Implement rate limiting and enhance authentication flow

- Added rate limiting configuration for authentication endpoints, allowing customizable request limits via environment variables.
- Updated authentication flow to utilize HttpRequest for cookie management, ensuring secure handling of refresh tokens.
- Introduced a new endpoint to retrieve user subscription details.
- Enhanced the handling of Telegram bot token validation to prevent errors with empty tokens.
- Updated the application to serialize enums as strings for better documentation and compatibility with TypeScript.
- Improved test coverage for new features and adjustments in command handlers.

backend/src/PnvPanel.Application/Admin/Activation/ApproveActivationCommandHandler.cs

@@ -5,6 +5,7 @@ using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
 using PnvPanel.Domain.Activation;
+using PnvPanel.Domain.Audit;
 
 namespace PnvPanel.Application.Admin.Activation;
 
@@ -33,6 +34,9 @@ public sealed class ApproveActivationCommandHandler(
         if (!activateResult.IsSuccess)
             return activateResult;
 
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            adminId, "ActivationApproved", "User", request.UserId.ToString(), metadata: null, AuditSource.Web));
+
         await notifier.NotifyUserActivatedAsync(request.UserId, cancellationToken);
         await telegramNotifier.NotifyUserAsync(request.UserId, "✅ Ваш аккаунт активирован администратором.", cancellationToken);
         return Result.Success();

backend/src/PnvPanel.Application/Admin/Activation/RejectActivationCommandHandler.cs

@@ -5,6 +5,7 @@ using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
 using PnvPanel.Domain.Activation;
+using PnvPanel.Domain.Audit;
 
 namespace PnvPanel.Application.Admin.Activation;
 
@@ -26,6 +27,10 @@ public sealed class RejectActivationCommandHandler(IAppDbContext dbContext, ICur
             return Result.Failure(ActivationErrors.AlreadyDecided);
 
         request.Reject(adminId, command.Reason);
+
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            adminId, "ActivationRejected", "User", request.UserId.ToString(), metadata: null, AuditSource.Web));
+
         return Result.Success();
     }
 }

backend/src/PnvPanel.Application/Admin/Inbounds/PublishInboundCommandHandler.cs

@@ -2,10 +2,11 @@ using Microsoft.EntityFrameworkCore;
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Audit;
 
 namespace PnvPanel.Application.Admin.Inbounds;
 
-public sealed class PublishInboundCommandHandler(IAppDbContext dbContext)
+public sealed class PublishInboundCommandHandler(IAppDbContext dbContext, ICurrentUser currentUser)
     : ICommandHandler<PublishInboundCommand, Result<InboundDto>>
 {
     public async Task<Result<InboundDto>> Handle(PublishInboundCommand command, CancellationToken cancellationToken)
@@ -19,6 +20,10 @@ public sealed class PublishInboundCommandHandler(IAppDbContext dbContext)
         else
             inbound.Unpublish();
 
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            currentUser.UserId, command.IsPublished ? "InboundPublished" : "InboundUnpublished",
+            "Inbound", inbound.Id.ToString(), metadata: null, AuditSource.Web));
+
         return Result.Success(InboundDto.FromDomain(inbound));
     }
 }

backend/src/PnvPanel.Application/Admin/Nodes/DeleteNodeCommandHandler.cs

@@ -2,10 +2,11 @@ using Microsoft.EntityFrameworkCore;
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Audit;
 
 namespace PnvPanel.Application.Admin.Nodes;
 
-public sealed class DeleteNodeCommandHandler(IAppDbContext dbContext, IXuiPanelGateway gateway)
+public sealed class DeleteNodeCommandHandler(IAppDbContext dbContext, IXuiPanelGateway gateway, ICurrentUser currentUser)
     : ICommandHandler<DeleteNodeCommand, Result>
 {
     public async Task<Result> Handle(DeleteNodeCommand command, CancellationToken cancellationToken)
@@ -19,6 +20,9 @@ public sealed class DeleteNodeCommandHandler(IAppDbContext dbContext, IXuiPanelG
         dbContext.Nodes.Remove(node);
         gateway.InvalidateClient(node.Id);
 
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            currentUser.UserId, "NodeDeleted", "Node", node.Id.ToString(), metadata: null, AuditSource.Web));
+
         return Result.Success();
     }
 }

backend/src/PnvPanel.Application/Admin/Nodes/RegisterNodeCommandHandler.cs

@@ -1,11 +1,13 @@
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Audit;
 using PnvPanel.Domain.Nodes;
 
 namespace PnvPanel.Application.Admin.Nodes;
 
-public sealed class RegisterNodeCommandHandler(IAppDbContext dbContext, IXuiPanelGateway gateway, ISecretProtector secretProtector)
+public sealed class RegisterNodeCommandHandler(
+    IAppDbContext dbContext, IXuiPanelGateway gateway, ISecretProtector secretProtector, ICurrentUser currentUser)
     : ICommandHandler<RegisterNodeCommand, Result<NodeDto>>
 {
     public Task<Result<NodeDto>> Handle(RegisterNodeCommand command, CancellationToken cancellationToken)
@@ -21,6 +23,8 @@ public sealed class RegisterNodeCommandHandler(IAppDbContext dbContext, IXuiPane
         var node = Node.Register(command.Name, baseAddress, credentials, command.Location);
 
         dbContext.Nodes.Add(node);
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            currentUser.UserId, "NodeRegistered", "Node", node.Id.ToString(), metadata: null, AuditSource.Web));
 
         return Task.FromResult(Result.Success(NodeDto.FromDomain(node)));
     }

backend/src/PnvPanel.Application/Admin/Nodes/UpdateNodeCommandHandler.cs

@@ -2,11 +2,13 @@ using Microsoft.EntityFrameworkCore;
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Audit;
 using PnvPanel.Domain.Nodes;
 
 namespace PnvPanel.Application.Admin.Nodes;
 
-public sealed class UpdateNodeCommandHandler(IAppDbContext dbContext, IXuiPanelGateway gateway, ISecretProtector secretProtector)
+public sealed class UpdateNodeCommandHandler(
+    IAppDbContext dbContext, IXuiPanelGateway gateway, ISecretProtector secretProtector, ICurrentUser currentUser)
     : ICommandHandler<UpdateNodeCommand, Result<NodeDto>>
 {
     public async Task<Result<NodeDto>> Handle(UpdateNodeCommand command, CancellationToken cancellationToken)
@@ -28,6 +30,9 @@ public sealed class UpdateNodeCommandHandler(IAppDbContext dbContext, IXuiPanelG
             gateway.InvalidateClient(node.Id);
         }
 
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            currentUser.UserId, "NodeUpdated", "Node", node.Id.ToString(), metadata: null, AuditSource.Web));
+
         return Result.Success(NodeDto.FromDomain(node));
     }
 }

backend/src/PnvPanel.Application/Admin/Users/ChangeUserRoleCommandHandler.cs

@@ -1,11 +1,23 @@
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Messaging;
 using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Audit;
 
 namespace PnvPanel.Application.Admin.Users;
 
-public sealed class ChangeUserRoleCommandHandler(IRoleService roleService) : ICommandHandler<ChangeUserRoleCommand, Result>
+public sealed class ChangeUserRoleCommandHandler(IRoleService roleService, IAppDbContext dbContext, ICurrentUser currentUser)
+    : ICommandHandler<ChangeUserRoleCommand, Result>
 {
-    public Task<Result> Handle(ChangeUserRoleCommand command, CancellationToken cancellationToken)
-        => roleService.ChangeUserRoleAsync(command.UserId, command.RoleId, cancellationToken);
+    public async Task<Result> Handle(ChangeUserRoleCommand command, CancellationToken cancellationToken)
+    {
+        var result = await roleService.ChangeUserRoleAsync(command.UserId, command.RoleId, cancellationToken);
+        if (!result.IsSuccess)
+            return result;
+
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            currentUser.UserId, "UserRoleChanged", "User", command.UserId.ToString(),
+            metadata: $"{{\"roleId\":\"{command.RoleId}\"}}", AuditSource.Web));
+
+        return result;
+    }
 }

backend/src/PnvPanel.Application/Common/Interfaces/IIdentityService.cs

@@ -4,7 +4,8 @@ namespace PnvPanel.Application.Common.Interfaces;
 
 public sealed record AuthenticatedUser(Guid Id, string UserName, string Role);
 
-public sealed record CurrentUserProfile(Guid Id, string UserName, Guid RoleId, string Role, bool IsActivated, bool IsBlocked, int MaxConfigs);
+public sealed record CurrentUserProfile(
+    Guid Id, string UserName, Guid RoleId, string Role, bool IsActivated, bool IsBlocked, int MaxConfigs, string SubscriptionToken);
 
 public sealed record UserSummaryDto(Guid Id, string UserName, string Role, bool IsActivated, bool IsBlocked, DateTimeOffset? ActivatedAt);
 

backend/src/PnvPanel.Application/Configs/GetMySubscription/GetMySubscriptionQuery.cs

@@ -0,0 +1,9 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Configs.GetMySubscription;
+
+public sealed record GetMySubscriptionQuery : IQuery<Result<MySubscriptionDto>>;
+
+/// <summary>SubscriptionToken — Api-слой строит из него абсолютный URL (знает scheme/host запроса), см. GetConfigLinkQuery.</summary>
+public sealed record MySubscriptionDto(string SubscriptionToken);

backend/src/PnvPanel.Application/Configs/GetMySubscription/GetMySubscriptionQueryHandler.cs

@@ -0,0 +1,22 @@
+using PnvPanel.Application.Auth;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Configs.GetMySubscription;
+
+public sealed class GetMySubscriptionQueryHandler(IIdentityService identityService, ICurrentUser currentUser)
+    : IQueryHandler<GetMySubscriptionQuery, Result<MySubscriptionDto>>
+{
+    public async Task<Result<MySubscriptionDto>> Handle(GetMySubscriptionQuery query, CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId is not { } userId)
+            return Result.Failure<MySubscriptionDto>(AuthErrors.Unauthorized);
+
+        var profile = await identityService.GetProfileAsync(userId, cancellationToken);
+        if (profile is null)
+            return Result.Failure<MySubscriptionDto>(AuthErrors.Unauthorized);
+
+        return Result.Success(new MySubscriptionDto(profile.SubscriptionToken));
+    }
+}