Merge pull request #2576 from BEDOLAGA-DEV/release-please--branches--main

chore(main): release 3.7.2

.github/workflows/docker-hub.yml

@@ -36,15 +36,15 @@ jobs:
           TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:latest,fr1ngg/remnawave-bedolaga-telegram-bot:${VERSION}"
           echo "🏷️ Собираем релизную версию: $VERSION"
         elif [[ $GITHUB_REF == refs/heads/main ]]; then
-          VERSION="v3.6.0-$(git rev-parse --short HEAD)"
+          VERSION="v3.7.0-$(git rev-parse --short HEAD)" # x-release-please-version
           TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:latest,fr1ngg/remnawave-bedolaga-telegram-bot:${VERSION}"
           echo "🚀 Собираем версию из main: $VERSION"
         elif [[ $GITHUB_REF == refs/heads/dev ]]; then
-          VERSION="v3.6.0-dev-$(git rev-parse --short HEAD)"
+          VERSION="v3.7.0-dev-$(git rev-parse --short HEAD)" # x-release-please-version
           TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:dev,fr1ngg/remnawave-bedolaga-telegram-bot:${VERSION}"
           echo "🧪 Собираем dev версию: $VERSION"
         else
-          VERSION="v3.6.0-pr-$(git rev-parse --short HEAD)"
+          VERSION="v3.7.0-pr-$(git rev-parse --short HEAD)" # x-release-please-version
           TAGS="fr1ngg/remnawave-bedolaga-telegram-bot:pr-$(git rev-parse --short HEAD)"
           echo "🔀 Собираем PR версию: $VERSION"
         fi

.github/workflows/docker-registry.yml

@@ -49,13 +49,13 @@ jobs:
             VERSION=${GITHUB_REF#refs/tags/}
             echo "🏷️ Building release version: $VERSION"
           elif [[ $GITHUB_REF == refs/heads/main ]]; then
-            VERSION="v3.6.0-$(git rev-parse --short HEAD)"
+            VERSION="v3.7.0-$(git rev-parse --short HEAD)" # x-release-please-version
             echo "🚀 Building main version: $VERSION"
           elif [[ $GITHUB_REF == refs/heads/dev ]]; then
-            VERSION="v3.6.0-dev-$(git rev-parse --short HEAD)"
+            VERSION="v3.7.0-dev-$(git rev-parse --short HEAD)" # x-release-please-version
             echo "🧪 Building dev version: $VERSION"
           else
-            VERSION="v3.6.0-pr-$(git rev-parse --short HEAD)"
+            VERSION="v3.7.0-pr-$(git rev-parse --short HEAD)" # x-release-please-version
             echo "🔀 Building PR version: $VERSION"
           fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT

.github/workflows/release-please.yml

@@ -20,6 +20,5 @@ jobs:
       - uses: googleapis/release-please-action@v4
         id: release
         with:
-          release-type: python
-          extra-files: |
-            pyproject.toml
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.6.0"
+  ".": "3.7.2"
 }

CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## [3.7.2](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.7.1...v3.7.2) (2026-02-08)
+
+
+### Bug Fixes
+
+* handle FK violation in create_yookassa_payment when user is deleted ([55d281b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/55d281b0e37a6e8977ceff792cccb8669560945b))
+* remove dots from Remnawave username sanitization ([d6fa86b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/d6fa86b870eccbf22327cd205539dd2084f0014e))
+
+## [3.7.1](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.7.0...v3.7.1) (2026-02-08)
+
+
+### Bug Fixes
+
+* release-please config — remove blocked workflow files ([d88ca98](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/d88ca980ec67e303e37f0094a2912471929b4cef))
+* remove workflow files and pyproject.toml from release-please extra-files ([5070bb3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5070bb34e8a09b2641783f5e818bb624469ad610))
+* resolve HWID reset and webhook FK violation ([5f3e426](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/5f3e426750c2adcb097b92f1a9e7725b1c5c5eba))
+* resolve HWID reset context manager bug and webhook FK violation ([a9eee19](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a9eee19c95efdc38ecf5fa28f7402a2bbba7dd07))
+* resolve merge conflict in release-please config ([0ef4f55](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/0ef4f55304751571754f2027105af3e507f75dfd))
+* resolve multiple production errors and performance issues ([071c23d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/071c23dd5297c20527442cb5d348d498ebf20af4))
+
+## [3.7.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.6.0...v3.7.0) (2026-02-07)
+
+
+### Features
+
+* add admin traffic usage API ([aa1cd38](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/aa1cd3829c5c3671e220d49dd7ec2d83563e2cf9))
+* add admin traffic usage API with per-node statistics ([6c2c25d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/6c2c25d2ccb27446c822e4ed94d9351bfeaf4549))
+* add node/status filters and custom date range to traffic page ([ad260d9](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ad260d9fe0b232c9d65176502476212902909660))
+* add node/status filters, custom date range, connected devices to traffic page ([9ea533a](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/9ea533a864e345647754f316bd27971fba1420af))
+* add node/status filters, date range, devices to traffic page ([ad6522f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ad6522f547e68ef5965e70d395ca381b0a032093))
+* add risk columns to traffic CSV export ([7c1a142](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/7c1a1426537e43d14eff0a1c3faeca484611b58b))
+* add tariff filter, fix traffic data aggregation ([fa01819](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/fa01819674b2d2abb0d05b470559b09eb43abef8))
+* node/status filters + custom date range for traffic page ([a161e2f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a161e2f904732b459fef98a67abfaae1214ecfd4))
+* tariff filter + fix traffic data aggregation ([1021c2c](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/1021c2cdcd07cf2194e59af7b59491108339e61f))
+* traffic filters, date range & risk columns in CSV export ([4c40b5b](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/4c40b5b370616a9ab40cbf0cccdbc0ac4a3f8278))
+
+
+### Bug Fixes
+
+* close unclosed HTML tags in version notification ([0b61c7f](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/0b61c7fe482e7bbfbb3421307a96d54addfd91ee))
+* close unclosed HTML tags when truncating version notification ([b674550](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b6745508da861af9b2ff05d89b4ac9a3933da510))
+* correct response parsing for non-legacy node-users endpoint ([a076dfb](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a076dfb5503a349450b5aa8aac3c6f40070b715d))
+* correct response parsing for non-legacy node-users endpoint ([91ac90c](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/91ac90c2aecfb990679b3d0c835314dde448886a))
+* handle mixed types in traffic sort ([eeed2d6](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/eeed2d6369b07860505c59bcff391e7b17e0ffb7))
+* handle mixed types in traffic sort for string fields ([a194be0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/a194be0843856b3376167d9ba8a8ef737280998c))
+* resolve 429 rate limiting on traffic page ([b12544d](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b12544d3ea8f4bbd2d8c941f83ee3ac412157adb))
+* resolve 429 rate limiting on traffic page ([924d6bc](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/924d6bc09c815c1d188ea1d0e7974f7e803c1d3f))
+* use legacy per-node endpoint for traffic aggregation ([cc1c8ba](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/cc1c8bacb42a9089021b7ae0fecd1f2717953efb))
+* use legacy per-node endpoint with correct response format ([b707b79](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/b707b7995b90c6465910a35e9a4403e1408c6568))
+* use PaymentService for cabinet YooKassa payments ([61bb8fc](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/61bb8fcafd94509568f134ccdba7769b66cc7d5d))
+* use PaymentService for cabinet YooKassa payments to save local DB record ([ff5bba3](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/commit/ff5bba3fc5d1e1b08d008b64215e487a9eb70960))
+
 ## [3.6.0](https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot/compare/v3.5.0...v3.6.0) (2026-02-07)
 
 

Dockerfile

@@ -14,7 +14,7 @@ RUN pip install --no-cache-dir --upgrade pip && \
 
 FROM python:3.13-slim
 
-ARG VERSION="v3.6.0"
+ARG VERSION="v3.7.2" # x-release-please-version
 ARG BUILD_DATE
 ARG VCS_REF
 

app/cabinet/routes/__init__.py

@@ -17,6 +17,7 @@ from .admin_settings import router as admin_settings_router
 from .admin_stats import router as admin_stats_router
 from .admin_tariffs import router as admin_tariffs_router
 from .admin_tickets import router as admin_tickets_router
+from .admin_traffic import router as admin_traffic_router
 from .admin_users import router as admin_users_router
 from .admin_wheel import router as admin_wheel_router
 from .auth import router as auth_router
@@ -85,6 +86,7 @@ router.include_router(admin_payments_router)
 router.include_router(admin_promo_offers_router)
 router.include_router(admin_remnawave_router)
 router.include_router(admin_email_templates_router)
+router.include_router(admin_traffic_router)
 
 # WebSocket route
 router.include_router(websocket_router)

app/cabinet/routes/admin_traffic.py

@@ -0,0 +1,509 @@
+"""Admin routes for traffic usage statistics."""
+
+import asyncio
+import csv
+import io
+import logging
+import time
+from datetime import UTC, datetime, timedelta
+
+from aiogram import Bot
+from aiogram.client.default import DefaultBotProperties
+from aiogram.enums import ParseMode
+from aiogram.types import BufferedInputFile
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.config import settings
+from app.database.models import Subscription, User
+from app.services.remnawave_service import RemnaWaveService
+
+from ..dependencies import get_cabinet_db, get_current_admin_user
+from ..schemas.traffic import (
+    ExportCsvRequest,
+    ExportCsvResponse,
+    TrafficNodeInfo,
+    TrafficUsageResponse,
+    UserTrafficItem,
+)
+
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix='/admin/traffic', tags=['Admin Traffic'])
+
+_ALLOWED_PERIODS = frozenset({1, 3, 7, 14, 30})
+_CONCURRENCY_LIMIT = 5  # Max parallel API calls to avoid rate limiting
+
+# In-memory cache: {(start_str, end_str): (timestamp, aggregated_data, nodes_info)}
+_traffic_cache: dict[tuple[str, str], tuple[float, dict[str, dict[str, int]], list[TrafficNodeInfo]]] = {}
+_CACHE_TTL = 300  # 5 minutes
+_cache_lock = asyncio.Lock()
+
+# Valid sort fields for the GET endpoint
+_SORT_FIELDS = frozenset({'total_bytes', 'full_name', 'tariff_name', 'device_limit', 'traffic_limit_gb'})
+
+
+def _get_status(sub) -> str | None:
+    """Get subscription status via actual_status property."""
+    return sub.actual_status
+
+
+def _validate_period(period: int) -> None:
+    if period not in _ALLOWED_PERIODS:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f'Period must be one of: {sorted(_ALLOWED_PERIODS)}',
+        )
+
+
+async def _aggregate_traffic(
+    start_str: str, end_str: str, user_uuids: list[str]
+) -> tuple[dict[str, dict[str, int]], list[TrafficNodeInfo]]:
+    """Aggregate per-user traffic across all nodes for a given date range.
+
+    Uses legacy per-node endpoint to fetch all users' traffic per node —
+    O(nodes) API calls instead of O(users). The legacy endpoint returns
+    {userUuid, nodeUuid, total} per entry (non-legacy only returns topUsers
+    without userUuid).
+
+    Returns (user_traffic, nodes_info) where:
+      user_traffic = {remnawave_uuid: {node_uuid: total_bytes, ...}}
+      nodes_info = [TrafficNodeInfo, ...]
+    """
+    cache_key = (start_str, end_str)
+
+    # Quick check without lock
+    now = time.time()
+    cached = _traffic_cache.get(cache_key)
+    if cached and (now - cached[0]) < _CACHE_TTL:
+        return cached[1], cached[2]
+
+    # Acquire lock for the slow path
+    async with _cache_lock:
+        # Re-check after acquiring lock
+        now = time.time()
+        cached = _traffic_cache.get(cache_key)
+        if cached and (now - cached[0]) < _CACHE_TTL:
+            return cached[1], cached[2]
+
+        service = RemnaWaveService()
+        if not service.is_configured:
+            return {}, []
+
+        user_uuids_set = set(user_uuids)
+
+        async with service.get_api_client() as api:
+            nodes = await api.get_all_nodes()
+
+            # Fetch per-node user stats — O(nodes) calls instead of O(users)
+            semaphore = asyncio.Semaphore(_CONCURRENCY_LIMIT)
+
+            async def fetch_node_users(node):
+                async with semaphore:
+                    try:
+                        stats = await api.get_bandwidth_stats_node_users_legacy(node.uuid, start_str, end_str)
+                        return node.uuid, stats
+                    except Exception:
+                        logger.warning('Failed to get traffic for node %s', node.name, exc_info=True)
+                        return node.uuid, None
+
+            results = await asyncio.gather(*(fetch_node_users(n) for n in nodes))
+
+        nodes_info: list[TrafficNodeInfo] = [
+            TrafficNodeInfo(node_uuid=node.uuid, node_name=node.name, country_code=node.country_code) for node in nodes
+        ]
+        nodes_info.sort(key=lambda n: n.node_name)
+
+        # Legacy response: [{userUuid, username, nodeUuid, total, date}, ...]
+        user_traffic: dict[str, dict[str, int]] = {}
+        for node_uuid, entries in results:
+            if not isinstance(entries, list):
+                continue
+            for entry in entries:
+                uid = entry.get('userUuid', '')
+                total = int(entry.get('total', 0))
+                if uid and total > 0 and uid in user_uuids_set:
+                    user_traffic.setdefault(uid, {})[node_uuid] = user_traffic.get(uid, {}).get(node_uuid, 0) + total
+
+        _traffic_cache[cache_key] = (now, user_traffic, nodes_info)
+
+        # Evict expired entries to prevent unbounded growth
+        expired = [k for k, (ts, _, _) in _traffic_cache.items() if (now - ts) >= _CACHE_TTL]
+        for k in expired:
+            del _traffic_cache[k]
+
+        return user_traffic, nodes_info
+
+
+def _compute_date_range(period_days: int) -> tuple[str, str]:
+    """Compute ISO date-time range from period days.
+
+    Truncates to 5-minute intervals for stable cache keys.
+    """
+    end_dt = datetime.now(UTC).replace(second=0, microsecond=0)
+    end_dt = end_dt.replace(minute=(end_dt.minute // 5) * 5)
+    start_dt = end_dt - timedelta(days=period_days)
+    return start_dt.strftime('%Y-%m-%dT%H:%M:%SZ'), end_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+
+
+async def _load_user_map(db: AsyncSession) -> dict[str, User]:
+    """Load all users with remnawave_uuid, eagerly loading subscription + tariff."""
+    stmt = (
+        select(User)
+        .where(User.remnawave_uuid.isnot(None))
+        .options(selectinload(User.subscription).selectinload(Subscription.tariff))
+    )
+    result = await db.execute(stmt)
+    users = result.scalars().all()
+    return {u.remnawave_uuid: u for u in users if u.remnawave_uuid}
+
+
+def _build_traffic_items(
+    user_traffic: dict[str, dict[str, int]],
+    user_map: dict[str, User],
+    nodes_info: list[TrafficNodeInfo],
+    search: str = '',
+    sort_by: str = 'total_bytes',
+    sort_desc: bool = True,
+    tariff_filter: set[str] | None = None,
+    status_filter: set[str] | None = None,
+    node_filter: set[str] | None = None,
+) -> list[UserTrafficItem]:
+    """Merge traffic data with user data, apply search/tariff/status/node filters, return sorted list."""
+    items: list[UserTrafficItem] = []
+    search_lower = search.lower().strip()
+
+    all_uuids = set(user_traffic.keys()) | set(user_map.keys())
+    for uuid in all_uuids:
+        user = user_map.get(uuid)
+        if not user:
+            continue
+
+        traffic = user_traffic.get(uuid, {})
+
+        full_name = user.full_name
+        username = user.username
+
+        if search_lower:
+            if search_lower not in (full_name or '').lower() and search_lower not in (username or '').lower():
+                continue
+
+        sub = user.subscription
+        tariff_name = None
+        subscription_status = None
+        traffic_limit_gb = 0.0
+        device_limit = 1
+
+        if sub:
+            subscription_status = _get_status(sub)
+            traffic_limit_gb = float(sub.traffic_limit_gb or 0)
+            device_limit = sub.device_limit or 1
+            if sub.tariff:
+                tariff_name = sub.tariff.name
+
+        if tariff_filter is not None:
+            if (tariff_name or '') not in tariff_filter:
+                continue
+
+        if status_filter is not None:
+            if (subscription_status or '') not in status_filter:
+                continue
+
+        # Apply node filter: keep only selected nodes, recalculate total
+        if node_filter is not None:
+            traffic = {k: v for k, v in traffic.items() if k in node_filter}
+
+        total_bytes = sum(traffic.values())
+
+        items.append(
+            UserTrafficItem(
+                user_id=user.id,
+                telegram_id=user.telegram_id,
+                username=username,
+                full_name=full_name,
+                tariff_name=tariff_name,
+                subscription_status=subscription_status,
+                traffic_limit_gb=traffic_limit_gb,
+                device_limit=device_limit,
+                node_traffic=traffic,
+                total_bytes=total_bytes,
+            )
+        )
+
+    # Sort by the requested field; node columns use 'node_<uuid>' prefix
+    if sort_by.startswith('node_'):
+        node_uuid = sort_by[5:]
+        items.sort(key=lambda x: x.node_traffic.get(node_uuid, 0), reverse=sort_desc)
+    elif sort_by in ('full_name', 'tariff_name'):
+        items.sort(key=lambda x: (getattr(x, sort_by, None) or '').lower(), reverse=sort_desc)
+    else:
+        items.sort(key=lambda x: getattr(x, sort_by, 0) or 0, reverse=sort_desc)
+
+    return items
+
+
+@router.get('', response_model=TrafficUsageResponse)
+async def get_traffic_usage(
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+    period: int = Query(30, ge=1, le=30),
+    limit: int = Query(50, ge=1, le=200),
+    offset: int = Query(0, ge=0),
+    search: str = Query('', max_length=100),
+    sort_by: str = Query('total_bytes', max_length=100),
+    sort_desc: bool = Query(True),
+    tariffs: str = Query('', max_length=500),
+    statuses: str = Query('', max_length=500),
+    nodes: str = Query('', max_length=2000),
+    start_date: str = Query('', max_length=10),
+    end_date: str = Query('', max_length=10),
+):
+    """Get paginated per-user traffic usage by node."""
+    # Determine date range: custom dates or period-based
+    if start_date.strip() and end_date.strip():
+        try:
+            start_dt = datetime.strptime(start_date.strip(), '%Y-%m-%d').replace(tzinfo=UTC)
+            end_dt = datetime.strptime(end_date.strip(), '%Y-%m-%d').replace(tzinfo=UTC, hour=23, minute=59, second=59)
+        except ValueError:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Invalid date format. Use YYYY-MM-DD.')
+
+        now = datetime.now(UTC)
+        end_dt = min(end_dt, now)
+
+        if start_dt > end_dt:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='start_date must be before end_date.')
+
+        if (end_dt - start_dt).days > 31:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Date range cannot exceed 31 days.')
+
+        start_str = start_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        end_str = end_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        effective_period = (end_dt - start_dt).days or 1
+    else:
+        _validate_period(period)
+        start_str, end_str = _compute_date_range(period)
+        effective_period = period
+
+    user_map = await _load_user_map(db)
+    user_traffic, nodes_info = await _aggregate_traffic(start_str, end_str, list(user_map.keys()))
+
+    # Collect all available tariff names (before filtering)
+    available_tariffs = sorted(
+        {
+            u.subscription.tariff.name
+            for u in user_map.values()
+            if u.subscription and u.subscription.tariff and u.subscription.tariff.name
+        }
+    )
+
+    # Collect all available statuses (before filtering)
+    available_statuses = sorted(
+        {_get_status(sub) for u in user_map.values() if (sub := u.subscription) and _get_status(sub)}
+    )
+
+    # Parse tariff filter
+    tariff_filter: set[str] | None = None
+    if tariffs.strip():
+        tariff_filter = {t.strip() for t in tariffs.split(',') if t.strip()}
+
+    # Parse status filter
+    status_filter: set[str] | None = None
+    if statuses.strip():
+        status_filter = {s.strip() for s in statuses.split(',') if s.strip()}
+
+    # Parse node filter
+    node_filter: set[str] | None = None
+    all_node_uuids = {n.node_uuid for n in nodes_info}
+    if nodes.strip():
+        node_filter = {n.strip() for n in nodes.split(',') if n.strip()} & all_node_uuids
+        if not node_filter:
+            node_filter = None  # No valid nodes matched, treat as "all nodes"
+
+    # Validate sort_by: allow known fields + 'node_<uuid>' for dynamic node columns
+    is_node_sort = sort_by.startswith('node_') and sort_by[5:] in all_node_uuids
+    if sort_by not in _SORT_FIELDS and not is_node_sort:
+        sort_by = 'total_bytes'
+
+    items = _build_traffic_items(
+        user_traffic, user_map, nodes_info, search, sort_by, sort_desc, tariff_filter, status_filter, node_filter
+    )
+
+    total = len(items)
+    paginated = items[offset : offset + limit]
+
+    return TrafficUsageResponse(
+        items=paginated,
+        nodes=nodes_info,
+        total=total,
+        offset=offset,
+        limit=limit,
+        period_days=effective_period,
+        available_tariffs=available_tariffs,
+        available_statuses=available_statuses,
+    )
+
+
+@router.post('/export-csv', response_model=ExportCsvResponse)
+async def export_traffic_csv(
+    request: ExportCsvRequest,
+    admin: User = Depends(get_current_admin_user),
+    db: AsyncSession = Depends(get_cabinet_db),
+):
+    """Generate CSV with traffic usage and send to admin's Telegram DM."""
+    if not admin.telegram_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Admin has no Telegram ID configured',
+        )
+
+    # Determine date range: custom dates or period-based
+    if request.start_date and request.end_date:
+        try:
+            start_dt = datetime.strptime(request.start_date.strip(), '%Y-%m-%d').replace(tzinfo=UTC)
+            end_dt = datetime.strptime(request.end_date.strip(), '%Y-%m-%d').replace(
+                tzinfo=UTC, hour=23, minute=59, second=59
+            )
+        except ValueError:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Invalid date format. Use YYYY-MM-DD.')
+
+        now = datetime.now(UTC)
+        end_dt = min(end_dt, now)
+        if start_dt > end_dt:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='start_date must be before end_date.')
+        if (end_dt - start_dt).days > 31:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail='Date range cannot exceed 31 days.')
+
+        start_str = start_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        end_str = end_dt.strftime('%Y-%m-%dT%H:%M:%SZ')
+        period_label = f'{request.start_date}_{request.end_date}'
+    else:
+        _validate_period(request.period)
+        start_str, end_str = _compute_date_range(request.period)
+        period_label = f'{request.period}d'
+
+    user_map = await _load_user_map(db)
+    user_traffic, nodes_info = await _aggregate_traffic(start_str, end_str, list(user_map.keys()))
+
+    # Parse filters
+    tariff_filter: set[str] | None = None
+    if request.tariffs and request.tariffs.strip():
+        tariff_filter = {t.strip() for t in request.tariffs.split(',') if t.strip()}
+
+    status_filter: set[str] | None = None
+    if request.statuses and request.statuses.strip():
+        status_filter = {s.strip() for s in request.statuses.split(',') if s.strip()}
+
+    node_filter: set[str] | None = None
+    all_node_uuids = {n.node_uuid for n in nodes_info}
+    if request.nodes and request.nodes.strip():
+        node_filter = {n.strip() for n in request.nodes.split(',') if n.strip()} & all_node_uuids
+        if not node_filter:
+            node_filter = None
+
+    items = _build_traffic_items(
+        user_traffic,
+        user_map,
+        nodes_info,
+        sort_by='total_bytes',
+        sort_desc=True,
+        tariff_filter=tariff_filter,
+        status_filter=status_filter,
+        node_filter=node_filter,
+    )
+
+    # Determine which nodes to include in CSV columns
+    csv_nodes = [n for n in nodes_info if n.node_uuid in node_filter] if node_filter else nodes_info
+
+    # Compute period days for risk calculation
+    if request.start_date and request.end_date:
+        period_days = max((end_dt - start_dt).days, 1)
+    else:
+        period_days = request.period
+
+    total_thr = request.total_threshold_gb or 0
+    node_thr = request.node_threshold_gb or 0
+    has_risk = total_thr > 0 or node_thr > 0
+
+    # Build CSV rows
+    rows: list[dict] = []
+    for item in items:
+        row: dict = {
+            'User ID': item.user_id,
+            'Telegram ID': item.telegram_id or '',
+            'Username': item.username or '',
+            'Full Name': item.full_name,
+            'Tariff': item.tariff_name or '',
+            'Status': item.subscription_status or '',
+            'Traffic Limit (GB)': item.traffic_limit_gb,
+            'Devices': item.device_limit,
+        }
+        for node in csv_nodes:
+            row[f'{node.node_name} (bytes)'] = item.node_traffic.get(node.node_uuid, 0)
+        row['Total (bytes)'] = item.total_bytes
+        row['Total (GB)'] = round(item.total_bytes / (1024**3), 2) if item.total_bytes else 0
+
+        if has_risk:
+            daily_total = item.total_bytes / period_days / (1024**3) if period_days > 0 else 0
+            row['Total GB/day'] = round(daily_total, 4)
+
+            total_ratio = daily_total / total_thr if total_thr > 0 else 0
+
+            max_node_ratio = 0.0
+            worst_node_daily = 0.0
+            for node_bytes in item.node_traffic.values():
+                if node_bytes > 0 and node_thr > 0:
+                    daily_node = node_bytes / period_days / (1024**3) if period_days > 0 else 0
+                    ratio = daily_node / node_thr
+                    if ratio > max_node_ratio:
+                        max_node_ratio = ratio
+                        worst_node_daily = daily_node
+
+            ratio = max(total_ratio, max_node_ratio)
+            if ratio < 0.5:
+                risk_level = 'low'
+            elif ratio < 0.8:
+                risk_level = 'medium'
+            elif ratio < 1.2:
+                risk_level = 'high'
+            else:
+                risk_level = 'critical'
+
+            row['Risk Level'] = risk_level
+            row['Risk Ratio'] = round(ratio, 3)
+            row['Risk GB/day'] = round(daily_total if total_ratio >= max_node_ratio else worst_node_daily, 4)
+
+        rows.append(row)
+
+    # Generate CSV
+    output = io.StringIO()
+    if rows:
+        writer = csv.DictWriter(output, fieldnames=rows[0].keys())
+        writer.writeheader()
+        writer.writerows(rows)
+    csv_bytes = output.getvalue().encode('utf-8-sig')
+
+    timestamp = datetime.now(UTC).strftime('%Y%m%d_%H%M%S')
+    filename = f'traffic_usage_{period_label}_{timestamp}.csv'
+
+    try:
+        bot = Bot(
+            token=settings.BOT_TOKEN,
+            default=DefaultBotProperties(parse_mode=ParseMode.HTML),
+        )
+        async with bot:
+            await bot.send_document(
+                chat_id=admin.telegram_id,
+                document=BufferedInputFile(csv_bytes, filename=filename),
+                caption=f'Traffic usage report ({period_label})\nUsers: {len(rows)}',
+            )
+    except Exception:
+        logger.error('Failed to send CSV to admin %s', admin.telegram_id, exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail='Failed to send CSV report. Please try again later.',
+        )
+
+    return ExportCsvResponse(success=True, message=f'CSV sent ({len(rows)} users)')

app/cabinet/routes/balance.py

@@ -23,7 +23,6 @@ from app.services.payment_verification_service import (
     method_display_name,
     run_manual_check,
 )
-from app.services.yookassa_service import YooKassaService
 
 from ..dependencies import get_cabinet_db, get_current_cabinet_user
 from ..schemas.balance import (
@@ -341,13 +340,11 @@ async def create_topup(
 
     try:
         if request.payment_method == 'yookassa':
-            yookassa_service = YooKassaService()
+            payment_service = PaymentService()
             yookassa_metadata = {
-                'user_id': str(user.id),
                 'user_telegram_id': str(user.telegram_id) if user.telegram_id else '',
                 'user_username': user.username or '',
-                'amount_kopeks': str(request.amount_kopeks),
-                'type': 'balance_topup',
+                'purpose': 'balance_topup',
                 'source': 'cabinet',
             }
 
@@ -358,25 +355,25 @@ async def create_topup(
                 request.amount_kopeks, telegram_user_id=user.telegram_id
             )
             if option == 'sbp':
-                # Create SBP payment with QR code
-                result = await yookassa_service.create_sbp_payment(
-                    amount=amount_rubles,
-                    currency='RUB',
+                result = await payment_service.create_yookassa_sbp_payment(
+                    db=db,
+                    user_id=user.id,
+                    amount_kopeks=request.amount_kopeks,
                     description=description,
                     metadata=yookassa_metadata,
                 )
             else:
-                # Default: card payment
-                result = await yookassa_service.create_payment(
-                    amount=amount_rubles,
-                    currency='RUB',
+                result = await payment_service.create_yookassa_payment(
+                    db=db,
+                    user_id=user.id,
+                    amount_kopeks=request.amount_kopeks,
                     description=description,
                     metadata=yookassa_metadata,
                 )
 
-            if result and not result.get('error'):
+            if result:
                 payment_url = result.get('confirmation_url')
-                payment_id = result.get('id')
+                payment_id = result.get('yookassa_payment_id')
             else:
                 raise HTTPException(
                     status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,

app/cabinet/schemas/traffic.py

@@ -0,0 +1,49 @@
+"""Schemas for admin traffic usage."""
+
+from pydantic import BaseModel, Field
+
+
+class TrafficNodeInfo(BaseModel):
+    node_uuid: str
+    node_name: str
+    country_code: str
+
+
+class UserTrafficItem(BaseModel):
+    user_id: int
+    telegram_id: int | None
+    username: str | None
+    full_name: str
+    tariff_name: str | None
+    subscription_status: str | None
+    traffic_limit_gb: float
+    device_limit: int
+    node_traffic: dict[str, int]  # {node_uuid: total_bytes}
+    total_bytes: int
+
+
+class TrafficUsageResponse(BaseModel):
+    items: list[UserTrafficItem]
+    nodes: list[TrafficNodeInfo]
+    total: int
+    offset: int
+    limit: int
+    period_days: int
+    available_tariffs: list[str]
+    available_statuses: list[str]
+
+
+class ExportCsvRequest(BaseModel):
+    period: int = Field(30, ge=1, le=30)
+    start_date: str | None = None
+    end_date: str | None = None
+    tariffs: str | None = None
+    statuses: str | None = None
+    nodes: str | None = None
+    total_threshold_gb: float | None = Field(None, ge=0, description='Total GB/day threshold for risk column')
+    node_threshold_gb: float | None = Field(None, ge=0, description='Per-node GB/day threshold for risk column')
+
+
+class ExportCsvResponse(BaseModel):
+    success: bool
+    message: str

app/config.py

@@ -1051,8 +1051,9 @@ class Settings(BaseSettings):
         )
 
         raw_username = template.format_map(values).strip()
-        sanitized_username = re.sub(r'[^0-9A-Za-z._-]+', '_', raw_username)
-        sanitized_username = re.sub(r'_+', '_', sanitized_username).strip('._-')
+        # Remnawave разрешает только буквы, цифры, подчёркивания и дефисы
+        sanitized_username = re.sub(r'[^0-9A-Za-z_-]+', '_', raw_username)
+        sanitized_username = re.sub(r'_+', '_', sanitized_username).strip('_-')
 
         if not sanitized_username:
             sanitized_username = f'user_{identifier}'

app/database/crud/tariff.py

@@ -492,8 +492,8 @@ async def reorder_tariffs(
 async def sync_default_tariff_from_config(db: AsyncSession) -> Tariff | None:
     """
     Синхронизирует дефолтный тариф из конфига (.env) в БД.
-    Создаёт тариф "Стандартный" если в БД нет тарифов.
-    Обновляет цены существующего тарифа если он есть.
+    Создаёт тариф "Стандартный" только если в БД нет тарифов.
+    Существующий тариф НЕ перезаписывается — админ управляет им через кабинет.
 
     Returns:
         Tariff или None если не требуется синхронизация
@@ -519,13 +519,11 @@ async def sync_default_tariff_from_config(db: AsyncSession) -> Tariff | None:
     existing_tariff = result.scalar_one_or_none()
 
     if existing_tariff:
-        # Обновляем цены существующего тарифа
-        existing_tariff.period_prices = period_prices
-        existing_tariff.traffic_limit_gb = settings.DEFAULT_TRAFFIC_LIMIT_GB
-        existing_tariff.device_limit = settings.DEFAULT_DEVICE_LIMIT
-        await db.commit()
-        await db.refresh(existing_tariff)
-        logger.info("Обновлён дефолтный тариф 'Стандартный' из конфига")
+        # Тариф уже существует — НЕ перезаписываем настройки из конфига.
+        # Админ управляет тарифом через кабинет, синхронизация не нужна.
+        logger.info(
+            "Дефолтный тариф 'Стандартный' (id=%s) уже существует, пропускаем sync из конфига", existing_tariff.id
+        )
         return existing_tariff
 
     if tariff_count == 0:
@@ -571,21 +569,26 @@ async def load_period_prices_from_db(db: AsyncSession) -> None:
         )
         tariff = result.scalar_one_or_none()
 
-        if tariff and tariff.period_prices:
-            # Преобразуем строковые ключи в int
-            period_prices = {int(days): int(price) for days, price in tariff.period_prices.items() if int(price) > 0}
-
-            if period_prices:
-                set_period_prices_from_db(period_prices)
-                logger.info(
-                    "Загружены периоды из тарифа '%s': %s",
-                    tariff.name,
-                    {f'{d}д': f'{p // 100}₽' for d, p in period_prices.items()},
-                )
-            else:
-                logger.warning("Тариф '%s' не имеет активных периодов", tariff.name)
-        else:
+        if not tariff:
             logger.info('Активные тарифы не найдены, используются цены из .env')
+            return
+
+        if not tariff.period_prices:
+            logger.warning("Тариф '%s' (id=%s) найден, но period_prices пуст", tariff.name, tariff.id)
+            return
+
+        # Преобразуем строковые ключи в int
+        period_prices = {int(days): int(price) for days, price in tariff.period_prices.items() if int(price) > 0}
+
+        if period_prices:
+            set_period_prices_from_db(period_prices)
+            logger.info(
+                "Загружены периоды из тарифа '%s': %s",
+                tariff.name,
+                {f'{d}д': f'{p // 100}₽' for d, p in period_prices.items()},
+            )
+        else:
+            logger.warning("Тариф '%s' не имеет активных периодов (все цены = 0)", tariff.name)
 
     except Exception as e:
         logger.error('Ошибка загрузки периодов из БД: %s', e)

app/database/crud/yookassa.py

@@ -2,6 +2,7 @@ import logging
 from datetime import datetime
 
 from sqlalchemy import and_, select, update
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
@@ -24,7 +25,7 @@ async def create_yookassa_payment(
     payment_method_type: str | None = None,
     yookassa_created_at: datetime | None = None,
     test_mode: bool = False,
-) -> YooKassaPayment:
+) -> YooKassaPayment | None:
     payment = YooKassaPayment(
         user_id=user_id,
         yookassa_payment_id=yookassa_payment_id,
@@ -40,7 +41,17 @@ async def create_yookassa_payment(
     )
 
     db.add(payment)
-    await db.commit()
+    try:
+        await db.commit()
+    except IntegrityError as e:
+        await db.rollback()
+        logger.error(
+            'FK violation при создании платежа YooKassa %s: user_id=%s не существует в БД: %s',
+            yookassa_payment_id,
+            user_id,
+            e,
+        )
+        return None
     await db.refresh(payment)
 
     logger.info(f'Создан платеж YooKassa: {yookassa_payment_id} на {amount_kopeks / 100}₽ для пользователя {user_id}')

app/external/remnawave_api.py

@@ -1,3 +1,4 @@
+import asyncio
 import base64
 import json
 import logging
@@ -366,32 +367,63 @@ class RemnaWaveAPI:
             raise RemnaWaveAPIError('Session not initialized. Use async context manager.')
 
         url = f'{self.base_url}{endpoint}'
+        max_retries = 3
+        base_delay = 1.0
 
-        try:
-            kwargs = {'url': url, 'params': params}
+        for attempt in range(max_retries + 1):
+            try:
+                kwargs = {'url': url, 'params': params}
 
-            if data:
-                kwargs['json'] = data
+                if data:
+                    kwargs['json'] = data
 
-            async with self.session.request(method, **kwargs) as response:
-                response_text = await response.text()
+                async with self.session.request(method, **kwargs) as response:
+                    response_text = await response.text()
 
-                try:
-                    response_data = json.loads(response_text) if response_text else {}
-                except json.JSONDecodeError:
-                    response_data = {'raw_response': response_text}
+                    try:
+                        response_data = json.loads(response_text) if response_text else {}
+                    except json.JSONDecodeError:
+                        response_data = {'raw_response': response_text}
 
-                if response.status >= 400:
-                    error_message = response_data.get('message', f'HTTP {response.status}')
-                    logger.error(f'API Error {response.status}: {error_message}')
-                    logger.error(f'Response: {response_text[:500]}')
-                    raise RemnaWaveAPIError(error_message, response.status, response_data)
+                    if response.status == 429 and attempt < max_retries:
+                        retry_after = float(response.headers.get('Retry-After', base_delay * (2**attempt)))
+                        logger.warning(
+                            'Rate limited (429) on %s %s, retry %d/%d after %.1fs',
+                            method,
+                            endpoint,
+                            attempt + 1,
+                            max_retries,
+                            retry_after,
+                        )
+                        await asyncio.sleep(retry_after)
+                        continue
 
-                return response_data
+                    if response.status >= 400:
+                        error_message = response_data.get('message', f'HTTP {response.status}')
+                        logger.error(f'API Error {response.status}: {error_message}')
+                        logger.error(f'Response: {response_text[:500]}')
+                        raise RemnaWaveAPIError(error_message, response.status, response_data)
 
-        except aiohttp.ClientError as e:
-            logger.error(f'Request failed: {e}')
-            raise RemnaWaveAPIError(f'Request failed: {e!s}')
+                    return response_data
+
+            except aiohttp.ClientError as e:
+                if attempt < max_retries:
+                    delay = base_delay * (2**attempt)
+                    logger.warning(
+                        'Request failed on %s %s: %s, retry %d/%d after %.1fs',
+                        method,
+                        endpoint,
+                        e,
+                        attempt + 1,
+                        max_retries,
+                        delay,
+                    )
+                    await asyncio.sleep(delay)
+                    continue
+                logger.error(f'Request failed: {e}')
+                raise RemnaWaveAPIError(f'Request failed: {e!s}')
+
+        raise RemnaWaveAPIError(f'Max retries exceeded for {method} {endpoint}')
 
     async def create_user(
         self,

app/handlers/admin/tickets.py

@@ -1045,10 +1045,11 @@ async def notify_user_about_ticket_reply(bot: Bot, ticket: Ticket, reply_text: s
             return
 
         if not getattr(user, 'telegram_id', None):
-            logger.error(
-                'Cannot notify ticket #%s user without telegram_id (username=%s)',
+            logger.warning(
+                'Cannot notify ticket #%s user without telegram_id (username=%s, auth_type=%s)',
                 ticket.id,
                 getattr(user, 'username', None),
+                getattr(user, 'auth_type', None),
             )
             return
 

app/handlers/start.py

@@ -3,7 +3,7 @@ from datetime import datetime
 
 from aiogram import Bot, Dispatcher, F, types
 from aiogram.enums import ChatMemberStatus
-from aiogram.exceptions import TelegramForbiddenError
+from aiogram.exceptions import TelegramBadRequest, TelegramForbiddenError
 from aiogram.filters import Command, StateFilter
 from aiogram.fsm.context import FSMContext
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -776,12 +776,11 @@ async def process_rules_accept(callback: types.CallbackQuery, state: FSMContext,
 
             try:
                 await callback.message.edit_text(rules_required_text, reply_markup=get_rules_keyboard(language))
-            except Exception as e:
-                logger.error(f'Ошибка при показе сообщения об отклонении правил: {e}')
-                try:
-                    await callback.message.edit_text(rules_required_text, reply_markup=get_rules_keyboard(language))
-                except:
-                    pass
+            except TelegramBadRequest as e:
+                if 'message is not modified' in str(e):
+                    pass  # Сообщение уже содержит нужный текст
+                else:
+                    logger.error(f'Ошибка при показе сообщения об отклонении правил: {e}')
 
         logger.info(f'✅ Правила обработаны для пользователя {callback.from_user.id}')
 

app/handlers/subscription/countries.py

@@ -468,6 +468,10 @@ async def select_country(callback: types.CallbackQuery, state: FSMContext, db_us
     country_uuid = callback.data.split('_')[1]
     data = await state.get_data()
 
+    if 'period_days' not in data:
+        await callback.answer('❌ Данные подписки устарели. Начните оформление заново.', show_alert=True)
+        return
+
     selected_countries = data.get('countries', [])
     if country_uuid in selected_countries:
         selected_countries.remove(country_uuid)

app/handlers/subscription/pricing.py

@@ -24,6 +24,10 @@ async def _prepare_subscription_summary(
     texts,
 ) -> tuple[str, dict[str, Any]]:
     summary_data = dict(data)
+
+    if 'period_days' not in summary_data:
+        raise KeyError('period_days missing from subscription data — FSM state likely expired')
+
     countries = await _get_available_countries(db_user.promo_group_id)
 
     months_in_period = calculate_months_from_days(summary_data['period_days'])

app/handlers/subscription/purchase.py

@@ -1402,6 +1402,11 @@ async def return_to_saved_cart(callback: types.CallbackQuery, state: FSMContext,
 
     prepared_cart_data = dict(cart_data)
 
+    if 'period_days' not in prepared_cart_data:
+        await callback.answer('❌ Корзина повреждена. Оформите подписку заново.', show_alert=True)
+        await user_cart_service.delete_user_cart(db_user.id)
+        return
+
     if not settings.is_devices_selection_enabled():
         try:
             from .pricing import _prepare_subscription_summary

app/handlers/tickets.py

@@ -80,6 +80,9 @@ async def handle_ticket_title_input(message: types.Message, state: FSMContext, d
         return
 
     """Обработать ввод заголовка тикета"""
+    if not message.text:
+        asyncio.create_task(_try_delete_message_later(message.bot, message.chat.id, message.message_id, 2.0))
+        return
     title = message.text.strip()
 
     data_prompt = await state.get_data()

app/services/blacklist_service.py

@@ -5,6 +5,7 @@
 
 import asyncio
 import logging
+import time
 from datetime import datetime, timedelta
 
 import aiohttp
@@ -27,6 +28,9 @@ class BlacklistService:
         interval_hours = self.get_blacklist_update_interval_hours()
         self.update_interval = timedelta(hours=interval_hours)
         self.lock = asyncio.Lock()  # Блокировка для предотвращения одновременных обновлений
+        # Кэш результатов проверки: {telegram_id: (is_blacklisted, reason, timestamp)}
+        self._check_cache: dict[int, tuple[bool, str | None, float]] = {}
+        self._cache_ttl = 300  # 5 минут
 
     def is_blacklist_check_enabled(self) -> bool:
         """Проверяет, включена ли проверка черного списка"""
@@ -117,6 +121,7 @@ class BlacklistService:
 
                 self.blacklist_data = blacklist_data
                 self.last_update = datetime.utcnow()
+                self._check_cache.clear()
                 logger.info(f'Черный список успешно обновлен. Найдено {len(blacklist_data)} записей')
                 return True
 
@@ -141,9 +146,17 @@ class BlacklistService:
         if not self.is_blacklist_check_enabled():
             return False, None
 
+        # Проверяем кэш
+        now = time.monotonic()
+        cached = self._check_cache.get(telegram_id)
+        if cached is not None:
+            is_bl, reason, ts = cached
+            if now - ts < self._cache_ttl:
+                return is_bl, reason
+
         # Проверяем, является ли пользователь администратором и нужно ли его игнорировать
         if self.should_ignore_admins() and self.is_admin(telegram_id):
-            logger.info(f'Пользователь {telegram_id} является администратором, игнорируем проверку черного списка')
+            self._check_cache[telegram_id] = (False, None, now)
             return False, None
 
         # Если черный список пуст или устарел, обновляем его
@@ -156,6 +169,7 @@ class BlacklistService:
         for bl_id, bl_username, bl_reason in self.blacklist_data:
             if bl_id == telegram_id:
                 logger.info(f'Пользователь {telegram_id} найден в черном списке по ID: {bl_reason}')
+                self._check_cache[telegram_id] = (True, bl_reason, now)
                 return True, bl_reason
 
         # Проверяем по username, если он передан
@@ -166,8 +180,10 @@ class BlacklistService:
                     logger.info(
                         f'Пользователь {username} ({telegram_id}) найден в черном списке по username: {bl_reason}'
                     )
+                    self._check_cache[telegram_id] = (True, bl_reason, now)
                     return True, bl_reason
 
+        self._check_cache[telegram_id] = (False, None, now)
         return False, None
 
     async def get_all_blacklisted_users(self) -> list[tuple[int, str, str]]:

app/services/payment/yookassa.py

@@ -1328,6 +1328,27 @@ class YooKassaPaymentMixin:
             )
             return None
 
+        # Verify user exists before creating FK-linked record
+        try:
+            from app.database.crud.user import get_user_by_id
+
+            user = await get_user_by_id(db, user_id)
+            if not user:
+                logger.warning(
+                    'Webhook YooKassa %s: user_id=%s не найден в БД, пропускаем восстановление платежа',
+                    yookassa_payment_id,
+                    user_id,
+                )
+                return None
+        except Exception as e:
+            logger.warning(
+                'Webhook YooKassa %s: не удалось проверить user_id=%s: %s',
+                yookassa_payment_id,
+                user_id,
+                e,
+            )
+            return None
+
         amount_info = event_object.get('amount') or {}
         amount_value = amount_info.get('value')
         currency = (amount_info.get('currency') or 'RUB').upper()

app/services/remnawave_service.py

@@ -151,19 +151,20 @@ class RemnaWaveService:
         elif not api_key:
             self._config_error = 'REMNAWAVE_API_KEY не настроен'
 
-        self.api: RemnaWaveAPI | None
-        if self._config_error:
-            self.api = None
-        else:
-            self.api = RemnaWaveAPI(
-                base_url=base_url,
-                api_key=api_key,
-                secret_key=auth_params.get('secret_key'),
-                username=auth_params.get('username'),
-                password=auth_params.get('password'),
-                caddy_token=auth_params.get('caddy_token'),
-                auth_type=auth_params.get('auth_type') or 'api_key',
-            )
+        # Сохраняем параметры для создания новых экземпляров API клиента
+        # (каждый вызов get_api_client создаёт свой экземпляр, чтобы
+        # параллельные корутины не перезаписывали друг другу aiohttp-сессию)
+        self._api_kwargs: dict | None = None
+        if not self._config_error:
+            self._api_kwargs = {
+                'base_url': base_url,
+                'api_key': api_key,
+                'secret_key': auth_params.get('secret_key'),
+                'username': auth_params.get('username'),
+                'password': auth_params.get('password'),
+                'caddy_token': auth_params.get('caddy_token'),
+                'auth_type': auth_params.get('auth_type') or 'api_key',
+            }
 
     @property
     def is_configured(self) -> bool:
@@ -174,7 +175,7 @@ class RemnaWaveService:
         return self._config_error
 
     def _ensure_configured(self) -> None:
-        if not self.is_configured or self.api is None:
+        if not self.is_configured or self._api_kwargs is None:
             raise RemnaWaveConfigurationError(self._config_error or 'RemnaWave API не настроен')
 
     def _ensure_user_remnawave_uuid(
@@ -228,8 +229,9 @@ class RemnaWaveService:
     @asynccontextmanager
     async def get_api_client(self):
         self._ensure_configured()
-        assert self.api is not None
-        async with self.api as api:
+        assert self._api_kwargs is not None
+        api = RemnaWaveAPI(**self._api_kwargs)
+        async with api:
             yield api
 
     def _now_utc(self) -> datetime:
@@ -1439,12 +1441,14 @@ class RemnaWaveService:
 
                 # Используем один API клиент для всех операций сброса HWID
                 hwid_api_client = None
+                hwid_api_cm = None
                 try:
-                    hwid_api_client = self.get_api_client()
-                    await hwid_api_client.__aenter__()
+                    hwid_api_cm = self.get_api_client()
+                    hwid_api_client = await hwid_api_cm.__aenter__()
                 except Exception as api_init_error:
                     logger.warning(f'⚠️ Не удалось создать API клиент для сброса HWID: {api_init_error}')
                     hwid_api_client = None
+                    hwid_api_cm = None
 
                 try:
                     for telegram_id, db_user in users_to_deactivate:
@@ -1565,9 +1569,9 @@ class RemnaWaveService:
 
                 finally:
                     # Закрываем API клиент
-                    if hwid_api_client:
+                    if hwid_api_cm:
                         try:
-                            await hwid_api_client.__aexit__(None, None, None)
+                            await hwid_api_cm.__aexit__(None, None, None)
                         except Exception:
                             pass
 

app/utils/markdown_to_telegram.py

@@ -153,6 +153,26 @@ def github_markdown_to_telegram_html(text: str) -> str:
     return result.strip()
 
 
+def _close_open_tags(html: str) -> str:
+    """Find unclosed HTML tags and append closing tags in reverse order."""
+    open_tags: list[str] = []
+    for match in _HTML_TAG_RE.finditer(html):
+        is_closing = match.group(1) == '/'
+        is_self_closing = match.group(4) == '/'
+        tag_name = match.group(2).lower()
+        if is_self_closing:
+            continue
+        if is_closing:
+            if open_tags and open_tags[-1] == tag_name:
+                open_tags.pop()
+        else:
+            open_tags.append(tag_name)
+    # Close remaining open tags in reverse order
+    for tag in reversed(open_tags):
+        html += f'</{tag}>'
+    return html
+
+
 def truncate_for_blockquote(
     description_html: str,
     *,
@@ -191,8 +211,10 @@ def truncate_for_blockquote(
     if len(description_html) <= available:
         return description_html
 
-    # Truncate, trying not to break mid-tag
-    truncated = description_html[: available - len(ellipsis)]
+    # Reserve space for ellipsis, then iteratively truncate until
+    # the result (with closing tags) fits within the budget.
+    budget = available - len(ellipsis)
+    truncated = description_html[:budget]
 
     # If we broke an HTML tag, backtrack to before it
     last_open = truncated.rfind('<')
@@ -200,4 +222,16 @@ def truncate_for_blockquote(
     if last_open > last_close:
         truncated = truncated[:last_open]
 
-    return truncated.rstrip() + ellipsis
+    # Close any unclosed HTML tags to avoid Telegram parse errors
+    closed = _close_open_tags(truncated)
+
+    # If closing tags pushed us over budget, trim more text
+    while len(closed) + len(ellipsis) > available and len(truncated) > 0:
+        truncated = truncated[:-20] if len(truncated) > 20 else ''
+        last_open = truncated.rfind('<')
+        last_close = truncated.rfind('>')
+        if last_open > last_close:
+            truncated = truncated[:last_open]
+        closed = _close_open_tags(truncated)
+
+    return closed.rstrip() + ellipsis

app/webserver/payments.py

@@ -524,8 +524,8 @@ def create_payment_router(bot: Bot, payment_service: PaymentService) -> APIRoute
                 if success:
                     return JSONResponse({'status': 'ok'})
 
-                order_id = payload.get('order_id', 'unknown')
-                logger.error('Wata webhook processing failed: order_id=%s', order_id)
+                order_id = payload.get('orderId') or payload.get('order_id') or 'unknown'
+                logger.error('Wata webhook processing failed: order_id=%s, payload=%s', order_id, payload)
                 return JSONResponse(
                     {'status': 'error', 'reason': 'not_processed'},
                     status_code=status.HTTP_400_BAD_REQUEST,

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = 'remnawave-bedolaga-telegram-bot'
-version = "3.6.0"
+version = "3.7.2"
 description = 'Telegram bot for RemnaWave VPN service'
 readme = 'README.md'
 license = { text = 'MIT' }

release-please-config.json

@@ -6,7 +6,11 @@
       "bump-patch-for-minor-pre-major": true,
       "include-component-in-tag": false,
       "extra-files": [
-        "pyproject.toml"
+        {
+          "type": "generic",
+          "path": "Dockerfile",
+          "glob": false
+        }
       ],
       "changelog-sections": [
         { "type": "feat", "section": "New Features" },