neuroalpha 0.2.0 → 0.3.12

package/server/auth/index.js

@@ -1,340 +1,544 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { ROOT, DATA_DIR } from '../config.js';
-import { db, kvGet, kvSet, registerUidResolver } from '../db.js';
-
-const ctx = new AsyncLocalStorage();
-registerUidResolver(() => ctx.getStore()?.user?.id || 1);
-
-// ---------- шифрование секретов (AES-256-GCM) ----------
-let masterKey = null;
-function getMasterKey() {
-  if (masterKey) return masterKey;
-  const envKey = (process.env.MASTER_KEY || '').trim();
-  if (envKey) {
-    masterKey = crypto.createHash('sha256').update(envKey).digest();
-    return masterKey;
-  }
-  const keyPath = path.join(DATA_DIR, '.master.key');
-  try {
-    if (fs.existsSync(keyPath)) {
-      const hex = fs.readFileSync(keyPath, 'utf8').trim();
-      if (hex.length >= 64) { masterKey = Buffer.from(hex.slice(0, 64), 'hex'); return masterKey; }
-    }
-    const rnd = crypto.randomBytes(32);
-    fs.mkdirSync(path.dirname(keyPath), { recursive: true });
-    fs.writeFileSync(keyPath, rnd.toString('hex'), { mode: 0o600 });
-    masterKey = rnd;
-  } catch {
-    masterKey = crypto.createHash('sha256').update(ROOT).digest();
-  }
-  return masterKey;
-}
-
-export function encryptSecret(plain) {
-  const s = String(plain ?? '').trim();
-  if (!s) return '';
-  if (s.startsWith('enc:v1:')) return s;
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv('aes-256-gcm', getMasterKey(), iv);
-  const enc = Buffer.concat([cipher.update(s, 'utf8'), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `enc:v1:${iv.toString('hex')}:${tag.toString('hex')}:${enc.toString('hex')}`;
-}
-
-export function decryptSecret(val) {
-  const s = String(val ?? '').trim();
-  if (!s) return '';
-  if (!s.startsWith('enc:v1:')) return s;
-  try {
-    const [, , ivHex, tagHex, encHex] = s.split(':');
-    const decipher = crypto.createDecipheriv('aes-256-gcm', getMasterKey(), Buffer.from(ivHex, 'hex'));
-    decipher.setAuthTag(Buffer.from(tagHex, 'hex'));
-    return Buffer.concat([decipher.update(Buffer.from(encHex, 'hex')), decipher.final()]).toString('utf8');
-  } catch {
-    return '';
-  }
-}
-
-// ---------- хэширование паролей (scrypt) ----------
-export function hashPassword(password) {
-  const salt = crypto.randomBytes(16).toString('hex');
-  const hash = crypto.scryptSync(String(password), salt, 64).toString('hex');
-  return `${salt}:${hash}`;
-}
-
-export function verifyPassword(password, stored) {
-  if (!stored || !stored.includes(':')) return false;
-  const [salt, hex] = stored.split(':');
-  const hash = crypto.scryptSync(String(password), salt, 64);
-  const target = Buffer.from(hex, 'hex');
-  return hash.length === target.length && crypto.timingSafeEqual(hash, target);
-}
-
-// ---------- пользователи и сессии ----------
-export const PLANS = {
-  free: { id: 'free', name: 'Старт (Витрина)', priceRub: 0, maxRunsPerDay: 2, maxVirtualAccounts: 1, maxBrokerAccounts: 0, maxChatPerDay: 10, allowTransformer: false },
-  investor: { id: 'investor', name: 'Инвестор (Автопилот)', priceRub: 3900, maxRunsPerDay: 30, maxVirtualAccounts: 3, maxBrokerAccounts: 2, maxChatPerDay: 150, allowTransformer: false },
-  pro: { id: 'pro', name: 'Профи / Лаборатория', priceRub: 9900, maxRunsPerDay: 500, maxVirtualAccounts: 5, maxBrokerAccounts: 5, maxChatPerDay: 1000, allowTransformer: true },
-};
-
-export function generateApiKey() {
-  return `na_live_${crypto.randomBytes(16).toString('hex')}`;
-}
-
-export function ensureApiKey(userId, regenerate = false) {
-  const u = getUserById(userId);
-  if (!u) throw new Error('Пользователь не найден');
-  if (u.api_key && !regenerate) return u.api_key;
-  const key = generateApiKey();
-  db.prepare('UPDATE users SET api_key = ? WHERE id = ?').run(key, u.id);
-  return key;
-}
-
-export function getUserByApiKey(apiKey) {
-  const clean = String(apiKey || '').trim();
-  if (!clean.startsWith('na_live_')) return null;
-  return db.prepare('SELECT * FROM users WHERE api_key = ?').get(clean) || null;
-}
-
-// ---------- синхронизация лицензии для локального запуска (npx neuroalpha --key ...) ----------
-export function getLocalLicense() {
-  return kvGet('cloudLicense') || null;
-}
-
-export async function activateLocalLicense(apiKey, cloudUrl = '') {
-  const cleanKey = String(apiKey || '').trim();
-  if (!cleanKey.startsWith('na_live_')) throw new Error('Ключ должен начинаться с na_live_…');
-  const baseUrl = String(cloudUrl || process.env.CLOUD_URL || '').trim().replace(/\/+$/, '');
-  // 1) если ключ есть в этой же БД — проверяем напрямую
-  const localUser = getUserByApiKey(cleanKey);
-  if (localUser) {
-    const p = effectivePlan(localUser);
-    const lic = {
-      apiKey: cleanKey,
-      cloudUrl: baseUrl || 'local',
-      email: localUser.email,
-      name: localUser.name,
-      plan: p.id,
-      planName: p.name,
-      planUntil: localUser.plan_until || 0,
-      verifiedAt: Date.now(),
-    };
-    kvSet('cloudLicense', lic);
-    return lic;
-  }
-  // 2) иначе проверяем об облачный сервер
-  if (!baseUrl) throw new Error('Ключ не найден локально. Укажите адрес облачного сервера или активируйте ключ на сайте');
-  const r = await fetch(`${baseUrl}/api/license/verify`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${cleanKey}` },
-    body: JSON.stringify({ apiKey: cleanKey }),
-    signal: AbortSignal.timeout(15000),
-  });
-  const j = await r.json().catch(() => ({}));
-  if (!r.ok || !j.valid) throw new Error(j.error || `Не удалось проверить ключ (HTTP ${r.status})`);
-  const lic = {
-    apiKey: cleanKey,
-    cloudUrl: baseUrl,
-    email: j.email,
-    name: j.name,
-    plan: j.plan || 'free',
-    planName: j.planName || PLANS[j.plan]?.name || 'Старт',
-    planUntil: j.planUntil || 0,
-    verifiedAt: Date.now(),
-  };
-  kvSet('cloudLicense', lic);
-  // применяем тариф к локальному пользователю #1
-  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = 1').run(lic.plan, lic.planUntil);
-  return lic;
-}
-
-export function effectivePlan(user) {
-  if (!user) return PLANS.free;
-  // В локальном режиме (npx): если активирован лицензионный ключ — действует тариф подписки;
-  // если ADMIN_ALL_PRO=1 или это явно админ облака — действует его тариф
-  if (process.env.CLOUD_MODE !== '1' && user.id === 1) {
-    const lic = getLocalLicense();
-    if (lic?.plan && PLANS[lic.plan]) {
-      if (lic.plan !== 'free' && lic.planUntil > 0 && lic.planUntil < Date.now()) return PLANS.free;
-      return PLANS[lic.plan];
-    }
-    if (process.env.LOCAL_STRICT_LICENSE === '1') return PLANS.free;
-    return PLANS.pro;
-  }
-  if (user.role === 'admin') return PLANS.pro;
-  const p = PLANS[user.plan] || PLANS.free;
-  if (p.id !== 'free' && user.plan_until > 0 && user.plan_until < Date.now()) return PLANS.free;
-  return p;
-}
-
-export function publicUser(u) {
-  if (!u) return null;
-  if (!u.api_key) {
-    try { u.api_key = ensureApiKey(u.id); } catch { /* ignore */ }
-  }
-  const plan = effectivePlan(u);
-  return {
-    id: u.id,
-    email: u.email,
-    name: u.name || 'Инвестор',
-    role: u.role || 'user',
-    plan: plan.id,
-    planName: plan.name,
-    planUntil: u.plan_until || 0,
-    limits: plan,
-    apiKey: u.api_key || null,
-    tgConnected: Boolean(u.tg_chat_id),
-    maxConnected: Boolean(u.max_chat_id),
-    notifyCode: u.notify_code || null,
-    localLicense: process.env.CLOUD_MODE !== '1' ? getLocalLicense() : null,
-    createdAt: u.created_at,
-  };
-}
-
-export function getUserById(id) {
-  return db.prepare('SELECT * FROM users WHERE id = ?').get(Number(id));
-}
-
-export function currentUser() {
-  const store = ctx.getStore();
-  if (store?.user) return store.user;
-  return getUserById(1);
-}
-
-export function currentUserId() {
-  const store = ctx.getStore();
-  return store?.user?.id || 1;
-}
-
-export function runWithUser(user, fn) {
-  return ctx.run({ user }, fn);
-}
-
-export function parseCookies(cookieHeader = '') {
-  const out = {};
-  for (const part of String(cookieHeader || '').split(';')) {
-    const i = part.indexOf('=');
-    if (i > 0) out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
-  }
-  return out;
-}
-
-export function userFromRequest(req) {
-  const cookies = parseCookies(req.headers?.cookie);
-  const authHeader = String(req.headers?.authorization || '');
-  const apiKeyHeader = String(req.headers?.['x-api-key'] || '').trim();
-  const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : '';
-  const apiCandidate = apiKeyHeader || (bearer.startsWith('na_live_') ? bearer : '');
-  if (apiCandidate) {
-    const byKey = getUserByApiKey(apiCandidate);
-    if (byKey) return byKey;
-  }
-  const token = cookies.sid || bearer;
-  if (token) {
-    const sess = db.prepare('SELECT * FROM sessions WHERE token = ? AND expires_at > ?').get(token, Date.now());
-    if (sess) {
-      const u = getUserById(sess.user_id);
-      if (u) return u;
-    }
-  }
-  // В локальном режиме (без CLOUD_MODE=1) по умолчанию открывается владелец (id = 1)
-  if (process.env.CLOUD_MODE !== '1' && cookies.sid !== 'logged_out') {
-    return getUserById(1);
-  }
-  return null;
-}
-
-export function createSession(userId, days = 30) {
-  const token = crypto.randomBytes(24).toString('hex');
-  const now = Date.now();
-  db.prepare('INSERT INTO sessions (token, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
-    .run(token, Number(userId), now, now + days * 86400000);
-  return token;
-}
-
-export function deleteSession(token) {
-  if (!token) return;
-  db.prepare('DELETE FROM sessions WHERE token = ?').run(String(token));
-}
-
-export function registerUser({ email, password, name }) {
-  const cleanEmail = String(email || '').trim().toLowerCase();
-  if (!cleanEmail || !cleanEmail.includes('@')) throw new Error('Укажите корректный email');
-  if (!password || String(password).length < 6) throw new Error('Пароль должен быть не короче 6 символов');
-  const existing = db.prepare('SELECT id FROM users WHERE email = ?').get(cleanEmail);
-  if (existing) throw new Error('Пользователь с таким email уже зарегистрирован');
-  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
-  const apiKey = generateApiKey();
-  const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, notify_code, api_key, created_at)
-    VALUES (?, ?, ?, 'user', 'free', 0, ?, ?, ?)`).run(cleanEmail, String(name || cleanEmail.split('@')[0]).trim(), hashPassword(password), code, apiKey, Date.now());
-  return getUserById(Number(r.lastInsertRowid));
-}
-
-export function loginUser({ email, password }) {
-  const cleanEmail = String(email || '').trim().toLowerCase();
-  const u = db.prepare('SELECT * FROM users WHERE email = ?').get(cleanEmail);
-  if (!u || !verifyPassword(password, u.pass_hash)) throw new Error('Неверный email или пароль');
-  return u;
-}
-
-export function ensureNotifyCode(userId) {
-  const u = getUserById(userId);
-  if (!u) throw new Error('Пользователь не найден');
-  if (u.notify_code) return u.notify_code;
-  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
-  db.prepare('UPDATE users SET notify_code = ? WHERE id = ?').run(code, u.id);
-  return code;
-}
-
-export function listAllUsers() {
-  return db.prepare('SELECT * FROM users ORDER BY id ASC').all().map(publicUser);
-}
-
-export function setUserPlan(userId, plan, days = 30) {
-  if (!(plan in PLANS)) throw new Error(`Неизвестный тариф: ${plan}`);
-  const until = plan === 'free' ? 0 : Date.now() + Math.max(1, Number(days) || 30) * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(plan, until, Number(userId));
-  return publicUser(getUserById(userId));
-}
-
-// ---------- промокоды ----------
-export function createPromoCode({ code, plan = 'investor', days = 14, maxUses = 50 }) {
-  const clean = String(code || '').trim().toUpperCase().replace(/[^A-Z0-9_-]/g, '');
-  if (clean.length < 3) throw new Error('Код должен содержать минимум 3 символа (латиница/цифры)');
-  if (!(plan in PLANS) || plan === 'free') throw new Error('Выберите тариф Инвестор или Профи');
-  const d = Math.max(1, Math.min(365, Math.round(Number(days) || 14)));
-  const m = Math.max(1, Math.min(10000, Math.round(Number(maxUses) || 50)));
-  db.prepare(`INSERT OR REPLACE INTO promocodes (code, plan, days, max_uses, used_count, created_at)
-    VALUES (?, ?, ?, ?, COALESCE((SELECT used_count FROM promocodes WHERE code = ?), 0), ?)`).run(clean, plan, d, m, clean, Date.now());
-  return listPromoCodes();
-}
-
-export function listPromoCodes() {
-  return db.prepare('SELECT * FROM promocodes ORDER BY created_at DESC').all();
-}
-
-export function redeemPromoCode(userId, rawCode) {
-  if (!userId) throw new Error('Войдите в аккаунт для активации промокода');
-  const clean = String(rawCode || '').trim().toUpperCase();
-  const promo = db.prepare('SELECT * FROM promocodes WHERE UPPER(code) = ?').get(clean);
-  if (!promo) throw new Error('Промокод не найден');
-  if (promo.used_count >= promo.max_uses) throw new Error('Лимит активаций этого промокода исчерпан');
-  const already = db.prepare('SELECT 1 FROM promocode_uses WHERE code = ? AND user_id = ?').get(promo.code, Number(userId));
-  if (already) throw new Error('Вы уже активировали этот промокод');
-  const u = getUserById(userId);
-  const baseTs = u.plan === promo.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
-  const nextUntil = baseTs + promo.days * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(promo.plan, nextUntil, u.id);
-  db.prepare('UPDATE promocodes SET used_count = used_count + 1 WHERE code = ?').run(promo.code);
-  db.prepare('INSERT INTO promocode_uses (code, user_id, used_at) VALUES (?, ?, ?)').run(promo.code, u.id, Date.now());
-  return publicUser(getUserById(userId));
-}
-
-export function authMiddleware(req, res, next) {
-  const u = userFromRequest(req);
-  req.user = u;
-  return runWithUser(u, () => next());
-}
+// Copyright (c) 2026 Roman A. Perepelkin. Licensed under the MIT License.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { ROOT, DATA_DIR, DEFAULT_CLOUD_URL } from '../config.js';
+import { db, kvGet, kvSet, registerUidResolver } from '../db.js';
+
+const ctx = new AsyncLocalStorage();
+registerUidResolver(() => ctx.getStore()?.user?.id || 1);
+
+// ---------- шифрование секретов (AES-256-GCM) ----------
+let masterKey = null;
+function getMasterKey() {
+  if (masterKey) return masterKey;
+  const envKey = (process.env.MASTER_KEY || '').trim();
+  if (envKey) {
+    masterKey = crypto.createHash('sha256').update(envKey).digest();
+    return masterKey;
+  }
+  const keyPath = path.join(DATA_DIR, '.master.key');
+  try {
+    if (fs.existsSync(keyPath)) {
+      const hex = fs.readFileSync(keyPath, 'utf8').trim();
+      if (hex.length >= 64) { masterKey = Buffer.from(hex.slice(0, 64), 'hex'); return masterKey; }
+    }
+    const rnd = crypto.randomBytes(32);
+    fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs.writeFileSync(keyPath, rnd.toString('hex'), { mode: 0o600 });
+    masterKey = rnd;
+  } catch {
+    masterKey = crypto.createHash('sha256').update(ROOT).digest();
+  }
+  return masterKey;
+}
+
+export function encryptSecret(plain) {
+  const s = String(plain ?? '').trim();
+  if (!s) return '';
+  if (s.startsWith('enc:v1:')) return s;
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', getMasterKey(), iv);
+  const enc = Buffer.concat([cipher.update(s, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `enc:v1:${iv.toString('hex')}:${tag.toString('hex')}:${enc.toString('hex')}`;
+}
+
+export function decryptSecret(val) {
+  const s = String(val ?? '').trim();
+  if (!s) return '';
+  if (!s.startsWith('enc:v1:')) return s;
+  try {
+    const [, , ivHex, tagHex, encHex] = s.split(':');
+    const decipher = crypto.createDecipheriv('aes-256-gcm', getMasterKey(), Buffer.from(ivHex, 'hex'));
+    decipher.setAuthTag(Buffer.from(tagHex, 'hex'));
+    return Buffer.concat([decipher.update(Buffer.from(encHex, 'hex')), decipher.final()]).toString('utf8');
+  } catch {
+    return '';
+  }
+}
+
+// ---------- хэширование паролей (scrypt) ----------
+export function hashPassword(password) {
+  const salt = crypto.randomBytes(16).toString('hex');
+  const hash = crypto.scryptSync(String(password), salt, 64).toString('hex');
+  return `${salt}:${hash}`;
+}
+
+export function verifyPassword(password, stored) {
+  if (!stored || !stored.includes(':')) return false;
+  const [salt, hex] = stored.split(':');
+  const hash = crypto.scryptSync(String(password), salt, 64);
+  const target = Buffer.from(hex, 'hex');
+  return hash.length === target.length && crypto.timingSafeEqual(hash, target);
+}
+
+// ---------- пользователи и сессии ----------
+export const PLANS = {
+  free: { id: 'free', name: 'Старт (Витрина)', priceRub: 0, maxRunsPerDay: 2, maxVirtualAccounts: 1, maxBrokerAccounts: 0, maxChatPerDay: 10, allowTransformer: false },
+  investor: { id: 'investor', name: 'Инвестор (Автопилот)', priceRub: 3900, maxRunsPerDay: 30, maxVirtualAccounts: 3, maxBrokerAccounts: 2, maxChatPerDay: 150, allowTransformer: false },
+  pro: { id: 'pro', name: 'Профи / Лаборатория', priceRub: 9900, maxRunsPerDay: 500, maxVirtualAccounts: 5, maxBrokerAccounts: 5, maxChatPerDay: 1000, allowTransformer: true },
+};
+
+export function generateApiKey() {
+  return `na_live_${crypto.randomBytes(16).toString('hex')}`;
+}
+
+export function ensureApiKey(userId, regenerate = false) {
+  const u = getUserById(userId);
+  if (!u) throw new Error('Пользователь не найден');
+  if (u.api_key && !regenerate) return u.api_key;
+  const key = generateApiKey();
+  db.prepare('UPDATE users SET api_key = ? WHERE id = ?').run(key, u.id);
+  return key;
+}
+
+export function getUserByApiKey(apiKey) {
+  const clean = String(apiKey || '').trim();
+  if (!clean.startsWith('na_live_')) return null;
+  return db.prepare('SELECT * FROM users WHERE api_key = ?').get(clean) || null;
+}
+
+// ---------- синхронизация лицензии для локального запуска (npx neuroalpha --key ...) ----------
+export function getLocalLicense() {
+  return kvGet('cloudLicense') || null;
+}
+
+export async function activateLocalLicense(apiKey, cloudUrl = '') {
+  const cleanKey = String(apiKey || '').trim();
+  if (!cleanKey.startsWith('na_live_')) throw new Error('Ключ должен начинаться с na_live_…');
+  const baseUrl = String(cloudUrl || process.env.CLOUD_URL || DEFAULT_CLOUD_URL).trim().replace(/\/+$/, '');
+  return patchUserLicense(cleanKey, baseUrl);
+}
+
+async function patchUserLicense(cleanKey, baseUrl) {
+  // 1) если ключ есть в этой же БД — проверяем напрямую
+  const localUser = getUserByApiKey(cleanKey);
+  if (localUser) {
+    const p = effectivePlan(localUser);
+    const lic = {
+      apiKey: cleanKey,
+      cloudUrl: baseUrl || 'local',
+      email: localUser.email,
+      name: localUser.name,
+      plan: p.id,
+      planName: p.name,
+      planUntil: localUser.plan_until || 0,
+      verifiedAt: Date.now(),
+    };
+    kvSet('cloudLicense', lic);
+    return lic;
+  }
+  // 2) иначе проверяем об облачный сервер
+  if (!baseUrl) throw new Error('Ключ не найден локально. Укажите адрес облачного сервера или активируйте ключ на сайте');
+  const r = await fetch(`${baseUrl}/api/license/verify`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${cleanKey}` },
+    body: JSON.stringify({ apiKey: cleanKey }),
+    signal: AbortSignal.timeout(15000),
+  });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok || !j.valid) throw new Error(j.error || `Не удалось проверить ключ (HTTP ${r.status})`);
+  const lic = {
+    apiKey: cleanKey,
+    cloudUrl: baseUrl,
+    email: j.email,
+    name: j.name,
+    plan: j.plan || 'free',
+    planName: j.planName || PLANS[j.plan]?.name || 'Старт',
+    planUntil: j.planUntil || 0,
+    verifiedAt: Date.now(),
+  };
+  kvSet('cloudLicense', lic);
+  // применяем тариф к локальному пользователю #1
+  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = 1').run(lic.plan, lic.planUntil);
+  return lic;
+}
+
+export function effectivePlan(user) {
+  if (!user) return PLANS.free;
+  // В локальном режиме (npx): если активирован лицензионный ключ — действует тариф подписки;
+  // если ADMIN_ALL_PRO=1 или это явно админ облака — действует его тариф
+  if (process.env.CLOUD_MODE !== '1' && user.id === 1) {
+    const lic = getLocalLicense();
+    if (lic?.plan && PLANS[lic.plan]) {
+      if (lic.plan !== 'free' && lic.planUntil > 0 && lic.planUntil < Date.now()) return PLANS.free;
+      return PLANS[lic.plan];
+    }
+    if (process.env.LOCAL_STRICT_LICENSE === '1') return PLANS.free;
+    return PLANS.pro;
+  }
+  if (user.role === 'admin') return PLANS.pro;
+  const p = PLANS[user.plan] || PLANS.free;
+  if (p.id !== 'free' && user.plan_until > 0 && user.plan_until < Date.now()) return PLANS.free;
+  return p;
+}
+
+export function publicUser(u) {
+  if (!u) return null;
+  if (!u.api_key) {
+    try { u.api_key = ensureApiKey(u.id); } catch { /* ignore */ }
+  }
+  const plan = effectivePlan(u);
+  return {
+    id: u.id,
+    email: u.email,
+    name: u.name || 'Инвестор',
+    role: u.role || 'user',
+    plan: plan.id,
+    planName: plan.name,
+    planUntil: u.plan_until || 0,
+    limits: plan,
+    apiKey: u.api_key || null,
+    tgConnected: Boolean(u.tg_chat_id),
+    maxConnected: Boolean(u.max_chat_id),
+    notifyCode: u.notify_code || null,
+    localLicense: process.env.CLOUD_MODE !== '1' ? getLocalLicense() : null,
+    createdAt: u.created_at,
+  };
+}
+
+export function getUserById(id) {
+  return db.prepare('SELECT * FROM users WHERE id = ?').get(Number(id));
+}
+
+export function currentUser() {
+  const store = ctx.getStore();
+  if (store?.user) return store.user;
+  return getUserById(1);
+}
+
+export function currentUserId() {
+  const store = ctx.getStore();
+  return store?.user?.id || 1;
+}
+
+export function runWithUser(user, fn) {
+  return ctx.run({ user }, fn);
+}
+
+export function parseCookies(cookieHeader = '') {
+  const out = {};
+  for (const part of String(cookieHeader || '').split(';')) {
+    const i = part.indexOf('=');
+    if (i > 0) out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
+  }
+  return out;
+}
+
+export function userFromRequest(req) {
+  const cookies = parseCookies(req.headers?.cookie);
+  const authHeader = String(req.headers?.authorization || '');
+  const apiKeyHeader = String(req.headers?.['x-api-key'] || '').trim();
+  const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : '';
+  const apiCandidate = apiKeyHeader || (bearer.startsWith('na_live_') ? bearer : '');
+  if (apiCandidate) {
+    const byKey = getUserByApiKey(apiCandidate);
+    if (byKey) return byKey;
+  }
+  const token = cookies.sid || bearer;
+  if (token) {
+    const sess = db.prepare('SELECT * FROM sessions WHERE token = ? AND expires_at > ?').get(token, Date.now());
+    if (sess) {
+      const u = getUserById(sess.user_id);
+      if (u) return u;
+    }
+  }
+  // В локальном режиме (без CLOUD_MODE=1) по умолчанию открывается владелец (id = 1)
+  if (process.env.CLOUD_MODE !== '1' && cookies.sid !== 'logged_out') {
+    return getUserById(1);
+  }
+  return null;
+}
+
+export function createSession(userId, days = 30) {
+  const token = crypto.randomBytes(24).toString('hex');
+  const now = Date.now();
+  db.prepare('INSERT INTO sessions (token, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
+    .run(token, Number(userId), now, now + days * 86400000);
+  return token;
+}
+
+export function deleteSession(token) {
+  if (!token) return;
+  db.prepare('DELETE FROM sessions WHERE token = ?').run(String(token));
+}
+
+export function registerUser({ email, password, name }) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  if (!cleanEmail || !cleanEmail.includes('@')) throw new Error('Укажите корректный email');
+  if (!password || String(password).length < 6) throw new Error('Пароль должен быть не короче 6 символов');
+  const existing = db.prepare('SELECT id FROM users WHERE email = ?').get(cleanEmail);
+  if (existing) throw new Error('Пользователь с таким email уже зарегистрирован');
+  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+  const apiKey = generateApiKey();
+  const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, notify_code, api_key, created_at)
+    VALUES (?, ?, ?, 'user', 'free', 0, ?, ?, ?)`).run(cleanEmail, String(name || cleanEmail.split('@')[0]).trim(), hashPassword(password), code, apiKey, Date.now());
+  return getUserById(Number(r.lastInsertRowid));
+}
+
+export function loginUser({ email, password }) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  const u = db.prepare('SELECT * FROM users WHERE email = ?').get(cleanEmail);
+  if (!u || !verifyPassword(password, u.pass_hash)) throw new Error('Неверный email или пароль');
+  return u;
+}
+
+export function ensureNotifyCode(userId) {
+  const u = getUserById(userId);
+  if (!u) throw new Error('Пользователь не найден');
+  if (u.notify_code) return u.notify_code;
+  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+  db.prepare('UPDATE users SET notify_code = ? WHERE id = ?').run(code, u.id);
+  return code;
+}
+
+export function listAllUsers() {
+  return db.prepare('SELECT * FROM users ORDER BY id ASC').all().map(publicUser);
+}
+
+export function setUserPlan(userId, plan, days = 30) {
+  if (!(plan in PLANS)) throw new Error(`Неизвестный тариф: ${plan}`);
+  const until = plan === 'free' ? 0 : Date.now() + Math.max(1, Number(days) || 30) * 86400000;
+  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(plan, until, Number(userId));
+  return publicUser(getUserById(userId));
+}
+
+// ---------- промокоды ----------
+export function createPromoCode({ code, plan = 'investor', days = 14, maxUses = 50 }) {
+  const clean = String(code || '').trim().toUpperCase().replace(/[^A-Z0-9_-]/g, '');
+  if (clean.length < 3) throw new Error('Код должен содержать минимум 3 символа (латиница/цифры)');
+  if (!(plan in PLANS) || plan === 'free') throw new Error('Выберите тариф Инвестор или Профи');
+  const d = Math.max(1, Math.min(365, Math.round(Number(days) || 14)));
+  const m = Math.max(1, Math.min(10000, Math.round(Number(maxUses) || 50)));
+  db.prepare(`INSERT OR REPLACE INTO promocodes (code, plan, days, max_uses, used_count, created_at)
+    VALUES (?, ?, ?, ?, COALESCE((SELECT used_count FROM promocodes WHERE code = ?), 0), ?)`).run(clean, plan, d, m, clean, Date.now());
+  return listPromoCodes();
+}
+
+export function listPromoCodes() {
+  return db.prepare('SELECT * FROM promocodes ORDER BY created_at DESC').all();
+}
+
+export function redeemPromoCode(userId, rawCode) {
+  if (!userId) throw new Error('Войдите в аккаунт для активации промокода');
+  const clean = String(rawCode || '').trim().toUpperCase();
+  const promo = db.prepare('SELECT * FROM promocodes WHERE UPPER(code) = ?').get(clean);
+  if (!promo) throw new Error('Промокод не найден');
+  if (promo.used_count >= promo.max_uses) throw new Error('Лимит активаций этого промокода исчерпан');
+  const already = db.prepare('SELECT 1 FROM promocode_uses WHERE code = ? AND user_id = ?').get(promo.code, Number(userId));
+  if (already) throw new Error('Вы уже активировали этот промокод');
+  const u = getUserById(userId);
+  const baseTs = u.plan === promo.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
+  const nextUntil = baseTs + promo.days * 86400000;
+  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(promo.plan, nextUntil, u.id);
+  db.prepare('UPDATE promocodes SET used_count = used_count + 1 WHERE code = ?').run(promo.code);
+  db.prepare('INSERT INTO promocode_uses (code, user_id, used_at) VALUES (?, ?, ?)').run(promo.code, u.id, Date.now());
+  return publicUser(getUserById(userId));
+}
+
+export function authMiddleware(req, res, next) {
+  const u = userFromRequest(req);
+  req.user = u;
+  return runWithUser(u, () => next());
+}
+
+// ---------- OAuth 2.0 / Социальный вход: Яндекс, Google, Сбер ID, Т-Банк ID, VK ID ----------
+export const OAUTH_PROVIDERS = [
+  { id: 'yandex', name: 'Яндекс ID', authUrl: 'https://oauth.yandex.ru/authorize', tokenUrl: 'https://oauth.yandex.ru/token', userUrl: 'https://login.yandex.ru/info?format=json', scope: 'login:email login:info' },
+  { id: 'google', name: 'Google', authUrl: 'https://accounts.google.com/o/oauth2/v2/auth', tokenUrl: 'https://oauth2.googleapis.com/token', userUrl: 'https://www.googleapis.com/oauth2/v3/userinfo', scope: 'openid email profile' },
+  { id: 'sber', name: 'Сбер ID', authUrl: 'https://oauth.sber.ru/ru/prod/tokens/v2/oauth', tokenUrl: 'https://oauth.sber.ru/ru/prod/tokens/v2/oidc', userUrl: 'https://oauth.sber.ru/ru/prod/sberbankid/v2.1/userinfo', scope: 'openid name email' },
+  { id: 'tbank', name: 'T-ID (Т-Банк)', authUrl: 'https://id.tbank.ru/auth/authorize', tokenUrl: 'https://id.tbank.ru/auth/token', userUrl: 'https://id.tbank.ru/userinfo/userinfo', scope: 'openid profile email' },
+  { id: 'vk', name: 'VK ID', authUrl: 'https://oauth.vk.com/authorize', tokenUrl: 'https://oauth.vk.com/access_token', userUrl: 'https://api.vk.com/method/users.get?v=5.199', scope: 'email' },
+];
+
+export function getOAuthConfig() {
+  const saved = kvGet('oauthConfig') || {};
+  const out = {};
+  for (const p of OAUTH_PROVIDERS) {
+    const envPrefix = `OAUTH_${p.id.toUpperCase()}_`;
+    const cur = saved[p.id] || {};
+    const clientId = String(cur.clientId || process.env[`${envPrefix}CLIENT_ID`] || '').trim();
+    const clientSecret = decryptSecret(cur.clientSecret || '') || String(process.env[`${envPrefix}CLIENT_SECRET`] || '').trim();
+    out[p.id] = { id: p.id, name: p.name, clientId, clientSecret, enabled: Boolean(clientId && clientSecret) };
+  }
+  return out;
+}
+
+export function publicOAuthConfig() {
+  const cfg = getOAuthConfig();
+  return Object.fromEntries(OAUTH_PROVIDERS.map((p) => [p.id, {
+    id: p.id,
+    name: p.name,
+    clientId: cfg[p.id].clientId,
+    hasSecret: Boolean(cfg[p.id].clientSecret),
+    enabled: cfg[p.id].enabled,
+  }]));
+}
+
+export function saveOAuthConfig(input = {}) {
+  const prev = kvGet('oauthConfig') || {};
+  const next = { ...prev };
+  for (const p of OAUTH_PROVIDERS) {
+    const b = input[p.id];
+    if (!b) continue;
+    const cur = prev[p.id] || {};
+    next[p.id] = {
+      clientId: String(b.clientId ?? cur.clientId ?? '').trim(),
+      clientSecret: b.clearSecret ? '' : (b.clientSecret && String(b.clientSecret).trim() ? encryptSecret(b.clientSecret) : (cur.clientSecret || '')),
+    };
+  }
+  kvSet('oauthConfig', next);
+  return publicOAuthConfig();
+}
+
+const oauthStates = new Map(); // state -> { provider, plan, createdAt, origin }
+
+export function startOAuthRedirect(providerId, { origin = 'http://localhost:3000', plan = '' } = {}) {
+  const meta = OAUTH_PROVIDERS.find((p) => p.id === providerId);
+  if (!meta) throw new Error(`Неизвестный провайдер: ${providerId}`);
+  const cfg = getOAuthConfig()[providerId];
+  if (!cfg?.enabled) {
+    throw new Error(`Вход через «${meta.name}» ещё не подключён администратором (укажите Client ID и Secret в Настройках → Профиль, тариф и боты)`);
+  }
+  // очистка старых state
+  const now = Date.now();
+  for (const [k, v] of oauthStates) if (now - v.createdAt > 15 * 60000) oauthStates.delete(k);
+
+  const state = crypto.randomBytes(16).toString('hex');
+  const redirectUri = `${origin.replace(/\/+$/, '')}/api/auth/oauth/${providerId}/callback`;
+  oauthStates.set(state, { provider: providerId, plan: String(plan || ''), createdAt: now, redirectUri });
+
+  const params = new URLSearchParams({
+    client_id: cfg.clientId,
+    redirect_uri: redirectUri,
+    response_type: 'code',
+    scope: meta.scope,
+    state,
+  });
+  if (providerId === 'sber') params.set('nonce', crypto.randomUUID());
+  return `${meta.authUrl}?${params.toString()}`;
+}
+
+function decodeJwtPayload(jwt) {
+  try {
+    const part = String(jwt || '').split('.')[1];
+    if (!part) return null;
+    return JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export async function completeOAuthCallback(providerId, { code, state }) {
+  const st = oauthStates.get(String(state || ''));
+  oauthStates.delete(String(state || ''));
+  if (!st || st.provider !== providerId) throw new Error('Сессия авторизации истекла — попробуйте войти ещё раз');
+  if (!code) throw new Error('Провайдер не передал код авторизации');
+
+  const meta = OAUTH_PROVIDERS.find((p) => p.id === providerId);
+  const cfg = getOAuthConfig()[providerId];
+  if (!meta || !cfg?.enabled) throw new Error('Провайдер не настроен');
+
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code: String(code),
+    client_id: cfg.clientId,
+    client_secret: cfg.clientSecret,
+    redirect_uri: st.redirectUri,
+  });
+
+  const tokRes = await fetch(meta.tokenUrl, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    body: body.toString(),
+    signal: AbortSignal.timeout(15000),
+  });
+  const tokJson = await tokRes.json().catch(() => ({}));
+  if (!tokRes.ok || (!tokJson.access_token && !tokJson.id_token)) {
+    throw new Error(tokJson.error_description || tokJson.error || `Ошибка обмена токена ${meta.name} (HTTP ${tokRes.status})`);
+  }
+
+  let email = '';
+  let name = '';
+  let extId = '';
+
+  if (providerId === 'vk') {
+    email = String(tokJson.email || '').trim().toLowerCase();
+    extId = String(tokJson.user_id || '');
+    if (tokJson.access_token && extId) {
+      const uRes = await fetch(`${meta.userUrl}&access_token=${encodeURIComponent(tokJson.access_token)}&user_ids=${encodeURIComponent(extId)}`).then((r) => r.json()).catch(() => null);
+      const u0 = uRes?.response?.[0];
+      if (u0) name = `${u0.first_name || ''} ${u0.last_name || ''}`.trim();
+    }
+  } else {
+    if (tokJson.id_token) {
+      const claims = decodeJwtPayload(tokJson.id_token);
+      if (claims) {
+        email = String(claims.email || '').trim().toLowerCase();
+        name = String(claims.name || claims.given_name || '').trim();
+        extId = String(claims.sub || '');
+      }
+    }
+    if ((!email || !name) && tokJson.access_token && meta.userUrl) {
+      const uRes = await fetch(meta.userUrl, {
+        headers: { Authorization: `Bearer ${tokJson.access_token}`, Accept: 'application/json' },
+        signal: AbortSignal.timeout(12000),
+      }).then((r) => r.json()).catch(() => null);
+      if (uRes) {
+        email = email || String(uRes.default_email || uRes.email || uRes.emails?.[0] || '').trim().toLowerCase();
+        name = name || String(uRes.real_name || uRes.display_name || uRes.name || `${uRes.first_name || ''} ${uRes.last_name || ''}`).trim();
+        extId = extId || String(uRes.id || uRes.sub || uRes.psuid || '');
+      }
+    }
+  }
+
+  if (!email) {
+    email = `${providerId}_${extId || crypto.randomBytes(4).toString('hex')}@oauth.neuroalpha.local`;
+  }
+  if (!name) {
+    name = email.split('@')[0];
+  }
+
+  let user = db.prepare('SELECT * FROM users WHERE email = ?').get(email);
+  if (!user) {
+    const notifyCode = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+    const apiKey = generateApiKey();
+    const rndPass = hashPassword(crypto.randomBytes(16).toString('hex'));
+    const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, notify_code, api_key, created_at)
+      VALUES (?, ?, ?, 'user', 'free', 0, ?, ?, ?)`).run(email, name, rndPass, notifyCode, apiKey, Date.now());
+    user = getUserById(Number(r.lastInsertRowid));
+  } else if (!user.api_key) {
+    ensureApiKey(user.id);
+    user = getUserById(user.id);
+  }
+
+  return { user, plan: st.plan };
+}
+
+export function verifyTelegramLoginWidget(query = {}, botToken = '') {
+  const { hash, ...data } = query;
+  if (!hash || !botToken) throw new Error('Некорректные данные авторизации Telegram');
+  const checkString = Object.keys(data).sort().map((k) => `${k}=${data[k]}`).join('\n');
+  const secretKey = crypto.createHash('sha256').update(botToken).digest();
+  const hmac = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');
+  if (hmac !== String(hash)) throw new Error('Подпись Telegram не прошла проверку');
+  const tgId = String(data.id || '');
+  const name = `${data.first_name || ''} ${data.last_name || ''}`.trim() || data.username || `Telegram ${tgId}`;
+  const email = data.username ? `${String(data.username).toLowerCase()}@tg.neuroalpha.local` : `tg_${tgId}@tg.neuroalpha.local`;
+
+  let user = db.prepare('SELECT * FROM users WHERE tg_chat_id = ? OR email = ?').get(tgId, email);
+  if (!user) {
+    const notifyCode = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+    const apiKey = generateApiKey();
+    const rndPass = hashPassword(crypto.randomBytes(16).toString('hex'));
+    const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, tg_chat_id, notify_code, api_key, created_at)
+      VALUES (?, ?, ?, 'user', 'free', 0, ?, ?, ?, ?)`).run(email, name, rndPass, tgId, notifyCode, apiKey, Date.now());
+    user = getUserById(Number(r.lastInsertRowid));
+  } else if (!user.tg_chat_id) {
+    db.prepare('UPDATE users SET tg_chat_id = ? WHERE id = ?').run(tgId, user.id);
+    user = getUserById(user.id);
+  }
+  return user;
+}