neuroalpha 0.5.17 → 0.5.20

package/public/styles.css

@@ -15,6 +15,9 @@
   --yellow: #d29922;
   --violet: #a371f7;
   --best-bg: #13241a;
+  --blocked-bg: rgba(244, 114, 182, 0.14);
+  --blocked-fg: #f472b6;
+  --blocked-border: rgba(244, 114, 182, 0.48);
   --flash-bg: #2a1f45;
   --chat-w: 38%;
   --accent-bg: rgba(88, 149, 255, 0.15);
@@ -36,6 +39,9 @@ body.light {
   --yellow: #9a6700;
   --violet: #8250df;
   --best-bg: #dcfce7;
+  --blocked-bg: #fce7f3;
+  --blocked-fg: #be185d;
+  --blocked-border: #f9a8d4;
   --flash-bg: #ede9fe;
   --accent-bg: rgba(36, 87, 214, 0.09);
   --hover-bg: #f0f3f6;
@@ -297,10 +303,13 @@ th, td { text-align: left; padding: 5px 8px; border-bottom: 1px solid var(--line
 th { color: var(--muted); font-weight: 500; }
 td.num, th.num { text-align: right; font-variant-numeric: tabular-nums; }
 tr.best td { background: var(--best-bg); }
+tr.fc-blocked td { background: var(--blocked-bg); }
+tr.fc-blocked td:first-child { box-shadow: inset 3px 0 0 var(--blocked-fg); }
 .tag { font-size: 11px; padding: 0 6px; border-radius: 4px; border: 1px solid var(--line); color: var(--muted); }
 .tag.ok { border-color: var(--green); color: var(--green); }
 .tag.no { border-color: var(--red); color: var(--red); }
 .tag.mid { border-color: var(--yellow); color: var(--yellow); }
+.tag.blocked { border-color: var(--blocked-border); color: var(--blocked-fg); background: var(--blocked-bg); font-weight: 500; }
 .stab-box { background: var(--panel); border: 1px solid var(--line); border-radius: 8px; padding: 10px 14px; margin: 8px 0 10px; font-size: 13px; }
 .stab-head { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
 .stab-chips { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 8px; }
@@ -583,7 +592,7 @@ details.hist-year-box[open] > summary { border-bottom: 1px solid var(--line); }
   background: var(--accent);
   border-radius: 4px;
 }
-
-/* Прогноз: две таблицы с общей сеткой колонок */
-.fc-table td, .fc-table th { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+/* Прогноз: две таблицы с общей сеткой колонок */
+.fc-table td, .fc-table th { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 

package/scripts/set-admin-password.mjs

@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
+// Задать email и пароль главного администратора (пользователь №1) или добавить/обновить второго (запасного) администратора (--add).
+//   ADMIN_PASS='…' node scripts/set-admin-password.mjs --email admin@neuroalpha.odant.org
+//   ADMIN_PASS='…' node scripts/set-admin-password.mjs --add --email backup@neuroalpha.odant.org --name "Запасной админ"
+//   kubectl exec -it deploy/neuroalpha-central -- env ADMIN_PASS='…' node scripts/set-admin-password.mjs --email admin@…
+// Пароль берётся из переменной ADMIN_PASS (чтобы не попадал в историю команд как аргумент).
+import { db } from '../server/db.js';
+import { hashPassword, ensureApiKey, createOrUpdateAdminUser } from '../server/auth/index.js';
+
+const i = process.argv.indexOf('--email');
+const iName = process.argv.indexOf('--name');
+const isAdd = process.argv.includes('--add') || process.argv.includes('--second');
+const email = String(i >= 0 ? process.argv[i + 1] : '').trim().toLowerCase();
+const name = iName >= 0 ? String(process.argv[iName + 1] || '').trim() : '';
+const pass = String(process.env.ADMIN_PASS || '');
+if (!email.includes('@') || pass.length < 10) {
+  console.error('Укажите --email и пароль не короче 10 символов в переменной ADMIN_PASS');
+  process.exit(1);
+}
+if (isAdd) {
+  const u = createOrUpdateAdminUser({ email, password: pass, name: name || 'Администратор' });
+  db.prepare('DELETE FROM sessions WHERE user_id = ?').run(u.id);
+  console.log(`✓ Запасной администратор (#${u.id}): ${u.email}. Прежние сессии этого аккаунта завершены.`);
+  process.exit(0);
+}
+db.prepare("UPDATE users SET email = ?, name = COALESCE(NULLIF(?, ''), name), pass_hash = ?, role = 'admin', plan = 'owner', plan_until = 0 WHERE id = 1").run(email, name, hashPassword(pass));
+ensureApiKey(1);
+db.prepare('DELETE FROM sessions WHERE user_id = 1').run();
+console.log(`✓ Главный администратор (#1): ${email}. Все прежние сессии администратора завершены.`);
+process.exit(0);

package/server/api/routes.js

@@ -6,13 +6,13 @@ import { ROOT, strategyDefaults } from '../config.js';
 import { activeModelInfo } from '../llm/client.js';
 import { listProviders, getSelected, addProvider, updateProvider, deleteProvider, fetchRemoteModels, testProvider, selectModel, resolveUpstreamForProxy, providerFetch } from '../llm/providers.js';
 import { listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle, setRunShowcase, listShowcaseRuns, countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal, listSettingsHistory, kvGet, kvSet, db, loadCandles } from '../db.js';
-import { PLANS, effectivePlan, publicUser, getUserById, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createPromoCode, listPromoCodes, redeemPromoCode, acceptUserOffer, createVipRequest, listVipRequests, parseCookies, publicOAuthConfig, saveOAuthConfig, startOAuthRedirect, completeOAuthCallback, verifyTelegramLoginWidget } from '../auth/index.js';
-import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments } from '../billing/yookassa.js';
+import { PLANS, effectivePlan, publicUser, getUserById, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createOrUpdateAdminUser, createPromoCode, listPromoCodes, redeemPromoCode, acceptUserOffer, createVipRequest, listVipRequests, parseCookies, parseAllCookieValues, publicOAuthConfig, saveOAuthConfig, startOAuthRedirect, completeOAuthCallback, verifyTelegramLoginWidget } from '../auth/index.js';
+import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments, listUserPayments } from '../billing/yookassa.js';
 import { publicNotifyConfig, getNotifyConfig, saveNotifyConfig, notifyUser, createTelegramLoginChallenge, checkTelegramLoginChallenge, handleMaxWebhook } from '../notify/index.js';
 import { PARAMS } from '../params-meta.js';
 import { getSettings, updateSettings, resetSettings, revertSettingsChange } from '../settings.js';
 import { startModelResearch, cancelModelResearch, startStabilityCheck, cancelStabilityCheck } from '../model/research.js';
-import { forecastNow, TIER1_LIQUID_SYMBOLS } from '../model/forecast.js';
+import { forecastNow, TIER1_LIQUID_SYMBOLS, symbolEdgeMult } from '../model/forecast.js';
 import { profilesInfo, startProfilesRefresh, TRAITS, loadProfiles } from '../model/profiles.js';
 import { ensureDividends } from '../data/moex.js';
 import { live } from '../model/live.js';
@@ -25,7 +25,7 @@ import { isCrossOrigin } from '../security.js';
 import { IS_CENTRAL, IS_INSTANCE, CENTRAL_URL, clientIp, isHttpsRequest } from '../role.js';
 import { consumeSsoToken } from '../instance/agent.js';
 import { IS_DESKTOP } from '../role.js';
-import { listInstances, createInstance, rotateInstanceKey, setInstanceTrading, setInstanceRevoked, deleteInstance, instanceByKey, instanceHeartbeat, cabinetInstances, ssoRedirectUrl, relayInstanceNotify, centralPublicKeyPem, createDesktopActivationCode, activateDesktopInstall, unbindInstall } from '../instance/central.js';
+import { listInstances, createInstance, rotateInstanceKey, setInstanceTrading, setInstanceRevoked, deleteInstance, instanceByKey, instanceHeartbeat, cabinetInstances, ensureUserCloudInstance, ssoRedirectUrl, relayInstanceNotify, centralPublicKeyPem, createDesktopActivationCode, activateDesktopInstall, unbindInstall } from '../instance/central.js';
 import { activateDesktop, instanceInfo } from '../instance/agent.js';
 import { isActivated } from '../instance/identity.js';
 
@@ -73,8 +73,16 @@ export function createRouter() {
     const secure = isHttpsRequest(res.req) ? '; Secure' : '';
     res.setHeader('Set-Cookie', `sid=${encodeURIComponent(sid)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure}`);
   };
+  const isRuSegmentRequest = (req) => {
+    if (process.env.ALLOW_FOREIGN_AUTH === '1') return false;
+    const country = String(req.headers?.['cf-ipcountry'] || req.headers?.['x-country-code'] || req.headers?.['x-geo-country'] || '').trim().toUpperCase();
+    if (country) return country === 'RU';
+    const lang = String(req.headers?.['accept-language'] || '').toLowerCase();
+    if (lang && !lang.includes('ru')) return false;
+    return true;
+  };
   r.get('/auth/me', (req, res) => res.json({
-    user: req.user ? { ...publicUser(req.user), instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [] } : null,
+    user: req.user ? { ...publicUser(req.user), instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } : null,
     downloads: IS_CENTRAL ? {
       windows: process.env.DESKTOP_DOWNLOAD_WINDOWS || '',
       linux: process.env.DESKTOP_DOWNLOAD_LINUX || '',
@@ -83,6 +91,7 @@ export function createRouter() {
     role: IS_INSTANCE ? 'instance' : IS_CENTRAL ? 'central' : 'dev',
     centralUrl: IS_INSTANCE ? CENTRAL_URL : '',
     cloudMode: process.env.CLOUD_MODE === '1',
+    isRuSegment: isRuSegmentRequest(req),
     plans: PLANS,
     notify: publicNotifyConfig(),
     oauth: publicOAuthConfig(),
@@ -154,8 +163,9 @@ export function createRouter() {
     res.json({ user: publicUser(u), token });
   }));
   r.post('/auth/logout', (req, res) => {
-    const cookies = parseCookies(req.headers?.cookie);
-    if (cookies.sid) deleteSession(cookies.sid);
+    for (const tok of parseAllCookieValues(req.headers?.cookie, 'sid')) {
+      if (tok && tok !== 'logged_out') deleteSession(tok);
+    }
     setCookie(res, 'logged_out', 365 * 86400);
     res.json({ ok: true, ...(IS_INSTANCE ? { redirect: CENTRAL_URL } : {}) });
   });
@@ -221,10 +231,11 @@ export function createRouter() {
     if (!sent.tg && !sent.max) throw new Error('Сначала привяжите Telegram или MAX по вашему коду привязки');
     res.json({ ok: true, ...sent });
   }));
-  r.post('/auth/redeem-promo', wrap((req, res) => {
+  r.post('/auth/redeem-promo', wrap(async (req, res) => {
     if (!req.user) throw new Error('Войдите в аккаунт для активации кода или VIP-токена');
     const user = redeemPromoCode(req.user.id, req.body?.code);
-    res.json({ user });
+    if (IS_CENTRAL) await ensureUserCloudInstance(req.user.id).catch(() => {});
+    res.json({ user: { ...user, instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } });
   }));
   r.post('/auth/accept-offer', wrap((req, res) => {
     if (!req.user) throw new Error('Войдите в аккаунт');
@@ -277,12 +288,25 @@ export function createRouter() {
   }));
   r.post('/billing/verify', wrap(async (req, res) => {
     if (!req.user) throw new Error('Войдите в аккаунт');
-    if (req.body?.paymentId) return res.json(await verifyYookassaPayment(req.body.paymentId));
-    return res.json(await verifyUserLatestPayment(req.user.id));
+    const out = req.body?.paymentId
+      ? await verifyYookassaPayment(req.body.paymentId)
+      : await verifyUserLatestPayment(req.user.id);
+    if (IS_CENTRAL && out?.status === 'succeeded') {
+      await ensureUserCloudInstance(req.user.id).catch(() => {});
+    }
+    res.json({
+      ...out,
+      user: out?.user ? { ...out.user, instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } : null,
+    });
   }));
   r.post('/billing/yookassa/webhook', wrap(async (req, res) => {
     const pid = req.body?.object?.id;
-    if (pid) await verifyYookassaPayment(pid).catch(() => {});
+    if (pid) {
+      const out = await verifyYookassaPayment(pid).catch(() => null);
+      if (IS_CENTRAL && out?.status === 'succeeded' && out?.user?.id) {
+        await ensureUserCloudInstance(out.user.id).catch(() => {});
+      }
+    }
     res.json({ ok: true });
   }));
   r.post('/notify/max/webhook', wrap(async (req, res) => {
@@ -393,9 +417,15 @@ export function createRouter() {
     requireAdmin(req);
     res.json({ promos: createPromoCode(req.body || {}) });
   }));
-  r.post('/admin/user-plan', wrap((req, res) => {
+  r.post('/admin/user-plan', wrap(async (req, res) => {
+    requireAdmin(req);
+    const user = setUserPlan(req.body?.userId, req.body?.plan, req.body?.days || 30);
+    if (IS_CENTRAL) await ensureUserCloudInstance(req.body?.userId).catch(() => {});
+    res.json({ user, users: listAllUsers() });
+  }));
+  r.post('/admin/create-admin', wrap((req, res) => {
     requireAdmin(req);
-    res.json({ user: setUserPlan(req.body?.userId, req.body?.plan, req.body?.days || 30), users: listAllUsers() });
+    res.json({ user: createOrUpdateAdminUser(req.body || {}), users: listAllUsers() });
   }));
   r.post('/admin/billing', wrap((req, res) => {
     requireAdmin(req);
@@ -636,6 +666,7 @@ export function createRouter() {
     const vocabHit = vocabList.find((v) => v.symbol === sym);
     const fcRow = fc?.rows?.find((x) => x.symbol === sym) || null;
     const isTier1 = TIER1_LIQUID_SYMBOLS.has(sym);
+    const tierMult = symbolEdgeMult(sym);
 
     // 10-минутные свечи за последние 30 дней (для детального просмотра 1Д / 1Н / 1М) + дневной ряд за всё время (1Г / Все)
     const nowTs = Date.now();
@@ -727,8 +758,10 @@ export function createRouter() {
       yearChangePct,
       tier: isTier1 ? 1 : 2,
       tierLabel: isTier1 ? '1-й эшелон (высокая ликвидность)' : '2-й эшелон',
-      buyThresholdPct: isTier1 ? Math.max(fc?.buyThresholdPct || 0.30, 0.30) : Math.max(fc?.buyThresholdPct || 0.30, 0.35),
-      shortThresholdPct: isTier1 ? Math.max(fc?.shortThresholdPct || 0.31, 0.31) : Math.max(fc?.shortThresholdPct || 0.31, 0.36),
+      edgeMult: fcRow?.edgeMult ?? round(tierMult, 3),
+      sigmaPct: fcRow?.sigmaPct ?? null,
+      buyThresholdPct: fcRow?.buyThresholdPct ?? round(Math.max((fc?.buyThresholdPct || 0.413) * tierMult, 0.30), 3),
+      shortThresholdPct: fcRow?.shortThresholdPct ?? round(Math.max((fc?.shortThresholdPct || 0.516) * tierMult, 0.31), 3),
       shortAllowedByBroker: shortableMap[sym] !== undefined ? Boolean(shortableMap[sym]) : null,
       specs: {
         lotSize: sp.lotSize,
@@ -748,6 +781,12 @@ export function createRouter() {
         signal: Boolean(fcRow.signal),
         shortSignal: Boolean(fcRow.shortSignal),
         shortBlockedByBroker: Boolean(fcRow.shortBlockedByBroker),
+        shortBlockedBySqueeze: Boolean(fcRow.shortBlockedBySqueeze),
+        buyBlockedByDip: Boolean(fcRow.buyBlockedByDip),
+        buyBlockedByDiv: fcRow.buyBlockedByDiv || null,
+        shortBlockedByDiv: fcRow.shortBlockedByDiv || null,
+        buyBlockedByNews: fcRow.buyBlockedByNews || null,
+        shortBlockedByNews: fcRow.shortBlockedByNews || null,
         selfPct: fcRow.selfPct ?? 0,
         influences: (fcRow.influences || []).map((inf) => {
           const infRow = fc?.rows?.find((x) => x.symbol === inf.symbol);

package/server/auth/index.js

@@ -281,7 +281,7 @@ export function effectivePlan(user) {
     if (process.env.LOCAL_STRICT_LICENSE === '1') return PLANS.none;
     return PLANS.owner;
   }
-  if (user.role === 'admin' || user.plan === 'owner') return PLANS[user.plan] || PLANS.owner;
+  if (user.id === 1 || user.role === 'admin' || user.plan === 'owner') return PLANS.owner;
   const p = PLANS[user.plan] || PLANS.none;
   if (p.id !== 'none' && user.plan_until > 0 && user.plan_until < Date.now()) return PLANS.none;
   return p;
@@ -360,8 +360,20 @@ export function parseCookies(cookieHeader = '') {
   return out;
 }
 
+export function parseAllCookieValues(cookieHeader = '', key = 'sid') {
+  const vals = [];
+  for (const part of String(cookieHeader || '').split(';')) {
+    const i = part.indexOf('=');
+    if (i > 0 && part.slice(0, i).trim() === key) {
+      vals.push(decodeURIComponent(part.slice(i + 1).trim()));
+    }
+  }
+  return vals;
+}
+
 export function userFromRequest(req) {
   const cookies = parseCookies(req.headers?.cookie);
+  const allSids = parseAllCookieValues(req.headers?.cookie, 'sid');
   const authHeader = String(req.headers?.authorization || '');
   const apiKeyHeader = String(req.headers?.['x-api-key'] || '').trim();
   const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : '';
@@ -370,8 +382,8 @@ export function userFromRequest(req) {
     const byKey = getUserByApiKey(apiCandidate);
     if (byKey) return byKey;
   }
-  const token = cookies.sid || bearer;
-  if (token) {
+  const candidates = [...allSids.filter((s) => s && s !== 'logged_out'), ...(bearer ? [bearer] : [])];
+  for (const token of candidates) {
     const sess = db.prepare('SELECT * FROM sessions WHERE token = ? AND expires_at > ?').get(token, Date.now());
     if (sess) {
       const u = getUserById(sess.user_id);
@@ -381,7 +393,8 @@ export function userFromRequest(req) {
   // В локальном режиме (без CLOUD_MODE=1) владелец (id = 1) открывается без входа только с этого компьютера
   // Установка на компьютер клиента после активации — так же, без пароля только с этого компьютера
   const localTrusted = !IS_INSTANCE || (IS_DESKTOP && isActivated());
-  if (process.env.CLOUD_MODE !== '1' && localTrusted && cookies.sid !== 'logged_out' && isLoopbackRequest(req)) {
+  const explicitlyLoggedOut = cookies.sid === 'logged_out' || allSids.includes('logged_out');
+  if (process.env.CLOUD_MODE !== '1' && localTrusted && !explicitlyLoggedOut && isLoopbackRequest(req)) {
     return getUserById(1);
   }
   return null;
@@ -445,9 +458,36 @@ export function listAllUsers() {
 
 export function setUserPlan(userId, plan, days = 30) {
   if (!(plan in PLANS)) throw new Error(`Неизвестный тариф: ${plan}`);
+  const uid = Number(userId);
+  if (!uid) throw new Error('Некорректный ID пользователя');
   const until = (plan === 'none' || plan === 'owner') ? 0 : Date.now() + Math.max(1, Number(days) || 30) * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ? WHERE id = ?').run(plan, until, Number(userId));
-  return publicUser(getUserById(userId));
+  // Тариф «Хозяин» (owner) даёт права администратора (role = 'admin'); главный владелец (id = 1) всегда сохраняет роль admin
+  const role = (plan === 'owner' || uid === 1) ? 'admin' : 'user';
+  db.prepare('UPDATE users SET plan = ?, plan_until = ?, role = ? WHERE id = ?').run(plan, until, role, uid);
+  return publicUser(getUserById(uid));
+}
+
+export function createOrUpdateAdminUser({ email, password, name }) {
+  const cleanEmail = String(email || '').trim().toLowerCase();
+  if (!cleanEmail || !cleanEmail.includes('@')) throw new Error('Укажите корректный email администратора');
+  const existing = db.prepare('SELECT * FROM users WHERE email = ?').get(cleanEmail);
+  const cleanPass = String(password || '').trim();
+  if (existing) {
+    if (cleanPass && cleanPass.length < 6) throw new Error('Пароль должен быть не короче 6 символов');
+    const nextHash = cleanPass ? hashPassword(cleanPass) : existing.pass_hash;
+    const nextName = String(name || '').trim() || existing.name || 'Администратор';
+    db.prepare("UPDATE users SET name = ?, pass_hash = ?, role = 'admin', plan = 'owner', plan_until = 0 WHERE id = ?")
+      .run(nextName, nextHash, existing.id);
+    ensureApiKey(existing.id);
+    return publicUser(getUserById(existing.id));
+  }
+  if (cleanPass.length < 6) throw new Error('Для нового администратора укажите пароль не короче 6 символов');
+  const code = `NA-${crypto.randomBytes(3).toString('hex').toUpperCase()}`;
+  const apiKey = generateApiKey();
+  const cleanName = String(name || '').trim() || 'Администратор';
+  const r = db.prepare(`INSERT INTO users (email, name, pass_hash, role, plan, plan_until, notify_code, api_key, offer_accepted_at, created_at)
+    VALUES (?, ?, ?, 'admin', 'owner', 0, ?, ?, ?, ?)`).run(cleanEmail, cleanName, hashPassword(cleanPass), code, apiKey, Date.now(), Date.now());
+  return publicUser(getUserById(Number(r.lastInsertRowid)));
 }
 
 // ---------- промокоды и персональные VIP-токены ----------
@@ -480,7 +520,11 @@ export function redeemPromoCode(userId, rawCode) {
   const u = getUserById(userId);
   const baseTs = u.plan === promo.plan && u.plan_until > Date.now() ? u.plan_until : Date.now();
   const nextUntil = baseTs + promo.days * 86400000;
-  db.prepare('UPDATE users SET plan = ?, plan_until = ?, offer_accepted_at = COALESCE(NULLIF(offer_accepted_at, 0), ?) WHERE id = ?').run(promo.plan, nextUntil, Date.now(), u.id);
+  if (u.id === 1 || u.role === 'admin') {
+    db.prepare('UPDATE users SET offer_accepted_at = COALESCE(NULLIF(offer_accepted_at, 0), ?) WHERE id = ?').run(Date.now(), u.id);
+  } else {
+    db.prepare('UPDATE users SET plan = ?, plan_until = ?, offer_accepted_at = COALESCE(NULLIF(offer_accepted_at, 0), ?) WHERE id = ?').run(promo.plan, nextUntil, Date.now(), u.id);
+  }
   db.prepare('UPDATE promocodes SET used_count = used_count + 1 WHERE code = ?').run(promo.code);
   db.prepare('INSERT INTO promocode_uses (code, user_id, used_at) VALUES (?, ?, ?)').run(promo.code, u.id, Date.now());
   return publicUser(getUserById(userId));
@@ -518,11 +562,11 @@ export function authMiddleware(req, res, next) {
 
 // ---------- OAuth 2.0 / Социальный вход: Яндекс, Google, Сбер ID, Т-Банк ID, VK ID ----------
 export const OAUTH_PROVIDERS = [
-  { id: 'yandex', name: 'Яндекс ID', authUrl: 'https://oauth.yandex.ru/authorize', tokenUrl: 'https://oauth.yandex.ru/token', userUrl: 'https://login.yandex.ru/info?format=json', scope: 'login:email login:info' },
-  { id: 'google', name: 'Google', authUrl: 'https://accounts.google.com/o/oauth2/v2/auth', tokenUrl: 'https://oauth2.googleapis.com/token', userUrl: 'https://www.googleapis.com/oauth2/v3/userinfo', scope: 'openid email profile' },
-  { id: 'sber', name: 'Сбер ID', authUrl: 'https://oauth.sber.ru/ru/prod/tokens/v2/oauth', tokenUrl: 'https://oauth.sber.ru/ru/prod/tokens/v2/oidc', userUrl: 'https://oauth.sber.ru/ru/prod/sberbankid/v2.1/userinfo', scope: 'openid name email' },
-  { id: 'tbank', name: 'T-ID (Т-Банк)', authUrl: 'https://id.tbank.ru/auth/authorize', tokenUrl: 'https://id.tbank.ru/auth/token', userUrl: 'https://id.tbank.ru/userinfo/userinfo', scope: 'openid profile email' },
-  { id: 'vk', name: 'VK ID', authUrl: 'https://oauth.vk.com/authorize', tokenUrl: 'https://oauth.vk.com/access_token', userUrl: 'https://api.vk.com/method/users.get?v=5.199', scope: 'email' },
+  { id: 'yandex', name: 'Яндекс ID', foreign: false, authUrl: 'https://oauth.yandex.ru/authorize', tokenUrl: 'https://oauth.yandex.ru/token', userUrl: 'https://login.yandex.ru/info?format=json', scope: 'login:email login:info' },
+  { id: 'google', name: 'Google', foreign: true, authUrl: 'https://accounts.google.com/o/oauth2/v2/auth', tokenUrl: 'https://oauth2.googleapis.com/token', userUrl: 'https://www.googleapis.com/oauth2/v3/userinfo', scope: 'openid email profile' },
+  { id: 'sber', name: 'Сбер ID', foreign: false, authUrl: 'https://oauth.sber.ru/ru/prod/tokens/v2/oauth', tokenUrl: 'https://oauth.sber.ru/ru/prod/tokens/v2/oidc', userUrl: 'https://oauth.sber.ru/ru/prod/sberbankid/v2.1/userinfo', scope: 'openid name email' },
+  { id: 'tbank', name: 'T-ID (Т-Банк)', foreign: false, authUrl: 'https://id.tbank.ru/auth/authorize', tokenUrl: 'https://id.tbank.ru/auth/token', userUrl: 'https://id.tbank.ru/userinfo/userinfo', scope: 'openid profile email' },
+  { id: 'vk', name: 'VK ID', foreign: false, authUrl: 'https://oauth.vk.com/authorize', tokenUrl: 'https://oauth.vk.com/access_token', userUrl: 'https://api.vk.com/method/users.get?v=5.199', scope: 'email' },
 ];
 
 export function getOAuthConfig() {
@@ -533,7 +577,7 @@ export function getOAuthConfig() {
     const cur = saved[p.id] || {};
     const clientId = String(cur.clientId || process.env[`${envPrefix}CLIENT_ID`] || '').trim();
     const clientSecret = decryptSecret(cur.clientSecret || '') || String(process.env[`${envPrefix}CLIENT_SECRET`] || '').trim();
-    out[p.id] = { id: p.id, name: p.name, clientId, clientSecret, enabled: Boolean(clientId && clientSecret) };
+    out[p.id] = { id: p.id, name: p.name, foreign: Boolean(p.foreign), clientId, clientSecret, enabled: Boolean(clientId && clientSecret) };
   }
   return out;
 }
@@ -543,6 +587,7 @@ export function publicOAuthConfig() {
   return Object.fromEntries(OAUTH_PROVIDERS.map((p) => [p.id, {
     id: p.id,
     name: p.name,
+    foreign: Boolean(p.foreign),
     clientId: cfg[p.id].clientId,
     hasSecret: Boolean(cfg[p.id].clientSecret),
     enabled: cfg[p.id].enabled,