""" pdf2scan web service — FastAPI backend. Добавляет задания в очередь бота (та же БД, тот же temp/). Бот обрабатывает и оставляет файл в temp/ (url_res_f='web_local'). Веб отдаёт файл напрямую и удаляет через 30 минут. """ import asyncio import datetime import hashlib import hmac import os import re import secrets import sqlite3 import subprocess import threading import time import uuid from pathlib import Path from fastapi import FastAPI, File, Form, HTTPException, Request, UploadFile from fastapi.exceptions import RequestValidationError from starlette.background import BackgroundTask from starlette.middleware.base import BaseHTTPMiddleware from fastapi.responses import FileResponse, HTMLResponse, JSONResponse, RedirectResponse, Response from fastapi.staticfiles import StaticFiles # ── Config ──────────────────────────────────────────────────────────────────── BOT_TOKEN = os.getenv("TOKEN", "") BOT_USERNAME = os.getenv("BOT_USERNAME", "pdf2scan_pybot") DB_PATH = "/data/bot_db.db" BOT_TEMP = "temp/" # относительный путь (рабочая директория /app) WEB_USER_ID = 0 # фейковый TG user_id для веб-заданий RESULT_TTL = 21600 # 6 часов (большие пачки не успевают за 30 мин) AUTH_TOKEN_TTL = 600 # 10 минут на авторизацию через бота AUTH_REQUIRED_PAGES = 100 AUTH_REQUIRED_MB = 50.0 # ── ЮKassa (платежи) ────────────────────────────────────────────────────────── YOOKASSA_SHOP_ID = os.getenv("YOOKASSA_SHOP_ID", "") YOOKASSA_SECRET_KEY = os.getenv("YOOKASSA_SECRET_KEY", "") YOOKASSA_API = "https://api.yookassa.ru/v3" SITE_BASE_URL = os.getenv("SITE_BASE_URL", "https://pdf2scan.online") PAY_MIN_RUB = 10.0 PAY_MAX_RUB = 100000.0 # Тариф API Pro (правится здесь). Активируется при purpose=api_pro. API_PRO_PRICE_RUB = float(os.getenv("API_PRO_PRICE_RUB", "299")) API_PRO_DAYS = 30 # Пейволл больших файлов: ≤50МБ и ≤100стр — бесплатно; больше — оплата. FILE_PRICE_RUB = float(os.getenv("FILE_PRICE_RUB", "99")) # разовая за файл SUB_PRICE_RUB = float(os.getenv("SUB_PRICE_RUB", "299")) # подписка/мес SUB_DAYS = 30 # Пейволл ВЫКЛЮЧЕН по умолчанию: пока нет фронта пейволла — работает старый порог # авторизации (иначе большие файлы у залогиненных зависнут). Включим флагом = 1. PAYWALL_ENABLED = os.getenv("PAYWALL_ENABLED", "0").strip() in {"1", "true", "yes", "on"} # ── OAuth: Yandex ID ────────────────────────────────────────────────────────── YANDEX_CLIENT_ID = os.getenv("YANDEX_CLIENT_ID", "") YANDEX_CLIENT_SECRET = os.getenv("YANDEX_CLIENT_SECRET", "") YANDEX_REDIRECT = f"{os.getenv('SITE_BASE_URL', 'https://pdf2scan.online')}/api/auth/yandex/callback" SESSION_COOKIE = "p2s_session" SESSION_DAYS = 30 # ── OAuth: VK ID (OAuth 2.1 / PKCE) ─────────────────────────────────────────── VK_CLIENT_ID = os.getenv("VK_CLIENT_ID", "") VK_CLIENT_SECRET = os.getenv("VK_CLIENT_SECRET", "") VK_REDIRECT = f"{os.getenv('SITE_BASE_URL', 'https://pdf2scan.online')}/api/auth/vk/callback" # ── Админ-панель ────────────────────────────────────────────────────────────── ADMIN_TOKEN = os.getenv("ADMIN_TOKEN", "") # ── Подписка через Telegram-бота (подписанные deep-link) ────────────────────── SUB_LINK_SECRET = os.getenv("SUB_LINK_SECRET", "") # общий секрет бота и веба # ── Вход по почте (magic-code через SMTP) ───────────────────────────────────── SMTP_HOST = os.getenv("SMTP_HOST", "") SMTP_PORT = int(os.getenv("SMTP_PORT", "465")) SMTP_USER = os.getenv("SMTP_USER", "") SMTP_PASS = os.getenv("SMTP_PASS", "") SMTP_FROM = os.getenv("SMTP_FROM", "") or SMTP_USER EMAIL_CODE_TTL = 600 # 10 минут на ввод кода # Чанковая загрузка (туннель схлопывает крупные передачи — грузим кусками ≤6 МБ) UPLOAD_DIR = f"{BOT_TEMP}uploads/" # временные .part-файлы MAX_CHUNK_BYTES = 12 * 1024 * 1024 # защита: один кусок не больше 12 МБ MAX_UPLOAD_BYTES = 300 * 1024 * 1024 # суммарный предел собранного файла _COLOR_MAP = {"color": "цветной", "bw": "черно-белый"} # job_id → {original_name, stitching, created_at} _meta: dict[str, dict] = {} _meta_lock = threading.Lock() # zip_id → {status, path, name, created_at} — асинхронная сборка больших ZIP _zip_jobs: dict[str, dict] = {} _zip_jobs_lock = threading.Lock() # user_id → unix timestamp of verification (24h TTL) _verified_users: dict[int, float] = {} _verified_users_lock = threading.Lock() # ── Конвертация документов ──────────────────────────────────────────────────── _LO_PROFILE_TEMPLATE = "/opt/lo-profile" def _convert_doc_to_pdf(src_path: str, dst_path: str) -> None: """Конвертирует DOC/DOCX в PDF через libreoffice.""" import tempfile, shutil with tempfile.TemporaryDirectory() as userdir: # Копируем шаблон профиля (замена шрифтов Calibri→Carlito и т.д.) if os.path.isdir(_LO_PROFILE_TEMPLATE): shutil.copytree(_LO_PROFILE_TEMPLATE, userdir, dirs_exist_ok=True) cmd = [ "libreoffice", f"-env:UserInstallation=file://{userdir}", "--headless", "--norestore", "--convert-to", "pdf", "--outdir", str(Path(dst_path).parent), str(src_path), ] result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=180) if result.returncode != 0: raise RuntimeError(f"libreoffice convert failed: {result.stderr.decode(errors='ignore')}") candidate = Path(dst_path).parent / (Path(src_path).stem + ".pdf") if candidate.exists() and str(candidate) != dst_path: candidate.rename(dst_path) if not Path(dst_path).exists(): raise FileNotFoundError(f"Converted PDF not found: {dst_path}") # ── БД-хелперы ──────────────────────────────────────────────────────────────── def _db_insert_job( name_or_f, stitching, title, numeration, flip_side, color, pdfa, quality, original_name, source_size_mb, ocr=0, web_owner_id=0, ): now = datetime.datetime.now() date_str = now.strftime("%Y.%m.%d") time_str = now.strftime("%H:%M:%S") with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute("PRAGMA table_info(FILES)") cols = {row[1] for row in cur.fetchall()} fields = [ "date", "time", "name_or_f", "user_id", "first_name", "last_name", "username", "stitching", "title", "numeration", "flip_side", "color", "pdfa", "num_pages", "name_res_f", "url_res_f", "finish_time", "elapsed_time", ] values = [ date_str, time_str, name_or_f, WEB_USER_ID, "Web", "User", "webuser", stitching, int(title), int(numeration), int(flip_side), color, int(pdfa), 0, "-", "-", "-", "-", ] if "original_name" in cols: fields.append("original_name") values.append(original_name or "document.pdf") if "source_size_mb" in cols: fields.append("source_size_mb") values.append(source_size_mb) if "quality" in cols: fields.append("quality") values.append(quality or "high") if "ocr" in cols: fields.append("ocr") values.append(int(ocr)) if "web_owner_id" in cols: fields.append("web_owner_id") values.append(int(web_owner_id or 0)) placeholders = ", ".join(["?"] * len(fields)) sql = f"INSERT INTO FILES ({', '.join(fields)}) VALUES ({placeholders})" cur.execute(sql, values) con.commit() def _db_get_url_res_f(name_or_f: str) -> str | None: try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute("SELECT url_res_f FROM FILES WHERE name_or_f = ?", (name_or_f,)) row = cur.fetchone() return row[0] if row else None except Exception: return None def _db_get_job_meta(name_or_f: str): """(original_name, stitching) из FILES — имена для скачивания/ZIP переживают рестарт.""" try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute("SELECT original_name, stitching FROM FILES WHERE name_or_f = ?", (name_or_f,)) row = cur.fetchone() if row: return (row[0] or None, row[1] or None) except Exception: pass return (None, None) def _db_set_url_res_f(name_or_f: str, value: str): try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("UPDATE FILES SET url_res_f = ? WHERE name_or_f = ?", (value, name_or_f)) con.commit() except Exception: pass def _db_queue_position(name_or_f: str) -> int: """Реальная позиция задания в очереди (1 = бот обрабатывает его сейчас; FIFO по rowid). Бот не помечает задание 'processing' в БД, поэтому позицию считаем по rowid.""" try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute("SELECT rowid FROM FILES WHERE name_or_f = ?", (name_or_f,)) row = cur.fetchone() if not row: return 0 myrow = row[0] cur.execute( "SELECT COUNT(*) FROM FILES " "WHERE (url_res_f IS NULL OR TRIM(url_res_f) IN ('', '-')) AND rowid <= ?", (myrow,), ) r = cur.fetchone() return int(r[0]) if r else 0 except Exception: return 0 # ── Web auth tokens (shared SQLite) ─────────────────────────────────────────── def _db_ensure_auth_table(): try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute(""" CREATE TABLE IF NOT EXISTS WEB_AUTH_TOKENS ( token TEXT PRIMARY KEY, user_id INTEGER, first_name TEXT, last_name TEXT, username TEXT, created_at REAL, status TEXT DEFAULT 'pending' ) """) # Подтверждённые веб-пользователи — в БД, чтобы авторизация # переживала рестарт контейнера (не только in-memory _verified_users). con.execute(""" CREATE TABLE IF NOT EXISTS WEB_VERIFIED_USERS ( user_id INTEGER PRIMARY KEY, verified_at REAL ) """) # API-ключи для бизнес-доступа (интеграции). owner_id — TG user_id # владельца ключа (из веб-авторизации). Оплату/квоты прикрутим позже — # поля plan/quota уже заложены. con.execute(""" CREATE TABLE IF NOT EXISTS WEB_API_KEYS ( api_key TEXT PRIMARY KEY, owner_id INTEGER, name TEXT, plan TEXT DEFAULT 'free', active INTEGER DEFAULT 1, req_count INTEGER DEFAULT 0, created_at REAL, last_req REAL ) """) # Аккаунты с подпиской. account_id: 'tg:' (позже yandex:/vk:/email:). con.execute(""" CREATE TABLE IF NOT EXISTS WEB_ACCOUNTS ( account_id TEXT PRIMARY KEY, sub_until REAL DEFAULT 0, created_at REAL ) """) # Сессии (cookie) для OAuth-входа (Yandex/VK). token → аккаунт. con.execute(""" CREATE TABLE IF NOT EXISTS WEB_SESSIONS ( token TEXT PRIMARY KEY, account_id TEXT, provider TEXT, name TEXT, email TEXT, created_at REAL, expires_at REAL ) """) # Коды для входа по почте (magic-code). con.execute(""" CREATE TABLE IF NOT EXISTS WEB_EMAIL_CODES ( email TEXT PRIMARY KEY, code TEXT, created_at REAL, attempts INTEGER DEFAULT 0 ) """) # Счётчик заходов на сайт по дням (для админ-панели). con.execute(""" CREATE TABLE IF NOT EXISTS WEB_VISITS ( day TEXT PRIMARY KEY, count INTEGER DEFAULT 0 ) """) # Уникальные посетители: (день, id браузера из cookie p2s_vid). con.execute(""" CREATE TABLE IF NOT EXISTS WEB_VISIT_IDS ( day TEXT, vid TEXT, PRIMARY KEY (day, vid) ) """) # Платежи ЮKassa. status: pending/succeeded/canceled. purpose: donate/api_pro/file/sub. con.execute(""" CREATE TABLE IF NOT EXISTS WEB_PAYMENTS ( payment_id TEXT PRIMARY KEY, amount REAL, currency TEXT, status TEXT, purpose TEXT, api_key TEXT, owner_id INTEGER, email TEXT, created_at REAL, paid_at REAL ) """) # paid_until у ключей — до какого времени активен платный тариф try: cur = con.execute("PRAGMA table_info(WEB_API_KEYS)") kcols = {row[1] for row in cur.fetchall()} if "paid_until" not in kcols: con.execute("ALTER TABLE WEB_API_KEYS ADD COLUMN paid_until REAL DEFAULT 0") except Exception as _kmig: print(f"WEB_API_KEYS migrate error: {_kmig}") # Авто-миграция FILES: колонки для OCR и владельца веб-задания # (личный кабинет «Мои документы»). ADD COLUMN идемпотентен по факту наличия. try: cur = con.execute("PRAGMA table_info(FILES)") have = {row[1] for row in cur.fetchall()} if "ocr" not in have: con.execute("ALTER TABLE FILES ADD COLUMN ocr INTEGER DEFAULT 0") if "web_owner_id" not in have: con.execute("ALTER TABLE FILES ADD COLUMN web_owner_id INTEGER DEFAULT 0") except Exception as _mig: print(f"FILES migrate error: {_mig}") # Авто-миграция WEB_ACCOUNTS: авто-продление подписки (сохранённый способ оплаты) try: cur = con.execute("PRAGMA table_info(WEB_ACCOUNTS)") acols = {row[1] for row in cur.fetchall()} for _c, _ddl in (("autorenew", "INTEGER DEFAULT 0"), ("pm_id", "TEXT"), ("pm_email", "TEXT"), ("renew_fail", "INTEGER DEFAULT 0"), ("last_renew", "REAL DEFAULT 0")): if _c not in acols: con.execute(f"ALTER TABLE WEB_ACCOUNTS ADD COLUMN {_c} {_ddl}") except Exception as _amig: print(f"WEB_ACCOUNTS migrate error: {_amig}") con.commit() except Exception as e: print(f"WEB_AUTH_TOKENS create error: {e}") def _db_mark_verified(user_id: int): if not user_id: return try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_VERIFIED_USERS (user_id, verified_at) VALUES (?, ?) " "ON CONFLICT(user_id) DO UPDATE SET verified_at=excluded.verified_at", (int(user_id), time.time()), ) con.commit() except Exception: pass def _db_is_verified(user_id: int) -> bool: if not user_id: return False try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute("SELECT verified_at FROM WEB_VERIFIED_USERS WHERE user_id = ?", (int(user_id),)) row = cur.fetchone() return bool(row) and (time.time() - (row[0] or 0) <= 86400) except Exception: return False def _db_create_auth_token(token: str): with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_AUTH_TOKENS (token, created_at, status) VALUES (?, ?, 'pending')", (token, time.time()), ) con.commit() def _db_poll_auth_token(token: str) -> dict | None: try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute( "SELECT status, user_id, first_name, last_name, username, created_at " "FROM WEB_AUTH_TOKENS WHERE token = ?", (token,), ) row = cur.fetchone() if not row: return None return { "status": row[0], "user_id": row[1], "first_name": row[2], "last_name": row[3], "username": row[4], "created_at": row[5], } except Exception: return None # ── Фоновая уборка файлов через 30 минут ────────────────────────────────────── def _cleanup_loop(): while True: time.sleep(60) now = time.time() # Удаляем просроченные сессии авторизации (24 ч) with _verified_users_lock: stale = [uid for uid, ts in _verified_users.items() if now - ts > 86400] for uid in stale: del _verified_users[uid] # Удаляем старые auth-токены из БД (старше 1 часа) try: with sqlite3.connect(DB_PATH, timeout=5) as con: con.execute( "DELETE FROM WEB_AUTH_TOKENS WHERE created_at < ?", (now - 3600,), ) con.commit() except Exception: pass # Удаляем старые результаты по mtime файла — не зависит от in-memory _meta, # поэтому переживает рестарт контейнера (пачка не пропадает). try: for rp in Path(BOT_TEMP).glob("* скан *.pdf"): try: if now - rp.stat().st_mtime > RESULT_TTL: rp.unlink() except Exception: pass except Exception: pass with _meta_lock: for jid in [j for j, m in _meta.items() if now - m["created_at"] > RESULT_TTL]: _meta.pop(jid, None) # Подчищаем оставшиеся ZIP-архивы (на случай, если их не скачали) try: for zp in Path(BOT_TEMP).glob("*.zip"): if now - zp.stat().st_mtime > RESULT_TTL: zp.unlink() except Exception: pass # Подчищаем устаревшие записи фоновых zip-сборок with _zip_jobs_lock: for zid in [z for z, jj in _zip_jobs.items() if now - jj.get("created_at", now) > RESULT_TTL]: old = _zip_jobs.pop(zid, {}) if old.get("path"): _safe_remove(old["path"]) # Подчищаем брошенные куски чанковой загрузки (старше часа) try: for pp in Path(UPLOAD_DIR).glob("*.part"): if now - pp.stat().st_mtime > 3600: pp.unlink() except Exception: pass # ── Auth ────────────────────────────────────────────────────────────────────── def _verify_telegram_auth(data: dict) -> bool: if not BOT_TOKEN: return False try: data = dict(data) check_hash = data.pop("hash", None) if not check_hash: return False if time.time() - int(data.get("auth_date", 0)) > 86400: return False data_check_string = "\n".join(f"{k}={v}" for k, v in sorted(data.items())) secret_key = hashlib.sha256(BOT_TOKEN.encode()).digest() expected = hmac.new(secret_key, data_check_string.encode(), hashlib.sha256).hexdigest() return hmac.compare_digest(expected, check_hash) except Exception: return False # ── App ─────────────────────────────────────────────────────────────────────── app = FastAPI(title="pdf2scan web") class NoIndexApiMiddleware(BaseHTTPMiddleware): """Запрещает индексирование /api/* роботами.""" async def dispatch(self, request: Request, call_next): response = await call_next(request) if request.url.path.startswith("/api/"): response.headers["X-Robots-Tag"] = "noindex, nofollow" return response app.add_middleware(NoIndexApiMiddleware) @app.exception_handler(RequestValidationError) async def validation_exception_handler(request: Request, exc: RequestValidationError): print(f"422 on {request.method} {request.url.path}: {exc.errors()}") return JSONResponse(status_code=422, content={"detail": str(exc.errors())}) @app.on_event("startup") async def _startup(): os.makedirs(BOT_TEMP, exist_ok=True) os.makedirs(UPLOAD_DIR, exist_ok=True) _db_ensure_auth_table() threading.Thread(target=_cleanup_loop, daemon=True).start() threading.Thread(target=_autorenew_loop, daemon=True).start() app.mount("/static", StaticFiles(directory="/web_app/static"), name="static") # ── SEO: серверный рендер локализованных языковых страниц ───────────────────── # Отдельные URL на язык (/, /en/, /de/…) с локализованным — краулеры видят # правильные title/description/hreflang на своём языке, это открывает западный трафик. SEO_BASE = "https://pdf2scan.online" SEO_LANG_PATH = { "ru": "/", "en": "/en/", "de": "/de/", "fr": "/fr/", "it": "/it/", "es": "/es/", "pt": "/pt/", } SEO_LOCALE = { "ru": "ru_RU", "en": "en_US", "de": "de_DE", "fr": "fr_FR", "it": "it_IT", "es": "es_ES", "pt": "pt_PT", } SEO = { "ru": { "title": "pdf2scan — сделать скан из PDF онлайн бесплатно", "desc": "Сделайте скан из PDF онлайн — бесплатно, без регистрации. Эффект сканирования, сшивка (нитка, ленточка, пружинка, уголок, дырокол), нумерация страниц и лист «прошито-пронумеровано».", "og_desc": "Сделайте скан из PDF онлайн — бесплатно, без регистрации. Сшивка, нумерация, эффект сканирования в один клик.", "keywords": "сделать скан из pdf онлайн, pdf в скан онлайн, сканирование pdf бесплатно, pdf с эффектом сканирования, прошить документ онлайн, сшивка документов онлайн, растровый pdf онлайн, pdf2scan", "ld_desc": "Бесплатный онлайн-инструмент для создания PDF с эффектом сканирования. Сшивка нитками, ленточкой, уголком, пружинкой и дыроколом. Нумерация страниц, титульный лист, PDF/A.", }, "en": { "title": "pdf2scan — add a scan effect to PDF online, free", "desc": "Make a PDF look scanned online — free, no signup. Add a realistic scan effect, binding (thread, ribbon, spiral, corner, hole punch), page numbering and a certification page. Word to scanned PDF too.", "og_desc": "Make your PDF look scanned online — free, no signup. Scan effect, binding and page numbering in one click.", "keywords": "pdf scanner effect online, make pdf look scanned, add scan effect to pdf, convert pdf to scanned document, scan effect pdf free, pdf to scan online, word to scanned pdf, pdf2scan", "ld_desc": "Free online tool to give a PDF a realistic scan effect. Thread, ribbon, corner, spiral and hole-punch binding. Page numbering, title page, PDF/A.", }, "de": { "title": "pdf2scan — PDF online mit Scan-Effekt versehen, kostenlos", "desc": "PDF online wie gescannt aussehen lassen — kostenlos, ohne Anmeldung. Realistischer Scan-Effekt, Bindung (Faden, Band, Spirale, Ecke, Lochung), Seitennummerierung und Zertifizierungsseite. Auch Word zu gescanntem PDF.", "og_desc": "PDF online wie gescannt aussehen lassen — kostenlos, ohne Anmeldung. Scan-Effekt, Bindung und Nummerierung in einem Klick.", "keywords": "pdf scan-effekt online, pdf wie gescannt, pdf in scan umwandeln, scan-effekt pdf kostenlos, word in gescanntes pdf, pdf2scan", "ld_desc": "Kostenloses Online-Tool, um ein PDF wie einen echten Scan aussehen zu lassen. Faden-, Band-, Ecken-, Spiral- und Lochbindung. Seitennummerierung, Titelseite, PDF/A.", }, "fr": { "title": "pdf2scan — ajouter un effet scan à un PDF en ligne, gratuit", "desc": "Donnez à un PDF l'apparence d'un document scanné en ligne — gratuit, sans inscription. Effet scan réaliste, reliure (fil, ruban, spirale, coin, perforation), numérotation et page de certification. Word vers PDF scanné aussi.", "og_desc": "Donnez à un PDF l'apparence d'un scan en ligne — gratuit, sans inscription. Effet scan, reliure et numérotation en un clic.", "keywords": "effet scan pdf en ligne, pdf aspect scanné, convertir pdf en scan, effet scan pdf gratuit, word en pdf scanné, pdf2scan", "ld_desc": "Outil en ligne gratuit pour donner à un PDF un effet de scan réaliste. Reliure par fil, ruban, coin, spirale et perforateur. Numérotation, page de titre, PDF/A.", }, "it": { "title": "pdf2scan — aggiungi un effetto scansione al PDF online, gratis", "desc": "Fai sembrare scansionato un PDF online — gratis, senza registrazione. Effetto scansione realistico, rilegatura (filo, nastro, spirale, angolo, foratura), numerazione e pagina di certificazione. Anche da Word a PDF scansionato.", "og_desc": "Fai sembrare scansionato un PDF online — gratis, senza registrazione. Effetto scansione, rilegatura e numerazione in un clic.", "keywords": "effetto scansione pdf online, pdf aspetto scansionato, convertire pdf in scansione, effetto scansione pdf gratis, word in pdf scansionato, pdf2scan", "ld_desc": "Strumento online gratuito per dare a un PDF un effetto scansione realistico. Rilegatura con filo, nastro, angolo, spirale e perforatore. Numerazione, pagina del titolo, PDF/A.", }, "es": { "title": "pdf2scan — añade efecto de escaneo a un PDF online, gratis", "desc": "Haz que un PDF parezca escaneado online — gratis, sin registro. Efecto de escaneo realista, encuadernación (hilo, cinta, espiral, esquina, perforación), numeración y página de certificación. También de Word a PDF escaneado.", "og_desc": "Haz que un PDF parezca escaneado online — gratis, sin registro. Efecto de escaneo, encuadernación y numeración en un clic.", "keywords": "efecto escaneo pdf online, pdf aspecto escaneado, convertir pdf a escaneado, efecto escaneo pdf gratis, word a pdf escaneado, pdf2scan", "ld_desc": "Herramienta online gratuita para dar a un PDF un efecto de escaneo realista. Encuadernación con hilo, cinta, esquina, espiral y perforadora. Numeración, página de título, PDF/A.", }, "pt": { "title": "pdf2scan — adicione efeito de digitalização ao PDF online, grátis", "desc": "Faça um PDF parecer digitalizado online — grátis, sem cadastro. Efeito de digitalização realista, encadernação (fio, fita, espiral, canto, furação), numeração e página de certificação. Também de Word para PDF digitalizado.", "og_desc": "Faça um PDF parecer digitalizado online — grátis, sem cadastro. Efeito de digitalização, encadernação e numeração em um clique.", "keywords": "efeito digitalização pdf online, pdf aparência digitalizada, converter pdf em digitalizado, efeito scan pdf grátis, word para pdf digitalizado, pdf2scan", "ld_desc": "Ferramenta online gratuita para dar a um PDF um efeito de digitalização realista. Encadernação com fio, fita, canto, espiral e furador. Numeração, página de título, PDF/A.", }, } _INDEX_RAW: str | None = None def _load_index_template() -> str: global _INDEX_RAW if _INDEX_RAW is None: with open("/web_app/static/index.html", encoding="utf-8") as f: _INDEX_RAW = f.read() return _INDEX_RAW def _esc_attr(s: str) -> str: return s.replace("&", "&").replace('"', """).replace("<", "<").replace(">", ">") def _build_seo_head(lang: str) -> str: s = SEO[lang] path = SEO_LANG_PATH[lang] url = SEO_BASE + path title = _esc_attr(s["title"]) desc = _esc_attr(s["desc"]) og_desc = _esc_attr(s["og_desc"]) keywords = _esc_attr(s["keywords"]) og_img = f"{SEO_BASE}/static/og.png" hreflangs = "\n".join( f'' for lc, p in SEO_LANG_PATH.items() ) ld = { "@context": "https://schema.org", "@type": "WebApplication", "name": "pdf2scan", "url": url, "description": s["ld_desc"], "applicationCategory": "UtilitiesApplication", "operatingSystem": "Any", "browserRequirements": "Requires JavaScript", "inLanguage": list(SEO_LANG_PATH.keys()), "offers": {"@type": "Offer", "price": "0", "priceCurrency": "RUB"}, "creator": {"@type": "Organization", "name": "pdf2scan", "url": SEO_BASE}, } import json as _json ld_json = _json.dumps(ld, ensure_ascii=False, indent=2) return ( f"{title}\n" f'\n' f'\n' f'\n' f"{hreflangs}\n" f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'\n' f'' ) def _render_index_html(lang: str) -> str: lang = lang if lang in SEO else "ru" html = _load_index_template() # Локализуем язык документа. На корне (/ = ru/x-default) data-prelang оставляем # пустым, чтобы уважать сохранённый выбор пользователя и авто-детект языка; # на явных языковых URL (/en/, /de/…) prelang жёсткий — страница на своём языке. prelang = "" if lang == "ru" else lang html = html.replace( '', f'', ) # Заменяем SEO-блок между маркерами на локализованный start = html.find("") end = html.find("") if start != -1 and end != -1: head = _build_seo_head(lang) html = html[:start] + "\n" + head + "\n" + html[end:] return html @app.get("/", response_class=HTMLResponse) async def index(): return _render_index_html("ru") @app.get("/en/", response_class=HTMLResponse) @app.get("/en", response_class=HTMLResponse) async def index_en(): return _render_index_html("en") @app.get("/de/", response_class=HTMLResponse) @app.get("/de", response_class=HTMLResponse) async def index_de(): return _render_index_html("de") @app.get("/fr/", response_class=HTMLResponse) @app.get("/fr", response_class=HTMLResponse) async def index_fr(): return _render_index_html("fr") @app.get("/it/", response_class=HTMLResponse) @app.get("/it", response_class=HTMLResponse) async def index_it(): return _render_index_html("it") @app.get("/es/", response_class=HTMLResponse) @app.get("/es", response_class=HTMLResponse) async def index_es(): return _render_index_html("es") @app.get("/pt/", response_class=HTMLResponse) @app.get("/pt", response_class=HTMLResponse) async def index_pt(): return _render_index_html("pt") @app.get("/favicon.ico", include_in_schema=False) async def favicon(): return FileResponse("/web_app/static/favicon.ico", media_type="image/x-icon") @app.get("/robots.txt") async def robots(): return HTMLResponse( content=( "User-agent: *\n" "Allow: /\n" "Disallow: /api/\n" "Disallow: /static/\n" "\n" "Sitemap: https://pdf2scan.online/sitemap.xml\n" ), media_type="text/plain", ) @app.get("/sitemap.xml") async def sitemap(): today = datetime.date.today().isoformat() # Все языковые страницы + перекрёстные hreflang-альтернативы (xhtml:link) alternates = "".join( f' \n' for lc, p in SEO_LANG_PATH.items() ) alternates += f' \n' urls = "" for lc, p in SEO_LANG_PATH.items(): urls += ( ' \n' f' {SEO_BASE}{p}\n' f'{alternates}' f' {today}\n' ' weekly\n' f' {"1.0" if lc == "ru" else "0.9"}\n' ' \n' ) # Страница API-документации (для запросов «pdf scan api») urls += ( ' \n' f' {SEO_BASE}/developers\n' f' {today}\n' ' monthly\n' ' 0.7\n' ' \n' ) return HTMLResponse( content=( '\n' '\n' f'{urls}' '\n' ), media_type="application/xml", ) @app.post("/api/auth/token") async def create_auth_token(): """Создаёт одноразовый токен для авторизации через бота.""" token = secrets.token_hex(16) _db_create_auth_token(token) url = f"tg://resolve?domain={BOT_USERNAME}&start=webauth_{token}" return {"token": token, "url": url, "expires_in": AUTH_TOKEN_TTL} @app.get("/api/auth/poll/{token}") async def poll_auth_token(token: str): """Проверяет статус авторизации по токену.""" row = _db_poll_auth_token(token) if not row: raise HTTPException(status_code=404, detail="Token not found") if time.time() - row["created_at"] > AUTH_TOKEN_TTL: return {"status": "expired"} if row["status"] == "verified": uid = row["user_id"] if uid: with _verified_users_lock: _verified_users[uid] = time.time() _db_mark_verified(uid) return { "status": "verified", "user_id": uid, "first_name": row["first_name"] or "", "last_name": row["last_name"] or "", "username": row["username"] or "", } return {"status": "pending"} @app.post("/api/check") async def check_auth_required(pages: int = Form(0), size_mb: float = Form(0.0)): requires_auth = pages > AUTH_REQUIRED_PAGES or size_mb > AUTH_REQUIRED_MB return {"requires_auth": requires_auth} @app.post("/api/auth/verify") async def verify_auth(data: dict): if not _verify_telegram_auth(data): raise HTTPException(status_code=401, detail="Invalid Telegram auth data") try: uid = int(data.get("id", 0)) if uid: with _verified_users_lock: _verified_users[uid] = time.time() _db_mark_verified(uid) except (TypeError, ValueError): pass return {"ok": True, "user_id": data.get("id")} def _count_pdf_pages(content: bytes) -> int: """Быстрый подсчёт страниц по байтам PDF без внешних зависимостей.""" try: matches = re.findall(rb'/Type\s*/Page[^s]', content) return len(matches) except Exception: return 0 def _write_bytes(path: str, data: bytes) -> None: """Синхронная запись файла — вызывается через asyncio.to_thread, чтобы не блокировать event-loop.""" with open(path, "wb") as f_out: f_out.write(data) def _read_and_count_pdf(path: str) -> int: """Читает PDF с диска и считает страницы (для запуска в отдельном потоке).""" try: with open(path, "rb") as f_in: return _count_pdf_pages(f_in.read()) except Exception: return 0 def _safe_remove(path: str) -> None: try: os.remove(path) except Exception: pass _UPLOAD_ID_RE = re.compile(r"^[A-Za-z0-9_-]{8,64}$") def _chunk_part_path(upload_id: str): """Путь к временному .part-файлу чанковой загрузки (с валидацией upload_id).""" if not upload_id or not _UPLOAD_ID_RE.match(upload_id): return None return f"{UPLOAD_DIR}{upload_id}.part" def _write_chunk_at(path: str, data: bytes, offset: int) -> None: """Пишет кусок по смещению (идемпотентно при ретраях). Вызывается через to_thread.""" os.makedirs(os.path.dirname(path), exist_ok=True) fd = os.open(path, os.O_WRONLY | os.O_CREAT, 0o644) try: os.pwrite(fd, data, offset) finally: os.close(fd) def _finalize_submit(job_id, file_path, original_name, stitching, title, numeration, flip_side, color, pdfa, quality, size_mb, pages, user_id, trusted=False, ocr=0, web_owner_id=None, account_id=None): """Общий хвост постановки задания: проверка авторизации, запись в БД, _meta. trusted=True (бизнес-API по ключу) — пропускает пейволл. account_id — аккаунт запроса (из сессии/TG) для проверки подписки. web_owner_id — TG id владельца для истории «Мои документы» (по умолчанию = user_id).""" # Пейволл: ≤50МБ и ≤100стр — бесплатно; больше — нужна активная подписка, # иначе задание держим (url_res_f='awaiting_payment') до разовой оплаты 99₽. acc = account_id or _account_id(user_id) held = False if not trusted and (size_mb > AUTH_REQUIRED_MB or pages > AUTH_REQUIRED_PAGES): if _db_sub_active(acc): pass # активная подписка — бесплатно elif PAYWALL_ENABLED: held = True # держим до оплаты 99₽ или подписки else: # Пейволл ещё не включён → прежний порог: нужна TG-авторизация verified = False if user_id: with _verified_users_lock: ts = _verified_users.get(user_id) if ts and time.time() - ts <= 86400: verified = True if not verified and _db_is_verified(user_id): verified = True if not verified: _safe_remove(file_path) raise HTTPException( status_code=403, detail="Для файлов больше 100 страниц или 50 МБ необходима авторизация через Telegram.", ) bot_color = _COLOR_MAP.get(color, "цветной") owner = web_owner_id if web_owner_id is not None else user_id try: _db_insert_job( name_or_f=job_id, stitching=stitching, title=title, numeration=numeration, flip_side=flip_side, color=bot_color, pdfa=pdfa, quality=quality, original_name=original_name, source_size_mb=size_mb, ocr=ocr, web_owner_id=owner, ) except Exception as exc: _safe_remove(file_path) raise HTTPException(status_code=500, detail=f"Ошибка записи в БД: {exc}") with _meta_lock: _meta[job_id] = { "original_name": original_name, "stitching": stitching, "created_at": time.time(), } if held: # Задание не идёт в очередь бота, пока не оплатят (файл 99₽ или подписка) _db_set_url_res_f(job_id, "awaiting_payment") return {"job_id": job_id, "requires_payment": True, "file_price": FILE_PRICE_RUB, "sub_price": SUB_PRICE_RUB} return {"job_id": job_id} def _build_zip(items) -> str: """Собирает ZIP из готовых PDF. items = [(src_path, arcname), ...]. Возвращает путь к временному архиву.""" import tempfile import zipfile fd, zip_path = tempfile.mkstemp(suffix=".zip", dir=BOT_TEMP) os.close(fd) # ZIP_STORED: PDF уже сжаты, повторное сжатие только грузит CPU без выгоды with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_STORED) as zf: for src_path, arcname in items: zf.write(src_path, arcname=arcname) return zip_path @app.post("/api/submit") async def submit( request: Request, file: UploadFile = File(...), stitching: str = Form("без сшивки"), title: int = Form(0), numeration: int = Form(0), flip_side: int = Form(0), color: str = Form("color"), pdfa: int = Form(0), quality: str = Form("high"), ocr: int = Form(0), user_id: int = Form(0), ): original_name = file.filename or "document.pdf" src_ext = os.path.splitext(original_name)[1].lower() is_doc = src_ext in (".doc", ".docx") # Именование аналогично телеграм-боту: YYYY.MM.DD_HH-MM-SS_имя_файла _stem = os.path.splitext(original_name)[0].replace("'", "").replace(":", "") job_id = f"{datetime.datetime.now().strftime('%Y.%m.%d_%H-%M-%S')}_{_stem}" file_path = f"{BOT_TEMP}{job_id}.pdf" content = await file.read() size_mb = len(content) / (1024 * 1024) if is_doc: # Сохраняем оригинальный Word-документ во временный файл src_path = f"{BOT_TEMP}{job_id}{src_ext}" try: await asyncio.to_thread(_write_bytes, src_path, content) except Exception as exc: raise HTTPException(status_code=500, detail=f"Не удалось сохранить файл: {exc}") # Конвертируем в PDF через libreoffice try: await asyncio.to_thread(_convert_doc_to_pdf, src_path, file_path) except Exception as exc: try: os.remove(src_path) except Exception: pass raise HTTPException(status_code=500, detail=f"Не удалось конвертировать DOC/DOCX: {exc}") finally: try: os.remove(src_path) except Exception: pass # Считаем страницы из конвертированного PDF pages = await asyncio.to_thread(_read_and_count_pdf, file_path) else: pages = await asyncio.to_thread(_count_pdf_pages, content) try: await asyncio.to_thread(_write_bytes, file_path, content) except Exception as exc: raise HTTPException(status_code=500, detail=f"Не удалось сохранить файл: {exc}") return _finalize_submit( job_id, file_path, original_name, stitching, title, numeration, flip_side, color, pdfa, quality, size_mb, pages, user_id, ocr=ocr, account_id=_resolve_account(request, user_id), ) @app.post("/api/upload-chunk") async def upload_chunk( upload_id: str = Form(...), offset: int = Form(...), chunk: UploadFile = File(...), ): """Приём одного куска файла (чанковая загрузка в обход потолка туннеля).""" part_path = _chunk_part_path(upload_id) if not part_path: raise HTTPException(status_code=400, detail="Bad upload_id") if offset < 0 or offset > MAX_UPLOAD_BYTES: raise HTTPException(status_code=400, detail="Bad offset") data = await chunk.read() if len(data) > MAX_CHUNK_BYTES: raise HTTPException(status_code=413, detail="Chunk too large") if offset + len(data) > MAX_UPLOAD_BYTES: raise HTTPException(status_code=413, detail="Upload too large") await asyncio.to_thread(_write_chunk_at, part_path, data, offset) return {"ok": True} @app.post("/api/submit-chunked") async def submit_chunked( request: Request, upload_id: str = Form(...), filename: str = Form("document.pdf"), total_size: int = Form(0), stitching: str = Form("без сшивки"), title: int = Form(0), numeration: int = Form(0), flip_side: int = Form(0), color: str = Form("color"), pdfa: int = Form(0), quality: str = Form("high"), ocr: int = Form(0), user_id: int = Form(0), ): """Финализация чанковой загрузки: собранный .part становится заданием в очереди.""" part_path = _chunk_part_path(upload_id) if not part_path or not os.path.exists(part_path): raise HTTPException(status_code=404, detail="Загрузка не найдена") actual = os.path.getsize(part_path) if total_size and actual != total_size: _safe_remove(part_path) raise HTTPException(status_code=400, detail=f"Размер не совпал ({actual} != {total_size})") original_name = filename or "document.pdf" src_ext = os.path.splitext(original_name)[1].lower() is_doc = src_ext in (".doc", ".docx") _stem = os.path.splitext(original_name)[0].replace("'", "").replace(":", "") job_id = f"{datetime.datetime.now().strftime('%Y.%m.%d_%H-%M-%S')}_{_stem}" file_path = f"{BOT_TEMP}{job_id}.pdf" size_mb = actual / (1024 * 1024) try: if is_doc: src_path = f"{BOT_TEMP}{job_id}{src_ext}" await asyncio.to_thread(os.replace, part_path, src_path) try: await asyncio.to_thread(_convert_doc_to_pdf, src_path, file_path) finally: _safe_remove(src_path) pages = await asyncio.to_thread(_read_and_count_pdf, file_path) else: await asyncio.to_thread(os.replace, part_path, file_path) pages = await asyncio.to_thread(_read_and_count_pdf, file_path) except HTTPException: raise except Exception as exc: _safe_remove(part_path) _safe_remove(file_path) raise HTTPException(status_code=500, detail=f"Не удалось обработать файл: {exc}") return _finalize_submit( job_id, file_path, original_name, stitching, title, numeration, flip_side, color, pdfa, quality, size_mb, pages, user_id, ocr=ocr, account_id=_resolve_account(request, user_id), ) @app.get("/api/status/{job_id}") async def status(job_id: str): url_res_f = _db_get_url_res_f(job_id) if url_res_f is None: raise HTTPException(status_code=404, detail="Job not found") if url_res_f in ("-", "", None): pos = _db_queue_position(job_id) if pos <= 1: # передний в очереди — бот его сейчас и обрабатывает (он не пишет 'processing' в БД) return {"status": "processing", "progress": 50, "queue_pos": 0, "error": None} return {"status": "queued", "progress": 0, "queue_pos": pos, "error": None} if url_res_f in ("processing", "uploading"): return {"status": "processing", "progress": 50, "queue_pos": 0, "error": None} if url_res_f == "awaiting_payment": # Большой файл ждёт оплаты (99₽ за файл или подписка) return {"status": "awaiting_payment", "progress": 0, "queue_pos": 0, "error": None, "file_price": FILE_PRICE_RUB, "sub_price": SUB_PRICE_RUB} if url_res_f in ("ошибка", "error"): return {"status": "error", "progress": 0, "queue_pos": 0, "error": "Ошибка обработки"} if url_res_f == "cancelled": return {"status": "error", "progress": 0, "queue_pos": 0, "error": "Обработка отменена"} if url_res_f == "expired": return {"status": "error", "progress": 0, "queue_pos": 0, "error": "Ссылка истекла. Отправьте файл заново."} if url_res_f == "web_local": # Считаем оставшееся время with _meta_lock: meta = _meta.get(job_id, {}) created_at = meta.get("created_at", time.time()) expires_in = max(0, int(RESULT_TTL - (time.time() - created_at))) return {"status": "done", "progress": 100, "queue_pos": 0, "error": None, "expires_in": expires_in} # Любой другой непустой статус — тоже готово return {"status": "done", "progress": 100, "queue_pos": 0, "error": None} def _make_download_response(job_id: str) -> FileResponse: """Готовит FileResponse с результатом задания (общий код для веба и бизнес-API).""" url_res_f = _db_get_url_res_f(job_id) if url_res_f != "web_local": raise HTTPException(status_code=409, detail="Not ready") with _meta_lock: meta = _meta.get(job_id, {}) original_name = meta.get("original_name") stitching = meta.get("stitching") if not original_name or not stitching: db_name, db_st = _db_get_job_meta(job_id) # фоллбэк на БД (переживает рестарт) original_name = original_name or db_name or "document.pdf" stitching = stitching or db_st or "без сшивки" base = os.path.splitext(original_name)[0] download_name = f"{base} скан.pdf" result_path = f"{BOT_TEMP}{job_id} скан {stitching}.pdf" if not os.path.exists(result_path): _db_set_url_res_f(job_id, "expired") raise HTTPException(status_code=404, detail="Файл не найден или уже удалён") return FileResponse( result_path, media_type="application/pdf", filename=download_name, ) @app.get("/api/download/{job_id}") async def download(job_id: str): return _make_download_response(job_id) def _collect_zip_items(job_ids): """[(result_path, arcname)] для готовых заданий (имена из _meta или БД).""" items = [] used = set() for jid in job_ids: if not isinstance(jid, str): continue if _db_get_url_res_f(jid) != "web_local": continue with _meta_lock: meta = _meta.get(jid, {}) original_name = meta.get("original_name") stitching = meta.get("stitching") if not original_name or not stitching: db_name, db_st = _db_get_job_meta(jid) original_name = original_name or db_name or "document.pdf" stitching = stitching or db_st or "без сшивки" result_path = f"{BOT_TEMP}{jid} скан {stitching}.pdf" if not os.path.exists(result_path): continue base = os.path.splitext(os.path.basename(original_name))[0] arcname = f"{base} скан.pdf" n = 1 while arcname in used: n += 1 arcname = f"{base} скан ({n}).pdf" used.add(arcname) items.append((result_path, arcname)) return items def _zip_build_worker(zip_id, items): """Фоновая сборка ZIP (большие архивы не успевают за таймаут заголовков прокси).""" try: path = _build_zip(items) with _zip_jobs_lock: j = _zip_jobs.get(zip_id) if j is not None: j["status"] = "ready" j["path"] = path except Exception as exc: with _zip_jobs_lock: j = _zip_jobs.get(zip_id) if j is not None: j["status"] = "error" j["error"] = str(exc) @app.post("/api/zip/prepare") async def zip_prepare(payload: dict): """Старт фоновой сборки ZIP. Возвращает zip_id; статус — /api/zip/status.""" job_ids = payload.get("job_ids") if isinstance(payload, dict) else None if not isinstance(job_ids, list) or not job_ids: raise HTTPException(status_code=400, detail="job_ids required") if len(job_ids) > 20: raise HTTPException(status_code=400, detail="Слишком много файлов (максимум 20)") items = _collect_zip_items(job_ids) if not items: raise HTTPException(status_code=409, detail="Нет готовых файлов для архива") zip_id = secrets.token_hex(8) download_name = f"pdf2scan_{datetime.datetime.now().strftime('%Y-%m-%d')}.zip" with _zip_jobs_lock: _zip_jobs[zip_id] = {"status": "building", "created_at": time.time(), "name": download_name} threading.Thread(target=_zip_build_worker, args=(zip_id, items), daemon=True).start() return {"zip_id": zip_id, "name": download_name} @app.get("/api/zip/status/{zip_id}") async def zip_status(zip_id: str): with _zip_jobs_lock: j = _zip_jobs.get(zip_id) if not j: raise HTTPException(status_code=404, detail="not found") return {"status": j.get("status"), "name": j.get("name"), "error": j.get("error")} @app.get("/api/zip/file/{zip_id}") async def zip_file(zip_id: str): with _zip_jobs_lock: j = _zip_jobs.get(zip_id) if not j or j.get("status") != "ready" or not j.get("path") or not os.path.exists(j["path"]): raise HTTPException(status_code=404, detail="Архив не готов") path = j["path"] name = j.get("name", "pdf2scan.zip") def _cleanup(): _safe_remove(path) with _zip_jobs_lock: _zip_jobs.pop(zip_id, None) return FileResponse( path, media_type="application/zip", filename=name, background=BackgroundTask(_cleanup), ) # ══════════════════════════════════════════════════════════════════════════════ # Бизнес-API (доступ по ключу) — /api/v1/* # ══════════════════════════════════════════════════════════════════════════════ API_RATE_PER_MIN = 60 # мягкий лимит запросов в минуту на ключ _api_rate: dict[str, list] = {} _api_rate_lock = threading.Lock() def _db_create_api_key(owner_id: int, name: str, plan: str = "free") -> str: key = "sk_" + secrets.token_hex(24) with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_API_KEYS (api_key, owner_id, name, plan, active, req_count, created_at) " "VALUES (?, ?, ?, ?, 1, 0, ?)", (key, int(owner_id or 0), (name or "key")[:64], plan, time.time()), ) con.commit() return key def _db_get_api_key(key: str): try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute( "SELECT api_key, owner_id, name, plan, active, req_count " "FROM WEB_API_KEYS WHERE api_key = ?", (key,), ) row = cur.fetchone() if not row: return None return { "api_key": row[0], "owner_id": row[1], "name": row[2], "plan": row[3], "active": row[4], "req_count": row[5], } except Exception: return None def _db_touch_api_key(key: str): try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "UPDATE WEB_API_KEYS SET req_count = req_count + 1, last_req = ? WHERE api_key = ?", (time.time(), key), ) con.commit() except Exception: pass def _extract_api_key(request: Request) -> str | None: auth = request.headers.get("authorization") or "" if auth.lower().startswith("bearer "): return auth[7:].strip() return request.headers.get("x-api-key") def _require_api_key(request: Request) -> dict: key = _extract_api_key(request) if not key: raise HTTPException( status_code=401, detail="Missing API key. Use 'Authorization: Bearer ' or 'X-API-Key' header.", ) row = _db_get_api_key(key) if not row or not row.get("active"): raise HTTPException(status_code=401, detail="Invalid or inactive API key.") now = time.time() with _api_rate_lock: bucket = [t for t in _api_rate.get(key, []) if now - t < 60] if len(bucket) >= API_RATE_PER_MIN: raise HTTPException(status_code=429, detail=f"Rate limit exceeded ({API_RATE_PER_MIN}/min).") bucket.append(now) _api_rate[key] = bucket _db_touch_api_key(key) return row @app.post("/api/v1/keys") async def api_create_key(token: str = Form(...), name: str = Form("api")): """Самовыдача ключа: нужен подтверждённый auth-токen (после входа через Telegram-бота).""" row = _db_poll_auth_token(token) if not row or row.get("status") != "verified" or not row.get("user_id"): raise HTTPException(status_code=401, detail="Требуется вход через Telegram (verified token).") key = _db_create_api_key(row["user_id"], name) return {"api_key": key, "plan": "free", "rate_limit_per_min": API_RATE_PER_MIN, "note": "Сохраните ключ — он показывается один раз."} @app.post("/api/v1/scan") async def api_scan( request: Request, file: UploadFile = File(...), stitching: str = Form("без сшивки"), title: int = Form(0), numeration: int = Form(0), flip_side: int = Form(0), color: str = Form("color"), pdfa: int = Form(0), quality: str = Form("high"), ocr: int = Form(0), ): """Постановка файла в обработку по API-ключу. Возвращает job_id.""" key_row = _require_api_key(request) original_name = file.filename or "document.pdf" src_ext = os.path.splitext(original_name)[1].lower() is_doc = src_ext in (".doc", ".docx") _stem = os.path.splitext(original_name)[0].replace("'", "").replace(":", "") job_id = f"{datetime.datetime.now().strftime('%Y.%m.%d_%H-%M-%S')}_{_stem}" file_path = f"{BOT_TEMP}{job_id}.pdf" content = await file.read() size_mb = len(content) / (1024 * 1024) if size_mb > MAX_UPLOAD_BYTES / (1024 * 1024): raise HTTPException(status_code=413, detail="File too large") if is_doc: src_path = f"{BOT_TEMP}{job_id}{src_ext}" await asyncio.to_thread(_write_bytes, src_path, content) try: await asyncio.to_thread(_convert_doc_to_pdf, src_path, file_path) except Exception as exc: _safe_remove(src_path) raise HTTPException(status_code=500, detail=f"DOC/DOCX convert failed: {exc}") finally: _safe_remove(src_path) pages = await asyncio.to_thread(_read_and_count_pdf, file_path) else: pages = await asyncio.to_thread(_count_pdf_pages, content) await asyncio.to_thread(_write_bytes, file_path, content) result = _finalize_submit( job_id, file_path, original_name, stitching, title, numeration, flip_side, color, pdfa, quality, size_mb, pages, user_id=WEB_USER_ID, trusted=True, ocr=ocr, web_owner_id=key_row.get("owner_id") or 0, ) return {"job_id": result["job_id"], "pages": pages, "status_url": f"/api/v1/scan/{result['job_id']}", "download_url": f"/api/v1/scan/{result['job_id']}/download"} @app.get("/api/v1/scan/{job_id}") async def api_scan_status(request: Request, job_id: str): """Статус задания по API-ключу: queued / processing / done / error.""" _require_api_key(request) url_res_f = _db_get_url_res_f(job_id) if url_res_f is None: raise HTTPException(status_code=404, detail="Job not found") if url_res_f in ("-", "", None): pos = _db_queue_position(job_id) if pos <= 1: return {"status": "processing", "queue_pos": 0} return {"status": "queued", "queue_pos": pos} if url_res_f in ("processing", "uploading"): return {"status": "processing", "queue_pos": 0} if url_res_f in ("ошибка", "error"): return {"status": "error", "error": "processing failed"} if url_res_f == "cancelled": return {"status": "error", "error": "cancelled"} if url_res_f == "expired": return {"status": "error", "error": "expired"} return {"status": "done", "download_url": f"/api/v1/scan/{job_id}/download"} @app.get("/api/v1/scan/{job_id}/download") async def api_scan_download(request: Request, job_id: str): """Скачивание результата по API-ключу.""" _require_api_key(request) return _make_download_response(job_id) # ── Личный кабинет: история «Мои документы» ─────────────────────────────────── def _db_history(owner_id: int, limit: int = 40): """Последние веб-задания владельца (для личного кабинета).""" rows = [] try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.cursor() cur.execute("PRAGMA table_info(FILES)") cols = {r[1] for r in cur.fetchall()} if "web_owner_id" not in cols: return rows oname = "original_name" if "original_name" in cols else "name_or_f" cur.execute( f"SELECT name_or_f, {oname}, date, time, url_res_f, stitching " "FROM FILES WHERE web_owner_id = ? ORDER BY rowid DESC LIMIT ?", (int(owner_id), limit), ) for r in cur.fetchall(): job_id, name, date, tm, url_res_f, stitching = r if url_res_f == "web_local": result_path = f"{BOT_TEMP}{job_id} скан {stitching}.pdf" st = "available" if os.path.exists(result_path) else "expired" elif url_res_f in ("-", "", None): st = "processing" elif url_res_f in ("ошибка", "error"): st = "error" else: st = "expired" rows.append({ "job_id": job_id, "name": name or "document.pdf", "date": date, "time": tm, "status": st, }) except Exception as exc: print(f"history error: {exc}") return rows @app.get("/api/history/{user_id}") async def history(user_id: int): """История документов пользователя. Только для подтверждённых (вошедших) юзеров.""" if not user_id or not _db_is_verified(user_id): raise HTTPException(status_code=403, detail="Требуется вход через Telegram.") return {"items": _db_history(user_id)} # ── Загрузка ZIP: распаковка и постановка каждого PDF/DOCX в очередь ─────────── def _unpack_zip_and_enqueue(part_path: str, settings: dict, user_id: int) -> list[dict]: """Распаковывает ZIP, ставит в очередь каждый вложенный PDF/DOC(X). Возвращает [{job_id,name}].""" import zipfile created = [] verified = bool(user_id) and (_db_is_verified(user_id) or ( _verified_users.get(user_id, 0) and time.time() - _verified_users[user_id] <= 86400)) try: with zipfile.ZipFile(part_path) as zf: names = [n for n in zf.namelist() if not n.endswith("/") and os.path.splitext(n)[1].lower() in (".pdf", ".doc", ".docx")] names = names[:20] # не больше 20 файлов за раз for inner in names: ext = os.path.splitext(inner)[1].lower() base = os.path.basename(inner) or f"file{ext}" _stem = os.path.splitext(base)[0].replace("'", "").replace(":", "") job_id = f"{datetime.datetime.now().strftime('%Y.%m.%d_%H-%M-%S')}_{_stem}_{secrets.token_hex(2)}" file_path = f"{BOT_TEMP}{job_id}.pdf" data = zf.read(inner) size_mb = len(data) / (1024 * 1024) try: if ext in (".doc", ".docx"): src_path = f"{BOT_TEMP}{job_id}{ext}" _write_bytes(src_path, data) try: _convert_doc_to_pdf(src_path, file_path) finally: _safe_remove(src_path) pages = _read_and_count_pdf(file_path) else: _write_bytes(file_path, data) pages = _count_pdf_pages(data) # авторизация по порогу — как в обычном submit (кроме verified) if not verified and (size_mb > AUTH_REQUIRED_MB or pages > AUTH_REQUIRED_PAGES): _safe_remove(file_path) continue _finalize_submit( job_id, file_path, base, settings.get("stitching", "без сшивки"), settings.get("title", 0), settings.get("numeration", 0), settings.get("flip_side", 0), settings.get("color", "color"), settings.get("pdfa", 0), settings.get("quality", "high"), size_mb, pages, user_id, trusted=True, ocr=settings.get("ocr", 0), web_owner_id=user_id, ) created.append({"job_id": job_id, "name": base}) except Exception as exc: print(f"zip entry '{inner}' failed: {exc}") _safe_remove(file_path) finally: _safe_remove(part_path) return created @app.post("/api/submit-zip-chunked") async def submit_zip_chunked( upload_id: str = Form(...), total_size: int = Form(0), stitching: str = Form("без сшивки"), title: int = Form(0), numeration: int = Form(0), flip_side: int = Form(0), color: str = Form("color"), pdfa: int = Form(0), quality: str = Form("high"), ocr: int = Form(0), user_id: int = Form(0), ): """Финализация загруженного ZIP: распаковать и поставить вложенные файлы в очередь.""" part_path = _chunk_part_path(upload_id) if not part_path or not os.path.exists(part_path): raise HTTPException(status_code=404, detail="Загрузка не найдена") actual = os.path.getsize(part_path) if total_size and actual != total_size: _safe_remove(part_path) raise HTTPException(status_code=400, detail=f"Размер не совпал ({actual} != {total_size})") settings = { "stitching": stitching, "title": title, "numeration": numeration, "flip_side": flip_side, "color": color, "pdfa": pdfa, "quality": quality, "ocr": ocr, } created = await asyncio.to_thread(_unpack_zip_and_enqueue, part_path, settings, user_id) if not created: raise HTTPException(status_code=400, detail="В архиве нет подходящих файлов (PDF/DOC/DOCX) или превышен лимит/порог авторизации.") return {"jobs": created} # ══════════════════════════════════════════════════════════════════════════════ # Платежи ЮKassa — /api/pay/*, вебхук # ══════════════════════════════════════════════════════════════════════════════ import base64 as _b64 import json as _pjson import urllib.request as _urlreq import urllib.error as _urlerr def _yk_auth_header() -> str: raw = f"{YOOKASSA_SHOP_ID}:{YOOKASSA_SECRET_KEY}".encode() return "Basic " + _b64.b64encode(raw).decode() def _yk_request(method: str, path: str, body: dict | None = None, idempotence_key: str | None = None) -> dict: """Синхронный вызов API ЮKassa (stdlib urllib). Вызывать через asyncio.to_thread.""" data = _pjson.dumps(body).encode() if body is not None else None req = _urlreq.Request(f"{YOOKASSA_API}{path}", data=data, method=method) req.add_header("Authorization", _yk_auth_header()) req.add_header("Content-Type", "application/json") if idempotence_key: req.add_header("Idempotence-Key", idempotence_key) try: with _urlreq.urlopen(req, timeout=25) as resp: return _pjson.loads(resp.read().decode()) except _urlerr.HTTPError as e: raise HTTPException(status_code=502, detail=f"ЮKassa {e.code}: {e.read().decode(errors='ignore')[:300]}") except Exception as e: raise HTTPException(status_code=502, detail=f"ЮKassa недоступна: {e}") def _db_record_payment(payment_id, amount, currency, status, purpose, api_key, email): """Пишет/обновляет платёж, сохраняя paid_at и email при повторной записи из вебхука.""" try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_PAYMENTS (payment_id, amount, currency, status, purpose, api_key, email, created_at, paid_at) " "VALUES (?,?,?,?,?,?,?,?,0) " "ON CONFLICT(payment_id) DO UPDATE SET status=excluded.status, " "email=COALESCE(NULLIF(excluded.email,''), WEB_PAYMENTS.email)", (payment_id, amount, currency, status, purpose, api_key, email, time.time()), ) con.commit() except Exception as e: print(f"record payment error: {e}") def _account_id(user_id) -> str | None: """Внутренний id аккаунта из Telegram user_id.""" try: uid = int(user_id or 0) except (TypeError, ValueError): uid = 0 return f"tg:{uid}" if uid else None def _resolve_account(request, user_id=0) -> str | None: """Аккаунт запроса: сначала cookie-сессия (Yandex/VK), иначе tg:.""" try: sess = _db_get_session(request.cookies.get(SESSION_COOKIE)) if request else None except Exception: sess = None if sess and sess.get("account_id"): return sess["account_id"] return _account_id(user_id) def _db_sub_until(account_id: str | None) -> float: """Время окончания подписки (unix) или 0.""" if not account_id: return 0.0 try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.execute("SELECT sub_until FROM WEB_ACCOUNTS WHERE account_id=?", (account_id,)) row = cur.fetchone() return float(row[0] or 0) if row else 0.0 except Exception: return 0.0 def _db_sub_active(account_id: str | None) -> bool: return _db_sub_until(account_id) > time.time() def _db_activate_sub(account_id: str, days: int): if not account_id: return with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.execute("SELECT sub_until FROM WEB_ACCOUNTS WHERE account_id=?", (account_id,)) row = cur.fetchone() base = max(time.time(), (row[0] or 0)) if row else time.time() until = base + days * 86400 con.execute( "INSERT INTO WEB_ACCOUNTS (account_id, sub_until, created_at) VALUES (?,?,?) " "ON CONFLICT(account_id) DO UPDATE SET sub_until=excluded.sub_until", (account_id, until, time.time()), ) con.commit() def _db_set_autorenew(account_id, pm_id, email): """Сохранить способ оплаты ЮKassa и включить автопродление для аккаунта.""" if not account_id or not pm_id: return try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "UPDATE WEB_ACCOUNTS SET autorenew=1, pm_id=?, " "pm_email=COALESCE(NULLIF(?,''), pm_email), renew_fail=0 WHERE account_id=?", (pm_id, email or "", account_id)) con.commit() except Exception as e: print(f"set autorenew error: {e}") def _db_get_autorenew(account_id) -> dict: if not account_id: return {"autorenew": False, "has_method": False} try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.row_factory = sqlite3.Row row = con.execute("SELECT autorenew, pm_id FROM WEB_ACCOUNTS WHERE account_id=?", (account_id,)).fetchone() if not row: return {"autorenew": False, "has_method": False} return {"autorenew": bool(row["autorenew"]), "has_method": bool(row["pm_id"])} except Exception: return {"autorenew": False, "has_method": False} def _db_set_autorenew_flag(account_id, enable: bool) -> dict: """Вкл/выкл автопродление. Включить можно только при сохранённом способе оплаты.""" try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.row_factory = sqlite3.Row row = con.execute("SELECT autorenew, pm_id FROM WEB_ACCOUNTS WHERE account_id=?", (account_id,)).fetchone() if not row: return {"autorenew": False, "has_method": False} has_pm = bool(row["pm_id"]) if enable and not has_pm: return {"autorenew": bool(row["autorenew"]), "has_method": False} con.execute("UPDATE WEB_ACCOUNTS SET autorenew=? WHERE account_id=?", (1 if enable else 0, account_id)) con.commit() return {"autorenew": bool(enable), "has_method": has_pm} except Exception as e: print(f"toggle autorenew error: {e}") return {"autorenew": False, "has_method": False} def _db_mark_payment_paid(payment_id, purpose, api_key, extra=None, payment_method=None): """extra: metadata платежа (job_id для file, account_id для sub). payment_method: объект payment_method из ЮKassa (для сохранения при автопродлении).""" extra = extra or {} try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("UPDATE WEB_PAYMENTS SET status='succeeded', paid_at=? WHERE payment_id=?", (time.time(), payment_id)) if purpose == "api_pro" and api_key: cur = con.execute("SELECT paid_until FROM WEB_API_KEYS WHERE api_key=?", (api_key,)) row = cur.fetchone() base = max(time.time(), (row[0] or 0)) if row else time.time() until = base + API_PRO_DAYS * 86400 con.execute("UPDATE WEB_API_KEYS SET plan='business', paid_until=? WHERE api_key=?", (until, api_key)) con.commit() # Подписка → продлеваем аккаунт if purpose == "sub": acc = extra.get("account_id") if acc: _db_activate_sub(acc, SUB_DAYS) # Автопродление: пользователь согласился и способ оплаты сохранён if str(extra.get("autorenew")) in ("1", "true", "True") and \ payment_method and payment_method.get("saved") and payment_method.get("id"): _db_set_autorenew(acc, payment_method.get("id"), extra.get("email") or "") # И file, и sub: если платёж привязан к заданию — снимаем его с холда job_id = extra.get("job_id") if job_id and _db_get_url_res_f(job_id) == "awaiting_payment": _db_set_url_res_f(job_id, "-") except Exception as e: print(f"mark paid error: {e}") @app.post("/api/pay/create") async def pay_create(payload: dict, request: Request): """Создаёт платёж ЮKassa. body: {amount, purpose, email?, api_key?, job_id?, user_id?} → confirmation_url.""" if not YOOKASSA_SHOP_ID or not YOOKASSA_SECRET_KEY: raise HTTPException(status_code=503, detail="Приём платежей не настроен.") if not isinstance(payload, dict): raise HTTPException(status_code=400, detail="Bad payload") purpose = str(payload.get("purpose") or "donate")[:32] email = (payload.get("email") or "").strip()[:128] api_key = (payload.get("api_key") or "").strip()[:80] or None job_id = (payload.get("job_id") or "").strip()[:128] or None account_id = _resolve_account(request, payload.get("user_id")) autorenew = bool(payload.get("autorenew")) and purpose == "sub" if purpose == "api_pro": amount = API_PRO_PRICE_RUB description = "pdf2scan API — тариф Business (30 дней)" if api_key and not _db_get_api_key(api_key): raise HTTPException(status_code=400, detail="Неизвестный API-ключ") elif purpose == "file": amount = FILE_PRICE_RUB description = "Обработка файла pdf2scan" if not job_id or _db_get_url_res_f(job_id) != "awaiting_payment": raise HTTPException(status_code=400, detail="Задание для оплаты не найдено") elif purpose == "sub": amount = SUB_PRICE_RUB description = "Подписка pdf2scan (30 дней)" if not account_id: raise HTTPException(status_code=401, detail="Для подписки нужен вход в аккаунт") else: try: amount = round(float(payload.get("amount") or 0), 2) except (TypeError, ValueError): raise HTTPException(status_code=400, detail="Некорректная сумма") if amount < PAY_MIN_RUB or amount > PAY_MAX_RUB: raise HTTPException(status_code=400, detail=f"Сумма {PAY_MIN_RUB:.0f}–{PAY_MAX_RUB:.0f} ₽") description = "Поддержка проекта pdf2scan" value = f"{amount:.2f}" body = { "amount": {"value": value, "currency": "RUB"}, "capture": True, "confirmation": {"type": "redirect", "return_url": f"{SITE_BASE_URL}/?paid={purpose}"}, "description": description, "metadata": {"purpose": purpose, "api_key": api_key or "", "email": email, "job_id": job_id or "", "account_id": account_id or "", "autorenew": "1" if autorenew else ""}, } if autorenew: body["save_payment_method"] = True # сохранить способ оплаты для авто-списаний if email: # чек 54-ФЗ (нужна подключённая онлайн-касса в ЮKassa) body["receipt"] = { "customer": {"email": email}, "items": [{ "description": description[:128], "quantity": "1.00", "amount": {"value": value, "currency": "RUB"}, "vat_code": 1, "payment_mode": "full_payment", "payment_subject": "service", }], } result = await asyncio.to_thread(_yk_request, "POST", "/payments", body, secrets.token_hex(16)) pid = result.get("id") conf = (result.get("confirmation") or {}).get("confirmation_url") _db_record_payment(pid, amount, "RUB", result.get("status", "pending"), purpose, api_key, email) return {"payment_id": pid, "confirmation_url": conf, "status": result.get("status")} @app.post("/api/yookassa/webhook") async def yookassa_webhook(payload: dict): """Вебхук ЮKassa. Тело НЕ доверяем — перепроверяем платёж через API.""" obj = payload.get("object") if isinstance(payload, dict) else None pid = (obj or {}).get("id") if not pid: return {"ok": True} try: real = await asyncio.to_thread(_yk_request, "GET", f"/payments/{pid}", None, None) except Exception: return {"ok": True} status = real.get("status") meta = real.get("metadata") or {} purpose = meta.get("purpose") or "donate" api_key = meta.get("api_key") or None amount = float((real.get("amount") or {}).get("value") or 0) _db_record_payment(pid, amount, "RUB", status, purpose, api_key, meta.get("email") or "") if status == "succeeded": _db_mark_payment_paid(pid, purpose, api_key, extra=meta, payment_method=real.get("payment_method")) return {"ok": True} @app.get("/api/pay/status/{payment_id}") async def pay_status(payment_id: str): """Статус платежа. Если в БД ещё pending — активно перепроверяем через API ЮKassa и активируем (фоллбэк, когда вебхук не настроен/задержался).""" db_status, purpose, api_key = None, "donate", None try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.execute("SELECT status, purpose, api_key FROM WEB_PAYMENTS WHERE payment_id=?", (payment_id,)) row = cur.fetchone() if row: db_status, purpose, api_key = row[0], row[1], row[2] except Exception: pass if db_status == "succeeded": return {"status": "succeeded", "purpose": purpose} if not db_status: return {"status": "unknown"} try: real = await asyncio.to_thread(_yk_request, "GET", f"/payments/{payment_id}", None, None) status = real.get("status") if status and status != db_status: meta = real.get("metadata") or {} amount = float((real.get("amount") or {}).get("value") or 0) rp = meta.get("purpose") or purpose rk = meta.get("api_key") or api_key _db_record_payment(payment_id, amount, "RUB", status, rp, rk, meta.get("email") or "") if status == "succeeded": _db_mark_payment_paid(payment_id, rp, rk, extra=meta, payment_method=real.get("payment_method")) return {"status": status or db_status, "purpose": purpose} except Exception: return {"status": db_status, "purpose": purpose} @app.post("/api/paywall/check") async def paywall_check(payload: dict, request: Request): """Предпроверка пейволла БЕЗ загрузки файла. body: {size_mb?, pages?, user_id?}. Возвращает решение сервера, чтобы фронт показал пейволл сразу.""" if not isinstance(payload, dict): payload = {} try: size_mb = float(payload.get("size_mb") or 0) except (TypeError, ValueError): size_mb = 0.0 try: pages = int(payload.get("pages") or 0) except (TypeError, ValueError): pages = 0 account = _resolve_account(request, payload.get("user_id")) sub_active = _db_sub_active(account) over = size_mb > AUTH_REQUIRED_MB or pages > AUTH_REQUIRED_PAGES requires_payment = bool(PAYWALL_ENABLED and over and not sub_active) return { "paywall_enabled": bool(PAYWALL_ENABLED), "sub_active": sub_active, "requires_payment": requires_payment, "file_price": FILE_PRICE_RUB, "sub_price": SUB_PRICE_RUB, } # ── Авто-продление подписки (рекуррентные списания ЮKassa) ───────────────────── def _bump_renew_fail(account_id): try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("UPDATE WEB_ACCOUNTS SET renew_fail=renew_fail+1 WHERE account_id=?", (account_id,)) con.commit() except Exception: pass def _charge_renewal(acc_row: dict): """Рекуррентное списание за подписку по сохранённому способу оплаты (payment_method_id).""" account_id = acc_row["account_id"] # отметим попытку сразу, чтобы не долбить при ошибке (guard раз в 12ч) try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("UPDATE WEB_ACCOUNTS SET last_renew=? WHERE account_id=?", (time.time(), account_id)) con.commit() except Exception: pass value = f"{SUB_PRICE_RUB:.2f}" email = acc_row.get("pm_email") or "" body = { "amount": {"value": value, "currency": "RUB"}, "capture": True, "payment_method_id": acc_row["pm_id"], "description": "Подписка pdf2scan (автопродление, 30 дней)", "metadata": {"purpose": "sub", "account_id": account_id, "autorenew": "1", "renewal": "1", "email": email}, } if email: body["receipt"] = {"customer": {"email": email}, "items": [{ "description": "Подписка pdf2scan (30 дней)", "quantity": "1.00", "amount": {"value": value, "currency": "RUB"}, "vat_code": 1, "payment_mode": "full_payment", "payment_subject": "service"}]} # идемпотентность по периоду подписки — защита от двойного списания при повторе цикла idem = hashlib.sha256(f"renew:{account_id}:{int(acc_row.get('sub_until') or 0)}".encode()).hexdigest() try: real = _yk_request("POST", "/payments", body, idem) except Exception as e: print(f"renew charge error {account_id}: {e}") _bump_renew_fail(account_id) return pid, status = real.get("id"), real.get("status") _db_record_payment(pid, SUB_PRICE_RUB, "RUB", status or "pending", "sub", None, email) if status == "succeeded": _db_mark_payment_paid(pid, "sub", None, extra=real.get("metadata") or {}, payment_method=real.get("payment_method")) try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("UPDATE WEB_ACCOUNTS SET renew_fail=0 WHERE account_id=?", (account_id,)) con.commit() except Exception: pass print(f"autorenew OK: {account_id}") elif status == "canceled": _bump_renew_fail(account_id) print(f"autorenew canceled: {account_id}") # status pending → активацию довершит вебхук успешного платежа def _run_autorenew_once(): if not (YOOKASSA_SHOP_ID and YOOKASSA_SECRET_KEY): return now = time.time() with sqlite3.connect(DB_PATH, timeout=15) as con: con.row_factory = sqlite3.Row rows = [dict(r) for r in con.execute( "SELECT account_id, sub_until, pm_id, pm_email, renew_fail, last_renew FROM WEB_ACCOUNTS " "WHERE autorenew=1 AND pm_id IS NOT NULL AND pm_id != '' " "AND sub_until < ? AND sub_until > ? AND renew_fail < 3 AND COALESCE(last_renew,0) < ?", (now + 2 * 86400, now - 3 * 86400, now - 12 * 3600))] for r in rows: try: _charge_renewal(r) except Exception as e: print(f"autorenew row error: {e}") def _autorenew_loop(): """Фоновый цикл: раз в 6ч списывает подписку у аккаунтов с автопродлением, у которых срок истекает в ближайшие 2 дня. Списание ДО истечения — без разрыва.""" time.sleep(120) # дать приложению прогреться while True: try: _run_autorenew_once() except Exception as e: print(f"autorenew loop error: {e}") time.sleep(6 * 3600) # ══════════════════════════════════════════════════════════════════════════════ # Аккаунты, сессии, OAuth-вход (Yandex ID) # ══════════════════════════════════════════════════════════════════════════════ import urllib.parse as _urlparse def _db_ensure_account(account_id: str): try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("INSERT OR IGNORE INTO WEB_ACCOUNTS (account_id, sub_until, created_at) VALUES (?,0,?)", (account_id, time.time())) con.commit() except Exception: pass def _db_create_session(account_id, provider, name, email) -> str: token = secrets.token_urlsafe(32) try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_SESSIONS (token, account_id, provider, name, email, created_at, expires_at) " "VALUES (?,?,?,?,?,?,?)", (token, account_id, provider, (name or "")[:128], (email or "")[:128], time.time(), time.time() + SESSION_DAYS * 86400), ) con.commit() except Exception as e: print(f"create session error: {e}") return token def _db_get_session(token: str): if not token: return None try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.execute( "SELECT account_id, provider, name, email, expires_at FROM WEB_SESSIONS WHERE token=?", (token,)) row = cur.fetchone() if not row or (row[4] or 0) < time.time(): return None return {"account_id": row[0], "provider": row[1], "name": row[2], "email": row[3]} except Exception: return None def _db_delete_session(token: str): try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute("DELETE FROM WEB_SESSIONS WHERE token=?", (token,)) con.commit() except Exception: pass def _yandex_token_exchange(code: str) -> str: data = _urlparse.urlencode({ "grant_type": "authorization_code", "code": code, "client_id": YANDEX_CLIENT_ID, "client_secret": YANDEX_CLIENT_SECRET, }).encode() req = _urlreq.Request("https://oauth.yandex.ru/token", data=data, method="POST") with _urlreq.urlopen(req, timeout=20) as resp: return _pjson.loads(resp.read().decode()).get("access_token", "") def _yandex_userinfo(access_token: str) -> dict: req = _urlreq.Request("https://login.yandex.ru/info?format=json") req.add_header("Authorization", f"OAuth {access_token}") with _urlreq.urlopen(req, timeout=20) as resp: return _pjson.loads(resp.read().decode()) @app.get("/api/auth/yandex/start") async def yandex_start(): if not YANDEX_CLIENT_ID: raise HTTPException(status_code=503, detail="Вход через Яндекс не настроен.") state = secrets.token_hex(16) url = ("https://oauth.yandex.ru/authorize?response_type=code" f"&client_id={YANDEX_CLIENT_ID}&redirect_uri={_urlparse.quote(YANDEX_REDIRECT, safe='')}" f"&state={state}") resp = RedirectResponse(url) resp.set_cookie("p2s_oauth_state", state, max_age=600, httponly=True, secure=True, samesite="lax", path="/") return resp @app.get("/api/auth/yandex/callback") async def yandex_callback(request: Request, code: str = "", state: str = ""): if not code: return RedirectResponse(f"{SITE_BASE_URL}/?login=error") if state and request.cookies.get("p2s_oauth_state") != state: return RedirectResponse(f"{SITE_BASE_URL}/?login=error") try: access = await asyncio.to_thread(_yandex_token_exchange, code) info = await asyncio.to_thread(_yandex_userinfo, access) except Exception as e: print(f"yandex oauth error: {e}") return RedirectResponse(f"{SITE_BASE_URL}/?login=error") yid = str(info.get("id") or "") if not yid: return RedirectResponse(f"{SITE_BASE_URL}/?login=error") email = info.get("default_email") or "" name = info.get("real_name") or info.get("first_name") or info.get("login") or "Yandex" account_id = f"yandex:{yid}" _db_ensure_account(account_id) token = _db_create_session(account_id, "yandex", name, email) resp = RedirectResponse(f"{SITE_BASE_URL}/?login=yandex") resp.set_cookie(SESSION_COOKIE, token, max_age=SESSION_DAYS * 86400, httponly=True, secure=True, samesite="lax", path="/") resp.delete_cookie("p2s_oauth_state", path="/") return resp def _verify_sub_token(token: str): """Проверяет подписанный deep-link из бота: '..'. Возвращает tgid (int) или None.""" if not SUB_LINK_SECRET or not token: return None try: tgid_s, exp_s, sig = token.split(".", 2) if float(exp_s) < time.time(): return None expect = hmac.new(SUB_LINK_SECRET.encode(), f"{tgid_s}.{exp_s}".encode(), hashlib.sha256).hexdigest() if not hmac.compare_digest(sig, expect): return None return int(tgid_s) except Exception: return None @app.get("/subscribe") async def subscribe_via_bot(request: Request, token: str = "", name: str = ""): """Deep-link из Telegram-бота: проверяем подпись, логиним как tg: (сессия), ведём на главную с авто-открытием окна оплаты подписки.""" tgid = _verify_sub_token(token) if not tgid: return RedirectResponse(f"{SITE_BASE_URL}/?login=error", status_code=302) account_id = f"tg:{tgid}" _db_ensure_account(account_id) sess = _db_create_session(account_id, "telegram", (name or "").strip()[:64] or "Telegram", "") resp = RedirectResponse(f"{SITE_BASE_URL}/?subscribe=1", status_code=302) resp.set_cookie(SESSION_COOKIE, sess, max_age=SESSION_DAYS * 86400, httponly=True, secure=True, samesite="lax", path="/") return resp def _verify_pay_link(tg, job, exp, sig): """Проверяет подписанную ссылку оплаты файла из бота (раздельные параметры).""" if not SUB_LINK_SECRET: return None try: if float(exp) < time.time(): return None expect = hmac.new(SUB_LINK_SECRET.encode(), f"{tg}:{exp}:{job}".encode(), hashlib.sha256).hexdigest() if not hmac.compare_digest(str(sig), expect): return None return int(tg) except Exception: return None @app.get("/pay") async def pay_held_file(request: Request, tg: str = "", job: str = "", exp: str = "", sig: str = "", name: str = ""): """Deep-link из бота на оплату придержанного файла: логиним tg: + открываем пейволл по job.""" tgid = _verify_pay_link(tg, job, exp, sig) if not tgid or not job: return RedirectResponse(f"{SITE_BASE_URL}/?login=error", status_code=302) account_id = f"tg:{tgid}" _db_ensure_account(account_id) sess = _db_create_session(account_id, "telegram", (name or "").strip()[:64] or "Telegram", "") resp = RedirectResponse(f"{SITE_BASE_URL}/?pay_job={_urlparse.quote(job)}", status_code=302) resp.set_cookie(SESSION_COOKIE, sess, max_age=SESSION_DAYS * 86400, httponly=True, secure=True, samesite="lax", path="/") return resp @app.post("/api/held/release") async def held_release(payload: dict, request: Request): """Освободить придержанный файл БЕЗ оплаты — только владельцу с активной подпиской.""" if not isinstance(payload, dict): payload = {} acc = _resolve_account(request, payload.get("user_id")) job_id = (payload.get("job_id") or "").strip()[:128] if not acc or not job_id: raise HTTPException(status_code=400, detail="bad request") if not _db_sub_active(acc): raise HTTPException(status_code=403, detail="Нет активной подписки") def _release(): with sqlite3.connect(DB_PATH, timeout=10) as con: row = con.execute("SELECT user_id, url_res_f FROM FILES WHERE name_or_f=?", (job_id,)).fetchone() if not row: return False uid_owner, urf = row if (urf or "").strip() != "awaiting_payment": return False if acc.startswith("tg:") and str(uid_owner) != acc.split(":", 1)[1]: return False con.execute("UPDATE FILES SET url_res_f='-' WHERE name_or_f=?", (job_id,)) con.commit() return True ok = await asyncio.to_thread(_release) return {"released": bool(ok)} @app.get("/api/me") async def me(request: Request): sess = _db_get_session(request.cookies.get(SESSION_COOKIE)) if not sess: return {"logged_in": False} return {"logged_in": True, "provider": sess["provider"], "name": sess["name"], "email": sess["email"], "sub_active": _db_sub_active(sess["account_id"])} @app.get("/api/subscription") async def subscription_status(request: Request, user_id: int = 0): """Статус подписки для текущего входа: cookie-сессия (Yandex/VK) ИЛИ Telegram user_id.""" acc = _resolve_account(request, user_id) until = _db_sub_until(acc) ar = _db_get_autorenew(acc) return {"active": until > time.time(), "until": until, "price": SUB_PRICE_RUB, "paywall_enabled": PAYWALL_ENABLED, "autorenew": ar["autorenew"], "has_method": ar["has_method"]} @app.post("/api/subscription/autorenew") async def subscription_autorenew(payload: dict, request: Request): """Вкл/выкл автопродление. body: {enable: bool, user_id?}.""" if not isinstance(payload, dict): payload = {} acc = _resolve_account(request, payload.get("user_id")) if not acc: raise HTTPException(status_code=401, detail="Нужен вход в аккаунт") res = await asyncio.to_thread(_db_set_autorenew_flag, acc, bool(payload.get("enable"))) return res @app.post("/api/auth/logout") async def auth_logout(request: Request): _db_delete_session(request.cookies.get(SESSION_COOKIE)) resp = JSONResponse({"ok": True}) resp.delete_cookie(SESSION_COOKIE, path="/") return resp # ── OAuth: VK ID (OAuth 2.1 + PKCE) ─────────────────────────────────────────── def _pkce_pair(): verifier = secrets.token_urlsafe(48) # 43–128 символов challenge = _b64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode() return verifier, challenge def _vk_token_exchange(code: str, verifier: str, device_id: str) -> dict: data = _urlparse.urlencode({ "grant_type": "authorization_code", "code": code, "code_verifier": verifier, "client_id": VK_CLIENT_ID, "device_id": device_id, "redirect_uri": VK_REDIRECT, }).encode() req = _urlreq.Request("https://id.vk.com/oauth2/auth", data=data, method="POST") req.add_header("Content-Type", "application/x-www-form-urlencoded") with _urlreq.urlopen(req, timeout=20) as resp: return _pjson.loads(resp.read().decode()) def _vk_userinfo(access_token: str) -> dict: data = _urlparse.urlencode({"access_token": access_token, "client_id": VK_CLIENT_ID}).encode() req = _urlreq.Request("https://id.vk.com/oauth2/user_info", data=data, method="POST") req.add_header("Content-Type", "application/x-www-form-urlencoded") with _urlreq.urlopen(req, timeout=20) as resp: return _pjson.loads(resp.read().decode()) @app.get("/api/auth/vk/start") async def vk_start(): if not VK_CLIENT_ID: raise HTTPException(status_code=503, detail="Вход через VK не настроен.") state = secrets.token_hex(16) verifier, challenge = _pkce_pair() url = ("https://id.vk.com/authorize?response_type=code" f"&client_id={VK_CLIENT_ID}&redirect_uri={_urlparse.quote(VK_REDIRECT, safe='')}" f"&state={state}&code_challenge={challenge}&code_challenge_method=S256&scope=email") resp = RedirectResponse(url) resp.set_cookie("p2s_vk_state", state, max_age=600, httponly=True, secure=True, samesite="lax", path="/") resp.set_cookie("p2s_vk_verifier", verifier, max_age=600, httponly=True, secure=True, samesite="lax", path="/") return resp @app.get("/api/auth/vk/callback") async def vk_callback(request: Request, code: str = "", state: str = "", device_id: str = ""): if not code: return RedirectResponse(f"{SITE_BASE_URL}/?login=error") if state and request.cookies.get("p2s_vk_state") != state: return RedirectResponse(f"{SITE_BASE_URL}/?login=error") verifier = request.cookies.get("p2s_vk_verifier") or "" try: tok = await asyncio.to_thread(_vk_token_exchange, code, verifier, device_id) access = tok.get("access_token") vk_uid = str(tok.get("user_id") or "") email = tok.get("email") or "" info = await asyncio.to_thread(_vk_userinfo, access) if access else {} except Exception as e: print(f"vk oauth error: {e}") return RedirectResponse(f"{SITE_BASE_URL}/?login=error") user = (info.get("user") or {}) if isinstance(info, dict) else {} if not vk_uid: vk_uid = str(user.get("user_id") or "") if not vk_uid: return RedirectResponse(f"{SITE_BASE_URL}/?login=error") email = email or user.get("email") or "" name = ((user.get("first_name") or "") + " " + (user.get("last_name") or "")).strip() or "VK" account_id = f"vk:{vk_uid}" _db_ensure_account(account_id) token = _db_create_session(account_id, "vk", name, email) resp = RedirectResponse(f"{SITE_BASE_URL}/?login=vk") resp.set_cookie(SESSION_COOKIE, token, max_age=SESSION_DAYS * 86400, httponly=True, secure=True, samesite="lax", path="/") resp.delete_cookie("p2s_vk_state", path="/") resp.delete_cookie("p2s_vk_verifier", path="/") return resp # ── Вход по почте (magic-code) ──────────────────────────────────────────────── import smtplib as _smtplib import ssl as _ssl from email.mime.text import MIMEText as _MIMEText _EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$") _email_rate: dict = {} # email → ts последней отправки (rate-limit) def _send_email(to: str, subject: str, body: str): if not (SMTP_HOST and SMTP_USER and SMTP_PASS): raise RuntimeError("SMTP не настроен") msg = _MIMEText(body, "plain", "utf-8") msg["Subject"] = subject msg["From"] = SMTP_FROM msg["To"] = to ctx = _ssl.create_default_context() if SMTP_PORT == 465: with _smtplib.SMTP_SSL(SMTP_HOST, SMTP_PORT, context=ctx, timeout=20) as s: s.login(SMTP_USER, SMTP_PASS) s.sendmail(SMTP_FROM, [to], msg.as_string()) else: with _smtplib.SMTP(SMTP_HOST, SMTP_PORT, timeout=20) as s: s.starttls(context=ctx) s.login(SMTP_USER, SMTP_PASS) s.sendmail(SMTP_FROM, [to], msg.as_string()) @app.post("/api/auth/email/start") async def email_start(payload: dict): if not (SMTP_HOST and SMTP_USER): raise HTTPException(status_code=503, detail="Вход по почте не настроен.") email = (payload.get("email") or "").strip().lower()[:128] if isinstance(payload, dict) else "" if not _EMAIL_RE.match(email): raise HTTPException(status_code=400, detail="Некорректный email") now = time.time() if now - _email_rate.get(email, 0) < 60: raise HTTPException(status_code=429, detail="Код уже отправлен, подождите минуту.") code = f"{secrets.randbelow(1000000):06d}" try: with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_EMAIL_CODES (email, code, created_at, attempts) VALUES (?,?,?,0) " "ON CONFLICT(email) DO UPDATE SET code=excluded.code, created_at=excluded.created_at, attempts=0", (email, code, now)) con.commit() except Exception: raise HTTPException(status_code=500, detail="Ошибка БД") try: await asyncio.to_thread( _send_email, email, "Код входа pdf2scan", f"Ваш код для входа на pdf2scan.online: {code}\n\nКод действует 10 минут.\nЕсли вы не запрашивали вход — проигнорируйте письмо.") except Exception as e: print(f"email send error: {e}") raise HTTPException(status_code=502, detail="Не удалось отправить письмо. Попробуйте позже.") _email_rate[email] = now return {"ok": True} @app.post("/api/auth/email/verify") async def email_verify(payload: dict): email = (payload.get("email") or "").strip().lower()[:128] if isinstance(payload, dict) else "" code = (payload.get("code") or "").strip()[:6] if not _EMAIL_RE.match(email) or not code.isdigit(): raise HTTPException(status_code=400, detail="Некорректные данные") try: with sqlite3.connect(DB_PATH, timeout=10) as con: cur = con.execute("SELECT code, created_at, attempts FROM WEB_EMAIL_CODES WHERE email=?", (email,)) row = cur.fetchone() if not row: raise HTTPException(status_code=400, detail="Код не найден. Запросите новый.") saved, created, attempts = row if time.time() - (created or 0) > EMAIL_CODE_TTL: raise HTTPException(status_code=400, detail="Код истёк. Запросите новый.") if (attempts or 0) >= 5: raise HTTPException(status_code=429, detail="Слишком много попыток. Запросите новый код.") if code != saved: con.execute("UPDATE WEB_EMAIL_CODES SET attempts=attempts+1 WHERE email=?", (email,)) con.commit() raise HTTPException(status_code=400, detail="Неверный код") con.execute("DELETE FROM WEB_EMAIL_CODES WHERE email=?", (email,)) con.commit() except HTTPException: raise except Exception: raise HTTPException(status_code=500, detail="Ошибка БД") account_id = f"email:{email}" _db_ensure_account(account_id) token = _db_create_session(account_id, "email", email.split("@")[0], email) resp = JSONResponse({"ok": True}) resp.set_cookie(SESSION_COOKIE, token, max_age=SESSION_DAYS * 86400, httponly=True, secure=True, samesite="lax", path="/") return resp _API_DOCS_HTML = """ pdf2scan API — scan effect PDF API for business
← pdf2scan.online

pdf2scan API

REST · JSON · for business

Программно превращайте PDF и Word в «скан»: эффект сканирования, сшивка, нумерация, титульный лист, PDF/A. Идеально для юрфирм, бухгалтерий, документооборота и тендерных отделов.

Programmatically turn PDF/Word into scanned documents — scan effect, binding, numbering, PDF/A. Built for integrations.

Базовый URL / Base URL: https://pdf2scan.online/api/v1
Аутентификация: заголовок Authorization: Bearer <api_key> или X-API-Key: <api_key>
Лимит: 60 запросов/мин на ключ (пробный тариф).

1. Получить ключ / Get an API key

Ключи привязаны к Telegram-аккаунту. Пока сервис бесплатный (тарифы и оплату добавим позже).

Либо напишите @berkio — выдадим ключ вручную.

Тариф / Plan

Free — 60 запросов/мин, для проб.   Business — 300 запросов/мин, приоритет, крупные файлы.

{{PRO_PRICE}} ₽ / 30 дней. Оплата картой через ЮKassa (чек на email).



2. Отправить файл / Submit a file

POST/api/v1/scan  — multipart/form-data

ПолеТипПо умолчаниюОписание
filefile—PDF / DOC / DOCX
stitchingstringбез сшивкинитка · ленточка · уголок · пружинка · дырокол · без сшивки
colorstringcolorcolor или bw
qualitystringhighhigh (300 DPI) · medium (250) · low (200)
numeration0/10нумерация страниц
title0/10титульный лист
flip_side0/10лист «прошито-пронумеровано»
pdfa0/10формат PDF/A

Пример / Example

curl -X POST https://pdf2scan.online/api/v1/scan \\
  -H "Authorization: Bearer sk_your_key_here" \\
  -F "file=@document.pdf" \\
  -F "stitching=нитка" \\
  -F "color=bw" \\
  -F "numeration=1" \\
  -F "pdfa=1"

Ответ / Response

{
  "job_id": "2026.07.02_12-40-11_document",
  "pages": 14,
  "status_url": "/api/v1/scan/2026.07.02_12-40-11_document",
  "download_url": "/api/v1/scan/2026.07.02_12-40-11_document/download"
}

3. Проверить статус / Check status

GET/api/v1/scan/{job_id}

curl https://pdf2scan.online/api/v1/scan/JOB_ID \\
  -H "Authorization: Bearer sk_your_key_here"

# { "status": "queued", "queue_pos": 3 }
# { "status": "processing", "queue_pos": 0 }
# { "status": "done", "download_url": "/api/v1/scan/JOB_ID/download" }

4. Скачать результат / Download result

GET/api/v1/scan/{job_id}/download  — возвращает PDF (готов ~6 часов).

curl -L https://pdf2scan.online/api/v1/scan/JOB_ID/download \\
  -H "Authorization: Bearer sk_your_key_here" \\
  -o scan.pdf

Коды ошибок / Errors

КодЗначение
401Нет ключа / ключ неверный или отключён
409Файл ещё не готов (проверьте статус)
413Файл слишком большой
429Превышен лимит запросов
pdf2scan.online · Главная · Вопросы по API — @berkio
""" _ADMIN_HTML = """ pdf2scan · админ

Админ-панель

Введите админ-токен

pdf2scan · админ

Активные подписки
—
Доход (успешно)
—
Заходы сегодня
—
Документов обработано
—

Активные подписки

АккаунтАктивна доОсталось

Заходы на сайт

Платежи

ДатаСуммаНазначениеСтатусEmail

Обработанные документы

ДатаФайлСтр.ИсходникРезультатКач-воСшивкаOCRИсточник
""" # ── Админ-панель ────────────────────────────────────────────────────────────── def _bump_visit(vid: str | None = None): """+1 к счётчику заходов за сегодня; vid — id браузера для подсчёта уникальных.""" try: day = datetime.datetime.now().strftime("%Y-%m-%d") with sqlite3.connect(DB_PATH, timeout=10) as con: con.execute( "INSERT INTO WEB_VISITS (day, count) VALUES (?, 1) " "ON CONFLICT(day) DO UPDATE SET count = count + 1", (day,), ) if vid: con.execute("INSERT OR IGNORE INTO WEB_VISIT_IDS (day, vid) VALUES (?, ?)", (day, vid)) con.commit() except Exception: pass @app.post("/api/hit") async def api_hit(request: Request): """Маячок посещения: JS вызывает раз в сессию браузера. Боты/health-check без JS не считаются. Cookie p2s_vid (2 года) даёт подсчёт уникальных посетителей.""" vid = request.cookies.get("p2s_vid") or "" new_vid = False if len(vid) < 8: vid = secrets.token_urlsafe(12) new_vid = True await asyncio.to_thread(_bump_visit, vid) resp = JSONResponse({"ok": True}) if new_vid: resp.set_cookie("p2s_vid", vid, max_age=60 * 60 * 24 * 730, httponly=True, secure=True, samesite="lax", path="/") return resp def _require_admin(request: Request) -> bool: if not ADMIN_TOKEN: return False tok = request.headers.get("X-Admin-Token") or request.query_params.get("token") or "" try: return hmac.compare_digest(str(tok), ADMIN_TOKEN) except Exception: return False def _admin_collect_stats() -> dict: now = time.time() out = {"generated_at": now, "web_user_id": WEB_USER_ID} with sqlite3.connect(DB_PATH, timeout=15) as con: con.row_factory = sqlite3.Row # Активные подписки subs = [dict(r) for r in con.execute( "SELECT account_id, sub_until FROM WEB_ACCOUNTS WHERE sub_until > ? ORDER BY sub_until DESC", (now,))] out["subs"] = {"active_count": len(subs), "list": subs[:300]} # Платежи pays = [dict(r) for r in con.execute( "SELECT payment_id, amount, currency, status, purpose, email, created_at, paid_at " "FROM WEB_PAYMENTS ORDER BY created_at DESC LIMIT 100")] srow = con.execute( "SELECT COUNT(*) c, COALESCE(SUM(amount),0) s FROM WEB_PAYMENTS WHERE status='succeeded'").fetchone() by_purpose = {r["purpose"]: {"count": r["c"], "sum": r["s"]} for r in con.execute( "SELECT purpose, COUNT(*) c, COALESCE(SUM(amount),0) s FROM WEB_PAYMENTS " "WHERE status='succeeded' GROUP BY purpose")} out["payments"] = {"recent": pays, "count_succeeded": srow["c"], "total_succeeded": srow["s"], "by_purpose": by_purpose} # Заходы + уникальные посетители days = [dict(r) for r in con.execute( "SELECT day, count FROM WEB_VISITS ORDER BY day DESC LIMIT 30")] udays = {r["day"]: r["u"] for r in con.execute( "SELECT day, COUNT(*) u FROM WEB_VISIT_IDS GROUP BY day")} for d in days: d["uniques"] = udays.get(d["day"], 0) today = datetime.datetime.now().strftime("%Y-%m-%d") today_c = next((d["count"] for d in days if d["day"] == today), 0) last7 = sum(d["count"] for d in days[:7]) total = con.execute("SELECT COALESCE(SUM(count),0) s FROM WEB_VISITS").fetchone()["s"] uniq_total = con.execute("SELECT COUNT(DISTINCT vid) c FROM WEB_VISIT_IDS").fetchone()["c"] uniq_today = udays.get(today, 0) uniq_last7 = sum(udays.get(d["day"], 0) for d in days[:7]) out["visits"] = {"today": today_c, "last7": last7, "total": total, "days": days, "unique_today": uniq_today, "unique_last7": uniq_last7, "unique_total": uniq_total} # Документы cols = {r[1] for r in con.execute("PRAGMA table_info(FILES)")} pages_expr = "COALESCE(NULLIF(pages_total,0), num_pages, 0)" if "pages_total" in cols else "COALESCE(num_pages,0)" docs = [dict(r) for r in con.execute( f"SELECT date, time, COALESCE(NULLIF(original_name,''), name_or_f) AS name, {pages_expr} AS pages, " "source_size_mb, result_size_mb, quality, stitching, ocr, user_id, url_res_f " "FROM FILES ORDER BY rowid DESC LIMIT 150")] agg = con.execute( f"SELECT COUNT(*) c, COALESCE(SUM({pages_expr}),0) p, " "COALESCE(SUM(source_size_mb),0) ssz, COALESCE(SUM(result_size_mb),0) rsz FROM FILES").fetchone() out["docs"] = {"recent": docs, "total_count": agg["c"], "total_pages": agg["p"], "total_source_mb": agg["ssz"], "total_result_mb": agg["rsz"]} return out @app.get("/api/admin/stats") async def admin_stats(request: Request): if not _require_admin(request): raise HTTPException(status_code=401, detail="unauthorized") return await asyncio.to_thread(_admin_collect_stats) def _build_docs_csv() -> bytes: import csv, io buf = io.StringIO() w = csv.writer(buf, delimiter=";") w.writerow(["Дата", "Время", "Файл", "Страниц", "Исходник, МБ", "Результат, МБ", "Качество", "Сшивка", "OCR", "Источник", "Статус"]) def _mb(v): return ("%.2f" % v) if v else "" with sqlite3.connect(DB_PATH, timeout=30) as con: con.row_factory = sqlite3.Row cols = {r[1] for r in con.execute("PRAGMA table_info(FILES)")} pages_expr = "COALESCE(NULLIF(pages_total,0), num_pages, 0)" if "pages_total" in cols else "COALESCE(num_pages,0)" for r in con.execute( f"SELECT date, time, COALESCE(NULLIF(original_name,''), name_or_f) AS name, {pages_expr} AS pages, " "source_size_mb, result_size_mb, quality, stitching, ocr, user_id, url_res_f FROM FILES ORDER BY rowid DESC"): src = "сайт" if (r["user_id"] == WEB_USER_ID) else "бот" w.writerow([r["date"] or "", (r["time"] or "")[:8], r["name"] or "", r["pages"] or "", _mb(r["source_size_mb"]), _mb(r["result_size_mb"]), r["quality"] or "", r["stitching"] or "", "да" if r["ocr"] else "", src, r["url_res_f"] or ""]) return ("" + buf.getvalue()).encode("utf-8") # BOM → кириллица в Excel @app.get("/api/admin/docs.csv") async def admin_docs_csv(request: Request): if not _require_admin(request): raise HTTPException(status_code=401, detail="unauthorized") data = await asyncio.to_thread(_build_docs_csv) return Response(content=data, media_type="text/csv; charset=utf-8", headers={"Content-Disposition": "attachment; filename=pdf2scan_documents.csv"}) @app.get("/admin", response_class=HTMLResponse) @app.get("/admin/", response_class=HTMLResponse) async def admin_page(): return _ADMIN_HTML @app.get("/developers", response_class=HTMLResponse) @app.get("/api-docs", response_class=HTMLResponse) async def developers_docs(): return _API_DOCS_HTML.replace("{{PRO_PRICE}}", str(int(API_PRO_PRICE_RUB)))