d0))
@@ -14,7 +14,7 @@ RUN pip install --no-cache-dir --upgrade pip && \

 FROM python:3.13-slim

-ARG VERSION="v3.4.0"
+ARG VERSION="v3.9.0" # x-release-please-version
 ARG BUILD_DATE
 ARG VCS_REF

@@ -160,7 +160,6 @@ docker compose logs
 | -------------- | --------------------------------------------------------------------------- | ------------------------------------------------ |
 | `polling`      | Бот опрашивает Telegram через long polling. HTTP-сервер можно не поднимать. | Локальная отладка или отсутствие внешнего HTTPS. |
 | `webhook`      | Aiogram получает апдейты только через вебхук.                               | Продакшн и серверы за HTTPS-прокси.              |
-| `both`         | Одновременно работают polling и webhook.                                    | Тестирование или повышенная отказоустойчивость.  |

 ### 2. Минимальные настройки для webhook

@@ -1012,7 +1011,7 @@ curl -I https://miniapp.domain.com
 | ---------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------ |
 | 🤖 **BOT_TOKEN** | [@BotFather](https://t.me/BotFather)                                                                              | `1234567890:AABBCCdd...` |
 | 👑 **ADMIN_IDS** | Твой Telegram ID                                                                                                  | `123456789,987654321`    |
-| **BOT_RUN_MODE** | определяет способ приёма обновлений: `polling`, `webhook` или `both`, чтобы одновременно использовать оба режима. |
+| **BOT_RUN_MODE** | определяет способ приёма обновлений: `polling` или `webhook`. |

 [Полный список доступных параметров:](.env.example)

@@ -1022,7 +1021,7 @@ curl -I https://miniapp.domain.com

 ### 🤖 Режимы запуска бота

- `BOT_RUN_MODE` — определяет способ приёма обновлений: `polling`, `webhook` или `both`, чтобы одновременно использовать оба режима.
+- `BOT_RUN_MODE` — определяет способ приёма обновлений: `polling` или `webhook`.
 - `WEBHOOK_SECRET_TOKEN` — секрет для проверки заголовка `X-Telegram-Bot-Api-Secret-Token` при работе через вебхуки.
 - `WEBHOOK_DROP_PENDING_UPDATES` — управляет очисткой очереди сообщений при установке вебхука.
 - `WEBHOOK_MAX_QUEUE_SIZE` — ограничивает длину очереди входящих обновлений, чтобы защащаться от перегрузок.
@@ -1343,7 +1342,6 @@ CONTEST_BUTTON_VISIBLE=true
 - 🔄 Автоплатёж с настройкой дня списания
 - 🎁 Реферальные и промо-бонусы
 - ⚡ **Быстрое пополнение** с кнопками быстрых сумм
- 🔄 **Умная автоактивация** подписки после пополнения баланса

 📱 **Управление подписками**

@@ -1530,7 +1528,6 @@ CONTEST_BUTTON_VISIBLE=true
 - 🔄 **Миграция сквадов** - массовый перенос пользователей между сквадами
 - 🧾 **История операций** - хранение всех транзакций и действий для аудита
 - 💸 **Сервис автопроверки транзакций** - автоматическая проверка транзакций в статусе "В ожидании оплаты" за последние 24ч
- 🔄 **Умная автоактивация** - автоматическая активация подписки после пополнения баланса
 - 📝 **Ротация логов** - автоматическая очистка и архивация старых логов
 - 🎮 **Система конкурсов** - ежедневные игры и реферальные конкурсы с призами

@@ -61,6 +61,7 @@ from app.handlers.admin import (
 )
 from app.handlers.stars_payments import register_stars_handlers
 from app.middlewares.auth import AuthMiddleware
+from app.middlewares.blacklist import BlacklistMiddleware
 from app.middlewares.button_stats import ButtonStatsMiddleware
 from app.middlewares.display_name_restriction import DisplayNameRestrictionMiddleware
 from app.middlewares.global_error import GlobalErrorMiddleware
@@ -119,6 +120,10 @@ async def setup_bot() -> tuple[Bot, Dispatcher]:
    dp.callback_query.middleware(LoggingMiddleware())
    dp.message.middleware(MaintenanceMiddleware())
    dp.callback_query.middleware(MaintenanceMiddleware())
+    blacklist_middleware = BlacklistMiddleware()
+    dp.message.middleware(blacklist_middleware)
+    dp.callback_query.middleware(blacklist_middleware)
+    dp.pre_checkout_query.middleware(blacklist_middleware)
    display_name_middleware = DisplayNameRestrictionMiddleware()
    dp.message.middleware(display_name_middleware)
    dp.callback_query.middleware(display_name_middleware)
@@ -0,0 +1,429 @@
+"""OAuth 2.0 provider implementations for cabinet authentication."""
+
+import logging
+import secrets
+from abc import ABC, abstractmethod
+from typing import Any, TypedDict
+
+import httpx
+from pydantic import BaseModel
+
+from app.config import settings
+from app.utils.cache import cache, cache_key
+
+
+logger = logging.getLogger(__name__)
+
+STATE_TTL_SECONDS = 600  # 10 minutes
+
+
+# --- Typed dicts for provider API responses ---
+
+
+class OAuthProviderConfig(TypedDict):
+    client_id: str
+    client_secret: str
+    enabled: bool
+    display_name: str
+
+
+class OAuthTokenResponse(TypedDict, total=False):
+    access_token: str
+    token_type: str
+    expires_in: int
+    refresh_token: str
+    scope: str
+    # VK-specific: email and user_id come in token response
+    email: str
+    user_id: int
+
+
+class GoogleUserInfoResponse(TypedDict, total=False):
+    sub: str
+    email: str
+    email_verified: bool
+    given_name: str
+    family_name: str
+    picture: str
+    name: str
+
+
+class YandexUserInfoResponse(TypedDict, total=False):
+    id: str
+    login: str
+    default_email: str
+    emails: list[str]
+    first_name: str
+    last_name: str
+    default_avatar_id: str
+
+
+class DiscordUserInfoResponse(TypedDict, total=False):
+    id: str
+    username: str
+    global_name: str
+    email: str
+    verified: bool
+    avatar: str
+
+
+class VKUserInfoItem(TypedDict, total=False):
+    id: int
+    first_name: str
+    last_name: str
+    photo_200: str
+
+
+class VKUserInfoResponse(TypedDict, total=False):
+    response: list[VKUserInfoItem]
+
+
+# --- Models ---
+
+
+class OAuthUserInfo(BaseModel):
+    """Normalized user info from OAuth provider."""
+
+    provider: str
+    provider_id: str
+    email: str | None = None
+    email_verified: bool = False
+    first_name: str | None = None
+    last_name: str | None = None
+    username: str | None = None
+    avatar_url: str | None = None
+
+
+# --- CSRF state management (Redis) ---
+
+
+async def generate_oauth_state(provider: str) -> str:
+    """Generate a CSRF state token for OAuth flow. Stored in Redis with TTL."""
+    state = secrets.token_urlsafe(32)
+    await cache.set(cache_key('oauth_state', state), provider, expire=STATE_TTL_SECONDS)
+    return state
+
+
+async def validate_oauth_state(state: str, provider: str) -> bool:
+    """Validate and consume a CSRF state token from Redis."""
+    key = cache_key('oauth_state', state)
+    stored_provider: str | None = await cache.get(key)
+    if stored_provider is None:
+        return False
+    await cache.delete(key)
+    if stored_provider != provider:
+        return False
+    return True
+
+
+# --- Provider implementations ---
+
+
+class OAuthProvider(ABC):
+    """Base class for OAuth 2.0 providers."""
+
+    name: str
+    display_name: str
+
+    def __init__(self, client_id: str, client_secret: str, redirect_uri: str) -> None:
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+
+    @abstractmethod
+    def get_authorization_url(self, state: str) -> str:
+        """Build the authorization URL for the provider."""
+
+    @abstractmethod
+    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+        """Exchange authorization code for tokens."""
+
+    @abstractmethod
+    async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
+        """Fetch user info from the provider."""
+
+
+class GoogleProvider(OAuthProvider):
+    name = 'google'
+    display_name = 'Google'
+
+    AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v2/auth'
+    TOKEN_URL = 'https://oauth2.googleapis.com/token'
+    USERINFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo'
+
+    def get_authorization_url(self, state: str) -> str:
+        params: dict[str, str] = {
+            'client_id': self.client_id,
+            'redirect_uri': self.redirect_uri,
+            'response_type': 'code',
+            'scope': 'openid email profile',
+            'state': state,
+            'access_type': 'offline',
+            'prompt': 'select_account',
+        }
+        request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
+        return str(request.url)
+
+    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.post(
+                self.TOKEN_URL,
+                json={
+                    'client_id': self.client_id,
+                    'client_secret': self.client_secret,
+                    'code': code,
+                    'grant_type': 'authorization_code',
+                    'redirect_uri': self.redirect_uri,
+                },
+            )
+            response.raise_for_status()
+            data: OAuthTokenResponse = response.json()
+            return data
+
+    async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
+        access_token = token_data['access_token']
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.get(
+                self.USERINFO_URL,
+                headers={'Authorization': f'Bearer {access_token}'},
+            )
+            response.raise_for_status()
+            data: GoogleUserInfoResponse = response.json()
+
+        return OAuthUserInfo(
+            provider='google',
+            provider_id=str(data['sub']),
+            email=data.get('email'),
+            email_verified=data.get('email_verified', False),
+            first_name=data.get('given_name'),
+            last_name=data.get('family_name'),
+            avatar_url=data.get('picture'),
+        )
+
+
+class YandexProvider(OAuthProvider):
+    name = 'yandex'
+    display_name = 'Yandex'
+
+    AUTHORIZE_URL = 'https://oauth.yandex.com/authorize'
+    TOKEN_URL = 'https://oauth.yandex.com/token'
+    USERINFO_URL = 'https://login.yandex.ru/info'
+
+    def get_authorization_url(self, state: str) -> str:
+        params: dict[str, str] = {
+            'client_id': self.client_id,
+            'redirect_uri': self.redirect_uri,
+            'response_type': 'code',
+            'scope': 'login:info login:email',
+            'state': state,
+            'force_confirm': 'yes',
+        }
+        request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
+        return str(request.url)
+
+    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.post(
+                self.TOKEN_URL,
+                data={
+                    'client_id': self.client_id,
+                    'client_secret': self.client_secret,
+                    'code': code,
+                    'grant_type': 'authorization_code',
+                },
+            )
+            response.raise_for_status()
+            data: OAuthTokenResponse = response.json()
+            return data
+
+    async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
+        access_token = token_data['access_token']
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.get(
+                self.USERINFO_URL,
+                params={'format': 'json'},
+                headers={'Authorization': f'OAuth {access_token}'},
+            )
+            response.raise_for_status()
+            data: YandexUserInfoResponse = response.json()
+
+        default_email = data.get('default_email')
+        emails = data.get('emails', [])
+        email = default_email or (emails[0] if emails else None)
+
+        return OAuthUserInfo(
+            provider='yandex',
+            provider_id=str(data['id']),
+            email=email,
+            email_verified=bool(email),
+            first_name=data.get('first_name'),
+            last_name=data.get('last_name'),
+            username=data.get('login'),
+            avatar_url=(
+                f'https://avatars.yandex.net/get-yapic/{data["default_avatar_id"]}/islands-200'
+                if data.get('default_avatar_id')
+                else None
+            ),
+        )
+
+
+class DiscordProvider(OAuthProvider):
+    name = 'discord'
+    display_name = 'Discord'
+
+    AUTHORIZE_URL = 'https://discord.com/api/oauth2/authorize'
+    TOKEN_URL = 'https://discord.com/api/oauth2/token'
+    USERINFO_URL = 'https://discord.com/api/v10/users/@me'
+
+    def get_authorization_url(self, state: str) -> str:
+        params: dict[str, str] = {
+            'client_id': self.client_id,
+            'redirect_uri': self.redirect_uri,
+            'response_type': 'code',
+            'scope': 'identify email',
+            'state': state,
+            'prompt': 'consent',
+        }
+        request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
+        return str(request.url)
+
+    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.post(
+                self.TOKEN_URL,
+                data={
+                    'client_id': self.client_id,
+                    'client_secret': self.client_secret,
+                    'code': code,
+                    'grant_type': 'authorization_code',
+                    'redirect_uri': self.redirect_uri,
+                },
+            )
+            response.raise_for_status()
+            data: OAuthTokenResponse = response.json()
+            return data
+
+    async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
+        access_token = token_data['access_token']
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.get(
+                self.USERINFO_URL,
+                headers={'Authorization': f'Bearer {access_token}'},
+            )
+            response.raise_for_status()
+            data: DiscordUserInfoResponse = response.json()
+
+        avatar_url: str | None = None
+        if data.get('avatar'):
+            avatar_url = f'https://cdn.discordapp.com/avatars/{data["id"]}/{data["avatar"]}.png'
+
+        return OAuthUserInfo(
+            provider='discord',
+            provider_id=str(data['id']),
+            email=data.get('email'),
+            email_verified=data.get('verified', False),
+            first_name=data.get('global_name') or data.get('username'),
+            username=data.get('username'),
+            avatar_url=avatar_url,
+        )
+
+
+class VKProvider(OAuthProvider):
+    name = 'vk'
+    display_name = 'VK'
+
+    AUTHORIZE_URL = 'https://oauth.vk.com/authorize'
+    TOKEN_URL = 'https://oauth.vk.com/access_token'
+    USERINFO_URL = 'https://api.vk.com/method/users.get'
+    API_VERSION = '5.131'
+
+    def get_authorization_url(self, state: str) -> str:
+        params: dict[str, str] = {
+            'client_id': self.client_id,
+            'redirect_uri': self.redirect_uri,
+            'response_type': 'code',
+            'scope': 'email',
+            'state': state,
+            'v': self.API_VERSION,
+        }
+        request = httpx.Request('GET', self.AUTHORIZE_URL, params=params)
+        return str(request.url)
+
+    async def exchange_code(self, code: str) -> OAuthTokenResponse:
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.get(
+                self.TOKEN_URL,
+                params={
+                    'client_id': self.client_id,
+                    'client_secret': self.client_secret,
+                    'code': code,
+                    'redirect_uri': self.redirect_uri,
+                },
+            )
+            response.raise_for_status()
+            data: OAuthTokenResponse = response.json()
+            return data
+
+    async def get_user_info(self, token_data: OAuthTokenResponse) -> OAuthUserInfo:
+        access_token = token_data['access_token']
+        user_id: int | None = token_data.get('user_id')
+        # VK returns email in token response, not in userinfo
+        email: str | None = token_data.get('email')
+
+        async with httpx.AsyncClient(timeout=30) as client:
+            response = await client.get(
+                self.USERINFO_URL,
+                params={
+                    'access_token': access_token,
+                    'fields': 'photo_200',
+                    'v': self.API_VERSION,
+                },
+            )
+            response.raise_for_status()
+            data: VKUserInfoResponse = response.json()
+
+        users: list[Any] = data.get('response', [])
+        user_data: VKUserInfoItem = users[0] if users else {}  # type: ignore[assignment]
+
+        return OAuthUserInfo(
+            provider='vk',
+            provider_id=str(user_id or user_data.get('id', '')),
+            email=email,
+            email_verified=bool(email),
+            first_name=user_data.get('first_name'),
+            last_name=user_data.get('last_name'),
+            avatar_url=user_data.get('photo_200'),
+        )
+
+
+# --- Provider factory ---
+
+_PROVIDERS: dict[str, type[OAuthProvider]] = {
+    'google': GoogleProvider,
+    'yandex': YandexProvider,
+    'discord': DiscordProvider,
+    'vk': VKProvider,
+}
+
+
+def get_provider(name: str) -> OAuthProvider | None:
+    """Get an OAuth provider instance if enabled.
+
+    Returns None if the provider is not enabled or not found.
+    """
+    providers_config: dict[str, OAuthProviderConfig] = settings.get_oauth_providers_config()
+    config = providers_config.get(name)
+    if not config or not config['enabled']:
+        return None
+
+    provider_class = _PROVIDERS.get(name)
+    if not provider_class:
+        return None
+
+    redirect_uri = f'{settings.CABINET_URL}/auth/oauth/callback'
+
+    return provider_class(
+        client_id=config['client_id'],
+        client_secret=config['client_secret'],
+        redirect_uri=redirect_uri,
+    )
@@ -12,6 +12,7 @@ from app.config import settings
 from app.database.crud.user import get_user_by_id
 from app.database.database import AsyncSessionLocal
 from app.database.models import User
+from app.services.blacklist_service import blacklist_service
 from app.services.maintenance_service import maintenance_service

 from .auth.jwt_handler import get_token_payload
@@ -104,6 +105,18 @@ async def get_current_cabinet_user(
            detail='User account is not active',
        )

+    # Check blacklist
+    if user.telegram_id is not None:
+        is_blacklisted, reason = await blacklist_service.is_user_blacklisted(user.telegram_id, user.username)
+        if is_blacklisted:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail={
+                    'code': 'blacklisted',
+                    'message': reason or 'Доступ запрещен',
+                },
+            )
+
    # Check maintenance mode (allow admins to pass)
    if maintenance_service.is_maintenance_active():
        # Проверяем админа по telegram_id ИЛИ email
@@ -17,6 +17,8 @@ from .admin_settings import router as admin_settings_router
 from .admin_stats import router as admin_stats_router
 from .admin_tariffs import router as admin_tariffs_router
 from .admin_tickets import router as admin_tickets_router
+from .admin_traffic import router as admin_traffic_router
+from .admin_updates import router as admin_updates_router
 from .admin_users import router as admin_users_router
 from .admin_wheel import router as admin_wheel_router
 from .auth import router as auth_router
@@ -26,6 +28,7 @@ from .contests import router as contests_router
 from .info import router as info_router
 from .media import router as media_router
 from .notifications import router as notifications_router
+from .oauth import router as oauth_router
 from .polls import router as polls_router
 from .promo import router as promo_router
 from .promocode import router as promocode_router
@@ -45,6 +48,7 @@ router = APIRouter(prefix='/cabinet', tags=['Cabinet'])

 # Include all sub-routers
 router.include_router(auth_router)
+router.include_router(oauth_router)
 router.include_router(subscription_router)
 router.include_router(balance_router)
 router.include_router(referral_router)
@@ -83,6 +87,8 @@ router.include_router(admin_payments_router)
 router.include_router(admin_promo_offers_router)
 router.include_router(admin_remnawave_router)
 router.include_router(admin_email_templates_router)
+router.include_router(admin_updates_router)
+router.include_router(admin_traffic_router)

 # WebSocket route
 router.include_router(websocket_router)
@@ -337,7 +337,7 @@ SAMPLE_CONTEXTS: dict[str, dict[str, Any]] = {
    'password_reset': {'username': 'John', 'reset_url': 'https://example.com/reset?token=abc123', 'expire_hours': 1},
 }

-AVAILABLE_LANGUAGES = ['ru', 'en', 'zh', 'ua']
+AVAILABLE_LANGUAGES = ['ru', 'en', 'zh', 'ua', 'fa']


 # ============ Schemas ============
@@ -363,13 +363,16 @@ async def create_promocode_endpoint(
    if existing:
        raise HTTPException(status.HTTP_400_BAD_REQUEST, 'Promo code with this code already exists')

+    # 0 means unlimited — convert to large number for is_valid check (current_uses < max_uses)
+    effective_max_uses = 999999 if payload.max_uses == 0 else payload.max_uses
+
    promocode = await create_promocode(
        db,
        code=normalized_code,
        type=payload.type,
        balance_bonus_kopeks=payload.balance_bonus_kopeks,
        subscription_days=payload.subscription_days,
-        max_uses=payload.max_uses,
+        max_uses=effective_max_uses,
        valid_until=normalized_valid_until,
        created_by=admin.id,
    )
@@ -426,7 +429,7 @@ async def update_promocode_endpoint(
        updates['subscription_days'] = payload.subscription_days

    if payload.max_uses is not None:
-        updates['max_uses'] = payload.max_uses
+        updates['max_uses'] = 999999 if payload.max_uses == 0 else payload.max_uses

    if payload.valid_from is not None:
        updates['valid_from'] = _normalize_datetime(payload.valid_from)
@@ -1,6 +1,8 @@
 """Admin routes for statistics dashboard in cabinet."""

 import logging
+import sys
+import time
 from datetime import datetime, timedelta

 from fastapi import APIRouter, Depends, HTTPException, status
@@ -22,12 +24,15 @@ from app.database.models import (
    User,
 )
 from app.services.remnawave_service import RemnaWaveService
+from app.services.version_service import version_service

 from ..dependencies import get_cabinet_db, get_current_admin_user


 logger = logging.getLogger(__name__)

+_start_time = time.time()
+
 router = APIRouter(prefix='/admin/stats', tags=['Cabinet Admin Stats'])


@@ -142,6 +147,16 @@ class DashboardStats(BaseModel):
    tariff_stats: TariffStats | None = None


+class SystemInfoResponse(BaseModel):
+    """System information for admin dashboard."""
+
+    bot_version: str
+    python_version: str
+    uptime_seconds: int
+    users_total: int
+    subscriptions_active: int
+
+
 # ============ Extended Stats Schemas ============


@@ -309,6 +324,38 @@ async def get_dashboard_stats(
        )


+@router.get('/system-info', response_model=SystemInfoResponse)
+async def get_system_info(
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get system information for admin dashboard."""
+    try:
+        users_total_result = await db.execute(select(func.count()).select_from(User))
+        users_total = users_total_result.scalar() or 0
+
+        subs_active_result = await db.execute(
+            select(func.count(Subscription.id)).where(
+                Subscription.status == SubscriptionStatus.ACTIVE.value,
+            )
+        )
+        subscriptions_active = subs_active_result.scalar() or 0
+
+        return SystemInfoResponse(
+            bot_version=version_service.current_version,
+            python_version=sys.version.split()[0],
+            uptime_seconds=int(time.time() - _start_time),
+            users_total=users_total,
+            subscriptions_active=subscriptions_active,
+        )
+    except Exception as e:
+        logger.error(f'Failed to get system info: {e}')
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to load system information',
+        )
+
+
@router.get('/nodes', response_model=NodesOverview)
 async def get_nodes_status(
    admin: User = Depends(get_current_admin_user),
@@ -14,6 +14,7 @@ from app.database.crud.tariff import (
    get_tariff_by_id,
    get_tariff_subscriptions_count,
    load_period_prices_from_db,
+    reorder_tariffs,
    set_tariff_promo_groups,
    update_tariff,
 )
@@ -29,6 +30,7 @@ from ..schemas.tariffs import (
    TariffDetailResponse,
    TariffListItem,
    TariffListResponse,
+    TariffSortOrderRequest,
    TariffStatsResponse,
    TariffToggleResponse,
    TariffTrialResponse,
@@ -157,6 +159,21 @@ async def get_available_servers(
    ]


+@router.put('/order')
+async def update_tariff_order(
+    request: TariffSortOrderRequest,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Update the display order of tariffs."""
+    await reorder_tariffs(db, request.tariff_ids)
+    await db.commit()
+
+    logger.info(f'Admin {admin.id} updated tariff order: {request.tariff_ids}')
+
+    return {'message': 'Tariff order updated successfully'}
+
+
@router.get('/{tariff_id}', response_model=TariffDetailResponse)
 async def get_tariff(
    tariff_id: int,
@@ -371,7 +388,7 @@ async def update_existing_tariff(

    # Update promo groups separately
    if request.promo_group_ids is not None:
-        await set_tariff_promo_groups(db, tariff_id, request.promo_group_ids)
+        await set_tariff_promo_groups(db, tariff, request.promo_group_ids)

    logger.info(f'Admin {admin.id} updated tariff {tariff_id}')

@@ -395,21 +412,14 @@ async def delete_existing_tariff(
            detail='Tariff not found',
        )

-    # Check if tariff has subscriptions
    subs_count = await get_tariff_subscriptions_count(db, tariff_id)
-    if subs_count > 0:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'Cannot delete tariff with {subs_count} active subscriptions',
-        )
-
    await delete_tariff(db, tariff)
-    logger.info(f'Admin {admin.id} deleted tariff {tariff_id}: {tariff.name}')
+    logger.info(f'Admin {admin.id} deleted tariff {tariff_id}: {tariff.name} (affected subscriptions: {subs_count})')

    # Перезагружаем периоды из БД для синхронизации с ботом
    await load_period_prices_from_db(db)

-    return {'message': 'Tariff deleted successfully'}
+    return {'message': 'Tariff deleted successfully', 'affected_subscriptions': subs_count}


@router.post('/{tariff_id}/toggle', response_model=TariffToggleResponse)
@@ -336,6 +336,7 @@ async def get_all_tickets(
    per_page: int = Query(20, ge=1, le=100, description='Items per page'),
    status_filter: str | None = Query(None, alias='status', description='Filter by status'),
    priority_filter: str | None = Query(None, alias='priority', description='Filter by priority'),
+    user_id: int | None = Query(None, description='Filter by user ID'),
    admin: User = Depends(get_current_admin_user),
    db: AsyncSession = Depends(get_cabinet_db),
 ):
@@ -355,6 +356,10 @@ async def get_all_tickets(
        query = query.where(Ticket.priority == priority_filter)
        count_query = count_query.where(Ticket.priority == priority_filter)

+    if user_id:
+        query = query.where(Ticket.user_id == user_id)
+        count_query = count_query.where(Ticket.user_id == user_id)
+
    # Get total count
    total_result = await db.execute(count_query)
    total = total_result.scalar() or 0
@@ -0,0 +1,694 @@
+"""Admin routes for traffic usage statistics."""
+
+import asyncio
+import csv
+import io
+import logging
+import time
+from datetime import UTC, datetime, timedelta
+
+from aiogram import Bot
+from aiogram.client.default import DefaultBotProperties
+from aiogram.enums import ParseMode
+from aiogram.types import BufferedInputFile
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy import and_, func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.config import settings
+from app.database.models import Subscription, Transaction, TransactionType, User
+from app.services.remnawave_service import RemnaWaveService
+
+from ..dependencies import get_cabinet_db, get_current_admin_user
+from ..schemas.traffic import (
+    ExportCsvRequest,
+    ExportCsvResponse,
+    TrafficEnrichmentResponse,
+    TrafficNodeInfo,
+    TrafficUsageResponse,
+    UserTrafficEnrichment,
+    UserTrafficItem,
+)
+
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix='/admin/traffic', tags=['Admin Traffic'])
+
+_ALLOWED_PERIODS = frozenset({1, 3, 7, 14, 30})
+_CONCURRENCY_LIMIT = 5  # Max parallel API calls to avoid rate limiting
+
+# In-memory cache: {(start_str, end_str): (timestamp, aggregated_data, nodes_info)}
+_traffic_cache: dict[tuple[str, str], tuple[float, dict[str, dict[str, int]], list[TrafficNodeInfo]]] = {}
+_CACHE_TTL = 300  # 5 minutes
+_cache_lock = asyncio.Lock()
+
+# Valid sort fields for the GET endpoint
+_SORT_FIELDS = frozenset({'total_bytes', 'full_name', 'tariff_name', 'device_limit', 'traffic_limit_gb'})
+_ENRICHMENT_SORT_FIELDS = frozenset({'connected', 'total_spent', 'sub_start', 'sub_end', 'last_node'})
+
+
+def _get_status(sub) -> str | None:
+    """Get subscription status via actual_status property."""
+    return sub.actual_status
+
+
+def _validate_period(period: int) -> None:
+    if period not in _ALLOWED_PERIODS:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Period must be one of: {sorted(_ALLOWED_PERIODS)}',
+        )
+
+
+async def _aggregate_traffic(
+    start_str: str, end_str: str, user_uuids: list[str]
+) -> tuple[dict[str, dict[str, int]], list[TrafficNodeInfo]]:
+    """Aggregate per-user traffic across all nodes for a given date range.
+
+    Uses legacy per-node endpoint to fetch all users' traffic per node —
+    O(nodes) API calls instead of O(users). The legacy endpoint returns
+    {userUuid, nodeUuid, total} per entry (non-legacy only returns topUsers
+    without userUuid).
+
+    Returns (user_traffic, nodes_info) where:
+      user_traffic = {remnawave_uuid: {node_uuid: total_bytes, ...}}
+      nodes_info = [TrafficNodeInfo, ...]
+    """
+    cache_key = (start_str, end_str)
+
+    # Quick check without lock
+    now = time.time()
+    cached = _traffic_cache.get(cache_key)
+    if cached and (now - cached[0]) < _CACHE_TTL:
+        return cached[1], cached[2]
+
+    # Acquire lock for the slow path
+    async with _cache_lock:
+        # Re-check after acquiring lock
+        now = time.time()
+        cached = _traffic_cache.get(cache_key)
+        if cached and (now - cached[0]) < _CACHE_TTL:
+            return cached[1], cached[2]
+
+        service = RemnaWaveService()
+        if not service.is_configured:
+            return {}, []
+
+        user_uuids_set = set(user_uuids)
+
+        async with service.get_api_client() as api:
+            nodes = await api.get_all_nodes()
+
+            # Fetch per-node user stats — O(nodes) calls instead of O(users)
+            semaphore = asyncio.Semaphore(_CONCURRENCY_LIMIT)
+
+            async def fetch_node_users(node):
+                async with semaphore:
+                    try:
+                        stats = await api.get_bandwidth_stats_node_users_legacy(node.uuid, start_str, end_str)
+                        return node.uuid, stats
+                    except Exception:
+                        logger.warning('Failed to get traffic for node %s', node.name, exc_info=True)
+                        return node.uuid, None
+
+            results = await asyncio.gather(*(fetch_node_users(n) for n in nodes))
+
+        nodes_info: list[TrafficNodeInfo] = [
+            TrafficNodeInfo(node_uuid=node.uuid, node_name=node.name, country_code=node.country_code) for node in nodes
+        ]
+        nodes_info.sort(key=lambda n: n.node_name)
+
+        # Legacy response: [{userUuid, username, nodeUuid, total, date}, ...]
+        user_traffic: dict[str, dict[str, int]] = {}
+        for node_uuid, entries in results:
+            if not isinstance(entries, list):
+                continue
+            for entry in entries:
+                uid = entry.get('userUuid', '')
+                total = int(entry.get('total', 0))
+                if uid and total > 0 and uid in user_uuids_set:
+                    user_traffic.setdefault(uid, {})[node_uuid] = user_traffic.get(uid, {}).get(node_uuid, 0) + total
+
+        _traffic_cache[cache_key] = (now, user_traffic, nodes_info)
+
+        # Evict expired entries to prevent unbounded growth
+        expired = [k for k, (ts, _, _) in _traffic_cache.items() if (now - ts) >= _CACHE_TTL]
+        for k in expired:
+            del _traffic_cache[k]
+
+        return user_traffic, nodes_info
+
+
+def _compute_date_range(period_days: int) -> tuple[str, str]:
+    """Compute ISO date-time range from period days.
+
+    Truncates to 5-minute intervals for stable cache keys.
+    """
+    end_dt = datetime.now(UTC).replace(second=0, microsecond=0)
+    end_dt = end_dt.replace(minute=(end_dt.minute // 5) * 5)
+    start_dt = end_dt - timedelta(days=period_days)
+    return start_dt.strftime('%Y-%m-%dT%H:%M:%SZ'), end_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+
+
+async def _load_user_map(db: AsyncSession) -> dict[str, User]:
+    """Load all users with remnawave_uuid, eagerly loading subscription + tariff."""
+    stmt = (
+        select(User)
+        .where(User.remnawave_uuid.isnot(None))
+        .options(selectinload(User.subscription).selectinload(Subscription.tariff))
+    )
+    result = await db.execute(stmt)
+    users = result.scalars().all()
+    return {u.remnawave_uuid: u for u in users if u.remnawave_uuid}
+
+
+def _build_traffic_items(
+    user_traffic: dict[str, dict[str, int]],
+    user_map: dict[str, User],
+    nodes_info: list[TrafficNodeInfo],
+    search: str = '',
+    sort_by: str = 'total_bytes',
+    sort_desc: bool = True,
+    tariff_filter: set[str] | None = None,
+    status_filter: set[str] | None = None,
+    node_filter: set[str] | None = None,
+) -> list[UserTrafficItem]:
+    """Merge traffic data with user data, apply search/tariff/status/node filters, return sorted list."""
+    items: list[UserTrafficItem] = []
+    search_lower = search.lower().strip()
+
+    all_uuids = set(user_traffic.keys()) | set(user_map.keys())
+    for uuid in all_uuids:
+        user = user_map.get(uuid)
+        if not user:
+            continue
+
+        traffic = user_traffic.get(uuid, {})
+
+        full_name = user.full_name
+        username = user.username
+        email = user.email
+
+        if search_lower:
+            if (
+                search_lower not in (full_name or '').lower()
+                and search_lower not in (username or '').lower()
+                and search_lower not in (email or '').lower()
+            ):
+                continue
+
+        sub = user.subscription
+        tariff_name = None
+        subscription_status = None
+        traffic_limit_gb = 0.0
+        device_limit = 1
+
+        if sub:
+            subscription_status = _get_status(sub)
+            traffic_limit_gb = float(sub.traffic_limit_gb or 0)
+            device_limit = sub.device_limit or 1
+            if sub.tariff:
+                tariff_name = sub.tariff.name
+
+        if tariff_filter is not None:
+            if (tariff_name or '') not in tariff_filter:
+                continue
+
+        if status_filter is not None:
+            if (subscription_status or '') not in status_filter:
+                continue
+
+        # Apply node filter: keep only selected nodes, recalculate total
+        if node_filter is not None:
+            traffic = {k: v for k, v in traffic.items() if k in node_filter}
+
+        total_bytes = sum(traffic.values())
+
+        items.append(
+            UserTrafficItem(
+                user_id=user.id,
+                telegram_id=user.telegram_id,
+                username=username,
+                email=email,
+                full_name=full_name,
+                tariff_name=tariff_name,
+                subscription_status=subscription_status,
+                traffic_limit_gb=traffic_limit_gb,
+                device_limit=device_limit,
+                node_traffic=traffic,
+                total_bytes=total_bytes,
+            )
+        )
+
+    # Sort by the requested field; node columns use 'node_<uuid>' prefix
+    if sort_by.startswith('node_'):
+        node_uuid = sort_by[5:]
+        items.sort(key=lambda x: x.node_traffic.get(node_uuid, 0), reverse=sort_desc)
+    elif sort_by in ('full_name', 'tariff_name'):
+        items.sort(key=lambda x: (getattr(x, sort_by, None) or '').lower(), reverse=sort_desc)
+    else:
+        items.sort(key=lambda x: getattr(x, sort_by, 0) or 0, reverse=sort_desc)
+
+    return items
+
+
+@router.get('', response_model=TrafficUsageResponse)
+async def get_traffic_usage(
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    period: int = Query(30, ge=1, le=30),
+    limit: int = Query(50, ge=1, le=200),
+    offset: int = Query(0, ge=0),
+    search: str = Query('', max_length=100),
+    sort_by: str = Query('total_bytes', max_length=100),
+    sort_desc: bool = Query(True),
+    tariffs: str = Query('', max_length=500),
+    statuses: str = Query('', max_length=500),
+    nodes: str = Query('', max_length=2000),
+    start_date: str = Query('', max_length=10),
+    end_date: str = Query('', max_length=10),
+):
+    """Get paginated per-user traffic usage by node."""
+    # Determine date range: custom dates or period-based
+    if start_date.strip() and end_date.strip():
+        try:
+            start_dt = datetime.strptime(start_date.strip(), '%Y-%m-%d').replace(tzinfo=UTC)
+            end_dt = datetime.strptime(end_date.strip(), '%Y-%m-%d').replace(tzinfo=UTC, hour=23, minute=59, second=59)
+        except ValueError:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Invalid date format. Use YYYY-MM-DD.')
+
+        now = datetime.now(UTC)
+        end_dt = min(end_dt, now)
+
+        if start_dt > end_dt:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='start_date must be before end_date.')
+
+        if (end_dt - start_dt).days > 31:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Date range cannot exceed 31 days.')
+
+        start_str = start_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        end_str = end_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        effective_period = (end_dt - start_dt).days or 1
+    else:
+        _validate_period(period)
+        start_str, end_str = _compute_date_range(period)
+        effective_period = period
+
+    user_map = await _load_user_map(db)
+    user_traffic, nodes_info = await _aggregate_traffic(start_str, end_str, list(user_map.keys()))
+
+    # Collect all available tariff names (before filtering)
+    available_tariffs = sorted(
+        {
+            u.subscription.tariff.name
+            for u in user_map.values()
+            if u.subscription and u.subscription.tariff and u.subscription.tariff.name
+        }
+    )
+
+    # Collect all available statuses (before filtering)
+    available_statuses = sorted(
+        {_get_status(sub) for u in user_map.values() if (sub := u.subscription) and _get_status(sub)}
+    )
+
+    # Parse tariff filter
+    tariff_filter: set[str] | None = None
+    if tariffs.strip():
+        tariff_filter = {t.strip() for t in tariffs.split(',') if t.strip()}
+
+    # Parse status filter
+    status_filter: set[str] | None = None
+    if statuses.strip():
+        status_filter = {s.strip() for s in statuses.split(',') if s.strip()}
+
+    # Parse node filter
+    node_filter: set[str] | None = None
+    all_node_uuids = {n.node_uuid for n in nodes_info}
+    if nodes.strip():
+        node_filter = {n.strip() for n in nodes.split(',') if n.strip()} & all_node_uuids
+        if not node_filter:
+            node_filter = None  # No valid nodes matched, treat as "all nodes"
+
+    # Validate sort_by: allow known fields + enrichment fields + 'node_<uuid>'
+    is_node_sort = sort_by.startswith('node_') and sort_by[5:] in all_node_uuids
+    is_enrichment_sort = sort_by in _ENRICHMENT_SORT_FIELDS
+    if sort_by not in _SORT_FIELDS and not is_node_sort and not is_enrichment_sort:
+        sort_by = 'total_bytes'
+
+    # For enrichment sort, build items unsorted then sort by enrichment field
+    effective_sort = 'total_bytes' if is_enrichment_sort else sort_by
+    items = _build_traffic_items(
+        user_traffic, user_map, nodes_info, search, effective_sort, sort_desc, tariff_filter, status_filter, node_filter
+    )
+
+    if is_enrichment_sort:
+        enrichment_data = await _build_enrichment(db, user_map)
+        enr_key_map = {
+            'connected': lambda e: e.devices_connected,
+            'total_spent': lambda e: e.total_spent_kopeks,
+            'sub_start': lambda e: e.subscription_start_date or '',
+            'sub_end': lambda e: e.subscription_end_date or '',
+            'last_node': lambda e: e.last_node_name or '',
+        }
+        key_fn = enr_key_map[sort_by]
+        empty = UserTrafficEnrichment()
+        items.sort(key=lambda x: key_fn(enrichment_data.get(x.user_id, empty)), reverse=sort_desc)
+
+    total = len(items)
+    paginated = items[offset : offset + limit]
+
+    return TrafficUsageResponse(
+        items=paginated,
+        nodes=nodes_info,
+        total=total,
+        offset=offset,
+        limit=limit,
+        period_days=effective_period,
+        available_tariffs=available_tariffs,
+        available_statuses=available_statuses,
+    )
+
+
+# ============== Enrichment endpoint ==============
+
+_enrichment_cache: dict[str, tuple[float, dict[int, UserTrafficEnrichment]]] = {}
+_ENRICHMENT_CACHE_TTL = 300  # 5 minutes
+_enrichment_lock = asyncio.Lock()
+
+
+async def _get_bulk_spending(db: AsyncSession, user_ids: list[int]) -> dict[int, int]:
+    """Get total spent kopeks for multiple users in a single query."""
+    if not user_ids:
+        return {}
+    result = await db.execute(
+        select(Transaction.user_id, func.coalesce(func.sum(Transaction.amount_kopeks), 0))
+        .where(
+            and_(
+                Transaction.user_id.in_(user_ids),
+                Transaction.is_completed.is_(True),
+                Transaction.type == TransactionType.SUBSCRIPTION_PAYMENT.value,
+            )
+        )
+        .group_by(Transaction.user_id)
+    )
+    return {row[0]: int(row[1]) for row in result.all()}
+
+
+async def _build_enrichment(db: AsyncSession, user_map: dict[str, User]) -> dict[int, UserTrafficEnrichment]:
+    """Build enrichment data for all users: devices, spending, dates, last node."""
+    uuid_to_user_id: dict[str, int] = {}
+    for uuid, user in user_map.items():
+        uuid_to_user_id[uuid] = user.id
+
+    service = RemnaWaveService()
+    devices_by_user: dict[int, int] = {}
+    last_node_uuid_by_user: dict[int, str] = {}
+    node_uuid_to_name: dict[str, str] = {}
+
+    if service.is_configured:
+        async with service.get_api_client() as api:
+            # 3 bulk calls: nodes + users (paginated) + devices
+            try:
+                nodes_list = await api.get_all_nodes()
+            except Exception:
+                logger.warning('Failed to fetch nodes for enrichment', exc_info=True)
+                nodes_list = []
+
+            for node in nodes_list:
+                node_uuid_to_name[node.uuid] = node.name
+
+            # Fetch all panel users (paginated) for last connected node
+            panel_users = []
+            try:
+                first_page = await api.get_all_users(start=0, size=500)
+                panel_users.extend(first_page['users'])
+                total_panel = first_page['total']
+
+                if total_panel > 500:
+                    remaining_tasks = [
+                        api.get_all_users(start=offset, size=500) for offset in range(500, total_panel, 500)
+                    ]
+                    pages = await asyncio.gather(*remaining_tasks, return_exceptions=True)
+                    for page in pages:
+                        if isinstance(page, dict):
+                            panel_users.extend(page['users'])
+            except Exception:
+                logger.warning('Failed to fetch panel users for enrichment', exc_info=True)
+
+            for pu in panel_users:
+                uid = uuid_to_user_id.get(pu.uuid)
+                if uid is None:
+                    continue
+                if pu.user_traffic and pu.user_traffic.last_connected_node_uuid:
+                    last_node_uuid_by_user[uid] = pu.user_traffic.last_connected_node_uuid
+
+            # Bulk device fetch — single API call (paginated with start/size)
+            try:
+                devices_data = await api.get_all_hwid_devices()
+                for device in devices_data.get('devices', []):
+                    user_uuid = device.get('userUuid', '')
+                    uid = uuid_to_user_id.get(user_uuid)
+                    if uid is not None:
+                        devices_by_user[uid] = devices_by_user.get(uid, 0) + 1
+            except Exception:
+                logger.warning('Failed to fetch bulk devices for enrichment', exc_info=True)
+
+    # Bulk spending stats
+    all_user_ids = [u.id for u in user_map.values()]
+    spending_map = await _get_bulk_spending(db, all_user_ids)
+
+    # Build enrichment data
+    enrichment: dict[int, UserTrafficEnrichment] = {}
+    for uuid, user in user_map.items():
+        uid = user.id
+        sub = user.subscription
+
+        start_date = None
+        end_date = None
+        if sub:
+            if sub.start_date:
+                start_date = sub.start_date.isoformat()
+            if sub.end_date:
+                end_date = sub.end_date.isoformat()
+
+        last_node_name = None
+        last_uuid = last_node_uuid_by_user.get(uid)
+        if last_uuid:
+            last_node_name = node_uuid_to_name.get(last_uuid)
+
+        enrichment[uid] = UserTrafficEnrichment(
+            devices_connected=devices_by_user.get(uid, 0),
+            total_spent_kopeks=spending_map.get(uid, 0),
+            subscription_start_date=start_date,
+            subscription_end_date=end_date,
+            last_node_name=last_node_name,
+        )
+
+    return enrichment
+
+
+@router.get('/enrichment', response_model=TrafficEnrichmentResponse)
+async def get_traffic_enrichment(
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Return enrichment data: device counts, spending, dates, last node."""
+    cache_key = 'enrichment'
+    now = time.time()
+
+    cached = _enrichment_cache.get(cache_key)
+    if cached and (now - cached[0]) < _ENRICHMENT_CACHE_TTL:
+        return TrafficEnrichmentResponse(data=cached[1])
+
+    async with _enrichment_lock:
+        now = time.time()
+        cached = _enrichment_cache.get(cache_key)
+        if cached and (now - cached[0]) < _ENRICHMENT_CACHE_TTL:
+            return TrafficEnrichmentResponse(data=cached[1])
+
+        user_map = await _load_user_map(db)
+        enrichment = await _build_enrichment(db, user_map)
+
+        _enrichment_cache[cache_key] = (now, enrichment)
+
+        # Evict expired
+        expired = [k for k, (ts, _) in _enrichment_cache.items() if (now - ts) >= _ENRICHMENT_CACHE_TTL]
+        for k in expired:
+            del _enrichment_cache[k]
+
+        return TrafficEnrichmentResponse(data=enrichment)
+
+
+@router.post('/export-csv', response_model=ExportCsvResponse)
+async def export_traffic_csv(
+    request: ExportCsvRequest,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Generate CSV with traffic usage and send to admin's Telegram DM."""
+    if not admin.telegram_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Admin has no Telegram ID configured',
+        )
+
+    # Determine date range: custom dates or period-based
+    if request.start_date and request.end_date:
+        try:
+            start_dt = datetime.strptime(request.start_date.strip(), '%Y-%m-%d').replace(tzinfo=UTC)
+            end_dt = datetime.strptime(request.end_date.strip(), '%Y-%m-%d').replace(
+                tzinfo=UTC, hour=23, minute=59, second=59
+            )
+        except ValueError:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Invalid date format. Use YYYY-MM-DD.')
+
+        now = datetime.now(UTC)
+        end_dt = min(end_dt, now)
+        if start_dt > end_dt:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='start_date must be before end_date.')
+        if (end_dt - start_dt).days > 31:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Date range cannot exceed 31 days.')
+
+        start_str = start_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        end_str = end_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        period_label = f'{request.start_date}_{request.end_date}'
+    else:
+        _validate_period(request.period)
+        start_str, end_str = _compute_date_range(request.period)
+        period_label = f'{request.period}d'
+
+    user_map = await _load_user_map(db)
+    user_traffic, nodes_info = await _aggregate_traffic(start_str, end_str, list(user_map.keys()))
+    enrichment = await _build_enrichment(db, user_map)
+
+    # Parse filters
+    tariff_filter: set[str] | None = None
+    if request.tariffs and request.tariffs.strip():
+        tariff_filter = {t.strip() for t in request.tariffs.split(',') if t.strip()}
+
+    status_filter: set[str] | None = None
+    if request.statuses and request.statuses.strip():
+        status_filter = {s.strip() for s in request.statuses.split(',') if s.strip()}
+
+    node_filter: set[str] | None = None
+    all_node_uuids = {n.node_uuid for n in nodes_info}
+    if request.nodes and request.nodes.strip():
+        node_filter = {n.strip() for n in request.nodes.split(',') if n.strip()} & all_node_uuids
+        if not node_filter:
+            node_filter = None
+
+    items = _build_traffic_items(
+        user_traffic,
+        user_map,
+        nodes_info,
+        sort_by='total_bytes',
+        sort_desc=True,
+        tariff_filter=tariff_filter,
+        status_filter=status_filter,
+        node_filter=node_filter,
+    )
+
+    # Determine which nodes to include in CSV columns
+    csv_nodes = [n for n in nodes_info if n.node_uuid in node_filter] if node_filter else nodes_info
+
+    # Compute period days for risk calculation
+    if request.start_date and request.end_date:
+        period_days = max((end_dt - start_dt).days, 1)
+    else:
+        period_days = request.period
+
+    total_thr = request.total_threshold_gb or 0
+    node_thr = request.node_threshold_gb or 0
+    has_risk = total_thr > 0 or node_thr > 0
+
+    # Build CSV rows
+    rows: list[dict] = []
+    for item in items:
+        row: dict = {
+            'User ID': item.user_id,
+            'Telegram ID': item.telegram_id or '',
+            'Username': item.username or '',
+            'Email': item.email or '',
+            'Full Name': item.full_name,
+            'Tariff': item.tariff_name or '',
+            'Status': item.subscription_status or '',
+            'Traffic Limit (GB)': item.traffic_limit_gb,
+            'Device Limit': item.device_limit,
+        }
+        # Enrichment columns
+        enr = enrichment.get(item.user_id)
+        row['Connected Devices'] = enr.devices_connected if enr else 0
+        row['Total Spent (RUB)'] = round(enr.total_spent_kopeks / 100, 2) if enr else 0
+        row['Sub Start'] = enr.subscription_start_date or '' if enr else ''
+        row['Sub End'] = enr.subscription_end_date or '' if enr else ''
+        row['Last Node'] = enr.last_node_name or '' if enr else ''
+
+        for node in csv_nodes:
+            row[f'{node.node_name} (bytes)'] = item.node_traffic.get(node.node_uuid, 0)
+        row['Total (bytes)'] = item.total_bytes
+        row['Total (GB)'] = round(item.total_bytes / (1024**3), 2) if item.total_bytes else 0
+
+        if has_risk:
+            daily_total = item.total_bytes / period_days / (1024**3) if period_days > 0 else 0
+            row['Total GB/day'] = round(daily_total, 4)
+
+            total_ratio = daily_total / total_thr if total_thr > 0 else 0
+
+            max_node_ratio = 0.0
+            worst_node_daily = 0.0
+            for node_bytes in item.node_traffic.values():
+                if node_bytes > 0 and node_thr > 0:
+                    daily_node = node_bytes / period_days / (1024**3) if period_days > 0 else 0
+                    ratio = daily_node / node_thr
+                    if ratio > max_node_ratio:
+                        max_node_ratio = ratio
+                        worst_node_daily = daily_node
+
+            ratio = max(total_ratio, max_node_ratio)
+            if ratio < 0.5:
+                risk_level = 'low'
+            elif ratio < 0.8:
+                risk_level = 'medium'
+            elif ratio < 1.2:
+                risk_level = 'high'
+            else:
+                risk_level = 'critical'
+
+            row['Risk Level'] = risk_level
+            row['Risk Ratio'] = round(ratio, 3)
+            row['Risk GB/day'] = round(daily_total if total_ratio >= max_node_ratio else worst_node_daily, 4)
+
+        rows.append(row)
+
+    # Generate CSV
+    output = io.StringIO()
+    if rows:
+        writer = csv.DictWriter(output, fieldnames=rows[0].keys())
+        writer.writeheader()
+        writer.writerows(rows)
+    csv_bytes = output.getvalue().encode('utf-8-sig')
+
+    timestamp = datetime.now(UTC).strftime('%Y%m%d_%H%M%S')
+    filename = f'traffic_usage_{period_label}_{timestamp}.csv'
+
+    try:
+        bot = Bot(
+            token=settings.BOT_TOKEN,
+            default=DefaultBotProperties(parse_mode=ParseMode.HTML),
+        )
+        async with bot:
+            await bot.send_document(
+                chat_id=admin.telegram_id,
+                document=BufferedInputFile(csv_bytes, filename=filename),
+                caption=f'Traffic usage report ({period_label})\nUsers: {len(rows)}',
+            )
+    except Exception:
+        logger.error('Failed to send CSV to admin %s', admin.telegram_id, exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to send CSV report. Please try again later.',
+        )
+
+    return ExportCsvResponse(success=True, message=f'CSV sent ({len(rows)} users)')
@@ -0,0 +1,139 @@
+"""Admin routes for version and release information."""
+
+import logging
+from datetime import datetime, timedelta
+
+import aiohttp
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from app.database.models import User
+from app.services.version_service import version_service
+
+from ..dependencies import get_current_admin_user
+
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix='/admin/updates', tags=['Cabinet Admin Updates'])
+
+
+# ============ Schemas ============
+
+
+class ReleaseItem(BaseModel):
+    tag_name: str
+    name: str
+    body: str
+    published_at: str
+    prerelease: bool
+
+
+class ProjectReleasesInfo(BaseModel):
+    current_version: str
+    has_updates: bool
+    releases: list[ReleaseItem]
+    repo_url: str
+
+
+class ReleasesResponse(BaseModel):
+    bot: ProjectReleasesInfo
+    cabinet: ProjectReleasesInfo
+
+
+# ============ Cabinet releases cache ============
+
+CABINET_REPO = 'BEDOLAGA-DEV/bedolaga-cabinet'
+_cabinet_cache: dict = {}
+_cabinet_last_check: datetime | None = None
+_CACHE_TTL = 3600
+
+
+async def _fetch_cabinet_releases(force: bool = False) -> list[dict]:
+    global _cabinet_last_check
+
+    if not force and _cabinet_cache.get('releases') and _cabinet_last_check:
+        if datetime.now() - _cabinet_last_check < timedelta(seconds=_CACHE_TTL):
+            return _cabinet_cache['releases']
+
+    url = f'https://api.github.com/repos/{CABINET_REPO}/releases'
+
+    try:
+        timeout = aiohttp.ClientTimeout(total=10)
+        async with aiohttp.ClientSession(timeout=timeout) as session, session.get(url) as response:
+            if response.status == 200:
+                data = await response.json()
+                releases = []
+                for item in data[:20]:
+                    releases.append(
+                        {
+                            'tag_name': item['tag_name'],
+                            'name': item.get('name') or item['tag_name'],
+                            'body': item.get('body') or '',
+                            'published_at': item['published_at'],
+                            'prerelease': item.get('prerelease', False),
+                        }
+                    )
+                _cabinet_cache['releases'] = releases
+                _cabinet_last_check = datetime.now()
+                logger.info('Fetched %d cabinet releases from GitHub', len(releases))
+                return releases
+            logger.warning('GitHub API returned status %d for cabinet releases', response.status)
+            return _cabinet_cache.get('releases', [])
+    except TimeoutError:
+        logger.warning('Timeout fetching cabinet releases from GitHub')
+        return _cabinet_cache.get('releases', [])
+    except Exception as e:
+        logger.error('Error fetching cabinet releases: %s', e)
+        return _cabinet_cache.get('releases', [])
+
+
+# ============ Routes ============
+
+
+@router.get('/releases', response_model=ReleasesResponse)
+async def get_releases(
+    current_user: User = Depends(get_current_admin_user),
+) -> ReleasesResponse:
+    """Get release information for bot and cabinet."""
+    # Bot releases
+    bot_releases_raw = await version_service._fetch_releases()
+    has_updates, _ = await version_service.check_for_updates()
+
+    bot_releases = [
+        ReleaseItem(
+            tag_name=r.tag_name,
+            name=r.name,
+            body=r.full_description,
+            published_at=r.published_at.isoformat(),
+            prerelease=r.prerelease,
+        )
+        for r in bot_releases_raw[:10]
+    ]
+
+    bot_info = ProjectReleasesInfo(
+        current_version=version_service.current_version,
+        has_updates=has_updates,
+        releases=bot_releases,
+        repo_url=f'https://github.com/{version_service.repo}',
+    )
+
+    # Cabinet releases
+    cabinet_releases_raw = await _fetch_cabinet_releases()
+    cabinet_releases = [ReleaseItem(**r) for r in cabinet_releases_raw[:10]]
+
+    # Current version = latest non-prerelease tag
+    cabinet_current = ''
+    for r in cabinet_releases_raw:
+        if not r.get('prerelease', False):
+            cabinet_current = r['tag_name']
+            break
+
+    cabinet_info = ProjectReleasesInfo(
+        current_version=cabinet_current,
+        has_updates=False,
+        releases=cabinet_releases,
+        repo_url=f'https://github.com/{CABINET_REPO}',
+    )
+
+    return ReleasesResponse(bot=bot_info, cabinet=cabinet_info)
@@ -7,6 +7,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import Integer, and_, func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession

+from app.database.crud.campaign import get_campaign_registration_by_user
 from app.database.crud.subscription import (
    extend_subscription,
 )
@@ -27,6 +28,7 @@ from app.database.models import (
    PromoGroup,
    Subscription,
    SubscriptionStatus,
+    TrafficPurchase,
    Transaction,
    TransactionType,
    User,
@@ -36,8 +38,10 @@ from app.utils.timezone import panel_datetime_to_naive_utc

 from ..dependencies import get_cabinet_db, get_current_admin_user
 from ..schemas.users import (
+    DeleteDeviceResponse,
    DeleteUserRequest,
    DeleteUserResponse,
+    DeviceInfo,
    DisableUserRequest,
    DisableUserResponse,
    FullDeleteUserRequest,
@@ -45,6 +49,7 @@ from ..schemas.users import (
    PanelSyncStatusResponse,
    PanelUserInfo,
    PeriodPriceInfo,
+    ResetDevicesResponse,
    ResetSubscriptionRequest,
    ResetSubscriptionResponse,
    ResetTrialRequest,
@@ -54,10 +59,13 @@ from ..schemas.users import (
    SyncFromPanelResponse,
    SyncToPanelRequest,
    SyncToPanelResponse,
+    TrafficPurchaseItem,
    UpdateBalanceRequest,
    UpdateBalanceResponse,
    UpdatePromoGroupRequest,
    UpdatePromoGroupResponse,
+    UpdateReferralCommissionRequest,
+    UpdateReferralCommissionResponse,
    UpdateRestrictionsRequest,
    UpdateRestrictionsResponse,
    UpdateSubscriptionRequest,
@@ -67,7 +75,11 @@ from ..schemas.users import (
    UserAvailableTariffItem,
    UserAvailableTariffsResponse,
    UserDetailResponse,
+    UserDevicesResponse,
    UserListItem,
+    UserNodeUsageItem,
+    UserNodeUsageResponse,
+    UserPanelInfoResponse,
    UserPromoGroupInfo,
    UserReferralInfo,
    UsersListResponse,
@@ -153,13 +165,43 @@ def _build_subscription_info(subscription: Subscription, tariff_name: str | None


 async def _build_subscription_info_async(db: AsyncSession, subscription: Subscription) -> UserSubscriptionInfo:
-    """Build UserSubscriptionInfo from Subscription model, fetching tariff name asynchronously."""
+    """Build UserSubscriptionInfo from Subscription model, fetching tariff name and traffic purchases."""
    tariff_name = None
    if subscription.tariff_id:
        tariff = await get_tariff_by_id(db, subscription.tariff_id)
        if tariff:
            tariff_name = tariff.name
-    return _build_subscription_info(subscription, tariff_name=tariff_name)
+
+    # Fetch traffic purchases
+    now = datetime.utcnow()
+    tp_query = (
+        select(TrafficPurchase)
+        .where(TrafficPurchase.subscription_id == subscription.id)
+        .order_by(TrafficPurchase.created_at.desc())
+    )
+    tp_result = await db.execute(tp_query)
+    purchases = tp_result.scalars().all()
+
+    traffic_purchase_items = []
+    for p in purchases:
+        delta = p.expires_at - now
+        days_remaining = max(0, delta.days)
+        is_expired = now >= p.expires_at
+        traffic_purchase_items.append(
+            TrafficPurchaseItem(
+                id=p.id,
+                traffic_gb=p.traffic_gb,
+                expires_at=p.expires_at,
+                created_at=p.created_at,
+                days_remaining=days_remaining,
+                is_expired=is_expired,
+            )
+        )
+
+    info = _build_subscription_info(subscription, tariff_name=tariff_name)
+    info.purchased_traffic_gb = getattr(subscription, 'purchased_traffic_gb', 0) or 0
+    info.traffic_purchases = traffic_purchase_items
+    return info


 async def _sync_subscription_to_panel(db: AsyncSession, user: User, subscription: Subscription) -> dict:
@@ -194,12 +236,16 @@ async def _sync_subscription_to_panel(db: AsyncSession, user: User, subscription
            full_name=user.full_name,
            username=user.username,
            telegram_id=user.telegram_id,
+            email=user.email,
+            user_id=user.id,
        )

        description = settings.format_remnawave_user_description(
            full_name=user.full_name,
            username=user.username,
            telegram_id=user.telegram_id,
+            email=user.email,
+            user_id=user.id,
        )

        hwid_limit = resolve_hwid_device_limit_for_payload(subscription)
@@ -209,7 +255,15 @@ async def _sync_subscription_to_panel(db: AsyncSession, user: User, subscription
        async with service.get_api_client() as api:
            panel_uuid = user.remnawave_uuid

-            # Try to find existing user
+            # Try to find existing user by UUID first
+            if panel_uuid:
+                existing_user = await api.get_user_by_uuid(panel_uuid)
+                if not existing_user:
+                    logger.warning(f'User {user.id} has stale remnawave_uuid {panel_uuid}, clearing')
+                    panel_uuid = None
+                    user.remnawave_uuid = None
+
+            # Fallback: search by telegram_id
            if not panel_uuid and user.telegram_id:
                existing_users = await api.get_user_by_telegram_id(user.telegram_id)
                if existing_users:
@@ -217,6 +271,14 @@ async def _sync_subscription_to_panel(db: AsyncSession, user: User, subscription
                    user.remnawave_uuid = panel_uuid
                    changes['remnawave_uuid_discovered'] = panel_uuid

+            # Fallback: search by email (for OAuth users without telegram_id)
+            if not panel_uuid and user.email:
+                existing_users = await api.get_user_by_email(user.email)
+                if existing_users:
+                    panel_uuid = existing_users[0].uuid
+                    user.remnawave_uuid = panel_uuid
+                    changes['remnawave_uuid_discovered'] = panel_uuid
+
            if panel_uuid:
                # Update existing user
                update_kwargs = {
@@ -252,6 +314,7 @@ async def _sync_subscription_to_panel(db: AsyncSession, user: User, subscription
                    'traffic_limit_bytes': traffic_limit_bytes,
                    'traffic_limit_strategy': TrafficLimitStrategy.MONTH,
                    'telegram_id': user.telegram_id,
+                    'email': user.email,
                    'description': description,
                    'active_internal_squads': subscription.connected_squads or [],
                }
@@ -525,6 +588,14 @@ async def get_user_detail(
        for t in transactions
    ]

+    # Get campaign info
+    campaign_name = None
+    campaign_id = None
+    campaign_reg = await get_campaign_registration_by_user(db, user.id)
+    if campaign_reg and campaign_reg.campaign:
+        campaign_name = campaign_reg.campaign.name
+        campaign_id = campaign_reg.campaign.id
+
    return UserDetailResponse(
        id=user.id,
        telegram_id=user.telegram_id,
@@ -550,6 +621,8 @@ async def get_user_detail(
        used_promocodes=user.used_promocodes,
        has_had_paid_subscription=user.has_had_paid_subscription,
        lifetime_used_traffic_bytes=user.lifetime_used_traffic_bytes or 0,
+        campaign_name=campaign_name,
+        campaign_id=campaign_id,
        restriction_topup=user.restriction_topup,
        restriction_subscription=user.restriction_subscription,
        restriction_reason=user.restriction_reason,
@@ -577,6 +650,171 @@ async def get_user_by_telegram(
    return await get_user_detail(user.id, admin, db)


+# === Panel Info ===
+
+
+@router.get('/{user_id}/panel-info', response_model=UserPanelInfoResponse)
+async def get_user_panel_info(
+    user_id: int,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get user panel info from Remnawave (config links, traffic, connection data)."""
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='User not found',
+        )
+
+    try:
+        from app.services.remnawave_service import RemnaWaveService
+
+        service = RemnaWaveService()
+        if not service.is_configured:
+            return UserPanelInfoResponse(found=False)
+
+        async with service.get_api_client() as api:
+            panel_user = None
+
+            # Try by UUID first (works for all users including OAuth)
+            if user.remnawave_uuid:
+                panel_user = await api.get_user_by_uuid(user.remnawave_uuid)
+
+            # Fallback: search by telegram_id
+            if not panel_user and user.telegram_id:
+                panel_users = await api.get_user_by_telegram_id(user.telegram_id)
+                if panel_users:
+                    panel_user = panel_users[0]
+
+            # Fallback: search by email (OAuth users)
+            if not panel_user and user.email:
+                panel_users_by_email = await api.get_user_by_email(user.email)
+                if panel_users_by_email:
+                    panel_user = panel_users_by_email[0]
+
+            if not panel_user:
+                return UserPanelInfoResponse(found=False)
+
+            # Resolve last connected node name via accessible nodes (lighter than get_all_nodes)
+            last_node_name = None
+            last_node_uuid = None
+            if panel_user.user_traffic and panel_user.user_traffic.last_connected_node_uuid:
+                last_node_uuid = panel_user.user_traffic.last_connected_node_uuid
+                try:
+                    accessible = await api.get_user_accessible_nodes(panel_user.uuid)
+                    for node in accessible:
+                        if node.uuid == last_node_uuid:
+                            last_node_name = node.node_name
+                            break
+                except Exception:
+                    logger.warning(f'Failed to resolve node name for user {user_id}')
+
+            return UserPanelInfoResponse(
+                found=True,
+                trojan_password=panel_user.trojan_password,
+                vless_uuid=panel_user.vless_uuid,
+                ss_password=panel_user.ss_password,
+                subscription_url=panel_user.subscription_url,
+                happ_link=panel_user.happ_link,
+                used_traffic_bytes=panel_user.used_traffic_bytes,
+                lifetime_used_traffic_bytes=panel_user.lifetime_used_traffic_bytes,
+                traffic_limit_bytes=panel_user.traffic_limit_bytes,
+                first_connected_at=panel_user.first_connected_at,
+                online_at=panel_user.online_at,
+                last_connected_node_uuid=last_node_uuid,
+                last_connected_node_name=last_node_name,
+            )
+
+    except Exception as e:
+        logger.error(f'Error getting panel info for user {user_id}: {e}')
+        return UserPanelInfoResponse(found=False)
+
+
+@router.get('/{user_id}/node-usage', response_model=UserNodeUsageResponse)
+async def get_user_node_usage(
+    user_id: int,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get user per-node traffic usage (always 30 days with daily breakdown)."""
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='User not found',
+        )
+
+    if not user.remnawave_uuid:
+        return UserNodeUsageResponse(items=[])
+
+    try:
+        from app.services.remnawave_service import RemnaWaveService
+
+        service = RemnaWaveService()
+        if not service.is_configured:
+            return UserNodeUsageResponse(items=[])
+
+        end_date = datetime.utcnow()
+        start_date = end_date - timedelta(days=30)
+        start_str = start_date.strftime('%Y-%m-%d')
+        end_str = end_date.strftime('%Y-%m-%d')
+
+        async with service.get_api_client() as api:
+            # Get user's accessible nodes (1 API call)
+            accessible_nodes = await api.get_user_accessible_nodes(user.remnawave_uuid)
+
+            # Get user bandwidth stats (1 API call)
+            # Response: {categories: [dates], series: [{uuid, name, countryCode, total, data: [daily]}, ...]}
+            stats = await api.get_bandwidth_stats_user(user.remnawave_uuid, start_str, end_str)
+
+            categories: list[str] = []
+            series_map: dict[str, dict] = {}
+            if isinstance(stats, dict):
+                categories = stats.get('categories', [])
+                for s in stats.get('series', []):
+                    series_map[s['uuid']] = {
+                        'name': s.get('name', ''),
+                        'country_code': s.get('countryCode', ''),
+                        'total': int(s.get('total', 0)),
+                        'daily': [int(v) for v in s.get('data', [])],
+                    }
+
+            # Build items: accessible nodes + any extra from stats
+            items = []
+            seen_uuids: set[str] = set()
+            for node in accessible_nodes:
+                seen_uuids.add(node.uuid)
+                sr = series_map.get(node.uuid)
+                items.append(
+                    UserNodeUsageItem(
+                        node_uuid=node.uuid,
+                        node_name=sr['name'] if sr else node.node_name,
+                        country_code=sr['country_code'] if sr else node.country_code,
+                        total_bytes=sr['total'] if sr else 0,
+                        daily_bytes=sr['daily'] if sr else [],
+                    )
+                )
+            for nid, sr in series_map.items():
+                if nid not in seen_uuids:
+                    items.append(
+                        UserNodeUsageItem(
+                            node_uuid=nid,
+                            node_name=sr['name'],
+                            country_code=sr['country_code'],
+                            total_bytes=sr['total'],
+                            daily_bytes=sr['daily'],
+                        )
+                    )
+
+            items.sort(key=lambda x: x.total_bytes, reverse=True)
+            return UserNodeUsageResponse(items=items, categories=categories)
+
+    except Exception as e:
+        logger.error(f'Error getting node usage for user {user_id}: {e}')
+        return UserNodeUsageResponse(items=[])
+
+
 # === Balance Management ===


@@ -896,6 +1134,113 @@ async def update_user_subscription(
            subscription=await _build_subscription_info_async(db, subscription),
        )

+    if request.action == 'add_traffic':
+        if not request.traffic_gb:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='traffic_gb parameter is required for add_traffic action',
+            )
+
+        from app.database.crud.subscription import add_subscription_traffic
+
+        await add_subscription_traffic(db, subscription, request.traffic_gb)
+        await db.commit()
+        await db.refresh(subscription)
+
+        # Sync to Remnawave panel
+        await _sync_subscription_to_panel(db, user, subscription)
+
+        logger.info(f'Admin {admin.id} added {request.traffic_gb} GB traffic for user {user_id}')
+
+        return UpdateSubscriptionResponse(
+            success=True,
+            message=f'Added {request.traffic_gb} GB traffic (30 days)',
+            subscription=await _build_subscription_info_async(db, subscription),
+        )
+
+    if request.action == 'remove_traffic':
+        if not request.traffic_purchase_id:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='traffic_purchase_id parameter is required for remove_traffic action',
+            )
+
+        # Find the traffic purchase
+        tp_query = select(TrafficPurchase).where(
+            TrafficPurchase.id == request.traffic_purchase_id,
+            TrafficPurchase.subscription_id == subscription.id,
+        )
+        tp_result = await db.execute(tp_query)
+        traffic_purchase = tp_result.scalar_one_or_none()
+        if not traffic_purchase:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail='Traffic purchase not found',
+            )
+
+        removed_gb = traffic_purchase.traffic_gb
+
+        # Decrement counters
+        subscription.traffic_limit_gb = max(0, subscription.traffic_limit_gb - removed_gb)
+        current_purchased = getattr(subscription, 'purchased_traffic_gb', 0) or 0
+        subscription.purchased_traffic_gb = max(0, current_purchased - removed_gb)
+
+        # Delete the purchase record
+        await db.delete(traffic_purchase)
+
+        # Recalculate traffic_reset_at from remaining active purchases
+        now = datetime.utcnow()
+        remaining_query = select(TrafficPurchase).where(
+            TrafficPurchase.subscription_id == subscription.id,
+            TrafficPurchase.expires_at > now,
+            TrafficPurchase.id != request.traffic_purchase_id,
+        )
+        remaining_result = await db.execute(remaining_query)
+        remaining_purchases = remaining_result.scalars().all()
+
+        if remaining_purchases:
+            subscription.traffic_reset_at = min(p.expires_at for p in remaining_purchases)
+        else:
+            subscription.traffic_reset_at = None
+
+        await db.commit()
+        await db.refresh(subscription)
+
+        # Sync to Remnawave panel
+        await _sync_subscription_to_panel(db, user, subscription)
+
+        logger.info(
+            f'Admin {admin.id} removed traffic purchase {request.traffic_purchase_id} ({removed_gb} GB) for user {user_id}'
+        )
+
+        return UpdateSubscriptionResponse(
+            success=True,
+            message=f'Removed {removed_gb} GB traffic package',
+            subscription=await _build_subscription_info_async(db, subscription),
+        )
+
+    if request.action == 'set_device_limit':
+        if request.device_limit is None:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail='device_limit parameter is required for set_device_limit action',
+            )
+
+        subscription.device_limit = request.device_limit
+        await db.commit()
+        await db.refresh(subscription)
+
+        # Sync to Remnawave panel
+        await _sync_subscription_to_panel(db, user, subscription)
+
+        logger.info(f'Admin {admin.id} set device limit to {request.device_limit} for user {user_id}')
+
+        return UpdateSubscriptionResponse(
+            success=True,
+            message=f'Device limit set to {request.device_limit}',
+            subscription=await _build_subscription_info_async(db, subscription),
+        )
+
    raise HTTPException(
        status_code=status.HTTP_400_BAD_REQUEST,
        detail=f'Unknown action: {request.action}',
@@ -976,6 +1321,11 @@ async def get_user_available_tariffs(
                price_per_day_kopeks=tariff.price_per_day_kopeks,
                min_days=tariff.min_days,
                max_days=tariff.max_days,
+                device_price_kopeks=tariff.device_price_kopeks,
+                max_device_limit=tariff.max_device_limit,
+                traffic_topup_enabled=tariff.traffic_topup_enabled,
+                traffic_topup_packages=tariff.traffic_topup_packages or {},
+                max_topup_traffic_gb=tariff.max_topup_traffic_gb,
                is_available=is_available,
                requires_promo_group=requires_promo_group,
            )
@@ -1162,6 +1512,173 @@ async def update_user_promo_group(
    )


+# === Referral Commission ===
+
+
+@router.post('/{user_id}/referral-commission', response_model=UpdateReferralCommissionResponse)
+async def update_user_referral_commission(
+    user_id: int,
+    request: UpdateReferralCommissionRequest,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Update user's individual referral commission percentage."""
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail='User not found',
+        )
+
+    old_commission = user.referral_commission_percent
+    user.referral_commission_percent = request.commission_percent
+    user.updated_at = datetime.utcnow()
+    await db.commit()
+
+    logger.info(
+        f'Admin {admin.id} changed referral commission for user {user_id}: {old_commission} -> {request.commission_percent}'
+    )
+
+    return UpdateReferralCommissionResponse(
+        success=True,
+        old_commission_percent=old_commission,
+        new_commission_percent=request.commission_percent,
+        message='Referral commission updated',
+    )
+
+
+# === Devices ===
+
+
+@router.get('/{user_id}/devices', response_model=UserDevicesResponse)
+async def get_user_devices(
+    user_id: int,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Get user devices from Remnawave panel."""
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail='User not found')
+
+    if not user.remnawave_uuid:
+        return UserDevicesResponse()
+
+    try:
+        from app.services.remnawave_service import RemnaWaveService
+
+        service = RemnaWaveService()
+        if not service.is_configured:
+            return UserDevicesResponse()
+
+        async with service.get_api_client() as api:
+            response = await api.get_user_devices(user.remnawave_uuid)
+
+            devices = []
+            for d in response.get('devices', []):
+                hwid = d.get('hwid') or d.get('deviceId') or d.get('id')
+                if not hwid:
+                    continue
+                devices.append(
+                    DeviceInfo(
+                        hwid=hwid,
+                        platform=d.get('platform') or d.get('platformType') or '',
+                        device_model=d.get('deviceModel') or d.get('model') or d.get('name') or '',
+                        created_at=d.get('updatedAt') or d.get('lastSeen') or d.get('createdAt'),
+                    )
+                )
+
+            device_limit = 0
+            if user.subscription:
+                device_limit = user.subscription.device_limit or 0
+
+            return UserDevicesResponse(
+                devices=devices,
+                total=response.get('total', len(devices)),
+                device_limit=device_limit,
+            )
+
+    except Exception as e:
+        logger.error(f'Error fetching devices for user {user_id}: {e}')
+        return UserDevicesResponse()
+
+
+@router.delete('/{user_id}/devices/{hwid}', response_model=DeleteDeviceResponse)
+async def delete_user_device(
+    user_id: int,
+    hwid: str,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Delete a single device for user."""
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail='User not found')
+
+    if not user.remnawave_uuid:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='User has no panel account')
+
+    try:
+        from app.services.remnawave_service import RemnaWaveService
+
+        service = RemnaWaveService()
+        async with service.get_api_client() as api:
+            success = await api.remove_device(user.remnawave_uuid, hwid)
+
+        if success:
+            logger.info(f'Admin {admin.id} deleted device {hwid} for user {user_id}')
+            return DeleteDeviceResponse(success=True, message='Device deleted', deleted_hwid=hwid)
+        return DeleteDeviceResponse(success=False, message='Failed to delete device')
+
+    except Exception as e:
+        logger.error(f'Error deleting device {hwid} for user {user_id}: {e}')
+        return DeleteDeviceResponse(success=False, message=str(e))
+
+
+@router.delete('/{user_id}/devices', response_model=ResetDevicesResponse)
+async def reset_user_devices(
+    user_id: int,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Reset all devices for user."""
+    user = await get_user_by_id(db, user_id)
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail='User not found')
+
+    if not user.remnawave_uuid:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='User has no panel account')
+
+    try:
+        from app.services.remnawave_service import RemnaWaveService
+
+        service = RemnaWaveService()
+        async with service.get_api_client() as api:
+            devices_info = await api.get_user_devices(user.remnawave_uuid)
+            devices = devices_info.get('devices', [])
+            total = len(devices)
+
+            if total == 0:
+                return ResetDevicesResponse(success=True, message='No devices to reset', deleted_count=0)
+
+            deleted = 0
+            for d in devices:
+                device_hwid = d.get('hwid') or d.get('deviceId') or d.get('id')
+                if device_hwid:
+                    try:
+                        await api.remove_device(user.remnawave_uuid, device_hwid)
+                        deleted += 1
+                    except Exception:
+                        pass
+
+        logger.info(f'Admin {admin.id} reset devices for user {user_id}: {deleted}/{total}')
+        return ResetDevicesResponse(success=True, message=f'Deleted {deleted}/{total} devices', deleted_count=deleted)
+
+    except Exception as e:
+        logger.error(f'Error resetting devices for user {user_id}: {e}')
+        return ResetDevicesResponse(success=False, message=str(e))
+
+
 # === Delete User ===


@@ -1590,11 +2107,27 @@ async def get_user_sync_status(
        from app.services.remnawave_service import RemnaWaveService

        service = RemnaWaveService()
-        if service.is_configured and user.telegram_id:
+        if service.is_configured:
            async with service.get_api_client() as api:
-                panel_users = await api.get_user_by_telegram_id(user.telegram_id)
-                if panel_users:
-                    panel_user = panel_users[0]
+                panel_user = None
+
+                # Try by UUID first (works for all users including OAuth)
+                if user.remnawave_uuid:
+                    panel_user = await api.get_user_by_uuid(user.remnawave_uuid)
+
+                # Fallback: search by telegram_id
+                if not panel_user and user.telegram_id:
+                    panel_users = await api.get_user_by_telegram_id(user.telegram_id)
+                    if panel_users:
+                        panel_user = panel_users[0]
+
+                # Fallback: search by email (OAuth users)
+                if not panel_user and user.email:
+                    panel_users_by_email = await api.get_user_by_email(user.email)
+                    if panel_users_by_email:
+                        panel_user = panel_users_by_email[0]
+
+                if panel_user:
                    panel_found = True
                    panel_status = panel_user.status.value if panel_user.status else None
                    panel_expire_at = panel_user.expire_at
@@ -1720,27 +2253,30 @@ async def sync_user_from_panel(
        errors = []
        panel_info = None

-        # Email-only users cannot be synced from panel by telegram_id
-        if not user.telegram_id:
-            return SyncFromPanelResponse(
-                success=False,
-                message='Cannot sync email-only user',
-                errors=["Email-only users don't have telegram_id for panel lookup"],
-            )
-
        async with service.get_api_client() as api:
-            # Find user in panel
-            panel_users = await api.get_user_by_telegram_id(user.telegram_id)
+            # Find user in panel: UUID → telegram_id → email
+            panel_user = None

-            if not panel_users:
+            if user.remnawave_uuid:
+                panel_user = await api.get_user_by_uuid(user.remnawave_uuid)
+
+            if not panel_user and user.telegram_id:
+                panel_users = await api.get_user_by_telegram_id(user.telegram_id)
+                if panel_users:
+                    panel_user = panel_users[0]
+
+            if not panel_user and user.email:
+                panel_users_by_email = await api.get_user_by_email(user.email)
+                if panel_users_by_email:
+                    panel_user = panel_users_by_email[0]
+
+            if not panel_user:
                return SyncFromPanelResponse(
                    success=False,
                    message='User not found in panel',
-                    errors=['No user with this telegram_id found in Remnawave panel'],
+                    errors=['No user found in Remnawave panel by UUID, telegram_id, or email'],
                )

-            panel_user = panel_users[0]
-
            # Build panel info
            active_squads = []
            if hasattr(panel_user, 'active_internal_squads') and panel_user.active_internal_squads:
@@ -1949,19 +2485,31 @@ async def sync_user_to_panel(
            full_name=user.full_name,
            username=user.username,
            telegram_id=user.telegram_id,
+            email=user.email,
+            user_id=user.id,
        )

        description = settings.format_remnawave_user_description(
            full_name=user.full_name,
            username=user.username,
            telegram_id=user.telegram_id,
+            email=user.email,
+            user_id=user.id,
        )

        hwid_limit = resolve_hwid_device_limit_for_payload(sub)
        traffic_limit_bytes = sub.traffic_limit_gb * (1024**3) if sub.traffic_limit_gb > 0 else 0

        async with service.get_api_client() as api:
-            # Try to find existing user in panel
+            # Validate existing UUID
+            if panel_uuid:
+                existing_user = await api.get_user_by_uuid(panel_uuid)
+                if not existing_user:
+                    logger.warning(f'User {user.id} has stale remnawave_uuid {panel_uuid}, clearing')
+                    panel_uuid = None
+                    user.remnawave_uuid = None
+
+            # Fallback: search by telegram_id
            if not panel_uuid and user.telegram_id:
                existing_users = await api.get_user_by_telegram_id(user.telegram_id)
                if existing_users:
@@ -1969,6 +2517,14 @@ async def sync_user_to_panel(
                    user.remnawave_uuid = panel_uuid
                    changes['remnawave_uuid_discovered'] = panel_uuid

+            # Fallback: search by email (OAuth users)
+            if not panel_uuid and user.email:
+                existing_users = await api.get_user_by_email(user.email)
+                if existing_users:
+                    panel_uuid = existing_users[0].uuid
+                    user.remnawave_uuid = panel_uuid
+                    changes['remnawave_uuid_discovered'] = panel_uuid
+
            if panel_uuid:
                # Update existing user
                update_kwargs = {'uuid': panel_uuid}
@@ -2014,6 +2570,7 @@ async def sync_user_to_panel(
                    'traffic_limit_bytes': traffic_limit_bytes,
                    'traffic_limit_strategy': TrafficLimitStrategy.MONTH,
                    'telegram_id': user.telegram_id,
+                    'email': user.email,
                    'description': description,
                    'active_internal_squads': sub.connected_squads or [],
                }
@@ -22,6 +22,7 @@ from app.database.crud.user import (
    verify_and_apply_email_change,
 )
 from app.database.models import CabinetRefreshToken, User
+from app.services.disposable_email_service import disposable_email_service
 from app.services.referral_service import process_referral_registration
 from app.utils.timezone import panel_datetime_to_naive_utc

@@ -385,6 +386,13 @@ async def register_email(
    Requires valid JWT token from Telegram authentication.
    Sends verification email to the provided address.
    """
+    # Check for disposable email
+    if disposable_email_service.is_disposable(request.email):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Disposable email addresses are not allowed',
+        )
+
    # Check if email already exists
    existing_user = await db.execute(select(User).where(User.email == request.email))
    if existing_user.scalar_one_or_none():
@@ -478,6 +486,13 @@ async def register_email_standalone(
            )
        logger.info(f'Test email registration: {request.email}')

+    # Check for disposable email
+    if disposable_email_service.is_disposable(request.email):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Disposable email addresses are not allowed',
+        )
+
    # Проверить что email не занят
    existing = await db.execute(select(User).where(User.email == request.email))
    if existing.scalar_one_or_none():
@@ -971,6 +986,13 @@ async def request_email_change(
            detail='New email is the same as current email',
        )

+    # Check for disposable email
+    if disposable_email_service.is_disposable(request.new_email):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Disposable email addresses are not allowed',
+        )
+
    # Check if new email is already taken
    if await is_email_taken(db, request.new_email, exclude_user_id=user.id):
        raise HTTPException(
@@ -23,7 +23,6 @@ from app.services.payment_verification_service import (
    method_display_name,
    run_manual_check,
 )
-from app.services.yookassa_service import YooKassaService

 from ..dependencies import get_cabinet_db, get_current_cabinet_user
 from ..schemas.balance import (
@@ -341,13 +340,11 @@ async def create_topup(

    try:
        if request.payment_method == 'yookassa':
-            yookassa_service = YooKassaService()
+            payment_service = PaymentService()
            yookassa_metadata = {
-                'user_id': str(user.id),
                'user_telegram_id': str(user.telegram_id) if user.telegram_id else '',
                'user_username': user.username or '',
-                'amount_kopeks': str(request.amount_kopeks),
-                'type': 'balance_topup',
+                'purpose': 'balance_topup',
                'source': 'cabinet',
            }

@@ -358,25 +355,25 @@ async def create_topup(
                request.amount_kopeks, telegram_user_id=user.telegram_id
            )
            if option == 'sbp':
-                # Create SBP payment with QR code
-                result = await yookassa_service.create_sbp_payment(
-                    amount=amount_rubles,
-                    currency='RUB',
+                result = await payment_service.create_yookassa_sbp_payment(
+                    db=db,
+                    user_id=user.id,
+                    amount_kopeks=request.amount_kopeks,
                    description=description,
                    metadata=yookassa_metadata,
                )
            else:
-                # Default: card payment
-                result = await yookassa_service.create_payment(
-                    amount=amount_rubles,
-                    currency='RUB',
+                result = await payment_service.create_yookassa_payment(
+                    db=db,
+                    user_id=user.id,
+                    amount_kopeks=request.amount_kopeks,
                    description=description,
                    metadata=yookassa_metadata,
                )

-            if result and not result.get('error'):
+            if result:
                payment_url = result.get('confirmation_url')
-                payment_id = result.get('id')
+                payment_id = result.get('yookassa_payment_id')
            else:
                raise HTTPException(
                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -36,6 +36,7 @@ EMAIL_AUTH_ENABLED_KEY = 'CABINET_EMAIL_AUTH_ENABLED'  # Stores "true" or "false
 YANDEX_METRIKA_ID_KEY = 'CABINET_YANDEX_METRIKA_ID'  # Stores counter ID (numeric string)
 GOOGLE_ADS_ID_KEY = 'CABINET_GOOGLE_ADS_ID'  # Stores conversion ID (e.g. "AW-123456789")
 GOOGLE_ADS_LABEL_KEY = 'CABINET_GOOGLE_ADS_LABEL'  # Stores conversion label (alphanumeric)
+LITE_MODE_ENABLED_KEY = 'CABINET_LITE_MODE_ENABLED'  # Stores "true" or "false"

 # Allowed image types
 ALLOWED_CONTENT_TYPES = {'image/png', 'image/jpeg', 'image/jpg', 'image/webp', 'image/svg+xml'}
@@ -144,6 +145,18 @@ class EmailAuthEnabledUpdate(BaseModel):
    enabled: bool


+class LiteModeEnabledResponse(BaseModel):
+    """Lite mode enabled setting."""
+
+    enabled: bool = False
+
+
+class LiteModeEnabledUpdate(BaseModel):
+    """Request to update lite mode setting."""
+
+    enabled: bool
+
+
 class AnalyticsCountersResponse(BaseModel):
    """Analytics counter settings."""

@@ -718,3 +731,39 @@ async def update_analytics_counters(
        google_ads_id=google_id,
        google_ads_label=google_label,
    )
+
+
+# ============ Lite Mode Routes ============
+
+
+@router.get('/lite-mode', response_model=LiteModeEnabledResponse)
+async def get_lite_mode_enabled(
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """
+    Get lite mode enabled setting.
+    This is a public endpoint - no authentication required.
+    When enabled, shows simplified dashboard with minimal features.
+    """
+    lite_mode_value = await get_setting_value(db, LITE_MODE_ENABLED_KEY)
+
+    if lite_mode_value is not None:
+        enabled = lite_mode_value.lower() == 'true'
+        return LiteModeEnabledResponse(enabled=enabled)
+
+    # Default: disabled
+    return LiteModeEnabledResponse(enabled=False)
+
+
+@router.patch('/lite-mode', response_model=LiteModeEnabledResponse)
+async def update_lite_mode_enabled(
+    payload: LiteModeEnabledUpdate,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Update lite mode enabled setting. Admin only."""
+    await set_setting_value(db, LITE_MODE_ENABLED_KEY, str(payload.enabled).lower())
+
+    logger.info(f'Admin {admin.telegram_id} set lite mode enabled: {payload.enabled}')
+
+    return LiteModeEnabledResponse(enabled=payload.enabled)
@@ -20,6 +20,30 @@ logger = logging.getLogger(__name__)

 router = APIRouter(prefix='/info', tags=['Cabinet Info'])

+_LANGUAGE_META: dict[str, tuple[str, str]] = {
+    'ru': ('Русский', '🇷🇺'),
+    'en': ('English', '🇬🇧'),
+    'ua': ('Українська', '🇺🇦'),
+    'zh': ('中文', '🇨🇳'),
+    'fa': ('فارسی', '🇮🇷'),
+}
+
+
+def _normalize_language_code(value: str | None) -> str:
+    return (value or '').strip().lower().split('-', 1)[0]
+
+
+def _get_available_language_codes() -> list[str]:
+    codes: list[str] = []
+    seen: set[str] = set()
+    for code in settings.get_available_languages():
+        normalized = _normalize_language_code(code)
+        if not normalized or normalized in seen:
+            continue
+        seen.add(normalized)
+        codes.append(normalized)
+    return codes
+

 # ============ Schemas ============

@@ -212,12 +236,19 @@ async def get_service_info():
@router.get('/languages')
 async def get_available_languages():
    """Get list of available languages."""
+    codes = _get_available_language_codes()
+    default_language = _normalize_language_code(getattr(settings, 'DEFAULT_LANGUAGE', 'ru') or 'ru')
+
    return {
        'languages': [
-            {'code': 'ru', 'name': 'Русский', 'flag': '🇷🇺'},
-            {'code': 'en', 'name': 'English', 'flag': '🇬🇧'},
+            {
+                'code': code,
+                'name': _LANGUAGE_META.get(code, (code.upper(), '🌐'))[0],
+                'flag': _LANGUAGE_META.get(code, (code.upper(), '🌐'))[1],
+            }
+            for code in codes
        ],
-        'default': getattr(settings, 'DEFAULT_LANGUAGE', 'ru') or 'ru',
+        'default': default_language,
    }


@@ -236,16 +267,15 @@ async def update_user_language(
    db: AsyncSession = Depends(get_cabinet_db),
 ):
    """Update user's language preference."""
-    language = request.get('language', 'ru')
-
-    valid_languages = ['ru', 'en']
-    if language not in valid_languages:
+    requested_language = _normalize_language_code(request.get('language', 'ru'))
+    available_languages = _get_available_language_codes()
+    if requested_language not in available_languages:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f'Invalid language. Supported: {", ".join(valid_languages)}',
+            detail=f'Invalid language. Supported: {", ".join(available_languages)}',
        )

-    user.language = language
+    user.language = requested_language
    await db.commit()
    await db.refresh(user)

@@ -0,0 +1,165 @@
+"""OAuth 2.0 authentication routes for cabinet."""
+
+import logging
+from datetime import UTC, datetime
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database.crud.user import (
+    create_user_by_oauth,
+    get_user_by_email,
+    get_user_by_oauth_provider,
+    set_user_oauth_provider_id,
+)
+from app.database.models import User
+
+from ..auth.oauth_providers import (
+    OAuthUserInfo,
+    generate_oauth_state,
+    get_provider,
+    validate_oauth_state,
+)
+from ..dependencies import get_cabinet_db
+from ..schemas.auth import AuthResponse
+from .auth import _create_auth_response, _store_refresh_token
+
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix='/auth/oauth', tags=['Cabinet OAuth'])
+
+
+async def _finalize_oauth_login(db: AsyncSession, user: User, provider: str) -> AuthResponse:
+    """Update last login, create tokens, store refresh token."""
+    user.cabinet_last_login = datetime.now(UTC).replace(tzinfo=None)
+    await db.commit()
+    auth_response = _create_auth_response(user)
+    await _store_refresh_token(db, user.id, auth_response.refresh_token, device_info=f'oauth:{provider}')
+    return auth_response
+
+
+# --- Schemas ---
+
+
+class OAuthProviderInfo(BaseModel):
+    name: str
+    display_name: str
+
+
+class OAuthProvidersResponse(BaseModel):
+    providers: list[OAuthProviderInfo]
+
+
+class OAuthAuthorizeResponse(BaseModel):
+    authorize_url: str
+    state: str
+
+
+class OAuthCallbackRequest(BaseModel):
+    code: str = Field(..., description='Authorization code from provider')
+    state: str = Field(..., description='CSRF state token')
+
+
+# --- Endpoints ---
+
+
+@router.get('/providers', response_model=OAuthProvidersResponse)
+async def get_oauth_providers():
+    """Get list of enabled OAuth providers."""
+    providers_config = settings.get_oauth_providers_config()
+    providers = [
+        OAuthProviderInfo(name=name, display_name=cfg['display_name'])
+        for name, cfg in providers_config.items()
+        if cfg['enabled']
+    ]
+    return OAuthProvidersResponse(providers=providers)
+
+
+@router.get('/{provider}/authorize', response_model=OAuthAuthorizeResponse)
+async def get_oauth_authorize_url(provider: str):
+    """Get authorization URL for an OAuth provider."""
+    oauth_provider = get_provider(provider)
+    if not oauth_provider:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'OAuth provider "{provider}" is not enabled',
+        )
+
+    state = await generate_oauth_state(provider)
+    authorize_url = oauth_provider.get_authorization_url(state)
+
+    return OAuthAuthorizeResponse(authorize_url=authorize_url, state=state)
+
+
+@router.post('/{provider}/callback', response_model=AuthResponse)
+async def oauth_callback(
+    provider: str,
+    request: OAuthCallbackRequest,
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Handle OAuth callback: exchange code, find/create user, return JWT."""
+    # 1. Validate CSRF state
+    if not await validate_oauth_state(request.state, provider):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Invalid or expired OAuth state',
+        )
+
+    # 2. Get provider instance
+    oauth_provider = get_provider(provider)
+    if not oauth_provider:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'OAuth provider "{provider}" is not enabled',
+        )
+
+    # 3. Exchange code for tokens
+    try:
+        token_data = await oauth_provider.exchange_code(request.code)
+    except Exception as exc:
+        logger.error('OAuth code exchange failed for %s: %s', provider, exc)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Failed to exchange authorization code',
+        ) from exc
+
+    # 4. Fetch user info from provider
+    try:
+        user_info: OAuthUserInfo = await oauth_provider.get_user_info(token_data)
+    except Exception as exc:
+        logger.error('OAuth user info fetch failed for %s: %s', provider, exc)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Failed to fetch user information from provider',
+        ) from exc
+
+    # 5. Find user by provider ID
+    user = await get_user_by_oauth_provider(db, provider, user_info.provider_id)
+    if user:
+        logger.info('OAuth login via %s for existing user %s', provider, user.id)
+        return await _finalize_oauth_login(db, user, provider)
+
+    # 6. Find user by email (if verified) and link provider
+    if user_info.email and user_info.email_verified:
+        user = await get_user_by_email(db, user_info.email)
+        if user:
+            await set_user_oauth_provider_id(db, user, provider, user_info.provider_id)
+            logger.info('OAuth login via %s linked to existing email user %s', provider, user.id)
+            return await _finalize_oauth_login(db, user, provider)
+
+    # 7. Create new user
+    user = await create_user_by_oauth(
+        db=db,
+        provider=provider,
+        provider_id=user_info.provider_id,
+        email=user_info.email if user_info.email_verified else None,
+        email_verified=user_info.email_verified,
+        first_name=user_info.first_name,
+        last_name=user_info.last_name,
+        username=user_info.username,
+    )
+    logger.info('OAuth new user created via %s with id=%s', provider, user.id)
+    return await _finalize_oauth_login(db, user, provider)
@@ -1070,6 +1070,19 @@ async def get_trial_info(
    """Get trial subscription info and availability."""
    await db.refresh(user, ['subscription'])

+    # Проверяем, отключён ли триал для этого типа пользователя
+    if settings.is_trial_disabled_for_user(getattr(user, 'auth_type', 'telegram')):
+        return TrialInfoResponse(
+            is_available=False,
+            duration_days=settings.TRIAL_DURATION_DAYS,
+            traffic_limit_gb=settings.TRIAL_TRAFFIC_LIMIT_GB,
+            device_limit=settings.TRIAL_DEVICE_LIMIT,
+            requires_payment=bool(settings.TRIAL_PAYMENT_ENABLED),
+            price_kopeks=0,
+            price_rubles=0,
+            reason_unavailable='Trial is not available for your account type',
+        )
+
    duration_days = settings.TRIAL_DURATION_DAYS
    traffic_limit_gb = settings.TRIAL_TRAFFIC_LIMIT_GB
    device_limit = settings.TRIAL_DEVICE_LIMIT
@@ -1148,6 +1161,13 @@ async def activate_trial(
    """Activate trial subscription."""
    await db.refresh(user, ['subscription'])

+    # Проверяем, отключён ли триал для этого типа пользователя
+    if settings.is_trial_disabled_for_user(getattr(user, 'auth_type', 'telegram')):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Trial is not available for your account type',
+        )
+
    # Check if user already has an active subscription
    if user.subscription:
        now = datetime.utcnow()
@@ -1642,7 +1662,7 @@ async def submit_purchase(
                        user=user,
                        subscription=subscription,
                        transaction=None,
-                        period_days=selection.period_days,
+                        period_days=selection.period.days,
                        was_trial_conversion=result.get('was_trial_conversion', False),
                        amount_kopeks=pricing.final_total,
                        purchase_type='renewal' if not is_new_subscription else None,
@@ -2917,7 +2937,12 @@ def _convert_remnawave_config_to_cabinet(config: dict[str, Any]) -> dict[str, An


 async def _load_app_config_async() -> dict[str, Any]:
-    """Load app config from RemnaWave (if configured) or local file."""
+    """Load app config from RemnaWave (if configured) or local file.
+
+    When config comes from RemnaWave, returns the original format with
+    ``_isRemnawave`` flag so the caller can serve it as-is (enriched with
+    deep links) instead of converting to the legacy step-based format.
+    """
    remnawave_uuid = _get_remnawave_config_uuid()

    if remnawave_uuid:
@@ -2927,22 +2952,9 @@ async def _load_app_config_async() -> dict[str, Any]:
                config = await api.get_subscription_page_config(remnawave_uuid)
                if config and config.config:
                    logger.debug(f'Loaded app config from RemnaWave: {remnawave_uuid}')
-                    # Debug: log raw RemnaWave config structure
-                    import json
-
-                    logger.debug(
-                        f'RemnaWave raw config: {json.dumps(config.config, ensure_ascii=False, indent=2)[:2000]}'
-                    )
-                    converted = _convert_remnawave_config_to_cabinet(config.config)
-                    logger.debug(f'Converted config platforms: {list(converted.get("platforms", {}).keys())}')
-                    # Log first app from each platform
-                    for platform, apps in converted.get('platforms', {}).items():
-                        if apps:
-                            first_app = apps[0]
-                            logger.debug(
-                                f'Platform {platform} first app: name={first_app.get("name")}, urlScheme={first_app.get("urlScheme")}'
-                            )
-                    return converted
+                    raw = dict(config.config)
+                    raw['_isRemnawave'] = True
+                    return raw
        except Exception as e:
            logger.warning(f'Failed to load RemnaWave config, falling back to file: {e}')

@@ -3329,6 +3341,29 @@ async def get_happ_downloads(
    }


+def _resolve_button_url(
+    url: str,
+    subscription_url: str | None,
+    subscription_crypto_link: str | None,
+) -> str:
+    """Resolve template variables in button URLs.
+
+    Matches remnawave/subscription-page frontend TemplateEngine:
+    - {{SUBSCRIPTION_LINK}} -> plain subscription URL
+    - {{HAPP_CRYPT3_LINK}} -> crypto link
+    - {{HAPP_CRYPT4_LINK}} -> crypto link
+    """
+    if not url:
+        return url
+    result = url
+    if subscription_url:
+        result = result.replace('{{SUBSCRIPTION_LINK}}', subscription_url)
+    if subscription_crypto_link:
+        result = result.replace('{{HAPP_CRYPT3_LINK}}', subscription_crypto_link)
+        result = result.replace('{{HAPP_CRYPT4_LINK}}', subscription_crypto_link)
+    return result
+
+
@router.get('/app-config')
 async def get_app_config(
    user: User = Depends(get_current_cabinet_user),
@@ -3345,13 +3380,97 @@ async def get_app_config(

    # Load config from RemnaWave (if configured) or local file
    config = await _load_app_config_async()
-    platforms_raw = config.get('platforms', {})

+    is_remnawave = config.pop('_isRemnawave', False)
+    hide_link = settings.should_hide_subscription_link()
+
+    # Строим platformNames из displayName каждой платформы RemnaWave
+    platform_names: dict[str, Any] = {}
+    for pk, pd in config.get('platforms', {}).items():
+        if isinstance(pd, dict) and 'displayName' in pd:
+            platform_names[pk] = pd['displayName']
+    # Фоллбэк для платформ без displayName (en достаточно)
+    fallback_names = {
+        'ios': {'en': 'iPhone/iPad'},
+        'android': {'en': 'Android'},
+        'macos': {'en': 'macOS'},
+        'windows': {'en': 'Windows'},
+        'linux': {'en': 'Linux'},
+        'androidTV': {'en': 'Android TV'},
+        'appleTV': {'en': 'Apple TV'},
+    }
+    for k, v in fallback_names.items():
+        if k not in platform_names:
+            platform_names[k] = v
+
+    if is_remnawave:
+        # ── RemnaWave original format ──
+        # Serve original blocks/svgLibrary enriched with deep links and resolved URLs.
+        platforms: dict[str, Any] = {}
+        for platform_key, platform_data in config.get('platforms', {}).items():
+            if not isinstance(platform_data, dict):
+                continue
+            apps = platform_data.get('apps', [])
+            if not isinstance(apps, list):
+                continue
+
+            enriched_apps = []
+            for app in apps:
+                if not isinstance(app, dict):
+                    continue
+
+                # Generate deep link
+                deep_link = None
+                if subscription_url or subscription_crypto_link:
+                    deep_link = _create_deep_link(app, subscription_url, subscription_crypto_link)
+                app['deepLink'] = deep_link
+
+                # Resolve templates only for subscriptionLink and copyButton (not external)
+                for block in app.get('blocks', []):
+                    if not isinstance(block, dict):
+                        continue
+                    for btn in block.get('buttons', []):
+                        if not isinstance(btn, dict):
+                            continue
+                        btn_type = btn.get('type', '')
+                        if btn_type in ('subscriptionLink', 'copyButton'):
+                            url = btn.get('url', '') or btn.get('link', '')
+                            if url and '{{' in url:
+                                btn['resolvedUrl'] = _resolve_button_url(
+                                    url,
+                                    subscription_url,
+                                    subscription_crypto_link,
+                                )
+
+                enriched_apps.append(app)
+
+            if enriched_apps:
+                # Сохраняем platform-level поля (svgIconKey, displayName и т.д.)
+                platform_output = {k: v for k, v in platform_data.items() if k != 'apps'}
+                platform_output['apps'] = enriched_apps
+                platforms[platform_key] = platform_output
+
+        return {
+            'isRemnawave': True,
+            'platforms': platforms,
+            'svgLibrary': config.get('svgLibrary', {}),
+            'baseTranslations': config.get('baseTranslations'),
+            'baseSettings': config.get('baseSettings'),
+            'uiConfig': config.get('uiConfig', {}),
+            'platformNames': platform_names,
+            'hasSubscription': bool(subscription_url or subscription_crypto_link),
+            'subscriptionUrl': subscription_url,
+            'subscriptionCryptoLink': subscription_crypto_link,
+            'hideLink': hide_link,
+            'branding': config.get('brandingSettings', {}),
+        }
+
+    # ── Legacy file-based format ──
+    platforms_raw = config.get('platforms', {})
    if not isinstance(platforms_raw, dict):
        platforms_raw = {}

-    # Build response with deep links
-    platforms = {}
+    platforms_legacy: dict[str, Any] = {}
    for platform_key, apps in platforms_raw.items():
        if not isinstance(apps, list):
            continue
@@ -3379,23 +3498,10 @@ async def get_app_config(
            platform_apps.append(app_data)

        if platform_apps:
-            platforms[platform_key] = platform_apps
-
-    # Platform display names for UI
-    platform_names = {
-        'ios': {'ru': 'iPhone/iPad', 'en': 'iPhone/iPad'},
-        'android': {'ru': 'Android', 'en': 'Android'},
-        'macos': {'ru': 'macOS', 'en': 'macOS'},
-        'windows': {'ru': 'Windows', 'en': 'Windows'},
-        'linux': {'ru': 'Linux', 'en': 'Linux'},
-        'androidTV': {'ru': 'Android TV', 'en': 'Android TV'},
-        'appleTV': {'ru': 'Apple TV', 'en': 'Apple TV'},
-    }
-
-    hide_link = settings.should_hide_subscription_link()
+            platforms_legacy[platform_key] = platform_apps

    return {
-        'platforms': platforms,
+        'platforms': platforms_legacy,
        'platformNames': platform_names,
        'hasSubscription': bool(subscription_url or subscription_crypto_link),
        'subscriptionUrl': subscription_url if not hide_link else None,
@@ -194,6 +194,12 @@ class TariffUpdateRequest(BaseModel):
    traffic_reset_mode: str | None = None  # DAY, WEEK, MONTH, NO_RESET, None = глобальная настройка


+class TariffSortOrderRequest(BaseModel):
+    """Request to reorder tariffs."""
+
+    tariff_ids: list[int] = Field(..., min_length=1, description='Ordered list of tariff IDs')
+
+
 class TariffToggleResponse(BaseModel):
    """Response after toggling tariff."""

@@ -0,0 +1,62 @@
+"""Schemas for admin traffic usage."""
+
+from pydantic import BaseModel, Field
+
+
+class TrafficNodeInfo(BaseModel):
+    node_uuid: str
+    node_name: str
+    country_code: str
+
+
+class UserTrafficItem(BaseModel):
+    user_id: int
+    telegram_id: int | None
+    username: str | None
+    email: str | None
+    full_name: str
+    tariff_name: str | None
+    subscription_status: str | None
+    traffic_limit_gb: float
+    device_limit: int
+    node_traffic: dict[str, int]  # {node_uuid: total_bytes}
+    total_bytes: int
+
+
+class TrafficUsageResponse(BaseModel):
+    items: list[UserTrafficItem]
+    nodes: list[TrafficNodeInfo]
+    total: int
+    offset: int
+    limit: int
+    period_days: int
+    available_tariffs: list[str]
+    available_statuses: list[str]
+
+
+class UserTrafficEnrichment(BaseModel):
+    devices_connected: int = 0
+    total_spent_kopeks: int = 0
+    subscription_start_date: str | None = None
+    subscription_end_date: str | None = None
+    last_node_name: str | None = None
+
+
+class TrafficEnrichmentResponse(BaseModel):
+    data: dict[int, UserTrafficEnrichment]
+
+
+class ExportCsvRequest(BaseModel):
+    period: int = Field(30, ge=1, le=30)
+    start_date: str | None = None
+    end_date: str | None = None
+    tariffs: str | None = None
+    statuses: str | None = None
+    nodes: str | None = None
+    total_threshold_gb: float | None = Field(None, ge=0, description='Total GB/day threshold for risk column')
+    node_threshold_gb: float | None = Field(None, ge=0, description='Per-node GB/day threshold for risk column')
+
+
+class ExportCsvResponse(BaseModel):
+    success: bool
+    message: str
@@ -39,6 +39,17 @@ class SortByEnum(str, Enum):
 # === User Subscription Info ===


+class TrafficPurchaseItem(BaseModel):
+    """Individual traffic purchase record."""
+
+    id: int
+    traffic_gb: int
+    expires_at: datetime
+    created_at: datetime
+    days_remaining: int
+    is_expired: bool
+
+
 class UserSubscriptionInfo(BaseModel):
    """User subscription information."""

@@ -55,6 +66,8 @@ class UserSubscriptionInfo(BaseModel):
    autopay_enabled: bool = False
    is_active: bool = False
    days_remaining: int = 0
+    purchased_traffic_gb: int = 0
+    traffic_purchases: list[TrafficPurchaseItem] = []


 class UserPromoGroupInfo(BaseModel):
@@ -189,9 +202,58 @@ class UserDetailResponse(BaseModel):
    promo_offer_discount_source: str | None = None
    promo_offer_discount_expires_at: datetime | None = None

+    # Campaign
+    campaign_name: str | None = None
+    campaign_id: int | None = None
+
    # Recent transactions
    recent_transactions: list[UserTransactionItem] = []

+    # Remnawave UUID
+    remnawave_uuid: str | None = None
+
+
+# === Panel Info ===
+
+
+class UserPanelInfoResponse(BaseModel):
+    """Panel info for user from Remnawave."""
+
+    found: bool = False
+    trojan_password: str | None = None
+    vless_uuid: str | None = None
+    ss_password: str | None = None
+    subscription_url: str | None = None
+    happ_link: str | None = None
+    used_traffic_bytes: int = 0
+    lifetime_used_traffic_bytes: int = 0
+    traffic_limit_bytes: int = 0
+    first_connected_at: datetime | None = None
+    online_at: datetime | None = None
+    last_connected_node_uuid: str | None = None
+    last_connected_node_name: str | None = None
+
+
+# === Node Usage ===
+
+
+class UserNodeUsageItem(BaseModel):
+    """Per-node traffic usage item."""
+
+    node_uuid: str
+    node_name: str
+    country_code: str = ''
+    total_bytes: int
+    daily_bytes: list[int] = []
+
+
+class UserNodeUsageResponse(BaseModel):
+    """Node usage response with 30-day daily breakdown."""
+
+    items: list[UserNodeUsageItem]
+    categories: list[str] = []
+    period_days: int = 30
+

 # === User Actions ===

@@ -236,6 +298,12 @@ class UpdateSubscriptionRequest(BaseModel):
    # For toggle_autopay
    autopay_enabled: bool | None = Field(None, description='Enable/disable autopay')

+    # For add_traffic action
+    traffic_gb: int | None = Field(None, ge=1, description='Traffic GB to add')
+
+    # For remove_traffic action
+    traffic_purchase_id: int | None = Field(None, description='Traffic purchase ID to remove')
+
    # For create new subscription
    is_trial: bool | None = Field(None, description='Is trial subscription')
    device_limit: int | None = Field(None, ge=1, description='Device limit')
@@ -299,6 +367,56 @@ class UpdatePromoGroupResponse(BaseModel):
    message: str


+class UpdateReferralCommissionRequest(BaseModel):
+    """Request to update user referral commission percent."""
+
+    commission_percent: int | None = Field(
+        None, ge=0, le=100, description='Referral commission percent (null for default)'
+    )
+
+
+class UpdateReferralCommissionResponse(BaseModel):
+    """Response after referral commission update."""
+
+    success: bool
+    old_commission_percent: int | None = None
+    new_commission_percent: int | None = None
+    message: str
+
+
+class DeviceInfo(BaseModel):
+    """Individual device info."""
+
+    hwid: str
+    platform: str = ''
+    device_model: str = ''
+    created_at: str | None = None
+
+
+class UserDevicesResponse(BaseModel):
+    """User devices from panel."""
+
+    devices: list[DeviceInfo] = []
+    total: int = 0
+    device_limit: int = 0
+
+
+class DeleteDeviceResponse(BaseModel):
+    """Response after device deletion."""
+
+    success: bool
+    message: str
+    deleted_hwid: str | None = None
+
+
+class ResetDevicesResponse(BaseModel):
+    """Response after resetting all devices."""
+
+    success: bool
+    message: str
+    deleted_count: int = 0
+
+
 class DeleteUserRequest(BaseModel):
    """Request to delete user."""

@@ -392,6 +510,15 @@ class UserAvailableTariffItem(BaseModel):
    min_days: int = 1
    max_days: int = 365

+    # Device limits
+    device_price_kopeks: int | None = None
+    max_device_limit: int | None = None
+
+    # Traffic topup
+    traffic_topup_enabled: bool = False
+    traffic_topup_packages: dict[str, int] = {}
+    max_topup_traffic_gb: int = 0
+
    # Access info
    is_available: bool = True  # Available for this user's promo group
    requires_promo_group: bool = False  # Requires specific promo group
@@ -119,7 +119,7 @@ class EmailService:
            verification_token: Verification token
            verification_url: Base URL for verification (token will be appended)
            username: User's name for personalization
-            language: Language code (ru, en, zh, ua)
+            language: Language code (ru, en, zh, ua, fa)
            custom_subject: Override subject from admin template
            custom_body_html: Override body HTML from admin template (already wrapped in base template)

@@ -174,6 +174,16 @@ class EmailService:
                'ignore': 'Якщо ви не створювали акаунт, просто проігноруйте цей лист.',
                'regards': 'З повагою,',
            },
+            'fa': {
+                'greeting': f'سلام{", " + username if username else ""}!',
+                'subject': 'تایید آدرس ایمیل',
+                'intro': 'از ثبت‌نام شما سپاسگزاریم! لطفاً با کلیک روی دکمه زیر ایمیل خود را تایید کنید:',
+                'button': 'تایید ایمیل',
+                'or_copy': 'یا این لینک را در مرورگر خود کپی و باز کنید:',
+                'expires': f'این لینک تا {expire_hours} ساعت معتبر است.',
+                'ignore': 'اگر شما این حساب را ایجاد نکرده‌اید، این ایمیل را نادیده بگیرید.',
+                'regards': 'با احترام،',
+            },
        }

        t = texts.get(language, texts['ru'])
@@ -236,7 +246,7 @@ class EmailService:
            reset_token: Password reset token
            reset_url: Base URL for password reset (token will be appended)
            username: User's name for personalization
-            language: Language code (ru, en, zh, ua)
+            language: Language code (ru, en, zh, ua, fa)
            custom_subject: Override subject from admin template
            custom_body_html: Override body HTML from admin template (already wrapped in base template)

@@ -291,6 +301,16 @@ class EmailService:
                'warning': "Якщо ви не запитували скидання пароля, проігноруйте цей лист або зв'яжіться з підтримкою.",
                'regards': 'З повагою,',
            },
+            'fa': {
+                'greeting': f'سلام{", " + username if username else ""}!',
+                'subject': 'بازنشانی رمز عبور',
+                'intro': 'درخواستی برای بازنشانی رمز عبور شما دریافت شد. برای تعیین رمز جدید روی دکمه زیر بزنید:',
+                'button': 'بازنشانی رمز عبور',
+                'or_copy': 'یا این لینک را در مرورگر خود کپی و باز کنید:',
+                'expires': f'این لینک تا {expire_hours} ساعت معتبر است.',
+                'warning': 'اگر شما درخواست بازنشانی رمز عبور نداده‌اید، این ایمیل را نادیده بگیرید یا با پشتیبانی تماس بگیرید.',
+                'regards': 'با احترام،',
+            },
        }

        t = texts.get(language, texts['ru'])
@@ -352,7 +372,7 @@ class EmailService:
            to_email: New email address
            code: 6-digit verification code
            username: User's name for personalization
-            language: Language code (ru, en, zh, ua)
+            language: Language code (ru, en, zh, ua, fa)
            custom_subject: Override subject from admin template
            custom_body_html: Override body HTML from admin template

@@ -401,6 +421,15 @@ class EmailService:
                'ignore': 'Якщо ви не запитували зміну email, просто проігноруйте цей лист.',
                'regards': 'З повагою,',
            },
+            'fa': {
+                'greeting': f'سلام{", " + username if username else ""}!',
+                'subject': 'کد تایید تغییر ایمیل',
+                'intro': 'شما درخواست تغییر ایمیل داده‌اید. برای تایید از کد زیر استفاده کنید:',
+                'code_label': 'کد تایید شما:',
+                'expires': f'این کد تا {expire_minutes} دقیقه معتبر است.',
+                'ignore': 'اگر شما درخواست تغییر ایمیل نداده‌اید، این ایمیل را نادیده بگیرید.',
+                'regards': 'با احترام،',
+            },
        }

        t = texts.get(language, texts['ru'])
@@ -1,7 +1,7 @@
 """
 Email notification templates for different notification types.

-Supports multiple languages: ru, en, zh, ua
+Supports multiple languages: ru, en, zh, ua, fa
 """

 from typing import Any
@@ -27,7 +27,7 @@ class EmailNotificationTemplates:

        Args:
            notification_type: Type of notification
-            language: Language code (ru, en, zh, ua)
+            language: Language code (ru, en, zh, ua, fa)
            context: Context data for template rendering

        Returns:
@@ -72,6 +72,7 @@ class EmailNotificationTemplates:
            'en': 'This is an automated message. Please do not reply to this email.',
            'zh': '这是一封自动发送的邮件，请勿回复。',
            'ua': 'Це автоматичне повідомлення. Будь ласка, не відповідайте на цей лист.',
+            'fa': 'این یک پیام خودکار است. لطفاً به این ایمیل پاسخ ندهید.',
        }
        footer_text = footer_texts.get(language, footer_texts['ru'])

@@ -182,6 +183,7 @@ class EmailNotificationTemplates:
            'en': 'Open Dashboard',
            'zh': '打开控制面板',
            'ua': 'Відкрити особистий кабінет',
+            'fa': 'باز کردن پنل کاربری',
        }
        text = texts.get(language, texts['en'])

@@ -112,6 +112,7 @@ class Settings(BaseSettings):
    TRIAL_PAYMENT_ENABLED: bool = False
    TRIAL_ACTIVATION_PRICE: int = 0
    TRIAL_USER_TAG: str | None = None
+    TRIAL_DISABLED_FOR: str = 'none'  # none, email, telegram, all
    DEFAULT_TRAFFIC_LIMIT_GB: int = 100
    DEFAULT_DEVICE_LIMIT: int = 1
    DEFAULT_TRAFFIC_RESET_STRATEGY: str = 'MONTH'
@@ -236,6 +237,8 @@ class Settings(BaseSettings):
    BLACKLIST_UPDATE_INTERVAL_HOURS: int = 24
    BLACKLIST_IGNORE_ADMINS: bool = True

+    DISPOSABLE_EMAIL_CHECK_ENABLED: bool = True
+
    # Настройки простой покупки
    SIMPLE_SUBSCRIPTION_ENABLED: bool = False
    SIMPLE_SUBSCRIPTION_PERIOD_DAYS: int = 30
@@ -336,12 +339,6 @@ class Settings(BaseSettings):
    NALOGO_STORAGE_PATH: str = './nalogo_tokens.json'

    AUTO_PURCHASE_AFTER_TOPUP_ENABLED: bool = False
-    AUTO_ACTIVATE_AFTER_TOPUP_ENABLED: bool = False
-
-    # Показывать предупреждение об активации подписки после пополнения баланса
-    # Если True - после пополнения показывает большое сообщение с кнопками:
-    # "Активировать", "Продлить", "Добавить устройства"
-    SHOW_ACTIVATION_PROMPT_AFTER_TOPUP: bool = False

    # Отключение превью ссылок в сообщениях бота
    DISABLE_WEB_PAGE_PREVIEW: bool = False
@@ -406,7 +403,6 @@ class Settings(BaseSettings):
    PAL24_SIGNATURE_TOKEN: str | None = None
    PAL24_BASE_URL: str = 'https://pal24.pro/api/v1/'
    PAL24_WEBHOOK_PATH: str = '/pal24-webhook'
-    PAL24_WEBHOOK_PORT: int = 8084
    PAL24_PAYMENT_DESCRIPTION: str = 'Пополнение баланса'
    PAL24_MIN_AMOUNT_KOPEKS: int = 10000
    PAL24_MAX_AMOUNT_KOPEKS: int = 100000000
@@ -528,7 +524,7 @@ class Settings(BaseSettings):
    SKIP_REFERRAL_CODE: bool = False

    DEFAULT_LANGUAGE: str = 'ru'
-    AVAILABLE_LANGUAGES: str = 'ru,en'
+    AVAILABLE_LANGUAGES: str = 'ru,en,ua,zh,fa'
    LANGUAGE_SELECTION_ENABLED: bool = True

    # Округление цен при отображении (≤50 коп вниз, >50 коп вверх)
@@ -695,6 +691,23 @@ class Settings(BaseSettings):
    CABINET_EMAIL_AUTH_ENABLED: bool = True  # Enable email registration/login in cabinet
    CABINET_URL: str = 'https://example.com/cabinet'  # Base URL for cabinet (used in verification emails)

+    # OAuth 2.0 provider settings for cabinet
+    OAUTH_GOOGLE_CLIENT_ID: str = ''
+    OAUTH_GOOGLE_CLIENT_SECRET: str = ''
+    OAUTH_GOOGLE_ENABLED: bool = False
+
+    OAUTH_YANDEX_CLIENT_ID: str = ''
+    OAUTH_YANDEX_CLIENT_SECRET: str = ''
+    OAUTH_YANDEX_ENABLED: bool = False
+
+    OAUTH_DISCORD_CLIENT_ID: str = ''
+    OAUTH_DISCORD_CLIENT_SECRET: str = ''
+    OAUTH_DISCORD_ENABLED: bool = False
+
+    OAUTH_VK_CLIENT_ID: str = ''
+    OAUTH_VK_CLIENT_SECRET: str = ''
+    OAUTH_VK_ENABLED: bool = False
+
    # SMTP settings for cabinet email
    SMTP_HOST: str | None = None
    SMTP_PORT: int = 587
@@ -1031,8 +1044,9 @@ class Settings(BaseSettings):
        )

        raw_username = template.format_map(values).strip()
-        sanitized_username = re.sub(r'[^0-9A-Za-z._-]+', '_', raw_username)
-        sanitized_username = re.sub(r'_+', '_', sanitized_username).strip('._-')
+        # Remnawave разрешает только буквы, цифры, подчёркивания и дефисы
+        sanitized_username = re.sub(r'[^0-9A-Za-z_-]+', '_', raw_username)
+        sanitized_username = re.sub(r'_+', '_', sanitized_username).strip('_-')

        if not sanitized_username:
            sanitized_username = f'user_{identifier}'
@@ -1162,22 +1176,12 @@ class Settings(BaseSettings):

        return bool(value)

-    def is_auto_activate_after_topup_enabled(self) -> bool:
-        """Умная автоактивация после пополнения баланса (без корзины)."""
-        value = getattr(self, 'AUTO_ACTIVATE_AFTER_TOPUP_ENABLED', False)
-
-        if isinstance(value, str):
-            normalized = value.strip().lower()
-            return normalized in {'1', 'true', 'yes', 'on'}
-
-        return bool(value)
-
    def is_quick_amount_buttons_enabled(self) -> bool:
        """Показывать ли кнопки быстрого выбора суммы пополнения."""
        return self.YOOKASSA_QUICK_AMOUNT_SELECTION_ENABLED and not self.DISABLE_TOPUP_BUTTONS

    def get_available_languages(self) -> list[str]:
-        defaults = ['ru', 'en', 'ua', 'zh']
+        defaults = ['ru', 'en', 'ua', 'zh', 'fa']

        try:
            langs = self.AVAILABLE_LANGUAGES
@@ -1309,6 +1313,17 @@ class Settings(BaseSettings):
    def get_trial_user_tag(self) -> str | None:
        return self._normalize_user_tag(self.TRIAL_USER_TAG, 'TRIAL_USER_TAG')

+    def is_trial_disabled_for_user(self, auth_type: str | None) -> bool:
+        disabled_for = self.TRIAL_DISABLED_FOR
+        if disabled_for == 'all':
+            return True
+        # 'email' means all non-Telegram users (email, google, yandex, discord, vk, etc.)
+        if disabled_for == 'email' and auth_type not in (None, 'telegram'):
+            return True
+        if disabled_for == 'telegram' and (auth_type is None or auth_type == 'telegram'):
+            return True
+        return False
+
    def get_paid_subscription_user_tag(self) -> str | None:
        return self._normalize_user_tag(
            self.PAID_SUBSCRIPTION_USER_TAG,
@@ -2417,7 +2432,7 @@ class Settings(BaseSettings):

    def get_bot_run_mode(self) -> str:
        mode = (self.BOT_RUN_MODE or 'polling').strip().lower()
-        if mode not in {'polling', 'webhook', 'both'}:
+        if mode not in {'polling', 'webhook'}:
            return 'polling'
        return mode

@@ -2515,6 +2530,40 @@ class Settings(BaseSettings):
            return self.SMTP_FROM_EMAIL
        return self.SMTP_USER

+    # OAuth helpers
+    def get_oauth_providers_config(self) -> dict[str, dict[str, str | bool]]:
+        """Return config for all OAuth providers (enabled or not)."""
+        return {
+            'google': {
+                'client_id': self.OAUTH_GOOGLE_CLIENT_ID,
+                'client_secret': self.OAUTH_GOOGLE_CLIENT_SECRET,
+                'enabled': self.OAUTH_GOOGLE_ENABLED,
+                'display_name': 'Google',
+            },
+            'yandex': {
+                'client_id': self.OAUTH_YANDEX_CLIENT_ID,
+                'client_secret': self.OAUTH_YANDEX_CLIENT_SECRET,
+                'enabled': self.OAUTH_YANDEX_ENABLED,
+                'display_name': 'Yandex',
+            },
+            'discord': {
+                'client_id': self.OAUTH_DISCORD_CLIENT_ID,
+                'client_secret': self.OAUTH_DISCORD_CLIENT_SECRET,
+                'enabled': self.OAUTH_DISCORD_ENABLED,
+                'display_name': 'Discord',
+            },
+            'vk': {
+                'client_id': self.OAUTH_VK_CLIENT_ID,
+                'client_secret': self.OAUTH_VK_CLIENT_SECRET,
+                'enabled': self.OAUTH_VK_ENABLED,
+                'display_name': 'VK',
+            },
+        }
+
+    def get_enabled_oauth_provider_names(self) -> list[str]:
+        """Return list of enabled OAuth provider names."""
+        return [name for name, cfg in self.get_oauth_providers_config().items() if cfg['enabled']]
+
    # Ban System helpers
    def is_ban_system_enabled(self) -> bool:
        return bool(self.BAN_SYSTEM_ENABLED)
@@ -95,6 +95,25 @@ async def create_trial_subscription(

    end_date = datetime.utcnow() + timedelta(days=duration_days)

+    # Check for existing PENDING trial subscription (retry after failed payment)
+    existing = await get_subscription_by_user_id(db, user_id)
+    if existing and existing.is_trial and existing.status == SubscriptionStatus.PENDING.value:
+        existing.status = SubscriptionStatus.ACTIVE.value
+        existing.start_date = datetime.utcnow()
+        existing.end_date = end_date
+        existing.traffic_limit_gb = traffic_limit_gb
+        existing.device_limit = device_limit
+        existing.connected_squads = final_squads
+        existing.tariff_id = tariff_id
+        await db.commit()
+        await db.refresh(existing)
+        logger.info(
+            '🎁 Обновлена PENDING триальная подписка %s для пользователя %s',
+            existing.id,
+            user_id,
+        )
+        return existing
+
    subscription = Subscription(
        user_id=user_id,
        status=SubscriptionStatus.ACTIVE.value,
@@ -486,16 +486,14 @@ async def reorder_tariffs(
    for order, tariff_id in enumerate(tariff_order):
        await db.execute(update(Tariff).where(Tariff.id == tariff_id).values(display_order=order))

-    await db.commit()
-
    logger.info('Изменен порядок тарифов: %s', tariff_order)


 async def sync_default_tariff_from_config(db: AsyncSession) -> Tariff | None:
    """
    Синхронизирует дефолтный тариф из конфига (.env) в БД.
-    Создаёт тариф "Стандартный" если в БД нет тарифов.
-    Обновляет цены существующего тарифа если он есть.
+    Создаёт тариф "Стандартный" только если в БД нет тарифов.
+    Существующий тариф НЕ перезаписывается — админ управляет им через кабинет.

    Returns:
        Tariff или None если не требуется синхронизация
@@ -521,13 +519,11 @@ async def sync_default_tariff_from_config(db: AsyncSession) -> Tariff | None:
    existing_tariff = result.scalar_one_or_none()

    if existing_tariff:
-        # Обновляем цены существующего тарифа
-        existing_tariff.period_prices = period_prices
-        existing_tariff.traffic_limit_gb = settings.DEFAULT_TRAFFIC_LIMIT_GB
-        existing_tariff.device_limit = settings.DEFAULT_DEVICE_LIMIT
-        await db.commit()
-        await db.refresh(existing_tariff)
-        logger.info("Обновлён дефолтный тариф 'Стандартный' из конфига")
+        # Тариф уже существует — НЕ перезаписываем настройки из конфига.
+        # Админ управляет тарифом через кабинет, синхронизация не нужна.
+        logger.info(
+            "Дефолтный тариф 'Стандартный' (id=%s) уже существует, пропускаем sync из конфига", existing_tariff.id
+        )
        return existing_tariff

    if tariff_count == 0:
@@ -573,21 +569,26 @@ async def load_period_prices_from_db(db: AsyncSession) -> None:
        )
        tariff = result.scalar_one_or_none()

-        if tariff and tariff.period_prices:
-            # Преобразуем строковые ключи в int
-            period_prices = {int(days): int(price) for days, price in tariff.period_prices.items() if int(price) > 0}
-
-            if period_prices:
-                set_period_prices_from_db(period_prices)
-                logger.info(
-                    "Загружены периоды из тарифа '%s': %s",
-                    tariff.name,
-                    {f'{d}д': f'{p // 100}₽' for d, p in period_prices.items()},
-                )
-            else:
-                logger.warning("Тариф '%s' не имеет активных периодов", tariff.name)
-        else:
+        if not tariff:
            logger.info('Активные тарифы не найдены, используются цены из .env')
+            return
+
+        if not tariff.period_prices:
+            logger.warning("Тариф '%s' (id=%s) найден, но period_prices пуст", tariff.name, tariff.id)
+            return
+
+        # Преобразуем строковые ключи в int
+        period_prices = {int(days): int(price) for days, price in tariff.period_prices.items() if int(price) > 0}
+
+        if period_prices:
+            set_period_prices_from_db(period_prices)
+            logger.info(
+                "Загружены периоды из тарифа '%s': %s",
+                tariff.name,
+                {f'{d}д': f'{p // 100}₽' for d, p in period_prices.items()},
+            )
+        else:
+            logger.warning("Тариф '%s' не имеет активных периодов (все цены = 0)", tariff.name)

    except Exception as e:
        logger.error('Ошибка загрузки периодов из БД: %s', e)
@@ -1,7 +1,7 @@
 import logging
 import secrets
 import string
-from datetime import datetime, timedelta
+from datetime import UTC, datetime, timedelta

 from sqlalchemy import and_, case, func, nullslast, or_, select, text
 from sqlalchemy.exc import IntegrityError
@@ -28,6 +28,13 @@ from app.utils.validators import sanitize_telegram_name
 logger = logging.getLogger(__name__)


+def _normalize_language_code(language: str | None, fallback: str = 'ru') -> str:
+    normalized = (language or '').strip().lower()
+    if '-' in normalized:
+        normalized = normalized.split('-', 1)[0]
+    return normalized or fallback
+
+
 def _build_spending_stats_select():
    """
    Возвращает базовый SELECT для статистики трат пользователей.
@@ -232,6 +239,7 @@ async def create_user_no_commit(

    if not referral_code:
        referral_code = await create_unique_referral_code(db)
+    normalized_language = _normalize_language_code(language)

    default_group = await _get_or_create_default_promo_group(db)
    promo_group_id = default_group.id
@@ -243,7 +251,7 @@ async def create_user_no_commit(
        username=username,
        first_name=safe_first,
        last_name=safe_last,
-        language=language,
+        language=normalized_language,
        referred_by_id=referred_by_id,
        referral_code=referral_code,
        balance_kopeks=0,
@@ -277,6 +285,7 @@ async def create_user(
 ) -> User:
    if not referral_code:
        referral_code = await create_unique_referral_code(db)
+    normalized_language = _normalize_language_code(language)

    attempts = 3

@@ -291,7 +300,7 @@ async def create_user(
            username=username,
            first_name=safe_first,
            last_name=safe_last,
-            language=language,
+            language=normalized_language,
            referred_by_id=referred_by_id,
            referral_code=referral_code,
            balance_kopeks=0,
@@ -360,6 +369,8 @@ async def update_user(db: AsyncSession, user: User, **kwargs) -> User:
    for field, value in kwargs.items():
        if field in ('first_name', 'last_name'):
            value = sanitize_telegram_name(value)
+        if field == 'language':
+            value = _normalize_language_code(value)
        if hasattr(user, field):
            setattr(user, field, value)

@@ -1060,6 +1071,7 @@ async def create_user_by_email(
        Created User object
    """
    referral_code = await create_unique_referral_code(db)
+    normalized_language = _normalize_language_code(language)
    default_group = await _get_or_create_default_promo_group(db)

    user = User(
@@ -1071,7 +1083,7 @@ async def create_user_by_email(
        username=None,
        first_name=sanitize_telegram_name(first_name) if first_name else None,
        last_name=None,
-        language=language,
+        language=normalized_language,
        referred_by_id=referred_by_id,
        referral_code=referral_code,
        balance_kopeks=0,
@@ -1235,3 +1247,101 @@ async def clear_email_change_pending(db: AsyncSession, user: User) -> None:

    await db.commit()
    logger.info(f'Email change cancelled for user {user.id}')
+
+
+# --- OAuth provider functions ---
+
+_OAUTH_PROVIDER_COLUMNS = {
+    'google': 'google_id',
+    'yandex': 'yandex_id',
+    'discord': 'discord_id',
+    'vk': 'vk_id',
+}
+
+
+async def get_user_by_oauth_provider(db: AsyncSession, provider: str, provider_id: str) -> User | None:
+    """Find a user by OAuth provider ID."""
+    column_name = _OAUTH_PROVIDER_COLUMNS.get(provider)
+    if not column_name:
+        return None
+    column = getattr(User, column_name)
+    # VK uses BigInteger, so convert
+    value: str | int = int(provider_id) if provider == 'vk' else provider_id
+    result = await db.execute(select(User).where(column == value))
+    return result.scalar_one_or_none()
+
+
+async def set_user_oauth_provider_id(db: AsyncSession, user: User, provider: str, provider_id: str) -> None:
+    """Link an OAuth provider ID to an existing user."""
+    column_name = _OAUTH_PROVIDER_COLUMNS.get(provider)
+    if not column_name:
+        return
+    value: str | int = int(provider_id) if provider == 'vk' else provider_id
+    setattr(user, column_name, value)
+    user.updated_at = datetime.now(UTC).replace(tzinfo=None)
+    logger.info(f'Linked {provider} (id={provider_id}) to user {user.id}')
+
+
+async def create_user_by_oauth(
+    db: AsyncSession,
+    provider: str,
+    provider_id: str,
+    email: str | None = None,
+    email_verified: bool = False,
+    first_name: str | None = None,
+    last_name: str | None = None,
+    username: str | None = None,
+    language: str = 'ru',
+) -> User:
+    """Create a new user via OAuth provider."""
+    referral_code = await create_unique_referral_code(db)
+    normalized_language = _normalize_language_code(language)
+    default_group = await _get_or_create_default_promo_group(db)
+
+    column_name = _OAUTH_PROVIDER_COLUMNS.get(provider)
+    provider_value: str | int = int(provider_id) if provider == 'vk' else provider_id
+
+    user = User(
+        telegram_id=None,
+        auth_type=provider,
+        email=email,
+        email_verified=email_verified,
+        password_hash=None,
+        username=sanitize_telegram_name(username) if username else None,
+        first_name=sanitize_telegram_name(first_name) if first_name else None,
+        last_name=sanitize_telegram_name(last_name) if last_name else None,
+        language=normalized_language,
+        referral_code=referral_code,
+        balance_kopeks=0,
+        has_had_paid_subscription=False,
+        has_made_first_topup=False,
+        promo_group_id=default_group.id,
+    )
+    if column_name:
+        setattr(user, column_name, provider_value)
+
+    db.add(user)
+    await db.flush()
+    await db.refresh(user)
+
+    user.promo_group = default_group
+    logger.info(f'Created OAuth user via {provider} (provider_id={provider_id}) with id={user.id}')
+
+    try:
+        from app.services.event_emitter import event_emitter
+
+        await event_emitter.emit(
+            'user.created',
+            {
+                'user_id': user.id,
+                'email': user.email,
+                'auth_type': provider,
+                'first_name': user.first_name,
+                'referral_code': user.referral_code,
+            },
+            db=db,
+        )
+    except Exception as error:
+        logger.warning('Failed to emit user.created event: %s', error)
+
+    return user
@@ -2,6 +2,7 @@ import logging
 from datetime import datetime

 from sqlalchemy import and_, select, update
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload

@@ -24,7 +25,7 @@ async def create_yookassa_payment(
    payment_method_type: str | None = None,
    yookassa_created_at: datetime | None = None,
    test_mode: bool = False,
-) -> YooKassaPayment:
+) -> YooKassaPayment | None:
    payment = YooKassaPayment(
        user_id=user_id,
        yookassa_payment_id=yookassa_payment_id,
@@ -40,7 +41,17 @@ async def create_yookassa_payment(
    )

    db.add(payment)
-    await db.commit()
+    try:
+        await db.commit()
+    except IntegrityError as e:
+        await db.rollback()
+        logger.error(
+            'FK violation при создании платежа YooKassa %s: user_id=%s не существует в БД: %s',
+            yookassa_payment_id,
+            user_id,
+            e,
+        )
+        return None
    await db.refresh(payment)

    logger.info(f'Создан платеж YooKassa: {yookassa_payment_id} на {amount_kopeks / 100}₽ для пользователя {user_id}')
@@ -995,6 +995,11 @@ class User(Base):
    email_change_new = Column(String(255), nullable=True)  # New email pending verification
    email_change_code = Column(String(6), nullable=True)  # 6-digit verification code
    email_change_expires = Column(DateTime, nullable=True)  # Code expiration
+    # OAuth provider IDs
+    google_id = Column(String(255), unique=True, nullable=True, index=True)
+    yandex_id = Column(String(255), unique=True, nullable=True, index=True)
+    discord_id = Column(String(255), unique=True, nullable=True, index=True)
+    vk_id = Column(BigInteger, unique=True, nullable=True, index=True)
    broadcasts = relationship('BroadcastHistory', back_populates='admin')
    referrals = relationship('User', backref='referrer', remote_side=[id], foreign_keys='User.referred_by_id')
    subscription = relationship('Subscription', back_populates='user', uselist=False)
@@ -1055,6 +1060,11 @@ class User(Base):
        """Пользователь зарегистрирован через email (без Telegram)."""
        return self.auth_type == 'email' and self.telegram_id is None

+    @property
+    def is_web_user(self) -> bool:
+        """Пользователь без Telegram (email, OAuth и т.д.)."""
+        return self.telegram_id is None
+
    def get_primary_promo_group(self):
        """Возвращает промогруппу с максимальным приоритетом."""
        if not self.user_promo_groups:
@@ -5094,6 +5094,58 @@ async def add_transaction_receipt_columns() -> bool:
        return False


+async def add_oauth_provider_columns() -> bool:
+    """Добавить колонки OAuth провайдеров (google_id, yandex_id, discord_id, vk_id) в users."""
+    try:
+        google_exists = await check_column_exists('users', 'google_id')
+        yandex_exists = await check_column_exists('users', 'yandex_id')
+        discord_exists = await check_column_exists('users', 'discord_id')
+        vk_exists = await check_column_exists('users', 'vk_id')
+
+        if google_exists and yandex_exists and discord_exists and vk_exists:
+            logger.info('Колонки OAuth провайдеров уже существуют в users')
+            return True
+
+        db_type = await get_database_type()
+
+        async with engine.begin() as conn:
+            if not google_exists:
+                await conn.execute(text('ALTER TABLE users ADD COLUMN google_id VARCHAR(255)'))
+                logger.info('✅ Добавлена колонка google_id в users')
+
+            if not yandex_exists:
+                await conn.execute(text('ALTER TABLE users ADD COLUMN yandex_id VARCHAR(255)'))
+                logger.info('✅ Добавлена колонка yandex_id в users')
+
+            if not discord_exists:
+                await conn.execute(text('ALTER TABLE users ADD COLUMN discord_id VARCHAR(255)'))
+                logger.info('✅ Добавлена колонка discord_id в users')
+
+            if not vk_exists:
+                if db_type == 'postgresql':
+                    await conn.execute(text('ALTER TABLE users ADD COLUMN vk_id BIGINT'))
+                else:
+                    await conn.execute(text('ALTER TABLE users ADD COLUMN vk_id INTEGER'))
+                logger.info('✅ Добавлена колонка vk_id в users')
+
+        # Создаём уникальные индексы
+        for col in ('google_id', 'yandex_id', 'discord_id', 'vk_id'):
+            try:
+                async with engine.begin() as conn:
+                    if db_type in ('postgresql', 'sqlite'):
+                        await conn.execute(text(f'CREATE UNIQUE INDEX IF NOT EXISTS uq_users_{col} ON users ({col})'))
+                    else:
+                        await conn.execute(text(f'CREATE UNIQUE INDEX uq_users_{col} ON users ({col})'))
+            except Exception as idx_error:
+                logger.warning(f'Индекс uq_users_{col} возможно уже существует: {idx_error}')
+
+        return True
+
+    except Exception as error:
+        logger.error(f'❌ Ошибка добавления колонок OAuth провайдеров в users: {error}')
+        return False
+
+
 async def create_withdrawal_requests_table() -> bool:
    """Создаёт таблицу для заявок на вывод реферального баланса."""
    try:
@@ -7045,6 +7097,13 @@ async def run_universal_migration():
        else:
            logger.warning('⚠️ Проблемы с миграцией transaction_id_cp')

+        logger.info('=== ДОБАВЛЕНИЕ КОЛОНОК OAUTH ПРОВАЙДЕРОВ ===')
+        oauth_columns_ready = await add_oauth_provider_columns()
+        if oauth_columns_ready:
+            logger.info('✅ Колонки OAuth провайдеров (google_id, yandex_id, discord_id, vk_id) готовы')
+        else:
+            logger.warning('⚠️ Проблемы с колонками OAuth провайдеров')
+
        async with engine.begin() as conn:
            total_subs = await conn.execute(text('SELECT COUNT(*) FROM subscriptions'))
            unique_users = await conn.execute(text('SELECT COUNT(DISTINCT user_id) FROM subscriptions'))
@@ -7157,6 +7216,10 @@ async def check_migration_status():
            'campaign_tariff_duration_days_column': False,
            'campaign_registration_tariff_id_column': False,
            'campaign_registration_tariff_duration_days_column': False,
+            'users_google_id_column': False,
+            'users_yandex_id_column': False,
+            'users_discord_id_column': False,
+            'users_vk_id_column': False,
        }

        status['has_made_first_topup_column'] = await check_column_exists('users', 'has_made_first_topup')
@@ -7288,6 +7351,12 @@ async def check_migration_status():
            'transactions', 'receipt_created_at'
        )

+        # Колонки OAuth провайдеров в users
+        status['users_google_id_column'] = await check_column_exists('users', 'google_id')
+        status['users_yandex_id_column'] = await check_column_exists('users', 'yandex_id')
+        status['users_discord_id_column'] = await check_column_exists('users', 'discord_id')
+        status['users_vk_id_column'] = await check_column_exists('users', 'vk_id')
+
        async with engine.begin() as conn:
            duplicates_check = await conn.execute(
                text("""
@@ -7358,6 +7427,10 @@ async def check_migration_status():
            'subscription_temporary_access_table': 'Таблица subscription_temporary_access',
            'transactions_receipt_uuid_column': 'Колонка receipt_uuid в transactions',
            'transactions_receipt_created_at_column': 'Колонка receipt_created_at в transactions',
+            'users_google_id_column': 'Колонка google_id в users',
+            'users_yandex_id_column': 'Колонка yandex_id в users',
+            'users_discord_id_column': 'Колонка discord_id в users',
+            'users_vk_id_column': 'Колонка vk_id в users',
        }

        for check_key, check_status in status.items():
@@ -1,166 +0,0 @@
-"""Flask webhook server for PayPalych callbacks."""
-
-from __future__ import annotations
-
-import asyncio
-import json
-import logging
-import threading
-from asyncio import AbstractEventLoop
-from concurrent.futures import TimeoutError as FuturesTimeoutError
-from typing import Any
-
-from flask import Flask, jsonify, request
-from werkzeug.serving import make_server
-
-from app.config import settings
-from app.database.database import AsyncSessionLocal
-from app.services.pal24_service import Pal24APIError, Pal24Service
-from app.services.payment_service import PaymentService
-
-
-logger = logging.getLogger(__name__)
-
-
-def _normalize_payload() -> dict[str, str]:
-    if request.is_json:
-        payload = request.get_json(silent=True) or {}
-        if isinstance(payload, dict):
-            return {k: str(v) for k, v in payload.items()}
-        logger.warning('Pal24 webhook JSON payload не является объектом: %s', payload)
-        return {}
-
-    if request.form:
-        return {k: v for k, v in request.form.items()}
-
-    try:
-        raw_body = request.data.decode('utf-8')
-        if raw_body:
-            payload = json.loads(raw_body)
-            if isinstance(payload, dict):
-                return {k: str(v) for k, v in payload.items()}
-    except json.JSONDecodeError:
-        logger.debug('Pal24 webhook body не удалось распарсить как JSON')
-
-    return {}
-
-
-def create_pal24_flask_app(
-    payment_service: PaymentService,
-    loop: AbstractEventLoop,
-) -> Flask:
-    pal24_service = Pal24Service()
-    app = Flask(__name__)
-
-    @app.route(settings.PAL24_WEBHOOK_PATH, methods=['POST'])
-    def pal24_webhook() -> tuple:
-        if not pal24_service.is_configured:
-            logger.error('Pal24 webhook получен, но сервис не настроен')
-            return jsonify({'status': 'error', 'reason': 'service_not_configured'}), 503
-
-        logger.debug('Получен Pal24 webhook: headers=%s', dict(request.headers))
-
-        payload = _normalize_payload()
-        if not payload:
-            logger.warning('Пустой Pal24 webhook')
-            return jsonify({'status': 'error', 'reason': 'empty_payload'}), 400
-
-        try:
-            parsed_payload = pal24_service.parse_callback(payload)
-        except Pal24APIError as error:
-            logger.error('Ошибка валидации Pal24 webhook: %s', error)
-            return jsonify({'status': 'error', 'reason': str(error)}), 400
-
-        async def process() -> bool:
-            async with AsyncSessionLocal() as db:
-                try:
-                    return await payment_service.process_pal24_callback(db, parsed_payload)
-                except Exception:
-                    await db.rollback()
-                    raise
-
-        try:
-            future = asyncio.run_coroutine_threadsafe(process(), loop)
-            processed = future.result(timeout=settings.PAL24_REQUEST_TIMEOUT)
-        except FuturesTimeoutError:
-            logger.error('Обработка Pal24 webhook превысила таймаут %sс', settings.PAL24_REQUEST_TIMEOUT)
-            return jsonify({'status': 'error', 'reason': 'timeout'}), 504
-        except Exception as error:  # pragma: no cover - defensive
-            logger.exception('Критическая ошибка обработки Pal24 webhook: %s', error)
-            return jsonify({'status': 'error', 'reason': 'internal_error'}), 500
-
-        if processed:
-            return jsonify({'status': 'ok'}), 200
-        return jsonify({'status': 'error', 'reason': 'not_processed'}), 400
-
-    @app.route(settings.PAL24_WEBHOOK_PATH, methods=['GET'])
-    def pal24_health() -> tuple:
-        return jsonify(
-            {
-                'status': 'ok',
-                'service': 'pal24_webhook',
-                'enabled': settings.is_pal24_enabled(),
-            }
-        ), 200
-
-    @app.route('/pal24/health', methods=['GET'])
-    def pal24_additional_health() -> tuple:
-        return jsonify(
-            {
-                'status': 'ok',
-                'service': 'pal24_webhook',
-                'path': settings.PAL24_WEBHOOK_PATH,
-            }
-        ), 200
-
-    return app
-
-
-class Pal24WebhookServer:
-    """Threaded Flask server for Pal24 callbacks."""
-
-    def __init__(self, payment_service: PaymentService, loop: AbstractEventLoop) -> None:
-        self.app = create_pal24_flask_app(payment_service, loop)
-        self._server: Any | None = None
-        self._thread: threading.Thread | None = None
-
-    def start(self) -> None:
-        if self._server:
-            logger.warning('Pal24 webhook server уже запущен')
-            return
-
-        self._server = make_server(
-            host='0.0.0.0',
-            port=settings.PAL24_WEBHOOK_PORT,
-            app=self.app,
-            threaded=True,
-        )
-
-        def _serve() -> None:
-            logger.info(
-                'Pal24 webhook сервер запущен на %s:%s%s',
-                '0.0.0.0',
-                settings.PAL24_WEBHOOK_PORT,
-                settings.PAL24_WEBHOOK_PATH,
-            )
-            self._server.serve_forever()
-
-        self._thread = threading.Thread(target=_serve, daemon=True)
-        self._thread.start()
-
-    def stop(self) -> None:
-        if self._server:
-            logger.info('Останавливаем Pal24 webhook сервер')
-            self._server.shutdown()
-            self._server = None
-
-        if self._thread and self._thread.is_alive():
-            self._thread.join(timeout=5)
-            self._thread = None
-
-
-async def start_pal24_webhook_server(payment_service: PaymentService) -> Pal24WebhookServer:
-    loop = asyncio.get_running_loop()
-    server = Pal24WebhookServer(payment_service, loop)
-    await loop.run_in_executor(None, server.start)
-    return server
@@ -1,3 +1,4 @@
+import asyncio
 import base64
 import json
 import logging
@@ -366,32 +367,63 @@ class RemnaWaveAPI:
            raise RemnaWaveAPIError('Session not initialized. Use async context manager.')

        url = f'{self.base_url}{endpoint}'
+        max_retries = 3
+        base_delay = 1.0

-        try:
-            kwargs = {'url': url, 'params': params}
+        for attempt in range(max_retries + 1):
+            try:
+                kwargs = {'url': url, 'params': params}

-            if data:
-                kwargs['json'] = data
+                if data:
+                    kwargs['json'] = data

-            async with self.session.request(method, **kwargs) as response:
-                response_text = await response.text()
+                async with self.session.request(method, **kwargs) as response:
+                    response_text = await response.text()

-                try:
-                    response_data = json.loads(response_text) if response_text else {}
-                except json.JSONDecodeError:
-                    response_data = {'raw_response': response_text}
+                    try:
+                        response_data = json.loads(response_text) if response_text else {}
+                    except json.JSONDecodeError:
+                        response_data = {'raw_response': response_text}

-                if response.status >= 400:
-                    error_message = response_data.get('message', f'HTTP {response.status}')
-                    logger.error(f'API Error {response.status}: {error_message}')
-                    logger.error(f'Response: {response_text[:500]}')
-                    raise RemnaWaveAPIError(error_message, response.status, response_data)
+                    if response.status == 429 and attempt < max_retries:
+                        retry_after = float(response.headers.get('Retry-After', base_delay * (2**attempt)))
+                        logger.warning(
+                            'Rate limited (429) on %s %s, retry %d/%d after %.1fs',
+                            method,
+                            endpoint,
+                            attempt + 1,
+                            max_retries,
+                            retry_after,
+                        )
+                        await asyncio.sleep(retry_after)
+                        continue

-                return response_data
+                    if response.status >= 400:
+                        error_message = response_data.get('message', f'HTTP {response.status}')
+                        logger.error(f'API Error {response.status}: {error_message}')
+                        logger.error(f'Response: {response_text[:500]}')
+                        raise RemnaWaveAPIError(error_message, response.status, response_data)

-        except aiohttp.ClientError as e:
-            logger.error(f'Request failed: {e}')
-            raise RemnaWaveAPIError(f'Request failed: {e!s}')
+                    return response_data
+
+            except aiohttp.ClientError as e:
+                if attempt < max_retries:
+                    delay = base_delay * (2**attempt)
+                    logger.warning(
+                        'Request failed on %s %s: %s, retry %d/%d after %.1fs',
+                        method,
+                        endpoint,
+                        e,
+                        attempt + 1,
+                        max_retries,
+                        delay,
+                    )
+                    await asyncio.sleep(delay)
+                    continue
+                logger.error(f'Request failed: {e}')
+                raise RemnaWaveAPIError(f'Request failed: {e!s}')
+
+        raise RemnaWaveAPIError(f'Max retries exceeded for {method} {endpoint}')

    async def create_user(
        self,
@@ -564,6 +596,33 @@ class RemnaWaveAPI:
        user = self._parse_user(response['response'])
        return await self.enrich_user_with_happ_link(user)

+    async def get_user_accessible_nodes(self, uuid: str) -> list[RemnaWaveAccessibleNode]:
+        """Получает список доступных нод для пользователя"""
+        try:
+            response = await self._make_request('GET', f'/api/users/{uuid}/accessible-nodes')
+            nodes_data = response.get('response', {}).get('activeNodes', [])
+            result = []
+            for node in nodes_data:
+                # Collect inbounds from activeSquads
+                inbounds: list[str] = []
+                for squad in node.get('activeSquads', []):
+                    inbounds.extend(squad.get('activeInbounds', []))
+                result.append(
+                    RemnaWaveAccessibleNode(
+                        uuid=node['uuid'],
+                        node_name=node['nodeName'],
+                        country_code=node['countryCode'],
+                        config_profile_uuid=node.get('configProfileUuid', ''),
+                        config_profile_name=node.get('configProfileName', ''),
+                        active_inbounds=inbounds,
+                    )
+                )
+            return result
+        except RemnaWaveAPIError as e:
+            if e.status_code == 404:
+                return []
+            raise
+
    async def get_all_users(self, start: int = 0, size: int = 100, enrich_happ_links: bool = False) -> dict[str, Any]:
        params = {'start': start, 'size': size}
        response = await self._make_request('GET', '/api/users', params=params)
@@ -940,6 +999,30 @@ class RemnaWaveAPI:
            uuid=data['uuid'], name=data['name'], view_position=data['viewPosition'], config=data.get('config')
        )

+    async def get_all_hwid_devices(self) -> dict[str, Any]:
+        """GET /api/hwid/devices — all devices for all users (paginated, max 1000/page)."""
+        all_devices: list[dict[str, Any]] = []
+        start = 0
+        page_size = 1000
+
+        while True:
+            response = await self._make_request('GET', '/api/hwid/devices', params={'start': start, 'size': page_size})
+            data = response.get('response', {'devices': [], 'total': 0})
+            devices = data.get('devices', [])
+            total = data.get('total', 0)
+            all_devices.extend(devices)
+
+            if len(all_devices) >= total or not devices:
+                break
+            start += len(devices)
+
+        return {'devices': all_devices, 'total': len(all_devices)}
+
+    async def get_all_panel_subscriptions(self) -> list[dict[str, Any]]:
+        """GET /api/subscriptions — all panel subscriptions."""
+        response = await self._make_request('GET', '/api/subscriptions')
+        return response.get('response') or []
+
    async def get_user_devices(self, user_uuid: str) -> dict[str, Any]:
        try:
            response = await self._make_request('GET', f'/api/hwid/devices/{user_uuid}')
@@ -1045,10 +1045,11 @@ async def notify_user_about_ticket_reply(bot: Bot, ticket: Ticket, reply_text: s
            return

        if not getattr(user, 'telegram_id', None):
-            logger.error(
-                'Cannot notify ticket #%s user without telegram_id (username=%s)',
+            logger.warning(
+                'Cannot notify ticket #%s user without telegram_id (username=%s, auth_type=%s)',
                ticket.id,
                getattr(user, 'username', None),
+                getattr(user, 'auth_type', None),
            )
            return

@@ -2602,8 +2602,15 @@ async def show_inactive_users(callback: types.CallbackQuery, db_user: User, db:
        await callback.answer()
        return

+    with_active_sub = sum(1 for u in inactive_users if u.subscription and u.subscription.is_active)
+    will_delete = len(inactive_users) - with_active_sub
+
    text = '🗑️ <b>Неактивные пользователи</b>\n'
-    text += f'Без активности более {settings.INACTIVE_USER_DELETE_MONTHS} месяцев: {len(inactive_users)}\n\n'
+    text += f'Без активности более {settings.INACTIVE_USER_DELETE_MONTHS} месяцев: {len(inactive_users)}\n'
+    if with_active_sub > 0:
+        text += f'🛡️ С активной подпиской (не будут удалены): {with_active_sub}\n'
+        text += f'🗑️ Будет удалено: {will_delete}\n'
+    text += '\n'

    for user in inactive_users[:10]:
        if user.telegram_id:
@@ -2612,7 +2619,9 @@ async def show_inactive_users(callback: types.CallbackQuery, db_user: User, db:
        else:
            user_link = f'<b>{user.full_name}</b>'
            user_id_display = user.email or f'#{user.id}'
-        text += f'👤 {user_link}\n'
+        has_active = user.subscription and user.subscription.is_active
+        sub_badge = ' 🛡️' if has_active else ''
+        text += f'👤 {user_link}{sub_badge}\n'
        text += f'🆔 <code>{user_id_display}</code>\n'
        last_activity_display = (
            format_time_ago(user.last_activity, db_user.language) if user.last_activity else 'Никогда'
@@ -4255,10 +4264,14 @@ async def _calculate_subscription_period_price(
@error_handler
 async def cleanup_inactive_users(callback: types.CallbackQuery, db_user: User, db: AsyncSession):
    user_service = UserService()
-    deleted_count = await user_service.cleanup_inactive_users(db)
+    deleted_count, skipped_count = await user_service.cleanup_inactive_users(db)
+
+    text = f'✅ Очистка завершена\n\nУдалено неактивных пользователей: {deleted_count}'
+    if skipped_count > 0:
+        text += f'\n⏭️ Пропущено (активная подписка): {skipped_count}'

    await callback.message.edit_text(
-        f'✅ Очистка завершена\n\nУдалено неактивных пользователей: {deleted_count}',
+        text,
        reply_markup=types.InlineKeyboardMarkup(
            inline_keyboard=[[types.InlineKeyboardButton(text='⬅️ Назад', callback_data='admin_users')]]
        ),
@@ -4621,6 +4634,8 @@ async def admin_buy_subscription_execute(callback: types.CallbackQuery, db_user:
                                full_name=target_user.full_name,
                                username=target_user.username,
                                telegram_id=target_user.telegram_id,
+                                email=target_user.email,
+                                user_id=target_user.id,
                            ),
                            active_internal_squads=subscription.connected_squads,
                        )
@@ -4634,6 +4649,8 @@ async def admin_buy_subscription_execute(callback: types.CallbackQuery, db_user:
                        full_name=target_user.full_name,
                        username=target_user.username,
                        telegram_id=target_user.telegram_id,
+                        email=target_user.email,
+                        user_id=target_user.id,
                    )
                    async with remnawave_service.get_api_client() as api:
                        create_kwargs = dict(
@@ -4645,10 +4662,12 @@ async def admin_buy_subscription_execute(callback: types.CallbackQuery, db_user:
                            else 0,
                            traffic_limit_strategy=TrafficLimitStrategy.MONTH,
                            telegram_id=target_user.telegram_id,
+                            email=target_user.email,
                            description=settings.format_remnawave_user_description(
                                full_name=target_user.full_name,
                                username=target_user.username,
                                telegram_id=target_user.telegram_id,
+                                email=target_user.email,
                            ),
                            active_internal_squads=subscription.connected_squads,
                        )
@@ -8,7 +8,6 @@ from app.config import settings
 from app.database.models import User
 from app.keyboards.inline import get_back_keyboard
 from app.localization.texts import get_texts
-from app.services.blacklist_service import blacklist_service
 from app.services.payment_service import PaymentService
 from app.states import BalanceStates
 from app.utils.decorators import error_handler
@@ -126,23 +125,6 @@ async def process_cryptobot_payment_amount(
        await state.clear()
        return

-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        message.from_user.id, message.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {message.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await message.answer(
-                f'🚫 Оплата невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    texts = get_texts(db_user.language)

    if not settings.is_cryptobot_enabled():
@@ -8,7 +8,6 @@ from app.database.models import User
 from app.external.telegram_stars import TelegramStarsService
 from app.keyboards.inline import get_back_keyboard
 from app.localization.texts import get_texts
-from app.services.blacklist_service import blacklist_service
 from app.services.payment_service import PaymentService
 from app.states import BalanceStates
 from app.utils.decorators import error_handler
@@ -94,23 +93,6 @@ async def process_stars_payment_amount(message: types.Message, db_user: User, am
        await state.clear()
        return

-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        message.from_user.id, message.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {message.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await message.answer(
-                f'🚫 Оплата невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    texts = get_texts(db_user.language)

    if not settings.TELEGRAM_STARS_ENABLED:
@@ -10,7 +10,6 @@ from app.config import settings
 from app.database.models import User
 from app.keyboards.inline import get_back_keyboard
 from app.localization.texts import get_texts
-from app.services.blacklist_service import blacklist_service
 from app.services.payment_service import PaymentService
 from app.states import BalanceStates
 from app.utils.decorators import error_handler
@@ -171,23 +170,6 @@ async def process_yookassa_payment_amount(
        await state.clear()
        return

-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        message.from_user.id, message.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {message.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await message.answer(
-                f'🚫 Оплата невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    texts = get_texts(db_user.language)

    if not settings.is_yookassa_enabled():
@@ -338,23 +320,6 @@ async def process_yookassa_sbp_payment_amount(
        await state.clear()
        return

-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        message.from_user.id, message.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {message.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await message.answer(
-                f'🚫 Оплата невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    texts = get_texts(db_user.language)

    if not settings.is_yookassa_enabled() or not settings.YOOKASSA_SBP_ENABLED:
@@ -9,7 +9,6 @@ from app.database.models import User
 from app.keyboards.inline import get_back_keyboard
 from app.localization.texts import get_texts
 from app.services.admin_notification_service import AdminNotificationService
-from app.services.blacklist_service import blacklist_service
 from app.services.promocode_service import PromoCodeService
 from app.states import PromoCodeStates
 from app.utils.decorators import error_handler
@@ -71,23 +70,6 @@ async def activate_promocode_for_registration(db: AsyncSession, user_id: int, co

@error_handler
 async def process_promocode(message: types.Message, db_user: User, state: FSMContext, db: AsyncSession):
-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        message.from_user.id, message.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {message.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await message.answer(
-                f'🚫 Активация промокода невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    texts = get_texts(db_user.language)

    code = message.text.strip()
@@ -3,7 +3,7 @@ from datetime import datetime

 from aiogram import Bot, Dispatcher, F, types
 from aiogram.enums import ChatMemberStatus
-from aiogram.exceptions import TelegramForbiddenError
+from aiogram.exceptions import TelegramBadRequest, TelegramForbiddenError
 from aiogram.filters import Command, StateFilter
 from aiogram.fsm.context import FSMContext
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -22,6 +22,7 @@ from app.database.crud.user import (
 from app.database.crud.user_message import get_random_active_message
 from app.database.models import PinnedMessage, SubscriptionStatus, UserStatus
 from app.keyboards.inline import (
+    get_back_keyboard,
    get_language_selection_keyboard,
    get_main_menu_keyboard_async,
    get_post_registration_keyboard,
@@ -35,7 +36,6 @@ from app.middlewares.channel_checker import (
    get_pending_payload_from_redis,
 )
 from app.services.admin_notification_service import AdminNotificationService
-from app.services.blacklist_service import blacklist_service
 from app.services.campaign_service import AdvertisingCampaignService
 from app.services.main_menu_button_service import MainMenuButtonService
 from app.services.pinned_message_service import (
@@ -486,9 +486,24 @@ async def cmd_start(message: types.Message, state: FSMContext, db: AsyncSession,
        logger.info(f'🔄 Удаленный пользователь {user.telegram_id} начинает повторную регистрацию')

        try:
-            from sqlalchemy import delete
+            from sqlalchemy import delete, update as sa_update

-            from app.database.models import PromoCodeUse, ReferralEarning, SubscriptionServer, Transaction
+            from app.database.models import (
+                CloudPaymentsPayment,
+                CryptoBotPayment,
+                FreekassaPayment,
+                HeleketPayment,
+                KassaAiPayment,
+                MulenPayPayment,
+                Pal24Payment,
+                PlategaPayment,
+                PromoCodeUse,
+                ReferralEarning,
+                SubscriptionServer,
+                Transaction,
+                WataPayment,
+                YooKassaPayment,
+            )

            if user.subscription:
                await decrement_subscription_server_counts(db, user.subscription)
@@ -503,9 +518,37 @@ async def cmd_start(message: types.Message, state: FSMContext, db: AsyncSession,

            await db.execute(delete(PromoCodeUse).where(PromoCodeUse.user_id == user.id))

+            await db.execute(
+                sa_update(ReferralEarning)
+                .where(ReferralEarning.user_id == user.id)
+                .values(referral_transaction_id=None)
+            )
+            await db.execute(
+                sa_update(ReferralEarning)
+                .where(ReferralEarning.referral_id == user.id)
+                .values(referral_transaction_id=None)
+            )
            await db.execute(delete(ReferralEarning).where(ReferralEarning.user_id == user.id))
            await db.execute(delete(ReferralEarning).where(ReferralEarning.referral_id == user.id))

+            # Обнуляем transaction_id во всех таблицах платежей перед удалением транзакций
+            payment_models = [
+                YooKassaPayment,
+                CryptoBotPayment,
+                HeleketPayment,
+                MulenPayPayment,
+                Pal24Payment,
+                WataPayment,
+                PlategaPayment,
+                CloudPaymentsPayment,
+                FreekassaPayment,
+                KassaAiPayment,
+            ]
+            for payment_model in payment_models:
+                await db.execute(
+                    sa_update(payment_model).where(payment_model.user_id == user.id).values(transaction_id=None)
+                )
+
            await db.execute(delete(Transaction).where(Transaction.user_id == user.id))

            user.status = UserStatus.ACTIVE.value
@@ -777,12 +820,11 @@ async def process_rules_accept(callback: types.CallbackQuery, state: FSMContext,

            try:
                await callback.message.edit_text(rules_required_text, reply_markup=get_rules_keyboard(language))
-            except Exception as e:
-                logger.error(f'Ошибка при показе сообщения об отклонении правил: {e}')
-                try:
-                    await callback.message.edit_text(rules_required_text, reply_markup=get_rules_keyboard(language))
-                except:
-                    pass
+            except TelegramBadRequest as e:
+                if 'message is not modified' in str(e):
+                    pass  # Сообщение уже содержит нужный текст
+                else:
+                    logger.error(f'Ошибка при показе сообщения об отклонении правил: {e}')

        logger.info(f'✅ Правила обработаны для пользователя {callback.from_user.id}')

@@ -993,25 +1035,6 @@ async def process_referral_code_skip(callback: types.CallbackQuery, state: FSMCo
 async def complete_registration_from_callback(callback: types.CallbackQuery, state: FSMContext, db: AsyncSession):
    logger.info(f'🎯 COMPLETE: Завершение регистрации для пользователя {callback.from_user.id}')

-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        callback.from_user.id, callback.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {callback.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await callback.message.answer(
-                f'🚫 Регистрация невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-
-        await state.clear()
-        return
-
    existing_user = await get_user_by_telegram_id(db, callback.from_user.id)

    if existing_user and existing_user.status == UserStatus.ACTIVE.value:
@@ -1262,25 +1285,6 @@ async def complete_registration_from_callback(callback: types.CallbackQuery, sta
 async def complete_registration(message: types.Message, state: FSMContext, db: AsyncSession):
    logger.info(f'🎯 COMPLETE: Завершение регистрации для пользователя {message.from_user.id}')

-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        message.from_user.id, message.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {message.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await message.answer(
-                f'🚫 Регистрация невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.'
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-
-        await state.clear()
-        return
-
    existing_user = await get_user_by_telegram_id(db, message.from_user.id)

    if existing_user and existing_user.status == UserStatus.ACTIVE.value:
@@ -1490,9 +1494,16 @@ async def complete_registration(message: types.Message, state: FSMContext, db: A

    if offer_text and not skip_welcome_offer:
        try:
+            # Если у пользователя уже есть подписка (например, от промокода), не предлагаем триал
+            user_has_subscription = user.subscription and getattr(user.subscription, 'is_active', False)
+            if user_has_subscription:
+                keyboard = get_back_keyboard(user.language, callback_data='back_to_menu')
+            else:
+                keyboard = get_post_registration_keyboard(user.language)
+
            await message.answer(
                offer_text,
-                reply_markup=get_post_registration_keyboard(user.language),
+                reply_markup=keyboard,
            )
            logger.info(f'✅ Приветственное сообщение отправлено пользователю {user.telegram_id}')
            await _send_pinned_message(message.bot, db, user)
@@ -1869,9 +1880,7 @@ async def required_sub_channel_check(

            menu_text = await get_main_menu_text(user, texts, db)

-            from aiogram.types import FSInputFile
-
-            from app.utils.message_patch import LOGO_PATH
+            from app.utils.message_patch import _cache_logo_file_id, get_logo_media

            is_admin = settings.is_admin(user.telegram_id)
            is_moderator = (not is_admin) and SupportSettingsService.is_moderator(user.telegram_id)
@@ -1898,13 +1907,14 @@ async def required_sub_channel_check(
            )

            if settings.ENABLE_LOGO_MODE:
-                await bot.send_photo(
+                _result = await bot.send_photo(
                    chat_id=query.from_user.id,
-                    photo=FSInputFile(LOGO_PATH),
+                    photo=get_logo_media(),
                    caption=menu_text,
                    reply_markup=keyboard,
                    parse_mode='HTML',
                )
+                _cache_logo_file_id(_result)
            else:
                await bot.send_message(
                    chat_id=query.from_user.id,
@@ -1964,9 +1974,7 @@ async def required_sub_channel_check(

                    menu_text = await get_main_menu_text(user, texts, db)

-                    from aiogram.types import FSInputFile
-
-                    from app.utils.message_patch import LOGO_PATH
+                    from app.utils.message_patch import _cache_logo_file_id, get_logo_media

                    is_admin = settings.is_admin(user.telegram_id)
                    is_moderator = (not is_admin) and SupportSettingsService.is_moderator(user.telegram_id)
@@ -1993,13 +2001,14 @@ async def required_sub_channel_check(
                    )

                    if settings.ENABLE_LOGO_MODE:
-                        await bot.send_photo(
+                        _result = await bot.send_photo(
                            chat_id=query.from_user.id,
-                            photo=FSInputFile(LOGO_PATH),
+                            photo=get_logo_media(),
                            caption=menu_text,
                            reply_markup=keyboard,
                            parse_mode='HTML',
                        )
+                        _cache_logo_file_id(_result)
                    else:
                        await bot.send_message(
                            chat_id=query.from_user.id,
@@ -2019,19 +2028,18 @@ async def required_sub_channel_check(
                    )
                    await state.set_state(RegistrationStates.waiting_for_referral_code)
            else:
-                from aiogram.types import FSInputFile
-
-                from app.utils.message_patch import LOGO_PATH
+                from app.utils.message_patch import _cache_logo_file_id, get_logo_media

                rules_text = await get_rules(language)

                if settings.ENABLE_LOGO_MODE:
-                    await bot.send_photo(
+                    _result = await bot.send_photo(
                        chat_id=query.from_user.id,
-                        photo=FSInputFile(LOGO_PATH),
+                        photo=get_logo_media(),
                        caption=rules_text,
                        reply_markup=get_rules_keyboard(language),
                    )
+                    _cache_logo_file_id(_result)
                else:
                    await bot.send_message(
                        chat_id=query.from_user.id,
@@ -2040,9 +2048,22 @@ async def required_sub_channel_check(
                    )
                await state.set_state(RegistrationStates.waiting_for_rules_accept)

+    except TelegramBadRequest as e:
+        error_msg = str(e).lower()
+        if 'query is too old' in error_msg or 'query id is invalid' in error_msg:
+            logger.debug('Устаревший callback в required_sub_channel_check, игнорируем')
+        else:
+            logger.error(f'Ошибка Telegram API в required_sub_channel_check: {e}')
+            try:
+                await query.answer(f'{texts.ERROR}!', show_alert=True)
+            except Exception:
+                pass
    except Exception as e:
        logger.error(f'Ошибка в required_sub_channel_check: {e}')
-        await query.answer(f'{texts.ERROR}!', show_alert=True)
+        try:
+            await query.answer(f'{texts.ERROR}!', show_alert=True)
+        except Exception:
+            pass


 def register_handlers(dp: Dispatcher):
@@ -416,8 +416,14 @@ def get_traffic_switch_keyboard(

        buttons.append([InlineKeyboardButton(text=button_text, callback_data=f'switch_traffic_{gb}')])

+    language_code = (language or 'ru').split('-')[0].lower()
    buttons.append(
-        [InlineKeyboardButton(text='⬅️ Назад' if language == 'ru' else '⬅️ Back', callback_data='subscription_settings')]
+        [
+            InlineKeyboardButton(
+                text='⬅️ Назад' if language_code in {'ru', 'fa'} else '⬅️ Back',
+                callback_data='subscription_settings',
+            )
+        ]
    )

    return InlineKeyboardMarkup(inline_keyboard=buttons)
@@ -468,6 +468,10 @@ async def select_country(callback: types.CallbackQuery, state: FSMContext, db_us
    country_uuid = callback.data.split('_')[1]
    data = await state.get_data()

+    if 'period_days' not in data:
+        await callback.answer('❌ Данные подписки устарели. Начните оформление заново.', show_alert=True)
+        return
+
    selected_countries = data.get('countries', [])
    if country_uuid in selected_countries:
        selected_countries.remove(country_uuid)
@@ -416,6 +416,7 @@ async def confirm_change_devices(callback: types.CallbackQuery, db_user: User, d
            ).format(
                amount=texts.format_price(price),
                period=period_label,
+                months=period_label,
            )
            if total_discount > 0:
                cost_text += texts.t(
@@ -24,6 +24,10 @@ async def _prepare_subscription_summary(
    texts,
 ) -> tuple[str, dict[str, Any]]:
    summary_data = dict(data)
+
+    if 'period_days' not in summary_data:
+        raise KeyError('period_days missing from subscription data — FSM state likely expired')
+
    countries = await _get_available_countries(db_user.promo_group_id)

    months_in_period = calculate_months_from_days(summary_data['period_days'])
@@ -39,7 +39,6 @@ from app.keyboards.inline import (
 )
 from app.localization.texts import get_texts
 from app.services.admin_notification_service import AdminNotificationService
-from app.services.blacklist_service import blacklist_service
 from app.services.remnawave_service import RemnaWaveConfigurationError
 from app.services.subscription_checkout_service import (
    clear_subscription_checkout_draft,
@@ -561,6 +560,15 @@ async def show_trial_offer(callback: types.CallbackQuery, db_user: User, db: Asy

    texts = get_texts(db_user.language)

+    # Проверяем, отключён ли триал для этого типа пользователя
+    if settings.is_trial_disabled_for_user(getattr(db_user, 'auth_type', 'telegram')):
+        await callback.message.edit_text(
+            texts.t('TRIAL_DISABLED_FOR_USER_TYPE', 'Пробный период недоступен'),
+            reply_markup=get_back_keyboard(db_user.language),
+        )
+        await callback.answer()
+        return
+
    # Проверяем, использовал ли пользователь триал
    # PENDING триальные подписки не считаются - пользователь может повторить оплату
    trial_blocked = False
@@ -753,6 +761,15 @@ async def activate_trial(callback: types.CallbackQuery, db_user: User, db: Async
        await callback.answer()
        return

+    # Проверяем, отключён ли триал для этого типа пользователя
+    if settings.is_trial_disabled_for_user(getattr(db_user, 'auth_type', 'telegram')):
+        await callback.message.edit_text(
+            texts.t('TRIAL_DISABLED_FOR_USER_TYPE', 'Пробный период недоступен'),
+            reply_markup=get_back_keyboard(db_user.language),
+        )
+        await callback.answer()
+        return
+
    # Проверяем, использовал ли пользователь триал
    # PENDING триальные подписки не считаются - пользователь может повторить оплату
    trial_blocked = False
@@ -1385,6 +1402,11 @@ async def return_to_saved_cart(callback: types.CallbackQuery, state: FSMContext,

    prepared_cart_data = dict(cart_data)

+    if 'period_days' not in prepared_cart_data:
+        await callback.answer('❌ Корзина повреждена. Оформите подписку заново.', show_alert=True)
+        await user_cart_service.delete_user_cart(db_user.id)
+        return
+
    if not settings.is_devices_selection_enabled():
        try:
            from .pricing import _prepare_subscription_summary
@@ -1724,24 +1746,6 @@ async def handle_extend_subscription(callback: types.CallbackQuery, db_user: Use


 async def confirm_extend_subscription(callback: types.CallbackQuery, db_user: User, db: AsyncSession):
-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        callback.from_user.id, callback.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {callback.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await callback.answer(
-                f'🚫 Продление подписки невозможно\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.',
-                show_alert=True,
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    days = int(callback.data.split('_')[2])
    texts = get_texts(db_user.language)

@@ -2228,24 +2232,6 @@ async def devices_continue(callback: types.CallbackQuery, state: FSMContext, db_


 async def confirm_purchase(callback: types.CallbackQuery, state: FSMContext, db_user: User, db: AsyncSession):
-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        callback.from_user.id, callback.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {callback.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await callback.answer(
-                f'🚫 Покупка подписки невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.',
-                show_alert=True,
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    # Проверка ограничения на покупку/продление подписки
    if getattr(db_user, 'restriction_subscription', False):
        reason = getattr(db_user, 'restriction_reason', None) or 'Действие ограничено администратором'
@@ -3241,6 +3227,9 @@ async def handle_trial_pay_with_balance(callback: types.CallbackQuery, db_user:

    await db.refresh(db_user)

+    # Сохраняем ID до начала транзакции (на случай detached session)
+    user_id_snapshot = db_user.id
+
    # Создаем триальную подписку
    subscription: Subscription | None = None
    remnawave_user = None
@@ -3402,22 +3391,33 @@ async def handle_trial_pay_with_balance(callback: types.CallbackQuery, db_user:
    except Exception as error:
        logger.error(
            'Unexpected error during paid trial activation for user %s: %s',
-            db_user.id,
+            user_id_snapshot,
            error,
        )
-        # Пытаемся откатить и вернуть деньги
-        if subscription:
-            await rollback_trial_subscription_activation(db, subscription)
-        from app.database.crud.user import add_user_balance
+        # Откатываем сессию чтобы очистить PendingRollbackError
+        try:
+            await db.rollback()
+        except Exception:
+            pass

-        await add_user_balance(
-            db,
-            db_user,
-            trial_price_kopeks,
-            texts.t('TRIAL_REFUND_DESCRIPTION', 'Возврат за неудачную активацию триала'),
-            transaction_type=TransactionType.REFUND,
-        )
-        await db.refresh(db_user)
+        # Пытаемся вернуть деньги
+        try:
+            from app.database.crud.user import add_user_balance
+
+            await add_user_balance(
+                db,
+                db_user,
+                trial_price_kopeks,
+                texts.t('TRIAL_REFUND_DESCRIPTION', 'Возврат за неудачную активацию триала'),
+                transaction_type=TransactionType.REFUND,
+            )
+            await db.refresh(db_user)
+        except Exception as refund_error:
+            logger.error(
+                'Failed to refund trial payment for user %s: %s',
+                user_id_snapshot,
+                refund_error,
+            )

        await callback.message.edit_text(
            texts.t(
@@ -4134,24 +4134,6 @@ async def handle_simple_subscription_purchase(
    db: AsyncSession,
 ):
    """Обрабатывает простую покупку подписки."""
-    # Проверяем, находится ли пользователь в черном списке
-    is_blacklisted, blacklist_reason = await blacklist_service.is_user_blacklisted(
-        callback.from_user.id, callback.from_user.username
-    )
-
-    if is_blacklisted:
-        logger.warning(f'🚫 Пользователь {callback.from_user.id} находится в черном списке: {blacklist_reason}')
-        try:
-            await callback.answer(
-                f'🚫 Простая покупка подписки невозможна\n\n'
-                f'Причина: {blacklist_reason}\n\n'
-                f'Если вы считаете, что это ошибка, обратитесь в поддержку.',
-                show_alert=True,
-            )
-        except Exception as e:
-            logger.error(f'Ошибка при отправке сообщения о блокировке: {e}')
-        return
-
    texts = get_texts(db_user.language)

    if not settings.SIMPLE_SUBSCRIPTION_ENABLED:
@@ -1424,10 +1424,23 @@ async def confirm_daily_tariff_purchase(
 # ==================== Продление по тарифу ====================


+def _calc_extra_devices_cost(tariff: Tariff, subscription_device_limit: int, period_days: int) -> int:
+    """Рассчитывает стоимость дополнительных устройств сверх тарифа для периода."""
+    additional = max(0, subscription_device_limit - (tariff.device_limit or 1))
+    if additional <= 0:
+        return 0
+    device_price = getattr(tariff, 'device_price_kopeks', None) or 0
+    if device_price <= 0:
+        return 0
+    months = max(1, round(period_days / 30))
+    return additional * device_price * months
+
+
 def get_tariff_extend_keyboard(
    tariff: Tariff,
    language: str,
    db_user: User | None = None,
+    subscription_device_limit: int | None = None,
 ) -> InlineKeyboardMarkup:
    """Создает клавиатуру выбора периода для продления по тарифу с учетом скидок по периодам."""
    texts = get_texts(language)
@@ -1438,6 +1451,10 @@ def get_tariff_extend_keyboard(
        period = int(period_str)
        price = prices[period_str]

+        # Добавляем стоимость дополнительных устройств
+        if subscription_device_limit is not None:
+            price += _calc_extra_devices_cost(tariff, subscription_device_limit, period)
+
        # Получаем скидку для конкретного периода
        discount_percent = 0
        if db_user:
@@ -1508,13 +1525,17 @@ async def show_tariff_extend(
    if has_period_discounts:
        discount_hint = '\n🎁 <i>Скидки зависят от выбранного периода</i>'

+    actual_device_limit = subscription.device_limit or tariff.device_limit
+
    await callback.message.edit_text(
        f'🔄 <b>Продление подписки</b>{discount_hint}\n\n'
        f'📦 Тариф: <b>{tariff.name}</b>\n'
        f'📊 Трафик: {traffic}\n'
-        f'📱 Устройств: {tariff.device_limit}\n\n'
+        f'📱 Устройств: {actual_device_limit}\n\n'
        'Выберите период продления:',
-        reply_markup=get_tariff_extend_keyboard(tariff, db_user.language, db_user=db_user),
+        reply_markup=get_tariff_extend_keyboard(
+            tariff, db_user.language, db_user=db_user, subscription_device_limit=actual_device_limit
+        ),
        parse_mode='HTML',
    )
    await callback.answer()
@@ -1538,12 +1559,16 @@ async def select_tariff_extend_period(
        await callback.answer('Тариф недоступен', show_alert=True)
        return

+    subscription = await get_subscription_by_user_id(db, db_user.id)
+    actual_device_limit = (subscription.device_limit if subscription else None) or tariff.device_limit
+
    # Получаем скидку для выбранного периода
    discount_percent = _get_user_period_discount(db_user, period)

-    # Получаем цену
+    # Получаем цену (тариф + дополнительные устройства)
    prices = tariff.period_prices or {}
    base_price = prices.get(str(period), 0)
+    base_price += _calc_extra_devices_cost(tariff, actual_device_limit, period)
    final_price = _apply_promo_discount(base_price, discount_percent)

    # Проверяем баланс
@@ -1560,7 +1585,7 @@ async def select_tariff_extend_period(
            f'✅ <b>Подтверждение продления</b>\n\n'
            f'📦 Тариф: <b>{tariff.name}</b>\n'
            f'📊 Трафик: {traffic}\n'
-            f'📱 Устройств: {tariff.device_limit}\n'
+            f'📱 Устройств: {actual_device_limit}\n'
            f'📅 Период: {_format_period(period)}\n'
            f'{discount_text}\n'
            f'💰 <b>К оплате: {_format_price_kopeks(final_price)}</b>\n\n'
@@ -1572,9 +1597,6 @@ async def select_tariff_extend_period(
    else:
        missing = final_price - user_balance

-        # Получаем текущую подписку для сохранения в корзину
-        subscription = await get_subscription_by_user_id(db, db_user.id)
-
        # Сохраняем данные корзины для автопокупки после пополнения
        cart_data = {
            'cart_mode': 'extend',
@@ -1588,7 +1610,7 @@ async def select_tariff_extend_period(
            'return_to_cart': True,
            'description': f'Продление тарифа {tariff.name} на {period} дней',
            'traffic_limit_gb': tariff.traffic_limit_gb,
-            'device_limit': tariff.device_limit,
+            'device_limit': actual_device_limit,
            'allowed_squads': tariff.allowed_squads or [],
            'discount_percent': discount_percent,
        }
@@ -1641,12 +1663,15 @@ async def confirm_tariff_extend(
        await callback.answer('Подписка не найдена', show_alert=True)
        return

+    actual_device_limit = subscription.device_limit or tariff.device_limit
+
    data = await state.get_data()
    discount_percent = data.get('extend_discount_percent', 0)

-    # Получаем цену
+    # Получаем цену (тариф + дополнительные устройства)
    prices = tariff.period_prices or {}
    base_price = prices.get(str(period), 0)
+    base_price += _calc_extra_devices_cost(tariff, actual_device_limit, period)
    final_price = _apply_promo_discount(base_price, discount_percent)

    # Проверяем баланс
@@ -1724,7 +1749,7 @@ async def confirm_tariff_extend(
            f'🎉 <b>Подписка успешно продлена!</b>\n\n'
            f'📦 Тариф: <b>{tariff.name}</b>\n'
            f'📊 Трафик: {traffic}\n'
-            f'📱 Устройств: {tariff.device_limit}\n'
+            f'📱 Устройств: {actual_device_limit}\n'
            f'📅 Добавлено: {_format_period(period)}\n'
            f'💰 Списано: {_format_price_kopeks(final_price)}',
            reply_markup=InlineKeyboardMarkup(
@@ -80,6 +80,9 @@ async def handle_ticket_title_input(message: types.Message, state: FSMContext, d
        return

    """Обработать ввод заголовка тикета"""
+    if not message.text:
+        asyncio.create_task(_try_delete_message_later(message.bot, message.chat.id, message.message_id, 2.0))
+        return
    title = message.text.strip()

    data_prompt = await state.get_data()
@@ -247,6 +247,8 @@ _LANGUAGE_DISPLAY_NAMES = {
    'zh-hant': '🇹🇼 中文 (繁體)',
    'vi': '🇻🇳 Tiếng Việt',
    'vi-vn': '🇻🇳 Tiếng Việt',
+    'fa': '🇮🇷 فارسی',
+    'fa-ir': '🇮🇷 فارسی',
 }


@@ -1789,6 +1791,8 @@ def get_add_traffic_keyboard(
    from app.utils.pricing_utils import get_remaining_months

    texts = get_texts(language)
+    language_code = (language or DEFAULT_LANGUAGE).split('-')[0].lower()
+    use_russian_fallback = language_code in {'ru', 'fa'}

    months_multiplier = 1
    period_text = ''
@@ -1826,17 +1830,20 @@ def get_add_traffic_keyboard(
        total_discount = discount_per_month * months_multiplier

        if gb == 0:
-            if language == 'ru':
+            if use_russian_fallback:
                text = f'♾️ Безлимитный трафик - {total_price // 100} ₽{period_text}'
            else:
                text = f'♾️ Unlimited traffic - {total_price // 100} ₽{period_text}'
-        elif language == 'ru':
+        elif use_russian_fallback:
            text = f'📊 +{gb} ГБ трафика - {total_price // 100} ₽{period_text}'
        else:
            text = f'📊 +{gb} GB traffic - {total_price // 100} ₽{period_text}'

        if discount_percent > 0 and total_discount > 0:
-            text += f' (скидка {discount_percent}%: -{total_discount // 100}₽)'
+            if use_russian_fallback:
+                text += f' (скидка {discount_percent}%: -{total_discount // 100}₽)'
+            else:
+                text += f' (discount {discount_percent}%: -{total_discount // 100}₽)'

        buttons.append([InlineKeyboardButton(text=text, callback_data=f'add_traffic_{gb}')])

@@ -1861,6 +1868,8 @@ def get_add_traffic_keyboard_from_tariff(
        discount_percent: Процент скидки
    """
    texts = get_texts(language)
+    language_code = (language or DEFAULT_LANGUAGE).split('-')[0].lower()
+    use_russian_fallback = language_code in {'ru', 'fa'}

    if not packages:
        return InlineKeyboardMarkup(
@@ -1888,15 +1897,18 @@ def get_add_traffic_keyboard_from_tariff(
            discount_percent,
        )

-        period_text = ' /мес' if language == 'ru' else ' /mo'
+        period_text = ' /мес' if use_russian_fallback else ' /mo'

-        if language == 'ru':
+        if use_russian_fallback:
            text = f'📊 +{gb} ГБ трафика - {discounted_price // 100} ₽{period_text}'
        else:
            text = f'📊 +{gb} GB traffic - {discounted_price // 100} ₽{period_text}'

        if discount_percent > 0 and discount_value > 0:
-            text += f' (скидка {discount_percent}%: -{discount_value // 100}₽)'
+            if use_russian_fallback:
+                text += f' (скидка {discount_percent}%: -{discount_value // 100}₽)'
+            else:
+                text += f' (discount {discount_percent}%: -{discount_value // 100}₽)'

        buttons.append([InlineKeyboardButton(text=text, callback_data=f'add_traffic_{gb}')])

@@ -231,7 +231,7 @@ def ensure_locale_templates() -> None:
            _copy_locale(template, destination / template.name)
        return

-    for locale_code in ('ru', 'en'):
+    for locale_code in ('ru', 'en', 'fa'):
        source_path = _DEFAULT_LOCALES_DIR / f'{locale_code}.json'
        target_path = destination / f'{locale_code}.json'

@@ -1548,6 +1548,9 @@
  "TRIAL_PROVISIONING_FAILED": "We couldn't finish setting up the trial. Any charge has been refunded. Please try again later.",
  "TRIAL_ROLLBACK_FAILED": "We couldn't cancel the trial activation after a payment error. Please contact support and try again later.",
  "TRIAL_REFUND_FAILED": "We couldn't refund the trial activation charge. Please contact support immediately.",
+  "TRIAL_PAYMENT_DESCRIPTION": "Trial subscription payment",
+  "TRIAL_REFUND_DESCRIPTION": "Refund for failed trial activation",
+  "TRIAL_ACTIVATION_ERROR": "❌ An error occurred during trial activation. Funds have been returned to your balance.",
  "TRIAL_PAYMENT_CHARGED_NOTE": "💳 {amount} has been deducted from your balance.",
  "TRIAL_CHANNEL_UNSUBSCRIBED": "\n🚫 <b>Access paused</b>\n\nWe couldn't find your subscription to our channel, so the trial plan has been disabled.\n\nJoin the channel and tap “{check_button}” to restore access.",
  "TRIAL_ENDING_SOON": "\n🎁 <b>The trial subscription is ending soon!</b>\n\nYour trial expires in a few hours.\n\n💎 <b>Don't want to lose VPN access?</b>\nSwitch to the full subscription!\n\n🔥 <b>Special offer:</b>\n• 30 days for {price}\n• Unlimited traffic\n• All servers available\n• Speeds up to 1 Gbit/s\n\n⚡️ Activate before the trial ends!\n",
@@ -1569,6 +1569,9 @@
  "TRIAL_PROVISIONING_FAILED": "Не удалось завершить активацию триала. Средства возвращены на баланс. Попробуйте позже.",
  "TRIAL_ROLLBACK_FAILED": "Не удалось отменить активацию триала после ошибки списания. Свяжитесь с поддержкой и попробуйте позже.",
  "TRIAL_REFUND_FAILED": "Не удалось вернуть оплату за активацию триала. Немедленно свяжитесь с поддержкой.",
+  "TRIAL_PAYMENT_DESCRIPTION": "Оплата пробной подписки",
+  "TRIAL_REFUND_DESCRIPTION": "Возврат за неудачную активацию триала",
+  "TRIAL_ACTIVATION_ERROR": "❌ Произошла ошибка при активации триала. Средства возвращены на баланс.",
  "TRIAL_PAYMENT_CHARGED_NOTE": "💳 С вашего баланса списано {amount}.",
  "TRIAL_CHANNEL_UNSUBSCRIBED": "\n🚫 <b>Доступ приостановлен</b>\n\nМы не нашли вашу подписку на наш канал, поэтому тестовая подписка отключена.\n\nПодпишитесь на канал и нажмите «{check_button}», чтобы вернуть доступ.",
  "TRIAL_ENDING_SOON": "\n🎁 <b>Тестовая подписка скоро закончится!</b>\n\nВаша тестовая подписка истекает через несколько часов.\n\n💎 <b>Не хотите остаться без VPN?</b>\nПереходите на полную подписку!\n\n🔥 <b>Специальное предложение:</b>\n• 30 дней всего за {price}\n• Безлимитный трафик  \n• Все серверы доступны\n• Скорость до 1ГБит/сек\n\n⚡️ Успейте оформить до окончания тестового периода!\n",
@@ -1479,6 +1479,9 @@
 "TRIAL_PROVISIONING_FAILED": "Не вдалося завершити активацію тріалу. Кошти повернуто на баланс. Спробуйте пізніше.",
 "TRIAL_ROLLBACK_FAILED": "Не вдалося скасувати активацію тріалу після помилки списання. Зв'яжіться з підтримкою і спробуйте пізніше.",
 "TRIAL_REFUND_FAILED": "Не вдалося повернути оплату за активацію тріалу. Негайно зв'яжіться з підтримкою.",
+ "TRIAL_PAYMENT_DESCRIPTION": "Оплата пробної підписки",
+ "TRIAL_REFUND_DESCRIPTION": "Повернення за невдалу активацію тріалу",
+ "TRIAL_ACTIVATION_ERROR": "❌ Виникла помилка при активації тріалу. Кошти повернуто на баланс.",
 "TRIAL_PAYMENT_CHARGED_NOTE": "💳 З вашого балансу списано {amount}.",
 "TRIAL_CHANNEL_UNSUBSCRIBED": "\n🚫 <b>Доступ призупинено</b>\n\nМи не знайшли вашу підписку на наш канал, тому тестову підписку вимкнено.\n\nПідпишіться на канал і натисніть «{check_button}», щоб повернути доступ.",
 "TRIAL_ENDING_SOON": "\n🎁 <b>Тестова підписка скоро закінчиться!</b>\n\nВаша тестова підписка закінчується через декілька годин.\n\n💎 <b>Не хочете залишитися без VPN?</b>\nПереходьте на повну підписку!\n\n🔥 <b>Спеціальна пропозиція:</b>\n• 30 днів усього за {price}\n• Безлімітний трафік  \n• Всі сервери доступні\n• Швидкість до 1ГБіт/сек\n\n⚡️ Встигніть оформити до закінчення тестового періоду!\n",
@@ -1477,6 +1477,9 @@
 "TRIAL_PROVISIONING_FAILED":"未能完成试用激活。资金已退回余额。请稍后再试。",
 "TRIAL_ROLLBACK_FAILED":"扣款失败后未能取消试用激活。请联系支持并稍后再试。",
 "TRIAL_REFUND_FAILED":"未能退还试用激活付款。请立即联系支持。",
+"TRIAL_PAYMENT_DESCRIPTION":"试用订阅付款",
+"TRIAL_REFUND_DESCRIPTION":"试用激活失败退款",
+"TRIAL_ACTIVATION_ERROR":"❌ 试用激活出错。资金已退回余额。",
 "TRIAL_PAYMENT_CHARGED_NOTE":"💳已从您的余额中扣除{amount}。",
 "TRIAL_CHANNEL_UNSUBSCRIBED":"\n🚫<b>访问已暂停</b>\n\n我们未找到您对我们频道的订阅，因此试用订阅已禁用。\n\n请订阅频道并点击“{check_button}”以恢复访问。",
 "TRIAL_ENDING_SOON":"\n🎁<b>试用订阅即将结束！</b>\n\n您的试用订阅将在几小时后过期。\n\n💎<b>不想没有VPN吗？</b>\n升级到完整订阅！\n\n🔥<b>特别优惠：</b>\n•30天仅需{price}\n•无限流量 \n•所有服务器可用\n•速度高达1Gbit/s\n\n⚡️赶在试用期结束前订购吧！\n",
@@ -1807,6 +1810,9 @@
 "TRIAL_PROVISIONING_FAILED":"未能完成试用激活。资金已退回余额。请稍后再试。",
 "TRIAL_ROLLBACK_FAILED":"扣款失败后未能取消试用激活。请联系支持并稍后再试。",
 "TRIAL_REFUND_FAILED":"未能退还试用激活付款。请立即联系支持。",
+"TRIAL_PAYMENT_DESCRIPTION":"试用订阅付款",
+"TRIAL_REFUND_DESCRIPTION":"试用激活失败退款",
+"TRIAL_ACTIVATION_ERROR":"❌ 试用激活出错。资金已退回余额。",
 "TRIAL_PAYMENT_CHARGED_NOTE":"💳已从您的余额中扣除{amount}。",
 "TRIAL_CHANNEL_UNSUBSCRIBED":"\n🚫<b>访问已暂停</b>\n\n我们未找到您对我们频道的订阅，因此试用订阅已禁用。\n\n请订阅频道并点击“{check_button}”以恢复访问。",
 "TRIAL_ENDING_SOON":"\n🎁<b>试用订阅即将结束！</b>\n\n您的试用订阅将在几小时后过期。\n\n💎<b>不想没有VPN吗？</b>\n升级到完整订阅！\n\n🔥<b>特别优惠：</b>\n•30天仅需{price}\n•无限流量 \n•所有服务器可用\n•速度高达1Gbit/s\n\n⚡️赶在试用期结束前订购吧！\n",
@@ -35,6 +35,18 @@ _DYNAMIC_LANGUAGE_CONFIGS = {
            'Старайтесь использовать тикеты — так мы быстрее поможем и ничего не потеряется.\n'
        ),
    },
+    'fa': {
+        'traffic_pattern': '📊 {size} گیگابایت - {price}',
+        'unlimited_pattern': '📊 نامحدود - {price}',
+        'support_info': (
+            '\n🛟 <b>پشتیبانی</b>\n\n'
+            'برای هرگونه سؤال به پشتیبانی پیام دهید:\n\n'
+            '👤 {support_username}\n\n'
+            '• 🎫 ایجاد تیکت\n'
+            '• 📋 تیکت‌های من\n'
+            '• 💬 تماس مستقیم\n'
+        ),
+    },
    'en': {
        'traffic_pattern': '📊 {size} GB - {price}',
        'unlimited_pattern': '📊 Unlimited - {price}',
@@ -0,0 +1,49 @@
+import logging
+from collections.abc import Awaitable, Callable
+from typing import Any
+
+from aiogram import BaseMiddleware
+from aiogram.types import CallbackQuery, Message, PreCheckoutQuery, TelegramObject, User as TgUser
+
+from app.services.blacklist_service import blacklist_service
+
+
+logger = logging.getLogger(__name__)
+
+
+class BlacklistMiddleware(BaseMiddleware):
+    async def __call__(
+        self,
+        handler: Callable[[TelegramObject, dict[str, Any]], Awaitable[Any]],
+        event: TelegramObject,
+        data: dict[str, Any],
+    ) -> Any:
+        user: TgUser | None = None
+        if isinstance(event, (Message, CallbackQuery, PreCheckoutQuery)):
+            user = event.from_user
+
+        if not user or user.is_bot:
+            return await handler(event, data)
+
+        is_blacklisted, reason = await blacklist_service.is_user_blacklisted(user.id, user.username)
+
+        if not is_blacklisted:
+            return await handler(event, data)
+
+        logger.warning(f'🚫 Пользователь {user.id} (@{user.username}) из черного списка: {reason}')
+
+        block_text = (
+            f'🚫 Доступ запрещен\n\nПричина: {reason}\n\nЕсли вы считаете, что это ошибка, обратитесь в поддержку.'
+        )
+
+        try:
+            if isinstance(event, Message):
+                await event.answer(block_text)
+            elif isinstance(event, CallbackQuery):
+                await event.answer(block_text, show_alert=True)
+            elif isinstance(event, PreCheckoutQuery):
+                await event.answer(ok=False, error_message='Доступ запрещен')
+        except Exception as e:
+            logger.error(f'Ошибка отправки сообщения о блокировке пользователю {user.id}: {e}')
+
+        return None
@@ -5,6 +5,7 @@

 import asyncio
 import logging
+import time
 from datetime import datetime, timedelta

 import aiohttp
@@ -27,6 +28,9 @@ class BlacklistService:
        interval_hours = self.get_blacklist_update_interval_hours()
        self.update_interval = timedelta(hours=interval_hours)
        self.lock = asyncio.Lock()  # Блокировка для предотвращения одновременных обновлений
+        # Кэш результатов проверки: {telegram_id: (is_blacklisted, reason, timestamp)}
+        self._check_cache: dict[int, tuple[bool, str | None, float]] = {}
+        self._cache_ttl = 300  # 5 минут

    def is_blacklist_check_enabled(self) -> bool:
        """Проверяет, включена ли проверка черного списка"""
@@ -117,6 +121,7 @@ class BlacklistService:

                self.blacklist_data = blacklist_data
                self.last_update = datetime.utcnow()
+                self._check_cache.clear()
                logger.info(f'Черный список успешно обновлен. Найдено {len(blacklist_data)} записей')
                return True

@@ -141,9 +146,17 @@ class BlacklistService:
        if not self.is_blacklist_check_enabled():
            return False, None

+        # Проверяем кэш
+        now = time.monotonic()
+        cached = self._check_cache.get(telegram_id)
+        if cached is not None:
+            is_bl, reason, ts = cached
+            if now - ts < self._cache_ttl:
+                return is_bl, reason
+
        # Проверяем, является ли пользователь администратором и нужно ли его игнорировать
        if self.should_ignore_admins() and self.is_admin(telegram_id):
-            logger.info(f'Пользователь {telegram_id} является администратором, игнорируем проверку черного списка')
+            self._check_cache[telegram_id] = (False, None, now)
            return False, None

        # Если черный список пуст или устарел, обновляем его
@@ -156,17 +169,21 @@ class BlacklistService:
        for bl_id, bl_username, bl_reason in self.blacklist_data:
            if bl_id == telegram_id:
                logger.info(f'Пользователь {telegram_id} найден в черном списке по ID: {bl_reason}')
+                self._check_cache[telegram_id] = (True, bl_reason, now)
                return True, bl_reason

        # Проверяем по username, если он передан
        if username:
+            username_lower = username.lower().lstrip('@')
            for bl_id, bl_username, bl_reason in self.blacklist_data:
-                if bl_username and (bl_username == username or bl_username == f'@{username}'):
+                if bl_username and bl_username.lower().lstrip('@') == username_lower:
                    logger.info(
                        f'Пользователь {username} ({telegram_id}) найден в черном списке по username: {bl_reason}'
                    )
+                    self._check_cache[telegram_id] = (True, bl_reason, now)
                    return True, bl_reason

+        self._check_cache[telegram_id] = (False, None, now)
        return False, None

    async def get_all_blacklisted_users(self) -> list[tuple[int, str, str]]:
@@ -0,0 +1,109 @@
+"""Service for blocking disposable/temporary email domains."""
+
+import asyncio
+import logging
+from datetime import UTC, datetime
+
+import aiohttp
+
+from app.config import settings
+
+
+logger = logging.getLogger(__name__)
+
+
+class DisposableEmailService:
+    """
+    Downloads and caches a list of disposable email domains from GitHub.
+
+    Domains are stored in a frozenset for O(1) thread-safe lookups.
+    The list is refreshed every 24 hours via an asyncio background task.
+    If the download fails, the service falls back to an empty set (no blocking).
+    """
+
+    DOMAINS_URL = 'https://raw.githubusercontent.com/disposable/disposable-email-domains/master/domains.txt'
+    UPDATE_INTERVAL_HOURS = 24
+
+    def __init__(self) -> None:
+        self._domains: frozenset[str] = frozenset()
+        self._task: asyncio.Task[None] | None = None
+        self._last_updated: datetime | None = None
+        self._domain_count: int = 0
+
+    async def start(self) -> None:
+        """Load domains and start periodic refresh task."""
+        await self._update_domains()
+        self._task = asyncio.create_task(self._periodic_loop())
+        logger.info('DisposableEmailService started (%d domains loaded)', self._domain_count)
+
+    async def stop(self) -> None:
+        """Cancel periodic refresh task."""
+        if self._task and not self._task.done():
+            self._task.cancel()
+            try:
+                await self._task
+            except asyncio.CancelledError:
+                pass
+            self._task = None
+        logger.info('DisposableEmailService stopped')
+
+    async def _update_domains(self) -> None:
+        """Fetch domains.txt from GitHub and swap the in-memory set."""
+        try:
+            async with aiohttp.ClientSession() as session, session.get(self.DOMAINS_URL) as resp:
+                if resp.status != 200:
+                    logger.error(
+                        'Failed to fetch disposable domains: HTTP %d',
+                        resp.status,
+                    )
+                    return
+
+                text = await resp.text()
+
+            domains = frozenset(
+                line.strip().lower() for line in text.splitlines() if line.strip() and not line.startswith('#')
+            )
+
+            self._domains = domains
+            self._domain_count = len(domains)
+            self._last_updated = datetime.now(UTC)
+            logger.info('Disposable email domains updated: %d domains', self._domain_count)
+
+        except Exception:
+            logger.exception('Error updating disposable email domains')
+
+    async def _periodic_loop(self) -> None:
+        """Sleep then refresh, repeating forever until cancelled."""
+        while True:
+            await asyncio.sleep(self.UPDATE_INTERVAL_HOURS * 3600)
+            await self._update_domains()
+
+    def is_disposable(self, email: str) -> bool:
+        """Check if the email uses a disposable domain.
+
+        Returns False when the feature is disabled via settings.
+        """
+        if not getattr(settings, 'DISPOSABLE_EMAIL_CHECK_ENABLED', True):
+            return False
+
+        if not self._domains:
+            return False
+
+        try:
+            domain = email.rsplit('@', 1)[1].lower()
+        except IndexError:
+            return False
+
+        return domain in self._domains
+
+    def get_status(self) -> dict:
+        """Return service status for monitoring / health checks."""
+        return {
+            'enabled': getattr(settings, 'DISPOSABLE_EMAIL_CHECK_ENABLED', True),
+            'domain_count': self._domain_count,
+            'last_updated': self._last_updated.isoformat() if self._last_updated else None,
+            'running': self._task is not None and not self._task.done(),
+        }
+
+
+disposable_email_service = DisposableEmailService()
@@ -6,7 +6,6 @@ from typing import Any

 from aiogram.enums import ChatMemberStatus
 from aiogram.exceptions import TelegramBadRequest, TelegramForbiddenError
-from aiogram.types import FSInputFile
 from sqlalchemy import and_, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
@@ -108,13 +107,17 @@ class MonitoringService:

        if settings.ENABLE_LOGO_MODE and LOGO_PATH.exists() and (text is None or len(text) <= 1000):
            try:
-                return await self.bot.send_photo(
+                from app.utils.message_patch import _cache_logo_file_id, get_logo_media
+
+                result = await self.bot.send_photo(
                    chat_id=chat_id,
-                    photo=FSInputFile(LOGO_PATH),
+                    photo=get_logo_media(),
                    caption=text,
                    reply_markup=reply_markup,
                    parse_mode=parse_mode,
                )
+                _cache_logo_file_id(result)
+                return result
            except TelegramBadRequest as exc:
                logger.warning(
                    'Не удалось отправить сообщение с логотипом пользователю %s: %s. Отправляем текстовое сообщение.',
@@ -12,7 +12,6 @@ from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.cloudpayments_service import CloudPaymentsAPIError
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -262,22 +261,11 @@ class CloudPaymentsPaymentMixin:
            logger.exception('Ошибка отправки уведомления CloudPayments: %s', error)

        # Auto-purchase if enabled
-        auto_purchase_success = False
        try:
-            auto_purchase_success = await auto_purchase_saved_cart_after_topup(db, user, bot=getattr(self, 'bot', None))
+            await auto_purchase_saved_cart_after_topup(db, user, bot=getattr(self, 'bot', None))
        except Exception as error:
            logger.exception('Ошибка автопокупки после CloudPayments: %s', error)

-        # Умная автоактивация если автопокупка не сработала
-        if not auto_purchase_success:
-            try:
-                # Игнорируем notification_sent т.к. здесь нет дополнительных уведомлений
-                await auto_activate_subscription_after_topup(
-                    db, user, bot=getattr(self, 'bot', None), topup_amount=amount_kopeks
-                )
-            except Exception as error:
-                logger.exception('Ошибка умной автоактивации после CloudPayments: %s', error)
-
        return True

    async def process_cloudpayments_fail_webhook(
@@ -171,79 +171,18 @@ class PaymentCommonMixin:
        try:
            payment_method = payment_method_title or 'Банковская карта (YooKassa)'

-            # Проверяем, нужно ли показывать яркое предупреждение об активации
-            if settings.SHOW_ACTIVATION_PROMPT_AFTER_TOPUP:
-                # Определяем статус подписки для выбора правильной кнопки
-                has_active_subscription = False
-                if user_snapshot:
-                    try:
-                        subscription = user_snapshot.subscription
-                        has_active_subscription = bool(
-                            subscription
-                            and not getattr(subscription, 'is_trial', False)
-                            and getattr(subscription, 'is_active', False)
-                        )
-                    except Exception:
-                        pass
-
-                # Яркое сообщение с восклицательными знаками
-                message = (
-                    '✅ <b>Платеж успешно завершен!</b>\n\n'
-                    f'💰 Сумма: {settings.format_price(amount_kopeks)}\n'
-                    f'💳 Способ: {payment_method}\n\n'
-                    '💎 Средства зачислены на ваш баланс!\n\n'
-                    '‼️ <b>ВНИМАНИЕ! ОБЯЗАТЕЛЬНО АКТИВИРУЙТЕ ПОДПИСКУ!</b> ‼️\n\n'
-                    '⚠️ Пополнение баланса <b>НЕ АКТИВИРУЕТ</b> подписку автоматически!\n\n'
-                    '👇 <b>НАЖМИТЕ КНОПКУ НИЖЕ ДЛЯ АКТИВАЦИИ</b> 👇'
-                )
-
-                # Формируем клавиатуру с кнопками действий
-                keyboard_rows: list[list[InlineKeyboardButton]] = []
-
-                # Кнопка активации или продления в зависимости от статуса
-                if has_active_subscription:
-                    # Активная платная подписка - показываем продление и изменение устройств
-                    keyboard_rows.append(
-                        [
-                            build_miniapp_or_callback_button(
-                                text='🔄 ПРОДЛИТЬ ПОДПИСКУ',
-                                callback_data='subscription_extend',
-                            )
-                        ]
-                    )
-                    keyboard_rows.append(
-                        [
-                            build_miniapp_or_callback_button(
-                                text='📱 Изменить количество устройств',
-                                callback_data='subscription_change_devices',
-                            )
-                        ]
-                    )
-                else:
-                    # Нет подписки или истекла - показываем только активацию
-                    keyboard_rows.append(
-                        [
-                            build_miniapp_or_callback_button(
-                                text='🔥 АКТИВИРОВАТЬ ПОДПИСКУ',
-                                callback_data='menu_buy',
-                            )
-                        ]
-                    )
-
-                keyboard = InlineKeyboardMarkup(inline_keyboard=keyboard_rows)
-            else:
-                # Стандартное сообщение с полной клавиатурой
-                keyboard = await self.build_topup_success_keyboard(user_snapshot)
-                message = (
-                    '✅ <b>Платеж успешно завершен!</b>\n\n'
-                    f'💰 Сумма: {settings.format_price(amount_kopeks)}\n'
-                    f'💳 Способ: {payment_method}\n\n'
-                    'Средства зачислены на ваш баланс!\n\n'
-                    '⚠️ <b>Важно:</b> Пополнение баланса не активирует подписку автоматически. '
-                    'Обязательно активируйте подписку отдельно!\n\n'
-                    f'🔄 При наличии сохранённой корзины подписки и включенной автопокупке, '
-                    f'подписка будет приобретена автоматически после пополнения баланса.'
-                )
+            # Стандартное сообщение с полной клавиатурой
+            keyboard = await self.build_topup_success_keyboard(user_snapshot)
+            message = (
+                '✅ <b>Платеж успешно завершен!</b>\n\n'
+                f'💰 Сумма: {settings.format_price(amount_kopeks)}\n'
+                f'💳 Способ: {payment_method}\n\n'
+                'Средства зачислены на ваш баланс!\n\n'
+                '⚠️ <b>Важно:</b> Пополнение баланса не активирует подписку автоматически. '
+                'Обязательно активируйте подписку отдельно!\n\n'
+                f'🔄 При наличии сохранённой корзины подписки и включенной автопокупке, '
+                f'подписка будет приобретена автоматически после пополнения баланса.'
+            )

            await self.bot.send_message(
                chat_id=telegram_id,
@@ -14,7 +14,6 @@ from app.config import settings
 from app.database.database import AsyncSessionLocal
 from app.database.models import PaymentMethod, TransactionType
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.services.subscription_renewal_service import (
@@ -361,26 +360,7 @@ class CryptoBotPaymentMixin:
                        if auto_purchase_success:
                            has_saved_cart = False

-                    # Умная автоактивация если автопокупка не сработала
-                    activation_notification_sent = False
-                    if not auto_purchase_success:
-                        try:
-                            _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                                db,
-                                user,
-                                bot=bot_instance,
-                                topup_amount=amount_kopeks,
-                            )
-                        except Exception as auto_activate_error:
-                            logger.error(
-                                'Ошибка умной автоактивации для пользователя %s: %s',
-                                user.id,
-                                auto_activate_error,
-                                exc_info=True,
-                            )
-
-                    # Отправляем уведомление только если его ещё не отправили
-                    if has_saved_cart and bot_instance and not activation_notification_sent:
+                    if has_saved_cart and bot_instance:
                        from app.localization.texts import get_texts

                        texts = get_texts(user.language)
@@ -14,7 +14,6 @@ from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.freekassa_service import freekassa_service
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -388,23 +387,7 @@ class FreekassaPaymentMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        db, user, bot=getattr(self, 'bot', None), topup_amount=payment.amount_kopeks
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили
-            if has_saved_cart and getattr(self, 'bot', None) and not activation_notification_sent and user.telegram_id:
+            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                from app.localization.texts import get_texts

                texts = get_texts(user.language)
@@ -13,7 +13,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -452,22 +451,6 @@ class HeleketPaymentMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            if not auto_purchase_success:
-                try:
-                    await auto_activate_subscription_after_topup(
-                        db,
-                        user,
-                        bot=getattr(self, 'bot', None),
-                        topup_amount=amount_kopeks,
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
        except Exception as error:
            logger.error(
                'Ошибка при работе с автоактивацией для пользователя %s: %s',
@@ -14,7 +14,6 @@ from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.kassa_ai_service import kassa_ai_service
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -339,34 +338,14 @@ class KassaAiPaymentMixin:
            try:
                display_name = settings.get_kassa_ai_display_name()

-                if settings.SHOW_ACTIVATION_PROMPT_AFTER_TOPUP:
-                    # Яркое сообщение для тупых
-                    from aiogram import types
-
-                    message = (
-                        '✅ <b>Платеж успешно завершен!</b>\n\n'
-                        f'💰 Сумма: {settings.format_price(payment.amount_kopeks)}\n'
-                        f'💳 Способ: {display_name}\n\n'
-                        '💎 Средства зачислены на ваш баланс!\n\n'
-                        '‼️ <b>ВНИМАНИЕ! ОБЯЗАТЕЛЬНО АКТИВИРУЙТЕ ПОДПИСКУ!</b> ‼️\n\n'
-                        '⚠️ Пополнение баланса <b>НЕ АКТИВИРУЕТ</b> подписку автоматически!\n\n'
-                        '👇 <b>НАЖМИТЕ КНОПКУ НИЖЕ ДЛЯ АКТИВАЦИИ</b> 👇'
-                    )
-                    keyboard = types.InlineKeyboardMarkup(
-                        inline_keyboard=[
-                            [types.InlineKeyboardButton(text='🔥 АКТИВИРОВАТЬ ПОДПИСКУ', callback_data='menu_buy')],
-                        ]
-                    )
-                else:
-                    # Стандартное сообщение (как было раньше)
-                    keyboard = await self.build_topup_success_keyboard(user)
-                    message = (
-                        '✅ <b>Пополнение успешно!</b>\n\n'
-                        f'💰 Сумма: {settings.format_price(payment.amount_kopeks)}\n'
-                        f'💳 Способ: {display_name}\n'
-                        f'🆔 Транзакция: {transaction.id}\n\n'
-                        'Баланс пополнен автоматически!'
-                    )
+                keyboard = await self.build_topup_success_keyboard(user)
+                message = (
+                    '✅ <b>Пополнение успешно!</b>\n\n'
+                    f'💰 Сумма: {settings.format_price(payment.amount_kopeks)}\n'
+                    f'💳 Способ: {display_name}\n'
+                    f'🆔 Транзакция: {transaction.id}\n\n'
+                    'Баланс пополнен автоматически!'
+                )

                await self.bot.send_message(
                    user.telegram_id,
@@ -404,23 +383,7 @@ class KassaAiPaymentMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        db, user, bot=getattr(self, 'bot', None), topup_amount=payment.amount_kopeks
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили
-            if has_saved_cart and getattr(self, 'bot', None) and not activation_notification_sent and user.telegram_id:
+            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                from app.localization.texts import get_texts

                texts = get_texts(user.language)
@@ -11,7 +11,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -390,28 +389,7 @@ class MulenPayPaymentMixin:
                        if auto_purchase_success:
                            has_saved_cart = False

-                    # Умная автоактивация если автопокупка не сработала
-                    activation_notification_sent = False
-                    if not auto_purchase_success:
-                        try:
-                            _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                                db, user, bot=getattr(self, 'bot', None), topup_amount=payment.amount_kopeks
-                            )
-                        except Exception as auto_activate_error:
-                            logger.error(
-                                'Ошибка умной автоактивации для пользователя %s: %s',
-                                user.id,
-                                auto_activate_error,
-                                exc_info=True,
-                            )
-
-                    # Отправляем уведомление только если его ещё не отправили и есть telegram_id
-                    if (
-                        has_saved_cart
-                        and getattr(self, 'bot', None)
-                        and not activation_notification_sent
-                        and user.telegram_id
-                    ):
+                    if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                        # Если у пользователя есть сохраненная корзина,
                        # отправляем ему уведомление с кнопкой вернуться к оформлению
                        from app.localization.texts import get_texts
@@ -13,7 +13,6 @@ from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.pal24_service import Pal24APIError
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -489,23 +488,7 @@ class Pal24PaymentMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        db, user, bot=getattr(self, 'bot', None), topup_amount=payment.amount_kopeks
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили
-            if has_saved_cart and getattr(self, 'bot', None) and not activation_notification_sent and user.telegram_id:
+            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                from app.localization.texts import get_texts

                texts = get_texts(user.language)
@@ -13,7 +13,6 @@ from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.platega_service import PlategaService
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -470,23 +469,7 @@ class PlategaPaymentMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        db, user, bot=getattr(self, 'bot', None), topup_amount=payment.amount_kopeks
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили
-            if has_saved_cart and getattr(self, 'bot', None) and not activation_notification_sent and user.telegram_id:
+            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                from app.localization.texts import get_texts

                texts = get_texts(user.language)
@@ -19,7 +19,6 @@ from app.database.crud.user import get_user_by_id
 from app.database.models import PaymentMethod, TransactionType
 from app.external.telegram_stars import TelegramStarsService
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -534,26 +533,7 @@ class TelegramStarsMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        db,
-                        user,
-                        bot=getattr(self, 'bot', None),
-                        topup_amount=amount_kopeks,
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили
-            if has_saved_cart and getattr(self, 'bot', None) and not activation_notification_sent and user.telegram_id:
+            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                texts = get_texts(user.language)
                cart_message = texts.t(
                    'BALANCE_TOPUP_CART_REMINDER_DETAILED',
@@ -12,7 +12,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.services.wata_service import WataAPIError, WataService
@@ -575,23 +574,7 @@ class WataPaymentMixin:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        db, user, bot=getattr(self, 'bot', None), topup_amount=payment.amount_kopeks
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили
-            if has_saved_cart and getattr(self, 'bot', None) and not activation_notification_sent and user.telegram_id:
+            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
                from app.localization.texts import get_texts

                texts = get_texts(user.language)
@@ -16,7 +16,6 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from app.config import settings
 from app.database.models import PaymentMethod, TransactionType
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.payment_logger import payment_logger as logger
@@ -847,78 +846,59 @@ class YooKassaPaymentMixin:
                            if auto_purchase_success:
                                has_saved_cart = False

-                        # Умная автоактивация если автопокупка не сработала
-                        if not auto_purchase_success:
-                            try:
-                                await auto_activate_subscription_after_topup(
-                                    db,
-                                    user,
-                                    bot=getattr(self, 'bot', None),
-                                )
-                            except Exception as auto_activate_error:
-                                logger.error(
-                                    'Ошибка умной автоактивации для пользователя %s: %s',
-                                    user.id,
-                                    auto_activate_error,
-                                    exc_info=True,
-                                )
+                        if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
+                            # Если у пользователя есть сохраненная корзина,
+                            # отправляем ему уведомление с кнопкой вернуться к оформлению
+                            from aiogram import types

-                        # Если включен яркий промпт активации, пропускаем старое уведомление
-                        # т.к. оно будет отправлено через _send_payment_success_notification
-                        if not settings.SHOW_ACTIVATION_PROMPT_AFTER_TOPUP:
-                            if has_saved_cart and getattr(self, 'bot', None) and user.telegram_id:
-                                # Если у пользователя есть сохраненная корзина,
-                                # отправляем ему уведомление с кнопкой вернуться к оформлению
-                                from aiogram import types
+                            from app.localization.texts import get_texts

-                                from app.localization.texts import get_texts
+                            texts = get_texts(user.language)
+                            cart_message = texts.BALANCE_TOPUP_CART_REMINDER_DETAILED.format(
+                                total_amount=settings.format_price(payment.amount_kopeks)
+                            )

-                                texts = get_texts(user.language)
-                                cart_message = texts.BALANCE_TOPUP_CART_REMINDER_DETAILED.format(
-                                    total_amount=settings.format_price(payment.amount_kopeks)
-                                )
+                            # Создаем клавиатуру с кнопками
+                            keyboard = types.InlineKeyboardMarkup(
+                                inline_keyboard=[
+                                    [
+                                        types.InlineKeyboardButton(
+                                            text=texts.RETURN_TO_SUBSCRIPTION_CHECKOUT,
+                                            callback_data='return_to_saved_cart',
+                                        )
+                                    ],
+                                    [
+                                        types.InlineKeyboardButton(
+                                            text='💰 Мой баланс',
+                                            callback_data='menu_balance',
+                                        )
+                                    ],
+                                    [
+                                        types.InlineKeyboardButton(
+                                            text='🏠 Главное меню',
+                                            callback_data='back_to_menu',
+                                        )
+                                    ],
+                                ]
+                            )

-                                # Создаем клавиатуру с кнопками
-                                keyboard = types.InlineKeyboardMarkup(
-                                    inline_keyboard=[
-                                        [
-                                            types.InlineKeyboardButton(
-                                                text=texts.RETURN_TO_SUBSCRIPTION_CHECKOUT,
-                                                callback_data='return_to_saved_cart',
-                                            )
-                                        ],
-                                        [
-                                            types.InlineKeyboardButton(
-                                                text='💰 Мой баланс',
-                                                callback_data='menu_balance',
-                                            )
-                                        ],
-                                        [
-                                            types.InlineKeyboardButton(
-                                                text='🏠 Главное меню',
-                                                callback_data='back_to_menu',
-                                            )
-                                        ],
-                                    ]
-                                )
-
-                                await self.bot.send_message(
-                                    chat_id=user.telegram_id,
-                                    text=f'✅ Баланс пополнен на {settings.format_price(payment.amount_kopeks)}!\n\n'
-                                    f'⚠️ <b>Важно:</b> Пополнение баланса не активирует подписку автоматически. '
-                                    f'Обязательно активируйте подписку отдельно!\n\n'
-                                    f'🔄 При наличии сохранённой корзины подписки и включенной автопокупке, '
-                                    f'подписка будет приобретена автоматически после пополнения баланса.\n\n{cart_message}',
-                                    reply_markup=keyboard,
-                                )
-                                logger.info(
-                                    f'Отправлено уведомление с кнопкой возврата к оформлению подписки пользователю {user.id}'
-                                )
-                            else:
-                                logger.info(
-                                    'У пользователя %s нет сохраненной корзины, бот недоступен или покупка уже выполнена',
-                                    user.id,
-                                )
+                            await self.bot.send_message(
+                                chat_id=user.telegram_id,
+                                text=f'✅ Баланс пополнен на {settings.format_price(payment.amount_kopeks)}!\n\n'
+                                f'⚠️ <b>Важно:</b> Пополнение баланса не активирует подписку автоматически. '
+                                f'Обязательно активируйте подписку отдельно!\n\n'
+                                f'🔄 При наличии сохранённой корзины подписки и включенной автопокупке, '
+                                f'подписка будет приобретена автоматически после пополнения баланса.\n\n{cart_message}',
+                                reply_markup=keyboard,
+                            )
+                            logger.info(
+                                f'Отправлено уведомление с кнопкой возврата к оформлению подписки пользователю {user.id}'
+                            )
+                        else:
+                            logger.info(
+                                'У пользователя %s нет сохраненной корзины, бот недоступен или покупка уже выполнена',
+                                user.id,
+                            )
                    except Exception as e:
                        logger.error(
                            f'Критическая ошибка при работе с сохраненной корзиной для пользователя {user.id}: {e}',
@@ -1328,6 +1308,27 @@ class YooKassaPaymentMixin:
            )
            return None

+        # Verify user exists before creating FK-linked record
+        try:
+            from app.database.crud.user import get_user_by_id
+
+            user = await get_user_by_id(db, user_id)
+            if not user:
+                logger.warning(
+                    'Webhook YooKassa %s: user_id=%s не найден в БД, пропускаем восстановление платежа',
+                    yookassa_payment_id,
+                    user_id,
+                )
+                return None
+        except Exception as e:
+            logger.warning(
+                'Webhook YooKassa %s: не удалось проверить user_id=%s: %s',
+                yookassa_payment_id,
+                user_id,
+                e,
+            )
+            return None
+
        amount_info = event_object.get('amount') or {}
        amount_value = amount_info.get('value')
        currency = (amount_info.get('currency') or 'RUB').upper()
@@ -151,19 +151,20 @@ class RemnaWaveService:
        elif not api_key:
            self._config_error = 'REMNAWAVE_API_KEY не настроен'

-        self.api: RemnaWaveAPI | None
-        if self._config_error:
-            self.api = None
-        else:
-            self.api = RemnaWaveAPI(
-                base_url=base_url,
-                api_key=api_key,
-                secret_key=auth_params.get('secret_key'),
-                username=auth_params.get('username'),
-                password=auth_params.get('password'),
-                caddy_token=auth_params.get('caddy_token'),
-                auth_type=auth_params.get('auth_type') or 'api_key',
-            )
+        # Сохраняем параметры для создания новых экземпляров API клиента
+        # (каждый вызов get_api_client создаёт свой экземпляр, чтобы
+        # параллельные корутины не перезаписывали друг другу aiohttp-сессию)
+        self._api_kwargs: dict | None = None
+        if not self._config_error:
+            self._api_kwargs = {
+                'base_url': base_url,
+                'api_key': api_key,
+                'secret_key': auth_params.get('secret_key'),
+                'username': auth_params.get('username'),
+                'password': auth_params.get('password'),
+                'caddy_token': auth_params.get('caddy_token'),
+                'auth_type': auth_params.get('auth_type') or 'api_key',
+            }

    @property
    def is_configured(self) -> bool:
@@ -174,7 +175,7 @@ class RemnaWaveService:
        return self._config_error

    def _ensure_configured(self) -> None:
-        if not self.is_configured or self.api is None:
+        if not self.is_configured or self._api_kwargs is None:
            raise RemnaWaveConfigurationError(self._config_error or 'RemnaWave API не настроен')

    def _ensure_user_remnawave_uuid(
@@ -228,8 +229,9 @@ class RemnaWaveService:
    @asynccontextmanager
    async def get_api_client(self):
        self._ensure_configured()
-        assert self.api is not None
-        async with self.api as api:
+        assert self._api_kwargs is not None
+        api = RemnaWaveAPI(**self._api_kwargs)
+        async with api:
            yield api

    def _now_utc(self) -> datetime:
@@ -1439,12 +1441,14 @@ class RemnaWaveService:

                # Используем один API клиент для всех операций сброса HWID
                hwid_api_client = None
+                hwid_api_cm = None
                try:
-                    hwid_api_client = self.get_api_client()
-                    await hwid_api_client.__aenter__()
+                    hwid_api_cm = self.get_api_client()
+                    hwid_api_client = await hwid_api_cm.__aenter__()
                except Exception as api_init_error:
                    logger.warning(f'⚠️ Не удалось создать API клиент для сброса HWID: {api_init_error}')
                    hwid_api_client = None
+                    hwid_api_cm = None

                try:
                    for telegram_id, db_user in users_to_deactivate:
@@ -1565,9 +1569,9 @@ class RemnaWaveService:

                finally:
                    # Закрываем API клиент
-                    if hwid_api_client:
+                    if hwid_api_cm:
                        try:
-                            await hwid_api_client.__aexit__(None, None, None)
+                            await hwid_api_cm.__aexit__(None, None, None)
                        except Exception:
                            pass

@@ -1678,38 +1682,47 @@ class RemnaWaveService:
                # expire_at приходит в UTC (naive) из _parse_remnawave_date
                expire_at = self._parse_remnawave_date(expire_at_str)

-                # Конвертируем локальную дату из БД в UTC для корректного сравнения
-                # subscription.end_date хранится в локальной таймзоне (MSK)
-                local_end_date_utc = self._local_to_utc(subscription.end_date)
+                # Обновляем end_date только если пользователь ACTIVE в панели.
+                # Для EXPIRED/DISABLED панель может содержать искусственную дату
+                # (установленную _safe_expire_at_for_panel при sync_users_to_panel),
+                # которая не должна перезаписывать реальную дату окончания подписки.
+                if panel_status == 'ACTIVE':
+                    # Конвертируем локальную дату из БД в UTC для корректного сравнения
+                    local_end_date_utc = self._local_to_utc(subscription.end_date)

-                # КРИТИЧНО: НЕ перезаписываем end_date если локальная дата ПОЗЖЕ
-                # Это защищает от ситуации когда подписка была продлена в боте,
-                # но RemnaWave ещё не получил обновление или вернул старую дату
-                time_diff = abs((local_end_date_utc - expire_at).total_seconds())
-                if time_diff > 60:
-                    if expire_at > local_end_date_utc:
-                        # RemnaWave имеет более позднюю дату - обновляем
-                        # Конвертируем UTC обратно в локальное время для сохранения в БД
-                        new_end_date_local = (
-                            expire_at.replace(tzinfo=self._utc_timezone)
-                            .astimezone(self._panel_timezone)
-                            .replace(tzinfo=None)
-                        )
-                        logger.info(
-                            f'✅ Sync: обновлена end_date для user {getattr(user, "telegram_id", "?")}: '
-                            f'{subscription.end_date} -> {new_end_date_local} (разница: {time_diff:.0f}с)'
-                        )
-                        subscription.end_date = new_end_date_local
+                    # КРИТИЧНО: НЕ перезаписываем end_date если локальная дата ПОЗЖЕ
+                    # Это защищает от ситуации когда подписка была продлена в боте,
+                    # но RemnaWave ещё не получил обновление или вернул старую дату
+                    time_diff = abs((local_end_date_utc - expire_at).total_seconds())
+                    if time_diff > 60:
+                        if expire_at > local_end_date_utc:
+                            # RemnaWave имеет более позднюю дату - обновляем
+                            # Конвертируем UTC обратно в локальное время для сохранения в БД
+                            new_end_date_local = (
+                                expire_at.replace(tzinfo=self._utc_timezone)
+                                .astimezone(self._panel_timezone)
+                                .replace(tzinfo=None)
+                            )
+                            logger.info(
+                                f'✅ Sync: обновлена end_date для user {getattr(user, "telegram_id", "?")}: '
+                                f'{subscription.end_date} -> {new_end_date_local} (разница: {time_diff:.0f}с)'
+                            )
+                            subscription.end_date = new_end_date_local
+                        else:
+                            # Локальная дата позже - НЕ перезаписываем
+                            logger.debug(
+                                f'⏭️ Sync: end_date для user {getattr(user, "telegram_id", "?")} актуальна: '
+                                f'локальная ({subscription.end_date} / UTC: {local_end_date_utc}) >= RemnaWave ({expire_at} UTC)'
+                            )
                    else:
-                        # Локальная дата позже - НЕ перезаписываем
                        logger.debug(
-                            f'⏭️ Sync: end_date для user {getattr(user, "telegram_id", "?")} актуальна: '
-                            f'локальная ({subscription.end_date} / UTC: {local_end_date_utc}) >= RemnaWave ({expire_at} UTC)'
+                            f'⏭️ Sync: пропускаем обновление end_date для user {getattr(user, "telegram_id", "?")}: '
+                            f'разница слишком мала ({time_diff:.0f}с < 60с)'
                        )
                else:
                    logger.debug(
                        f'⏭️ Sync: пропускаем обновление end_date для user {getattr(user, "telegram_id", "?")}: '
-                        f'разница слишком мала ({time_diff:.0f}с < 60с)'
+                        f'панель не ACTIVE (статус: {panel_status})'
                    )

            current_time = self._now_utc()
@@ -1857,6 +1870,8 @@ class RemnaWaveService:
                                    full_name=user.full_name,
                                    username=user.username,
                                    telegram_id=user.telegram_id,
+                                    email=user.email,
+                                    user_id=user.id,
                                )

                                create_kwargs = dict(
@@ -1891,6 +1906,15 @@ class RemnaWaveService:
                                        panel_uuid = existing_users[0].uuid
                                        logger.debug(f'Найден пользователь {user.telegram_id} в панели: {panel_uuid}')

+                                # Fallback: поиск по email (для OAuth юзеров без telegram_id)
+                                if not panel_uuid and user.email:
+                                    existing_users = await api.get_user_by_email(user.email)
+                                    if existing_users:
+                                        panel_uuid = existing_users[0].uuid
+                                        logger.debug(
+                                            f'Найден пользователь {user.email} в панели по email: {panel_uuid}'
+                                        )
+
                                if panel_uuid:
                                    update_kwargs = dict(
                                        uuid=panel_uuid,
@@ -5,7 +5,6 @@
 """

 import logging
-import os
 from datetime import datetime
 from typing import Final

@@ -24,7 +23,6 @@ from app.utils.timezone import format_local_datetime
 logger = logging.getLogger(__name__)

 # Константы
-VERSION_ENV_VAR: Final[str] = 'VERSION'
 DEFAULT_VERSION: Final[str] = 'dev'
 DEFAULT_AUTH_TYPE: Final[str] = 'api_key'

@@ -70,10 +68,20 @@ class StartupNotificationService:
        self.enabled = getattr(settings, 'ADMIN_NOTIFICATIONS_ENABLED', False)

    def _get_version(self) -> str:
-        """Получает версию из переменной окружения VERSION."""
-        version = os.getenv(VERSION_ENV_VAR, '').strip()
-        if version:
-            return version
+        """Получает версию из pyproject.toml."""
+        try:
+            from pathlib import Path
+
+            pyproject_path = Path(__file__).resolve().parents[2] / 'pyproject.toml'
+            if pyproject_path.exists():
+                for line in pyproject_path.read_text().splitlines():
+                    if line.strip().startswith('version'):
+                        ver = line.split('=', 1)[1].strip().strip('"').strip("'")
+                        if ver:
+                            return ver
+        except Exception:
+            pass
+
        return DEFAULT_VERSION

    async def _get_users_count(self) -> int:
@@ -1814,340 +1814,4 @@ async def auto_purchase_saved_cart_after_topup(
    return True


-async def auto_activate_subscription_after_topup(
-    db: AsyncSession,
-    user: User,
-    *,
-    bot: Bot | None = None,
-    topup_amount: int | None = None,
-) -> tuple[bool, bool]:
-    """
-    Умная автоактивация после пополнения баланса.
-
-    Работает БЕЗ сохранённой корзины:
-    - Если подписка активна — ничего не делает
-    - Если подписка истекла — продлевает с теми же параметрами
-    - Если подписки нет — создаёт новую с дефолтными параметрами
-
-    Выбирает максимальный период, который можно оплатить из баланса.
-
-    Args:
-        topup_amount: Сумма пополнения в копейках (для отображения в уведомлении)
-
-    Returns:
-        tuple[bool, bool]: (success, notification_sent)
-            - success: True если подписка активирована
-            - notification_sent: True если уведомление отправлено пользователю
-    """
-    from datetime import datetime
-
-    # Lazy imports to avoid circular dependency
-    from app.cabinet.routes.websocket import (
-        notify_user_subscription_activated,
-        notify_user_subscription_renewed,
-    )
-    from app.database.crud.server_squad import get_available_server_squads, get_server_ids_by_uuids
-    from app.database.crud.subscription import create_paid_subscription, get_subscription_by_user_id
-    from app.database.crud.transaction import create_transaction
-    from app.database.crud.user import subtract_user_balance
-    from app.database.models import PaymentMethod, TransactionType
-    from app.services.admin_notification_service import AdminNotificationService
-    from app.services.subscription_renewal_service import SubscriptionRenewalService
-    from app.services.subscription_service import SubscriptionService
-
-    if not user or not getattr(user, 'id', None):
-        return (False, False)
-
-    subscription = await get_subscription_by_user_id(db, user.id)
-
-    # Если автоактивация отключена - уведомление отправится из _send_payment_success_notification
-    if not settings.is_auto_activate_after_topup_enabled():
-        logger.info(
-            '⚠️ Автоактивация отключена для пользователя %s, уведомление будет отправлено из payment service',
-            _format_user_id(user),
-        )
-        return (False, False)
-
-    # Если подписка активна — ничего не делаем (автоактивация включена, но подписка уже есть)
-    if subscription and subscription.status == 'ACTIVE' and subscription.end_date > datetime.utcnow():
-        logger.info(
-            '🔁 Автоактивация: у пользователя %s уже активная подписка, пропускаем',
-            _format_user_id(user),
-        )
-        return (False, False)
-
-    # Определяем параметры подписки
-    if subscription:
-        device_limit = subscription.device_limit or settings.DEFAULT_DEVICE_LIMIT
-        # В режиме fixed_with_topup при автоактивации используем фиксированный лимит
-        if settings.is_traffic_fixed():
-            traffic_limit_gb = settings.get_fixed_traffic_limit()
-        else:
-            traffic_limit_gb = subscription.traffic_limit_gb or 0
-        connected_squads = subscription.connected_squads or []
-    else:
-        device_limit = settings.DEFAULT_DEVICE_LIMIT
-        # В режиме fixed_with_topup при автоактивации используем фиксированный лимит
-        if settings.is_traffic_fixed():
-            traffic_limit_gb = settings.get_fixed_traffic_limit()
-        else:
-            traffic_limit_gb = 0
-        connected_squads = []
-
-    # Если серверы не выбраны — берём бесплатные по умолчанию
-    if not connected_squads:
-        available_servers = await get_available_server_squads(db, promo_group_id=user.promo_group_id)
-        connected_squads = [s.squad_uuid for s in available_servers if s.is_available and s.price_kopeks == 0]
-        if not connected_squads and available_servers:
-            connected_squads = [available_servers[0].squad_uuid]
-
-    server_ids = await get_server_ids_by_uuids(db, connected_squads) if connected_squads else []
-
-    balance = user.balance_kopeks
-    available_periods = sorted(settings.get_available_subscription_periods(), reverse=True)
-
-    if not available_periods:
-        logger.warning('🔁 Автоактивация: нет доступных периодов подписки')
-        return (False, False)
-
-    subscription_service = SubscriptionService()
-
-    # Найти максимальный период <= баланса
-    best_period = None
-    best_price = 0
-
-    for period in available_periods:
-        try:
-            price, _ = await subscription_service.calculate_subscription_price_with_months(
-                period, traffic_limit_gb, server_ids, device_limit, db, user=user
-            )
-            if price <= balance:
-                best_period = period
-                best_price = price
-                break
-        except Exception as calc_error:
-            logger.warning(
-                '🔁 Автоактивация: ошибка расчёта цены для периода %s: %s',
-                period,
-                calc_error,
-            )
-            continue
-
-    if not best_period:
-        logger.info(
-            '🔁 Автоактивация: у пользователя %s недостаточно средств (%s) для любого периода',
-            _format_user_id(user),
-            balance,
-        )
-        # Уведомление отправится из _send_payment_success_notification
-        logger.info(
-            '⚠️ Недостаточно средств для автоактивации пользователя %s, уведомление будет отправлено из payment service',
-            _format_user_id(user),
-        )
-        return (False, False)
-
-    texts = get_texts(getattr(user, 'language', 'ru'))
-
-    try:
-        if subscription:
-            # Продление существующей подписки
-            renewal_service = SubscriptionRenewalService()
-            pricing = await renewal_service.calculate_pricing(db, user, subscription, best_period)
-
-            result = await renewal_service.finalize(
-                db,
-                user,
-                subscription,
-                pricing,
-                description=f'Автоматическое продление на {best_period} дней',
-                payment_method=PaymentMethod.BALANCE,
-            )
-
-            logger.info(
-                '✅ Автоактивация: подписка пользователя %s продлена на %s дней за %s коп.',
-                _format_user_id(user),
-                best_period,
-                best_price,
-            )
-
-            # Send WebSocket notification to cabinet frontend
-            try:
-                await notify_user_subscription_renewed(
-                    user_id=user.id,
-                    new_expires_at=result.subscription.end_date.isoformat() if result.subscription.end_date else '',
-                    amount_kopeks=best_price,
-                )
-            except Exception as ws_error:
-                logger.warning(
-                    '⚠️ Автоактивация: не удалось отправить WS уведомление о продлении для %s: %s',
-                    _format_user_id(user),
-                    ws_error,
-                )
-
-            # Уведомление пользователю (только для Telegram-пользователей)
-            if bot and user.telegram_id:
-                try:
-                    period_label = format_period_description(best_period, getattr(user, 'language', 'ru'))
-                    new_end_date = result.subscription.end_date
-                    end_date_str = new_end_date.strftime('%d.%m.%Y') if new_end_date else '—'
-
-                    message = texts.t(
-                        'AUTO_PURCHASE_SUBSCRIPTION_EXTENDED',
-                        '✅ Подписка автоматически продлена на {period}.',
-                    ).format(period=period_label)
-
-                    details = texts.t(
-                        'AUTO_PURCHASE_SUBSCRIPTION_EXTENDED_DETAILS',
-                        '⏰ Новая дата окончания: {date}.',
-                    ).format(date=end_date_str)
-
-                    hint = texts.t(
-                        'AUTO_PURCHASE_SUBSCRIPTION_HINT',
-                        'Перейдите в раздел «Моя подписка», чтобы получить ссылку.',
-                    )
-
-                    keyboard = InlineKeyboardMarkup(
-                        inline_keyboard=[
-                            [
-                                InlineKeyboardButton(
-                                    text=texts.t('MY_SUBSCRIPTION_BUTTON', '📱 Моя подписка'),
-                                    callback_data='menu_subscription',
-                                )
-                            ],
-                        ]
-                    )
-
-                    await bot.send_message(
-                        chat_id=user.telegram_id,
-                        text=f'{message}\n{details}\n\n{hint}',
-                        reply_markup=keyboard,
-                        parse_mode='HTML',
-                    )
-                except Exception as notify_error:
-                    logger.warning(
-                        '⚠️ Автоактивация: не удалось уведомить пользователя %s: %s',
-                        user.telegram_id or user.id,
-                        notify_error,
-                    )
-
-        else:
-            # Создание новой подписки
-            new_subscription = await create_paid_subscription(
-                db,
-                user.id,
-                best_period,
-                traffic_limit_gb=traffic_limit_gb,
-                device_limit=device_limit,
-                connected_squads=connected_squads,
-                update_server_counters=True,
-            )
-
-            await subtract_user_balance(db, user, best_price, f'Активация подписки на {best_period} дней')
-
-            await subscription_service.create_remnawave_user(db, new_subscription)
-
-            await create_transaction(
-                db=db,
-                user_id=user.id,
-                type=TransactionType.SUBSCRIPTION_PAYMENT,
-                amount_kopeks=best_price,
-                description=f'Активация подписки на {best_period} дней',
-                payment_method=PaymentMethod.BALANCE,
-            )
-
-            logger.info(
-                '✅ Автоактивация: новая подписка на %s дней создана для пользователя %s за %s коп.',
-                best_period,
-                _format_user_id(user),
-                best_price,
-            )
-
-            # Send WebSocket notification to cabinet frontend
-            try:
-                await notify_user_subscription_activated(
-                    user_id=user.id,
-                    expires_at=new_subscription.end_date.isoformat() if new_subscription.end_date else '',
-                    tariff_name='',
-                )
-            except Exception as ws_error:
-                logger.warning(
-                    '⚠️ Автоактивация: не удалось отправить WS уведомление об активации для %s: %s',
-                    _format_user_id(user),
-                    ws_error,
-                )
-
-            # Уведомление пользователю (только для Telegram-пользователей)
-            if bot and user.telegram_id:
-                try:
-                    period_label = format_period_description(best_period, getattr(user, 'language', 'ru'))
-
-                    message = texts.t(
-                        'AUTO_PURCHASE_SUBSCRIPTION_SUCCESS',
-                        '✅ Подписка на {period} автоматически оформлена после пополнения баланса.',
-                    ).format(period=period_label)
-
-                    hint = texts.t(
-                        'AUTO_PURCHASE_SUBSCRIPTION_HINT',
-                        'Перейдите в раздел «Моя подписка», чтобы получить ссылку.',
-                    )
-
-                    keyboard = InlineKeyboardMarkup(
-                        inline_keyboard=[
-                            [
-                                InlineKeyboardButton(
-                                    text=texts.t('MY_SUBSCRIPTION_BUTTON', '📱 Моя подписка'),
-                                    callback_data='menu_subscription',
-                                )
-                            ],
-                        ]
-                    )
-
-                    await bot.send_message(
-                        chat_id=user.telegram_id,
-                        text=f'{message}\n\n{hint}',
-                        reply_markup=keyboard,
-                        parse_mode='HTML',
-                    )
-
-                except Exception as notify_error:
-                    logger.warning(
-                        '⚠️ Автоактивация: не удалось уведомить пользователя %s: %s',
-                        user.telegram_id or user.id,
-                        notify_error,
-                    )
-
-            # Уведомление админам (независимо от telegram_id)
-            if bot:
-                try:
-                    notification_service = AdminNotificationService(bot)
-                    await notification_service.send_subscription_purchase_notification(
-                        db,
-                        user,
-                        new_subscription,
-                        None,  # transaction
-                        best_period,
-                        False,  # was_trial_conversion
-                    )
-                except Exception as admin_error:
-                    logger.warning(
-                        '⚠️ Автоактивация: не удалось уведомить админов: %s',
-                        admin_error,
-                    )
-
-        return (True, True)  # success=True, notification_sent=True (об активации)
-
-    except Exception as e:
-        logger.error(
-            '❌ Автоактивация: ошибка для пользователя %s: %s',
-            _format_user_id(user),
-            e,
-            exc_info=True,
-        )
-        try:
-            await db.rollback()
-        except Exception:
-            pass
-        return (False, False)
-
-
-__all__ = ['auto_activate_subscription_after_topup', 'auto_purchase_saved_cart_after_topup']
+__all__ = ['auto_purchase_saved_cart_after_topup']
@@ -205,17 +205,24 @@ class SubscriptionService:

                # Ищем существующего пользователя в панели
                existing_users = []
-                if user.telegram_id:
-                    existing_users = await api.get_user_by_telegram_id(user.telegram_id)
-                elif user.remnawave_uuid:
-                    # Для email-пользователей ищем по uuid если есть
+                if user.remnawave_uuid:
                    try:
-                        existing_user = await api.get_user(user.remnawave_uuid)
+                        existing_user = await api.get_user_by_uuid(user.remnawave_uuid)
                        if existing_user:
                            existing_users = [existing_user]
                    except Exception:
                        pass

+                if not existing_users and user.telegram_id:
+                    existing_users = await api.get_user_by_telegram_id(user.telegram_id)
+
+                # Fallback: поиск по email (для OAuth юзеров без telegram_id)
+                if not existing_users and user.email:
+                    try:
+                        existing_users = await api.get_user_by_email(user.email)
+                    except Exception:
+                        pass
+
                if existing_users:
                    logger.info(f'🔄 Найден существующий пользователь в панели для {self._format_user_log(user)}')
                    remnawave_user = existing_users[0]
@@ -260,7 +260,6 @@ class BotConfigurationService:
        'PAYMENT_BALANCE_TEMPLATE': 'PAYMENT',
        'PAYMENT_SUBSCRIPTION_TEMPLATE': 'PAYMENT',
        'AUTO_PURCHASE_AFTER_TOPUP_ENABLED': 'PAYMENT',
-        'SHOW_ACTIVATION_PROMPT_AFTER_TOPUP': 'PAYMENT',
        'SIMPLE_SUBSCRIPTION_ENABLED': 'SIMPLE_SUBSCRIPTION',
        'SIMPLE_SUBSCRIPTION_PERIOD_DAYS': 'SIMPLE_SUBSCRIPTION',
        'SIMPLE_SUBSCRIPTION_DEVICE_LIMIT': 'SIMPLE_SUBSCRIPTION',
@@ -465,6 +464,12 @@ class BotConfigurationService:
            ChoiceOption('ERROR', '❌ Error'),
            ChoiceOption('CRITICAL', '🔥 Critical'),
        ],
+        'TRIAL_DISABLED_FOR': [
+            ChoiceOption('none', '✅ Включён для всех'),
+            ChoiceOption('email', '📧 Отключён для Email'),
+            ChoiceOption('telegram', '📱 Отключён для Telegram'),
+            ChoiceOption('all', '🚫 Отключён для всех'),
+        ],
    }

    SETTING_HINTS: dict[str, dict[str, str]] = {
@@ -579,19 +584,6 @@ class BotConfigurationService:
            'example': 'true',
            'warning': ('Используйте с осторожностью: средства будут списаны мгновенно, если корзина найдена.'),
        },
-        'SHOW_ACTIVATION_PROMPT_AFTER_TOPUP': {
-            'description': (
-                'Включает режим яркого промпта активации подписки после пополнения баланса. '
-                'Вместо обычного уведомления пользователь получит яркое сообщение с восклицательными знаками '
-                'и кнопками для активации/продления подписки или изменения количества устройств.'
-            ),
-            'format': 'Булево значение.',
-            'example': 'true',
-            'warning': (
-                'При включении пользователи будут получать только яркое уведомление без кнопок баланса и главного меню. '
-                'Эти кнопки появятся после выполнения действия (активация/продление/изменение устройств).'
-            ),
-        },
        'SUPPORT_TICKET_SLA_MINUTES': {
            'description': 'Лимит времени для ответа модераторов на тикет в минутах.',
            'format': 'Целое число от 1 до 1440.',
@@ -14,7 +14,6 @@ from app.database.models import PaymentMethod, TransactionType
 from app.external.tribute import TributeService as TributeAPI
 from app.services.payment_service import PaymentService
 from app.services.subscription_auto_purchase_service import (
-    auto_activate_subscription_after_topup,
    auto_purchase_saved_cart_after_topup,
 )
 from app.utils.user_utils import format_referrer_info
@@ -307,23 +306,8 @@ class TributeService:
                if auto_purchase_success:
                    has_saved_cart = False

-            # Умная автоактивация если автопокупка не сработала
-            activation_notification_sent = False
-            if not auto_purchase_success:
-                try:
-                    _, activation_notification_sent = await auto_activate_subscription_after_topup(
-                        session, user, bot=self.bot, topup_amount=amount_kopeks
-                    )
-                except Exception as auto_activate_error:
-                    logger.error(
-                        'Ошибка умной автоактивации для пользователя %s: %s',
-                        user.id,
-                        auto_activate_error,
-                        exc_info=True,
-                    )
-
-            # Отправляем уведомление только если его ещё не отправили и есть telegram_id
-            if has_saved_cart and self.bot and not activation_notification_sent and user_id:
+            # Отправляем уведомление только если есть сохранённая корзина и telegram_id
+            if has_saved_cart and self.bot and user_id:
                # Если у пользователя есть сохраненная корзина,
                # отправляем ему уведомление с кнопкой вернуться к оформлению
                from aiogram import types
@@ -1145,25 +1145,41 @@ class UserService:
                'new_month': 0,
            }

-    async def cleanup_inactive_users(self, db: AsyncSession, months: int = None) -> int:
+    async def cleanup_inactive_users(self, db: AsyncSession, months: int = None) -> tuple[int, int]:
+        """Clean up inactive users, skipping those with active subscriptions.
+
+        Returns:
+            Tuple of (deleted_count, skipped_active_sub_count).
+        """
        try:
            if months is None:
                months = settings.INACTIVE_USER_DELETE_MONTHS

            inactive_users = await get_inactive_users(db, months)
            deleted_count = 0
+            skipped_active_sub = 0

            for user in inactive_users:
+                # Skip users with active paid subscriptions
+                if user.subscription and user.subscription.is_active:
+                    skipped_active_sub += 1
+                    continue
+
                success = await self.delete_user_account(db, user.id, 0)
                if success:
                    deleted_count += 1

-            logger.info(f'Удалено {deleted_count} неактивных пользователей')
-            return deleted_count
+            if skipped_active_sub > 0:
+                logger.info(
+                    'Пропущено %d неактивных пользователей с активной подпиской',
+                    skipped_active_sub,
+                )
+            logger.info('Удалено %d неактивных пользователей', deleted_count)
+            return deleted_count, skipped_active_sub

        except Exception as e:
-            logger.error(f'Ошибка очистки неактивных пользователей: {e}')
-            return 0
+            logger.error('Ошибка очистки неактивных пользователей: %s', e)
+            return 0, 0

    async def get_user_activity_summary(self, db: AsyncSession, user_id: int) -> dict[str, Any]:
        try:
@@ -82,16 +82,18 @@ class VersionService:
        return 'UNKNOW'

    def _get_current_version(self) -> str:
-        import os
+        try:
+            from pathlib import Path

-        current = os.getenv('VERSION', '').strip()
-
-        if current:
-            if '-' in current and current.startswith('v'):
-                base_version = current.split('-')[0]
-                if base_version.count('.') == 2:
-                    return base_version
-            return current
+            pyproject_path = Path(__file__).resolve().parents[2] / 'pyproject.toml'
+            if pyproject_path.exists():
+                for line in pyproject_path.read_text().splitlines():
+                    if line.strip().startswith('version'):
+                        ver = line.split('=', 1)[1].strip().strip('"').strip("'")
+                        if ver:
+                            return ver
+        except Exception:
+            pass

        return 'UNKNOW'

@@ -87,7 +87,8 @@ def format_time_ago(dt: datetime | str, language: str = 'ru') -> str:


 def format_days_declension(days: int, language: str = 'ru') -> str:
-    if language != 'ru':
+    language_code = (language or 'ru').split('-')[0].lower()
+    if language_code not in {'ru', 'fa'}:
        return f'{days} day{"s" if days != 1 else ""}'

    if days % 10 == 1 and days % 100 != 11:
@@ -180,42 +181,49 @@ def format_subscription_status(is_active: bool, is_trial: bool, end_date: dateti
        except (ValueError, AttributeError):
            end_date = datetime.now()

+    language_code = (language or 'ru').split('-')[0].lower()
+    use_russian_fallback = language_code in {'ru', 'fa'}
+
    if not is_active:
-        return '❌ Неактивна' if language == 'ru' else '❌ Inactive'
+        return '❌ Неактивна' if use_russian_fallback else '❌ Inactive'

    if is_trial:
-        status = '🎁 Тестовая' if language == 'ru' else '🎁 Trial'
+        status = '🎁 Тестовая' if use_russian_fallback else '🎁 Trial'
    else:
-        status = '✅ Активна' if language == 'ru' else '✅ Active'
+        status = '✅ Активна' if use_russian_fallback else '✅ Active'

    now = datetime.utcnow()
    if end_date > now:
        days_left = (end_date - now).days
        if days_left > 0:
-            status += f' ({days_left} дн.)' if language == 'ru' else f' ({days_left} days)'
+            status += f' ({days_left} дн.)' if use_russian_fallback else f' ({days_left} days)'
        else:
            hours_left = (end_date - now).seconds // 3600
-            status += f' ({hours_left} ч.)' if language == 'ru' else f' ({hours_left} hrs)'
+            status += f' ({hours_left} ч.)' if use_russian_fallback else f' ({hours_left} hrs)'
    else:
-        status = '⏰ Истекла' if language == 'ru' else '⏰ Expired'
+        status = '⏰ Истекла' if use_russian_fallback else '⏰ Expired'

    return status


 def format_traffic_usage(used_gb: float, limit_gb: int, language: str = 'ru') -> str:
+    language_code = (language or 'ru').split('-')[0].lower()
+    use_russian_fallback = language_code in {'ru', 'fa'}
+
    if limit_gb == 0:
-        if language == 'ru':
+        if use_russian_fallback:
            return f'{used_gb:.1f} ГБ / ∞'
        return f'{used_gb:.1f} GB / ∞'

    percentage = (used_gb / limit_gb) * 100 if limit_gb > 0 else 0

-    if language == 'ru':
+    if use_russian_fallback:
        return f'{used_gb:.1f} ГБ / {limit_gb} ГБ ({percentage:.1f}%)'
    return f'{used_gb:.1f} GB / {limit_gb} GB ({percentage:.1f}%)'


 def format_boolean(value: bool, language: str = 'ru') -> str:
-    if language == 'ru':
+    language_code = (language or 'ru').split('-')[0].lower()
+    if language_code in {'ru', 'fa'}:
        return '✅ Да' if value else '❌ Нет'
    return '✅ Yes' if value else '❌ No'
@@ -81,7 +81,6 @@ class PaymentLogFilter(logging.Filter):
        'app.external.heleket',
        'app.external.tribute',
        'app.external.yookassa_webhook',
-        'app.external.pal24_webhook',
        'app.external.wata_webhook',
        'app.external.heleket_webhook',
    )
@@ -153,6 +153,26 @@ def github_markdown_to_telegram_html(text: str) -> str:
    return result.strip()


+def _close_open_tags(html: str) -> str:
+    """Find unclosed HTML tags and append closing tags in reverse order."""
+    open_tags: list[str] = []
+    for match in _HTML_TAG_RE.finditer(html):
+        is_closing = match.group(1) == '/'
+        is_self_closing = match.group(4) == '/'
+        tag_name = match.group(2).lower()
+        if is_self_closing:
+            continue
+        if is_closing:
+            if open_tags and open_tags[-1] == tag_name:
+                open_tags.pop()
+        else:
+            open_tags.append(tag_name)
+    # Close remaining open tags in reverse order
+    for tag in reversed(open_tags):
+        html += f'</{tag}>'
+    return html
+
+
 def truncate_for_blockquote(
    description_html: str,
    *,
@@ -191,8 +211,10 @@ def truncate_for_blockquote(
    if len(description_html) <= available:
        return description_html

-    # Truncate, trying not to break mid-tag
-    truncated = description_html[: available - len(ellipsis)]
+    # Reserve space for ellipsis, then iteratively truncate until
+    # the result (with closing tags) fits within the budget.
+    budget = available - len(ellipsis)
+    truncated = description_html[:budget]

    # If we broke an HTML tag, backtrack to before it
    last_open = truncated.rfind('<')
@@ -200,4 +222,16 @@ def truncate_for_blockquote(
    if last_open > last_close:
        truncated = truncated[:last_open]

-    return truncated.rstrip() + ellipsis
+    # Close any unclosed HTML tags to avoid Telegram parse errors
+    closed = _close_open_tags(truncated)
+
+    # If closing tags pushed us over budget, trim more text
+    while len(closed) + len(ellipsis) > available and len(truncated) > 0:
+        truncated = truncated[:-20] if len(truncated) > 20 else ''
+        last_open = truncated.rfind('<')
+        last_close = truncated.rfind('>')
+        if last_open > last_close:
+            truncated = truncated[:last_open]
+        closed = _close_open_tags(truncated)
+
+    return closed.rstrip() + ellipsis
@@ -10,6 +10,28 @@ from app.localization.texts import get_texts

 LOGO_PATH = Path(settings.LOGO_FILE)
 _PRIVACY_RESTRICTED_CODE = 'BUTTON_USER_PRIVACY_RESTRICTED'
+
+# Кеш file_id логотипа: после первой загрузки Telegram возвращает file_id,
+# который можно переиспользовать без повторной загрузки файла (экономит 3-4 сек)
+_logo_file_id: str | None = None
+
+
+def get_logo_media():
+    """Возвращает кешированный file_id или FSInputFile для логотипа."""
+    if _logo_file_id:
+        return _logo_file_id
+    return FSInputFile(LOGO_PATH)
+
+
+def _cache_logo_file_id(result: Message | None) -> None:
+    """Извлекает и кеширует file_id логотипа из ответа Telegram."""
+    global _logo_file_id
+    if _logo_file_id or result is None:
+        return
+    if hasattr(result, 'photo') and result.photo:
+        _logo_file_id = result.photo[-1].file_id
+
+
 _TOPIC_REQUIRED_ERRORS = (
    'topic must be specified',
    'TOPIC_CLOSED',
@@ -110,8 +132,9 @@ async def _answer_with_photo(self: Message, text: str = None, **kwargs):

    if LOGO_PATH.exists():
        try:
-            # Отправляем caption как есть; при ошибке парсинга ниже сработает фоллбек
-            return await self.answer_photo(FSInputFile(LOGO_PATH), caption=text, **kwargs)
+            result = await self.answer_photo(get_logo_media(), caption=text, **kwargs)
+            _cache_logo_file_id(result)
+            return result
        except TelegramBadRequest as error:
            if is_topic_required_error(error):
                # Канал с топиками — просто игнорируем, нельзя ответить без message_thread_id
@@ -163,12 +186,8 @@ async def _edit_with_photo(self: Message, text: str, **kwargs):
                return await _original_answer(self, text, **kwargs)
        except Exception:
            pass
-        # Всегда используем логотип если включен режим логотипа,
-        # кроме специальных случаев (QR сообщения)
-        if (settings.ENABLE_LOGO_MODE and LOGO_PATH.exists() and not is_qr_message(self)) or (
-            is_qr_message(self) and LOGO_PATH.exists()
-        ):
-            media = FSInputFile(LOGO_PATH)
+        if LOGO_PATH.exists():
+            media = get_logo_media()
        else:
            media = self.photo[-1].file_id
        media_kwargs = {'media': media, 'caption': text}
@@ -2,14 +2,16 @@ import asyncio
 import logging

 from aiogram import types
-from aiogram.exceptions import TelegramBadRequest, TelegramNetworkError
-from aiogram.types import FSInputFile, InaccessibleMessage, InputMediaPhoto
+from aiogram.exceptions import TelegramBadRequest, TelegramForbiddenError, TelegramNetworkError
+from aiogram.types import InaccessibleMessage, InputMediaPhoto

 from app.config import settings

 from .message_patch import (
    LOGO_PATH,
+    _cache_logo_file_id,
    append_privacy_hint,
+    get_logo_media,
    is_privacy_restricted_error,
    is_qr_message,
    prepare_privacy_safe_kwargs,
@@ -23,17 +25,13 @@ RETRY_DELAY = 0.5


 def _resolve_media(message: types.Message):
-    # Если сообщение недоступно, возвращаем логотип по умолчанию
    if isinstance(message, InaccessibleMessage):
-        return FSInputFile(LOGO_PATH)
-    # Всегда используем логотип если включен режим логотипа,
-    # кроме специальных случаев (QR сообщения)
+        return get_logo_media()
    if settings.ENABLE_LOGO_MODE and not is_qr_message(message):
-        return FSInputFile(LOGO_PATH)
-    # Только если режим логотипа выключен, используем фото из сообщения
+        return get_logo_media()
    if message.photo:
        return message.photo[-1].file_id
-    return FSInputFile(LOGO_PATH)
+    return get_logo_media()


 def _get_language(callback: types.CallbackQuery) -> str | None:
@@ -91,12 +89,13 @@ async def edit_or_answer_photo(
    if isinstance(callback.message, InaccessibleMessage):
        try:
            if settings.ENABLE_LOGO_MODE and LOGO_PATH.exists():
-                await callback.message.answer_photo(
-                    photo=FSInputFile(LOGO_PATH),
+                result = await callback.message.answer_photo(
+                    photo=get_logo_media(),
                    caption=caption,
                    reply_markup=keyboard,
                    parse_mode=resolved_parse_mode,
                )
+                _cache_logo_file_id(result)
            else:
                await callback.message.answer(
                    caption,
@@ -127,6 +126,8 @@ async def edit_or_answer_photo(
                    reply_markup=keyboard,
                    parse_mode=resolved_parse_mode,
                )
+        except TelegramForbiddenError:
+            logger.debug('Пользователь заблокировал бота, пропускаем')
        except TelegramBadRequest as error:
            try:
                await callback.message.delete()
@@ -141,6 +142,8 @@ async def edit_or_answer_photo(
            if callback.message.photo:
                await callback.message.delete()
            await _answer_text(callback, caption, keyboard, resolved_parse_mode)
+        except TelegramForbiddenError:
+            logger.debug('Пользователь заблокировал бота, пропускаем')
        except TelegramBadRequest as error:
            await _answer_text(callback, caption, keyboard, resolved_parse_mode, error)
        return
@@ -168,6 +171,10 @@ async def edit_or_answer_photo(
                pass
            await _answer_text(callback, caption, keyboard, resolved_parse_mode)
            return
+        except TelegramForbiddenError:
+            # Пользователь заблокировал бота — молча игнорируем
+            logger.debug('Пользователь заблокировал бота, пропускаем edit_media')
+            return
        except TelegramBadRequest as error:
            if is_privacy_restricted_error(error):
                try:
@@ -183,13 +190,14 @@ async def edit_or_answer_photo(
                pass
            try:
                # Отправим как фото с логотипом
-                await callback.message.answer_photo(
-                    photo=media if isinstance(media, FSInputFile) else FSInputFile(LOGO_PATH),
+                result = await callback.message.answer_photo(
+                    photo=get_logo_media(),
                    caption=caption,
                    reply_markup=keyboard,
                    parse_mode=resolved_parse_mode,
                )
-            except TelegramBadRequest as photo_error:
+                _cache_logo_file_id(result)
+            except (TelegramBadRequest, TelegramForbiddenError) as photo_error:
                await _answer_text(callback, caption, keyboard, resolved_parse_mode, photo_error)
            except Exception:
                # Последний фоллбек — обычный текст
@@ -307,7 +307,8 @@ def _pluralize_days_ru(n: int) -> str:


 def format_period_description(days: int, language: str = 'ru') -> str:
-    if language == 'ru':
+    language_code = (language or 'ru').split('-')[0].lower()
+    if language_code in {'ru', 'fa'}:
        if days == 30:
            return '1 месяц'
        if days == 60:
@@ -3047,6 +3047,9 @@ def _is_trial_available_for_user(user: User) -> bool:
    if settings.TRIAL_DURATION_DAYS <= 0:
        return False

+    if settings.is_trial_disabled_for_user(getattr(user, 'auth_type', 'telegram')):
+        return False
+
    if getattr(user, 'has_had_paid_subscription', False):
        return False

@@ -4051,7 +4054,7 @@ async def activate_subscription_trial_endpoint(

    language_code = _normalize_language_code(user)
    charged_amount_label = settings.format_price(charged_amount) if charged_amount > 0 else None
-    if language_code == 'ru':
+    if language_code in {'ru', 'fa'}:
        if duration_days:
            message = f'Триал активирован на {duration_days} дн. Приятного пользования!'
        else:
@@ -4062,7 +4065,7 @@ async def activate_subscription_trial_endpoint(
        message = 'Trial activated successfully. Enjoy!'

    if charged_amount_label:
-        if language_code == 'ru':
+        if language_code in {'ru', 'fa'}:
            message = f'{message}\n\n💳 С вашего баланса списано {charged_amount_label}.'
        else:
            message = f'{message}\n\n💳 {charged_amount_label} has been deducted from your balance.'
@@ -4473,7 +4476,7 @@ def _normalize_language_code(user: User | None) -> str:

 def _build_renewal_status_message(user: User | None) -> str:
    language_code = _normalize_language_code(user)
-    if language_code == 'ru':
+    if language_code in {'ru', 'fa'}:
        return 'Стоимость указана с учётом ваших текущих серверов, трафика и устройств.'
    return 'Prices already include your current servers, traffic, and devices.'

@@ -4490,7 +4493,7 @@ def _build_promo_offer_payload(user: User | None) -> dict[str, Any] | None:
        payload['expires_at'] = expires_at

    language_code = _normalize_language_code(user)
-    if language_code == 'ru':
+    if language_code in {'ru', 'fa'}:
        payload['message'] = 'Дополнительная скидка применяется автоматически.'
    else:
        payload['message'] = 'Extra discount is applied automatically.'
@@ -4524,7 +4527,7 @@ def _build_renewal_success_message(
    amount_label = settings.format_price(max(0, charged_amount))
    date_label = format_local_datetime(subscription.end_date, '%d.%m.%Y %H:%M') if subscription.end_date else ''

-    if language_code == 'ru':
+    if language_code in {'ru', 'fa'}:
        if charged_amount > 0:
            message = (
                f'Подписка продлена до {date_label}. ' if date_label else 'Подписка продлена. '
@@ -4540,7 +4543,7 @@ def _build_renewal_success_message(

    if promo_discount_value > 0:
        discount_label = settings.format_price(promo_discount_value)
-        if language_code == 'ru':
+        if language_code in {'ru', 'fa'}:
            message += f' Применена дополнительная скидка {discount_label}.'
        else:
            message += f' Promo discount applied: {discount_label}.'
@@ -4557,7 +4560,7 @@ def _build_renewal_pending_message(
    amount_label = settings.format_price(max(0, missing_amount))
    method_title = _format_payment_method_title(method)

-    if language_code == 'ru':
+    if language_code in {'ru', 'fa'}:
        if method_title:
            return (
                f'Недостаточно средств на балансе. Доплатите {amount_label} через {method_title}, '
@@ -190,13 +190,16 @@ async def create_promocode_endpoint(

    creator_id = payload.created_by if payload.created_by is not None and payload.created_by > 0 else None

+    # 0 means unlimited — convert to large number for is_valid check (current_uses < max_uses)
+    effective_max_uses = 999999 if payload.max_uses == 0 else payload.max_uses
+
    promocode = await create_promocode(
        db,
        code=normalized_code,
        type=payload.type,
        balance_bonus_kopeks=payload.balance_bonus_kopeks,
        subscription_days=payload.subscription_days,
-        max_uses=payload.max_uses,
+        max_uses=effective_max_uses,
        valid_until=normalized_valid_until,
        created_by=creator_id,
    )
@@ -248,7 +251,7 @@ async def update_promocode_endpoint(
        updates['subscription_days'] = payload.subscription_days

    if payload.max_uses is not None:
-        updates['max_uses'] = payload.max_uses
+        updates['max_uses'] = 999999 if payload.max_uses == 0 else payload.max_uses

    if payload.valid_from is not None:
        updates['valid_from'] = _normalize_datetime(payload.valid_from)
@@ -524,8 +524,8 @@ def create_payment_router(bot: Bot, payment_service: PaymentService) -> APIRoute
                if success:
                    return JSONResponse({'status': 'ok'})

-                order_id = payload.get('order_id', 'unknown')
-                logger.error('Wata webhook processing failed: order_id=%s', order_id)
+                order_id = payload.get('orderId') or payload.get('order_id') or 'unknown'
+                logger.error('Wata webhook processing failed: order_id=%s, payload=%s', order_id, payload)
                return JSONResponse(
                    {'status': 'error', 'reason': 'not_processed'},
                    status_code=status.HTTP_400_BAD_REQUEST,
@@ -10,6 +10,7 @@ from fastapi.staticfiles import StaticFiles

 from app.cabinet.routes import router as cabinet_router
 from app.config import settings
+from app.services.disposable_email_service import disposable_email_service
 from app.services.payment_service import PaymentService
 from app.webapi.app import create_web_api_app
 from app.webapi.docs import add_redoc_endpoint
@@ -144,6 +145,14 @@ def create_unified_app(
    else:
        telegram_processor = None

+    @app.on_event('startup')
+    async def start_disposable_email_service() -> None:  # pragma: no cover - event hook
+        await disposable_email_service.start()
+
+    @app.on_event('shutdown')
+    async def stop_disposable_email_service() -> None:  # pragma: no cover - event hook
+        await disposable_email_service.stop()
+
    miniapp_mounted, miniapp_path = _mount_miniapp_static(app)

    unified_health_path = '/health/unified' if settings.is_web_api_enabled() else '/health'
@@ -170,9 +170,6 @@
 - `app/external/pal24_client.py` — Async client for PayPalych (Pal24) API.
  Классы: `Pal24APIError` — Base error for Pal24 API operations., `Pal24Response` (2 методов) — Wrapper for Pal24 API responses., `Pal24Client` (5 методов) — Async client implementing PayPalych API methods.
  Функции: нет
- `app/external/pal24_webhook.py` — Flask webhook server for PayPalych callbacks.
-  Классы: `Pal24WebhookServer` (3 методов) — Threaded Flask server for Pal24 callbacks.
-  Функции: `_normalize_payload`, `create_pal24_flask_app`
 - `app/external/remnawave_api.py` — Python-модуль
  Классы: `UserStatus`, `TrafficLimitStrategy`, `RemnaWaveUser`, `RemnaWaveInternalSquad`, `RemnaWaveNode`, `SubscriptionInfo`, `RemnaWaveAPIError` (1 методов), `RemnaWaveAPI` (8 методов)
  Функции: `format_bytes`, `parse_bytes`
@@ -254,31 +254,31 @@ setInterval(() => {
 ### Python Webhook receiver

 ```python
-from flask import Flask, request
+from fastapi import FastAPI, Request, HTTPException
 import hmac
 import hashlib
 import json

-app = Flask(__name__)
+app = FastAPI()
 WEBHOOK_SECRET = "your-secret"

-@app.route('/webhook', methods=['POST'])
-def webhook():
+@app.post('/webhook')
+async def webhook(request: Request):
    signature = request.headers.get('X-Webhook-Signature', '')
    event_type = request.headers.get('X-Webhook-Event')
-    payload = request.json
-    
+    payload = await request.json()
+
    # Проверка подписи
    if not verify_signature(payload, signature, WEBHOOK_SECRET):
-        return {'error': 'Invalid signature'}, 401
-    
+        raise HTTPException(status_code=401, detail='Invalid signature')
+
    # Обработка события
    if event_type == 'user.created':
        handle_new_user(payload)
    elif event_type == 'payment.completed':
        handle_payment(payload)
-    
-    return {'status': 'ok'}, 200
+
+    return {'status': 'ok'}

 def verify_signature(payload, signature, secret):
    payload_json = json.dumps(payload, sort_keys=True)
@@ -517,8 +517,8 @@ async def main():
                logger.error('❌ Ошибка подготовки внешней админки: %s', error)

        bot_run_mode = settings.get_bot_run_mode()
-        polling_enabled = bot_run_mode in {'polling', 'both'}
-        telegram_webhook_enabled = bot_run_mode in {'webhook', 'both'}
+        polling_enabled = bot_run_mode == 'polling'
+        telegram_webhook_enabled = bot_run_mode == 'webhook'

        payment_webhooks_enabled = any(
            [
@@ -0,0 +1,45 @@
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'g5b6c7d8e9f0'
+down_revision: Union[str, None] = 'f4a5b6c7d8e9'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column('users', sa.Column('google_id', sa.String(255), nullable=True))
+    op.add_column('users', sa.Column('yandex_id', sa.String(255), nullable=True))
+    op.add_column('users', sa.Column('discord_id', sa.String(255), nullable=True))
+    op.add_column('users', sa.Column('vk_id', sa.BigInteger(), nullable=True))
+
+    op.create_unique_constraint('uq_users_google_id', 'users', ['google_id'])
+    op.create_unique_constraint('uq_users_yandex_id', 'users', ['yandex_id'])
+    op.create_unique_constraint('uq_users_discord_id', 'users', ['discord_id'])
+    op.create_unique_constraint('uq_users_vk_id', 'users', ['vk_id'])
+
+    op.create_index('ix_users_google_id', 'users', ['google_id'])
+    op.create_index('ix_users_yandex_id', 'users', ['yandex_id'])
+    op.create_index('ix_users_discord_id', 'users', ['discord_id'])
+    op.create_index('ix_users_vk_id', 'users', ['vk_id'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_users_vk_id', table_name='users')
+    op.drop_index('ix_users_discord_id', table_name='users')
+    op.drop_index('ix_users_yandex_id', table_name='users')
+    op.drop_index('ix_users_google_id', table_name='users')
+
+    op.drop_constraint('uq_users_vk_id', 'users', type_='unique')
+    op.drop_constraint('uq_users_discord_id', 'users', type_='unique')
+    op.drop_constraint('uq_users_yandex_id', 'users', type_='unique')
+    op.drop_constraint('uq_users_google_id', 'users', type_='unique')
+
+    op.drop_column('users', 'vk_id')
+    op.drop_column('users', 'discord_id')
+    op.drop_column('users', 'yandex_id')
+    op.drop_column('users', 'google_id')
--- a/Show More
+++ b/Show More