Add Telegram bot integration and enhance user management features

- Introduced Telegram.Bot package for bot functionality. - Updated user management to include Telegram linking and blocking features. - Enhanced activation request handling with notifications via Telegram. - Added new database entities for Telegram link tokens and login requests. - Implemented traffic synchronization for client stats in the XuiPanelGateway. - Updated application structure to support new test projects and improved dependency injection for Telegram services.
2026-07-02 01:01:03 +03:00
parent 1a8d33efa3
commit 7b6fe9ad78
142 changed files with 7570 additions and 22 deletions
@@ -0,0 +1,6 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram.Bot;
+
+public sealed record ApproveTelegramLoginCommand(Guid RequestId, long TelegramUserId) : ICommand<Result>;
@@ -0,0 +1,33 @@
+using Microsoft.EntityFrameworkCore;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Exceptions;
+
+namespace PnvPanel.Application.Telegram.Bot;
+
+public sealed class ApproveTelegramLoginCommandHandler(IAppDbContext dbContext, IIdentityService identityService)
+    : ICommandHandler<ApproveTelegramLoginCommand, Result>
+{
+    public async Task<Result> Handle(ApproveTelegramLoginCommand command, CancellationToken cancellationToken)
+    {
+        var userId = await identityService.FindUserIdByTelegramUserIdAsync(command.TelegramUserId, cancellationToken);
+        if (userId is null)
+            return Result.Failure(TelegramErrors.NotLinked);
+
+        var request = await dbContext.TelegramLoginRequests.FirstOrDefaultAsync(r => r.Id == command.RequestId, cancellationToken);
+        if (request is null)
+            return Result.Failure(TelegramErrors.LoginRequestNotFound);
+
+        try
+        {
+            request.Approve(userId.Value);
+        }
+        catch (DomainException ex)
+        {
+            return Result.Failure(Error.Conflict("Telegram.LoginRequestInvalid", ex.Message));
+        }
+
+        return Result.Success();
+    }
+}
@@ -0,0 +1,7 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram.Bot;
+
+/// <summary>Вызывается только из TelegramBotHostedService (обработка "/start link_&lt;token&gt;").</summary>
+public sealed record LinkTelegramCommand(string Token, long TelegramUserId, string? TelegramUsername) : ICommand<Result<Guid>>;
@@ -0,0 +1,26 @@
+using Microsoft.EntityFrameworkCore;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram.Bot;
+
+public sealed class LinkTelegramCommandHandler(IAppDbContext dbContext, IIdentityService identityService)
+    : ICommandHandler<LinkTelegramCommand, Result<Guid>>
+{
+    public async Task<Result<Guid>> Handle(LinkTelegramCommand command, CancellationToken cancellationToken)
+    {
+        var linkToken = await dbContext.TelegramLinkTokens.FirstOrDefaultAsync(t => t.Token == command.Token, cancellationToken);
+        if (linkToken is null || !linkToken.IsValid)
+            return Result.Failure<Guid>(TelegramErrors.LinkTokenNotFound);
+
+        var linkResult = await identityService.LinkTelegramAsync(
+            linkToken.UserId, command.TelegramUserId, command.TelegramUsername, cancellationToken);
+        if (!linkResult.IsSuccess)
+            return Result.Failure<Guid>(linkResult.Error);
+
+        linkToken.Consume();
+
+        return Result.Success(linkToken.UserId);
+    }
+}
@@ -0,0 +1,6 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram.Bot;
+
+public sealed record RejectTelegramLoginCommand(Guid RequestId, long TelegramUserId) : ICommand<Result>;
@@ -0,0 +1,33 @@
+using Microsoft.EntityFrameworkCore;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Exceptions;
+
+namespace PnvPanel.Application.Telegram.Bot;
+
+public sealed class RejectTelegramLoginCommandHandler(IAppDbContext dbContext, IIdentityService identityService)
+    : ICommandHandler<RejectTelegramLoginCommand, Result>
+{
+    public async Task<Result> Handle(RejectTelegramLoginCommand command, CancellationToken cancellationToken)
+    {
+        var userId = await identityService.FindUserIdByTelegramUserIdAsync(command.TelegramUserId, cancellationToken);
+        if (userId is null)
+            return Result.Failure(TelegramErrors.NotLinked);
+
+        var request = await dbContext.TelegramLoginRequests.FirstOrDefaultAsync(r => r.Id == command.RequestId, cancellationToken);
+        if (request is null)
+            return Result.Failure(TelegramErrors.LoginRequestNotFound);
+
+        try
+        {
+            request.Reject();
+        }
+        catch (DomainException ex)
+        {
+            return Result.Failure(Error.Conflict("Telegram.LoginRequestInvalid", ex.Message));
+        }
+
+        return Result.Success();
+    }
+}
@@ -0,0 +1,8 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram;
+
+public sealed record CreateLinkTokenCommand : ICommand<Result<LinkTokenDto>>;
+
+public sealed record LinkTokenDto(string Token, DateTimeOffset ExpiresAt);
@@ -0,0 +1,24 @@
+using PnvPanel.Application.Auth;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Telegram;
+
+namespace PnvPanel.Application.Telegram;
+
+public sealed class CreateLinkTokenCommandHandler(IAppDbContext dbContext, ICurrentUser currentUser)
+    : ICommandHandler<CreateLinkTokenCommand, Result<LinkTokenDto>>
+{
+    private static readonly TimeSpan Ttl = TimeSpan.FromMinutes(5);
+
+    public Task<Result<LinkTokenDto>> Handle(CreateLinkTokenCommand command, CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId is not { } userId)
+            return Task.FromResult(Result.Failure<LinkTokenDto>(AuthErrors.Unauthorized));
+
+        var token = TelegramLinkToken.Create(userId, Ttl);
+        dbContext.TelegramLinkTokens.Add(token);
+
+        return Task.FromResult(Result.Success(new LinkTokenDto(token.Token, token.ExpiresAt)));
+    }
+}
@@ -0,0 +1,9 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram;
+
+/// <summary>Публичная команда (пользователь ещё не залогинен) — начинает passwordless-вход.</summary>
+public sealed record CreateLoginRequestCommand(string? Context) : ICommand<Result<LoginRequestDto>>;
+
+public sealed record LoginRequestDto(Guid RequestId, DateTimeOffset ExpiresAt);
@@ -0,0 +1,20 @@
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Telegram;
+
+namespace PnvPanel.Application.Telegram;
+
+public sealed class CreateLoginRequestCommandHandler(IAppDbContext dbContext)
+    : ICommandHandler<CreateLoginRequestCommand, Result<LoginRequestDto>>
+{
+    private static readonly TimeSpan Ttl = TimeSpan.FromMinutes(5);
+
+    public Task<Result<LoginRequestDto>> Handle(CreateLoginRequestCommand command, CancellationToken cancellationToken)
+    {
+        var request = TelegramLoginRequest.Create(Ttl, command.Context);
+        dbContext.TelegramLoginRequests.Add(request);
+
+        return Task.FromResult(Result.Success(new LoginRequestDto(request.Id, request.ExpiresAt)));
+    }
+}
@@ -0,0 +1,10 @@
+using PnvPanel.Application.Auth;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Telegram;
+
+namespace PnvPanel.Application.Telegram;
+
+public sealed record GetLoginRequestStatusQuery(Guid RequestId) : IQuery<Result<LoginRequestStatusDto>>;
+
+public sealed record LoginRequestStatusDto(TelegramLoginStatus Status, AuthResult? Auth);
@@ -0,0 +1,48 @@
+using Microsoft.EntityFrameworkCore;
+using PnvPanel.Application.Auth;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Telegram;
+
+namespace PnvPanel.Application.Telegram;
+
+/// <summary>
+/// Формально Query, но при первом наблюдении Approved-статуса атомарно "забирает" вход:
+/// выпускает JWT и переводит запрос в Consumed (одноразовый claim), см. api-design.md.
+/// Осознанное отступление от чистого CQRS ради простого поллинга без отдельного claim-эндпоинта.
+/// </summary>
+public sealed class GetLoginRequestStatusQueryHandler(
+    IAppDbContext dbContext, IIdentityService identityService, IJwtTokenService jwtTokenService, IRefreshTokenService refreshTokenService)
+    : IQueryHandler<GetLoginRequestStatusQuery, Result<LoginRequestStatusDto>>
+{
+    public async Task<Result<LoginRequestStatusDto>> Handle(GetLoginRequestStatusQuery query, CancellationToken cancellationToken)
+    {
+        var request = await dbContext.TelegramLoginRequests.FirstOrDefaultAsync(r => r.Id == query.RequestId, cancellationToken);
+        if (request is null)
+            return Result.Failure<LoginRequestStatusDto>(TelegramErrors.LoginRequestNotFound);
+
+        if (request.Status == TelegramLoginStatus.Pending && request.IsExpired)
+            return Result.Success(new LoginRequestStatusDto(TelegramLoginStatus.Expired, null));
+
+        if (request.Status != TelegramLoginStatus.Approved)
+            return Result.Success(new LoginRequestStatusDto(request.Status, null));
+
+        var profile = await identityService.GetProfileAsync(request.UserId!.Value, cancellationToken);
+        if (profile is null)
+            return Result.Failure<LoginRequestStatusDto>(AuthErrors.Unauthorized);
+
+        var authUser = new AuthenticatedUser(profile.Id, profile.UserName, profile.Role);
+        var (accessToken, accessExpiresAt) = jwtTokenService.GenerateAccessToken(authUser);
+
+        request.Consume();
+        // IssueAsync сохраняет весь SaveChanges (в т.ч. Consume() выше) — см. RefreshTokenService.
+        var refreshToken = await refreshTokenService.IssueAsync(profile.Id, cancellationToken);
+
+        // Пользователь только что подтвердил вход через бота — Telegram точно привязан.
+        var dto = new CurrentUserDto(profile.Id, profile.UserName, profile.Role, profile.IsActivated, TelegramLinked: true);
+        var auth = new AuthResult(accessToken, accessExpiresAt, refreshToken.RawToken, refreshToken.ExpiresAt, dto);
+
+        return Result.Success(new LoginRequestStatusDto(TelegramLoginStatus.Approved, auth));
+    }
+}
@@ -0,0 +1,15 @@
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram;
+
+public static class TelegramErrors
+{
+    public static readonly Error LinkTokenNotFound =
+        Error.NotFound("Telegram.LinkTokenNotFound", "Токен привязки не найден или истёк.");
+
+    public static readonly Error LoginRequestNotFound =
+        Error.NotFound("Telegram.LoginRequestNotFound", "Запрос на вход не найден.");
+
+    public static readonly Error NotLinked =
+        Error.Conflict("Telegram.NotLinked", "Telegram не привязан ни к одному аккаунту.");
+}
@@ -0,0 +1,6 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram;
+
+public sealed record UnlinkTelegramCommand : ICommand<Result>;
@@ -0,0 +1,18 @@
+using PnvPanel.Application.Auth;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Telegram;
+
+public sealed class UnlinkTelegramCommandHandler(IIdentityService identityService, ICurrentUser currentUser)
+    : ICommandHandler<UnlinkTelegramCommand, Result>
+{
+    public Task<Result> Handle(UnlinkTelegramCommand command, CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId is not { } userId)
+            return Task.FromResult(Result.Failure(AuthErrors.Unauthorized));
+
+        return identityService.UnlinkTelegramAsync(userId, cancellationToken);
+    }
+}