security, audit, fom features

handlers/new_post.py

@@ -2,7 +2,7 @@ from telegram import Update, InputMediaPhoto, InlineKeyboardMarkup, InlineKeyboa
 from telegram.ext import ContextTypes, ConversationHandler, MessageHandler, CommandHandler, filters, CallbackQueryHandler, ContextTypes
 
 from db import AsyncSessionLocal
-from models import Channel, Group, Button
+from models import Channel, Group, Button, Admin
 
 SELECT_MEDIA, SELECT_TEXT, SELECT_TARGET = range(3)
 
@@ -29,10 +29,20 @@ async def select_text(update: Update, context: ContextTypes.DEFAULT_TYPE):
         context.user_data['text'] = getattr(update.message, 'text', None) or getattr(update.message, 'caption', None)
         from sqlalchemy import select
         session = AsyncSessionLocal()
+        user_id = update.effective_user.id if update.effective_user else None
         try:
-            channels_result = await session.execute(select(Channel))
+            # Ограничиваем каналы и группы только теми, где пользователь — админ
+            channels_result = await session.execute(
+                select(Channel).join(Button, isouter=True).join(Group, isouter=True)
+                .join(Admin, Channel.id == Admin.channel_id)
+                .where(Admin.tg_id == user_id)
+            )
             channels = channels_result.scalars().all()
-            groups_result = await session.execute(select(Group))
+            groups_result = await session.execute(
+                select(Group).join(Button, isouter=True)
+                .join(Admin, Group.id == Admin.channel_id)
+                .where(Admin.tg_id == user_id)
+            )
             groups = groups_result.scalars().all()
             keyboard = []
             for c in channels:
@@ -41,6 +51,9 @@ async def select_text(update: Update, context: ContextTypes.DEFAULT_TYPE):
                 keyboard.append([InlineKeyboardButton(f'Группа: {getattr(g, "name", str(g.name))}', callback_data=f'group_{getattr(g, "id", str(g.id))}')])
             reply_markup = InlineKeyboardMarkup(keyboard)
             await update.message.reply_text('Выберите, куда отправить пост:', reply_markup=reply_markup)
+            # Сохраняем id исходного сообщения для пересылки
+            context.user_data['forward_message_id'] = update.message.message_id
+            context.user_data['forward_chat_id'] = update.message.chat_id
             return SELECT_TARGET
         finally:
             await session.close()
@@ -80,14 +93,18 @@ async def select_target(update: Update, context: ContextTypes.DEFAULT_TYPE):
                 await query.edit_message_text('Ошибка: ссылка должна быть username (@channel) или числовой ID (-100...)')
                 return ConversationHandler.END
             try:
-                photo = context.user_data.get('photo') if context.user_data else None
-                if photo:
-                    await context.bot.send_photo(chat_id=chat_id, photo=photo, caption=context.user_data.get('text') if context.user_data else None, reply_markup=markup)
-                    await query.edit_message_text('Пост отправлен!')
-                else:
-                    await query.edit_message_text('Ошибка: не выбрано фото для поста.')
+                # Пересылка исходного сообщения
+                await context.bot.forward_message(
+                    chat_id=chat_id,
+                    from_chat_id=context.user_data.get('forward_chat_id'),
+                    message_id=context.user_data.get('forward_message_id')
+                )
+                from db import log_action
+                user_id = update.effective_user.id if update.effective_user else None
+                log_action(user_id, "forward_post", f"chat_id={chat_id}, from_chat_id={context.user_data.get('forward_chat_id')}, message_id={context.user_data.get('forward_message_id')}")
+                await query.edit_message_text('Пост переслан!')
             except Exception as e:
-                await query.edit_message_text(f'Ошибка отправки поста: {e}')
+                await query.edit_message_text(f'Ошибка пересылки поста: {e}')
     finally:
         await session.close()
     return ConversationHandler.END