1105 lines
37 KiB
Python
1105 lines
37 KiB
Python
from datetime import datetime
|
||
from fastapi import APIRouter, HTTPException, Query, Request, UploadFile, File, Form
|
||
from sqlalchemy import select, func
|
||
from sqlalchemy.orm import selectinload
|
||
from pydantic import BaseModel, Field
|
||
from typing import Optional
|
||
|
||
from app.api.deps import DbSession, CurrentUser, require_admin_with_2fa
|
||
from app.models import (
|
||
User, UserRole, Marathon, MarathonStatus, Participant, Game, AdminLog, AdminActionType, StaticContent,
|
||
Dispute, DisputeStatus, Assignment, AssignmentStatus, Challenge, BonusAssignment, BonusAssignmentStatus
|
||
)
|
||
from app.schemas import (
|
||
UserPublic, MessageResponse,
|
||
AdminUserResponse, BanUserRequest, AdminResetPasswordRequest, AdminLogResponse, AdminLogsListResponse,
|
||
BroadcastRequest, BroadcastResponse, StaticContentResponse, StaticContentUpdate,
|
||
StaticContentCreate, DashboardStats
|
||
)
|
||
from app.core.security import get_password_hash
|
||
from app.services.telegram_notifier import telegram_notifier
|
||
from app.core.rate_limit import limiter
|
||
|
||
router = APIRouter(prefix="/admin", tags=["admin"])
|
||
|
||
|
||
class SetUserRole(BaseModel):
|
||
role: str = Field(..., pattern="^(user|admin)$")
|
||
|
||
|
||
class AdminMarathonResponse(BaseModel):
|
||
id: int
|
||
title: str
|
||
status: str
|
||
creator: UserPublic
|
||
participants_count: int
|
||
games_count: int
|
||
start_date: str | None
|
||
end_date: str | None
|
||
created_at: str
|
||
|
||
class Config:
|
||
from_attributes = True
|
||
|
||
|
||
# ============ Helper Functions ============
|
||
async def log_admin_action(
|
||
db,
|
||
admin_id: int,
|
||
action: str,
|
||
target_type: str,
|
||
target_id: int,
|
||
details: dict | None = None,
|
||
ip_address: str | None = None
|
||
):
|
||
"""Log an admin action."""
|
||
log = AdminLog(
|
||
admin_id=admin_id,
|
||
action=action,
|
||
target_type=target_type,
|
||
target_id=target_id,
|
||
details=details,
|
||
ip_address=ip_address,
|
||
)
|
||
db.add(log)
|
||
await db.commit()
|
||
|
||
|
||
def build_admin_user_response(user: User, marathons_count: int) -> AdminUserResponse:
|
||
"""Build AdminUserResponse from User model."""
|
||
return AdminUserResponse(
|
||
id=user.id,
|
||
login=user.login,
|
||
nickname=user.nickname,
|
||
role=user.role,
|
||
avatar_url=user.avatar_url,
|
||
telegram_id=user.telegram_id,
|
||
telegram_username=user.telegram_username,
|
||
marathons_count=marathons_count,
|
||
created_at=user.created_at.isoformat(),
|
||
is_banned=user.is_banned,
|
||
banned_at=user.banned_at.isoformat() if user.banned_at else None,
|
||
banned_until=user.banned_until.isoformat() if user.banned_until else None,
|
||
ban_reason=user.ban_reason,
|
||
notify_events=user.notify_events,
|
||
notify_disputes=user.notify_disputes,
|
||
notify_moderation=user.notify_moderation,
|
||
)
|
||
|
||
|
||
@router.get("/users", response_model=list[AdminUserResponse])
|
||
async def list_users(
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
skip: int = Query(0, ge=0),
|
||
limit: int = Query(50, ge=1, le=100),
|
||
search: str | None = None,
|
||
banned_only: bool = False,
|
||
):
|
||
"""List all users. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
query = select(User).order_by(User.created_at.desc())
|
||
|
||
if search:
|
||
query = query.where(
|
||
(User.login.ilike(f"%{search}%")) |
|
||
(User.nickname.ilike(f"%{search}%"))
|
||
)
|
||
|
||
if banned_only:
|
||
query = query.where(User.is_banned == True)
|
||
|
||
query = query.offset(skip).limit(limit)
|
||
result = await db.execute(query)
|
||
users = result.scalars().all()
|
||
|
||
response = []
|
||
for user in users:
|
||
# Count marathons user participates in
|
||
marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.user_id == user.id)
|
||
)
|
||
response.append(build_admin_user_response(user, marathons_count))
|
||
|
||
return response
|
||
|
||
|
||
@router.get("/users/{user_id}", response_model=AdminUserResponse)
|
||
async def get_user(user_id: int, current_user: CurrentUser, db: DbSession):
|
||
"""Get user details. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(select(User).where(User.id == user_id))
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="User not found")
|
||
|
||
marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.user_id == user.id)
|
||
)
|
||
|
||
return build_admin_user_response(user, marathons_count)
|
||
|
||
|
||
@router.patch("/users/{user_id}/role", response_model=AdminUserResponse)
|
||
async def set_user_role(
|
||
user_id: int,
|
||
data: SetUserRole,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
request: Request,
|
||
):
|
||
"""Set user's global role. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
# Cannot change own role
|
||
if user_id == current_user.id:
|
||
raise HTTPException(status_code=400, detail="Cannot change your own role")
|
||
|
||
result = await db.execute(select(User).where(User.id == user_id))
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="User not found")
|
||
|
||
old_role = user.role
|
||
user.role = data.role
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.USER_ROLE_CHANGE.value,
|
||
"user", user_id,
|
||
{"old_role": old_role, "new_role": data.role, "nickname": user.nickname},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.user_id == user.id)
|
||
)
|
||
|
||
return build_admin_user_response(user, marathons_count)
|
||
|
||
|
||
@router.delete("/users/{user_id}", response_model=MessageResponse)
|
||
async def delete_user(user_id: int, current_user: CurrentUser, db: DbSession):
|
||
"""Delete a user. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
# Cannot delete yourself
|
||
if user_id == current_user.id:
|
||
raise HTTPException(status_code=400, detail="Cannot delete yourself")
|
||
|
||
result = await db.execute(select(User).where(User.id == user_id))
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="User not found")
|
||
|
||
# Cannot delete another admin
|
||
if user.role == UserRole.ADMIN.value:
|
||
raise HTTPException(status_code=400, detail="Cannot delete another admin")
|
||
|
||
await db.delete(user)
|
||
await db.commit()
|
||
|
||
return MessageResponse(message="User deleted")
|
||
|
||
|
||
@router.get("/marathons", response_model=list[AdminMarathonResponse])
|
||
async def list_marathons(
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
skip: int = Query(0, ge=0),
|
||
limit: int = Query(50, ge=1, le=200),
|
||
search: str | None = None,
|
||
):
|
||
"""List all marathons. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
query = (
|
||
select(Marathon)
|
||
.options(selectinload(Marathon.creator))
|
||
.order_by(Marathon.created_at.desc())
|
||
)
|
||
|
||
if search:
|
||
query = query.where(Marathon.title.ilike(f"%{search}%"))
|
||
|
||
query = query.offset(skip).limit(limit)
|
||
result = await db.execute(query)
|
||
marathons = result.scalars().all()
|
||
|
||
response = []
|
||
for marathon in marathons:
|
||
participants_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.marathon_id == marathon.id)
|
||
)
|
||
games_count = await db.scalar(
|
||
select(func.count()).select_from(Game).where(Game.marathon_id == marathon.id)
|
||
)
|
||
response.append(AdminMarathonResponse(
|
||
id=marathon.id,
|
||
title=marathon.title,
|
||
status=marathon.status,
|
||
creator=UserPublic.model_validate(marathon.creator),
|
||
participants_count=participants_count,
|
||
games_count=games_count,
|
||
start_date=marathon.start_date.isoformat() if marathon.start_date else None,
|
||
end_date=marathon.end_date.isoformat() if marathon.end_date else None,
|
||
created_at=marathon.created_at.isoformat(),
|
||
))
|
||
|
||
return response
|
||
|
||
|
||
@router.delete("/marathons/{marathon_id}", response_model=MessageResponse)
|
||
async def delete_marathon(marathon_id: int, current_user: CurrentUser, db: DbSession, request: Request):
|
||
"""Delete a marathon. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(select(Marathon).where(Marathon.id == marathon_id))
|
||
marathon = result.scalar_one_or_none()
|
||
if not marathon:
|
||
raise HTTPException(status_code=404, detail="Marathon not found")
|
||
|
||
marathon_title = marathon.title
|
||
await db.delete(marathon)
|
||
await db.commit()
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.MARATHON_DELETE.value,
|
||
"marathon", marathon_id,
|
||
{"title": marathon_title},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
return MessageResponse(message="Marathon deleted")
|
||
|
||
|
||
@router.get("/stats")
|
||
async def get_stats(current_user: CurrentUser, db: DbSession):
|
||
"""Get platform statistics. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
users_count = await db.scalar(select(func.count()).select_from(User))
|
||
marathons_count = await db.scalar(select(func.count()).select_from(Marathon))
|
||
games_count = await db.scalar(select(func.count()).select_from(Game))
|
||
participants_count = await db.scalar(select(func.count()).select_from(Participant))
|
||
|
||
return {
|
||
"users_count": users_count,
|
||
"marathons_count": marathons_count,
|
||
"games_count": games_count,
|
||
"total_participations": participants_count,
|
||
}
|
||
|
||
|
||
# ============ Ban/Unban Users ============
|
||
@router.post("/users/{user_id}/ban", response_model=AdminUserResponse)
|
||
@limiter.limit("10/minute")
|
||
async def ban_user(
|
||
request: Request,
|
||
user_id: int,
|
||
data: BanUserRequest,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Ban a user. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
if user_id == current_user.id:
|
||
raise HTTPException(status_code=400, detail="Cannot ban yourself")
|
||
|
||
result = await db.execute(select(User).where(User.id == user_id))
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="User not found")
|
||
|
||
if user.role == UserRole.ADMIN.value:
|
||
raise HTTPException(status_code=400, detail="Cannot ban another admin")
|
||
|
||
if user.is_banned:
|
||
raise HTTPException(status_code=400, detail="User is already banned")
|
||
|
||
user.is_banned = True
|
||
user.banned_at = datetime.utcnow()
|
||
# Normalize to naive datetime (remove tzinfo) to match banned_at
|
||
user.banned_until = data.banned_until.replace(tzinfo=None) if data.banned_until else None
|
||
user.banned_by_id = current_user.id
|
||
user.ban_reason = data.reason
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.USER_BAN.value,
|
||
"user", user_id,
|
||
{"nickname": user.nickname, "reason": data.reason},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.user_id == user.id)
|
||
)
|
||
|
||
return build_admin_user_response(user, marathons_count)
|
||
|
||
|
||
@router.post("/users/{user_id}/unban", response_model=AdminUserResponse)
|
||
async def unban_user(
|
||
request: Request,
|
||
user_id: int,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Unban a user. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(select(User).where(User.id == user_id))
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="User not found")
|
||
|
||
if not user.is_banned:
|
||
raise HTTPException(status_code=400, detail="User is not banned")
|
||
|
||
user.is_banned = False
|
||
user.banned_at = None
|
||
user.banned_until = None
|
||
user.banned_by_id = None
|
||
user.ban_reason = None
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.USER_UNBAN.value,
|
||
"user", user_id,
|
||
{"nickname": user.nickname},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.user_id == user.id)
|
||
)
|
||
|
||
return build_admin_user_response(user, marathons_count)
|
||
|
||
|
||
# ============ Reset Password ============
|
||
@router.post("/users/{user_id}/reset-password", response_model=AdminUserResponse)
|
||
async def reset_user_password(
|
||
request: Request,
|
||
user_id: int,
|
||
data: AdminResetPasswordRequest,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Reset user password. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(select(User).where(User.id == user_id))
|
||
user = result.scalar_one_or_none()
|
||
if not user:
|
||
raise HTTPException(status_code=404, detail="User not found")
|
||
|
||
# Hash and save new password
|
||
user.password_hash = get_password_hash(data.new_password)
|
||
await db.commit()
|
||
await db.refresh(user)
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.USER_PASSWORD_RESET.value,
|
||
"user", user_id,
|
||
{"nickname": user.nickname},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
# Notify user via Telegram if linked
|
||
if user.telegram_id:
|
||
await telegram_notifier.send_message(
|
||
user.telegram_id,
|
||
"🔐 <b>Ваш пароль был сброшен</b>\n\n"
|
||
"Администратор установил вам новый пароль. "
|
||
"Если это были не вы, свяжитесь с поддержкой."
|
||
)
|
||
|
||
marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Participant).where(Participant.user_id == user.id)
|
||
)
|
||
|
||
return build_admin_user_response(user, marathons_count)
|
||
|
||
|
||
# ============ Force Finish Marathon ============
|
||
@router.post("/marathons/{marathon_id}/force-finish", response_model=MessageResponse)
|
||
async def force_finish_marathon(
|
||
request: Request,
|
||
marathon_id: int,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Force finish a marathon. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(select(Marathon).where(Marathon.id == marathon_id))
|
||
marathon = result.scalar_one_or_none()
|
||
if not marathon:
|
||
raise HTTPException(status_code=404, detail="Marathon not found")
|
||
|
||
if marathon.status == MarathonStatus.FINISHED.value:
|
||
raise HTTPException(status_code=400, detail="Marathon is already finished")
|
||
|
||
old_status = marathon.status
|
||
marathon.status = MarathonStatus.FINISHED.value
|
||
marathon.end_date = datetime.utcnow()
|
||
await db.commit()
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.MARATHON_FORCE_FINISH.value,
|
||
"marathon", marathon_id,
|
||
{"title": marathon.title, "old_status": old_status},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
# Notify participants
|
||
await telegram_notifier.notify_marathon_finish(db, marathon_id, marathon.title)
|
||
|
||
return MessageResponse(message="Marathon finished")
|
||
|
||
|
||
# ============ Admin Logs ============
|
||
@router.get("/logs", response_model=AdminLogsListResponse)
|
||
async def get_logs(
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
skip: int = Query(0, ge=0),
|
||
limit: int = Query(50, ge=1, le=100),
|
||
action: str | None = None,
|
||
admin_id: int | None = None,
|
||
):
|
||
"""Get admin action logs. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
query = (
|
||
select(AdminLog)
|
||
.options(selectinload(AdminLog.admin))
|
||
.order_by(AdminLog.created_at.desc())
|
||
)
|
||
|
||
if action:
|
||
query = query.where(AdminLog.action == action)
|
||
if admin_id:
|
||
query = query.where(AdminLog.admin_id == admin_id)
|
||
|
||
# Get total count
|
||
count_query = select(func.count()).select_from(AdminLog)
|
||
if action:
|
||
count_query = count_query.where(AdminLog.action == action)
|
||
if admin_id:
|
||
count_query = count_query.where(AdminLog.admin_id == admin_id)
|
||
total = await db.scalar(count_query)
|
||
|
||
query = query.offset(skip).limit(limit)
|
||
result = await db.execute(query)
|
||
logs = result.scalars().all()
|
||
|
||
return AdminLogsListResponse(
|
||
logs=[
|
||
AdminLogResponse(
|
||
id=log.id,
|
||
admin_id=log.admin_id,
|
||
admin_nickname=log.admin.nickname if log.admin else None,
|
||
action=log.action,
|
||
target_type=log.target_type,
|
||
target_id=log.target_id,
|
||
details=log.details,
|
||
ip_address=log.ip_address,
|
||
created_at=log.created_at,
|
||
)
|
||
for log in logs
|
||
],
|
||
total=total or 0,
|
||
)
|
||
|
||
|
||
# ============ Broadcast ============
|
||
@router.post("/broadcast/all", response_model=BroadcastResponse)
|
||
@limiter.limit("1/minute")
|
||
async def broadcast_to_all(
|
||
request: Request,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
message: str = Form(""),
|
||
media: list[UploadFile] = File(default=[]),
|
||
):
|
||
"""Send broadcast message to all users with Telegram linked. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
# Get all users with telegram_id
|
||
result = await db.execute(
|
||
select(User).where(User.telegram_id.isnot(None))
|
||
)
|
||
users = result.scalars().all()
|
||
|
||
total_count = len(users)
|
||
sent_count = 0
|
||
|
||
# Read media files if provided (up to 10 files, Telegram limit)
|
||
media_items = []
|
||
for file in media[:10]:
|
||
if file and file.filename:
|
||
file_data = await file.read()
|
||
content_type = file.content_type or ""
|
||
if content_type.startswith("image/"):
|
||
media_items.append({
|
||
"type": "photo",
|
||
"data": file_data,
|
||
"filename": file.filename,
|
||
"content_type": content_type
|
||
})
|
||
elif content_type.startswith("video/"):
|
||
media_items.append({
|
||
"type": "video",
|
||
"data": file_data,
|
||
"filename": file.filename,
|
||
"content_type": content_type
|
||
})
|
||
|
||
for user in users:
|
||
if await telegram_notifier.send_media_message(
|
||
user.telegram_id,
|
||
text=message if message.strip() else None,
|
||
media_items=media_items if media_items else None
|
||
):
|
||
sent_count += 1
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.BROADCAST_ALL.value,
|
||
"broadcast", 0,
|
||
{"message": message[:100], "sent": sent_count, "total": total_count, "media_count": len(media_items)},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
return BroadcastResponse(sent_count=sent_count, total_count=total_count)
|
||
|
||
|
||
@router.post("/broadcast/marathon/{marathon_id}", response_model=BroadcastResponse)
|
||
@limiter.limit("3/minute")
|
||
async def broadcast_to_marathon(
|
||
request: Request,
|
||
marathon_id: int,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
message: str = Form(""),
|
||
media: list[UploadFile] = File(default=[]),
|
||
):
|
||
"""Send broadcast message to marathon participants. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
# Check marathon exists
|
||
result = await db.execute(select(Marathon).where(Marathon.id == marathon_id))
|
||
marathon = result.scalar_one_or_none()
|
||
if not marathon:
|
||
raise HTTPException(status_code=404, detail="Marathon not found")
|
||
|
||
# Get participants with telegram
|
||
total_result = await db.execute(
|
||
select(User)
|
||
.join(Participant, Participant.user_id == User.id)
|
||
.where(
|
||
Participant.marathon_id == marathon_id,
|
||
User.telegram_id.isnot(None)
|
||
)
|
||
)
|
||
users = total_result.scalars().all()
|
||
total_count = len(users)
|
||
|
||
# Read media files if provided (up to 10 files, Telegram limit)
|
||
media_items = []
|
||
for file in media[:10]:
|
||
if file and file.filename:
|
||
file_data = await file.read()
|
||
content_type = file.content_type or ""
|
||
if content_type.startswith("image/"):
|
||
media_items.append({
|
||
"type": "photo",
|
||
"data": file_data,
|
||
"filename": file.filename,
|
||
"content_type": content_type
|
||
})
|
||
elif content_type.startswith("video/"):
|
||
media_items.append({
|
||
"type": "video",
|
||
"data": file_data,
|
||
"filename": file.filename,
|
||
"content_type": content_type
|
||
})
|
||
|
||
sent_count = 0
|
||
for user in users:
|
||
if await telegram_notifier.send_media_message(
|
||
user.telegram_id,
|
||
text=message if message.strip() else None,
|
||
media_items=media_items if media_items else None
|
||
):
|
||
sent_count += 1
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.BROADCAST_MARATHON.value,
|
||
"marathon", marathon_id,
|
||
{"title": marathon.title, "message": message[:100], "sent": sent_count, "total": total_count, "media_count": len(media_items)},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
return BroadcastResponse(sent_count=sent_count, total_count=total_count)
|
||
|
||
|
||
# ============ Static Content ============
|
||
@router.get("/content", response_model=list[StaticContentResponse])
|
||
async def list_content(current_user: CurrentUser, db: DbSession):
|
||
"""List all static content. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(
|
||
select(StaticContent).order_by(StaticContent.key)
|
||
)
|
||
return result.scalars().all()
|
||
|
||
|
||
@router.get("/content/{key}", response_model=StaticContentResponse)
|
||
async def get_content(key: str, current_user: CurrentUser, db: DbSession):
|
||
"""Get static content by key. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(
|
||
select(StaticContent).where(StaticContent.key == key)
|
||
)
|
||
content = result.scalar_one_or_none()
|
||
if not content:
|
||
raise HTTPException(status_code=404, detail="Content not found")
|
||
return content
|
||
|
||
|
||
@router.put("/content/{key}", response_model=StaticContentResponse)
|
||
async def update_content(
|
||
request: Request,
|
||
key: str,
|
||
data: StaticContentUpdate,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Update static content. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(
|
||
select(StaticContent).where(StaticContent.key == key)
|
||
)
|
||
content = result.scalar_one_or_none()
|
||
if not content:
|
||
raise HTTPException(status_code=404, detail="Content not found")
|
||
|
||
content.title = data.title
|
||
content.content = data.content
|
||
content.updated_by_id = current_user.id
|
||
content.updated_at = datetime.utcnow()
|
||
await db.commit()
|
||
await db.refresh(content)
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.CONTENT_UPDATE.value,
|
||
"content", content.id,
|
||
{"key": key, "title": data.title},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
return content
|
||
|
||
|
||
@router.post("/content", response_model=StaticContentResponse)
|
||
async def create_content(
|
||
request: Request,
|
||
data: StaticContentCreate,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Create static content. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
# Check if key exists
|
||
result = await db.execute(
|
||
select(StaticContent).where(StaticContent.key == data.key)
|
||
)
|
||
if result.scalar_one_or_none():
|
||
raise HTTPException(status_code=400, detail="Content with this key already exists")
|
||
|
||
content = StaticContent(
|
||
key=data.key,
|
||
title=data.title,
|
||
content=data.content,
|
||
updated_by_id=current_user.id,
|
||
)
|
||
db.add(content)
|
||
await db.commit()
|
||
await db.refresh(content)
|
||
|
||
return content
|
||
|
||
|
||
@router.delete("/content/{key}", response_model=MessageResponse)
|
||
async def delete_content(
|
||
key: str,
|
||
request: Request,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Delete static content. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
result = await db.execute(
|
||
select(StaticContent).where(StaticContent.key == key)
|
||
)
|
||
content = result.scalar_one_or_none()
|
||
if not content:
|
||
raise HTTPException(status_code=404, detail="Content not found")
|
||
|
||
await db.delete(content)
|
||
await db.commit()
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, AdminActionType.CONTENT_UPDATE.value,
|
||
"static_content", content.id,
|
||
{"action": "delete", "key": key},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
return {"message": f"Content '{key}' deleted successfully"}
|
||
|
||
|
||
# ============ Dashboard ============
|
||
@router.get("/dashboard", response_model=DashboardStats)
|
||
async def get_dashboard(current_user: CurrentUser, db: DbSession):
|
||
"""Get dashboard statistics. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
users_count = await db.scalar(select(func.count()).select_from(User))
|
||
banned_users_count = await db.scalar(
|
||
select(func.count()).select_from(User).where(User.is_banned == True)
|
||
)
|
||
marathons_count = await db.scalar(select(func.count()).select_from(Marathon))
|
||
active_marathons_count = await db.scalar(
|
||
select(func.count()).select_from(Marathon).where(Marathon.status == MarathonStatus.ACTIVE.value)
|
||
)
|
||
games_count = await db.scalar(select(func.count()).select_from(Game))
|
||
total_participations = await db.scalar(select(func.count()).select_from(Participant))
|
||
|
||
# Get recent logs
|
||
result = await db.execute(
|
||
select(AdminLog)
|
||
.options(selectinload(AdminLog.admin))
|
||
.order_by(AdminLog.created_at.desc())
|
||
.limit(10)
|
||
)
|
||
recent_logs = result.scalars().all()
|
||
|
||
return DashboardStats(
|
||
users_count=users_count or 0,
|
||
banned_users_count=banned_users_count or 0,
|
||
marathons_count=marathons_count or 0,
|
||
active_marathons_count=active_marathons_count or 0,
|
||
games_count=games_count or 0,
|
||
total_participations=total_participations or 0,
|
||
recent_logs=[
|
||
AdminLogResponse(
|
||
id=log.id,
|
||
admin_id=log.admin_id,
|
||
admin_nickname=log.admin.nickname if log.admin else None,
|
||
action=log.action,
|
||
target_type=log.target_type,
|
||
target_id=log.target_id,
|
||
details=log.details,
|
||
ip_address=log.ip_address,
|
||
created_at=log.created_at,
|
||
)
|
||
for log in recent_logs
|
||
],
|
||
)
|
||
|
||
|
||
# ============ Disputes Management ============
|
||
|
||
class AdminDisputeResponse(BaseModel):
|
||
id: int
|
||
assignment_id: int | None
|
||
bonus_assignment_id: int | None
|
||
marathon_id: int
|
||
marathon_title: str
|
||
challenge_title: str
|
||
participant_nickname: str
|
||
raised_by_nickname: str
|
||
reason: str
|
||
status: str
|
||
votes_valid: int
|
||
votes_invalid: int
|
||
created_at: str
|
||
expires_at: str
|
||
|
||
class Config:
|
||
from_attributes = True
|
||
|
||
|
||
class ResolveDisputeRequest(BaseModel):
|
||
is_valid: bool = Field(..., description="True = proof is valid, False = proof is invalid")
|
||
|
||
|
||
@router.get("/disputes", response_model=list[AdminDisputeResponse])
|
||
async def list_disputes(
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
status: str = Query("pending", pattern="^(open|pending|all)$"),
|
||
):
|
||
"""List all disputes. Admin only.
|
||
|
||
Status filter:
|
||
- pending: disputes waiting for admin decision (default)
|
||
- open: disputes still in voting phase
|
||
- all: all disputes
|
||
"""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
from datetime import timedelta
|
||
DISPUTE_WINDOW_HOURS = 24
|
||
|
||
query = (
|
||
select(Dispute)
|
||
.options(
|
||
selectinload(Dispute.raised_by),
|
||
selectinload(Dispute.votes),
|
||
selectinload(Dispute.assignment).selectinload(Assignment.participant).selectinload(Participant.user),
|
||
selectinload(Dispute.assignment).selectinload(Assignment.challenge).selectinload(Challenge.game),
|
||
selectinload(Dispute.assignment).selectinload(Assignment.game), # For playthrough
|
||
selectinload(Dispute.bonus_assignment).selectinload(BonusAssignment.main_assignment).selectinload(Assignment.participant).selectinload(Participant.user),
|
||
selectinload(Dispute.bonus_assignment).selectinload(BonusAssignment.main_assignment).selectinload(Assignment.game),
|
||
selectinload(Dispute.bonus_assignment).selectinload(BonusAssignment.challenge),
|
||
)
|
||
.order_by(Dispute.created_at.desc())
|
||
)
|
||
|
||
if status == "pending":
|
||
# Disputes waiting for admin decision
|
||
query = query.where(Dispute.status == DisputeStatus.PENDING_ADMIN.value)
|
||
elif status == "open":
|
||
# Disputes still in voting phase
|
||
query = query.where(Dispute.status == DisputeStatus.OPEN.value)
|
||
|
||
result = await db.execute(query)
|
||
disputes = result.scalars().all()
|
||
|
||
response = []
|
||
for dispute in disputes:
|
||
# Get info based on dispute type
|
||
if dispute.bonus_assignment_id:
|
||
bonus = dispute.bonus_assignment
|
||
main_assignment = bonus.main_assignment
|
||
participant = main_assignment.participant
|
||
challenge_title = f"Бонус: {bonus.challenge.title}"
|
||
marathon_id = main_assignment.game.marathon_id
|
||
|
||
# Get marathon title
|
||
marathon_result = await db.execute(select(Marathon).where(Marathon.id == marathon_id))
|
||
marathon = marathon_result.scalar_one_or_none()
|
||
marathon_title = marathon.title if marathon else "Unknown"
|
||
else:
|
||
assignment = dispute.assignment
|
||
participant = assignment.participant
|
||
if assignment.is_playthrough:
|
||
challenge_title = f"Прохождение: {assignment.game.title}"
|
||
marathon_id = assignment.game.marathon_id
|
||
else:
|
||
challenge_title = assignment.challenge.title
|
||
marathon_id = assignment.challenge.game.marathon_id
|
||
|
||
# Get marathon title
|
||
marathon_result = await db.execute(select(Marathon).where(Marathon.id == marathon_id))
|
||
marathon = marathon_result.scalar_one_or_none()
|
||
marathon_title = marathon.title if marathon else "Unknown"
|
||
|
||
# Count votes
|
||
votes_valid = sum(1 for v in dispute.votes if v.vote is True)
|
||
votes_invalid = sum(1 for v in dispute.votes if v.vote is False)
|
||
|
||
# Calculate expiry
|
||
expires_at = dispute.created_at + timedelta(hours=DISPUTE_WINDOW_HOURS)
|
||
|
||
response.append(AdminDisputeResponse(
|
||
id=dispute.id,
|
||
assignment_id=dispute.assignment_id,
|
||
bonus_assignment_id=dispute.bonus_assignment_id,
|
||
marathon_id=marathon_id,
|
||
marathon_title=marathon_title,
|
||
challenge_title=challenge_title,
|
||
participant_nickname=participant.user.nickname,
|
||
raised_by_nickname=dispute.raised_by.nickname,
|
||
reason=dispute.reason,
|
||
status=dispute.status,
|
||
votes_valid=votes_valid,
|
||
votes_invalid=votes_invalid,
|
||
created_at=dispute.created_at.isoformat(),
|
||
expires_at=expires_at.isoformat(),
|
||
))
|
||
|
||
return response
|
||
|
||
|
||
@router.post("/disputes/{dispute_id}/resolve", response_model=MessageResponse)
|
||
async def resolve_dispute(
|
||
request: Request,
|
||
dispute_id: int,
|
||
data: ResolveDisputeRequest,
|
||
current_user: CurrentUser,
|
||
db: DbSession,
|
||
):
|
||
"""Manually resolve a dispute. Admin only."""
|
||
require_admin_with_2fa(current_user)
|
||
|
||
# Get dispute
|
||
result = await db.execute(
|
||
select(Dispute)
|
||
.options(
|
||
selectinload(Dispute.assignment).selectinload(Assignment.participant),
|
||
selectinload(Dispute.assignment).selectinload(Assignment.challenge).selectinload(Challenge.game),
|
||
selectinload(Dispute.assignment).selectinload(Assignment.game),
|
||
selectinload(Dispute.bonus_assignment).selectinload(BonusAssignment.main_assignment).selectinload(Assignment.participant),
|
||
selectinload(Dispute.bonus_assignment).selectinload(BonusAssignment.main_assignment).selectinload(Assignment.game),
|
||
selectinload(Dispute.bonus_assignment).selectinload(BonusAssignment.challenge),
|
||
)
|
||
.where(Dispute.id == dispute_id)
|
||
)
|
||
dispute = result.scalar_one_or_none()
|
||
|
||
if not dispute:
|
||
raise HTTPException(status_code=404, detail="Dispute not found")
|
||
|
||
# Allow resolving disputes that are either open or pending admin decision
|
||
if dispute.status not in [DisputeStatus.OPEN.value, DisputeStatus.PENDING_ADMIN.value]:
|
||
raise HTTPException(status_code=400, detail="Dispute is already resolved")
|
||
|
||
# Determine result
|
||
if data.is_valid:
|
||
result_status = DisputeStatus.RESOLVED_VALID.value
|
||
action_type = AdminActionType.DISPUTE_RESOLVE_VALID.value
|
||
else:
|
||
result_status = DisputeStatus.RESOLVED_INVALID.value
|
||
action_type = AdminActionType.DISPUTE_RESOLVE_INVALID.value
|
||
|
||
# Handle invalid proof
|
||
if dispute.bonus_assignment_id:
|
||
# Reset bonus assignment
|
||
bonus = dispute.bonus_assignment
|
||
main_assignment = bonus.main_assignment
|
||
participant = main_assignment.participant
|
||
|
||
# Only subtract points if main playthrough was already completed
|
||
# (bonus points are added only when main playthrough is completed)
|
||
if main_assignment.status == AssignmentStatus.COMPLETED.value:
|
||
points_to_subtract = bonus.points_earned
|
||
participant.total_points = max(0, participant.total_points - points_to_subtract)
|
||
# Also reduce the points_earned on the main assignment
|
||
main_assignment.points_earned = max(0, main_assignment.points_earned - points_to_subtract)
|
||
|
||
bonus.status = BonusAssignmentStatus.PENDING.value
|
||
bonus.proof_path = None
|
||
bonus.proof_url = None
|
||
bonus.proof_comment = None
|
||
bonus.points_earned = 0
|
||
bonus.completed_at = None
|
||
else:
|
||
# Reset main assignment
|
||
assignment = dispute.assignment
|
||
participant = assignment.participant
|
||
|
||
# Subtract points
|
||
points_to_subtract = assignment.points_earned
|
||
participant.total_points = max(0, participant.total_points - points_to_subtract)
|
||
|
||
# Reset streak - the completion was invalid
|
||
participant.current_streak = 0
|
||
|
||
# Reset assignment
|
||
assignment.status = AssignmentStatus.RETURNED.value
|
||
assignment.points_earned = 0
|
||
|
||
# For playthrough: reset all bonus assignments
|
||
if assignment.is_playthrough:
|
||
bonus_result = await db.execute(
|
||
select(BonusAssignment).where(BonusAssignment.main_assignment_id == assignment.id)
|
||
)
|
||
for ba in bonus_result.scalars().all():
|
||
ba.status = BonusAssignmentStatus.PENDING.value
|
||
ba.proof_path = None
|
||
ba.proof_url = None
|
||
ba.proof_comment = None
|
||
ba.points_earned = 0
|
||
ba.completed_at = None
|
||
|
||
# Update dispute
|
||
dispute.status = result_status
|
||
dispute.resolved_at = datetime.utcnow()
|
||
|
||
await db.commit()
|
||
|
||
# Get details for logging
|
||
if dispute.bonus_assignment_id:
|
||
challenge_title = f"Бонус: {dispute.bonus_assignment.challenge.title}"
|
||
marathon_id = dispute.bonus_assignment.main_assignment.game.marathon_id
|
||
elif dispute.assignment.is_playthrough:
|
||
challenge_title = f"Прохождение: {dispute.assignment.game.title}"
|
||
marathon_id = dispute.assignment.game.marathon_id
|
||
else:
|
||
challenge_title = dispute.assignment.challenge.title
|
||
marathon_id = dispute.assignment.challenge.game.marathon_id
|
||
|
||
# Log action
|
||
await log_admin_action(
|
||
db, current_user.id, action_type,
|
||
"dispute", dispute_id,
|
||
{
|
||
"challenge_title": challenge_title,
|
||
"marathon_id": marathon_id,
|
||
"is_valid": data.is_valid,
|
||
},
|
||
request.client.host if request.client else None
|
||
)
|
||
|
||
# Send notification
|
||
from app.services.telegram_notifier import telegram_notifier
|
||
|
||
if dispute.bonus_assignment_id:
|
||
participant_user_id = dispute.bonus_assignment.main_assignment.participant.user_id
|
||
else:
|
||
participant_user_id = dispute.assignment.participant.user_id
|
||
|
||
marathon_result = await db.execute(select(Marathon).where(Marathon.id == marathon_id))
|
||
marathon = marathon_result.scalar_one_or_none()
|
||
|
||
if marathon:
|
||
await telegram_notifier.notify_dispute_resolved(
|
||
db,
|
||
user_id=participant_user_id,
|
||
marathon_title=marathon.title,
|
||
challenge_title=challenge_title,
|
||
is_valid=data.is_valid
|
||
)
|
||
|
||
return MessageResponse(
|
||
message=f"Dispute resolved as {'valid' if data.is_valid else 'invalid'}"
|
||
)
|