before delete 3software

backend/apps/miniapp.js

@@ -1,11 +1,12 @@
 const express = require('express')
 const multer = require('multer')
 const crypto = require('crypto')
-const fs = require('fs')
 const contentDisposition = require('content-disposition')
 
 const bot = require('./bot')
 const db = require('../include/db')
+const log = require('../include/log')
+const eventBus = require('../include/eventbus')
 
 const app = express.Router()
 const upload = multer({
@@ -15,23 +16,47 @@ const upload = multer({
 	}
 })
 
+const sessions = {}
+
+function registerWS(sid, ws) {
+	const session = sessions[sid]
+	if (session) 
+		session.ws = ws
+
+	return !!session
+}
+
 function hasAccess(project_id, user_id) {
-	return  !!db
+	return !!db
+		.prepare(`select 1 from projects where id = :project_id and is_archived <> 1`)
+		.pluck(true)
+		.get({project_id}) &&
+		!!db
 		.prepare(`
 			select 1 
 			  from chat_users 
 			 where user_id = :user_id and 
 			       chat_id in (select id from chats where project_id = :project_id) and
-			       not exists(select 1 from user_details where user_id = :user_id and project_id = :project_id and is_blocked = 1) and
-			       not exists(select 1 from projects where id = :project_id and is_deleted = 1)	
+			       not exists(select 1 from user_details where user_id = :user_id and project_id = :project_id and is_blocked = 1)
 		`)
+		.pluck(true)
 		.get({project_id, user_id})
 }
 
-const sessions = {}
+function getUserInfo (user_id, project_id) {
+	const user = db
+		.prepare(`
+			select u.telegram_id, coalesce(ud.fullname, coalesce(u.lastname, '') || ' ' || coalesce(u.firstname, '')) name 
+			from users u left join user_details ud on u.id = ud.user_id and ud.project_id = :project_id 
+			where u.id = :user_id
+		`)
+		.safeIntegers(true)
+		.get({ user_id, project_id })
+	return user
+}
 
 app.use((req, res, next) => {
-	if (req.path == '/user/login')
+	if (req.path == '/auth')
 		return next()
 
 	const sid = req.query.sid || req.cookies.sid
@@ -43,8 +68,7 @@ app.use((req, res, next) => {
 	next()
 })
 
-
-app.post('/user/login', (req, res, next) => {
+app.post('/auth', (req, res, next) => {
 	db
 		.prepare(`insert or ignore into users (telegram_id) values (:telegram_id)`)
 		.safeIntegers(true)
@@ -58,18 +82,16 @@ app.post('/user/login', (req, res, next) => {
 
 	const sid = crypto.randomBytes(64).toString('hex')
 	req.session = sessions[sid] = {sid, user_id}
-	res.setHeader('Set-Cookie', [`sid=${sid};httpOnly;path=/`])
+	res.setHeader('Set-Cookie', [`sid=${sid};httpOnly;path=/api/miniapp`])
 	res.locals.user_id = user_id
  
-	res.status(200).json({success: true})
+	res.status(200).json({ success: true })
 })
 
 app.get('/project', (req, res, next) => {
-	const where = req.query.id ? ' and p.id = ' + parseInt(req.query.id) : ''
-
 	const rows = db
 		.prepare(`
-			select p.id, p.name, p.description, p.logo, 
+			select p.id, p.name, p.description, p.logo, p.is_logo_bg, company_id,
 				c.name customer_name, c.upload_chat_id <> 0 has_upload
 			from projects p
 			inner join customers c on p.customer_id = c.id
@@ -78,18 +100,15 @@ app.get('/project', (req, res, next) => {
 				  from chats 
 				 where id in (select chat_id from chat_users where user_id = :user_id)
 			) and not exists(select 1 from user_details where user_id = :user_id and project_id = p.id and is_blocked = 1)
-			${where} and is_deleted <> 1
+			and p.is_archived <> 1
 		`)
 		.all(res.locals)
 
-	if (where && rows.length == 0)
-		throw Error('NOT_FOUND::404')
+	rows.forEach(row => {
+		row.is_logo_bg = Boolean(row.is_logo_bg)		
+	})
 
-	res.status(200).json({success: true, data: where ? rows[0] : rows})
-})
-
-app.get('/project/:pid(\\d+)', (req, res, next) => {
-	res.redirect(req.baseUrl + `/project?id=${req.params.pid}`)
+	res.status(200).json({success: true, data: rows})
 })
 
 app.use('/project/:pid(\\d+)/*', (req, res, next) => {
@@ -99,17 +118,27 @@ app.use('/project/:pid(\\d+)/*', (req, res, next) => {
 		throw Error('ACCESS_DENIED::401')
 
 	const row = db
-		.prepare('select customer_id from projects where id = :project_id')
+		.prepare('select customer_id, company_id from projects where id = :project_id')
 		.get(res.locals)
-		
+
 	res.locals.customer_id = row.customer_id
+	res.locals.customer_company_id = row.company_id
 
 	next()
 })
 
-app.get('/project/:pid(\\d+)/user', (req, res, next) => {
-	const where = req.query.id ? ' and u.id = ' + parseInt(req.query.id) : ''
+function getUserCompanyId(user_id, project_id) {
+	return db
+		.prepare(`
+			select company_id 
+			from company_users 
+			where user_id = :user_id and company_id in (select id from companies where project_id = :project_id)
+		`)
+		.pluck(true)
+		.get({ user_id, project_id })
+} 
 
+app.get('/project/:pid(\\d+)/user', (req, res, next) => {
 	const users = db
 		.prepare(` 
 			with actuals (user_id) as (
@@ -125,7 +154,7 @@ app.get('/project/:pid(\\d+)/user', (req, res, next) => {
 				union
 				select created_by from meetings where project_id = :project_id
 				union 
-				select published_by from documents where project_id = :project_id
+				select published_by from files where project_id = :project_id
 			),
 			members (user_id, is_leave) as ( 
 				select user_id, 0 is_leave from actuals
@@ -138,8 +167,9 @@ app.get('/project/:pid(\\d+)/user', (req, res, next) => {
 				u.firstname,
 				u.lastname,
 				u.photo,
-				u.json_phone_projects,
 				ud.fullname,
+				ud.email,
+				ud.phone,
 				ud.role,
 				ud.department,
 				ud.is_blocked,
@@ -150,138 +180,189 @@ app.get('/project/:pid(\\d+)/user', (req, res, next) => {
 				m.is_leave
 			from users u 
 			inner join members m on u.id = m.user_id 
-			left join user_details ud on ud.user_id = u.id and ud.project_id = :project_id
-			where 1 = 1 ${where}	
+			left join user_details ud on ud.user_id = u.id and ud.project_id = :project_id	
 		`)
+		.safeIntegers(true)
 		.all(res.locals)
 
-	const companies = db
-		.prepare('select id, name, email, phone, site, description from companies where project_id = :project_id')
+	res.locals.company_id = getUserCompanyId(res.locals.user_id, res.locals.project_id)
+
+	// Список компаний, которые НЕ ВИДНЫ компании пользователя на проекте
+	const hidden = db
+		.prepare(`
+			select company_id from company_mappings where project_id = :project_id
+			except
+			select company_id from company_mappings where project_id = :project_id and show_to_id = :company_id`)	
+		.pluck(true)
 		.all(res.locals) 
-		.reduce((companies, row) => {
-			companies[row.id] = row
-			return companies
-		}, {})
+	
+	users
+		.filter(user => user.company_id) 	
+		.filter(user => hidden.indexOf(user.company_id) != -1)
+		.forEach(user => user.company_id = res.locals.customer_company_id) 	
 
-	const mappings = {}
-	const company_id = users.find(m => m.id == res.locals.user_id).company_id
-	if (company_id) {
-		res.locals.company_id = company_id
-
-		db
-			.prepare('select show_as_id, show_to_id from company_mappings where project_id = :project_id and company_id = :company_id')
-			.all(res.locals)
-			.forEach(row => mappings[row.show_to_id] = row.show_to_id)	
-	}
-
-	users.forEach(m => {
-		m.company = companies[mappings[m.company_id] || m.company_id]
-		delete m.company_id
-	})
-
-	users.forEach(m => {
-		const isHide = JSON.parse(m.json_phone_projects || []).indexOf(res.locals.project_id) == -1
-		if (isHide)
-			delete m.phone
-		delete m.json_phone_projects
-	})
-
-	if (where && users.length == 0)
-		throw Error('NOT_FOUND::404')
-
-	res.status(200).json({success: true, data: where ? users[0] : users})
+	res.status(200).json({success: true, data: users})
 })
 
 app.get('/project/:pid(\\d+)/user/reload', async (req, res, next) => {
-	const chatIds = db
-		.prepare(`select id from chats where project_id = :project_id`)
-		.all(res.locals)
-		.map(e => e.id)
+	try {
+		const chat_ids = db
+			.prepare(`select id from chats where project_id = :project_id`)
+			.all(res.locals)
+			.map(e => e.id)
 
-	const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
+		const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
 
-	for (const chatId of chatIds) {
-		await bot.reloadGroupUsers(chatId)
-		await sleep(1000)		
-	}
+		for (const chat_id of chat_ids) {
+			await bot.reloadChatUsers(chat_id)
+			await sleep(1000)		
+		}
 
-	res.status(200).json({success: true})	
+		res.status(200).json({success: true})	
+	} catch (err) {
+		next(err)
+	}	
 })
 
-app.get('/project/:pid(\\d+)/chat', (req, res, next) => {
-	const where = req.query.id ? ' and id = ' + parseInt(req.query.id) : ''
-
+app.get('/project/:pid(\\d+)/company', (req, res, next) => {
+	res.locals.company_id = getUserCompanyId(res.locals.user_id, res.locals.project_id)
+	
 	const rows = db
 		.prepare(`
-			select id, name, telegram_id 
-			 from chats 
-			where project_id = :project_id and id in (select chat_id from chat_users where user_id = :user_id)
-			      ${where}
+			select id, name, address, email, phone, site, description 
+			from companies 
+			where project_id = :project_id and (
+				id = :company_id or
+				id in (select company_id from company_mappings where project_id = :project_id and show_to_id = :company_id) or
+				id not in (select company_id from company_mappings where project_id = :project_id) or
+				(select :customer_company_id) 
+			) 
 		`)
 		.all(res.locals) 
-
-	if (where && rows.length == 0)
-		throw Error('NOT_FOUND::404')
-
-	res.status(200).json({success: true, data: where ? rows[0] : rows})
+		
+	res.status(200).json({success: true, data: rows})
 })
 
-app.get('/project/:pid(\\d+)/chat/:gid(\\d+)', (req, res, next) => {
-	res.redirect(req.baseUrl + `/project/${req.params.pid}/chat?id=${req.params.gid}`)
+// CHAT
+app.get('/project/:pid(\\d+)/chat', (req, res, next) => {
+	const rows = db
+		.prepare(`
+			select id, name, invite_link, description, telegram_id, owner_id, user_count, logo, 
+				(select json_group_array(user_id) from chat_users where chat_id = c.id) users,
+				(select count(1) from tasks where project_id = :project_id and chat_id = c.id) task_count 
+			from chats c
+			where project_id = :project_id and id in (select chat_id from chat_users where user_id = :user_id)
+		`)
+		.safeIntegers(true)
+		.all(res.locals) 
+
+	rows.forEach(row => {
+		row.users = JSON.parse(row.users)
+	})		
+
+	res.status(200).json({success: true, data: rows})
 })
 
 // TASK
-app.get('/project/:pid(\\d+)/task', (req, res, next) => {
-	const where = req.query.id ? ' and t.id = ' + parseInt(req.query.id) : ''
+function getTask(id, user_id) {
+	const row = db
+		.prepare(`
+			select id, name, description, created_by, assigned_to, priority, status, time_spent, create_date, plan_date, 
+			close_date, close_comment, coalesce(json_close_files, '[]') close_files, chat_id,
+			(select json_group_array(user_id) from task_users where task_id = t.id) observers,
+			(select json_group_array(id) from files where parent_type = 1 and parent_id = t.id) files
+			from tasks t
+			where t.id = :id
+		`)
+		.get({id})
 
+	if (!row)
+		throw Error('NOT_FOUND::404')
+
+	row.close_files = JSON.parse(row.close_files)
+	row.observers = JSON.parse(row.observers)
+	row.files = JSON.parse(row.files)
+	row.is_editable = row.created_by == user_id || row.assigned_to == user_id
+	
+	return row
+}
+
+app.get('/project/:pid(\\d+)/task', (req, res, next) => {
 	const rows = db
 		.prepare(`
-			select id, name, created_by, assigned_to, priority, status, time_spent, create_date, plan_date, close_date,
-			(select json_chat_array(user_id) from task_users where task_id = t.id) observers,
-			(select json_chat_array(id) from documents where parent_type = 1 and parent_id = t.id) attachments
+			select id, name, description, created_by, assigned_to, priority, status, time_spent, create_date, plan_date, 
+			close_date, close_comment, coalesce(json_close_files, '[]') close_files, chat_id,
+			(select json_group_array(user_id) from task_users where task_id = t.id) observers,
+			(select json_group_array(id) from files where parent_type = 1 and parent_id = t.id) files
 			from tasks t
-			where project_id = :project_id and
-			      (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = t.id and user_id = :user_id))
-			      ${where}
+			where project_id = :project_id and (created_by = :user_id or 
+				  assigned_to = :user_id or 
+				  exists(select 1 from task_users where task_id = t.id and user_id = :user_id) or
+				  exists(select 1 from chat_users where chat_id = t.chat_id))
 		`)
 		.all(res.locals) 
 	
 	rows.forEach(row => {
+		row.close_files = JSON.parse(row.close_files)
 		row.observers = JSON.parse(row.observers)
-		row.attachments = JSON.parse(row.attachments)
+		row.files = JSON.parse(row.files)
 	})
 
-	if (where && rows.length == 0)
-		throw Error('NOT_FOUND::404')
-
-	res.status(200).json({success: true, data: where ? rows[0] : rows})
+	res.status(200).json({success: true, data: rows})
 })
 
-app.get('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
-	res.redirect(req.baseUrl + `/project/${req.params.pid}/task?id=${req.params.tid}`)
-})
+app.post('/project/:pid(\\d+)/task', async (req, res, next) => {
+	try {
+		res.locals.name = req.body?.name
+		res.locals.description = req.body?.description
+		res.locals.status = parseInt(req.body?.status)
+		res.locals.priority = parseInt(req.body?.priority)
+		res.locals.assigned_to = req.body?.assigned_to ? parseInt(req.body?.assigned_to) : undefined
+		res.locals.create_date = Math.floor(Date.now() / 1000)
+		res.locals.plan_date = req.body?.plan_date ? parseInt(req.body?.plan_date) : undefined
+		res.locals.chat_id = req.body?.chat_id ? parseInt(req.body?.chat_id) : undefined
+		
+		if (res.locals.assigned_to && !hasAccess(res.locals.project_id, res.locals.assigned_to)) 
+			throw Error('INCORRECT_ASSIGNED_TO::400')
 
-app.post('/project/:pid(\\d+)/task', (req, res, next) => {
-	res.locals.name = req.body?.name	
-	res.locals.status = parseInt(req.body?.status)
-	res.locals.priority = parseInt(req.body?.priority)
-	res.locals.assigned_to = req.body?.assigned_to ? parseInt(req.body?.assigned_to) : undefined
-	res.locals.create_date = Math.floor(Date.now() / 1000)
-	res.locals.plan_date = req.body?.plan_date ? parseInt(req.body?.plan_date) : undefined
-	
-	if (res.locals.assigned_to && !hasAccess(res.locals.project_id, res.locals.assigned_to)) 
-		throw Error('INCORRECT_ASSIGNED_TO::400')
+		if (res.locals.chat_id && !db.prepare(`select id from chats where project_id = :project_id and id = :chat_id`).pluck(true).get(res.locals)) 
+			throw Error('INCORRECT_CHAT_ID::400')
 
-	const id = db
-		.prepare(`
-			insert into tasks (project_id, name, created_by, assigned_to, priority, status, create_date, plan_date) 
-			values (:project_id, :name, :user_id, :assigned_to, :priority, :status, :create_date, :plan_date) 
-			returning id
-		`)
-		.pluck(true)
-		.get(res.locals)
+		const id = db
+			.prepare(`
+				insert into tasks (project_id, name, description, created_by, assigned_to, priority, status, create_date, plan_date, chat_id) 
+				values (:project_id, :name, :description, :user_id, :assigned_to, :priority, :status, :create_date, :plan_date, :chat_id) 
+				returning id
+			`)
+			.pluck(true)
+			.get(res.locals)
 
-	res.status(200).json({success: true, data: id})
+		const task = getTask(id, res.locals.user_id)
+		if (res.locals.chat_id) {
+			const creator = getUserInfo(task.created_by, task.project_id)
+			const assignee = getUserInfo(task.assigned_to, task.project_id)
+			
+			const args = {
+				PRIORITY: '$TASK_PRIORITY_' + (task.priority || '0'),
+				NAME: task.name,
+				PLAN_DATE: new Date(task.plan_date * 1000).toLocaleString('ru'),
+				CREATOR: creator.name,
+				CREATOR_ID: creator.telegram_id,
+				ASSIGNEE: assignee.name,
+				ASSIGNEE_ID: assignee.telegram_id,
+				URL: bot.USER_APP + '/?startapp=p' + res.locals.project_id + 't' + task.id
+			}
+			
+			message_id = await bot.sendMessage(res.locals.chat_id, 'TASK_MESSAGE', args)
+			db
+				.prepare(`update tasks set message_id = :message_id where id = :id`)
+				.run({ id, message_id})
+		}
+
+		res.status(200).json({success: true, data: task})
+	} catch (err) {
+		next (err)
+	}
 })
 
 app.use('/project/:pid(\\d+)/task/:tid(\\d+)*', (req, res, next) => {
@@ -290,9 +371,12 @@ app.use('/project/:pid(\\d+)/task/:tid(\\d+)*', (req, res, next) => {
 	const task = db
 		.prepare(`
 			select created_by, assigned_to 
-			  from tasks 
-			 where id = :task_id and project_id = :project_id 
-			       and (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = :task_id and user_id = :user_id))
+			  from tasks t
+			 where id = :task_id and project_id = :project_id and (
+			 	created_by = :user_id or 
+				assigned_to = :user_id or 
+				exists(select 1 from task_users where task_id = :task_id and user_id = :user_id) or
+				exists(select 1 from chat_users where chat_id = t.chat_id))
 		`)
 		.get(res.locals)
 
@@ -305,18 +389,43 @@ app.use('/project/:pid(\\d+)/task/:tid(\\d+)*', (req, res, next) => {
 	next()
 })
 
+app.get('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
+	const task = getTask(req.params.tid, res.locals.user_id)
+	res.status(200).json({success: true, data: task})
+})
+
 app.put('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
 	if (!res.locals.is_author && !res.locals.is_assigned)
 		throw Error('ACCESS_DENIED::401')
 
 	res.locals.id = res.locals.task_id
 	res.locals.name = req.body?.name	
+	res.locals.description = req.body?.description
 	res.locals.status = parseInt(req.body?.status)
 	res.locals.priority = parseInt(req.body?.priority)
 	res.locals.assigned_to = req.body?.assigned_to ? parseInt(req.body?.assigned_to) : undefined
 	res.locals.plan_date = req.body?.plan_date ? parseInt(req.body?.plan_date) : undefined
+	res.locals.close_comment = req.body?.close_comment
+	res.locals.json_close_files = null
+	res.locals.chat_id = req.body?.chat_id ? parseInt(req.body?.chat_id) : undefined
+	
+	if (res.locals.chat_id && !db.prepare(`select id from chats where project_id = :project_id and id = :chat_id`).pluck(true).get(res.locals)) 
+		throw Error('INCORRECT_CHAT_ID::400')
 
-	const columns = res.locals.is_author ? ['name', 'assigned_to', 'priority', 'status', 'plan_date', 'time_spent'] : ['status', 'time_spent']
+	if (req.body?.close_files instanceof Array) {
+		const file_ids = db
+			.prepare(`select id from files where parent_type = 1 and parent_id = :task_id`)
+			.pluck(true)
+			.all(res.locals)
+
+		const close_files = req.body.close_files
+			.map(id => parseInt(id))
+			.filter(id => file_ids.indexOf(id) != -1)	
+
+		res.json_close_files	= JSON.stringify(close_files)
+	} 
+
+	const columns = res.locals.is_author ? ['name', 'description', 'assigned_to', 'priority', 'status', 'plan_date', 'time_spent', 'close_comment', 'json_close_files', 'chat_id'] : ['status', 'time_spent', 'close_comment', 'json_close_file_ids']
 	const info = db
 		.prepareUpdate('tasks', columns, res.locals, ['id', 'project_id'])
 		.run(res.locals)
@@ -324,7 +433,8 @@ app.put('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
 	if (info.changes == 0) 
 		throw Error('NOT_FOUND::404')
 
-	res.status(200).json({success: true})
+	const task = getTask(res.locals.task_id, res.locals.user_id)
+	res.status(200).json({success: true, data: task})
 })
 
 app.delete('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
@@ -338,7 +448,7 @@ app.delete('/project/:pid(\\d+)/task/:tid(\\d+)', (req, res, next) => {
 	if (info.changes == 0) 
 		throw Error('NOT_FOUND::404')
 			 
-	res.status(200).json({success: true})
+	res.status(200).json({success: true, data: {id: res.locals.task_id}})
 })
 
 app.put('/project/:pid(\\d+)/task/:tid(\\d+)/observer', (req, res, next) => {
@@ -373,51 +483,82 @@ app.put('/project/:pid(\\d+)/task/:tid(\\d+)/observer', (req, res, next) => {
 })
 
 // MEETINGS
-app.get('/project/:pid(\\d+)/meeting', (req, res, next) => {
-	const where = req.query.id ? ' and m.id = ' + parseInt(req.query.id) : ''
+function getMeeting(id, user_id) {
+	const row = db
+		.prepare(`
+			select id, name, description, place, created_by, meet_date, chat_id, is_cancel,
+			(select json_group_array(user_id) from meeting_users where meeting_id = m.id) participants,
+			(select json_group_array(id) from files where parent_type = 2 and parent_id = m.id) files
+			from meetings m
+			where m.id = :id
+		`)
+		.get({id})
 
+	if (!row)
+		throw Error('NOT_FOUND::404')
+
+	row.participants = JSON.parse(row.participants)
+	row.files = JSON.parse(row.files)
+	row.is_editable = row.created_by == user_id
+	
+	return row
+}
+
+app.get('/project/:pid(\\d+)/meeting', (req, res, next) => {
 	const rows = db
 		.prepare(`
-			select id, name, description, created_by, meet_date,
-			(select json_chat_array(user_id) from meeting_users where meeting_id = m.id) participants,
-			(select json_chat_array(id) from documents where parent_type = 2 and parent_id = m.id) attachments
+			select id, name, description, place, created_by, meet_date, duration, chat_id, is_cancel,
+			(select json_group_array(user_id) from meeting_users where meeting_id = m.id) participants,
+			(select json_group_array(id) from files where parent_type = 2 and parent_id = m.id) files,
+			created_by = :user_id is_editable
 			from meetings m
 			where project_id = :project_id and
 			      (created_by = :user_id or exists(select 1 from meeting_users where meeting_id = m.id and user_id = :user_id))
-			      ${where}
 		`)
 		.all(res.locals) 
 	
 	rows.forEach(row => {
 		row.participants = JSON.parse(row.participants)
-		row.attachments = JSON.parse(row.attachments)
+		row.files = JSON.parse(row.files)
+		row.is_editable = Boolean(row.is_editable)
 	})
 
-	if (where && rows.length == 0)
-		throw Error('NOT_FOUND::404')
-
-	res.status(200).json({success: true, data: where ? rows[0] : rows})
+	res.status(200).json({success: true, data: rows})
 })
 
-app.get('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
-	res.redirect(req.baseUrl + `/project/${req.params.pid}/meeting?id=${req.params.mid}`)
-})
+app.post('/project/:pid(\\d+)/meeting', async (req, res, next) => {
+	try {
+		res.locals.name = req.body?.name	
+		res.locals.description = req.body?.description
+		res.locals.place = req.body?.place
+		res.locals.meet_date = req.body?.meet_date ? parseInt(req.body?.meet_date) : undefined
+		res.locals.duration = req.body?.duration ? parseInt(req.body?.duration) : undefined
+		res.locals.chat_id = req.body?.chat_id ? parseInt(req.body?.chat_id) : undefined
+		
+		if (res.locals.chat_id && !db.prepare(`select id from chats where project_id = :project_id and id = :chat_id`).pluck(true).get(res.locals)) 
+			throw Error('INCORRECT_CHAT_ID::400')	
 
-app.post('/project/:pid(\\d+)/meeting', (req, res, next) => {
-	res.locals.name = req.body?.name	
-	res.locals.description = req.body?.description
-	res.locals.meet_date = req.body?.meet_date ? parseInt(req.body?.meet_date) : undefined
+		const id = db
+			.prepare(`
+				insert into meetings (project_id, name, description, place, created_by, meet_date, duration, chat_id) 
+				values (:project_id, :name, :description, :place, :user_id, :meet_date, :duration, :chat_id) 
+				returning id
+			`)
+			.pluck(true)
+			.get(res.locals)
 
-	const id = db
-		.prepare(`
-			insert into meetings (project_id, name, description, created_by, meet_date) 
-			values (:project_id, :name, :description, :user_id, :meet_date) 
-			returning id
-		`)
-		.pluck(true)
-		.get(res.locals)
-
-	res.status(200).json({success: true, data: id})
+		const meeting = getMeeting(id, res.locals.user_id)	
+		if (res.locals.chat_id) {
+			const url = bot.USER_APP + '/?startapp=p' + res.locals.project_id + 'm' + meeting.id
+			message_id = await bot.sendMessage(res.locals.chat_id, 'MEETING_MESSAGE', meeting)
+			db
+				.prepare(`update meetings set message_id = :message_id where id = :id`)
+				.run({ id, message_id})
+		}		
+		res.status(200).json({success: true, data: meeting})
+	} catch (err) {
+		next(err)
+	}
 })
 
 app.use('/project/:pid(\\d+)/meeting/:mid(\\d+)*', (req, res, next) => {
@@ -440,6 +581,11 @@ app.use('/project/:pid(\\d+)/meeting/:mid(\\d+)*', (req, res, next) => {
 	next()
 })
 
+app.get('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
+	const meeting = getMeeting(req.params.mid, res.locals.user_id)
+	res.status(200).json({success: true, data: meeting})
+})
+
 app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
 	if (!res.locals.is_author)
 		throw Error('ACCESS_DENIED::401')
@@ -447,16 +593,23 @@ app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
 	res.locals.id = res.locals.meeting_id
 	res.locals.name = req.body?.name	
 	res.locals.description = req.body?.description
+	res.locals.place = req.body?.place
 	res.locals.meet_date = req.body?.meet_date ? parseInt(req.body?.meet_date) : undefined
+	res.locals.chat_id = req.body?.chat_id ? parseInt(req.body?.chat_id) : undefined
+	res.locals.is_cancel = +!!req.body?.is_cancel
+	
+	if (res.locals.chat_id && !db.prepare(`select id from chats where project_id = :project_id and id = :chat_id`).pluck(true).get(res.locals)) 
+		throw Error('INCORRECT_CHAT_ID::400')		
 
 	const info = db
-		.prepareUpdate('meetings', ['name', 'description', 'meet_date'], res.locals, ['id', 'project_id'])
+		.prepareUpdate('meetings', ['name', 'description', 'place', 'meet_date', 'chat_id', 'is_cancel'], res.locals, ['id', 'project_id'])
 		.run(res.locals)
 	
 	if (info.changes == 0) 
 		throw Error('NOT_FOUND::404')
 
-	res.status(200).json({success: true})
+	const meeting = getMeeting(res.locals.meeting_id, res.locals.user_id)		
+	res.status(200).json({success: true, data: meeting})
 })
 
 app.delete('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
@@ -470,10 +623,10 @@ app.delete('/project/:pid(\\d+)/meeting/:mid(\\d+)', (req, res, next) => {
 	if (info.changes == 0) 
 		throw Error('NOT_FOUND::404')
 			 
-	res.status(200).json({success: true})
+	res.status(200).json({success: true, data: {id: res.locals.meeting_id}})
 })
 
-app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)/participants', (req, res, next) => {
+app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)/participant', (req, res, next) => {
 	if (!res.locals.is_author)
 		throw Error('ACCESS_DENIED::401')
 	
@@ -486,7 +639,7 @@ app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)/participants', (req, res, next)
 			  from chat_users 
 			 where chat_id in (select id from chats where project_id = :project_id)
 		`)
-		.pluck(true) // .raw?
+		.pluck(true)
 		.all(res.locals)
 
 	if (user_ids.some(user_id => rows.indexOf(user_id)) == -1)
@@ -501,72 +654,123 @@ app.put('/project/:pid(\\d+)/meeting/:mid(\\d+)/participants', (req, res, next)
 		.prepare(`insert into meeting_users (meeting_id, user_id) select :meeting_id, value from json_each(:json_ids)`)
 		.run(res.locals)
 
-	res.status(200).json({success: true})
+	res.status(200).json({ success: true, data: user_ids })
 })
 
-// DOCUMENTS
-app.get('/project/:pid(\\d+)/document', (req, res, next) => {
-	const ids = String(req.query.id).split(',').map(e => parseInt(e)).filter(e => e > 0)
-	const where = ids.length > 0 ? ' and id in (' + ids.join(', ') + ')' : ''
-
-	// Документы
+// FILES
+app.get('/project/:pid(\\d+)/file', (req, res, next) => {
 	// 1. Из групп, которые есть в проекте и в которых участвует пользователь
 	// 2. Из задач проекта, где пользователь автор, ответсвенный или наблюдатель
 	// 3. Из встреч на проекте, где пользователь создатель или участник
-	// To-Do: отдавать готовую ссылку --> как минимум GROUP_ID надо заменить на tgGroupId
 	const rows = db
 		.prepare(`
-			select id, origin_chat_id, origin_message_id, filename, mime, caption, size, published_by, parent_id, parent_type
-			  from documents d
-			 where project_id = :project_id ${where} and (
-				       origin_chat_id in (select chat_id from chat_users where user_id = :user_id) 
-				       or
-				       parent_type = 1 and parent_id in (
+			select f.id, f.chat_id, c.telegram_id telegram_chat_id, f.message_id, f.filename, f.mime, f.caption, f.size, f.published_by, f.published, f.parent_id, f.parent_type
+				from files f
+					left join chats c on f.chat_id = c.id and f.parent_type = 0
+				where f.project_id = :project_id and (
+						chat_id in (select chat_id from chat_users where user_id = :user_id) 
+						or
+						parent_type = 1 and parent_id in (
 						select id 
-						  from tasks t
-						 where project_id = :project_id and (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = t.id and user_id = :user_id))
-				       ) 
-				       or
-				       parent_type = 2 and parent_id in (
+							from tasks t
+							where project_id = :project_id and (created_by = :user_id or assigned_to = :user_id or exists(select 1 from task_users where task_id = t.id and user_id = :user_id))
+						) 
+						or
+						parent_type = 2 and parent_id in (
 						select id 
-						  from meetings m
-						 where project_id = :project_id and (created_by = :user_id or exists(select 1 from meeting_users where meeting_id = m.id and user_id = :user_id))
-				       )
-			       )
+							from meetings m
+							where project_id = :project_id and (created_by = :user_id or exists(select 1 from meeting_users where meeting_id = m.id and user_id = :user_id))
+						)
+					)
 		`)
-		.all(res.locals) 
+		.safeIntegers(true)
+		.all(res.locals)
 
-	if (where && rows.length == 0)
-		throw Error('NOT_FOUND::404')
+	const upload_ids = db
+		.prepare(`select upload_chat_id from customers where upload_chat_id is not null`)
+		.pluck(true)
+		.all()
+		.reduce((res, e) => { res[e] = true; return res}, {})
 
-	res.status(200).json({success: true, data: ids.length == 1 ? rows[0] : rows})
+	rows
+		.filter (row => upload_ids[row.chat_id]) 
+		.forEach(row => {
+			row.chat_id = null
+			row.message_id = null
+		})
+
+	res.status(200).json({success: true, data: rows})
 })
 
 app.post('/project/:pid(\\d+)/:type(task|meeting)/:id(\\d+)/attach', upload.any(), async (req, res, next) => {
-	const parentType = req.params.type == 'task' ? 1 : 2
-	const parentId = req.params.id
+	try {
+		res.locals.parent_id = req.params.id
+		res.locals.parent_type = req.params.type == 'task' ? 1 : 2
 
-	const ids = []
-	for (const file of req.files) {
- 		const id = await bot.uploadDocument(res.locals.project_id, file.originalname, file.mimetype, file.buffer, parentType, parentId, res.locals.user_id)
-		ids.push(id)	
+		const chat_id = db
+			.prepare(`
+				select coalesce(chat_id, (select upload_chat_id from customers where id = :customer_id)) 
+				from ${req.params.type}s 
+				where id = :parent_id and project_id = :project_id`)
+			.pluck(true)
+			.get(res.locals)
+
+		if (!chat_id)
+			throw Error('EMPTY_DESTINATION::500')
+		
+		const file_ids = []
+		
+		for (const file of req.files) {
+			if (file.size == 0)
+				continue
+
+			const filedata = {
+				project_id: req.params.pid,
+				chat_id,
+				filename: file.originalname,
+				mime: file.mimetype,
+				data: file.buffer,
+				size: file.size,
+				published_by: res.locals.user_id,
+				pablished: Math.floor(Date.now() / 1000),
+				parent_type: res.locals.parent_type,
+				parent_id: req.params.id
+			}
+
+			try {
+				const file_id = await bot.sendFile(filedata)
+				if (file_id)
+					file_ids.push(file_id)
+			} catch (err) {
+				log.error(err)	
+			}
+		}
+
+		if (file_ids.length == 0)	
+			throw Error('EMPTY_UPLOAD::500')
+
+		const files = db
+			.prepare(`select id, chat_id, message_id, filename, mime, size, published_by, published from files where id in (` + file_ids.join(',') + `)`)
+			.all()
+		
+		res.status(200).json({success: true, data: files})
+	} catch (err) {
+		next(err)
 	}
-
-	res.redirect(req.baseUrl + `/project/${req.params.pid}/document?id=` + ids.join(','))
 })
 
-app.use('/project/:pid(\\d+)/document/:did(\\d+)', (req, res, next) => {
-	res.locals.document_id = req.params.did
+app.use('/project/:pid(\\d+)/file/:fid(\\d+)', (req, res, next) => {
+	res.locals.file_id = req.params.fid
 
-	const doc = db
-		.prepare(`select * from documents where id = :document_id and project_id = :project_id`)
+	const file = db
+		.prepare(`select * from files where id = :file_id and project_id = :project_id`)
 		.get(res.locals)
 
-	if (!doc)
+	if (!file)
 		throw Error('NOT_FOUND::404')
 
-	if (doc.parent_type == 0) {
-		res.locals.chat_id = doc.chat_id
+	if (file.parent_type == 0) {
+		res.locals.chat_id = file.chat_id
 		const row = db
 			.prepare(`select 1 from chat_users where chat_id = :chat_id and user_id = :user_id`)
 			.get(res.locals)
@@ -575,8 +779,8 @@ app.use('/project/:pid(\\d+)/document/:did(\\d+)', (req, res, next) => {
 			res.locals.can_download = true
 		}
 	} else {
-		res.locals.parent_id = doc.parent_id
-		const parent = doc.parent_type == 1 ? 'task' : 'meeting'
+		res.locals.parent_id = file.parent_id
+		const parent = file.parent_type == 1 ? 'task' : 'meeting'
 		
 		const row = db
 			.prepare(`
@@ -589,36 +793,43 @@ app.use('/project/:pid(\\d+)/document/:did(\\d+)', (req, res, next) => {
 
 		if (row) {
 			res.locals.can_download = true
-			res.locals.can_delete = doc.published_by == res.locals.user_id
+			res.locals.can_delete = file.published_by == res.locals.user_id
 		}
 	}
 
 	next()
 })
 
-app.get('/project/:pid(\\d+)/document/:did(\\d+)', async (req, res, next) => {
-	if (!res.locals.can_download)
-		throw Error('NOT_FOUND::404')
+app.get('/project/:pid(\\d+)/file/:fid(\\d+)', async (req, res, next) => {
+	try {
+		if (!res.locals.can_download)
+			throw Error('NOT_FOUND::404')
 
-	const file = await bot.downloadDocument(res.locals.project_id, res.locals.document_id)
-	res.writeHead(200, {
-		'Content-Length': file.size,
-		'Content-Type': file.mime,
-		'Content-Disposition': contentDisposition(file.filename)
-	})
+		const file = await bot.downloadFile(res.locals.project_id, res.locals.file_id)
+		res.writeHead(200, {
+			'Content-Length': file.size,
+			'Content-Type': file.mime,
+			'Content-Disposition': contentDisposition(file.filename)
+		})
 
-	res.end(file.data)
+		res.end(file.data)
+	} catch (err) {
+		next(err)	
+	}
 })
 
-app.delete('/project/:pid(\\d+)/document/:id(\\d+)', (req, res, next) => {
+app.delete('/project/:pid(\\d+)/file/:fid(\\d+)', (req, res, next) => {
 	if (!res.locals.can_delete)
 		throw Error('NOT_FOUND::404')
 
-	const doc = db
-		.prepare(`delete from documents where id = :id and project_id = :project_id`)
+	const info = db
+		.prepare(`delete from files where id = :id and project_id = :project_id`)
 		.run(res.locals)
 
-	res.status(200).json({success: true})
+	if (info.changes == 0) 
+		throw Error('NOT_FOUND::404')		
+
+	res.status(200).json({success: true, data: {id: res.locals.file_id}})
 })
 
 app.get('/settings', (req, res, next) => {
@@ -640,4 +851,28 @@ app.put('/settings', (req, res, next) => {
 	res.status(200).json({success: true})
 })
 
-module.exports = app
+/*
+eventBus.on('data', evt => {
+	if (evt.)
+		
+	const msg = {
+		event: evt.event,
+		entity: evt.entity,
+		id: evt.id,
+		source: 'miniapp'
+	}
+	
+	const users = {}
+	if (evt.entity == 'project') {
+
+	}
+	if (evt.entity == 'task') {
+		msg.data = getTask(evt.id, null)
+	}
+	if (evt.entity == 'meeting') {
+		msg.data = getMeeting(evt.id, null)
+	}	
+})
+*/
+
+module.exports = { router: app, registerWS }