v2

2025-04-14 10:27:58 +03:00
parent f977d6b3d4
commit 7e798a7a83
55 changed files with 5625 additions and 353 deletions
--- a/backend/app.js
+++ b/backend/app.js
@@ -0,0 +1,96 @@
+const express = require('express')
+const bodyParser = require('body-parser')
+const cookieParser = require('cookie-parser')
+const crypto = require('crypto')
+const fs = require('fs')
+const util = require('util')
+const bot = require('./apps/bot')
+
+const app = express()
+
+app.use(bodyParser.json())
+app.use(cookieParser())
+
+BigInt.prototype.toJSON = function () {
+  return Number(this)
+}
+
+app.use((req, res, next) => {
+	if(!(req.body instanceof Object)) 
+		return next()
+
+	const escapeHtml = str => str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#039;')
+	Object
+		.keys(req.body || {})
+		.filter(key => typeof(req.body[key]) == 'string' && key != 'password')
+		.map(key => req.body[key] = escapeHtml(req.body[key]))
+
+	next()
+})
+
+// cors
+app.use((req, res, next) => {
+	res.set({
+		'Access-Control-Allow-Origin': '*',
+		'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE',
+		'Access-Control-Allow-Headers': 'Accept,Accept-Language,Content-Language,Content-Type,Authorization,Cookie,X-Requested-With,Origin,Host',
+		'Access-Control-Allow-Credentials': true
+	})
+
+	return req.method == 'OPTIONS' ? res.status(200).json({success: true}) : next()
+})
+
+app.post('(/api/admin/customer/login|/api/miniapp/user/login)', (req, res, next) => {
+	const data = Object.assign({}, req.query)
+	delete data.hash
+	const hash = req.query?.hash
+	
+	const BOT_TOKEN = '7236504417:AAGVaodw3cRwGlf-jAhwnYb51OHaXcgpW8k'
+	const dataCheckString = Object.keys(data).sort().map((key) => `${key}=${data[key]}`).join("\n")
+	const secretKey = crypto.createHmac("sha256", "WebAppData").update(BOT_TOKEN).digest()
+	const hmac = crypto.createHmac("sha256", secretKey).update(dataCheckString).digest("hex")
+
+	const timeDiff = Date.now() / 1000 - data.auth_date
+
+	if (hmac !== req.query.hash) // || timeDiff > 10) 
+		throw Error('ACCESS_DENIED::401')
+
+	const user = JSON.parse(req.query.user)
+	res.locals.telegram_id = user.id
+	res.locals.start_param = req.query.start_param
+
+	if (!res.locals.telegram_id) 
+		throw Error('ACCESS_DENIED::500')
+
+	next()
+})
+
+
+app.use('/api/admin', require('./apps/admin'))
+app.use('/api/miniapp', require('./apps/miniapp'))
+
+app.use((err, req, res, next) => {
+	console.error(`Error for ${req.path}: ${err}`)
+
+	let message, code
+	//if (err.code == 'SQLITE_ERROR' || err.code == 'SQLITE_CONSTRAINT_CHECK') {
+	//	message = 'DATABASE_ERROR'
+		//code = err.code == 'SQLITE_CONSTRAINT_CHECK' ? 400 : 500
+	//} else {
+		[message, code = 500] = err.message.split('::')
+	//}
+		
+	res.status(res.statusCode == 200 ? 500 : res.statusCode).json({success: false, error: { message, code}})
+})
+
+app.use(express.static('public'))
+
+const PORT = process.env.PORT || 3000
+app.listen(PORT, async () => {
+	console.log(`Listening at port ${PORT}`)
+	bot.start(
+		process.env.API_ID || 26746106,
+		process.env.API_HASH || '29e5f83c04e635fa583721473a6003b5',
+		process.env.BOT_TOKEN || '7236504417:AAGVaodw3cRwGlf-jAhwnYb51OHaXcgpW8k'
+	)
+})
--- a/backend/apps/admin.js
+++ b/backend/apps/admin.js
@@ -0,0 +1,496 @@
+const crypto = require('crypto')
+const express = require('express')
+const multer = require('multer')
+const db = require('../include/db')
+const bot = require('./bot')
+const fs = require('fs')
+const cookieParser = require('cookie-parser')
+
+const app = express.Router()
+const upload = multer({
+	storage: multer.memoryStorage(),
+	limits: {
+		fileSize: 1_000_000  // 1mb
+	}
+})
+
+const sessions = {}
+
+app.use((req, res, next) => {
+	if (req.path == '/customer/login' || 
+		req.path == '/customer/register' || 
+		req.path == '/customer/activate')
+		return next()
+
+	const asid = req.query.asid || req.cookies.asid
+	req.session = sessions[asid]
+	if (!req.session) 
+		throw Error('ACCESS_DENIED::401')
+
+	res.locals.customer_id = req.session.customer_id
+	next()
+})
+
+// CUSTOMER
+app.post('/customer/login', (req, res, next) => {
+	res.locals.email = req.body?.email
+	res.locals.password = req.body?.password
+	 
+	let customer_id = db
+		.prepare(`
+			select id
+			  from customers 
+			 where is_active = 1 and (
+				email is not null and email = :email and password is not null and password = :password or
+				email is null and password is null and telegram_user_id = :telegram_id
+			)
+		`)
+		.pluck(true)
+		.get(res.locals)
+
+	if (!customer_id && !res.locals.email && !res.locals.password) {
+		customer_id = db
+			.prepare(`insert into customers (telegram_user_id, is_active) values (:telegram_id, 1) returning id`)
+			.safeIntegers(true)
+			.pluck(true)
+			.get(res.locals)		
+	}
+
+	if (!customer_id) 
+		throw Error('AUTH_ERROR::401')
+
+	res.locals.customer_id = customer_id
+	db
+		.prepare(`update customers set telegram_user_id = :telegram_id where id = :customer_id and email is not null`)
+		.run(res.locals)
+						
+	const asid = crypto.randomBytes(64).toString('hex')
+	req.session = sessions[asid] = {asid, customer_id }
+	res.setHeader('Set-Cookie', [`asid=${asid};httpOnly;path=/api/admin`])
+
+	res.status(200).json({success: true})
+})
+
+app.get('/customer/logout', (req, res, next) => {
+	delete sessions[req.session.asid]
+	res.setHeader('Set-Cookie', [`asid=; expired; httpOnly`])
+	res.status(200).json({success: true})
+})
+
+app.post('/customer/register', (req, res, next) => {
+	const email = String(req.body.email).trim()
+	const password = String(req.body.password).trim()
+
+	const validateEmail = email => String(email).toLowerCase().match(/^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/)
+	if (!validateEmail(email)) 
+		throw Error('INCORRECT_EMAIL::400')
+
+	if (!password)
+		throw Error('EMPTY_PASSWORD::400')
+
+	const row = db
+		.prepare('select id from customers where email = :email')
+		.run({email}) 
+	if (row) 
+		throw Error('DUPLICATE_EMAIL::400')
+
+	const key = crypto.randomBytes(32).toString('hex')
+	const info = db
+		.prepare('insert into customers (email, password, activation_key) values (:email, :password, :key)')
+		.run({email, password, key}) 
+
+	// To-Do: SEND MAIL
+	console.log(`http://127.0.0.1:3000/api/customer/activate?key=${key}`)
+	res.status(200).json({success: true, data: key})			
+})
+
+app.get('/customer/activate', (req, res, next) => {
+	const row = db
+		.prepare('update customers set is_active = 1 where activation_key = :key returning id')
+		.get({key: req.query.key})
+
+	if (!row || !row.id)	
+		throw Error('BAD_ACTIVATION_KEY::400')
+
+	res.status(200).json({success: true})	
+})
+
+app.get('/customer/profile', (req, res, next) => {
+	const row = db
+		.prepare(`
+			select id, name, email, plan, coalesce(json_balance, '{}') json_balance, coalesce(json_company, '{}') json_company, upload_group_id 
+			from customers 
+			where id = :customer_id and is_active = 1
+		`)
+		.get(res.locals) 
+
+	if (row?.upload_group_id) {
+		row.upload_group = db
+			.prepare(`select id, name, telegram_id from groups where id = :group_id and project_id is null`)
+			.safeIntegers(true)
+			.get({ group_id: row.upload_group_id})  
+		delete row.upload_group_id
+	}
+
+	for (const key in row) {
+		if (key.startsWith('json_')) {
+			row[key.substr(5)] = JSON.parse(row[key])
+			delete row[key]
+		}
+	}
+	
+	res.status(200).json({success: true, data: row})
+})
+
+app.put('/customer/profile', (req, res, next) => {
+	if (req.body.company instanceof Object) 
+		req.body.json_company = JSON.stringify(req.body.company) 
+
+	const info = db
+		.prepareUpdate(
+			'customers', 
+			['name', 'password', 'json_company'], 
+			req.body, 
+			['id'])
+		.run(Object.assign({}, req.body, {id: req.session.customer_id}))
+	
+	if (info.changes == 0) 
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true})
+})
+
+// PROJECT
+app.get('/project', (req, res, next) => {
+	const where = req.query.id ? ' and id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select id, name, description, logo 
+			  from projects 
+			 where customer_id = :customer_id ${where} and is_deleted <> 1
+			 order by name
+		`)
+		.all(res.locals)
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project?id=${req.params.pid}`)
+})
+
+app.post('/project', (req, res, next) => {
+	res.locals.name = req.body?.name
+	res.locals.description = req.body?.description
+	res.locals.logo = req.body?.logo
+
+	const id = db
+		.prepare(`
+			insert into projects (customer_id, name, description, logo) 
+			values (:customer_id, :name, :description, :logo) 
+			returning id
+		`)
+		.pluck(true)
+		.get(res.locals)
+
+	res.status(200).json({success: true, data: id})
+})
+
+app.put('/project/:pid(\\d+)', (req, res, next) => {
+	res.locals.id = req.params.pid
+	res.locals.name = req.body?.name
+	res.locals.description = req.body?.description
+	res.locals.logo = req.body?.logo
+
+	const info = db
+		.prepareUpdate(
+			'projects', 
+			['name', 'description', 'logo'], 
+			res.locals, 
+			['id', 'customer_id'])
+		.run(res.locals)
+	
+	if (info.changes == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true})
+})
+
+app.delete('/project/:pid(\\d+)', async (req, res, next) => {
+	res.locals.id = req.params.pid
+
+	const info = db
+		.prepare('update projects set id_deleted = 1 where id = :id and customer_id = :customer_id')
+		.run(res.locals)
+
+	if (info.changes == 0)
+		throw Error('NOT_FOUND::404')
+
+	const groupIds = db
+		.prepare(`select id from groups where project_id = :id`)
+		.pluck(true)
+		.all(res.locals)
+
+	for (const groupId of groupIds) {
+		await bot.sendMessage(groupId, 'Проект удален')
+		await bot.leaveGroup(groupId)
+	}
+	
+	db.prepare(`updates groups set project_id = null where id in (${ groupIds.join(', ')})`).run()
+
+	res.status(200).json({success: true})
+})
+
+app.use ('/project/:pid(\\d+)/*', (req, res, next) => {
+	res.locals.project_id = parseInt(req.params.pid) 
+
+	const row = db
+		.prepare('select 1 from projects where id = :project_id and customer_id = :customer_id and is_deleted <> 1')
+		.get(res.locals)
+
+	if (!row)
+		throw Error('ACCESS_DENIED::401')
+
+	next()
+})
+
+// USER
+app.get('/project/:pid(\\d+)/user', (req, res, next) => {
+	const where = req.query.id ? ' and id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select u.id, u.telegram_id, u.firstname, u.lastname, u.username, u.photo,
+			       ud.fullname, ud.role, ud.department, ud.is_blocked
+			  from users u
+			       left join user_details ud on u.id = ud.user_id and ud.project_id = :project_id
+			 where id in (
+				select user_id 
+				from group_users 
+				where group_id in (select id from groups where project_id = :project_id)
+				) ${where}
+		`)
+		.safeIntegers(true)
+		.all(res.locals) 
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)/user/:uid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/user?id=${req.params.uid}`)
+})
+
+app.put('/project/:pid(\\d+)/user/:uid(\\d+)', (req, res, next) => {
+	res.locals.user_id = parseInt(req.params.uid)
+	
+	res.locals.fullname = req.body?.fullname
+	res.locals.role = req.body?.role
+	res.locals.department = req.body?.department
+	res.locals.is_blocked = req.body?.is_blocked
+
+	const info = db
+		.prepareUpdate('user_details', 
+			['fullname', 'role', 'department', 'is_blocked'], 
+			res.locals, 
+			['user_id', 'project_id']
+		) 
+		.all(res.locals) 
+
+	if (info.changes == 0)
+		throw Error('NOT_FOUND::404')	
+	
+	res.status(200).json({success: true})
+})
+
+app.get('/project/:pid(\\d+)/token', (req, res, next) => {
+	res.locals.time = Math.floor(Date.now() / 1000)
+
+	const key = db
+		.prepare('select generate_key(id, :time) from projects where id = :project_id and customer_id = :customer_id')
+		.pluck(true)
+		.get(res.locals)
+
+	if (!key)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: key})		  
+})
+
+// COMPANY
+app.get('/project/:pid(\\d+)/company', (req, res, next) => {
+	const where = req.query.id ? ' and id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select id, name, email, phone, description, logo,
+			(select json_group_array(user_id) from company_users where company_id = c.id) users
+			from companies c 
+			where project_id = :project_id ${where}
+			order by name
+		`)
+		.all(res.locals)
+
+	rows.forEach(row => row.users = JSON.parse(row.users || '[]'))
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)/company/:cid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/company?id=${req.params.cid}`)
+})
+
+app.post('/project/:pid(\\d+)/company', (req, res, next) => {
+	res.locals.name = req.body?.name
+	res.locals.email = req.body?.email
+	res.locals.phone = req.body?.phone
+	res.locals.site = req.body?.site
+	res.locals.description = req.body?.description
+	res.locals.logo = req.body?.logo
+
+	const id = db
+		.prepare(`
+			insert into companies (project_id, name, email, phone, site, description, logo) 
+			values (:project_id, :name, :email, :phone, :site, :description, :logo) 
+			returning id
+		`)
+		.pluck(res.locals)
+		.get(res.locals)
+
+	res.status(200).json({success: true, data: id})
+})
+
+app.put('/project/:pid(\\d+)/company/:cid(\\d+)', (req, res, next) => {
+	res.locals.id = parseInt(req.params.cid)
+	res.locals.name = req.body?.name
+	res.locals.email = req.body?.email
+	res.locals.phone = req.body?.phone
+	res.locals.site = req.body?.site
+	res.locals.description = req.body?.description
+
+	const info = db
+		.prepareUpdate(
+			'companies', 
+			['name', 'email', 'phone', 'site', 'description'], 
+			res.locals, 
+			['id', 'project_id'])
+		.run(res.locals)
+	
+	if (info.changes == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true})
+})
+
+app.delete('/project/:pid(\\d+)/company/:cid(\\d+)', (req, res, next) => {
+	res.locals.company_id = parseInt(req.params.cid)
+
+	const info = db
+		.prepare(`delete from companies where id = :company_id and project_id = :project_id`)
+		.run(res.locals)	
+
+	if (info.changes == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true})
+})
+
+app.get('/project/:pid(\\d+)/group', (req, res, next) => {
+	const where = req.query.id ? ' and id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select  id, name, telegram_id, is_channel, user_count, bot_can_ban
+			from groups 
+			where project_id = :project_id ${where}
+		`)
+		.all(res.locals)
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)/group/:gid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/group?id=${req.params.uid}`)
+})
+
+app.delete('/project/:pid(\\d+)/group/:gid(\\d+)', async (req, res, next) => {
+	res.locals.group_id = parseInt(req.params.gid)	
+	const info = db
+		.prepare(`update groups set project_id = null where id = :group_id and project_id = :project_id`)
+		.run(res.locals)
+
+	if (info.changes == 0)
+		throw Error('NOT_FOUND::404')
+
+	await bot.sendMessage(res.locals.group_id, 'Группа удалена из проекта')
+
+	res.status(200).json({success: true})
+})
+
+app.put('/project/:pid(\\d+)/company/:cid(\\d+)/user', (req, res, next) => {
+	res.locals.company_id = parseInt(req.params.cid)
+
+	// Проверка, что есть доступ к компании
+	const row = db
+		.prepare('select 1 from companies where id = :company_id and project_id = :project_id')
+		.get(res.locals)
+
+	if (!row)	
+		throw Error('NOT_FOUND::404')
+
+	const user_ids = req.body instanceof Array ? [...new Set(req.body.map(e => parseInt(e)))] : []
+
+	// Проверка, что пользователи имеют доступ к проекту
+	let rows = db
+		.prepare(`
+			select user_id 
+			  from group_users 
+			 where group_id in (select id from groups where project_id = :project_id)
+		`)
+		.pluck(true) // .raw?
+		.get(res.locals)
+
+	if (user_ids.some(user_id => !rows.contains(user_id)))
+		throw Error('INACCESSABLE_MEMBER::400')
+
+	// Проверка, что пользователи не участвуют в других компаниях на проекте
+	rows = db
+		.prepare(`
+			select user_id 
+			  from company_users 
+			 where company_id in (select id from companies where id <> :company_id and project_id = :project_id)
+		`)
+		.pluck(true) // .raw?
+		.get(res.locals)
+
+	if (user_ids.some(user_id => !rows.contains(user_id)))
+		throw Error('USED_MEMBER::400')
+
+	
+	db
+		.prepare(`delete from company_users where company_id = :company_id`)
+		.run(res.locals)
+
+	db
+		.prepare(`
+			insert into company_users (company_id, user_id) 
+			select :company_id, value from json_each(:json_ids)
+		`)
+		.run(res.locals, {json_ids: JSON.stringify(user_ids)})
+
+	res.status(200).json({success: true})
+})
+
+module.exports = app
--- a/backend/apps/bot.js
+++ b/backend/apps/bot.js
@@ -0,0 +1,654 @@
+const util = require('util')
+const crypto = require('crypto')
+const EventEmitter = require('events')
+const fs = require('fs')
+const db = require('../include/db')
+
+const { Api, TelegramClient } = require('telegram')
+const { StringSession } = require('telegram/sessions')
+const { NewMessage } = require('telegram/events')
+const { Button } = require('telegram/tl/custom/button')
+const { CustomFile } = require('telegram/client/uploads')
+
+// const session = new StringSession('1AgAOMTQ5LjE1NC4xNjcuNTABuxdIxmjimA0hmWpdrlZ4Fo7uoIGU4Bu9+G5QprS6zdtyeMfcssWEZp0doLRX/20MomQyF4Opsos0El0Ifj5aiNgg01z8khMLMeT98jS+1U/sh32p3GxZfxyXSxX1bD0NLRaXnqVyNNswYqRZPhboT28NMjDqwlz0nrW9rge+QMJDL7jIkXgSs+cmJBINiqsEI8jWjXmc8TU/17gngtjUHRf5kRM4y5gsNC4O8cF5lcHRx0G/U5ZVihTID8ItQ6EdEHjz6e4XErbVOJ81PfYkqEoPXVvkEmRM0/VbvCzFfixfas4Vzczfn98OHLd8P2MXcgokZ2rppvIV3fQXOHxJbA0=')
+const session = new StringSession('')
+
+let client
+
+function registerUser (telegramId) {
+	db
+		.prepare(`insert or ignore into users (telegram_id) values (:telegram_id)`)
+		.safeIntegers(true)
+		.run({ telegram_id: telegramId })
+
+	return db
+		.prepare(`select id from users where telegram_id = :telegram_id`)
+		.safeIntegers(true)
+		.pluck(true)
+		.get({ telegram_id: telegramId })
+}
+
+function updateUser (userId, data) {
+	const info = db
+		.prepare(`
+			update users set firstname = :firstname, lastname = :lastname, username = :username, 
+			access_hash = :access_hash, language_code = :language_code where id = :user_id
+		`)
+		.safeIntegers(true)
+		.run({
+			user_id: userId,
+			firstname: data.firstName,
+			lastname: data.lastName,
+			username: data.username,
+			access_hash: data.accessHash.value,
+			language_code: data.langCode
+		})
+
+	return info.changes == 1
+}
+
+async function updateUserPhoto (userId, data) {
+	const photoId = data.photo?.photoId?.value
+	if (!photoId) 
+		return
+
+	const tgUserId = db
+		.prepare(`select telegram_id from users where id = :user_id and coalesce(photo_id, 0) <> :photo_id`)
+		.safeIntegers(true)
+		.pluck(true)
+		.get({user_id: userId, photo_id: photoId })
+
+	if (!tgUserId)
+		return
+
+	const photo = await client.invoke(new Api.photos.GetUserPhotos({
+		userId: new Api.PeerUser({ userId: tgUserId }),
+		maxId: photoId,
+		offset: -1,
+		limit: 1,
+	}));
+
+	const file = await client.downloadFile(new Api.InputPhotoFileLocation({
+		id: photoId,
+		accessHash: photo.photos[0]?.accessHash,
+		fileReference: Buffer.from('random'),
+		thumbSize: 'a',
+	}, {}))	
+
+	db
+		.prepare(`update users set photo_id = :photo_id, photo = :photo where id = :user_id`)
+		.safeIntegers(true)
+		.run({ user_id: userId, photo_id: photoId, photo: file.toString('base64') })
+}
+
+async function registerGroup (telegramId, isChannel) {
+	db
+		.prepare(`insert or ignore into groups (telegram_id, is_channel) values (:telegram_id, :is_channel)`)
+		.safeIntegers(true)
+		.run({ telegram_id: telegramId, is_channel: +isChannel })
+
+	const row = db
+		.prepare(`select id, name from groups where telegram_id = :telegram_id`)
+		.safeIntegers(true)
+		.get({telegram_id: telegramId}) 
+
+	if (!row?.name) {	
+		const entity = isChannel ? { channelId: telegramId } : { chatId: telegramId }
+		const group = await client.getEntity(isChannel ? new Api.PeerChannel(entity) : new Api.PeerChat(entity))
+
+		db
+			.prepare(`update groups set name = :name where id = :group_id`)
+			.run({ group_id: row.id, name: group.title })
+	}
+
+	return row.id
+}
+
+async function attachGroup(groupId, isChannel, projectId) {
+	const info = db
+		.prepare(`update groups set project_id = :project_id where id = :group_id and coalesce(project_id, 1) = 1`)
+		.run({ group_id: groupId, project_id: projectId })
+
+	if (info.changes == 1) {
+		const inputPeer = isChannel ?
+			new Api.InputPeerChannel({ channelId: tgGroupId }) :
+			new Api.InputPeerChat({ chatlId: tgGroupId })
+
+		const query = `select (select name from customers where id = p.customer_id) || ' >> ' || p.name from projects p where id = :project_id`
+		const message = db
+			.prepare(query)
+			.pluck(true)
+			.get({project_id: projectId})
+		if (message)
+			await client.sendMessage(inputPeer, {message})
+	}
+
+	return info.changes == 1
+}
+
+async function onGroupAttach (tgGroupId, isChannel) {
+	const projectId = db
+		.prepare(`select project_id from groups where telegram_id = :telegram_id`)
+		.safeIntegers(true)
+		.pluck(true)
+		.get({ telegram_id: tgGroupId })
+
+	const entity =  isChannel ? { channelId: tgGroupId } : { chatId: tgGroupId }
+	const inputPeer = await client.getEntity( isChannel ?
+		new Api.InputPeerChannel(entity) :
+		new Api.InputPeerChat(entity)
+	)
+		
+	const resultBtn = await client.sendMessage(inputPeer, {
+		message: 'ReadyOrNot',
+		buttons: client.buildReplyMarkup([[Button.url('Открыть проект', 'https://t.me/ready_or_not_2025_bot/userapp?startapp=user_' + projectId)]])
+	})
+
+	await client.invoke(new Api.messages.UpdatePinnedMessage({
+		peer: inputPeer,
+		id: resultBtn.id,
+		unpin: false
+	}))
+
+//fs.appendFileSync('./1.log', '\n>' + tgGroupId + ':' + isChannel + '<\n')
+}
+
+async function reloadGroupUsers(groupId, onlyReset) {
+	db
+		.prepare(`delete from group_users where group_id = :group_id`)
+		.run({ group_id: groupId })
+
+	if (onlyReset)
+		return
+
+	const group = db
+		.prepare(`select telegram_id, is_channel, access_hash from groups where id = :group_id`)
+		.get({ group_id: groupId})
+
+	console.log (123, group)
+
+	if (!group)
+		return
+	
+	const tgGroupId = group.telegram_id
+	const isChannel = group.is_channel
+	let accessHash = group.access_hash
+
+	console.log ('HERE')
+	
+	db
+		.prepare(`update groups set access_hash = :access_hash where id = :group_id`)
+		.safeIntegers(true)
+		.run({
+			group_id: groupId,
+			access_hash: accessHash,
+		})
+
+	const result = isChannel ?
+		await client.invoke(new Api.channels.GetParticipants({
+			channel: new Api.PeerChannel({ channelId: tgGroupId }),
+			filter: new Api.ChannelParticipantsRecent(),
+			limit: 999999,
+			offset: 0
+	        })) : await client.invoke(new Api.messages.GetFullChat({
+			chatId: tgGroupId,
+		}))
+
+	const users = result.users.filter(user => !user.bot)
+	for (const user of users) {
+		const userId = registerUser(user.id.value, user)
+
+		if (updateUser(userId, user)) {
+			await updateUserPhoto (userId, user)
+
+			const query = `insert or ignore into group_users (group_id, user_id) values (:group_id, :user_id)`
+			db.prepare(query).run({ group_id: groupId, user_id: userId })
+		}
+	}
+}
+
+async function registerUpload(data) {
+	if (!data.projectId || !data.media)
+		return false
+
+	const uploadGroup = db
+		.prepare(`
+			select id, telegram_id, project_id, is_channel, access_hash 
+			  from groups 
+			 where id = (select upload_group_id 
+				       from customers 
+			              where id = (select customer_id from projects where id = :project_id limit 1)
+				      limit 1) 
+			limit 1
+		`)
+		.safeIntegers(true)
+		.get({project_id: data.projectId})
+
+	if (!uploadGroup || !uploadGroup.telegram_id || uploadGroup.id == data.originGroupId)
+		return false
+
+	const tgUploadGroupId = uploadGroup.telegram_id
+
+	const peer = uploadGroup.is_channel ?
+		new Api.PeerChannel({ channelId: tgUploadGroupId }) :
+		new Api.PeerChat({ chatlId: tgUploadGroupId })
+
+	let resultId = 0
+
+	try {
+		const result = await client.invoke(new Api.messages.SendMedia({
+				peer,
+				media: data.media,
+				message: data.caption || '',
+				background: true,
+				silent: true
+		}))
+
+		const update = result.updates.find(u => 
+			(u.className == 'UpdateNewMessage' || u.className == 'UpdateNewChannelMessage') && 
+			u.message.className == 'Message' && 
+			(u.message.peerId.channelId?.value == tgUploadGroupId || u.message.peerId.chatId?.value == tgUploadGroupId) &&
+			u.message.media)
+
+		const udoc = update?.message?.media?.document
+		if (udoc) {
+			resultId = db
+				.prepare(`
+					insert into documents (project_id, origin_group_id, origin_message_id, group_id, message_id, 
+					file_id, access_hash, filename, mime, caption, size, published_by, parent_type, parent_id)
+					values (:project_id, :origin_group_id, :origin_message_id, :group_id, :message_id, 
+					:file_id, :access_hash, :filename, :mime, :caption, :size, :published_by, :parent_type, :parent_id)
+					returning id
+				`)
+				.safeIntegers(true)
+				.pluck(true)
+				.get({
+					project_id: data.projectId,
+					origin_group_id: data.originGroupId,
+					origin_message_id: data.originMessageId,
+					group_id: uploadGroup.id,
+					message_id: update.message.id,
+					file_id: udoc.id.value,
+					filename: udoc.attributes.find(attr => attr.className == 'DocumentAttributeFilename')?.fileName,
+					access_hash: udoc.accessHash.value,
+					mime: udoc.mimeType,
+					caption: data.caption,
+					size: udoc.size.value,
+					published_by: data.publishedBy,
+					parent_type: data.parentType,
+					parent_id: data.parentId
+				})
+		}
+
+	} catch (err) {
+		fs.appendFileSync('./1.log', '\n\nERR:' + err.message + ':' + JSON.stringify (err.stack)+'\n\n')
+		console.error('Message.registerUpload: ' + err.message)
+	}
+
+	return resultId
+}
+
+async function onNewServiceMessage (msg, isChannel) {
+	const action = msg.action || {}
+	const tgGroupId = isChannel ? msg.peerId?.channelId?.value : msg.peerId?.chatId?.value
+	const groupId = await registerGroup(tgGroupId, isChannel)	
+
+	// Group/Channel rename
+	if (action.className == 'MessageActionChatEditTitle') {	
+		const info = db
+			.prepare(`
+				update groups 
+				set name = :name, is_channel = :is_channel, last_update_time = :last_update_time 
+				where telegram_id = :telegram_id
+			`)
+			.safeIntegers(true)
+			.run({
+				name: action.title,
+				is_channel: +isChannel, 
+				last_update_time: Math.floor (Date.now() / 1000),
+		 		telegram_id: tgGroupId
+			})
+	}
+
+	// Chat to Channel
+	if (action.className == 'MessageActionChatMigrateTo') {
+		const info = db
+			.prepare(`
+				update groups 
+				set telegram_id = :new_telegram_id, name = :name, is_channel = 1, last_update_time = :last_update_time 
+				where telegram_id = :old_telegram_id
+			`)
+			.safeIntegers(true)
+			.run({
+				name: action.title,
+				last_update_time: Date.now() / 1000,
+		 		old_telegram_id: tgGroupId,
+				new_telegram_id: action.channelId.value
+			})
+	}
+
+	// User/s un/register
+	if (action.className == 'MessageActionChatAddUser' || action.className == 'MessageActionChatDeleteUser' ||
+		action.className == 'MessageActionChannelAddUser' || action.className == 'MessageActionChannelDeleteUser'
+		) {
+
+		const tgUserIds = [action.user, action.users, action.userId].flat().filter(Boolean).map(e => BigInt(e.value))
+		const isAdd = action.className == 'MessageActionChatAddUser' || action.className == 'MessageActionChannelAddUser'
+
+		if (tgUserIds.indexOf(bot.id) == -1) {
+			// Add/remove non-bot users
+			for (const tgUserId of tgUserIds) {
+				const userId = registerUser(tgUserId)
+
+				if (isAdd) {
+					try {
+						const user = await client.getEntity(new Api.PeerUser({ userId: tgUserId }))
+						updateUser(userId, user)
+						await updateUserPhoto (userId, user)
+					} catch (err) {
+						console.error(msg.className + ', ' + userId + ': ' + err.message)
+					}						
+				}
+
+				const query = isAdd ? 
+					`insert or ignore into group_users (group_id, user_id) values (:group_id, :user_id)` :
+					`delete from group_users where group_id = :group_id and user_id = :user_id`
+				db.prepare(query).run({ group_id: groupId, user_id: userId })
+			}
+		}
+	}
+}
+
+async function onNewMessage (msg, isChannel) {
+	const tgGroupId = isChannel ? msg.peerId?.channelId?.value : msg.peerId?.chatId?.value
+	const groupId = await registerGroup(tgGroupId, isChannel)
+
+	// Document is detected
+	if (msg.media?.document) {
+		const doc = msg.media.document
+
+		const projectId = db
+			.prepare(`select project_id from groups where telegram_id = :telegram_id`)
+			.safeIntegers(true)
+			.pluck(true)
+			.get({telegram_id: tgGroupId})
+
+		const media = new Api.InputMediaDocument({
+			id: new Api.InputDocument({
+					id: doc.id.value, 
+					accessHash: doc.accessHash.value, 
+					fileReference: doc.fileReference
+				})
+			})
+
+		await registerUpload({
+			projectId,
+			media,
+			caption: msg.message,
+			originGroupId: groupId,
+			originMessageId: msg.id,
+			parentType: 0,
+			publishedBy: registerUser (msg.fromId?.userId?.value)
+		})
+	}
+
+	if (msg.message?.startsWith('KEY-')) {
+		let projectName = db
+				.prepare(`
+					select name 
+					from projects 
+					where id in (
+						select project_id from groups where id = :group_id
+						union
+						select id from projects where upload_group_id = :group_id)
+				`)
+				.pluck(true)
+				.get({ group_id: groupId })
+
+		if (projectName) 
+			return await bot.sendMessage(groupId, 'Группа уже используется на проекте ' + projectName)
+
+		const [_, time64, key] = msg.message.substr(3).split('-')
+		const now = Math.floor(Date.now() / 1000)
+		const time = Buffer.from(time64, 'base64')
+
+		if (now - 3600 >= time && time >= now) 
+			return await bot.sendMessage(groupId, 'Время действия ключа для привязки истекло')
+
+		const projectId = db
+			.prepare(`select id from projects where generate_key(id, :time) = :key`)
+			.pluck(true)
+			.get({ key: msg.message.trim(), time })
+
+		if (projectId) {
+			await attachGroup(groupId, isChannel, projectId)
+			await onGroupAttach(tgGroupId, isChannel)
+		}
+	}
+		
+	if (msg.message?.startsWith('/start')) {
+		// Called by https://t.me/ready_or_not_2025_bot?startgroup=<customer_id/project_id>
+		if (/start@ready_or_not_2025_bot (-|)([\d]+)$/g.test(msg.message)) {
+			const tgUserId = msg.fromId?.userId?.value
+			const param = +msg.message.split(' ')[1]
+
+			// Set upload group for customer
+			if (param < 0) {
+				const customerId = -param
+
+				db
+					.prepare(`
+						update customers 
+						set upload_group_id = :group_id 
+						where id = :customer_id and telegram_user_id = :telegram_user_id
+					`)
+					.safeIntegers(true)
+					.run({
+						group_id: groupId, 
+						customer_id: customerId, 
+						telegram_user_id: tgUserId
+					})
+			}
+
+			// Add group to project
+			if (param > 0) {
+				const projectId = param
+				
+				const customerId = db
+					.prepare(`select customer_id from projects where id = :project_id`)
+					.pluck(true)
+					.get({project_id: projectId})
+
+				db
+					.prepare(`
+						update groups 
+						set project_id = :project_id 
+						where id = :group_id and exists(
+							select 1 
+							from customers 
+							where id = :customer_id and telegram_user_id = :telegram_user_id)
+					`)
+					.safeIntegers(true)
+					.run({
+						project_id: projectId,
+						group_id: groupId, 
+						customer_id: customerId, 
+						telegram_user_id: tgUserId
+					})
+
+				await reloadGroupUsers(groupId, false)
+				await onGroupAttach(tgGroupId, isChannel)
+			}
+		}
+	}
+}
+
+async function onNewUserMessage (msg) {
+	if (msg.message == '/start' && msg.peerId?.className == 'PeerUser') {
+		const tgUserId = msg.peerId?.userId?.value
+		const userId = registerUser(tgUserId)
+
+		try {
+			const user = await client.getEntity(new Api.PeerUser({ userId: tgUserId }))
+			updateUser(userId, user)
+			await updateUserPhoto (userId, user)
+
+			const inputPeer = new Api.InputPeerUser({userId: tgUserId, accessHash: user.accessHash.value})
+			const resultBtn = await client.sendMessage(inputPeer, {
+				message: 'Сообщение от бота',
+				buttons: client.buildReplyMarkup([
+					[Button.url('Админка', 'https://t.me/ready_or_not_2025_bot/userapp?startapp=admin')],
+					[Button.url('Пользователь', 'https://t.me/ready_or_not_2025_bot/userapp?startapp=user')]
+				])
+			})
+		} catch (err) {
+			console.error(msg.className + ', ' + userId + ': ' + err.message)
+		}
+	}
+}
+
+async function onUpdatePaticipant (update, isChannel) {
+	const tgGroupId = isChannel ? update.channelId?.value : update.chatlId?.value
+	if (!tgGroupId || update.userId?.value != bot.id)
+		return
+
+	const groupId = await registerGroup (tgGroupId, isChannel)
+
+	const isBan = update.prevParticipant && !update.newParticipant
+	const isAdd = (!update.prevParticipant || update.prevParticipant?.className == 'ChannelParticipantBanned') && update.newParticipant
+
+	if (isBan || isAdd) 
+		await reloadGroupUsers(groupId, isBan)
+
+	if (isBan) { 
+		db
+			.prepare(`update groups set project_id = null where id = :group_id`)
+			.run({group_id: groupId})
+	}
+
+	const botCanBan = update.newParticipant?.adminRights?.banUsers || 0
+	db
+		.prepare(`update groups set bot_can_ban = :bot_can_ban where id = :group_id`)
+		.run({group_id: groupId, bot_can_ban: +botCanBan})
+}
+
+class Bot extends EventEmitter {
+	
+	async start (apiId, apiHash, botAuthToken) {
+		this.id = 7236504417n
+
+		client  = new TelegramClient(session, apiId, apiHash, {})
+
+		client.addEventHandler(async (update) => {
+			if (update.className == 'UpdateConnectionState') 
+				return
+
+			if (update.className == 'UpdateNewMessage' || update.className == 'UpdateNewChannelMessage') {
+				const msg = update?.message
+				const isChannel = update.className == 'UpdateNewChannelMessage'
+
+				if (!msg) 
+					return
+
+				const result = msg.peerId?.className == 'PeerUser' ? await onNewUserMessage(msg) :
+					msg.className == 'MessageService' ? await onNewServiceMessage(msg, isChannel) :
+					await onNewMessage(msg, isChannel) 
+			}
+
+			if (update.className == 'UpdateChatParticipant' || update.className == 'UpdateChannelParticipant')
+				await onUpdatePaticipant(update, update.className == 'UpdateChannelParticipant') 
+		})
+		
+		await client.start({botAuthToken})
+	}
+
+	async uploadDocument(projectId, fileName, mime, data, parentType, parentId, publishedBy) {	
+		const file = await client.uploadFile({ file: new CustomFile(fileName, data.length, '', data), workers: 1 })
+	
+		const media = new Api.InputMediaUploadedDocument({
+			file, 
+			mimeType: mime,
+			attributes: [new Api.DocumentAttributeFilename({ fileName })]
+		})
+	
+		return await registerUpload({
+			projectId, 
+			media,
+			parentType,
+			parentId,
+			publishedBy
+		})	
+	}
+	
+	async downloadDocument(projectId, documentId) {
+		const document = db
+			.prepare(`
+				select file_id, access_hash, '' thumbSize, filename, mime
+				from documents where id = :document_id and project_id = :project_id
+			`)
+			.safeIntegers(true)
+			.get({project_id: projectId, document_id: documentId})
+	
+		if (!document)
+			return false
+
+		const result = await client.downloadFile(new Api.InputDocumentFileLocation({
+			id: document.file_id,
+			accessHash: document.access_hash,
+			fileReference: Buffer.from(document.filename),
+			thumbSize: ''
+		}, {}))
+
+		return {
+			filename: document.filename,
+			mime: document.mime,
+			size: result.length,
+			data: result
+		}
+	}
+	
+	async reloadGroupUsers(groupId, onlyReset) {
+		return reloadGroupUsers(groupId, onlyReset)
+	}
+
+	async sendMessage (groupId, message) {
+		const group = db
+			.prepare(`select telegram_id, is_channel from groups where id = :group_id`)
+			.get({ group_id: groupId})
+
+		if (!group)
+			return
+
+		const entity =  group.is_channel ? { channelId: group.telegram_id } : { chatId: group.telegram_id }
+		const inputPeer = await client.getEntity( group.is_channel ?
+			new Api.InputPeerChannel(entity) :
+			new Api.InputPeerChat(entity)
+		)
+
+		await client.sendMessage(inputPeer, {message})
+
+		const delay = ms => new Promise(resolve => setTimeout(resolve, ms))
+		await delay(1000)
+	}
+
+	async leaveGroup (groupId) {
+		const group = db
+			.prepare(`select telegram_id, is_channel from groups where id = :group_id`)
+			.get({ group_id: groupId})
+
+		if (!group)
+			return
+
+		if (group.is_channel) {
+			const inputPeer = await client.getEntity(new Api.InputPeerChannel({ channelId: group.telegram_id }))
+			await client.invoke(new Api.channels.LeaveChannel({ channel: inputPeer }))
+		} else {
+			await client.invoke(new Api.messages.DeleteChatUser({ chatId: group.telegram_id, userId: this.id }))
+		}
+	}
+} 
+
+const bot = new Bot()
+
+module.exports = bot
+
--- a/backend/apps/miniapp.js
+++ b/backend/apps/miniapp.js
@@ -0,0 +1,643 @@
+const express = require('express')
+const multer = require('multer')
+const crypto = require('crypto')
+const fs = require('fs')
+const contentDisposition = require('content-disposition')
+
+const bot = require('./bot')
+const db = require('../include/db')
+
+const app = express.Router()
+const upload = multer({
+	storage: multer.memoryStorage(),
+	limits: {
+		fileSize: 10_000_000  // 10mb
+	}
+})
+
+function hasAccess(project_id, user_id) {
+	return  !!db
+		.prepare(`
+			select 1 
+			  from group_users 
+			 where user_id = :user_id and 
+			       group_id in (select id from groups where project_id = :project_id) and
+			       not exists(select 1 from user_details where user_id = :user_id and project_id = :project_id and is_blocked = 1) and
+			       not exists(select 1 from projects where id = :project_id and is_deleted = 1)	
+		`)
+		.get({project_id, user_id})
+}
+
+const sessions = {}
+
+app.use((req, res, next) => {
+	if (req.path == '/user/login')
+		return next()
+
+	const sid = req.query.sid || req.cookies.sid
+	req.session = sessions[sid]
+	if (!req.session) 
+		throw Error('ACCESS_DENIED::401')
+
+	res.locals.user_id = req.session.user_id
+	next()
+})
+
+
+app.post('/user/login', (req, res, next) => {
+	db
+		.prepare(`insert or ignore into users (telegram_id) values (:telegram_id)`)
+		.safeIntegers(true)
+		.run(res.locals)
+
+	const user_id = db
+		.prepare(`select id from users where telegram_id = :telegram_id`)
+		.safeIntegers(true)
+		.pluck(true)
+		.get(res.locals)
+
+	const sid = crypto.randomBytes(64).toString('hex')
+	req.session = sessions[sid] = {sid, user_id}
+	res.setHeader('Set-Cookie', [`sid=${sid};httpOnly;path=/`])
+	res.locals.user_id = user_id
+ 
+	res.status(200).json({success: true})
+})
+
+app.get('/project', (req, res, next) => {
+	const where = req.query.id ? ' and p.id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select p.id, p.name, p.description, p.logo, 
+				c.name customer_name, c.upload_group_id <> 0 has_upload
+			from projects p
+			inner join customers c on p.customer_id = c.id
+			where p.id in (
+				select project_id 
+				  from groups 
+				 where id in (select group_id from group_users where user_id = :user_id)
+			) and not exists(select 1 from user_details where user_id = :user_id and project_id = p.id and is_blocked = 1)
+			${where} and is_deleted <> 1
+		`)
+		.all(res.locals)
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project?id=${req.params.pid}`)
+})
+
+app.use('/project/:pid(\\d+)/*', (req, res, next) => {
+	res.locals.project_id = parseInt(req.params.pid)
+
+	if (!hasAccess(res.locals.project_id, res.locals.user_id))
+		throw Error('ACCESS_DENIED::401')
+
+	const row = db
+		.prepare('select customer_id from projects where id = :project_id')
+		.get(res.locals)
+		
+	res.locals.customer_id = row.customer_id
+
+	next()
+})
+
+app.get('/project/:pid(\\d+)/user', (req, res, next) => {
+	const where = req.query.id ? ' and u.id = ' + parseInt(req.query.id) : ''
+
+	const users = db
+		.prepare(` 
+			with actuals (user_id) as (
+				select distinct user_id 
+				  from group_users 
+				 where group_id in (select id from groups where project_id = :project_id)
+				       and group_id in (select group_id from group_users where user_id = :user_id)
+			),
+			contributors (user_id) as ( 
+				select created_by from tasks where project_id = :project_id
+				union
+				select assigned_to from tasks where project_id = :project_id
+				union
+				select created_by from meetings where project_id = :project_id
+				union 
+				select published_by from documents where project_id = :project_id
+			),
+			members (user_id, is_leave) as ( 
+				select user_id, 0 is_leave from actuals
+				union all
+				select user_id, 1 is_leave from contributors where user_id not in (select user_id from actuals)
+			)
+			select u.id,
+				u.telegram_id,
+				u.username,
+				u.firstname,
+				u.lastname,
+				u.photo,
+				u.json_phone_projects,
+				ud.fullname,
+				ud.role,
+				ud.department,
+				ud.is_blocked,
+				(select company_id 
+				   from company_users 
+				  where user_id = u.id and 
+					company_id in (select id from companies where project_id = :project_id)) company_id,
+				m.is_leave
+			from users u 
+			inner join members m on u.id = m.user_id 
+			left join user_details ud on ud.user_id = u.id and ud.project_id = :project_id
+			where 1 = 1 ${where}	
+		`)
+		.all(res.locals)
+
+	const companies = db
+		.prepare('select id, name, email, phone, site, description from companies where project_id = :project_id')
+		.all(res.locals) 
+		.reduce((companies, row) => {
+			companies[row.id] = row
+			return companies
+		}, {})
+
+	const mappings = {}
+	const company_id = users.find(m => m.id == res.locals.user_id).company_id
+	if (company_id) {
+		res.locals.company_id = company_id
+
+		db
+			.prepare('select show_as_id, show_to_id from company_mappings where project_id = :project_id and company_id = :company_id')
+			.all(res.locals)
+			.forEach(row => mappings[row.show_to_id] = row.show_to_id)	
+	}
+
+	users.forEach(m => {
+		m.company = companies[mappings[m.company_id] || m.company_id]
+		delete m.company_id
+	})
+
+	users.forEach(m => {
+		const isHide = JSON.parse(m.json_phone_projects || []).indexOf(res.locals.project_id) == -1
+		if (isHide)
+			delete m.phone
+		delete m.json_phone_projects
+	})
+
+	if (where && users.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? users[0] : users})
+})
+
+app.get('/project/:pid(\\d+)/user/reload', async (req, res, next) => {
+	const groupIds = db
+		.prepare(`select id from groups where project_id = :project_id`)
+		.all(res.locals)
+		.map(e => e.id)
+
+	const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
+
+	for (const groupId of groupIds) {
+		await bot.reloadGroupUsers(groupId)
+		await sleep(1000)		
+	}
+
+	res.status(200).json({success: true})	
+})
+
+app.get('/project/:pid(\\d+)/group', (req, res, next) => {
+	const where = req.query.id ? ' and id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select id, name, telegram_id 
+			 from groups 
+			where project_id = :project_id and id in (select group_id from group_users where user_id = :user_id)
+			      ${where}
+		`)
+		.all(res.locals) 
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)/group/:gid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/group?id=${req.params.gid}`)
+})
+
+// TASK
+app.get('/project/:pid(\\d+)/task', (req, res, next) => {
+	const where = req.query.id ? ' and t.id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select id, name, created_by, assigned_to, priority, status, time_spent, create_date, plan_date, close_date,
+			(select json_group_array(user_id) from task_users where task_id = t.id) observers,
+			(select json_group_array(id) from documents where parent_type = 1 and parent_id = t.id) attachments
+			from tasks t
+			where project_id = :project_id and
+			      (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = t.id and user_id = :user_id))
+			      ${where}
+		`)
+		.all(res.locals) 
+	
+	rows.forEach(row => {
+		row.observers = JSON.parse(row.observers)
+		row.attachments = JSON.parse(row.attachments)
+	})
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/task?id=${req.params.tid}`)
+})
+
+app.post('/project/:pid(\\d+)/task', (req, res, next) => {
+	res.locals.name = req.body?.name	
+	res.locals.status = parseInt(req.body?.status)
+	res.locals.priority = parseInt(req.body?.priority)
+	res.locals.assigned_to = req.body?.assigned_to ? parseInt(req.body?.assigned_to) : undefined
+	res.locals.create_date = Math.floor(Date.now() / 1000)
+	res.locals.plan_date = req.body?.plan_date ? parseInt(req.body?.plan_date) : undefined
+	
+	if (res.locals.assigned_to && !hasAccess(res.locals.project_id, res.locals.assigned_to)) 
+		throw Error('INCORRECT_ASSIGNED_TO::400')
+
+	const id = db
+		.prepare(`
+			insert into tasks (project_id, name, created_by, assigned_to, priority, status, create_date, plan_date) 
+			values (:project_id, :name, :user_id, :assigned_to, :priority, :status, :create_date, :plan_date) 
+			returning id
+		`)
+		.pluck(true)
+		.get(res.locals)
+
+	res.status(200).json({success: true, data: id})
+})
+
+app.use('/project/:pid(\\d+)/task/:tid(\\d+)*', (req, res, next) => {
+	res.locals.task_id = req.params.tid
+
+	const task = db
+		.prepare(`
+			select created_by, assigned_to 
+			  from tasks 
+			 where id = :task_id and project_id = :project_id 
+			       and (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = :task_id and user_id = :user_id))
+		`)
+		.get(res.locals)
+
+	if (!task)
+		throw Error('NOT_FOUND::404')
+
+	res.locals.is_author = task.created_by == res.locals.user_id
+	res.locals.is_assigned = task.assigned_to == res.locals.user_id
+
+	next()
+})
+
+app.put('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
+	if (!res.locals.is_author && !res.locals.is_assigned)
+		throw Error('ACCESS_DENIED::401')
+
+	res.locals.id = res.locals.task_id
+	res.locals.name = req.body?.name	
+	res.locals.status = parseInt(req.body?.status)
+	res.locals.priority = parseInt(req.body?.priority)
+	res.locals.assigned_to = req.body?.assigned_to ? parseInt(req.body?.assigned_to) : undefined
+	res.locals.plan_date = req.body?.plan_date ? parseInt(req.body?.plan_date) : undefined
+
+	const columns = res.locals.is_author ? ['name', 'assigned_to', 'priority', 'status', 'plan_date', 'time_spent'] : ['status', 'time_spent']
+	const info = db
+		.prepareUpdate('tasks', columns, res.locals, ['id', 'project_id'])
+		.run(res.locals)
+	
+	if (info.changes == 0) 
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true})
+})
+
+app.delete('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
+	if (!res.locals.is_author)
+		throw Error('ACCESS_DENIED::401')
+
+	const info = db
+		.prepare(`delete from tasks where id = :task_id and project_id = :project_id and created_by = :user_id`)
+		.run(res.locals)
+
+	if (info.changes == 0) 
+		throw Error('NOT_FOUND::404')
+			 
+	res.status(200).json({success: true})
+})
+
+app.put('/project/:pid(\\d+)/task/:tid(\\d+)/observer', (req, res, next) => {
+	if (!res.locals.is_author && !res.locals.is_assigned)
+		throw Error('ACCESS_DENIED::401')
+	
+	const user_ids = req.body instanceof Array ? [...new Set(req.body.map(e => parseInt(e)))] : []
+
+	// Проверка, что выбранные пользователи имеют доступ к проекту
+	let rows = db
+		.prepare(`
+			select user_id 
+			  from group_users 
+			 where group_id in (select id from groups where project_id = :project_id)
+		`)
+		.pluck(true)
+		.all(res.locals)
+
+	if (user_ids.some(user_id => !rows.contains(user_id)))
+		throw Error('INACCESSABLE_USER::400')
+
+	res.locals.json_ids = JSON.stringify(user_ids)
+
+	db
+		.prepare(`
+			delete from task_users where task_id = :task_id;
+			insert into task_users (task_id, user_id) select :task_id, value from json_each(:json_ids)
+		`)
+		.run(res.locals)
+
+	res.status(200).json({success: true})
+})
+
+// MEETINGS
+app.get('/project/:pid(\\d+)/meeting', (req, res, next) => {
+	const where = req.query.id ? ' and m.id = ' + parseInt(req.query.id) : ''
+
+	const rows = db
+		.prepare(`
+			select id, name, description, created_by, meet_date,
+			(select json_group_array(user_id) from meeting_users where meeting_id = m.id) participants,
+			(select json_group_array(id) from documents where parent_type = 2 and parent_id = m.id) attachments
+			from meetings m
+			where project_id = :project_id and
+			      (created_by = :user_id or exists(select 1 from meeting_users where meeting_id = m.id and user_id = :user_id))
+			      ${where}
+		`)
+		.all(res.locals) 
+	
+	rows.forEach(row => {
+		row.participants = JSON.parse(row.participants)
+		row.attachments = JSON.parse(row.attachments)
+	})
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: where ? rows[0] : rows})
+})
+
+app.get('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/meeting?id=${req.params.mid}`)
+})
+
+app.post('/project/:pid(\\d+)/meeting', (req, res, next) => {
+	res.locals.name = req.body?.name	
+	res.locals.description = req.body?.description
+	res.locals.meet_date = req.body?.meet_date ? parseInt(req.body?.meet_date) : undefined
+
+	const id = db
+		.prepare(`
+			insert into meetings (project_id, name, description, created_by, meet_date) 
+			values (:project_id, :name, :description, :user_id, :meet_date) 
+			returning id
+		`)
+		.pluck(true)
+		.get(res.locals)
+
+	res.status(200).json({success: true, data: id})
+})
+
+app.use('/project/:pid(\\d+)/meeting/:mid(\\d+)*', (req, res, next) => {
+	res.locals.meeting_id = req.params.mid
+
+	const meeting = db
+		.prepare(`
+			select created_by 
+			  from meetings 
+			 where id = :meeting_id and project_id = :project_id 
+			       and (created_by = :user_id or exists(select 1 from meeting_users where meeting_id = :meeting_id and user_id = :user_id))
+		`)
+		.get(res.locals)
+
+	if (!meeting)
+		throw Error('NOT_FOUND::404')
+
+	res.locals.is_author = meeting.created_by == res.locals.user_id
+
+	next()
+})
+
+app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
+	if (!res.locals.is_author)
+		throw Error('ACCESS_DENIED::401')
+
+	res.locals.id = res.locals.meeting_id
+	res.locals.name = req.body?.name	
+	res.locals.description = req.body?.description
+	res.locals.meet_date = req.body?.meet_date ? parseInt(req.body?.meet_date) : undefined
+
+	const info = db
+		.prepareUpdate('meetings', ['name', 'description', 'meet_date'], res.locals, ['id', 'project_id'])
+		.run(res.locals)
+	
+	if (info.changes == 0) 
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true})
+})
+
+app.delete('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
+	if (!res.locals.is_author)
+		throw Error('ACCESS_DENIED::401')
+
+	const info = db
+		.prepare(`delete from meetings where id = :meeting_id and project_id = :project_id and created_by = :user_id`)
+		.run(res.locals)
+
+	if (info.changes == 0) 
+		throw Error('NOT_FOUND::404')
+			 
+	res.status(200).json({success: true})
+})
+
+app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)/participants', (req, res, next) => {
+	if (!res.locals.is_author)
+		throw Error('ACCESS_DENIED::401')
+	
+	const user_ids = req.body instanceof Array ? [...new Set(req.body.map(e => parseInt(e)))] : []
+
+	// Проверка, что выбранные пользователи имеют доступ к проекту
+	let rows = db
+		.prepare(`
+			select user_id 
+			  from group_users 
+			 where group_id in (select id from groups where project_id = :project_id)
+		`)
+		.pluck(true) // .raw?
+		.all(res.locals)
+
+	if (user_ids.some(user_id => rows.indexOf(user_id)) == -1)
+		throw Error('INACCESSABLE_USER::400')
+
+	db
+		.prepare(`delete from meeting_users where meeting_id = :meeting_id`)
+		.run(res.locals)
+
+	res.locals.json_ids = JSON.stringify(user_ids)
+	db
+		.prepare(`insert into meeting_users (meeting_id, user_id) select :meeting_id, value from json_each(:json_ids)`)
+		.run(res.locals)
+
+	res.status(200).json({success: true})
+})
+
+// DOCUMENTS
+app.get('/project/:pid(\\d+)/document', (req, res, next) => {
+	const ids = String(req.query.id).split(',').map(e => parseInt(e)).filter(e => e > 0)
+	const where = ids.length > 0 ? ' and id in (' + ids.join(', ') + ')' : ''
+
+	// Документы
+	// 1. Из групп, которые есть в проекте и в которых участвует пользователь
+	// 2. Из задач проекта, где пользователь автор, ответсвенный или наблюдатель
+	// 3. Из встреч на проекте, где пользователь создатель или участник
+	// To-Do: отдавать готовую ссылку --> как минимум GROUP_ID надо заменить на tgGroupId
+	const rows = db
+		.prepare(`
+			select id, origin_group_id, origin_message_id, filename, mime, caption, size, published_by, parent_id, parent_type
+			  from documents d
+			 where project_id = :project_id ${where} and (
+				       origin_group_id in (select group_id from group_users where user_id = :user_id) 
+				       or
+				       parent_type = 1 and parent_id in (
+						select id 
+						  from tasks t
+						 where project_id = :project_id and (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = t.id and user_id = :user_id))
+				       ) 
+				       or
+				       parent_type = 2 and parent_id in (
+						select id 
+						  from meetings m
+						 where project_id = :project_id and (created_by = :user_id or exists(select 1 from meeting_users where meeting_id = m.id and user_id = :user_id))
+				       )
+			       )
+		`)
+		.all(res.locals) 
+
+	if (where && rows.length == 0)
+		throw Error('NOT_FOUND::404')
+
+	res.status(200).json({success: true, data: ids.length == 1 ? rows[0] : rows})
+})
+
+app.post('/project/:pid(\\d+)/:type(task|meeting)/:id(\\d+)/attach', upload.any(), async (req, res, next) => {
+	const parentType = req.params.type == 'task' ? 1 : 2
+	const parentId = req.params.id
+
+	const ids = []
+	for (const file of req.files) {
+ 		const id = await bot.uploadDocument(res.locals.project_id, file.originalname, file.mimetype, file.buffer, parentType, parentId, res.locals.user_id)
+		ids.push(id)	
+	}
+
+	res.redirect(req.baseUrl + `/project/${req.params.pid}/document?id=` + ids.join(','))
+})
+
+app.use('/project/:pid(\\d+)/document/:did(\\d+)', (req, res, next) => {
+	res.locals.document_id = req.params.did
+
+	const doc = db
+		.prepare(`select * from documents where id = :document_id and project_id = :project_id`)
+		.get(res.locals)
+
+	if (!doc)
+		throw Error('NOT_FOUND::404')
+
+	if (doc.parent_type == 0) {
+		res.locals.group_id = doc.group_id
+		const row = db
+			.prepare(`select 1 from group_users where group_id = :group_id and user_id = :user_id`)
+			.get(res.locals)
+
+		if (row) {
+			res.locals.can_download = true
+		}
+	} else {
+		res.locals.parent_id = doc.parent_id
+		const parent = doc.parent_type == 1 ? 'task' : 'meeting'
+		
+		const row = db
+			.prepare(`
+				select 1 
+				  from ${parent}s 
+				 where id = :parent_id and project_id = :project_id or 
+				       exists(select 1 from ${parent}_users where ${parent}_id = :parent_id and user_id = :user_id)
+			`)
+			.get(res.locals)
+
+		if (row) {
+			res.locals.can_download = true
+			res.locals.can_delete = doc.published_by == res.locals.user_id
+		}
+	}
+
+	next()
+})
+
+app.get('/project/:pid(\\d+)/document/:did(\\d+)', async (req, res, next) => {
+	if (!res.locals.can_download)
+		throw Error('NOT_FOUND::404')
+
+	const file = await bot.downloadDocument(res.locals.project_id, res.locals.document_id)
+	res.writeHead(200, {
+		'Content-Length': file.size,
+		'Content-Type': file.mime,
+		'Content-Disposition': contentDisposition(file.filename)
+	})
+
+	res.end(file.data)
+})
+
+app.delete('/project/:pid(\\d+)/document/:id(\\d+)', (req, res, next) => {
+	if (!res.locals.can_delete)
+		throw Error('NOT_FOUND::404')
+
+	const doc = db
+		.prepare(`delete from documents where id = :id and project_id = :project_id`)
+		.run(res.locals)
+
+	res.status(200).json({success: true})
+})
+
+app.get('/settings', (req, res, next) => {
+	const row = db
+		.prepare(`select coalesce(json_settings, '{}') from users where id = :user_id`)
+		.pluck(true)
+		.get(res.locals)
+	
+	res.status(200).json({success: true, data: JSON.parse(row)})
+})
+
+app.put('/settings', (req, res, next) => {
+	res.locals.json_settings = JSON.stringify(req.body || {})
+
+	const row = db
+		.prepare(`update users set json_settings = :json_settings where id = :user_id`)
+		.run(res.locals)
+	
+	res.status(200).json({success: true})
+})
+
+module.exports = app
--- a/backend/data/db.sqlite
+++ b/backend/data/db.sqlite
--- a/backend/data/db.sqlite-shm
+++ b/backend/data/db.sqlite-shm
--- a/backend/data/db.sqlite-wal
+++ b/backend/data/db.sqlite-wal
--- a/backend/data/init.sql
+++ b/backend/data/init.sql
@@ -0,0 +1,166 @@
+pragma foreign_keys = off;
+
+create table if not exists customers (
+	id integer primary key autoincrement,
+	name text check(name is null or trim(name) <> '' and length(name) < 256),	
+	email text check(email is null or trim(email) <> '' and length(email) < 128),
+	password text check(password is null or length(password) > 7 and length(password) < 64),
+	telegram_user_id integer,
+	plan integer,
+	json_balance text default '{}',
+	activation_key text,
+	is_active integer default 0,
+	json_company text default '{}',
+	upload_group_id	integer,
+	json_backup_server text default '{}',
+	json_backup_params text default '{}'
+) strict;
+
+create table if not exists projects (
+	id integer primary key autoincrement,
+	customer_id integer references customers(id) on delete cascade,	
+	name text not null check(trim(name) <> '' and length(name) < 256),
+	description text check(description is null or length(description) < 4096),
+	logo text,
+	is_deleted integer default 0
+) strict;
+
+create table if not exists groups (
+	id integer primary key autoincrement,
+	project_id integer references projects(id) on delete cascade,
+	name text,
+	telegram_id integer,
+	access_hash integer,
+	is_channel integer check(is_channel in (0, 1)) default 0,
+	bot_can_ban integer default 0,
+	user_count integer,
+	last_update_time integer
+);
+create unique index if not exists idx_groups_telegram_id on groups (telegram_id); 
+
+create table if not exists users (
+	id integer primary key autoincrement,
+	telegram_id integer,
+	access_hash integer,
+	firstname text,
+	lastname text,
+	username text,
+	photo_id integer,
+	photo text,
+	language_code text,	
+	phone text,
+	json_phone_projects text default '[]',
+	json_settings text default '{}'
+) strict;
+create unique index if not exists idx_users_telegram_id on users (telegram_id); 
+
+create table if not exists user_details (
+	user_id integer references users(id) on delete cascade,
+	project_id integer references projects(id) on delete cascade,
+	fullname text,
+	role text,
+	department text,
+	is_blocked integer check(is_blocked in (0, 1)) default 0,
+	primary key (user_id, project_id)
+) strict;
+
+create table if not exists tasks (
+	id integer primary key autoincrement,
+	project_id integer references projects(id) on delete cascade,	
+	name text not null check(trim(name) <> '' and length(name) < 4096),
+	created_by integer references users(id) on delete set null,
+	assigned_to integer references users(id) on delete set null,
+	closed_by integer references users(id) on delete set null,
+	priority integer check(priority in (0, 1, 2, 3, 4, 5)) default 0,
+	status integer check(status >= 1 and status <= 10) default 1,
+	time_spent integer check(time_spent is null or time_spent > 0 and time_spent < 44640), -- one month
+	create_date integer,
+	plan_date integer,
+	close_date integer
+) strict;
+
+create table if not exists meetings (
+	id integer primary key autoincrement,
+	project_id integer references projects(id) on delete cascade,
+	name text not null check(trim(name) <> '' and length(name) < 4096),
+	description text check(description is null or length(description) < 4096),
+	created_by integer references users(id) on delete set null,
+	meet_date integer
+) strict;
+
+create table if not exists documents (
+	id integer primary key autoincrement,
+	project_id integer references projects(id) on delete cascade,
+	origin_group_id integer references groups(id) on delete set null,
+	origin_message_id integer,
+	group_id integer references groups(id) on delete set null,
+	message_id integer,
+	file_id integer,
+	access_hash integer,
+	filename text not null check(length(filename) < 256),
+	mime text check(mime is null or length(mime) < 128),
+	caption text check(caption is null or length(caption) < 4096),
+	size integer,
+	published_by integer references users(id) on delete set null, 
+	parent_type integer check(parent_type in (0, 1, 2)) default 0,
+	parent_id integer, 
+	backup_state integer default 0
+) strict;
+
+create table if not exists companies (
+	id integer primary key autoincrement,
+	project_id integer references projects(id) on delete cascade,
+	name text not null check(length(name) < 4096),
+	email text check(email is null or length(email) < 128),
+	phone text check(phone is null or length(phone) < 128),
+	site text check(site is null or length(site) < 128),
+	description text check(description is null or length(description) < 4096),
+	logo text
+) strict;
+
+create table if not exists company_mappings (
+	project_id integer references projects(id) on delete cascade,
+	company_id integer references companies(id) on delete cascade,
+	show_as_id integer references companies(id) on delete cascade,
+	show_to_id integer references companies(id) on delete cascade
+) strict;
+
+create table if not exists task_users (
+	task_id integer references tasks(id) on delete cascade,
+	user_id integer references users(id) on delete cascade,
+	primary key (task_id, user_id)
+) without rowid;
+
+create table if not exists meeting_users (
+	meeting_id integer references meetings(id) on delete cascade,
+	user_id integer references users(id) on delete cascade,
+	primary key (meeting_id, user_id)
+) without rowid;
+
+create table if not exists company_users (
+	company_id integer references companies(id) on delete cascade,
+	user_id integer references users(id) on delete cascade,
+	primary key (company_id, user_id)
+) without rowid;
+
+create table if not exists group_users (
+	group_id integer references groups(id) on delete cascade,
+	user_id integer references users(id) on delete cascade,
+	primary key (group_id, user_id)
+) without rowid;
+
+pragma foreign_keys = on;
+
+
+create trigger if not exists trg_groups_update after update
+on groups
+when NEW.project_id is null
+begin
+	delete from group_users where group_id = NEW.id;
+end;
+
+
+
+
+
+
--- a/backend/include/db.js
+++ b/backend/include/db.js
@@ -0,0 +1,57 @@
+const fs = require('fs')
+const crypto = require('crypto')
+const sqlite3 = require('better-sqlite3')
+
+const db = sqlite3(`./data/db.sqlite`)
+db.pragma('journal_mode = WAL')
+
+db.exec(fs.readFileSync('./data/init.sql', 'utf8'))
+
+/*
+db.exec(`attach database './data/backup.sqlite' as backup`)
+
+db.function('backup', (tblname, ...values) => {
+	db
+		.prepare(`insert into backup.${tblname} select ` + values.map(e => '?').join(', '))
+		.run(values)
+})
+
+const backupQuery = db
+	.prepare(`
+		select group_concat(tbl || char(13) || trg, char(13) || char(13)) from (
+		select 'create table if not exists backup.' || t.name || ' (' || group_concat(c.name || ' ' || c.type, ', ') || ', time integer);' tbl,
+		'create trigger if not exists trg_' || t.name || '_delete after delete on ' || t.name || ' for each row begin ' || 
+		' select backup (' || t.name || ',' || group_concat('OLD.' || c.name, ', ') || ', strftime(''%s'', ''now'')); end;' trg
+		from sqlite_master t left join pragma_table_xinfo c on t.tbl_name = c.arg and c.schema = 'main' 
+		where t.sql is not null and t.type = 'table' and t.name <> 'sqlite_sequence' 
+		group by t.type, t.name order by t.type, t.name)
+	`)
+	.pluck(true)
+	.get()
+db.exec(backupQuery)
+*/
+
+db.function('generate_key', (id, time) => {
+	return [
+		'KEY',
+		Buffer.from(time + '').toString('base64'),	
+		crypto.createHash('md5').update(`sa${time}-${id}lt`).digest('hex')
+	].join('-')
+})
+
+process.on('exit', () => db.close())
+process.on('SIGHUP', () => process.exit(128 + 1))
+process.on('SIGINT', () => process.exit(128 + 2))
+process.on('SIGTERM', () => process.exit(128 + 15))
+
+db.prepareUpdate = function (table, columns, data, where) {
+	const dataColumns = columns.filter(col => col in data)
+	if (dataColumns.length == 0)
+		throw Error('SQLite Error: No data to update')
+
+	return db.prepare(`update "${table}" ` +
+		`set ` + dataColumns.map(col => `"${col}" = :${col}`).join(', ') + 
+		` where ` + where.map(col => `"${col}" = :${col}`).join(' and ')) 		
+}
+
+module.exports = db
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
--- a/backend/package.json
+++ b/backend/package.json
@@ -0,0 +1,25 @@
+{
+  "name": "telegram-bot",
+  "version": "1.0.0",
+  "main": "app.js",
+  "directories": {
+    "doc": "docs"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC",
+  "description": "",
+  "dependencies": {
+    "better-sqlite3": "^11.8.0",
+    "body-parser": "^1.20.3",
+    "content-disposition": "^0.5.4",
+    "cookie-parser": "^1.4.7",
+    "express": "^4.21.2",
+    "express-session": "^1.18.1",
+    "multer": "^1.4.5-lts.1",
+    "nodemailer": "^6.9.16",
+    "telegram": "^2.26.16"
+  }
+}
--- a/backend/public/index.html
+++ b/backend/public/index.html
@@ -0,0 +1,337 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no" />
+    <meta name="format-detection" content="telephone=no" />
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta name="MobileOptimized" content="176" />
+    <meta name="HandheldFriendly" content="True" />
+    <meta name="robots" content="noindex,nofollow" />
+    <script src="https://telegram.org/js/telegram-web-app.js?56"></script>
+    <title></title>
+    <style>
+	*[hidden] {display: none;}
+	.block {border: 1px black solid; padding:10px; margin-bottom: 10px;}
+	#settings input {width: 45%;}
+	#delete {color:red; cursor: pointer; margin-left: 10px;}
+
+    </style>
+</head>
+
+<body>
+
+<div id = "adminapp"  hidden>
+	<b>Админка</b>
+	<div id = "settings" class = "block">
+		<b>Настройки</b><br>
+		<input id = "name" type = "text" placeholder = "Name">	
+		<div>
+			<button id = "upload-group" href = "">Не задано</button>
+			<button id = "upload-group-selector" href = "" admin>Задать</button>	
+		</div>
+		<b>Company</b>
+		<div id = "company">
+			<input id = "company-name" type = "text" placeholder = "Name">
+			<input id = "company-phone" type = "text" placeholder = "Phone">
+			<input id = "company-site" type = "text" placeholder = "Site">
+			<input id = "company-description" type = "text" placeholder = "Description">
+		</div>
+
+		<button id = "update-profile">Update</button>	
+	</div>
+
+	<div id = "projects" class = "block">
+		<b>Список проектов</b><button id = "add-project">Добавить/Обновить</button>
+		<br>
+		<input id = "project-id" placeholder = "Id">
+		<input id = "project-name" placeholder = "Name">
+		<input id = "project-description" placeholder = "Description">
+		<br>
+		<div id = "project-list">Loading...</div>
+	</div>
+
+	<div id = "groups" class = "block">
+		<b>Список групп</b><button id = "add-group" href="" admin>Добавить</button>
+		<br>
+		<div id = "group-list">Проект не выбран</div>
+		<button id = "share" href = "">Отправить ключ подключения</button>
+	</div>
+
+	<div id = "users" class = "block">
+		<b>Список пользователей</b>
+		<br>
+		<div id = "user-list">Проект не выбран</div>
+	</div>
+
+	<div id = "companies" class = "block">
+		<b>Список компаний</b><button id = "add-company">Добавить/Обновить</button>
+		<br>
+		<input id = "company-id" placeholder = "Id">
+		<input id = "company-name" placeholder = "Name">
+		<input id = "company-description" placeholder = "Description">
+		<br>
+		<div id = "company-list">Проект не выбран</div>
+	</div>
+</div>
+
+
+<div id = "miniapp" style = "min-height: 20px; border: 1px black solid; padding:10px; word-break: break-all;" hidden>
+Пользов
+</div>
+
+<script type="text/javascript">
+const $miniapp = document.getElementById('miniapp')
+const $adminapp = document.getElementById('adminapp')
+
+$adminapp.querySelector('#settings #update-profile').addEventListener('click', async function (event) {
+	const $e = this.parentNode
+	const data = {
+		name: $e.querySelector('#name').value,
+		company: {
+			name: $e.querySelector('#company-name').value,
+			phone: $e.querySelector('#company-phone').value,
+			site: $e.querySelector('#company-site').value,
+			description: $e.querySelector('#company-description').value
+		}
+	}
+
+	const res = await fetch('/api/admin/customer/profile', {
+		method: 'PUT', 
+		body: JSON.stringify(data),
+		headers: {
+			'Content-Type': 'application/json'
+		}
+	}).then(res => res.json())
+	console.log(res)
+})
+
+$adminapp.querySelector('#projects #project-list').addEventListener('click', async function (event) {
+	const $e = event.target
+	if ($e.id != 'delete')	
+		return
+
+	const id = $e.parentNode.id
+
+	const res = await fetch('/api/admin/project/' + id, {
+		method: 'DELETE'
+	}).then(res => res.json())
+	.then(res => $e.parentNode.remove())
+	.catch(alert)
+})
+
+$adminapp.querySelector('#projects #project-list').addEventListener('click', async function (event) {
+	const $e = event.target
+	if ($e.parentNode.id != 'project-list')	
+		return
+
+	$adminapp.querySelector('#projects #project-id').value = $e.id
+	$adminapp.querySelector('#projects #project-name').value = $e.getAttribute('name')
+	$adminapp.querySelector('#projects #project-description').value = $e.getAttribute('title')
+
+	$adminapp.querySelector('#groups #add-group').setAttribute('href', 'https://t.me/ready_or_not_2025_bot?startgroup=' + $e.id)
+
+	reloadGroups($e.id) 
+	reloadUsers($e.id)
+	reloadCompanies($e.id)
+
+	const reqKey = await fetch('/api/admin/project/' + $e.id + '/token').then(res => res.json())
+	const url = 'https://t.me/share/url?url=' + reqKey.data
+	$adminapp.querySelector('#groups #share').setAttribute('href', url)
+})
+
+$adminapp.querySelector('#companies #company-list').addEventListener('click', async function (event) {
+	const $e = event.target
+	if ($e.id != 'delete')	
+		return
+
+	const id = $e.parentNode.id
+	const project_id = $adminapp.querySelector('#groups #group-list').getAttribute('project-id')
+
+	const res = await fetch(`/api/admin/project/${project_id}/company/${id}`, {
+		method: 'DELETE'
+	}).then(res => res.json())
+	.then(res => $e.parentNode.remove())
+	.catch(alert)
+})
+
+$adminapp.querySelector('#companies #company-list').addEventListener('click', async function (event) {
+	const $e = event.target
+	if ($e.parentNode.id != 'company-list')	
+		return
+
+	$adminapp.querySelector('#companies #company-id').value = $e.id
+	$adminapp.querySelector('#companies #company-name').value = $e.getAttribute('name')
+	$adminapp.querySelector('#companies #company-description').value = $e.getAttribute('title')
+})
+
+$adminapp.querySelector('#groups #group-list').addEventListener('click', async function (event) {
+	const $e = event.target
+	if ($e.id != 'delete')	
+		return
+
+	const id = $e.parentNode.id
+	const project_id = $adminapp.querySelector('#groups #group-list').getAttribute('project-id')
+
+	const res = await fetch(`/api/admin/project/${project_id}/group/${id}`, {
+		method: 'DELETE'
+	}).then(res => res.json())
+	.then(res => $e.parentNode.remove())
+	.catch(alert)
+})
+
+$adminapp.querySelectorAll('button[href]')
+	.forEach($e => {
+		$e.addEventListener('click', async function (event) {
+			// &admin=change_info+delete_messages+restrict_members+invite_users+pin_messages+promote_members
+			let url = this.getAttribute('href') 
+			if ($e.hasAttribute('admin'))
+				url += '&admin=change_info+pin_messages'
+			window.Telegram.WebApp.openTelegramLink(url)
+		})
+
+	})
+
+async function reloadProjects() {
+	const reqProjects = await fetch('/api/admin/project').then(res => res.json())
+
+	const projects = reqProjects.data
+	const $projectList = $adminapp.querySelector('#projects #project-list')
+	$projectList.innerHTML = projects.map(e => `<div id = "${e.id}" title = "${e.description}" name = "${e.name}">${e.name}<span id = "delete">x</div></div>`).join('') || 'Пусто'
+}
+
+async function reloadGroups(projectId) {
+	const req = await fetch('/api/admin/project/' + projectId + '/group').then(res => res.json())
+
+	const groups = req.data
+	const $groupList = $adminapp.querySelector('#groups #group-list')
+	$groupList.setAttribute('project-id', projectId)
+	$groupList.innerHTML = groups.map(e => `<div id = "${e.id}" name = "${e.name}">${e.name}<span id = "delete">x</div></div>`).join('') || 'Пусто'
+}
+
+async function reloadCompanies(projectId) {
+	const req = await fetch('/api/admin/project/' + projectId + '/company').then(res => res.json())
+
+	const companies = req.data
+	const $companyList = $adminapp.querySelector('#companies #company-list')
+	$companyList.setAttribute('project-id', projectId)
+	$companyList.innerHTML = companies.map(e => `<div id = "${e.id}" name = "${e.name}" title = "${e.description}">${e.name}<span id = "delete">x</div></div>`).join('') || 'Пусто'
+}
+
+async function reloadUsers(projectId) {
+	const req = await fetch('/api/admin/project/' + projectId + '/user').then(res => res.json())
+
+	const users = req.data
+	const $userList = $adminapp.querySelector('#users #user-list')
+	$userList.setAttribute('user-id', projectId)
+	$userList.innerHTML = users.map(e => `<div id = "${e.id}">${e.firstname} ${e.lastname}</div>`).join('') || 'Пусто'
+}
+
+$adminapp.querySelector('#projects #add-project').addEventListener('click', async function (event) {
+	const $e = this.parentNode
+	const id = +$e.querySelector('#project-id').value
+
+	const data = {
+		name: $e.querySelector('#project-name').value,
+		description: $e.querySelector('#project-description').value
+	}
+
+	const url = id ? '/api/admin/project/' + id : '/api/admin/project'
+	const method = id ? 'PUT' : 'POST'
+
+	
+	await fetch(url, {
+		method, 
+		body: JSON.stringify(data),
+		headers: {
+			'Content-Type': 'application/json'
+		}
+	}).then(res => res.json()).then(() => {
+		reloadProjects()
+		$e.querySelector('#project-id').value = ''
+		$e.querySelector('#project-name').value = ''
+		$e.querySelector('#project-description').value = ''
+	}).catch(alert)
+})
+
+$adminapp.querySelector('#companies #add-company').addEventListener('click', async function (event) {
+	const $e = this.parentNode
+	const project_id = +$adminapp.querySelector('#groups #group-list').getAttribute('project-id')
+	const id = +$e.querySelector('#company-id').value
+
+	const data = {
+		name: $e.querySelector('#company-name').value,
+		description: $e.querySelector('#company-description').value
+	}
+
+	const url = '/api/admin/project/' + project_id + '/company' + (id ? '/' + id : '')
+	const method = id ? 'PUT' : 'POST'
+ 
+	
+	await fetch(url, {
+		method, 
+		body: JSON.stringify(data),
+		headers: {
+			'Content-Type': 'application/json'
+		}
+	}).then(res => res.json()).then(() => {
+		reloadCompanies(project_id)
+		$e.querySelector('#company-id').value = ''
+		$e.querySelector('#company-name').value = ''
+		$e.querySelector('#company-description').value = ''
+	}).catch(alert)
+})
+
+try {
+
+
+
+
+(async () => {
+	const startParams = (Telegram.WebApp.initDataUnsafe.start_param || '').split('_')
+	const isAdmin = startParams[0] == 'admin'
+	const $app = isAdmin ? $adminapp : $miniapp
+	$app.hidden = false
+
+	const login_url = isAdmin ? '/api/admin/customer/login?' : '/api/miniapp/user/login?'
+	const login = await fetch(login_url + Telegram.WebApp.initData, {method: 'POST'}).then(res => res.json())
+	console.log(login)
+
+
+	if (isAdmin) {
+		const reqProfile = await fetch('/api/admin/customer/profile').then(res => res.json())
+		const profile = reqProfile.data
+
+		$adminapp.querySelector('#settings #name').value = profile.name || ''
+		$adminapp.querySelector('#settings #company-name').value = profile.company?.name || ''
+		$adminapp.querySelector('#settings #company-phone').value = profile.company?.phone || ''
+		$adminapp.querySelector('#settings #company-site').value = profile.company?.site || ''
+		$adminapp.querySelector('#settings #company-description').value = profile.company?.description || ''
+		$adminapp.querySelector('#settings #upload-group-selector').setAttribute('href', 'https://t.me/ready_or_not_2025_bot?startgroup=-' + profile.id)
+		
+		const $uploadGroup = $adminapp.querySelector('#settings #upload-group')
+		if (profile.upload_group) {
+			$uploadGroup.innerHTML = profile.upload_group.name || 'Ошибка'
+			$uploadGroup.setAttribute('href', 'https://t.me/c/' + profile.upload_group.telegram_id)
+		} else {
+			$uploadGroup.innerHTML = 'Не задано'
+			$uploadGroup.setAttribute('href', '')
+		}
+
+		await reloadProjects()
+	} else {
+		// Пользовательский
+		if (startParams[1])
+			alert('Группа на проекте ' + startParams[1])
+	}
+})()
+
+	
+} catch (err) {
+	alert(err)
+}
+
+</script>
+
+</body>
+</html>
--- a/backend/public/miniapp.html
+++ b/backend/public/miniapp.html
@@ -0,0 +1,65 @@
+ <!DOCTYPE html>
+<html>
+<body>
+<style>
+	.block {margin-bottom: 10px}
+	#projects > div {cursor: pointer}
+</style>
+<div class = "block">
+	<label for = "user">USER</label>
+	<select id = "user"></select>
+</div>
+
+<div class = "block">
+	<div id = "project-title">ПРОЕКТЫ</div>
+	<div id = "projects">EMPTY</div>
+</div>
+
+<div class = "block">
+	<div id = "member-title">УЧАСТНИКИ</div>
+	<div id = "members"></div>
+</div>
+
+
+<script type="text/javascript">
+(async function () {
+	try {
+		const $user = document.getElementById('user')
+		const $projects = document.getElementById('projects')
+		const $members = document.getElementById('members')
+
+		let members = {}
+
+		$user.addEventListener('change', async () => {
+			const user_id = $user.value
+			const projects = await fetch('/api/miniapp/project?user_id=' + user_id).then(res => res.json())
+			$projects.innerHTML = projects.data.map(e => 
+				`<div id = "${e.id}" title = '${JSON.stringify(e)}'>${e.name} - ${e.description}</div>`
+			).join('')
+			$members.innerHTML = ''
+		})
+
+		$projects.addEventListener('click', async (evt) => {
+			if (evt.target.parentNode != $projects)
+				return
+
+			const _members = await fetch('/api/miniapp/project/' + evt.target.id + '/member?user_id=' + $user.value).then(res => res.json())
+			members = _members.data
+			$members.innerHTML = members.map(e => 
+				`<div id = "${e.id}" title = '${JSON.stringify(e)}' is-blocked = '${e.is_blocked}'>${e.id} - ${e.telegram_name}</div>`
+			).join('')
+		})
+
+
+		const user_ids = await fetch('/api/miniapp/user').then(res => res.json())
+		$user.innerHTML = user_ids.data.map(id => `<option value = '${id}'>${id}</option>`).join('')
+		$user.dispatchEvent(new Event('change'))
+	} catch (err) {
+		console.error(err)
+		alert(err.message)
+	}
+})();
+</script>
+
+</body>
+</html>