"""Admin handler for spa-telegram-bot — secure with password.""" from aiogram import Router, F from aiogram.types import Message, CallbackQuery from aiogram.filters import Command, CommandObject from app.db.memory import load_bookings from app.config import ADMIN_IDS, ADMIN_PASSWORD from app.logger import logger router = Router() def is_admin(user_id: int, password: str | None = None) -> bool: """Check if user is admin: by user_id or by password.""" if user_id in ADMIN_IDS: return True if password and password == ADMIN_PASSWORD: return True return False @router.message(Command("admin")) async def admin_panel(message: Message, command: CommandObject): uid = message.from_user.id # Get password from command args password = command.args if not is_admin(uid, password=password): # Silent — no hint about how to get in return logger.info("Admin {uid} opened admin panel", uid=uid) bookings = load_bookings() active = [b for b in bookings if b.get("status") == "active"] if not active: await message.answer("📋 Активных записей нет") return from aiogram.types import InlineKeyboardMarkup, InlineKeyboardButton for booking in active: buttons = [[ InlineKeyboardButton( text="❌ Отменить", callback_data=f"admin_cancel_{booking['id']}" ) ]] user_name = booking.get("user_name") or f"id{booking['user_id']}" await message.answer( f"📋 Запись #{booking['id']}\n" f"👤 Клиент: {user_name}\n" f"💆 Услуги: {booking.get('service', '?')}\n" f"👤 Мастер: {booking.get('master', '?')}\n" f"📅 Дата: {booking.get('date', '?')}\n" f"🕒 Время: {booking.get('time', '?')}", reply_markup=InlineKeyboardMarkup(inline_keyboard=buttons) ) @router.callback_query(F.data.startswith("admin_cancel_")) async def admin_cancel_booking(callback: CallbackQuery): if not is_admin(callback.from_user.id): await callback.answer("⛔ Нет доступа") return booking_id = int(callback.data.split("_")[2]) logger.info("Admin {uid} cancelled booking #{bid}", uid=callback.from_user.id, bid=booking_id) from app.db.memory import cancel_booking cancel_booking(booking_id) await callback.message.edit_text( f"✅ Запись #{booking_id} отменена админом" ) await callback.answer("Запись отменена")