Update: admin panel, SMTP/EWS/Outlook mail modes, QR fix, event folders, security improvements

app/models.py

@@ -14,12 +14,14 @@ class User(db.Model):
     password_hash = db.Column(db.String(255), nullable=False)
     role = db.Column(db.String(20), nullable=False, default="staff")
     is_active = db.Column(db.Boolean, default=True, nullable=False)
+    session_version = db.Column(db.Integer, default=0, nullable=False)
     created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
 
     created_events = db.relationship("Event", backref="creator", lazy=True)
 
     def set_password(self, password):
         self.password_hash = generate_password_hash(password)
+        self.session_version = (self.session_version or 0) + 1
 
     def check_password(self, password):
         return check_password_hash(self.password_hash, password)
@@ -115,6 +117,37 @@ class Guest(db.Model):
         parts = [p for p in [self.last_name, self.first_name, self.middle_name] if p]
         return " ".join(parts) if parts else self.full_name
 
+    def _photo_paths(self):
+        """Возвращает возможные пути к фото: сначала папка мероприятия, потом корень."""
+        if not self.photo_filename:
+            return []
+        from pathlib import Path
+        from flask import current_app
+        base = Path(current_app.config["PHOTO_FOLDER"])
+        paths = [base / self.photo_filename]
+        if self.event_id:
+            paths.insert(0, base / f"event_{self.event_id}" / self.photo_filename)
+        return paths
+
+    @property
+    def has_photo_file(self):
+        try:
+            return any(p.exists() for p in self._photo_paths())
+        except Exception:
+            return False
+
+    @property
+    def photo_url(self):
+        if not self.has_photo_file:
+            return ""
+        from pathlib import Path
+        from flask import current_app
+        for p in self._photo_paths():
+            if p.exists():
+                rel = p.relative_to(Path(current_app.config["UPLOAD_FOLDER"]).parent)
+                return f"/static/{str(rel).replace('\\', '/')}"
+        return ""
+
     def __repr__(self):
         return f"<Guest {self.full_name} ({self.email})>"
 
@@ -130,3 +163,79 @@ class CheckIn(db.Model):
 
     def __repr__(self):
         return f"<CheckIn guest_id={self.guest_id} at={self.checked_in_at}>"
+
+
+class AuditLog(db.Model):
+    __tablename__ = "audit_logs"
+
+    id = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=True)
+    username = db.Column(db.String(100), nullable=True)
+    action = db.Column(db.String(50), nullable=False)
+    target_type = db.Column(db.String(50), nullable=True)
+    target_id = db.Column(db.String(50), nullable=True)
+    details = db.Column(db.Text, nullable=True)
+    ip_address = db.Column(db.String(45), nullable=True)
+    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
+
+    user = db.relationship("User", backref="audit_logs", lazy=True)
+
+    def __repr__(self):
+        return f"<AuditLog {self.action} by {self.username} at {self.created_at}>"
+
+
+class SmtpSettings(db.Model):
+    """Глобальные настройки SMTP для рассылки приглашений."""
+    __tablename__ = "smtp_settings"
+
+    id = db.Column(db.Integer, primary_key=True)
+    mail_server = db.Column(db.String(255), nullable=False, default="smtp.yandex.ru")
+    mail_port = db.Column(db.Integer, nullable=False, default=465)
+    mail_use_ssl = db.Column(db.Boolean, nullable=False, default=True)
+    mail_username = db.Column(db.String(255), nullable=False, default="")
+    mail_password = db.Column(db.String(255), nullable=False, default="")
+    mail_default_sender = db.Column(db.String(255), nullable=True)
+    use_local_outlook = db.Column(db.Boolean, nullable=False, default=False)
+    use_ews = db.Column(db.Boolean, nullable=False, default=False)
+    ews_url = db.Column(db.String(500), nullable=True)
+    updated_at = db.Column(db.DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False)
+
+    @property
+    def mail_mode(self):
+        if self.use_local_outlook:
+            return "outlook"
+        if self.use_ews:
+            return "ews"
+        return "smtp"
+
+    @classmethod
+    def get_settings(cls):
+        settings = cls.query.first()
+        if not settings:
+            settings = cls()
+            db.session.add(settings)
+            db.session.commit()
+        return settings
+
+    @classmethod
+    def apply_to_app(cls, app):
+        """Применяет сохранённые настройки к конфигурации Flask-приложения."""
+        try:
+            settings = cls.query.first()
+            if not settings:
+                return
+            app.config["MAIL_SERVER"] = settings.mail_server or app.config.get("MAIL_SERVER", "")
+            app.config["MAIL_PORT"] = settings.mail_port or app.config.get("MAIL_PORT", 465)
+            app.config["MAIL_USE_SSL"] = settings.mail_use_ssl
+            app.config["MAIL_USERNAME"] = settings.mail_username or ""
+            app.config["MAIL_PASSWORD"] = settings.mail_password or ""
+            app.config["MAIL_DEFAULT_SENDER"] = settings.mail_default_sender or settings.mail_username or app.config.get("MAIL_DEFAULT_SENDER", "")
+            app.config["MAIL_USE_LOCAL_OUTLOOK"] = settings.use_local_outlook
+            app.config["MAIL_USE_EWS"] = settings.use_ews
+            app.config["EWS_URL"] = settings.ews_url or ""
+        except Exception:
+            pass
+
+    def __repr__(self):
+        return f"<SmtpSettings {self.mail_server}:{self.mail_port} {self.mail_username}>"
+