Fringg 443a826402 fix: PayPear webhook signature — strip signature field before hashing + IP fallback ...

The old code hashed the full raw body INCLUDING the 'signature' field
itself — a circular computation that can never match (you can't include
the signature in the data being signed).

Fix:
1. Strip 'signature' key from payload before HMAC-SHA256 computation
2. Try both sorted and unsorted keys (PayPear docs don't specify)
3. Fallback to IP allowlist check (158.160.85.101 per PayPear docs)
4. Pass client_ip from request headers to the verification function

2026-04-29 11:23:20 +03:00

..

contests

fix: UUID warnings, phantom merge, yookassa validation, contest prize notification

2026-03-25 11:47:02 +03:00

menu_layout

feat: multi-subscription support (1 user = N subscriptions)

2026-03-23 18:37:17 +03:00

payment

fix: downgrade Pal24 API validation errors from error to debug

2026-04-29 10:25:08 +03:00

__init__.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

account_merge_service.py

chore: ruff format account_merge_service.py

2026-03-29 06:49:13 +03:00

admin_notification_service.py

feat: per-category enable/disable for admin notifications

2026-04-29 06:58:57 +03:00

aurapay_service.py

feat: integrate AuraPay payment provider

2026-04-18 00:02:49 +03:00

backup_service.py

fix: backup import crash + upload handler hardening

2026-04-26 19:39:09 +03:00

ban_notification_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

blacklist_service.py

fix: batch bug fixes from user complaints

2026-04-08 18:33:17 +03:00

blocked_users_service.py

chore: ruff format

2026-03-26 10:34:14 +03:00

broadcast_service.py

feat: add broadcast category (system/news/promo) + filter recipients by user prefs

2026-04-10 16:05:43 +03:00

bulk_ban_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

campaign_service.py

fix: grant all available squads for unrestricted trials (#2897)

2026-04-21 08:01:28 +03:00

channel_subscription_service.py

fix: respect per-channel disable_on_leave settings in monitoring service

2026-03-23 05:54:26 +03:00

cloudpayments_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

contest_rotation_service.py

feat: add multi-channel mandatory subscription system

2026-02-24 02:50:31 +03:00

daily_subscription_service.py

fix: rate-limit daily subscription insufficient balance notifications to 6 hours

2026-04-18 00:59:09 +03:00

disposable_email_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

event_emitter.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

faq_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

freekassa_service.py

fix: harden webhook signature verification across all payment providers

2026-03-23 18:45:46 +03:00

guest_purchase_service.py

fix: integrate Yandex Metrika offline conv + S2S postback hooks

2026-04-24 16:59:27 +03:00

kassa_ai_service.py

feat: add SberPay as KassaAI sub-method (payment_system_id=43)

2026-04-02 06:47:57 +03:00

log_rotation_service.py

fix: use keyword args for Path.mkdir in asyncio.to_thread

2026-03-11 01:22:02 +03:00

main_menu_button_service.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

maintenance_service.py

feat: раздельные топики для админских уведомлений

2026-03-18 23:16:54 +03:00

menu_layout_service.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

monitoring_service.py

fix: false subscription expiry notifications — 4 bugs fixed

2026-04-29 05:47:56 +03:00

mulenpay_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

nalogo_queue_service.py

fix: enforce max_attempts limit in NaloGO receipt queue

2026-04-13 14:42:06 +03:00

nalogo_service.py

fix: sanitize proxy credentials in all nalogo error paths

2026-03-21 04:27:15 +03:00

news_media_service.py

fix: validate FK existence, add FK indexes, expand video brand whitelist

2026-03-23 15:40:16 +03:00

notification_delivery_service.py

fix: add missing WEBHOOK_TORRENT_DETECTED mapping + dedup before unique index in migration 0053

2026-04-03 20:50:13 +03:00

notification_settings_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

overpay_service.py

feat: integrate Overpay payment provider (pay.overpay.io)

2026-04-23 04:36:56 +03:00

pal24_service.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

partner_application_service.py

feat: add desired commission percent to partner application

2026-02-27 04:02:17 +03:00

partner_stats_service.py

fix: align campaign top registrations revenue with period comparison

2026-04-18 00:50:23 +03:00

payment_method_config_service.py

feat: integrate Overpay payment provider (pay.overpay.io)

2026-04-23 04:36:56 +03:00

payment_search_service.py

feat: integrate Overpay payment provider (pay.overpay.io)

2026-04-23 04:36:56 +03:00

payment_service.py

feat: integrate Overpay payment provider (pay.overpay.io)

2026-04-23 04:36:56 +03:00

payment_verification_service.py

feat: integrate Overpay payment provider (pay.overpay.io)

2026-04-23 04:36:56 +03:00

paypear_service.py

fix: PayPear webhook signature — strip signature field before hashing + IP fallback

2026-04-29 11:23:20 +03:00

permission_service.py

feat: add bulk_actions, info_pages, news to PERMISSION_REGISTRY

2026-04-29 11:14:24 +03:00

phantom_service.py

style: fix ruff format for all sync-related changes

2026-04-10 15:13:59 +03:00

pinned_message_service.py

fix: use fresh DB session for deactivate after long unpin loop

2026-04-24 18:13:48 +03:00

platega_service.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

poll_service.py

fix: comprehensive html.escape() for all user/admin data in Telegram HTML messages

2026-03-23 08:06:15 +03:00

pricing_engine.py

fix: traffic addon discount also bypassed tariff-promo-group check

2026-04-29 07:14:14 +03:00

privacy_policy_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

promo_group_assignment.py

refactor: centralize Bot instantiation via create_bot() factory

2026-03-21 02:49:37 +03:00

promo_offer_service.py

style: fix ruff format for all sync-related changes

2026-04-10 15:13:59 +03:00

promocode_service.py

fix: grant all available squads for unrestricted trials (#2897)

2026-04-21 08:01:28 +03:00

public_offer_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

rbac_bootstrap_service.py

chore: ruff format rbac_bootstrap_service.py

2026-03-22 10:51:26 +03:00

recurrent_payment_service.py

feat: add tariff identification to all notifications for multi-tariff mode

2026-03-28 19:12:34 +03:00

referral_contest_service.py

feat: per-category enable/disable for admin notifications

2026-04-29 06:58:57 +03:00

referral_diagnostics_service.py

fix: исправления системы реферальных конкурсов

2026-03-06 01:33:06 +03:00

referral_service.py

fix: suppress empty reward alerts and clean up referral notifications

2026-03-29 04:59:23 +03:00

referral_withdrawal_service.py

fix: comprehensive html.escape() for all user/admin data in Telegram HTML messages

2026-03-23 08:06:15 +03:00

remnawave_resync_service.py

style: fix ruff format for all sync-related changes

2026-04-10 15:13:59 +03:00

remnawave_retry_queue.py

style: fix ruff format for all sync-related changes

2026-04-10 15:13:59 +03:00

remnawave_service.py

fix: handle A018 error code as user-not-found fallback to create_user

2026-04-29 06:48:30 +03:00

remnawave_sync_service.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

remnawave_webhook_service.py

fix: deadlock on user deletion — webhook handler never checked intentional mark

2026-04-29 10:28:57 +03:00

reporting_service.py

fix: manual admin top-ups missing from sales statistics

2026-03-21 07:01:22 +03:00

riopay_service.py

chore: ruff format and cleanup

2026-03-18 18:20:50 +03:00

rollypay_service.py

fix: support payment_method selection for RollyPay (sbp/card/crypto)

2026-04-16 06:03:33 +03:00

s2s_postback_service.py

feat: Yandex Metrika offline conversions + S2S postbacks

2026-04-22 05:57:46 +03:00

server_status_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

severpay_service.py

feat: добавлена интеграция SeverPay для пополнения баланса

2026-03-18 03:49:19 +03:00

startup_notification_service.py

feat: раздельные топики для админских уведомлений

2026-03-18 23:16:54 +03:00

subscription_auto_purchase_service.py

fix: autopay renewing trial subscriptions at classic-mode pricing

2026-04-29 08:16:39 +03:00

subscription_checkout_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

subscription_purchase_service.py

fix: create panel user instead of update for new subscriptions in multi-tariff mode

2026-04-15 13:14:10 +03:00

subscription_renewal_service.py

fix: classic mode renewal resets device_limit to 1 via cart key mismatch

2026-04-22 05:12:27 +03:00

subscription_service.py

fix: default sync_squads=True in update_remnawave_user (BUG-4)

2026-04-10 10:34:56 +03:00

support_settings_service.py

fix: sync SUPPORT_SYSTEM_MODE between SystemSettings and SupportSettings

2026-02-16 18:22:44 +03:00

system_settings_service.py

refactor: remove unused EXTERNAL_ADMIN_TOKEN functionality

2026-04-26 19:54:33 +03:00

traffic_monitoring_service.py

fix: comprehensive html.escape() for all user/admin data in Telegram HTML messages

2026-03-23 08:06:15 +03:00

trial_activation_service.py

fix: добавить create_transaction для 6 потоков оплаты с баланса

2026-03-05 10:15:32 +03:00

tribute_service.py

fix: миграция Tribute webhook с deprecated user_id на trb_user_id

2026-03-17 12:43:04 +03:00

user_cart_service.py

chore: ruff format

2026-03-26 10:34:14 +03:00

user_service.py

style: fix ruff format for all sync-related changes

2026-04-10 15:13:59 +03:00

version_service.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

wata_service.py

fix: atomicity refactor, review fixes, and DELETED recovery logging

2026-03-12 19:26:36 +03:00

web_api_token_service.py

style: apply ruff formatting

2026-02-18 08:11:33 +03:00

web_auth_service.py

fix: review findings — db.commit, isinstance guard, constants, ACTIVE check

2026-03-17 21:56:52 +03:00

webhook_service.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

wheel_service.py

fix: multi-tariff Stage 3 critical fixes — panel sync UUID, admin grant, wheel

2026-03-26 08:26:09 +03:00

yandex_offline_conv_service.py

feat: Yandex Metrika offline conversions + S2S postbacks

2026-04-22 05:57:46 +03:00

yookassa_service.py

refactor: централизация всех расчётов цен в PricingEngine

2026-03-16 03:10:22 +03:00