Stabilize staff concurrency and premium emoji; enable verified Drone deployment

src/middlewares/access.py

@@ -0,0 +1,49 @@
+"""Check every staff message/callback, including unfinished FSM dialogs."""
+from aiogram import BaseMiddleware
+from aiogram.types import CallbackQuery
+
+from src.core.access import current_role, get_role
+
+
+class AccessMiddleware(BaseMiddleware):
+    def __init__(self, *, allow_cashier=False, public_handlers=()):
+        self.allow_cashier = allow_cashier
+        self.public_handlers = set(public_handlers)
+
+    async def __call__(self, handler, event, data):
+        selected = data.get("handler")
+        if selected and selected.callback.__name__ in self.public_handlers:
+            return await handler(event, data)
+        actor = event.from_user
+        role = await get_role(actor.id) if actor else "user"
+        allowed = {"super_admin", "admin"}
+        if self.allow_cashier:
+            allowed.add("cashier")
+        if role not in allowed:
+            if isinstance(event, CallbackQuery):
+                await event.answer("❌ Недостаточно прав", show_alert=True)
+            else:
+                await event.answer("❌ Недостаточно прав")
+            return
+        token = current_role.set((actor.id, role))
+        try:
+            return await handler(event, data)
+        finally:
+            current_role.reset(token)
+
+
+class ChatAccessMiddleware(BaseMiddleware):
+    async def __call__(self, handler, event, data):
+        from src.core.access import is_admin
+        from src.core.chat_services import ChatPermissionService
+        from src.core.database import async_session_maker
+        admin = await is_admin(event.from_user.id)
+        async with async_session_maker() as session:
+            allowed, reason = await ChatPermissionService.can_send_message(session, event.from_user.id, is_admin=admin)
+        if not allowed:
+            if isinstance(event, CallbackQuery):
+                await event.answer(reason, show_alert=True)
+            else:
+                await event.answer(reason)
+            return
+        return await handler(event, data)