Merge pull request #297 from ffmemes/codex/fix-admin-source-permissions

Preserve roles when users block the bot

Author: ohld

CONTEXT.md

@@ -38,6 +38,12 @@ Use these terms consistently:
 _Code aliases_: `UserType.MODERATOR`, `UserType.ADMIN`
 _Avoid_: админ, проверяющий загрузки
 
+**Блокировка бота**:
+Транспортное состояние Telegram: пользователь запретил боту писать в личку.
+Не является ролью пользователя и не должно перетирать `UserType`.
+_Code aliases_: `user.blocked_bot_at`
+_Avoid_: `UserType.BLOCKED_BOT` как новое состояние, бан, потеря роли
+
 **Модераторский чат**:
 Комьюнити-чат модераторов, где бот может запускать задания, обсуждения и голосования по новым источникам.
 _Code aliases_: `TELEGRAM_MODERATOR_CHAT_ID`, Moderator Chat
@@ -115,6 +121,7 @@ _Avoid_: router
 ## Relationships
 
 - **Модератор** может участвовать в **модераторском чате** и получать **разбор новых мемов** в своей ленте.
+- **Блокировка бота** влияет на возможность отправить пользователю сообщение, но не меняет роль **Модератора**.
 - **Дедупликация мемов** должна выполняться до того, как мем становится доступен обычной рекомендательной системе.
 - **Модераторский чат** используется для комьюнити-циклов; **чат проверки загрузок** используется для решений по пользовательским загрузкам.
 - **Проверяющий загрузки** определяется доступом к **чату проверки загрузок**, а не `UserType`.

alembic/versions/2026-05-25_restore_okhlopkov_admin.py

@@ -0,0 +1,53 @@
+"""restore okhlopkov admin role
+
+Revision ID: a9f0d6c2b1e3
+Revises: 8c2f4a6d9e10
+Create Date: 2026-05-25 12:45:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "a9f0d6c2b1e3"
+down_revision = "8c2f4a6d9e10"
+branch_labels = None
+depends_on = None
+
+OKHLOPKOV_USER_ID = 49820636
+TELEGRAM_MODERATOR_CHAT_ID = -1001305866294
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    conn.execute(
+        sa.text(
+            """
+            INSERT INTO "user" (id, type, created_at, last_active_at, blocked_bot_at)
+            VALUES (:user_id, 'admin', now(), now(), NULL)
+            ON CONFLICT (id)
+            DO UPDATE SET
+                type = 'admin',
+                blocked_bot_at = NULL
+            """
+        ),
+        {"user_id": OKHLOPKOV_USER_ID},
+    )
+    conn.execute(
+        sa.text(
+            """
+            INSERT INTO user_tg_chat_membership (user_tg_id, chat_id, last_seen_at)
+            SELECT id, :chat_id, now()
+            FROM user_tg
+            WHERE id = :user_id
+            ON CONFLICT (user_tg_id, chat_id)
+            DO UPDATE SET last_seen_at = now()
+            """
+        ),
+        {"user_id": OKHLOPKOV_USER_ID, "chat_id": TELEGRAM_MODERATOR_CHAT_ID},
+    )
+
+
+def downgrade() -> None:
+    pass

src/broadcasts/service.py

@@ -25,6 +25,7 @@ async def get_user_ids_active_minutes_ago(
             id
         FROM "user"
         WHERE 1=1
+            AND blocked_bot_at IS NULL
             AND type NOT IN ('waitlist', 'blocked_bot')
             AND last_active_at BETWEEN
                 NOW() - INTERVAL '{to_minutes_ago} MINUTES'
@@ -51,10 +52,14 @@ async def get_users_to_broadcast_meme_from_tgchannelru(
             AND UMR.meme_id = {meme_id}
         LEFT JOIN user_tg_chat_membership UTCM
             ON UTCM.user_tg_id = UL.user_id
+        JOIN "user" U
+            ON U.id = UL.user_id
         WHERE 1=1
             AND UL.language_code = 'ru'
             AND UMR.user_id IS NULL
             AND UTCM.user_tg_id IS NULL
+            AND U.blocked_bot_at IS NULL
+            AND U.type NOT IN ('waitlist', 'blocked_bot')
     """
 
     return await fetch_all(text(select_query))
@@ -70,9 +75,13 @@ async def get_users_to_broadcast_post_from_tgchannelru():
         FROM user_language UL
         LEFT JOIN user_tg_chat_membership UTCM
             ON UTCM.user_tg_id = UL.user_id
+        JOIN "user" U
+            ON U.id = UL.user_id
         WHERE 1=1
             AND UL.language_code = 'ru'
             AND UTCM.user_tg_id IS NULL
+            AND U.blocked_bot_at IS NULL
+            AND U.type NOT IN ('waitlist', 'blocked_bot')
     """
 
     return await fetch_all(text(select_query))
@@ -82,9 +91,13 @@ async def get_users_with_language(
     language_code: str,
 ):
     select_query = f"""
-        SELECT user_id
-        FROM user_language
-        WHERE language_code = '{language_code}'
+        SELECT UL.user_id
+        FROM user_language UL
+        JOIN "user" U
+            ON U.id = UL.user_id
+        WHERE UL.language_code = '{language_code}'
+            AND U.blocked_bot_at IS NULL
+            AND U.type NOT IN ('waitlist', 'blocked_bot')
     """
     return await fetch_all(text(select_query))
 
@@ -96,6 +109,7 @@ async def get_users_active_more_than_days_ago(
         SELECT id
         FROM "user"
         WHERE last_active_at < NOW() - INTERVAL '{days_ago} DAYS'
+        AND blocked_bot_at IS NULL
         AND type != 'blocked_bot'
     """
     return await fetch_all(text(select_query))
@@ -119,7 +133,8 @@ async def get_all_non_blocked_users() -> list[dict]:
                ) AS language_code
         FROM "user" u
         LEFT JOIN user_tg ut ON ut.id = u.id
-        WHERE u.type NOT IN ('waitlist', 'blocked_bot')
+        WHERE u.blocked_bot_at IS NULL
+          AND u.type NOT IN ('waitlist', 'blocked_bot')
         ORDER BY u.last_active_at DESC
     """
         )

src/main.py

@@ -62,7 +62,7 @@ async def lifespan(_application: FastAPI) -> AsyncGenerator:
             ),
         ],
         ignore_errors=[
-            "telegram.error.Forbidden",  # handled by error.py → marks user as blocked_bot
+            "telegram.error.Forbidden",  # handled by error.py -> records blocked_bot_at
         ],
         include_local_variables=False,
         before_send=before_send,

src/tgbot/handlers/chat/send_tokens.py

@@ -68,7 +68,11 @@ async def send_tokens_to_reply(update: Update, context: ContextTypes.DEFAULT_TYP
         return  # no need to send tokens to yourself
 
     to_user = await get_user_by_id(to_user_id)
-    if not to_user or to_user["type"] == UserType.BLOCKED_BOT:
+    if (
+        not to_user
+        or to_user["blocked_bot_at"] is not None
+        or to_user["type"] == UserType.BLOCKED_BOT
+    ):
         return await _reply_and_delete(
             update.message,
             f"Не вижу {to_user_tg.name} в боте! ай-яй-яй 😿",

src/tgbot/handlers/deep_link.py

@@ -48,12 +48,12 @@ async def handle_invited_user(
     # set inviter id
     await update_user(invited_user["id"], inviter_id=invitor_user_id)
 
-    # dont reward if a user blocked the bot
-    if invitor_user["type"] == UserType.BLOCKED_BOT:
+    # Don't reward if the inviter cannot receive the bot notification.
+    if invitor_user["blocked_bot_at"] is not None or invitor_user["type"] == UserType.BLOCKED_BOT:
         return await log(
             f"""
 ❌ {invited_user_name} was invited by #{invitor_user_id}
-but his type is {invitor_user["type"]}
+but his bot access is blocked (type={invitor_user["type"]})
         """
         )
 

src/tgbot/service.py

@@ -467,9 +467,10 @@ async def mark_user_blocked(
 ) -> dict[str, Any] | None:
     """Mark a user as having blocked the bot.
 
-    Idempotent. Preserves privileged roles (moderator/admin/super_user) —
-    still records blocked_bot_at for retention analysis, but does not
-    demote their type. Invalidates user_info cache on success.
+    Idempotent. Preserves the user's role in `type` and records the Telegram
+    transport state in blocked_bot_at. The legacy `blocked_bot` user type can
+    still exist on old rows, but new block events must not overwrite roles.
+    Invalidates user_info cache on success.
 
     `source` is a free-form label for observability
     ("my_chat_member", "forbidden_send_meme", ...).
@@ -483,7 +484,10 @@ async def mark_user_blocked(
         return None
 
     ts = _blocked_bot_at_timestamp(when)
-    current_type = UserType(current["type"]) if current["type"] else None
+    try:
+        current_type = UserType(current["type"]) if current["type"] else None
+    except ValueError:
+        current_type = None
 
     if current_type and current_type.is_moderator:
         logging.warning(
@@ -493,13 +497,8 @@ async def mark_user_blocked(
             source,
             current_type.value,
         )
-        updated = await update_user(user_id, blocked_bot_at=ts)
-    else:
-        updated = await update_user(
-            user_id,
-            type=UserType.BLOCKED_BOT,
-            blocked_bot_at=ts,
-        )
+
+    updated = await update_user(user_id, blocked_bot_at=ts)
 
     if updated is not None:
         try:

tests/broadcasts/test_service.py

@@ -0,0 +1,95 @@
+from datetime import datetime
+
+import pytest
+import pytest_asyncio
+from sqlalchemy import delete
+from tests.factories import create_user, create_user_language
+
+from src.broadcasts.service import get_all_non_blocked_users, get_users_with_language
+from src.database import engine, user, user_language, user_tg
+
+ACTIVE_USER_ID = 311001
+BLOCKED_ADMIN_ID = 311002
+LEGACY_BLOCKED_USER_ID = 311003
+WAITLIST_USER_ID = 311004
+ACTIVE_ADMIN_ID = 311005
+TEST_USER_IDS = (
+    ACTIVE_USER_ID,
+    BLOCKED_ADMIN_ID,
+    LEGACY_BLOCKED_USER_ID,
+    WAITLIST_USER_ID,
+    ACTIVE_ADMIN_ID,
+)
+
+
+@pytest_asyncio.fixture()
+async def cleanup_broadcast_users():
+    await _cleanup()
+    yield
+    await _cleanup()
+
+
+async def _cleanup() -> None:
+    async with engine.connect() as conn:
+        await conn.execute(delete(user_language).where(user_language.c.user_id.in_(TEST_USER_IDS)))
+        await conn.execute(delete(user_tg).where(user_tg.c.id.in_(TEST_USER_IDS)))
+        await conn.execute(delete(user).where(user.c.id.in_(TEST_USER_IDS)))
+        await conn.commit()
+
+
+@pytest.mark.asyncio
+async def test_get_users_with_language_skips_blocked_transport_state(
+    cleanup_broadcast_users,
+) -> None:
+    async with engine.connect() as conn:
+        await create_user(conn, id=ACTIVE_USER_ID)
+        await create_user(conn, id=BLOCKED_ADMIN_ID, type="admin")
+        await create_user(conn, id=LEGACY_BLOCKED_USER_ID, type="blocked_bot")
+        await create_user(conn, id=WAITLIST_USER_ID, type="waitlist")
+        await create_user(conn, id=ACTIVE_ADMIN_ID, type="admin")
+        for user_id in TEST_USER_IDS:
+            await create_user_language(conn, user_id=user_id, language_code="ru")
+        await conn.execute(
+            user.update()
+            .where(user.c.id == BLOCKED_ADMIN_ID)
+            .values(blocked_bot_at=datetime(2026, 5, 25, 12, 0, 0))
+        )
+        await conn.commit()
+
+    rows = await get_users_with_language("ru")
+
+    assert {row["user_id"] for row in rows if row["user_id"] in TEST_USER_IDS} == {
+        ACTIVE_USER_ID,
+        ACTIVE_ADMIN_ID,
+    }
+
+
+@pytest.mark.asyncio
+async def test_get_all_non_blocked_users_skips_blocked_transport_state(
+    cleanup_broadcast_users,
+) -> None:
+    async with engine.connect() as conn:
+        await create_user(conn, id=ACTIVE_USER_ID)
+        await create_user(conn, id=BLOCKED_ADMIN_ID, type="admin")
+        await create_user(conn, id=LEGACY_BLOCKED_USER_ID, type="blocked_bot")
+        await create_user(conn, id=ACTIVE_ADMIN_ID, type="admin")
+        for user_id in (
+            ACTIVE_USER_ID,
+            BLOCKED_ADMIN_ID,
+            LEGACY_BLOCKED_USER_ID,
+            ACTIVE_ADMIN_ID,
+        ):
+            await create_user_language(conn, user_id=user_id, language_code="ru")
+        await conn.execute(
+            user.update()
+            .where(user.c.id == BLOCKED_ADMIN_ID)
+            .values(blocked_bot_at=datetime(2026, 5, 25, 12, 0, 0))
+        )
+        await conn.commit()
+
+    rows = await get_all_non_blocked_users()
+
+    assert {row["user_id"] for row in rows if row["user_id"] in TEST_USER_IDS} == {
+        ACTIVE_USER_ID,
+        ACTIVE_ADMIN_ID,
+    }

tests/tgbot/test_block_tracking.py

@@ -24,7 +24,7 @@ async def test_mark_user_blocked_sends_naive_timestamp_to_db(monkeypatch) -> Non
     update_user = AsyncMock(
         return_value={
             "id": 10001,
-            "type": UserType.BLOCKED_BOT.value,
+            "type": UserType.USER.value,
             "blocked_bot_at": datetime(2026, 4, 27, 20, 0, 27),
         }
     )
@@ -48,11 +48,44 @@ async def test_mark_user_blocked_sends_naive_timestamp_to_db(monkeypatch) -> Non
     )
 
     update_user.assert_awaited_once()
+    assert "type" not in update_user.await_args.kwargs
     blocked_bot_at = update_user.await_args.kwargs["blocked_bot_at"]
     assert blocked_bot_at == datetime(2026, 4, 27, 20, 0, 27)
     assert blocked_bot_at.tzinfo is None
 
 
+@pytest.mark.asyncio
+async def test_mark_user_blocked_preserves_admin_type(monkeypatch) -> None:
+    update_user = AsyncMock(
+        return_value={
+            "id": 49820636,
+            "type": UserType.ADMIN.value,
+            "blocked_bot_at": datetime(2026, 4, 27, 20, 0, 27),
+        }
+    )
+    monkeypatch.setattr(
+        service,
+        "get_user_by_id",
+        AsyncMock(return_value={"id": 49820636, "type": UserType.ADMIN.value}),
+    )
+    monkeypatch.setattr(service, "update_user", update_user)
+
+    monkeypatch.setitem(
+        sys.modules,
+        "src.tgbot.user_info",
+        SimpleNamespace(update_user_info_cache=AsyncMock()),
+    )
+
+    await service.mark_user_blocked(
+        user_id=49820636,
+        source="my_chat_member",
+        when=datetime(2026, 4, 27, 20, 0, 27, tzinfo=timezone.utc),
+    )
+
+    update_user.assert_awaited_once()
+    assert update_user.await_args.kwargs == {"blocked_bot_at": datetime(2026, 4, 27, 20, 0, 27)}
+
+
 @pytest.mark.asyncio
 async def test_handle_user_blocked_bot_escapes_admin_log_html(monkeypatch) -> None:
     messages = []