fix(cors): add popcornminisite.github.io to allowed origins

.gitignore

@@ -1,4 +0,0 @@
-
-static/
-static/
-static/

app.py

@@ -1,15 +1,21 @@
-import json, time, asyncio, aiohttp, os
+import json
+import time
+import asyncio
+import aiohttp
 from contextlib import asynccontextmanager
+
 from fastapi import FastAPI, Request, HTTPException
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
+
 from config import ORG, ACCOUNTS, CORS_ORIGINS, DEV_MODE
 from database import init_tables, exec, close_session
 from db_init import INIT_SQLS, INDEX_SQLS, FTS_SQLS, SEED_SQLS
 from ratelimit import limiter
 
+
 _KEEP_WARM_URLS = [
     "https://mml-analysing-shyper-and-api-mid-structer-db.hf.space/health",
     "https://multimedia-cryptography-benchmarks-proxy.hf.space/health",
@@ -18,6 +24,7 @@ _KEEP_WARM_URLS = [
     "https://Dgntsnfangskgsjafjyjysjtsjtsjwtjfsjyejyrky-proxy.hf.space/health",
 ]
 
+
 async def keep_warm():
     while True:
         await asyncio.sleep(240)
@@ -25,8 +32,11 @@ async def keep_warm():
             for url in _KEEP_WARM_URLS:
                 try:
                     async with sess.get(url) as resp:
-                        if resp.status == 200: await resp.read()
-                except: pass
+                        if resp.status == 200:
+                            await resp.read()
+                except:
+                    pass
+
 
 _MIGRATIONS = [
     "ALTER TABLE archives ADD COLUMN media_id INTEGER",
@@ -35,6 +45,13 @@ _MIGRATIONS = [
     "ALTER TABLE archives ADD COLUMN dataset_name TEXT",
     "ALTER TABLE archives ADD COLUMN account_key TEXT",
     "ALTER TABLE archives ADD COLUMN status TEXT DEFAULT 'archived'",
+    "ALTER TABLE archives ADD COLUMN season_number INTEGER",
+    "ALTER TABLE archives ADD COLUMN episode_number INTEGER",
+    "ALTER TABLE archives ADD COLUMN source TEXT",
+    "ALTER TABLE archives ADD COLUMN audio TEXT",
+    "ALTER TABLE archives ADD COLUMN network TEXT",
+    "ALTER TABLE archives ADD COLUMN highlights TEXT",
+    "ALTER TABLE archives ADD COLUMN full_metadata TEXT",
     "ALTER TABLE archives ADD COLUMN storage_channel_id INTEGER",
     "ALTER TABLE archives ADD COLUMN storage_msg_id INTEGER",
 ]
@@ -43,66 +60,108 @@ from routers import health, movies, series, search, stream
 from routers import auth_r, user, social, chat, parties
 from routers import store, payments
 from routers import notifications, achievements, leaderboard, comments
-from routers import archive, websocket as ws_router
-from routers import social_feed, clubs, gamification, analytics, media as media_router
+from routers import archive
+
 
 _CACHEABLE_PATHS = (
-    "/api/v1/health", "/api/v1/movies/trending", "/api/v1/movies/featured",
-    "/api/v1/movies/latest", "/api/v1/movies/genres", "/api/v1/stream/proxy/status",
+    "/api/v1/health",
+    "/api/v1/movies/trending",
+    "/api/v1/movies/featured",
+    "/api/v1/movies/latest",
+    "/api/v1/movies/genres",
+    "/api/v1/stream/proxy/status",
 )
-_INMEM_CACHE, _INMEM_TTL = {}, {}
+
+_INMEM_CACHE = {}
+_INMEM_TTL = {}
+
 
 async def cache_middleware(request: Request, call_next):
     path = request.url.path
     if request.method != "GET" or path == "/favicon.ico":
         return await call_next(request)
+
     now = time.time()
     cached = _INMEM_CACHE.get(path)
     if cached and now < _INMEM_TTL.get(path, 0):
-        return JSONResponse(content=cached, headers={"Cache-Control": "public, max-age=120","X-Cache":"HIT","Access-Control-Allow-Origin":"*"})
+        return JSONResponse(content=cached, headers={
+            "Cache-Control": "public, max-age=120",
+            "X-Cache": "HIT",
+            "Access-Control-Allow-Origin": "*",
+        })
+
     response = await call_next(request)
-    if response.status_code != 200: return response
+    if response.status_code != 200:
+        return response
+
     cached_ttl = 30
     for prefix in _CACHEABLE_PATHS:
-        if path.startswith(prefix): cached_ttl = 120; break
+        if path.startswith(prefix):
+            cached_ttl = 120
+            break
+
     try:
         body = b"".join([chunk async for chunk in response.body_iterator])
+        response = JSONResponse(
+            content=json.loads(body),
+            status_code=response.status_code,
+            headers=dict(response.headers),
+        )
         parsed = json.loads(body)
-        new_headers = dict(response.headers)
-        new_headers["Cache-Control"] = f"public, max-age={cached_ttl}"
-        new_resp = JSONResponse(content=parsed, status_code=response.status_code, headers=new_headers)
         _INMEM_CACHE[path] = parsed
         _INMEM_TTL[path] = now + cached_ttl
-        return new_resp
     except:
-        response.headers["Cache-Control"] = f"public, max-age={cached_ttl}"
-        return response
+        pass
+
+    response.headers["Cache-Control"] = f"public, max-age={cached_ttl}"
+    return response
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     task = asyncio.create_task(keep_warm())
     try:
-        for sqls in [INIT_SQLS, INDEX_SQLS, FTS_SQLS, SEED_SQLS]:
-            await init_tables(sqls)
+        r = await init_tables(INIT_SQLS)
+        i = await init_tables(INDEX_SQLS)
+        f = await init_tables(FTS_SQLS)
+        s = await init_tables(SEED_SQLS)
+
         for migration in _MIGRATIONS:
-            try: await exec(migration)
-            except: pass
-        try: await exec("UPDATE archives SET status='archived' WHERE status IS NULL OR status=''")
-        except: pass
-    except Exception as e: print(f"[init] error: {e}")
+            try:
+                await exec(migration)
+            except Exception:
+                pass
+
+        try:
+            await exec("UPDATE archives SET status='archived' WHERE status IS NULL OR status=''")
+        except Exception:
+            pass
+    except Exception as e:
+        print(f"[init] error: {e}")
     yield
     task.cancel()
-    try: await task
-    except: pass
+    try:
+        await task
+    except:
+        pass
     await close_session()
 
-app = FastAPI(title="PopCorn API", version="3.5", lifespan=lifespan)
+
+app = FastAPI(title="PopCorn Unified API", version="3.0.0", lifespan=lifespan)
+
 app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
-app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=False, allow_methods=["*"], allow_headers=["*"])
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=CORS_ORIGINS,
+    allow_credentials=not DEV_MODE,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
 app.middleware("http")(cache_middleware)
 
-# API Routes
 app.include_router(health.router, prefix="/api/v1", tags=["health"])
 app.include_router(auth_r.router, prefix="/api/v1/auth", tags=["auth"])
 app.include_router(movies.router, prefix="/api/v1/movies", tags=["movies"])
@@ -120,22 +179,88 @@ app.include_router(achievements.router, prefix="/api/v1/achievements", tags=["ac
 app.include_router(leaderboard.router, prefix="/api/v1/leaderboard", tags=["leaderboard"])
 app.include_router(comments.router, tags=["comments"])
 app.include_router(archive.router, prefix="/api/v1/archive", tags=["archive"])
-app.include_router(ws_router.router, prefix="/api/v1/ws", tags=["websocket"])
-app.include_router(social_feed.router, prefix="/api/v1/social", tags=["social-feed"])
-app.include_router(clubs.router, prefix="/api/v1", tags=["clubs"])
-app.include_router(gamification.router, prefix="/api/v1/game", tags=["gamification"])
-app.include_router(analytics.router, prefix="/api/v1/analytics", tags=["analytics"])
-app.include_router(media_router.router, prefix="/api/v1/media", tags=["media"])
+
 
 @app.get("/")
 async def root():
-    return {"status":"ok","org":ORG,"version":"3.5"}
+    return {"status": "ok", "org": ORG, "version": "3.0", "dev_mode": DEV_MODE, "accounts": list(ACCOUNTS.keys())}
+
 
 @app.get("/health")
 @limiter.limit("30/minute")
 async def root_health(request: Request):
-    return {"ok":True,"data":{"status":"healthy","version":"3.5"}}
+    return {"ok": True, "data": {"status": "healthy", "version": "3.0.0", "dev_mode": DEV_MODE}}
+
+
+@app.get("/status")
+async def compat_status(request: Request):
+    from routers.archive import full_status
+    return await full_status(request)
+
+
+@app.get("/network")
+async def compat_network(request: Request):
+    from routers.archive import network
+    return await network(request)
+
+
+@app.get("/archive/progress")
+async def compat_archive_progress(request: Request, archive_id: str = None):
+    from routers.archive import handle_progress_get
+    return await handle_progress_get(request, archive_id)
+
+
+@app.get("/archive/active")
+async def compat_archive_active(request: Request):
+    from routers.archive import handle_archive_active
+    return await handle_archive_active(request)
+
+
+@app.get("/archive/stats")
+async def compat_archive_stats(request: Request):
+    from routers.archive import handle_stats
+    return await handle_stats(request)
+
+
+@app.get("/archive/storage")
+async def compat_archive_storage(request: Request):
+    from routers.archive import handle_storage
+    return await handle_storage(request)
+
+
+@app.get("/orchestrate")
+async def compat_orchestrate(request: Request, target: str = "all", action: str = "ping"):
+    from routers.archive import orchestrate
+    return await orchestrate(request, target, action)
+
+
+@app.post("/archive/file")
+async def compat_archive_file(request: Request):
+    from routers.archive import handle_archive_file, ArchiveFileRequest
+    body = await request.json()
+    req = ArchiveFileRequest(**body)
+    return await handle_archive_file(req, request)
+
+
+@app.post("/archive/progress/update")
+async def compat_archive_progress_update(request: Request):
+    from routers.archive import handle_progress_update, ProgressUpdateRequest
+    raw = await request.json()
+    aid = raw.get("archive_id", "")
+    if not aid:
+        raise HTTPException(status_code=400, detail="Missing archive_id")
+    req = ProgressUpdateRequest(archive_id=aid)
+    return await handle_progress_update(req, request)
+
+
+@app.post("/archive/check-duplicate")
+async def compat_archive_check_dup(request: Request):
+    from routers.archive import handle_check_duplicate, CheckDuplicateRequest
+    body = await request.json()
+    req = CheckDuplicateRequest(**body)
+    return await handle_check_duplicate(req, request)
+
 
 @app.exception_handler(Exception)
 async def global_exception_handler(request, exc):
-    return JSONResponse(status_code=500, content={"ok":False,"error":str(exc)[:300]})
+    return JSONResponse(status_code=500, content={"ok": False, "error": str(exc)[:300]})

config.py

@@ -1,15 +1,12 @@
 import os
-from dotenv import load_dotenv
-
-load_dotenv()  # Load .env file for local development
 
 ORG = "MML-ANALYSING-SHYPER-AND-API-MID-STRUCTER"
 HF_TOKEN = os.environ.get("HF_TOKEN", "")
-TELEGRAM_BOT_TOKEN = os.environ.get("TELEGRAM_BOT_TOKEN", "")
-TMDB_API_KEY = os.environ.get("TMDB_API_KEY", "")
+TELEGRAM_BOT_TOKEN = os.environ.get("TELEGRAM_BOT_TOKEN")
+TMDB_API_KEY = os.environ.get("TMDB_API_KEY")
 DEV_MODE = os.environ.get("DEV_MODE", "").lower() in ("true", "1", "yes")
 
-DB_SPACE_URL = os.environ.get("DB_SPACE_URL", f"https://{ORG.lower()}-db.hf.space")
+DB_SPACE_URL = os.environ.get("DB_SPACE_URL", f"https://{ORG.lower().replace('_', '-')}-db.hf.space")
 
 ACCOUNTS = {
     "main": ORG,
@@ -33,12 +30,19 @@ ACCOUNT_TOKENS = {
     "user4": os.environ.get("HF_TOKEN_USER4", ""),
 }
 
-PROXY_SPACE_TTL = 28800       # 8 hours
-PROXY_CACHE_TTL = 3600        # 1 hour
+PROXY_SPACE_TTL = 28800
+PROXY_CACHE_TTL = 3600
 
 TMDB_IMAGE_BASE = "https://image.tmdb.org/t/p"
 
-CORS_ORIGINS = ["*"]
+CORS_ORIGINS = ["*"] if DEV_MODE else [
+    "https://mml-analysing-shyper-and-api-mid-structer-api.hf.space",
+    "https://popcornminisite.github.io",
+    "https://jamalmellouki.github.io",
+    "https://popcorn.app",
+    "http://localhost:5173",
+    "http://localhost:3000",
+]
 
 
 def resolve_proxy_url(account_key: str) -> str:
@@ -53,7 +57,7 @@ def resolve_archiver_url(account_key: str) -> str:
     return f"https://{slug}-archiver.hf.space"
 
 
-def dataset_for_account(account_key: str) -> str | None:
+def dataset_for_account(account_key: str) -> str:
     namespace = ACCOUNTS.get(account_key, account_key)
     if namespace == ORG:
         return None

database.py

@@ -2,7 +2,6 @@ import json
 import os
 import aiohttp
 from config import DB_SPACE_URL, HF_TOKEN
-from typing import Any
 
 HEADERS = {"Authorization": f"Bearer {HF_TOKEN}"}
 _session: aiohttp.ClientSession | None = None
@@ -22,8 +21,7 @@ async def close_session():
         _session = None
 
 
-def _escape(val: Any) -> str:
-    """Safe value escaping for SQLite inline usage."""
+def _escape(val):
     if val is None:
         return "NULL"
     t = type(val)
@@ -31,91 +29,62 @@ def _escape(val: Any) -> str:
         return str(val)
     if t is bool:
         return "1" if val else "0"
-    s = str(val)
-    # Instead of manual escaping, we use parameterized queries via the JSON API
-    return json.dumps(s)
+    s = str(val).replace("'", "''")
+    return f"'{s}'"
 
 
 def _build_sql(sql: str, params: list | None = None) -> str:
-    """
-    Build SQL string by replacing ? placeholders with escaped values.
-    NOTE: This is a fallback. The prefered approach is to pass params
-    separately when the DB supports parameterized queries.
-    """
+    # Internal use only: builds SQL from template with ? placeholders
     if not params:
         return sql
     parts = sql.split("?")
     result = parts[0]
     for i, p in enumerate(params):
+        val = p
+        if not isinstance(val, (int, float, bool)):
+            val = str(val)
         if i + 1 < len(parts):
-            result += _escape(p) + parts[i + 1]
+            result += _escape(val) + parts[i + 1]
         else:
-            result += _escape(p)
+            result += _escape(val)
     return result
 
 
 async def exec(sql: str, params: list = None) -> dict:
-    """Execute a SQL statement (INSERT, UPDATE, DELETE, DDL)."""
     session = await get_session()
     full_sql = _build_sql(sql, params)
-    payload: dict[str, Any] = {"sql": full_sql}
-    async with session.post(f"{DB_SPACE_URL}/exec", json=payload) as resp:
-        if resp.status >= 400:
-            text = await resp.text()
-            return {"ok": False, "error": text[:500]}
+    async with session.post(f"{DB_SPACE_URL}/exec", json={"sql": full_sql}) as resp:
         return await resp.json()
 
 
 async def query(sql: str, params: list = None) -> dict:
-    """Query the database and return raw response."""
     session = await get_session()
     full_sql = _build_sql(sql, params)
-    async with session.get(
-        f"{DB_SPACE_URL}/query",
-        params={"sql": full_sql},
-    ) as resp:
-        if resp.status >= 400:
-            text = await resp.text()
-            return {"ok": False, "error": text[:500], "cols": [], "rows": []}
+    async with session.get(f"{DB_SPACE_URL}/query", params={"sql": full_sql}) as resp:
         return await resp.json()
 
 
 async def fetch_all(sql: str, params: list = None) -> list[dict]:
-    """Fetch multiple rows as dicts."""
     r = await query(sql, params)
     if not r or "rows" not in r or not r["rows"]:
         return []
-    if r.get("ok") is False:
-        return []
     cols = r.get("cols") or r.get("columns", [])
     col_names = [c["name"] if isinstance(c, dict) else c for c in cols]
     return [dict(zip(col_names, row)) for row in r["rows"]]
 
 
 async def fetch_one(sql: str, params: list = None) -> dict | None:
-    """Fetch a single row as a dict, or None."""
     rows = await fetch_all(sql, params)
     return rows[0] if rows else None
 
 
 async def execute(sql: str, params: list = None) -> dict:
-    """Alias for exec()."""
     return await exec(sql, params)
 
 
 async def init_tables(sqls: list[str]) -> list[dict]:
-    """Execute a list of SQL statements (for schema init)."""
     results = []
     for sql in sqls:
         r = await exec(sql)
         results.append(r)
     return results
-
-
-async def execute_many(sql: str, params_list: list[list]) -> list[dict]:
-    """Execute the same SQL with multiple parameter sets."""
-    results = []
-    for params in params_list:
-        r = await exec(sql, params)
-        results.append(r)
-    return results

db_init.py

@@ -260,132 +260,4 @@ SEED_SQLS = [
     (7, 'Collector', 'Buy 5 items from the store', '\U0001f48e', 'store', 5),
     (8, 'High Roller', 'Earn 1000 kernels', '\U0001f4b0', 'earning', 1000)
     """,
-    # ── Social Feed ──
-    """CREATE TABLE IF NOT EXISTS social_posts (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id INTEGER NOT NULL,
-        post_type TEXT DEFAULT 'status',
-        content TEXT,
-        media_type TEXT,
-        media_id INTEGER,
-        image_url TEXT,
-        is_spoiler INTEGER DEFAULT 0,
-        tags TEXT,
-        likes_count INTEGER DEFAULT 0,
-        comments_count INTEGER DEFAULT 0,
-        shares_count INTEGER DEFAULT 0,
-        views_count INTEGER DEFAULT 0,
-        status TEXT DEFAULT 'active',
-        created_at TEXT DEFAULT (datetime('now'))
-    )""",
-    """CREATE TABLE IF NOT EXISTS social_likes (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        post_id INTEGER NOT NULL,
-        user_id INTEGER NOT NULL,
-        created_at TEXT DEFAULT (datetime('now')),
-        UNIQUE(post_id, user_id)
-    )""",
-    """CREATE TABLE IF NOT EXISTS social_saves (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        post_id INTEGER NOT NULL,
-        user_id INTEGER NOT NULL,
-        created_at TEXT DEFAULT (datetime('now')),
-        UNIQUE(post_id, user_id)
-    )""",
-    # ── Clubs ──
-    """CREATE TABLE IF NOT EXISTS clubs (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        name TEXT NOT NULL,
-        description TEXT,
-        cover_image TEXT,
-        owner_user_id INTEGER NOT NULL,
-        is_private INTEGER DEFAULT 0,
-        tags TEXT,
-        weekly_movie_tmdb_id INTEGER,
-        member_count INTEGER DEFAULT 0,
-        rules TEXT,
-        status TEXT DEFAULT 'active',
-        created_at TEXT DEFAULT (datetime('now'))
-    )""",
-    """CREATE TABLE IF NOT EXISTS club_members (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        club_id INTEGER NOT NULL,
-        user_id INTEGER NOT NULL,
-        role TEXT DEFAULT 'member',
-        joined_at TEXT DEFAULT (datetime('now')),
-        UNIQUE(club_id, user_id)
-    )""",
-    # ── Gamification ──
-    """CREATE TABLE IF NOT EXISTS daily_quests (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        title TEXT NOT NULL,
-        description TEXT,
-        xp_reward INTEGER DEFAULT 50,
-        stars_reward INTEGER DEFAULT 0,
-        kernels_reward INTEGER DEFAULT 0,
-        icon TEXT,
-        sort_order INTEGER DEFAULT 0,
-        is_active INTEGER DEFAULT 1
-    )""",
-    """CREATE TABLE IF NOT EXISTS user_quests (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id INTEGER NOT NULL,
-        quest_id INTEGER NOT NULL,
-        progress INTEGER DEFAULT 0,
-        completed INTEGER DEFAULT 0,
-        date TEXT DEFAULT (datetime('now', 'start of day')),
-        UNIQUE(user_id, quest_id, date)
-    )""",
-    """CREATE TABLE IF NOT EXISTS weekly_challenges (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        title TEXT NOT NULL,
-        description TEXT,
-        xp_reward INTEGER DEFAULT 200,
-        stars_reward INTEGER DEFAULT 50,
-        kernels_reward INTEGER DEFAULT 10,
-        icon TEXT,
-        is_active INTEGER DEFAULT 1,
-        starts_at TEXT,
-        ends_at TEXT
-    )""",
-    """CREATE TABLE IF NOT EXISTS season_pass_levels (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        level_num INTEGER NOT NULL UNIQUE,
-        xp_required INTEGER NOT NULL,
-        free_reward TEXT,
-        premium_reward TEXT
-    )""",
-    """CREATE TABLE IF NOT EXISTS user_season_pass (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        user_id INTEGER NOT NULL,
-        level_num INTEGER NOT NULL,
-        claimed INTEGER DEFAULT 0,
-        claimed_at TEXT,
-        UNIQUE(user_id, level_num)
-    )""",
-    # ── Seed Data ──
-    """INSERT OR IGNORE INTO daily_quests (id, title, description, xp_reward, icon, sort_order) VALUES
-        (1, 'شاهد فيلماً', 'شاهد أي فيلم اليوم', 50, '\U0001f3ac', 1),
-        (2, 'قيم 3 أفلام', 'أضف تقييمك لثلاثة أفلام', 30, '\u2b50', 2),
-        (3, 'شارك في حفلة', 'انضم أو أنشئ حفلة مشاهدة', 60, '\U0001f465', 3),
-        (4, 'اكتب مراجعة', 'شارك رأيك بفيلم شاهدته', 40, '\U0001f4dd', 4),
-        (5, 'تصفح 10 دقائق', 'تصفح التطبيق لمدة 10 دقائق', 20, '\u23f1\ufe0f', 5)
-    """,
-    """INSERT OR IGNORE INTO weekly_challenges (id, title, description, xp_reward, stars_reward, icon) VALUES
-        (1, 'ماراثون أفلام', 'شاهد 5 أفلام هذا الأسبوع', 200, 50, '\U0001f3c3'),
-        (2, 'مستكشف الأنواع', 'جرب 3 أنواع مختلفة من الأفلام', 150, 30, '\U0001f9ed'),
-        (3, 'اجتماعي', 'شارك في 3 حفلات مشاهدة', 180, 40, '\U0001f91d')
-    """,
-    """INSERT OR IGNORE INTO season_pass_levels (level_num, xp_required, free_reward, premium_reward) VALUES
-        (1, 0, '10 Stars', '20 Stars'),
-        (2, 100, '5 Kernels', '15 Kernels'),
-        (3, 250, '20 Stars', '🎨 Asset Common'),
-        (4, 500, '10 Kernels', '30 Stars'),
-        (5, 800, '50 Stars', '🎨 Asset Rare'),
-        (6, 1200, '15 Kernels', '100 Stars'),
-        (7, 1800, '100 Stars', '👑 Premium 1 Month'),
-        (8, 2500, '30 Kernels', '🎨 Asset Epic'),
-        (9, 4000, '200 Stars', '💎 500 Kernels'),
-        (10, 6000, '🎨 Asset Legendary', '👑 Premium 3 Months')
-    """,
 ]

requirements.txt

@@ -4,5 +4,3 @@ aiohttp>=3.9
 python-dotenv>=1.0
 python-multipart>=0.0.20
 slowapi>=0.1.9
-pydantic>=2.0
-python-dotenv>=1.0

routers/analytics.py

@@ -1,79 +0,0 @@
-"""Analytics API - إحصائيات وتحليلات المستخدم"""
-from fastapi import APIRouter, HTTPException, Request
-from database import fetch_one, fetch_all
-from auth import get_current_user
-
-router = APIRouter()
-
-async def _resolve_user(request: Request) -> dict:
-    user_data = await get_current_user(request)
-    user = await fetch_one("SELECT * FROM users WHERE user_id = ?", [str(user_data["id"])])
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-    return user
-
-@router.get("/stats")
-async def get_user_stats(request: Request):
-    """Get comprehensive user statistics"""
-    user = await _resolve_user(request)
-    db_id = str(user["id"])
-    
-    total_movies = await fetch_one("SELECT COUNT(*) as cnt FROM watch_history WHERE user_id=? AND media_type='movie'", [db_id])
-    total_series = await fetch_one("SELECT COUNT(DISTINCT tmdb_id) as cnt FROM watch_history WHERE user_id=? AND media_type='tv'", [db_id])
-    total_watch_time = await fetch_one("SELECT COALESCE(SUM(duration_seconds), 0) as total FROM watch_history WHERE user_id=?", [db_id])
-    avg_rating = await fetch_one("SELECT COALESCE(AVG(rating), 0) as avg FROM ratings WHERE user_id=?", [db_id])
-    total_reviews = await fetch_one("SELECT COUNT(*) as cnt FROM comments WHERE user_id=?", [db_id])
-    achievements = await fetch_one("SELECT COUNT(*) as cnt FROM user_achievements WHERE user_id=? AND is_unlocked=1", [db_id])
-    streak = await fetch_one("SELECT streak_count FROM daily_streaks WHERE user_id=?", [db_id])
-    
-    return {"ok": True, "data": {
-        "total_movies": total_movies["cnt"] if total_movies else 0,
-        "total_series": total_series["cnt"] if total_series else 0,
-        "total_watch_time": total_watch_time["total"] if total_watch_time else 0,
-        "average_rating": round(float(avg_rating["avg"] if avg_rating else 0), 1),
-        "total_reviews": total_reviews["cnt"] if total_reviews else 0,
-        "achievements_unlocked": achievements["cnt"] if achievements else 0,
-        "current_streak": streak["streak_count"] if streak else 0,
-    }}
-
-@router.get("/stats/genres")
-async def get_genre_breakdown(request: Request):
-    """Get genre distribution from watch history"""
-    user = await _resolve_user(request)
-    rows = await fetch_all("""
-        SELECT a.genres, COUNT(*) as count FROM watch_history wh
-        JOIN archives a ON wh.tmdb_id = a.media_id
-        WHERE wh.user_id=? AND a.genres != ''
-        GROUP BY a.genres ORDER BY count DESC""", [str(user["id"])])
-    
-    genre_counts = {}
-    for r in rows:
-        for g in (r["genres"] or "").split(","):
-            g = g.strip()
-            if g:
-                genre_counts[g] = genre_counts.get(g, 0) + r["count"]
-    total = sum(genre_counts.values()) or 1
-    data = [{"genre": k, "count": v, "percentage": round(v / total * 100, 1)} for k, v in sorted(genre_counts.items(), key=lambda x: -x[1])]
-    return {"ok": True, "data": data}
-
-@router.get("/stats/activity")
-async def get_activity_history(request: Request):
-    """Get recent user activity"""
-    user = await _resolve_user(request)
-    activities = []
-    wh = await fetch_all(
-        "SELECT tmdb_id, media_type, last_watched_at FROM watch_history WHERE user_id=? ORDER BY last_watched_at DESC LIMIT 10",
-        [str(user["id"])]
-    )
-    for w in wh:
-        activities.append({"action": "شاهد", "target": f"#{w['tmdb_id']}", "time": w.get("last_watched_at", ""), "icon": "🎬"})
-    
-    ratings = await fetch_all(
-        "SELECT tmdb_id, rating, updated_at FROM ratings WHERE user_id=? ORDER BY updated_at DESC LIMIT 5",
-        [str(user["id"])]
-    )
-    for r in ratings:
-        activities.append({"action": "قيم", "target": f"#{r['tmdb_id']} بـ {r['rating']}/10", "time": r.get("updated_at", ""), "icon": "⭐"})
-    
-    activities.sort(key=lambda x: x["time"], reverse=True)
-    return {"ok": True, "data": activities[:15]}

routers/clubs.py

@@ -1,113 +0,0 @@
-"""Movie Clubs API - الأندية السينمائية"""
-from fastapi import APIRouter, HTTPException, Request, Query
-from pydantic import BaseModel
-from typing import Optional
-from database import fetch_one, fetch_all, execute
-from auth import get_current_user
-from routers.utils import create_notification
-
-router = APIRouter()
-
-async def _resolve_user(request: Request) -> dict:
-    user_data = await get_current_user(request)
-    user = await fetch_one("SELECT * FROM users WHERE user_id = ?", [str(user_data["id"])])
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-    return user
-
-class CreateClub(BaseModel):
-    name: str
-    description: str
-    is_private: bool = False
-    tags: Optional[list[str]] = None
-
-class UpdateClub(BaseModel):
-    name: Optional[str] = None
-    description: Optional[str] = None
-    weekly_movie_tmdb_id: Optional[int] = None
-
-@router.get("/clubs")
-async def list_clubs(page: int = Query(1, ge=1), per_page: int = Query(20), search: str = "", tag: str = ""):
-    """List public clubs with optional search/filter"""
-    where = "WHERE c.is_private=0"
-    params = []
-    if search:
-        where += " AND (c.name LIKE ? OR c.description LIKE ?)"
-        params.extend([f"%{search}%", f"%{search}%"])
-    if tag:
-        where += " AND c.tags LIKE ?"
-        params.append(f"%{tag}%")
-    
-    offset = (page - 1) * per_page
-    total = await fetch_one(f"SELECT COUNT(*) as cnt FROM clubs c {where}", params)
-    clubs = await fetch_all(f"""
-        SELECT c.*, u.first_name as owner_name,
-               (SELECT COUNT(*) FROM club_members WHERE club_id=c.id) as member_count
-        FROM clubs c LEFT JOIN users u ON c.owner_user_id = u.id
-        {where} ORDER BY c.member_count DESC LIMIT {per_page} OFFSET {offset}""", params)
-    return {"ok": True, "data": clubs, "meta": {"total": total["cnt"] if total else 0, "page": page}}
-
-@router.post("/clubs")
-async def create_club(body: CreateClub, request: Request):
-    """Create a new movie club"""
-    user = await _resolve_user(request)
-    tags_str = ",".join(body.tags) if body.tags else ""
-    await execute(
-        """INSERT INTO clubs (name, description, owner_user_id, is_private, tags, member_count, created_at)
-           VALUES (?, ?, ?, ?, ?, 1, datetime('now'))""",
-        [body.name, body.description, str(user["user_id"]), "1" if body.is_private else "0", tags_str]
-    )
-    club = await fetch_one("SELECT * FROM clubs WHERE name=? AND owner_user_id=?", [body.name, str(user["user_id"])])
-    if club:
-        await execute("INSERT INTO club_members (club_id, user_id, role) VALUES (?, ?, 'owner')", [str(club["id"]), str(user["user_id"])])
-    return {"ok": True, "data": {"created": True}}
-
-@router.get("/clubs/my")
-async def get_my_clubs(request: Request):
-    """Get clubs the user belongs to"""
-    user = await _resolve_user(request)
-    clubs = await fetch_all(
-        """SELECT c.*, cm.role, (SELECT COUNT(*) FROM club_members WHERE club_id=c.id) as member_count
-           FROM clubs c JOIN club_members cm ON c.id=cm.club_id
-           WHERE cm.user_id=? ORDER BY cm.joined_at DESC""", [str(user["user_id"])]
-    )
-    return {"ok": True, "data": clubs}
-
-@router.get("/clubs/{club_id}")
-async def get_club(club_id: int, request: Request):
-    """Get club details"""
-    user = await _resolve_user(request)
-    club = await fetch_one("SELECT * FROM clubs WHERE id=?", [str(club_id)])
-    if not club:
-        raise HTTPException(status_code=404, detail="Club not found")
-    members = await fetch_all(
-        "SELECT cm.*, u.first_name, u.username, u.photo_url FROM club_members cm LEFT JOIN users u ON cm.user_id=u.user_id WHERE cm.club_id=?",
-        [str(club_id)]
-    )
-    return {"ok": True, "data": {**club, "members": members}}
-
-@router.post("/clubs/{club_id}/join")
-async def join_club(club_id: int, request: Request):
-    """Join a public club"""
-    user = await _resolve_user(request)
-    club = await fetch_one("SELECT * FROM clubs WHERE id=?", [str(club_id)])
-    if not club:
-        raise HTTPException(status_code=404, detail="Club not found")
-    existing = await fetch_one("SELECT * FROM club_members WHERE club_id=? AND user_id=?", [str(club_id), str(user["user_id"])])
-    if existing:
-        return {"ok": True, "data": {"message": "Already a member"}}
-    
-    await execute("INSERT INTO club_members (club_id, user_id, role) VALUES (?, ?, 'member')", [str(club_id), str(user["user_id"])])
-    await execute("UPDATE clubs SET member_count = member_count + 1 WHERE id=?", [str(club_id)])
-    
-    # Notify club owner
-    await create_notification(club["owner_user_id"], "club_join", f"انضم عضو جديد", f"انضم {user.get('first_name', '')} إلى نادي {club['name']}")
-    return {"ok": True, "data": {"joined": True}}
-
-@router.post("/clubs/{club_id}/leave")
-async def leave_club(club_id: int, request: Request):
-    """Leave a club"""
-    user = await _resolve_user(request)
-    await execute("DELETE FROM club_members WHERE club_id=? AND user_id=?", [str(club_id), str(user["user_id"])])
-    await execute("UPDATE clubs SET member_count = MAX(0, member_count - 1) WHERE id=?", [str(club_id)])
-    return {"ok": True, "data": {"left": True}}

routers/gamification.py

@@ -1,93 +0,0 @@
-"""Gamification API - التحديات والإنجازات ونظام المستويات"""
-from fastapi import APIRouter, HTTPException, Request, Query
-from database import fetch_one, fetch_all, execute
-from auth import get_current_user
-from routers.utils import progress_achievement
-
-router = APIRouter()
-
-LEVELS = [
-    (1, "New Popper 🍿", 0), (2, "Movie Fan 🎬", 100), (3, "Film Buff ⭐", 300),
-    (4, "Cinema Lover 🎥", 600), (5, "Movie Star 🌟", 1000), (6, "Film Critic 🏆", 1500),
-    (7, "Cinema King 👑", 2500), (8, "Movie Legend 🎪", 4000), (9, "Hall of Fame ⭐", 6000),
-    (10, "Living Cinema 🎬", 10000),
-]
-
-async def _resolve_user(request: Request) -> dict:
-    user_data = await get_current_user(request)
-    user = await fetch_one("SELECT * FROM users WHERE user_id = ?", [str(user_data["id"])])
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-    return user
-
-@router.get("/xp")
-async def get_user_xp(request: Request):
-    """Get user level, XP, and progress to next level"""
-    user = await _resolve_user(request)
-    xp = user.get("xp", 0) or 0
-    current_level = 1
-    for level_num, title, xp_req in LEVELS:
-        if xp >= xp_req:
-            current_level = level_num
-    next_xp = LEVELS[min(current_level, len(LEVELS)-1)][2] if current_level < len(LEVELS) else LEVELS[-1][2]
-    progress = min(100, int((xp / next_xp) * 100)) if next_xp else 100
-    return {
-        "ok": True, "data": {
-            "xp": xp, "level": current_level,
-            "title": LEVELS[current_level-1][1] if current_level <= len(LEVELS) else "Legend",
-            "xp_to_next": next_xp - xp, "progress": progress
-        }
-    }
-
-@router.get("/quests/daily")
-async def get_daily_quests(request: Request):
-    """Get today's daily quests"""
-    user = await _resolve_user(request)
-    today = "datetime('now', 'start of day')"
-    quests = await fetch_all(f"""
-        SELECT dq.*, COALESCE(uq.progress, 0) as user_progress,
-               CASE WHEN uq.completed=1 THEN 1 ELSE 0 END as completed
-        FROM daily_quests dq
-        LEFT JOIN user_quests uq ON dq.id=uq.quest_id AND uq.user_id=? AND uq.date={today}
-        WHERE dq.is_active=1 ORDER BY dq.sort_order""", [str(user["id"])])
-    return {"ok": True, "data": quests}
-
-@router.get("/quests/weekly")
-async def get_weekly_challenges(request: Request):
-    """Get weekly challenges"""
-    user = await _resolve_user(request)
-    challenges = await fetch_all("""
-        SELECT wc.*, COALESCE(uw.progress, 0) as user_progress,
-               CASE WHEN uw.completed=1 THEN 1 ELSE 0 END as completed
-        FROM weekly_challenges wc
-        LEFT JOIN user_weekly uw ON wc.id=uw.challenge_id AND uw.user_id=?
-        WHERE wc.is_active=1""", [str(user["id"])])
-    return {"ok": True, "data": challenges}
-
-@router.post("/quests/{quest_id}/progress")
-async def update_quest_progress(quest_id: int, request: Request):
-    """Update progress for a quest/challenge"""
-    user = await _resolve_user(request)
-    await execute("""
-        INSERT INTO user_quests (user_id, quest_id, progress, date)
-        VALUES (?, ?, 1, datetime('now', 'start of day'))
-        ON CONFLICT(user_id, quest_id, date) DO UPDATE SET progress=progress+1""",
-        [str(user["id"]), str(quest_id)])
-    return {"ok": True, "data": {"progressed": True}}
-
-@router.get("/season-pass")
-async def get_season_pass(request: Request):
-    """Get season pass levels and rewards"""
-    user = await _resolve_user(request)
-    levels = await fetch_all("SELECT * FROM season_pass_levels ORDER BY level_num")
-    user_levels = await fetch_all("SELECT * FROM user_season_pass WHERE user_id=?", [str(user["id"])])
-    claimed = {ul["level_num"]: ul["claimed"] for ul in user_levels}
-    result = []
-    for lv in levels:
-        result.append({
-            "level": lv["level_num"], "xp_required": lv["xp_required"],
-            "free_reward": lv["free_reward"], "premium_reward": lv["premium_reward"],
-            "claimed": claimed.get(lv["level_num"], False),
-            "unlocked": (user.get("xp", 0) or 0) >= lv["xp_required"],
-        })
-    return {"ok": True, "data": result}

routers/media.py

@@ -1,83 +0,0 @@
-"""Media Metadata API - جلب الميتاداتا الكاملة والصور"""
-from fastapi import APIRouter, HTTPException, Query
-from database import fetch_one, fetch_all
-
-router = APIRouter()
-
-@router.get("/metadata/{tmdb_id}")
-async def get_media_metadata(tmdb_id: int):
-    """Get full media metadata with credits, images, videos"""
-    row = await fetch_one("SELECT * FROM media_metadata WHERE tmdb_id=?", [str(tmdb_id)])
-    if not row:
-        # Fallback to archives
-        row = await fetch_one("SELECT * FROM archives WHERE media_id=?", [str(tmdb_id)])
-        if not row:
-            raise HTTPException(status_code=404, detail="Not found")
-        return {"ok": True, "data": {"tmdb_id": tmdb_id, "title": row.get("title"), "poster_url": row.get("poster_path"), "overview": row.get("overview")}}
-    
-    import json
-    cast = []
-    crew = []
-    try:
-        credits = json.loads(row.get("credits_json", "{}"))
-        cast = credits.get("cast", [])[:20]
-        crew = credits.get("crew", [])[:10]
-    except: pass
-    
-    return {
-        "ok": True, "data": {
-            "tmdb_id": row["tmdb_id"],
-            "media_type": row.get("media_type"),
-            "title": row.get("title"),
-            "overview": row.get("overview"),
-            "poster_url": f"https://image.tmdb.org/t/p/w500{row['poster_path']}" if row.get("poster_path") else None,
-            "backdrop_url": f"https://image.tmdb.org/t/p/w1280{row['backdrop_path']}" if row.get("backdrop_path") else None,
-            "year": row.get("year"),
-            "rating": row.get("rating"),
-            "genres": json.loads(row.get("genres", "[]")),
-            "runtime": row.get("runtime"),
-            "tagline": row.get("tagline"),
-            "status": row.get("status"),
-            "imdb_id": row.get("imdb_id"),
-            "budget": row.get("budget"),
-            "revenue": row.get("revenue"),
-            "cast": cast,
-            "crew": crew,
-        }
-    }
-
-@router.get("/metadata/search")
-async def search_metadata(q: str = Query(min_length=1)):
-    """Search metadata"""
-    rows = await fetch_all(
-        "SELECT tmdb_id, title, year, rating, poster_path FROM media_metadata WHERE title LIKE ? ORDER BY popularity DESC LIMIT 20",
-        [f"%{q}%"]
-    )
-    from config import TMDB_IMAGE_BASE
-    result = []
-    for r in rows:
-        result.append({
-            "tmdb_id": r["tmdb_id"],
-            "title": r.get("title"),
-            "year": r.get("year"),
-            "rating": r.get("rating"),
-            "poster_url": f"{TMDB_IMAGE_BASE}/w500{r['poster_path']}" if r.get("poster_path") else None,
-        })
-    return {"ok": True, "data": result}
-
-@router.get("/people/{person_id}")
-async def get_person(person_id: int):
-    """Get person details"""
-    row = await fetch_one("SELECT * FROM people WHERE id=?", [str(person_id)])
-    if not row:
-        raise HTTPException(status_code=404, detail="Not found")
-    return {"ok": True, "data": {
-        "id": row["id"],
-        "name": row.get("name"),
-        "known_for": row.get("known_for_department"),
-        "profile_url": f"https://image.tmdb.org/t/p/w185{row['profile_path']}" if row.get("profile_path") else None,
-        "popularity": row.get("popularity"),
-        "biography": row.get("biography"),
-        "birthday": row.get("birthday"),
-        "deathday": row.get("deathday"),
-    }}

routers/parties.py

@@ -9,8 +9,6 @@ from typing import Optional
 from database import fetch_one, fetch_all, execute
 from auth import get_current_user, verify_init_data
 from routers.utils import progress_achievement, create_notification
-from ratelimit import limiter
-import urllib.parse
 
 router = APIRouter()
 
@@ -44,7 +42,7 @@ class JoinParty(BaseModel):
 
 
 @router.post("/create")
-@limiter.limit("10/minute")
+@__import__('ratelimit').limiter.limit("10/minute")
 async def create_party(body: CreateParty, request: Request):
     user = await _resolve_user(request)
     room_code = _gen_room_code()
@@ -86,7 +84,7 @@ async def create_party(body: CreateParty, request: Request):
     if party_count:
         await progress_achievement(user["user_id"], "social", party_count[0]["cnt"])
 
-    share_link = f"https://t.me/share/url?url={urllib.parse.quote(f'انضم لمشاهدة {body.title}! room_code={room_code}')}"
+    share_link = f"https://t.me/share/url?url={__import__('urllib').parse.quote(f'انضم لمشاهدة {body.title}! room_code={room_code}')}"
 
     return {
         "ok": True,

routers/payments.py

@@ -1,18 +1,12 @@
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 from typing import Optional
-from database import fetch_one, fetch_all, execute
+from database import fetch_one, execute
 from auth import get_current_user, optional_current_user
 from routers.utils import progress_achievement, create_notification
-from config import TELEGRAM_BOT_TOKEN
-from ratelimit import limiter
-import os
 
 router = APIRouter()
 
-TELEGRAM_BOT_USERNAME = TELEGRAM_BOT_TOKEN.split(':')[0] if TELEGRAM_BOT_TOKEN else "PopCornMinibot"
-WEBHOOK_SECRET = os.environ.get("WEBHOOK_SECRET", "")
-
 
 async def _resolve_user(request: Request) -> dict:
     user_data = await get_current_user(request)
@@ -31,8 +25,9 @@ class CreateInvoice(BaseModel):
 
 class HybridPurchase(BaseModel):
     product_id: int
-    currency: str = "stars"
+    currency: str = "XTR"
     idempotency_key: str
+    payment_method: str = "stars"
 
 
 class WebhookPayload(BaseModel):
@@ -45,117 +40,72 @@ class WebhookPayload(BaseModel):
 
 @router.post("/create-invoice")
 async def create_invoice(body: CreateInvoice, request: Request):
-    """Create a Telegram Stars invoice for a product."""
     user = await _resolve_user(request)
     product = await fetch_one("SELECT * FROM products WHERE id=?", [str(body.product_id)])
     if not product:
         raise HTTPException(status_code=404, detail="Product not found")
 
     cost_stars = body.amount or product.get("price_stars", 0)
+
     payload = f"pc_{user['id']}_{body.product_id}_{body.idempotency_key}"
-    invoice_link = f"https://t.me/{TELEGRAM_BOT_USERNAME}/invoice/{payload}"
+    invoice_link = f"https://t.me/{__import__('config').TELEGRAM_BOT_TOKEN.split(':')[0]}/invoice/{payload}"
 
     return {
         "ok": True,
         "data": {
             "invoice_link": invoice_link,
             "payload": payload,
-            "amount": cost_stars,
+            "amount": body.amount,
             "currency": body.currency,
-            "product_id": body.product_id,
         },
     }
 
 
 @router.post("/hybrid-purchase")
-@limiter.limit("10/minute")
+@__import__('ratelimit').limiter.limit("10/minute")
 async def hybrid_purchase(body: HybridPurchase, request: Request):
-    """Purchase a product using kernels (in-app currency) or via Telegram Stars."""
     user = await _resolve_user(request)
     product = await fetch_one("SELECT * FROM products WHERE id=?", [str(body.product_id)])
     if not product:
         raise HTTPException(status_code=404, detail="Product not found")
 
-    cost_stars = product.get("price_stars", 0)
-    cost_kernels = product.get("price_kernels", cost_stars)
-
-    # Handle kernels purchase
-    if body.currency == "kernels":
-        cost = cost_kernels
+    if body.payment_method == "kernels":
+        cost = product.get("price_kernels", 0)
         balance = user.get("kernels_balance", 0)
         if balance < cost:
             raise HTTPException(status_code=400, detail="Not enough kernels")
-        await execute(
-            "UPDATE users SET kernels_balance = kernels_balance - ?, total_spent_kernels = total_spent_kernels + ? WHERE id=?",
-            [str(cost), str(cost), str(user["id"])],
-        )
+        await execute("UPDATE users SET kernels_balance = kernels_balance - ?, total_spent_kernels = total_spent_kernels + ? WHERE id=?",
+                      [str(cost), str(cost), str(user["id"])])
     else:
-        # Stars purchase via invoice
-        cost = cost_stars
+        cost = product.get("price_stars", 0)
         balance = user.get("stars_balance", 0)
-        if balance >= cost:
-            # Direct balance deduction (for dev/fallback)
-            await execute(
-                "UPDATE users SET stars_balance = stars_balance - ? WHERE id=?",
-                [str(cost), str(user["id"])],
-            )
-        else:
-            # Generate invoice link for Telegram Stars
-            payload = f"pc_{user['id']}_{body.product_id}_{body.idempotency_key}"
-            invoice_link = f"https://t.me/{TELEGRAM_BOT_USERNAME}/invoice/{payload}"
-            return {
-                "ok": True,
-                "data": {
-                    "invoice_link": invoice_link,
-                    "payload": payload,
-                    "product_id": body.product_id,
-                    "currency": body.currency,
-                    "amount": cost,
-                },
-            }
-
-    # Grant assets
-    asset_rows = await fetch_all(
-        "SELECT * FROM asset_items WHERE product_id=?",
-        [str(body.product_id)],
-    )
-    for asset in asset_rows:
-        await execute(
-            """INSERT OR IGNORE INTO user_assets (user_id, product_id, asset_item_id, asset_id, is_active, acquired_at)
-               VALUES (?, ?, ?, ?, ?, datetime('now'))""",
-            [str(user["id"]), str(body.product_id), str(asset["id"]), str(asset["id"]), "0" if len(asset_rows) > 1 else "1"],
-        )
-
-    # Record purchase
+        if balance < cost:
+            raise HTTPException(status_code=400, detail="Not enough stars")
+        await execute("UPDATE users SET stars_balance = stars_balance - ? WHERE id=?",
+                      [str(cost), str(user["id"])])
+
     await execute(
-        "INSERT INTO purchases (user_id, product_id, stars_amount, kernels_amount, status, purchased_at) VALUES (?, ?, ?, ?, 'completed', datetime('now'))",
-        [str(user["id"]), str(body.product_id), str(cost_stars), str(cost_kernels)],
+        "INSERT OR IGNORE INTO user_assets (user_id, asset_type, asset_id) VALUES (?, ?, ?)",
+        [str(user["id"]), "product", str(body.product_id)],
     )
 
-    # Progress achievements
-    purchase_count = await fetch_all(
-        "SELECT COUNT(*) as cnt FROM purchases WHERE user_id=?",
-        [str(user["id"])],
+    await execute(
+        "INSERT INTO purchases (user_id, product_id, stars_amount, status) VALUES (?, ?, ?, 'completed')",
+        [str(user["id"]), str(body.product_id), str(cost)],
     )
+
+    purchase_count = await fetch_all("SELECT COUNT(*) as cnt FROM purchases WHERE user_id=?", [str(user["id"])])
     if purchase_count:
-        await progress_achievement(user["id"], "store", purchase_count[0]["cnt"])
+        await progress_achievement(user["user_id"], "store", purchase_count[0]["cnt"])
 
-    return {
-        "ok": True,
-        "data": {
-            "purchased": True,
-            "product_id": body.product_id,
-            "currency": body.currency,
-            "amount": cost,
-        },
-    }
+    return {"ok": True, "data": {"purchased": True, "product_id": body.product_id, "idempotency_key": body.idempotency_key}}
 
 
 @router.post("/webhook")
 async def payment_webhook(body: WebhookPayload, request: Request):
-    """Webhook for Telegram Stars payment confirmation."""
     auth_header = request.headers.get("Authorization", "")
-    if WEBHOOK_SECRET and auth_header != f"Bearer {WEBHOOK_SECRET}":
+    token = __import__('os').environ.get("WEBHOOK_SECRET", "")
+    if token and auth_header != f"Bearer {token}":
         raise HTTPException(status_code=401, detail="Invalid webhook secret")
 
     if not body.product_id or not body.user_id:
@@ -167,34 +117,13 @@ async def payment_webhook(body: WebhookPayload, request: Request):
 
     cost = product.get("price_stars", 0)
 
-    # Grant assets to user
-    asset_rows = await fetch_all(
-        "SELECT * FROM asset_items WHERE product_id=?",
-        [str(body.product_id)],
-    )
-    for asset in asset_rows:
-        await execute(
-            """INSERT OR IGNORE INTO user_assets (user_id, product_id, asset_item_id, asset_id, is_active, acquired_at)
-               VALUES (?, ?, ?, ?, ?, datetime('now'))""",
-            [str(body.user_id), str(body.product_id), str(asset["id"]), str(asset["id"]), "0"],
-        )
-
-    # Record purchase
     await execute(
-        "INSERT INTO purchases (user_id, product_id, stars_amount, status, purchased_at, telegram_payment_id) VALUES (?, ?, ?, 'completed', datetime('now'), ?)",
-        [str(body.user_id), str(body.product_id), str(cost), body.telegram_payment_id or ""],
+        "INSERT OR IGNORE INTO user_assets (user_id, asset_type, asset_id) VALUES (?, ?, ?)",
+        [str(body.user_id), "product", str(body.product_id)],
     )
-
-    # Send notification
-    await create_notification(
-        body.user_id,
-        "purchase_completed",
-        "Purchase Complete!",
-        f"Thank you for your purchase of {product.get('name_en', 'item')}!",
-        '{"product_id": ' + str(body.product_id) + '}',
+    await execute(
+        "INSERT INTO purchases (user_id, product_id, stars_amount, status, purchased_at) VALUES (?, ?, ?, 'completed', datetime('now'))",
+        [str(body.user_id), str(body.product_id), str(cost)],
     )
 
-    return {
-        "ok": True,
-        "data": {"processed": True, "product_id": body.product_id, "user_id": body.user_id},
-    }
+    return {"ok": True, "data": {"processed": True, "product_id": body.product_id, "user_id": body.user_id}}

routers/social_feed.py

@@ -1,116 +0,0 @@
-"""Social Feed API - المنشورات والتغذية الاجتماعية"""
-from fastapi import APIRouter, HTTPException, Request, Query
-from pydantic import BaseModel
-from typing import Optional
-from database import fetch_one, fetch_all, execute
-from auth import get_current_user
-from ratelimit import limiter
-
-router = APIRouter()
-
-async def _resolve_user(request: Request) -> dict:
-    user_data = await get_current_user(request)
-    user = await fetch_one("SELECT * FROM users WHERE user_id = ?", [str(user_data["id"])])
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-    return user
-
-class CreatePost(BaseModel):
-    content: str
-    post_type: str = "status"  # review, rating, watch, achievement, party, status
-    media_type: Optional[str] = None
-    media_id: Optional[int] = None
-    is_spoiler: bool = False
-    tags: Optional[list[str]] = None
-
-class PostAction(BaseModel):
-    action: str  # like, unlike, save, unsave
-
-@router.get("/feed")
-async def get_feed(request: Request, page: int = Query(1, ge=1), per_page: int = Query(20, ge=1, le=50)):
-    """Get social feed with pagination"""
-    user = await _resolve_user(request)
-    offset = (page - 1) * per_page
-    total = await fetch_one("SELECT COUNT(*) as cnt FROM social_posts WHERE status='active'")
-    total_count = total["cnt"] if total else 0
-    
-    posts = await fetch_all(f"""
-        SELECT sp.*, u.username, u.first_name, u.photo_url, u.is_premium,
-               COALESCE(sl.liked, 0) as user_liked
-        FROM social_posts sp
-        LEFT JOIN users u ON sp.user_id = u.id
-        LEFT JOIN (SELECT post_id, 1 as liked FROM social_likes WHERE user_id=?) sl ON sl.post_id = sp.id
-        WHERE sp.status='active'
-        ORDER BY sp.created_at DESC
-        LIMIT {per_page} OFFSET {offset}""", [str(user["id"])])
-    
-    return {"ok": True, "data": posts, "meta": {"page": page, "per_page": per_page, "total": total_count}}
-
-@router.post("/feed")
-@limiter.limit("10/minute")
-async def create_post(body: CreatePost, request: Request):
-    """Create a new social post"""
-    user = await _resolve_user(request)
-    tags_str = ",".join(body.tags) if body.tags else ""
-    await execute(
-        """INSERT INTO social_posts (user_id, post_type, content, media_type, media_id, is_spoiler, tags, status, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, 'active', datetime('now'))""",
-        [str(user["id"]), body.post_type, body.content, body.media_type or "",
-         str(body.media_id) if body.media_id else None, "1" if body.is_spoiler else "0", tags_str]
-    )
-    return {"ok": True, "data": {"created": True}}
-
-@router.post("/feed/{post_id}/{action}")
-async def interact_with_post(post_id: int, action: str, request: Request):
-    """Like/unlike/save/unsave a post"""
-    user = await _resolve_user(request)
-    
-    if action == "like":
-        await execute("INSERT OR IGNORE INTO social_likes (post_id, user_id) VALUES (?, ?)", [str(post_id), str(user["id"])])
-        await execute("UPDATE social_posts SET likes_count = likes_count + 1 WHERE id = ?", [str(post_id)])
-    elif action == "unlike":
-        await execute("DELETE FROM social_likes WHERE post_id=? AND user_id=?", [str(post_id), str(user["id"])])
-        await execute("UPDATE social_posts SET likes_count = MAX(0, likes_count - 1) WHERE id = ?", [str(post_id)])
-    elif action == "save":
-        await execute("INSERT OR IGNORE INTO social_saves (post_id, user_id) VALUES (?, ?)", [str(post_id), str(user["id"])])
-    elif action == "unsave":
-        await execute("DELETE FROM social_saves WHERE post_id=? AND user_id=?", [str(post_id), str(user["id"])])
-    
-    return {"ok": True, "data": {"action": action, "success": True}}
-
-@router.get("/feed/friends")
-async def get_friends_feed(request: Request, page: int = Query(1, ge=1)):
-    """Get feed from friends only"""
-    user = await _resolve_user(request)
-    offset = (page - 1) * 20
-    posts = await fetch_all(f"""
-        SELECT sp.*, u.username, u.first_name, u.photo_url
-        FROM social_posts sp
-        JOIN users u ON sp.user_id = u.id
-        WHERE sp.user_id IN (
-            SELECT friend_id FROM friendships WHERE user_id = ? AND status='accepted'
-            UNION SELECT user_id FROM friendships WHERE friend_id = ? AND status='accepted'
-        ) AND sp.status='active'
-        ORDER BY sp.created_at DESC LIMIT 20 OFFSET {offset}""",
-        [str(user["user_id"]), str(user["user_id"])]
-    )
-    return {"ok": True, "data": posts}
-
-@router.get("/feed/trending")
-async def get_trending_posts(request: Request):
-    """Get trending posts (most likes in last 24h)"""
-    posts = await fetch_all("""
-        SELECT sp.*, u.username, u.first_name, u.photo_url
-        FROM social_posts sp
-        JOIN users u ON sp.user_id = u.id
-        WHERE sp.created_at >= datetime('now', '-1 day') AND sp.status='active'
-        ORDER BY sp.likes_count DESC LIMIT 10"""
-    )
-    return {"ok": True, "data": posts}
-
-@router.delete("/feed/{post_id}")
-async def delete_post(post_id: int, request: Request):
-    """Delete own post"""
-    user = await _resolve_user(request)
-    await execute("UPDATE social_posts SET status='deleted' WHERE id=? AND user_id=?", [str(post_id), str(user["id"])])
-    return {"ok": True, "data": {"deleted": True}}

routers/user.py

@@ -6,7 +6,6 @@ from typing import Optional
 from database import fetch_one, fetch_all, execute
 from auth import get_current_user
 from config import TMDB_IMAGE_BASE, DEV_MODE
-from ratelimit import limiter
 
 router = APIRouter()
 
@@ -218,7 +217,7 @@ async def get_daily_streak(request: Request):
 
 
 @router.post("/me/daily-streak/claim")
-@limiter.limit("5/minute")
+@__import__('ratelimit').limiter.limit("5/minute")
 async def claim_daily_streak(request: Request):
     user = await _resolve_user(request)
     today = datetime.now(timezone.utc).strftime("%Y-%m-%d")

routers/utils.py

@@ -1,97 +1,78 @@
-"""
-Shared utility functions for PopCorn API routers
-"""
 from database import fetch_one, fetch_all, execute
-from config import ACCOUNTS, ORG, DEV_MODE
 
-ACHIEVEMENT_THRESHOLDS = {
-    "watching": [1, 5, 10, 25, 50, 100, 250, 500, 1000],
-    "social": [1, 5, 10, 25, 50, 100],
-    "store": [1, 5, 10, 25, 50],
-    "comments": [1, 10, 25, 50, 100, 500],
-    "parties": [1, 5, 10, 25, 50],
-    "streak": [1, 3, 7, 14, 30, 60, 90, 180, 365],
-}
-
-
-async def progress_achievement(user_id: int | str, category: str, current_count: int) -> None:
-    """Progress an achievement category. Unlock it if threshold reached."""
-    thresholds = ACHIEVEMENT_THRESHOLDS.get(category, [])
-    target_count = None
-    for t in thresholds:
-        if current_count >= t:
-            target_count = t
-
-    if target_count is None:
-        return
 
+async def check_achievement(user_id: int, category: str, current: int, required: int, name: str):
     achievement = await fetch_one(
-        "SELECT id FROM achievements WHERE category=? AND total_required=?",
-        [category, str(target_count)],
+        "SELECT id FROM achievements WHERE name=? AND category=? AND total_required=?",
+        [name, category, str(required)],
     )
     if not achievement:
         return
 
-    existing = await fetch_one(
+    aid = achievement["id"]
+    ua = await fetch_one(
         "SELECT * FROM user_achievements WHERE user_id=? AND achievement_id=?",
-        [str(user_id), str(achievement["id"])],
+        [str(user_id), str(aid)],
     )
-    if existing and existing.get("is_unlocked"):
-        return
 
-    await execute(
-        """INSERT INTO user_achievements (user_id, achievement_id, progress, is_unlocked, unlocked_at)
-           VALUES (?, ?, ?, 1, datetime('now'))
-           ON CONFLICT(user_id, achievement_id) DO UPDATE SET
-           progress=?, is_unlocked=1, unlocked_at=CASE WHEN is_unlocked=0 THEN datetime('now') ELSE unlocked_at END""",
-        [str(user_id), str(achievement["id"]), str(target_count), str(target_count)],
-    )
+    if ua:
+        if ua.get("is_unlocked"):
+            return
+        if ua.get("progress", 0) >= ua.get("total", 1):
+            await execute(
+                "UPDATE user_achievements SET is_unlocked=1, unlocked_at=datetime('now') WHERE id=?",
+                [str(ua["id"])],
+            )
+            await create_notification(user_id, f"إنجاز مفتوح: {name}", f"لقد حصلت على إنجاز {name}!", "achievement_unlocked")
+    else:
+        await execute(
+            "INSERT INTO user_achievements (user_id, achievement_id, progress, total, is_unlocked) VALUES (?, ?, ?, ?, ?)",
+            [str(user_id), str(aid), str(current), str(required), "1" if current >= required else "0"],
+        )
+        if current >= required:
+            await create_notification(user_id, f"إنجاز مفتوح: {name}", f"لقد حصلت على إنجاز {name}!", "achievement_unlocked")
 
 
-async def create_notification(user_id: int | str, type: str, title: str, body: str, data: str = "{}") -> dict:
-    """Create a notification for a user."""
-    await execute(
-        """INSERT INTO notifications (user_id, type, title, body, data, is_read, created_at)
-           VALUES (?, ?, ?, ?, ?, 0, datetime('now'))""",
-        [str(user_id), type, title, body, data],
+async def progress_achievement(user_id: int, category: str, increment: int = 1):
+    achievements = await fetch_all(
+        "SELECT id, name, total_required FROM achievements WHERE category=?",
+        [category],
     )
-    return {"created": True}
-
+    for a in achievements:
+        aid = a["id"]
+        total = a["total_required"]
+        name = a["name"]
 
-async def create_or_update_user(user_data: dict) -> dict:
-    """Create a user if not exists, or update the existing one."""
-    tg_id = str(user_data["id"])
-    existing = await fetch_one("SELECT * FROM users WHERE user_id=?", [tg_id])
-    if existing:
-        await execute(
-            "UPDATE users SET first_name=?, last_name=?, username=?, language_code=?, photo_url=?, is_premium=?, last_active_at=datetime('now') WHERE user_id=?",
-            [
-                user_data.get("first_name", ""),
-                user_data.get("last_name", ""),
-                user_data.get("username", ""),
-                user_data.get("language_code", "en"),
-                user_data.get("photo_url", ""),
-                "1" if user_data.get("is_premium") else "0",
-                tg_id,
-            ],
+        ua = await fetch_one(
+            "SELECT * FROM user_achievements WHERE user_id=? AND achievement_id=?",
+            [str(user_id), str(aid)],
         )
-        return existing
 
-    await execute(
-        """INSERT INTO users (user_id, first_name, last_name, username, language_code, photo_url, is_premium, stars_balance, kernels_balance, points, created_at, last_active_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, 100, 5, 0, datetime('now'), datetime('now'))""",
-        [
-            tg_id,
-            user_data.get("first_name", ""),
-            user_data.get("last_name", ""),
-            user_data.get("username", ""),
-            user_data.get("language_code", "en"),
-            user_data.get("photo_url", ""),
-            "1" if user_data.get("is_premium") else "0",
-        ],
-    )
-    return await fetch_one("SELECT * FROM users WHERE user_id=?", [tg_id])
+        if ua:
+            if ua.get("is_unlocked"):
+                continue
+            new_progress = (ua.get("progress", 0) or 0) + increment
+            is_unlocked = "1" if new_progress >= total else "0"
+            await execute(
+                "UPDATE user_achievements SET progress=?, is_unlocked=?, unlocked_at=CASE WHEN ?=1 THEN datetime('now') ELSE NULL END WHERE id=?",
+                [str(new_progress), is_unlocked, is_unlocked, str(ua["id"])],
+            )
+            if new_progress >= total:
+                await create_notification(user_id, f"إنجاز مفتوح: {name}", f"لقد حصلت على إنجاز {name}!", "achievement_unlocked")
+        else:
+            await execute(
+                "INSERT INTO user_achievements (user_id, achievement_id, progress, total, is_unlocked) VALUES (?, ?, ?, ?, ?)",
+                [str(user_id), str(aid), str(increment), str(total), "1" if increment >= total else "0"],
+            )
+            if increment >= total:
+                await create_notification(user_id, f"إنجاز مفتوح: {name}", f"لقد حصلت على إنجاز {name}!", "achievement_unlocked")
 
 
-def is_dev_mode() -> bool:
-    return DEV_MODE
+async def create_notification(user_id: int, title: str, body: str, ntype: str = "info"):
+    try:
+        await execute(
+            "INSERT INTO notifications (user_id, title, body, type) VALUES (?, ?, ?, ?)",
+            [str(user_id), title, body, ntype],
+        )
+    except Exception:
+        pass

routers/websocket.py

@@ -1,301 +0,0 @@
-"""
-Real-time WebSocket Manager for PopCorn
-Handles: Watch Parties, Chat, Notifications, and Live Events
-"""
-import asyncio
-import json
-import time
-import uuid
-from typing import Any
-from fastapi import APIRouter, WebSocket, WebSocketDisconnect, Request, HTTPException
-from database import fetch_one, fetch_all, execute
-from auth import verify_init_data, get_current_user
-
-router = APIRouter()
-
-# ─── Connection Manager ───────────────────────────────────────────────────────
-
-class ConnectionManager:
-    def __init__(self):
-        self._rooms: dict[str, set[WebSocket]] = {}       # room_code -> {ws}
-        self._user_ws: dict[int, set[WebSocket]] = {}     # user_id -> {ws}
-        self._room_owners: dict[str, int] = {}             # room_code -> host_user_id
-        self._room_media: dict[str, dict] = {}             # room_code -> media info
-        self._room_participants: dict[str, dict] = {}      # room_code -> {user_id: participant_info}
-
-    async def connect_to_room(self, room_code: str, ws: WebSocket, user_id: int, user_data: dict, role: str = "follower"):
-        await ws.accept()
-        if room_code not in self._rooms:
-            self._rooms[room_code] = set()
-        self._rooms[room_code].add(ws)
-
-        if user_id not in self._user_ws:
-            self._user_ws[user_id] = set()
-        self._user_ws[user_id].add(ws)
-
-        # Store participant info
-        if room_code not in self._room_participants:
-            self._room_participants[room_code] = {}
-        self._room_participants[room_code][user_id] = {
-            "user_id": user_id,
-            "name": user_data.get("first_name", "Unknown"),
-            "username": user_data.get("username", ""),
-            "avatar_url": user_data.get("photo_url", ""),
-            "role": role,
-            "is_ready": False,
-            "joined_at": time.time(),
-            "is_online": True,
-        }
-
-        # Notify others
-        await self.broadcast_to_room(room_code, {
-            "type": "user_joined",
-            "participant": self._room_participants[room_code][user_id],
-        }, exclude=ws)
-
-        # Send current state
-        await ws.send_json({
-            "type": "room_state",
-            "participants": list(self._room_participants[room_code].values()),
-            "media": self._room_media.get(room_code),
-            "room_code": room_code,
-            "your_role": role,
-        })
-
-    async def disconnect(self, room_code: str, ws: WebSocket, user_id: int):
-        if room_code in self._rooms:
-            self._rooms[room_code].discard(ws)
-            if not self._rooms[room_code]:
-                del self._rooms[room_code]
-                self._room_participants.pop(room_code, None)
-                self._room_media.pop(room_code, None)
-
-        if user_id in self._user_ws:
-            self._user_ws[user_id].discard(ws)
-            if not self._user_ws[user_id]:
-                del self._user_ws[user_id]
-
-        # Remove participant and notify
-        if room_code in self._room_participants:
-            self._room_participants[room_code].pop(user_id, None)
-            await self.broadcast_to_room(room_code, {
-                "type": "user_left",
-                "user_id": user_id,
-            })
-
-    async def broadcast_to_room(self, room_code: str, message: dict, exclude: WebSocket | None = None):
-        if room_code not in self._rooms:
-            return
-        dead = set()
-        for ws in self._rooms[room_code]:
-            if ws == exclude:
-                continue
-            try:
-                await ws.send_json(message)
-            except Exception:
-                dead.add(ws)
-        for ws in dead:
-            self._rooms[room_code].discard(ws)
-
-    async def send_to_user(self, user_id: int, message: dict):
-        if user_id not in self._user_ws:
-            return
-        dead = set()
-        for ws in self._user_ws[user_id]:
-            try:
-                await ws.send_json(message)
-            except Exception:
-                dead.add(ws)
-        for ws in dead:
-            self._user_ws[user_id].discard(ws)
-
-    def get_room_participants_count(self, room_code: str) -> int:
-        return len(self._room_participants.get(room_code, {}))
-
-
-manager = ConnectionManager()
-
-
-# ─── WebSocket Endpoint ───────────────────────────────────────────────────────
-
-@router.websocket("/party/{room_code}")
-async def party_websocket(websocket: WebSocket, room_code: str):
-    user_id = None
-    user_data = None
-
-    try:
-        # Wait for auth message first
-        raw = await websocket.receive_text()
-        auth_data = json.loads(raw)
-
-        if auth_data.get("type") != "auth":
-            await websocket.close(code=4001, reason="Auth required")
-            return
-
-        init_data = auth_data.get("initData", "")
-        user_data = verify_init_data(init_data)
-        if not user_data or not user_data.get("id"):
-            await websocket.close(code=4001, reason="Invalid auth")
-            return
-
-        user_id = user_data["id"]
-        role = auth_data.get("role", "follower")
-
-        # Verify room exists
-        room = await fetch_one(
-            "SELECT * FROM party_rooms WHERE room_code = ? AND status != 'ended'",
-            [room_code],
-        )
-        if not room:
-            await websocket.send_json({"type": "error", "code": "ROOM_NOT_FOUND", "message": "Party room not found"})
-            await websocket.close(code=4004, reason="Room not found")
-            return
-
-        await manager.connect_to_room(room_code, websocket, user_id, user_data, role)
-
-        # Main message loop
-        while True:
-            raw = await websocket.receive_text()
-            msg = json.loads(raw)
-            msg_type = msg.get("type")
-
-            if msg_type == "ping":
-                await websocket.send_json({"type": "pong", "timestamp": time.time()})
-
-            elif msg_type == "sync":
-                # Leader sends sync; broadcast to all others
-                if manager._room_participants.get(room_code, {}).get(user_id, {}).get("role") == "leader":
-                    await manager.broadcast_to_room(room_code, {
-                        "type": "sync",
-                        "is_playing": msg.get("is_playing", False),
-                        "position": msg.get("position", 0),
-                        "timestamp": time.time(),
-                        "playback_rate": msg.get("playback_rate", 1.0),
-                    }, exclude=websocket)
-
-            elif msg_type == "chat":
-                message_data = {
-                    "type": "chat_message",
-                    "message": {
-                        "id": str(uuid.uuid4()),
-                        "user_id": str(user_id),
-                        "user_name": user_data.get("first_name", "Unknown"),
-                        "content": msg.get("content", ""),
-                        "type": "chat",
-                        "reply_to_id": msg.get("reply_to_id"),
-                        "created_at": time.time(),
-                    },
-                }
-                await manager.broadcast_to_room(room_code, message_data)
-
-            elif msg_type == "reaction":
-                await manager.broadcast_to_room(room_code, {
-                    "type": "reaction",
-                    "emoji": msg.get("emoji", "👍"),
-                    "target_id": msg.get("target_id"),
-                    "target_type": msg.get("target_type", "message"),
-                    "user_id": str(user_id),
-                })
-
-            elif msg_type == "ready":
-                is_ready = msg.get("is_ready", False)
-                if room_code in manager._room_participants and user_id in manager._room_participants[room_code]:
-                    manager._room_participants[room_code][user_id]["is_ready"] = is_ready
-
-                await manager.broadcast_to_room(room_code, {
-                    "type": "ready",
-                    "user_id": str(user_id),
-                    "is_ready": is_ready,
-                })
-
-            elif msg_type == "buffering":
-                await manager.broadcast_to_room(room_code, {
-                    "type": "buffering",
-                    "user_id": str(user_id),
-                    "is_buffering": msg.get("is_buffering", False),
-                })
-
-            elif msg_type == "leave":
-                break
-
-    except WebSocketDisconnect:
-        pass
-    except Exception as e:
-        print(f"[ws] error: {e}")
-    finally:
-        if room_code and user_id:
-            await manager.disconnect(room_code, websocket, user_id)
-
-
-# ─── Chat WebSocket ────────────────────────────────────────────────────────────
-
-@router.websocket("/chat/{conversation_id}")
-async def chat_websocket(websocket: WebSocket, conversation_id: str):
-    user_id = None
-    try:
-        raw = await websocket.receive_text()
-        auth_data = json.loads(raw)
-        init_data = auth_data.get("initData", "")
-        user_data = verify_init_data(init_data)
-        if not user_data or not user_data.get("id"):
-            await websocket.close(code=4001)
-            return
-
-        user_id = user_data["id"]
-        await websocket.accept()
-
-        while True:
-            raw = await websocket.receive_text()
-            msg = json.loads(raw)
-            if msg.get("type") == "ping":
-                await websocket.send_json({"type": "pong"})
-            elif msg.get("type") == "message":
-                content = msg.get("content", "").strip()
-                if content:
-                    msg_id = str(uuid.uuid4())
-                    await execute(
-                        "INSERT INTO chat_messages (id, conversation_id, sender_id, content, created_at) VALUES (?, ?, ?, ?, datetime('now'))",
-                        [msg_id, conversation_id, str(user_id), content],
-                    )
-                    # Update conversation last_message
-                    await execute(
-                        "UPDATE conversations SET last_message = ?, last_message_at = datetime('now') WHERE id = ?",
-                        [content, conversation_id],
-                    )
-                    await websocket.send_json({
-                        "type": "message_sent",
-                        "id": msg_id,
-                        "content": content,
-                        "sender_id": str(user_id),
-                        "created_at": time.time(),
-                    })
-    except WebSocketDisconnect:
-        pass
-    except Exception as e:
-        print(f"[ws-chat] error: {e}")
-
-
-# ─── REST Endpoints for Room Management ───────────────────────────────────────
-
-@router.get("/room/{room_code}/participants")
-async def get_room_participants(room_code: str):
-    participants = manager._room_participants.get(room_code, {})
-    return {"ok": True, "data": {"participants": list(participants.values()), "count": len(participants)}}
-
-
-@router.post("/room/{room_code}/media")
-async def set_room_media(room_code: str, request: Request):
-    body = await request.json()
-    manager._room_media[room_code] = body
-    await manager.broadcast_to_room(room_code, {"type": "media_changed", "media": body})
-    return {"ok": True}
-
-
-@router.post("/room/{room_code}/kick")
-async def kick_participant(room_code: str, request: Request):
-    body = await request.json()
-    target_user_id = body.get("user_id")
-    if target_user_id:
-        await manager.send_to_user(target_user_id, {"type": "kicked", "user_id": str(target_user_id)})
-        return {"ok": True}
-    raise HTTPException(status_code=400, detail="Missing user_id")