Files
remnawave-bedolaga-telegram…/app/webapi/schemas/users.py
T
Fringg 8175bc8bfe fix: comprehensive security hardening across payment and API layers
- CloudPayments: require webhook signature when secret configured (all 4 handlers)
- Platega: timing-safe HMAC comparison via hmac.compare_digest
- CryptoBot/Heleket: return False when API token unconfigured
- Tribute: return 503 when API key not configured
- Freekassa: use request.client.host instead of X-Forwarded-For
- Pal24: verify webhook amount matches stored payment amount
- YooKassa: reject test-mode payments in production; add YOOKASSA_TEST_MODE config
- CloudPayments: reject test-mode payments in production
- WebAPI: add upper bounds to duration_days, traffic_limit_gb, device_limit schemas
- WebAPI: bound balance update amount to ±100M kopeks
- WebAPI: sign-dispatch for balance updates (negative → subtract_user_balance)
- WebAPI miniapp: add blocked/deleted user checks, restriction_topup/subscription guards
- Admin handlers: add @admin_required and @error_handler to moderator panel
- add_user_balance: guard against negative amounts (use subtract_user_balance instead)
2026-03-23 16:44:38 +03:00

100 lines
2.7 KiB
Python

from __future__ import annotations
from datetime import datetime
from pydantic import BaseModel, Field
class PromoGroupSummary(BaseModel):
id: int
name: str
server_discount_percent: int
traffic_discount_percent: int
device_discount_percent: int
apply_discounts_to_addons: bool = True
class SubscriptionSummary(BaseModel):
id: int
status: str
actual_status: str
is_trial: bool
start_date: datetime
end_date: datetime
traffic_limit_gb: int
traffic_used_gb: float
device_limit: int
autopay_enabled: bool
autopay_days_before: int | None = None
subscription_url: str | None = None
subscription_crypto_link: str | None = None
connected_squads: list[str] = Field(default_factory=list)
class UserResponse(BaseModel):
id: int
telegram_id: int | None = None
username: str | None = None
first_name: str | None = None
last_name: str | None = None
status: str
language: str
balance_kopeks: int
balance_rubles: float
referral_code: str | None = None
referred_by_id: int | None = None
has_had_paid_subscription: bool
has_made_first_topup: bool
created_at: datetime
updated_at: datetime
last_activity: datetime | None = None
promo_group: PromoGroupSummary | None = None
subscription: SubscriptionSummary | None = None
class UserListResponse(BaseModel):
items: list[UserResponse]
total: int
limit: int
offset: int
class UserCreateRequest(BaseModel):
telegram_id: int | None = None
username: str | None = None
first_name: str | None = None
last_name: str | None = None
language: str = 'ru'
referred_by_id: int | None = None
promo_group_id: int | None = None
class UserUpdateRequest(BaseModel):
username: str | None = None
first_name: str | None = None
last_name: str | None = None
language: str | None = None
status: str | None = None
promo_group_id: int | None = None
referral_code: str | None = None
has_had_paid_subscription: bool | None = None
has_made_first_topup: bool | None = None
class BalanceUpdateRequest(BaseModel):
amount_kopeks: int = Field(..., ge=-100_000_000, le=100_000_000)
description: str | None = Field(default='Корректировка через веб-API')
create_transaction: bool = True
class UserSubscriptionCreateRequest(BaseModel):
"""Схема для создания подписки через users API (user_id берется из URL)"""
is_trial: bool = False
duration_days: int | None = None
traffic_limit_gb: int | None = None
device_limit: int | None = None
squad_uuid: str | None = None
connected_squads: list[str] | None = None
replace_existing: bool = False