prog1764
896c26bd57
- IDOR: отмена/редактирование брони только владельцем (проверка user_id) - пароль админа: убран дефолт admin123, обязателен из env; сравнение через hmac.compare_digest; TTL сессии 1ч - callback_data: безопасный парсинг int + .get() вместо прямого индексирования (KeyError/ValueError)
121 lines
2.9 KiB
Python
121 lines
2.9 KiB
Python
import json
|
|
from app.logger import logger
|
|
from pathlib import Path
|
|
|
|
DB_DIR = Path(__file__).resolve().parent.parent.parent / "data"
|
|
DB_DIR.mkdir(exist_ok=True)
|
|
|
|
USERS_FILE = DB_DIR / "users.json"
|
|
BOOKINGS_FILE = DB_DIR / "bookings.json"
|
|
|
|
|
|
def _load_json(path, default):
|
|
if path.exists():
|
|
try:
|
|
with open(path, "r", encoding="utf-8") as fh:
|
|
return json.load(fh)
|
|
except (json.JSONDecodeError, OSError):
|
|
return default
|
|
return default
|
|
|
|
|
|
def _save_json(path, data):
|
|
with open(path, "w", encoding="utf-8") as fh:
|
|
json.dump(data, fh, ensure_ascii=False, indent=2)
|
|
|
|
|
|
def load_users():
|
|
return _load_json(USERS_FILE, {})
|
|
|
|
|
|
def save_users(users):
|
|
_save_json(USERS_FILE, users)
|
|
|
|
|
|
def get_user(user_id):
|
|
users = load_users()
|
|
return users.get(str(user_id))
|
|
|
|
|
|
def set_user(user_id, data):
|
|
users = load_users()
|
|
users[str(user_id)] = data
|
|
save_users(users)
|
|
|
|
|
|
def load_bookings():
|
|
return _load_json(BOOKINGS_FILE, [])
|
|
|
|
|
|
def save_bookings(bookings):
|
|
from app.logger import logger
|
|
logger.debug("save_bookings: saving {n} bookings", n=len(bookings))
|
|
_save_json(BOOKINGS_FILE, bookings)
|
|
|
|
|
|
def create_booking(user_id, service, master, date, time, user_name=""):
|
|
from app.logger import logger
|
|
logger.debug("create_booking called: uid={uid}, svc={svc}, master={mst}, date={dt}, time={tm}", uid=user_id, svc=service, mst=master, dt=date, tm=time)
|
|
bookings = load_bookings()
|
|
booking = {
|
|
"id": len(bookings) + 1,
|
|
"user_id": user_id,
|
|
"user_name": user_name,
|
|
"service": service,
|
|
"master": master,
|
|
"date": date,
|
|
"time": time,
|
|
"status": "active",
|
|
}
|
|
bookings.append(booking)
|
|
_save_json(BOOKINGS_FILE, bookings)
|
|
return booking
|
|
|
|
|
|
def get_busy_times(master, date):
|
|
bookings = load_bookings()
|
|
return [
|
|
b["time"] for b in bookings
|
|
if b["master"] == master and b["date"] == date and b["status"] == "active"
|
|
]
|
|
|
|
|
|
def get_user_bookings(user_id):
|
|
bookings = load_bookings()
|
|
return [
|
|
b for b in bookings
|
|
if b["user_id"] == user_id and b["status"] == "active"
|
|
]
|
|
|
|
|
|
def get_booking(booking_id):
|
|
"""Return a booking by id regardless of status, or None."""
|
|
bookings = load_bookings()
|
|
for b in bookings:
|
|
if b["id"] == booking_id:
|
|
return b
|
|
return None
|
|
|
|
|
|
def cancel_booking(booking_id):
|
|
bookings = load_bookings()
|
|
for b in bookings:
|
|
if b["id"] == booking_id:
|
|
b["status"] = "cancelled"
|
|
_save_json(BOOKINGS_FILE, bookings)
|
|
return True
|
|
return False
|
|
|
|
|
|
def update_booking(booking_id, service, master, date, time):
|
|
bookings = load_bookings()
|
|
for b in bookings:
|
|
if b["id"] == booking_id:
|
|
b["service"] = service
|
|
b["master"] = master
|
|
b["date"] = date
|
|
b["time"] = time
|
|
save_bookings(bookings)
|
|
return b
|
|
return None
|