Update main.py

main.py

@@ -1,427 +1,1223 @@
+"""
+🎮 بوت تعويضات حسابات One Piece Bounty Rush
+====================================================
+ملف واحد يحتوي على كامل منطق البوت (نقاط / XP / متجر / VIP / إحالات /
+أكواد خصم / Mystery Box / سحوبات / Leaderboard / إنجازات / لوحة مطورين).
+
+كل البيانات تُحفظ في MongoDB فقط. لا يوجد تخزين محلي (RAM / ملفات / SQLite).
+مصمم للعمل على Hugging Face Docker Spaces:
+  - sdk: docker
+  - app_port: 7860 (القيمة الافتراضية الحالية في توثيق Hugging Face)
+  - يستمع على 0.0.0.0
+  - يشغّل HTTP health server (GET /health) بالتوازي مع Telegram polling
+  - يقرأ كل الأسرار عبر os.getenv() فقط (BOT_TOKEN, MONGO_URI, ...)
+"""
+
 import os
 import sys
-import time
+import json
 import random
-import logging
 import asyncio
-from datetime import datetime, timedelta
+import logging
+import signal
+from datetime import datetime, timedelta, timezone
+from typing import Optional, Dict, Any, List
+
 from aiohttp import web
+from pymongo import ASCENDING, DESCENDING, ReturnDocument
+from pymongo.errors import DuplicateKeyError, PyMongoError
 from motor.motor_asyncio import AsyncIOMotorClient
-from aiogram import Bot, Dispatcher, Router, F
-from aiogram.client.default import DefaultBotProperties
-from aiogram.types import Message, CallbackQuery, InlineKeyboardMarkup, InlineKeyboardButton
-from aiogram.filters import CommandStart, Command
-from aiogram.fsm.context import FSMContext
-from aiogram.fsm.state import State, StatesGroup
-from aiogram.exceptions import TelegramAPIError, TelegramNetworkError
-
-# --- الإعدادات الأساسية والأمان ---
-logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
-logger = logging.getLogger(__name__)
-
-BOT_TOKEN = os.getenv("BOT_TOKEN")
-MONGO_URI = os.getenv("MONGO_URI")
-
-if not BOT_TOKEN or not MONGO_URI:
-    logger.critical("🚨 خطأ حرج: BOT_TOKEN أو MONGO_URI غير موجود في Secrets. جاري الإيقاف.")
-    sys.exit(1)
-
-# الملاك الأساسيون
-OWNERS = [6069597294, 5359398024, 7126816492]
-SELL_ACCOUNT = "@kk66kk6"
-
-# إعداد قاعدة البيانات مع زيادة مهلة الاستجابة
-client = AsyncIOMotorClient(MONGO_URI, serverSelectionTimeoutMS=15000)
-db = client['bounty_rush_bot']
-
-# إعداد البوت بالتوافق مع النسخ الحديثة من aiogram
-bot = Bot(token=BOT_TOKEN, default=DefaultBotProperties(parse_mode="HTML"))
-dp = Dispatcher()
-router = Router()
-
-# --- تهيئة قاعدة البيانات والفهارس ---
-async def init_db():
-    try:
-        await db.users.create_index("user_id", unique=True)
-        await db.products.create_index("status")
-        await db.transactions.create_index("user_id")
-        
-        if not await db.settings.find_one({"_id": "bot_settings"}):
-            await db.settings.insert_one({
-                "_id": "bot_settings",
-                "ref_points": 500,
-                "msg_xp": 5,
-                "daily_reward": 1000,
-                "cooldown_seconds": 60,
-                "box_price": 2000
-            })
-        logger.info("✅ تم الاتصال بقاعدة بيانات MongoDB وتهيئة الفهارس بنجاح.")
-    except Exception as e:
-        logger.error(f"⚠️ خطأ أثناء الاتصال بقاعدة البيانات: {e}")
-
-async def get_settings():
-    settings = await db.settings.find_one({"_id": "bot_settings"})
-    if not settings:
-        return {
-            "ref_points": 500,
-            "msg_xp": 5,
-            "daily_reward": 1000,
-            "cooldown_seconds": 60,
-            "box_price": 2000
-        }
-    return settings
 
-async def get_user(user_id: int, username: str = None):
-    user = await db.users.find_one({"user_id": user_id})
-    if not user:
-        user = {
-            "user_id": user_id,
-            "username": username,
-            "points": 0,
-            "xp": 0,
-            "level": 1,
-            "vip": 0,
-            "tickets": 0,
-            "referrals": 0,
-            "is_banned": False,
-            "join_date": datetime.utcnow(),
-            "last_daily": None,
-            "last_msg_time": 0
+from telegram import (
+    Update,
+    InlineKeyboardMarkup,
+    InlineKeyboardButton,
+    ReplyKeyboardMarkup,
+    KeyboardButton,
+)
+from telegram.constants import ParseMode
+from telegram.ext import (
+    Application,
+    ApplicationBuilder,
+    CommandHandler,
+    MessageHandler,
+    CallbackQueryHandler,
+    ContextTypes,
+    filters,
+)
+from telegram.error import TelegramError
+
+# ---------------------------------------------------------------------------
+# Logging — لا تُطبع أبداً أي Secret أو بيانات اعتماد
+# ---------------------------------------------------------------------------
+logging.basicConfig(
+    format="%(asctime)s | %(levelname)s | %(name)s | %(message)s",
+    level=logging.INFO,
+)
+logging.getLogger("httpx").setLevel(logging.WARNING)
+logging.getLogger("apscheduler").setLevel(logging.WARNING)
+logger = logging.getLogger("bounty-rush-bot")
+
+
+# ---------------------------------------------------------------------------
+# قراءة الإعدادات من Environment Variables / Hugging Face Secrets فقط
+# ---------------------------------------------------------------------------
+def _require_env(name: str) -> str:
+    value = os.getenv(name)
+    if not value or not value.strip():
+        logger.critical(
+            "متغير البيئة المطلوب '%s' غير موجود. "
+            "أضفه من Space Settings -> Secrets ثم أعد تشغيل الـ Space.",
+            name,
+        )
+        sys.exit(1)
+    return value.strip()
+
+
+BOT_TOKEN = _require_env("BOT_TOKEN")
+MONGO_URI = _require_env("MONGO_URI")
+MONGO_DB_NAME = os.getenv("MONGO_DB_NAME", "bounty_rush_bot")
+PORT = int(os.getenv("PORT", "7860"))  # منفذ Hugging Face الافتراضي الحالي
+
+# معرّفات المالكين — أرقام Telegram User ID فقط، ليست Secrets
+OWNER_IDS = {6069597294, 5359398024, 7126816492}
+SELL_ACCOUNT_CONTACT = "@kk66kk6"
+
+ALL_ROLES = [
+    "super_admin",
+    "store_admin",
+    "points_admin",
+    "vip_admin",
+    "giveaway_admin",
+    "user_admin",
+    "moderator",
+]
+
+DEFAULT_SETTINGS: Dict[str, Any] = {
+    "_id": "config",
+    "bot_name": "🎮 One Piece Bounty Rush Store",
+    "points": {
+        "referral": 500,
+        "message_interaction": 5,
+        "interaction_cooldown_seconds": 60,
+        "daily_reward": 1000,
+        "weekly_reward": 5000,
+    },
+    "xp": {
+        "per_interaction": 10,
+        "interaction_cooldown_seconds": 60,
+    },
+    "levels": [
+        {"level": 1, "xp_required": 0, "points_reward": 0, "discount_percent": 0},
+        {"level": 2, "xp_required": 200, "points_reward": 100, "discount_percent": 0},
+        {"level": 3, "xp_required": 500, "points_reward": 200, "discount_percent": 1},
+        {"level": 5, "xp_required": 1500, "points_reward": 500, "discount_percent": 2},
+        {"level": 10, "xp_required": 5000, "points_reward": 1500, "discount_percent": 5},
+    ],
+    "links": {
+        "group": "",
+        "channel": "",
+        "sell_account_contact": SELL_ACCOUNT_CONTACT,
+    },
+    "messages": {
+        "welcome": "أهلاً بك في متجر حسابات ون بيس باونتي راش 🎮",
+    },
+    "mystery_box_enabled": True,
+    "giveaways_enabled": True,
+}
+
+# state بسيطة (ليست بيانات دائمة) لتتبّع خطوات إدخال الأدمن التفاعلية
+PENDING: Dict[int, Dict[str, Any]] = {}
+# تتبّع بسيط للتفاعل الأخير في الذاكرة كخط دفاع إضافي فوق ما هو محفوظ في DB
+LAST_SEEN: Dict[int, datetime] = {}
+
+
+def now_utc() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def gen_code(length: int = 6) -> str:
+    import string as _s
+
+    return "".join(random.SystemRandom().choice(_s.ascii_uppercase + _s.digits) for _ in range(length))
+
+
+# ---------------------------------------------------------------------------
+# طبقة الوصول لقاعدة البيانات
+# ---------------------------------------------------------------------------
+class DB:
+    def __init__(self, uri: str, name: str):
+        self.client = AsyncIOMotorClient(uri, serverSelectionTimeoutMS=8000)
+        self.db = self.client[name]
+
+        self.users = self.db["users"]
+        self.transactions = self.db["transactions"]
+        self.referrals = self.db["referrals"]
+        self.products = self.db["products"]
+        self.orders = self.db["orders"]
+        self.sell_requests = self.db["sell_requests"]
+        self.promo_codes = self.db["promo_codes"]
+        self.promo_code_usage = self.db["promo_code_usage"]
+        self.achievements = self.db["achievements"]
+        self.vip_plans = self.db["vip_plans"]
+        self.mystery_boxes = self.db["mystery_boxes"]
+        self.mystery_box_openings = self.db["mystery_box_openings"]
+        self.giveaways = self.db["giveaways"]
+        self.giveaway_entries = self.db["giveaway_entries"]
+        self.leaderboard_seasons = self.db["leaderboard_seasons"]
+        self.settings = self.db["settings"]
+        self.admins = self.db["admins"]
+        self.audit_logs = self.db["audit_logs"]
+
+    async def ping(self):
+        await self.client.admin.command("ping")
+
+    async def ensure_indexes(self):
+        await self.users.create_index("user_id", unique=True)
+        await self.users.create_index("referred_by")
+        await self.transactions.create_index("user_id")
+        await self.transactions.create_index(
+            "reference_id", unique=True, sparse=True
+        )
+        await self.referrals.create_index("referred_id", unique=True)
+        await self.referrals.create_index("referrer_id")
+        await self.products.create_index("status")
+        await self.orders.create_index("user_id")
+        await self.orders.create_index("product_id")
+        await self.promo_codes.create_index("code", unique=True)
+        await self.promo_code_usage.create_index(
+            [("code", ASCENDING), ("user_id", ASCENDING)], unique=True
+        )
+        await self.giveaway_entries.create_index(
+            [("giveaway_id", ASCENDING), ("user_id", ASCENDING)], unique=True
+        )
+        await self.mystery_box_openings.create_index("user_id")
+        await self.audit_logs.create_index([("created_at", DESCENDING)])
+        await self.admins.create_index("user_id", unique=True)
+
+    async def close(self):
+        self.client.close()
+
+
+db: Optional[DB] = None
+_settings_cache: Dict[str, Any] = {}
+_settings_cache_at: Optional[datetime] = None
+
+
+async def get_settings() -> Dict[str, Any]:
+    """يقرأ الإعدادات من MongoDB مع كاش قصير لتقليل الاستعلامات."""
+    global _settings_cache, _settings_cache_at
+    if _settings_cache_at and (now_utc() - _settings_cache_at).total_seconds() < 5:
+        return _settings_cache
+    doc = await db.settings.find_one({"_id": "config"})
+    if not doc:
+        doc = DEFAULT_SETTINGS.copy()
+        await db.settings.insert_one(doc)
+    _settings_cache = doc
+    _settings_cache_at = now_utc()
+    return doc
+
+
+async def update_settings_section(section: str, value: Any):
+    await db.settings.update_one(
+        {"_id": "config"}, {"$set": {section: value}}, upsert=True
+    )
+    global _settings_cache_at
+    _settings_cache_at = None
+
+
+# ---------------------------------------------------------------------------
+# الصلاحيات
+# ---------------------------------------------------------------------------
+async def get_admin_doc(user_id: int) -> Optional[Dict[str, Any]]:
+    return await db.admins.find_one({"user_id": user_id})
+
+
+async def is_owner(user_id: int) -> bool:
+    return user_id in OWNER_IDS
+
+
+async def get_roles(user_id: int) -> List[str]:
+    if user_id in OWNER_IDS:
+        return ["super_admin"]
+    doc = await get_admin_doc(user_id)
+    if not doc:
+        return []
+    return doc.get("roles", [])
+
+
+async def has_permission(user_id: int, required: Optional[List[str]] = None) -> bool:
+    roles = await get_roles(user_id)
+    if "super_admin" in roles:
+        return True
+    if not required:
+        return len(roles) > 0
+    return any(r in roles for r in required)
+
+
+async def audit(admin_id: int, action: str, details: Dict[str, Any]):
+    await db.audit_logs.insert_one(
+        {
+            "admin_id": admin_id,
+            "action": action,
+            "details": details,
+            "created_at": now_utc(),
         }
-        await db.users.insert_one(user)
-    return user
+    )
+
+
+# ---------------------------------------------------------------------------
+# المستخدمون
+# ---------------------------------------------------------------------------
+def default_user_doc(user_id: int, username: str, first_name: str) -> Dict[str, Any]:
+    return {
+        "user_id": user_id,
+        "username": username or "",
+        "first_name": first_name or "",
+        "points": 0,
+        "xp": 0,
+        "level": 1,
+        "levels_rewarded": [],
+        "vip": None,  # {"plan_id":..., "expires_at":...}
+        "tickets": 0,
+        "referred_by": None,
+        "referrals_count": 0,
+        "purchases_count": 0,
+        "sales_count": 0,
+        "achievements": [],
+        "banned": False,
+        "frozen": False,
+        "last_daily_claim": None,
+        "last_weekly_claim": None,
+        "last_interaction_at": None,
+        "personal_code": None,
+        "created_at": now_utc(),
+        "updated_at": now_utc(),
+    }
+
 
-async def log_transaction(user_id: int, amount: int, trans_type: str, reason: str):
-    await db.transactions.insert_one({
+async def get_or_create_user(user_id: int, username: str = "", first_name: str = "") -> Dict[str, Any]:
+    doc = await db.users.find_one({"user_id": user_id})
+    if doc:
+        upd = {}
+        if username and doc.get("username") != username:
+            upd["username"] = username
+        if first_name and doc.get("first_name") != first_name:
+            upd["first_name"] = first_name
+        if upd:
+            upd["updated_at"] = now_utc()
+            await db.users.update_one({"user_id": user_id}, {"$set": upd})
+            doc.update(upd)
+        return doc
+    new_doc = default_user_doc(user_id, username, first_name)
+    try:
+        await db.users.insert_one(new_doc)
+    except DuplicateKeyError:
+        return await db.users.find_one({"user_id": user_id})
+    return new_doc
+
+
+async def add_points(
+    user_id: int,
+    amount: int,
+    ptype: str,
+    reason: str,
+    admin_id: Optional[int] = None,
+    reference_id: Optional[str] = None,
+) -> bool:
+    """يضيف/يخصم نقاط مع دفتر معاملات، ويمنع التكرار عبر reference_id فريد."""
+    tx = {
         "user_id": user_id,
         "amount": amount,
-        "type": trans_type,
+        "type": ptype,
         "reason": reason,
-        "timestamp": datetime.utcnow()
-    })
-
-# --- لوحات المفاتيح ---
-def main_menu_kb():
-    kb = [
-        [InlineKeyboardButton(text="👤 حسابي", callback_data="my_profile"), 
-         InlineKeyboardButton(text="🛒 متجر الحسابات", callback_data="store")],
-        [InlineKeyboardButton(text="💰 بيع حساب", callback_data="sell_acc"),
-         InlineKeyboardButton(text="🎁 المكافأة اليومية", callback_data="daily_reward")],
-        [InlineKeyboardButton(text="📦 صندوق الحظ", callback_data="mystery_box"),
-         InlineKeyboardButton(text="🏆 المتصدرين", callback_data="leaderboard")],
-    ]
-    return InlineKeyboardMarkup(inline_keyboard=kb)
-
-def admin_menu_kb():
-    kb = [
-        [InlineKeyboardButton(text="🛒 إضافة منتج", callback_data="admin_add_product"),
-         InlineKeyboardButton(text="👥 إدارة المستخدمين", callback_data="admin_users")],
-        [InlineKeyboardButton(text="⚙️ إعدادات البوت", callback_data="admin_settings"),
-         InlineKeyboardButton(text="📊 الإحصائيات", callback_data="admin_stats")],
-        [InlineKeyboardButton(text="🔙 عودة للقائمة الرئيسية", callback_data="main_menu")]
-    ]
-    return InlineKeyboardMarkup(inline_keyboard=kb)
-
-# --- معالجة الأوامر والأحداث ---
-@router.message(CommandStart())
-async def cmd_start(message: Message):
-    user_id = message.from_user.id
-    args = message.text.split()
-    
+        "admin_id": admin_id,
+        "reference_id": reference_id,
+        "timestamp": now_utc(),
+    }
+    if reference_id:
+        try:
+            await db.transactions.insert_one(tx)
+        except DuplicateKeyError:
+            # هذه العملية سُجلت من قبل — لا تكرر إضافة النقاط
+            return False
+    else:
+        await db.transactions.insert_one(tx)
+
+    await db.users.update_one(
+        {"user_id": user_id}, {"$inc": {"points": amount}, "$set": {"updated_at": now_utc()}}
+    )
+    return True
+
+
+async def add_xp(user_id: int, amount: int, bot=None, chat_id: Optional[int] = None):
     user = await db.users.find_one({"user_id": user_id})
     if not user:
-        await get_user(user_id, message.from_user.username)
-        if len(args) > 1 and args[1].startswith("ref_"):
-            try:
-                referrer_id = int(args[1].split("_")[1])
-                if referrer_id != user_id:
-                    settings = await get_settings()
-                    ref_points = settings.get("ref_points", 500)
-                    
-                    await db.users.update_one({"user_id": referrer_id}, {"$inc": {"points": ref_points, "referrals": 1}})
-                    await log_transaction(referrer_id, ref_points, "add", f"إحالة المستخدم {user_id}")
-                    try:
-                        await bot.send_message(referrer_id, f"🎉 لقد قام شخص جديد بالدخول من رابطك! حصلت على {ref_points} نقطة.")
-                    except: pass
-            except: pass
+        return
+    new_xp = user.get("xp", 0) + amount
+    await db.users.update_one({"user_id": user_id}, {"$set": {"xp": new_xp, "updated_at": now_utc()}})
+    await check_level_up(user_id, new_xp, bot)
 
-    text = (
-        "<b>مرحباً بك في بوت تعويضات وحسابات One Piece Bounty Rush 🏴‍☠️</b>\n\n"
-        "يمكنك جمع النقاط من التفاعل والإحالات واستبدالها بحسابات ومكافآت."
+
+async def check_level_up(user_id: int, xp: int, bot=None):
+    settings = await get_settings()
+    levels = sorted(settings.get("levels", []), key=lambda l: l["xp_required"])
+    user = await db.users.find_one({"user_id": user_id})
+    if not user:
+        return
+    eligible = [l for l in levels if xp >= l["xp_required"]]
+    if not eligible:
+        return
+    top = eligible[-1]
+    already_rewarded = set(user.get("levels_rewarded", []))
+    if top["level"] != user.get("level"):
+        await db.users.update_one({"user_id": user_id}, {"$set": {"level": top["level"]}})
+    if top["level"] not in already_rewarded:
+        reward = top.get("points_reward", 0)
+        if reward:
+            await add_points(
+                user_id, reward, "level_up", f"مكافأة الوصول للمستوى {top['level']}",
+                reference_id=f"levelup:{user_id}:{top['level']}",
+            )
+        await db.users.update_one(
+            {"user_id": user_id}, {"$addToSet": {"levels_rewarded": top["level"]}}
+        )
+        if bot:
+            await safe_send(
+                bot, user_id,
+                f"⭐ مبروك! وصلت إلى Level {top['level']} وحصلت على {reward} نقطة إضافية!",
+            )
+    await check_achievements(user_id, bot)
+
+
+async def check_achievements(user_id: int, bot=None):
+    user = await db.users.find_one({"user_id": user_id})
+    if not user:
+        return
+    already = set(user.get("achievements", []))
+    async for ach in db.achievements.find({"enabled": {"$ne": False}}):
+        aid = ach["_id"]
+        if aid in already:
+            continue
+        cond = ach.get("condition", {})
+        ctype = cond.get("type")
+        ok = False
+        if ctype == "points_total" and user.get("points", 0) >= cond.get("value", 0):
+            ok = True
+        elif ctype == "level" and user.get("level", 1) >= cond.get("value", 0):
+            ok = True
+        elif ctype == "referrals_count" and user.get("referrals_count", 0) >= cond.get("value", 0):
+            ok = True
+        elif ctype == "purchases_count" and user.get("purchases_count", 0) >= cond.get("value", 0):
+            ok = True
+        elif ctype == "sales_count" and user.get("sales_count", 0) >= cond.get("value", 0):
+            ok = True
+        if ok:
+            await db.users.update_one({"user_id": user_id}, {"$addToSet": {"achievements": aid}})
+            reward = ach.get("points_reward", 0)
+            if reward:
+                await add_points(
+                    user_id, reward, "achievement", f"إنجاز: {ach.get('name')}",
+                    reference_id=f"ach:{user_id}:{aid}",
+                )
+            if bot:
+                await safe_send(bot, user_id, f"🏅 إنجاز جديد: {ach.get('name')} (+{reward} نقطة)")
+
+
+async def safe_send(bot, chat_id: int, text: str, **kwargs):
+    try:
+        await bot.send_message(chat_id=chat_id, text=text, **kwargs)
+    except TelegramError as e:
+        logger.warning("فشل إرسال رسالة إلى %s: %s", chat_id, e.__class__.__name__)
+    except Exception as e:  # noqa: BLE001
+        logger.warning("خطأ غير متوقع أثناء الإرسال: %s", e.__class__.__name__)
+
+
+# ---------------------------------------------------------------------------
+# الإحالات
+# ---------------------------------------------------------------------------
+async def process_referral(new_user_id: int, referrer_id: int, bot=None) -> bool:
+    if new_user_id == referrer_id:
+        return False
+    referrer = await db.users.find_one({"user_id": referrer_id})
+    if not referrer:
+        return False
+    try:
+        await db.referrals.insert_one(
+            {
+                "referrer_id": referrer_id,
+                "referred_id": new_user_id,
+                "created_at": now_utc(),
+            }
+        )
+    except DuplicateKeyError:
+        # هذا المستخدم لديه إحالة مسجّلة مسبقاً — امنع التكرار
+        return False
+
+    await db.users.update_one({"user_id": new_user_id}, {"$set": {"referred_by": referrer_id}})
+    await db.users.update_one({"user_id": referrer_id}, {"$inc": {"referrals_count": 1}})
+
+    settings = await get_settings()
+    reward = settings.get("points", {}).get("referral", 0)
+    if reward:
+        await add_points(
+            referrer_id, reward, "referral", f"إحالة مستخدم جديد {new_user_id}",
+            reference_id=f"ref:{referrer_id}:{new_user_id}",
+        )
+    if bot:
+        await safe_send(bot, referrer_id, f"👥 حصلت على {reward} نقطة من إحالة جديدة!")
+    await check_achievements(referrer_id, bot)
+    return True
+
+
+# ---------------------------------------------------------------------------
+# المتجر
+# ---------------------------------------------------------------------------
+async def purchase_product(user_id: int, product_id: str, bot=None, coupon_code: Optional[str] = None):
+    product = await db.products.find_one_and_update(
+        {"_id": product_id, "status": "متوفر"},
+        {"$set": {"status": "محجوز", "reserved_by": user_id, "reserved_at": now_utc()}},
+        return_document=ReturnDocument.AFTER,
     )
-    
-    kb = main_menu_kb()
-    if user_id in OWNERS or await db.admins.find_one({"user_id": user_id}):
-        kb.inline_keyboard.append([InlineKeyboardButton(text="👑 لوحة المطورين", callback_data="admin_panel")])
-        
-    await message.answer(text, reply_markup=kb)
-
-@router.callback_query(F.data == "main_menu")
-async def back_to_main(call: CallbackQuery):
-    user_id = call.from_user.id
-    text = "<b>القائمة الرئيسية:</b>"
-    kb = main_menu_kb()
-    if user_id in OWNERS or await db.admins.find_one({"user_id": user_id}):
-        kb.inline_keyboard.append([InlineKeyboardButton(text="👑 لوحة المطورين", callback_data="admin_panel")])
-    await call.message.edit_text(text, reply_markup=kb)
-
-@router.message(F.text & ~F.text.startswith('/'))
-async def process_message(message: Message):
-    if message.chat.type in ['group', 'supergroup']:
-        user_id = message.from_user.id
-        user = await get_user(user_id)
-        settings = await get_settings()
-        
-        now = time.time()
-        if now - user.get("last_msg_time", 0) > settings.get("cooldown_seconds", 60):
-            xp_to_add = settings.get("msg_xp", 5)
-            new_xp = user["xp"] + xp_to_add
-            new_level = int(new_xp / 100) + 1
-            
-            update_data = {"xp": new_xp, "last_msg_time": now}
-            if new_level > user.get("level", 1):
-                update_data["level"] = new_level
-                update_data["points"] = user["points"] + (new_level * 100)
-                await log_transaction(user_id, new_level * 100, "add", f"مكافأة الوصول للمستوى {new_level}")
+    if not product:
+        return False, "❌ هذا الحساب لم يعد متوفراً (ربما اشتراه شخص آخر أو لم يعد موجوداً)."
+
+    price = product.get("price", 0)
+    # تحقق من Flash Sale ومن انتهاء صلاحيته لحظة الشراء
+    flash = product.get("flash_sale")
+    if flash and flash.get("expires_at") and flash["expires_at"] > now_utc() and flash.get("remaining", 0) > 0:
+        price = flash.get("flash_price", price)
+
+    discount_percent = 0
+    if coupon_code:
+        code_doc = await db.promo_codes.find_one({"code": coupon_code.upper(), "active": True})
+        if code_doc:
+            expired = code_doc.get("expires_at") and code_doc.get("expires_at") < now_utc()
+            allowed_users = code_doc.get("allowed_users") or []
+            user_allowed = (not allowed_users) or (user_id in allowed_users)
+            if not expired and user_allowed and code_doc.get("used_count", 0) < code_doc.get("max_uses", 10**9):
                 try:
-                    await message.reply(f"🎉 مبروك! لقد وصلت إلى المستوى <b>{new_level}</b> وحصلت على مكافأة نقاط.")
-                except: pass
-                
-            await db.users.update_one({"user_id": user_id}, {"$set": update_data})
-
-@router.callback_query(F.data == "my_profile")
-async def show_profile(call: CallbackQuery):
-    user = await get_user(call.from_user.id)
-    bot_info = await bot.get_me()
-    ref_link = f"https://t.me/{bot_info.username}?start=ref_{user['user_id']}"
-    
-    text = (
-        f"👤 <b>حسابك:</b>\n"
-        f"🪙 النقاط: <code>{user.get('points', 0)}</code>\n"
-        f"⭐ المستوى: {user.get('level', 1)} (XP: {user.get('xp', 0)})\n"
-        f"💎 VIP: {'نعم' if user.get('vip', 0) > 0 else 'لا'}\n"
-        f"👥 الإحالات: {user.get('referrals', 0)}\n\n"
-        f"🔗 <b>رابط الإحالة الخاص بك:</b>\n<code>{ref_link}</code>"
+                    await db.promo_code_usage.insert_one({"code": code_doc["code"], "user_id": user_id, "used_at": now_utc()})
+                    discount_percent = code_doc.get("discount_percent", 0)
+                    await db.promo_codes.update_one({"_id": code_doc["_id"]}, {"$inc": {"used_count": 1}})
+                    owner_reward = code_doc.get("owner_points_reward", 0)
+                    if owner_reward and code_doc.get("owner_id"):
+                        await add_points(
+                            code_doc["owner_id"], owner_reward, "promo_code_used",
+                            f"استخدام الكود {code_doc['code']}",
+                            reference_id=f"promo:{code_doc['code']}:{user_id}",
+                        )
+                except DuplicateKeyError:
+                    pass  # المستخدم استخدم هذا الكود من قبل
+
+    final_price = max(0, round(price * (1 - discount_percent / 100)))
+
+    charged = await db.users.find_one_and_update(
+        {"user_id": user_id, "points": {"$gte": final_price}},
+        {"$inc": {"points": -final_price, "purchases_count": 1}},
+        return_document=ReturnDocument.AFTER,
     )
-    kb = InlineKeyboardMarkup(inline_keyboard=[[InlineKeyboardButton(text="🔙 عودة للقائمة", callback_data="main_menu")]])
-    await call.message.edit_text(text, reply_markup=kb)
+    if not charged:
+        # فشل الدفع → أعد المنتج متاحاً
+        await db.products.update_one(
+            {"_id": product_id}, {"$set": {"status": "متوفر"}, "$unset": {"reserved_by": "", "reserved_at": ""}}
+        )
+        return False, f"❌ رصيدك من النقاط غير كافٍ (السعر: {final_price})."
 
-@router.callback_query(F.data == "daily_reward")
-async def claim_daily(call: CallbackQuery):
-    user_id = call.from_user.id
-    user = await get_user(user_id)
-    settings = await get_settings()
-    
-    now = datetime.utcnow()
-    last_daily = user.get("last_daily")
-    
-    if last_daily and (now - last_daily).days < 1:
-        await call.answer("⏳ لقد استلمت المكافأة اليوم! عد غداً.", show_alert=True)
-        return
-        
-    reward = settings.get("daily_reward", 1000)
-    await db.users.update_one(
-        {"user_id": user_id}, 
-        {"$inc": {"points": reward}, "$set": {"last_daily": now}}
+    await db.products.update_one({"_id": product_id}, {"$set": {"status": "مباع", "sold_to": user_id, "sold_at": now_utc()}})
+    if flash:
+        await db.products.update_one({"_id": product_id}, {"$inc": {"flash_sale.remaining": -1}})
+
+    order_id = f"order:{product_id}:{user_id}:{int(now_utc().timestamp())}"
+    await db.orders.insert_one(
+        {
+            "_id": order_id,
+            "user_id": user_id,
+            "product_id": product_id,
+            "price_paid": final_price,
+            "discount_percent": discount_percent,
+            "created_at": now_utc(),
+        }
     )
-    await log_transaction(user_id, reward, "add", "المكافأة اليومية")
-    await call.answer(f"🎉 استلمت {reward} نقطة!", show_alert=True)
-    await show_profile(call)
-
-@router.callback_query(F.data == "sell_acc")
-async def sell_account(call: CallbackQuery):
-    text = f"💰 لبيع حسابك مقابل نقاط أو أموال، يرجى التواصل مع الإدارة عبر:\n\n{SELL_ACCOUNT}"
-    kb = InlineKeyboardMarkup(inline_keyboard=[
-        [InlineKeyboardButton(text="تواصل الآن", url=f"https://t.me/{SELL_ACCOUNT.replace('@', '')}")],
-        [InlineKeyboardButton(text="🔙 عودة", callback_data="main_menu")]
-    ])
-    await call.message.edit_text(text, reply_markup=kb)
-
-@router.callback_query(F.data == "mystery_box")
-async def open_box(call: CallbackQuery):
-    settings = await get_settings()
-    price = settings.get("box_price", 2000)
-    user_id = call.from_user.id
-    
-    user = await db.users.find_one_and_update(
+    await add_points(user_id, -0, "purchase_log", f"شراء منتج {product_id}", reference_id=f"buylog:{order_id}")
+    await check_achievements(user_id, bot)
+    return True, product
+
+
+async def revert_expired_flash_sales():
+    try:
+        cursor = db.products.find({"flash_sale.expires_at": {"$lt": now_utc()}, "status": "متوفر"})
+        async for p in cursor:
+            await db.products.update_one({"_id": p["_id"]}, {"$unset": {"flash_sale": ""}})
+    except PyMongoError as e:
+        logger.warning("تعذر فحص العروض المنتهية: %s", e.__class__.__name__)
+
+
+# ---------------------------------------------------------------------------
+# Mystery Box
+# ---------------------------------------------------------------------------
+async def open_mystery_box(user_id: int, box_id: str):
+    box = await db.mystery_boxes.find_one({"_id": box_id, "enabled": True})
+    if not box:
+        return False, "❌ هذا الصندوق غير متاح حالياً."
+    price = box.get("price", 0)
+    charged = await db.users.find_one_and_update(
         {"user_id": user_id, "points": {"$gte": price}},
         {"$inc": {"points": -price}},
-        return_document=True
+        return_document=ReturnDocument.AFTER,
     )
-    
-    if not user:
-        await call.answer("❌ نقاطك لا تكفي لفتح الصندوق!", show_alert=True)
-        return
-        
-    await log_transaction(user_id, price, "sub", "شراء صندوق حظ")
-    
-    prizes = [
-        ("نقاط", 500, 40), ("نقاط", 3000, 30), 
-        ("XP", 500, 20), ("تذكرة سحب", 1, 9), ("نقاط", 10000, 1)
+    if not charged:
+        return False, f"❌ رصيدك غير كافٍ لفتح هذا الصندوق (السعر: {price})."
+
+    prizes = box.get("prizes", [])
+    if not prizes:
+        return False, "❌ هذا الصندوق لا يحتوي على جوائز مُعرّفة."
+    weights = [p.get("probability", 1) for p in prizes]
+    prize = random.SystemRandom().choices(prizes, weights=weights, k=1)[0]
+
+    result = {"box_id": box_id, "user_id": user_id, "prize": prize, "opened_at": now_utc()}
+    await db.mystery_box_openings.insert_one(result)
+
+    ptype = prize.get("type")
+    if ptype == "points":
+        await add_points(user_id, prize.get("value", 0), "mystery_box", f"جائزة صندوق {box_id}")
+    elif ptype == "xp":
+        await add_xp(user_id, prize.get("value", 0))
+    elif ptype == "ticket":
+        await db.users.update_one({"user_id": user_id}, {"$inc": {"tickets": prize.get("value", 1)}})
+    elif ptype == "coupon":
+        code = gen_code(6)
+        await db.promo_codes.insert_one(
+            {
+                "code": code,
+                "discount_percent": prize.get("value", 5),
+                "active": True,
+                "max_uses": 1,
+                "used_count": 0,
+                "owner_id": user_id,
+                "owner_points_reward": 0,
+                "created_at": now_utc(),
+                "expires_at": now_utc() + timedelta(days=30),
+                "allowed_users": [user_id],
+            }
+        )
+        prize = {**prize, "code": code}
+    return True, prize
+
+
+# ---------------------------------------------------------------------------
+# السحوبات (Giveaways)
+# ---------------------------------------------------------------------------
+async def join_giveaway(user_id: int, giveaway_id: str):
+    giveaway = await db.giveaways.find_one({"_id": giveaway_id, "status": "open"})
+    if not giveaway:
+        return False, "❌ هذا السحب غير متاح حالياً."
+    cost_tickets = giveaway.get("ticket_cost", 1)
+    charged = await db.users.find_one_and_update(
+        {"user_id": user_id, "tickets": {"$gte": cost_tickets}},
+        {"$inc": {"tickets": -cost_tickets}},
+        return_document=ReturnDocument.AFTER,
+    )
+    if not charged:
+        return False, "❌ لا تملك تذاكر كافية للمشاركة في هذا السحب."
+    try:
+        await db.giveaway_entries.insert_one(
+            {"giveaway_id": giveaway_id, "user_id": user_id, "tickets": cost_tickets, "joined_at": now_utc()}
+        )
+    except DuplicateKeyError:
+        await db.users.update_one({"user_id": user_id}, {"$inc": {"tickets": cost_tickets}})
+        return False, "❌ أنت مشارك بالفعل في هذا السحب."
+    return True, "✅ تم تسجيل مشاركتك في السحب بنجاح!"
+
+
+async def draw_giveaway(giveaway_id: str, bot=None):
+    giveaway = await db.giveaways.find_one({"_id": giveaway_id})
+    if not giveaway or giveaway.get("status") != "open":
+        return None
+    entries = [e async for e in db.giveaway_entries.find({"giveaway_id": giveaway_id})]
+    if not entries:
+        await db.giveaways.update_one({"_id": giveaway_id}, {"$set": {"status": "closed_no_participants"}})
+        return None
+    winner = random.SystemRandom().choice(entries)
+    await db.giveaways.update_one(
+        {"_id": giveaway_id},
+        {"$set": {"status": "finished", "winner_id": winner["user_id"], "drawn_at": now_utc()}},
+    )
+    prize = giveaway.get("prize", {})
+    if prize.get("type") == "points":
+        await add_points(winner["user_id"], prize.get("value", 0), "giveaway_win", f"فوز بسحب {giveaway_id}")
+    if bot:
+        await safe_send(bot, winner["user_id"], f"🎉 مبروك! فزت بسحب: {giveaway.get('title')}")
+    return winner["user_id"]
+
+
+# ---------------------------------------------------------------------------
+# Leaderboard
+# ---------------------------------------------------------------------------
+async def get_leaderboard(limit: int = 10) -> List[Dict[str, Any]]:
+    cursor = db.users.find({"banned": {"$ne": True}}).sort("points", DESCENDING).limit(limit)
+    return [u async for u in cursor]
+
+
+# ---------------------------------------------------------------------------
+# Telegram Helpers
+# ---------------------------------------------------------------------------
+def main_menu_keyboard(is_admin: bool) -> ReplyKeyboardMarkup:
+    rows = [
+        [KeyboardButton("👤 حسابي"), KeyboardButton("🛒 المتجر")],
+        [KeyboardButton("🎁 المكافأة اليومية"), KeyboardButton("👥 الإحالات")],
+        [KeyboardButton("💎 VIP"), KeyboardButton("🎁 Mystery Box")],
+        [KeyboardButton("🎟️ السحوبات"), KeyboardButton("🏆 Leaderboard")],
+        [KeyboardButton("🏅 الإنجازات"), KeyboardButton("🏷️ أكوادي")],
+        [KeyboardButton("💰 بيع حساب مقابل نقاط")],
     ]
-    
-    prize_type, amount, _ = random.choices(prizes, weights=[p[2] for p in prizes])[0]
-    
-    if prize_type == "نقاط":
-        await db.users.update_one({"user_id": user_id}, {"$inc": {"points": amount}})
-        await log_transaction(user_id, amount, "add", "جائزة صندوق الحظ")
-    elif prize_type == "XP":
-        await db.users.update_one({"user_id": user_id}, {"$inc": {"xp": amount}})
-    elif prize_type == "تذكرة سحب":
-        await db.users.update_one({"user_id": user_id}, {"$inc": {"tickets": amount}})
-
-    await call.answer(f"🎉 فتحت الصندوق وربحت: {amount} {prize_type}!", show_alert=True)
-    await show_profile(call)
-
-@router.callback_query(F.data == "store")
-async def show_store(call: CallbackQuery):
-    products = await db.products.find({"status": "متوفر"}).to_list(10)
+    if is_admin:
+        rows.append([KeyboardButton("⚙️ لوحة المطورين")])
+    return ReplyKeyboardMarkup(rows, resize_keyboard=True)
+
+
+async def rate_limited_interaction(user_id: int) -> bool:
+    settings = await get_settings()
+    cooldown = settings.get("points", {}).get("interaction_cooldown_seconds", 60)
+    last = LAST_SEEN.get(user_id)
+    if last and (now_utc() - last).total_seconds() < cooldown:
+        return False
+    LAST_SEEN[user_id] = now_utc()
+    return True
+
+
+# ---------------------------------------------------------------------------
+# Handlers — أوامر عامة
+# ---------------------------------------------------------------------------
+async def cmd_start(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    tg_user = update.effective_user
+    try:
+        user = await get_or_create_user(tg_user.id, tg_user.username or "", tg_user.first_name or "")
+    except PyMongoError:
+        await update.message.reply_text("⚠️ تعذر الاتصال بقاعدة البيانات حالياً، حاول لاحقاً.")
+        return
+
+    if user.get("banned"):
+        await update.message.reply_text("🚫 حسابك محظور من استخدام هذا البوت.")
+        return
+
+    args = context.args
+    if args and args[0].startswith("ref_") and not user.get("referred_by"):
+        try:
+            referrer_id = int(args[0].replace("ref_", ""))
+            await process_referral(tg_user.id, referrer_id, context.bot)
+        except (ValueError, PyMongoError):
+            pass
+
+    settings = await get_settings()
+    admin = await has_permission(tg_user.id)
+    await update.message.reply_text(
+        settings.get("messages", {}).get("welcome", "أهلاً بك!"),
+        reply_markup=main_menu_keyboard(admin),
+    )
+
+
+async def cmd_myid(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    await update.message.reply_text(f"🆔 معرفك: `{update.effective_user.id}`", parse_mode=ParseMode.MARKDOWN)
+
+
+async def show_profile(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    user = await get_or_create_user(uid, update.effective_user.username or "", update.effective_user.first_name or "")
+    vip = user.get("vip")
+    vip_text = "لا يوجد" if not vip else f"{vip.get('plan_name','VIP')} (حتى {vip.get('expires_at')})"
+    text = (
+        f"👤 *حسابك*\n\n"
+        f"🪙 النقاط: {user.get('points',0)}\n"
+        f"⭐ XP: {user.get('xp',0)}\n"
+        f"📈 Level: {user.get('level',1)}\n"
+        f"💎 VIP: {vip_text}\n"
+        f"🎟️ التذاكر: {user.get('tickets',0)}\n"
+        f"🏅 الإنجازات: {len(user.get('achievements', []))}\n"
+        f"👥 الإحالات: {user.get('referrals_count',0)}\n"
+        f"🛒 المشتريات: {user.get('purchases_count',0)}\n"
+        f"💰 المبيعات: {user.get('sales_count',0)}\n"
+    )
+    await update.message.reply_text(text, parse_mode=ParseMode.MARKDOWN)
+
+
+async def show_store(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    products = [p async for p in db.products.find({"status": "متوفر"}).limit(10)]
     if not products:
-        kb = InlineKeyboardMarkup(inline_keyboard=[[InlineKeyboardButton(text="🔙 عودة للقائمة", callback_data="main_menu")]])
-        await call.message.edit_text("🛒 المتجر فارغ حالياً.", reply_markup=kb)
+        await update.message.reply_text("🛒 لا توجد حسابات متوفرة حالياً.")
         return
-    
-    kb = InlineKeyboardMarkup(inline_keyboard=[])
     for p in products:
-        kb.inline_keyboard.append([InlineKeyboardButton(text=f"{p['name']} - {p['price']} نقطة", callback_data=f"view_prod_{p['_id']}")])
-    kb.inline_keyboard.append([InlineKeyboardButton(text="🔙 عودة", callback_data="main_menu")])
-    
-    await call.message.edit_text("🛒 <b>حسابات Bounty Rush المتوفرة:</b>\nاختر حساباً للتفاصيل:", reply_markup=kb)
-
-@router.callback_query(F.data.startswith("view_prod_"))
-async def view_product(call: CallbackQuery):
-    from bson import ObjectId
-    prod_id = call.data.split("_")[2]
-    product = await db.products.find_one({"_id": ObjectId(prod_id)})
-    
-    if not product or product['status'] != 'متوفر':
-        await call.answer("❌ هذا الحساب لم يعد متوفراً.", show_alert=True)
+        price = p.get("price", 0)
+        flash = p.get("flash_sale")
+        caption = f"🎮 *{p.get('name')}*\n"
+        if flash and flash.get("expires_at", now_utc()) > now_utc() and flash.get("remaining", 0) > 0:
+            caption += f"💰 السعر: ~{price}~ 🔥 {flash.get('flash_price')}\n⏱️ ينتهي: {flash['expires_at'].strftime('%Y-%m-%d %H:%M UTC')}\n👤 المتبقي: {flash.get('remaining')}\n"
+        else:
+            caption += f"💰 السعر: {price} نقطة\n"
+        caption += f"📝 {p.get('description','')}\n"
+        kb = InlineKeyboardMarkup([[InlineKeyboardButton("🛒 شراء", callback_data=f"buy:{p['_id']}")]])
+        await update.message.reply_text(caption, parse_mode=ParseMode.MARKDOWN, reply_markup=kb)
+
+
+async def cb_buy(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    query = update.callback_query
+    await query.answer()
+    product_id = query.data.split(":", 1)[1]
+    ok, result = await purchase_product(query.from_user.id, product_id, context.bot)
+    if ok:
+        await query.message.reply_text(f"✅ تم شراء الحساب بنجاح: {result.get('name')}\nسيتواصل معك الأدمن لتسليم البيانات.")
+    else:
+        await query.message.reply_text(result)
+
+
+async def show_sell(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    await db.sell_requests.insert_one({"user_id": uid, "status": "pending", "created_at": now_utc()})
+    await db.users.update_one({"user_id": uid}, {"$inc": {"sales_count": 1}})
+    await check_achievements(uid, context.bot)
+    await update.message.reply_text(
+        f"💰 لبيع حسابك مقابل نقاط، تواصل ��باشرة مع: {SELL_ACCOUNT_CONTACT}\n"
+        "تم تسجيل طلبك في النظام."
+    )
+
+
+async def show_daily(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    user = await get_or_create_user(uid)
+    today = now_utc().date().isoformat()
+    if user.get("last_daily_claim") == today:
+        await update.message.reply_text("⏳ لقد استلمت المكافأة اليومية اليوم بالفعل، عد غداً!")
         return
-        
-    text = (
-        f"🏷️ <b>{product['name']}</b>\n"
-        f"💰 السعر: {product['price']} نقطة\n\n"
-        f"📝 الوصف:\n{product.get('description', 'لا يوجد وصف')}"
+    settings = await get_settings()
+    reward = settings.get("points", {}).get("daily_reward", 0)
+    await add_points(uid, reward, "daily_reward", "المكافأة اليومية", reference_id=f"daily:{uid}:{today}")
+    await db.users.update_one({"user_id": uid}, {"$set": {"last_daily_claim": today}})
+    await update.message.reply_text(f"🎁 حصلت على {reward} نقطة كمكافأة يومية!")
+
+
+async def show_referrals(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    bot_username = (await context.bot.get_me()).username
+    link = f"https://t.me/{bot_username}?start=ref_{uid}"
+    user = await get_or_create_user(uid)
+    await update.message.reply_text(
+        f"👥 رابط الإحالة الخاص بك:\n{link}\n\nعدد إحالاتك: {user.get('referrals_count',0)}"
     )
-    kb = InlineKeyboardMarkup(inline_keyboard=[
-        [InlineKeyboardButton(text="✅ تأكيد الشراء", callback_data=f"buy_prod_{prod_id}")],
-        [InlineKeyboardButton(text="🔙 عودة للمتجر", callback_data="store")]
-    ])
-    await call.message.edit_text(text, reply_markup=kb)
-
-@router.callback_query(F.data.startswith("buy_prod_"))
-async def buy_product(call: CallbackQuery):
-    from bson import ObjectId
-    user_id = call.from_user.id
-    prod_id = call.data.split("_")[2]
-    
-    product = await db.products.find_one({"_id": ObjectId(prod_id)})
-    if not product or product['status'] != 'متوفر':
-        await call.answer("❌ الحساب مباع أو غير متوفر.", show_alert=True)
+
+
+async def show_vip(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    plans = [p async for p in db.vip_plans.find({"enabled": {"$ne": False}})]
+    if not plans:
+        await update.message.reply_text("💎 لا توجد باقات VIP متاحة حالياً.")
         return
-        
-    price = product['price']
-    
-    user = await db.users.find_one_and_update(
-        {"user_id": user_id, "points": {"$gte": price}},
+    for plan in plans:
+        text = (
+            f"💎 *{plan.get('name')}*\n"
+            f"السعر: {plan.get('price')} نقطة | المدة: {plan.get('duration_days')} يوم\n"
+            f"المزايا: {plan.get('benefits_text','')}"
+        )
+        kb = InlineKeyboardMarkup([[InlineKeyboardButton("💎 اشتراك", callback_data=f"vip:{plan['_id']}")]])
+        await update.message.reply_text(text, parse_mode=ParseMode.MARKDOWN, reply_markup=kb)
+
+
+async def cb_vip(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    query = update.callback_query
+    await query.answer()
+    plan_id = query.data.split(":", 1)[1]
+    plan = await db.vip_plans.find_one({"_id": plan_id})
+    if not plan:
+        await query.message.reply_text("❌ هذه الباقة لم تعد متاحة.")
+        return
+    price = plan.get("price", 0)
+    uid = query.from_user.id
+    charged = await db.users.find_one_and_update(
+        {"user_id": uid, "points": {"$gte": price}},
         {"$inc": {"points": -price}},
-        return_document=True
+        return_document=ReturnDocument.AFTER,
     )
-    
-    if not user:
-        await call.answer("❌ رصيدك من النقاط لا يكفي لإتمام الشراء.", show_alert=True)
+    if not charged:
+        await query.message.reply_text("❌ رصيدك غير كافٍ لهذه الباقة.")
         return
-        
-    updated_product = await db.products.find_one_and_update(
-        {"_id": ObjectId(prod_id), "status": "متوفر"},
-        {"$set": {"status": "مباع", "buyer_id": user_id, "sell_date": datetime.utcnow()}}
+    expires = now_utc() + timedelta(days=plan.get("duration_days", 30))
+    await db.users.update_one(
+        {"user_id": uid},
+        {"$set": {"vip": {"plan_id": plan_id, "plan_name": plan.get("name"), "expires_at": expires.isoformat()}}},
     )
-    
-    if not updated_product:
-        await db.users.update_one({"user_id": user_id}, {"$inc": {"points": price}})
-        await call.answer("❌ نعتذر، قام شخص آخر بشراء الحساب قبلك بلحظات. تم إرجاع نقاطك.", show_alert=True)
+    await query.message.reply_text(f"✅ تم تفعيل {plan.get('name')} حتى {expires.strftime('%Y-%m-%d')}")
+
+
+async def show_mystery(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    settings = await get_settings()
+    if not settings.get("mystery_box_enabled", True):
+        await update.message.reply_text("🎁 Mystery Box غير مفعّل حالياً.")
+        return
+    boxes = [b async for b in db.mystery_boxes.find({"enabled": True})]
+    if not boxes:
+        await update.message.reply_text("🎁 لا توجد صناديق متاحة حالياً.")
+        return
+    for b in boxes:
+        kb = InlineKeyboardMarkup([[InlineKeyboardButton("🎁 افتح الصندوق", callback_data=f"box:{b['_id']}")]])
+        await update.message.reply_text(
+            f"🎁 *{b.get('name')}*\nالسعر: {b.get('price')} نقطة", parse_mode=ParseMode.MARKDOWN, reply_markup=kb
+        )
+
+
+async def cb_box(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    query = update.callback_query
+    await query.answer()
+    box_id = query.data.split(":", 1)[1]
+    ok, result = await open_mystery_box(query.from_user.id, box_id)
+    if not ok:
+        await query.message.reply_text(result)
+        return
+    ptype = result.get("type")
+    if ptype == "points":
+        txt = f"🎉 حصلت على {result.get('value')} نقطة!"
+    elif ptype == "xp":
+        txt = f"🎉 حصلت على {result.get('value')} XP!"
+    elif ptype == "ticket":
+        txt = f"🎉 حصلت على {result.get('value')} تذكرة/تذاكر سحب!"
+    elif ptype == "coupon":
+        txt = f"🎉 حصلت على كوبون خصم {result.get('value')}% — الكود: `{result.get('code')}`"
+    else:
+        txt = "🎉 حصلت على جائزة!"
+    await query.message.reply_text(txt, parse_mode=ParseMode.MARKDOWN)
+
+
+async def show_giveaways(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    settings = await get_settings()
+    if not settings.get("giveaways_enabled", True):
+        await update.message.reply_text("🎟️ السحوبات غير مفعّلة حالياً.")
+        return
+    giveaways = [g async for g in db.giveaways.find({"status": "open"})]
+    if not giveaways:
+        await update.message.reply_text("🎟️ لا توجد سحوبات مفتوحة حالياً.")
+        return
+    for g in giveaways:
+        kb = InlineKeyboardMarkup([[InlineKeyboardButton("🎟️ شارك الآن", callback_data=f"give:{g['_id']}")]])
+        await update.message.reply_text(
+            f"🎟️ *{g.get('title')}*\nتكلفة المشاركة: {g.get('ticket_cost',1)} تذكرة",
+            parse_mode=ParseMode.MARKDOWN, reply_markup=kb,
+        )
+
+
+async def cb_giveaway_join(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    query = update.callback_query
+    await query.answer()
+    gid = query.data.split(":", 1)[1]
+    ok, msg = await join_giveaway(query.from_user.id, gid)
+    await query.message.reply_text(msg)
+
+
+async def show_leaderboard(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    top = await get_leaderboard(10)
+    if not top:
+        await update.message.reply_text("🏆 لا توجد بيانات كافية بعد.")
         return
-        
-    await log_transaction(user_id, price, "sub", f"شراء حساب {product['name']}")
-    
-    account_details = product.get("account_data", "الرجاء التواصل مع الإدارة لاستلام بيانات الحساب.")
-    text = f"✅ <b>تم الشراء بنجاح!</b>\n\nبيانات الحساب:\n<code>{account_details}</code>"
-    kb = InlineKeyboardMarkup(inline_keyboard=[[InlineKeyboardButton(text="🔙 القائمة الرئيسية", callback_data="main_menu")]])
-    await call.message.edit_text(text, reply_markup=kb)
-    
-    for admin in OWNERS:
+    lines = ["🏆 *Top 10*\n"]
+    medals = ["🥇", "🥈", "🥉"]
+    for i, u in enumerate(top):
+        prefix = medals[i] if i < 3 else f"{i+1}."
+        name = u.get("username") or u.get("first_name") or str(u.get("user_id"))
+        lines.append(f"{prefix} {name} — {u.get('points',0)} نقطة")
+    await update.message.reply_text("\n".join(lines), parse_mode=ParseMode.MARKDOWN)
+
+
+async def show_achievements(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    user = await get_or_create_user(uid)
+    unlocked = set(user.get("achievements", []))
+    achs = [a async for a in db.achievements.find({})]
+    if not achs:
+        await update.message.reply_text("🏅 لا توجد إنجازات معرّفة بعد.")
+        return
+    lines = ["🏅 *الإنجازات*\n"]
+    for a in achs:
+        mark = "✅" if a["_id"] in unlocked else "🔒"
+        lines.append(f"{mark} {a.get('name')} — {a.get('description','')}")
+    await update.message.reply_text("\n".join(lines), parse_mode=ParseMode.MARKDOWN)
+
+
+async def show_my_codes(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    codes = [c async for c in db.promo_codes.find({"owner_id": uid})]
+    if not codes:
+        await update.message.reply_text("🏷️ لا تملك أكواد ��صم حالياً.")
+        return
+    lines = ["🏷️ *أكوادك*\n"]
+    for c in codes:
+        lines.append(f"`{c['code']}` — خصم {c.get('discount_percent')}% — استُخدم {c.get('used_count',0)}/{c.get('max_uses')}")
+    await update.message.reply_text("\n".join(lines), parse_mode=ParseMode.MARKDOWN)
+
+
+async def on_group_message(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    if not update.effective_user or not update.message:
+        return
+    uid = update.effective_user.id
+    try:
+        await get_or_create_user(uid, update.effective_user.username or "", update.effective_user.first_name or "")
+        if not await rate_limited_interaction(uid):
+            return
+        settings = await get_settings()
+        pts = settings.get("points", {}).get("message_interaction", 0)
+        xp = settings.get("xp", {}).get("per_interaction", 0)
+        if pts:
+            await add_points(uid, pts, "interaction", "تفاعل داخل الكروب")
+        if xp:
+            await add_xp(uid, xp, context.bot)
+        await db.users.update_one({"user_id": uid}, {"$set": {"last_interaction_at": now_utc()}})
+    except PyMongoError:
+        logger.warning("تعذر تسجيل تفاعل المستخدم %s بسبب مشكلة اتصال DB", uid)
+
+
+TEXT_ROUTES = {
+    "👤 حسابي": show_profile,
+    "🛒 المتجر": show_store,
+    "💰 بيع حساب مقابل نقاط": show_sell,
+    "🎁 المكافأة اليومية": show_daily,
+    "👥 الإحالات": show_referrals,
+    "💎 VIP": show_vip,
+    "🎁 Mystery Box": show_mystery,
+    "🎟️ السحوبات": show_giveaways,
+    "🏆 Leaderboard": show_leaderboard,
+    "🏅 الإنجازات": show_achievements,
+    "🏷️ أكوادي": show_my_codes,
+}
+
+
+async def on_private_text(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    text = update.message.text or ""
+    uid = update.effective_user.id
+
+    # أولاً: هل يوجد إدخال إداري معلّق بانتظار هذه الرسالة؟
+    if uid in PENDING:
+        await handle_pending_input(update, context)
+        return
+
+    if text == "⚙️ لوحة المطورين":
+        await admin_panel_root(update, context)
+        return
+
+    handler = TEXT_ROUTES.get(text)
+    if handler:
         try:
-            await bot.send_message(admin, f"🛍️ <b>عملية شراء جديدة:</b>\nالمستخدم: {user_id}\nالمنتج: {product['name']}\nالسعر: {price}")
-        except: pass
-
-@router.callback_query(F.data == "admin_panel")
-async def admin_panel(call: CallbackQuery):
-    if call.from_user.id not in OWNERS and not await db.admins.find_one({"user_id": call.from_user.id}):
-        return await call.answer("⛔ ليس لديك صلاحية.", show_alert=True)
-    await call.message.edit_text("👑 <b>لوحة المطورين:</b>\nتحكم بالبوت بالكامل من هنا.", reply_markup=admin_menu_kb())
-
-@router.callback_query(F.data == "admin_stats")
-async def admin_stats(call: CallbackQuery):
-    users_count = await db.users.count_documents({})
-    prods_count = await db.products.count_documents({"status": "متوفر"})
-    sold_count = await db.products.count_documents({"status": "مباع"})
-    
+            await handler(update, context)
+        except PyMongoError:
+            await update.message.reply_text("⚠️ تعذر الاتصال بقاعدة البيانات، حاول مرة أخرى بعد قليل.")
+    else:
+        await update.message.reply_text("استخدم الأزرار في القائمة 👇")
+
+
+# ---------------------------------------------------------------------------
+# لوحة المطورين
+# ---------------------------------------------------------------------------
+ADMIN_SECTIONS = [
+    ("users", "👥 المستخدمون"),
+    ("store", "🛒 المتجر"),
+    ("points", "🪙 إعدادات النقاط"),
+    ("levels", "⭐ XP / Levels"),
+    ("codes", "🏷️ أكواد الخصم"),
+    ("vip", "💎 VIP"),
+    ("boxes", "🎁 Mystery Boxes"),
+    ("giveaways", "🎟️ السحوبات"),
+    ("achievements", "🏅 الإنجازات"),
+    ("settings", "⚙️ إعدادات عامة"),
+    ("admins", "👮 الأدمنية"),
+    ("stats", "📊 الإحصائيات"),
+    ("audit", "🧾 Audit Log"),
+]
+
+
+def admin_root_keyboard() -> InlineKeyboardMarkup:
+    buttons = [[InlineKeyboardButton(label, callback_data=f"adm:{key}:root")] for key, label in ADMIN_SECTIONS]
+    return InlineKeyboardMarkup(buttons)
+
+
+async def admin_panel_root(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    uid = update.effective_user.id
+    if not await has_permission(uid):
+        await update.message.reply_text("🚫 ليست لديك صلاحية الوصول للوحة المطورين.")
+        return
+    await update.message.reply_text("⚙️ *لوحة المطورين*\nاختر قسماً:", parse_mode=ParseMode.MARKDOWN, reply_markup=admin_root_keyboard())
+
+
+async def cmd_admin(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    await admin_panel_root(update, context)
+
+
+def require_roles(section: str) -> List[str]:
+    mapping = {
+        "users": ["user_admin"],
+        "store": ["store_admin"],
+        "points": ["points_admin"],
+        "levels": ["points_admin"],
+        "codes": ["points_admin", "store_admin"],
+        "vip": ["vip_admin"],
+        "boxes": ["store_admin", "points_admin"],
+        "giveaways": ["giveaway_admin"],
+        "achievements": ["points_admin"],
+        "settings": ["super_admin"],
+        "admins": ["super_admin"],
+        "stats": [],
+        "audit": ["super_admin"],
+    }
+    return mapping.get(section, [])
+
+
+async def cb_admin(update: Update, context: ContextTypes.DEFAULT_TYPE):
+    query = update.callback_query
+    await query.answer()
+    uid = query.from_user.id
+    parts = query.data.split(":")
+    _, section, action, *rest = parts + [""] * (3 - len(parts) + 1)
+
+    if not await has_permission(uid, require_roles(section)):
+        await query.message.reply_text("🚫 ليست لديك صلاحية لهذا القسم.")
+        return
+
+    if section == "users":
+        await admin_users_menu(query, context, action, rest)
+    elif section == "store":
+        await admin_store_menu(query, context, action, rest)
+    elif section == "points":
+        await admin_json_section_menu(query, context, "points", "إعدادات النقاط")
+    elif section == "levels":
+        await admin_json_section_menu(query, context, "levels", "قائمة المستويات (XP/Levels)")
+    elif section == "codes":
+        await admin_list_menu(query, context, db.promo_codes, "codes", "أكواد الخصم", "code")
+    elif section == "vip":
+        await admin_list_menu(query, context, db.vip_plans, "vip", "باقات VIP", "name")
+    elif section == "boxes":
+        await admin_list_menu(query, context, db.mystery_boxes, "boxes", "Mystery Boxes", "name")
+    elif section == "giveaways":
+        await admin_giveaways_menu(query, context, action, rest)
+    elif section == "achievements":
+        await admin_list_menu(query, context, db.achievements, "achievements", "الإنجازات", "name")
+    elif section == "settings":
+        await admin_json_section_menu(query, context, "links", "روابط وإعدادات عامة")
+    elif section == "admins":
+        await admin_admins_menu(query, context, action, rest)
+    elif section == "stats":
+        await admin_stats(query, context)
+    elif section == "audit":
+        await admin_audit(query, context)
+
+
+# --- قسم المستخدمين ---
+async def admin_users_menu(query, context, action, rest):
+    if action == "root":
+        PENDING[query.from_user.id] = {"flow": "find_user"}
+        await query.message.reply_text("🔎 أرسل الآن User ID للمستخدم الذي تريد إدارته:")
+        return
+    target_id = int(rest[0]) if rest and rest[0] else None
+    if action == "view" and target_id:
+        await send_user_admin_card(query.message, target_id)
+    elif action in ("addpts", "subpts", "addxp") and target_id:
+        PENDING[query.from_user.id] = {"flow": "user_amount", "action": action, "target": target_id}
+        await query.message.reply_text("✏️ أرسل القيمة (رقم):")
+    elif action == "ban" and target_id:
+        await db.users.update_one({"user_id": target_id}, {"$set": {"banned": True}})
+        await audit(query.from_user.id, "ban_user", {"target": target_id})
+        await query.message.reply_text("🚫 تم حظر المستخدم.")
+    elif action == "unban" and target_id:
+        await db.users.update_one({"user_id": target_id}, {"$set": {"banned": False}})
+        await audit(query.from_user.id, "unban_user", {"target": target_id})
+        await query.message.reply_text("✅ تم فك الحظر.")
+    elif action == "freeze" and target_id:
+        await db.users.update_one({"user_id": target_id}, {"$set": {"frozen": True}})
+        await audit(query.from_user.id, "freeze_user", {"target": target_id})
+        await query.message.reply_text("🧊 تم تجميد الحساب.")
+    elif action == "unfreeze" and target_id:
+        await db.users.update_one({"user_id": target_id}, {"$set": {"frozen": False}})
+        await audit(query.from_user.id, "unfreeze_user", {"target": target_id})
+        await query.message.reply_text("✅ تم إلغاء التجميد.")
+
+
+async def send_user_admin_card(message, target_id: int):
+    user = await db.users.find_one({"user_id": target_id})
+    if not user:
+        await message.reply_text("❌ لم يتم العثور على هذا المستخدم.")
+        return
     text = (
-        "📊 <b>إحصائيات البوت:</b>\n\n"
-        f"👥 إجمالي المستخدمين: {users_count}\n"
-        f"🛒 حسابات متوفرة: {prods_count}\n"
-        f"🛍️ حسابات مباعة: {sold_count}"
+        f"👤 المستخدم {target_id}\n"
+        f"النقاط: {user.get('points')} | XP: {user.get('xp')} | Level: {user.get('level')}\n"
+        f"محظور: {user.get('banned')} | مجمّد: {user.get('frozen')}\n"
+        f"إحالات: {user.get('referrals_count')} | مشتريات: {user.get('purchases_count')} | مبيعات: {user.get('sales_count')}"
     )
-    kb = InlineKeyboardMarkup(inline_keyboard=[[InlineKeyboardButton(text="🔙 رجوع", callback_data="admin_panel")]])
-    await call.message.edit_text(text, reply_markup=kb)
-
-# --- إعداد Web Server لـ Hugging Face ---
-async def health_check(request):
-    return web.json_response({"status": "ok", "time": datetime.utcnow().isoformat()})
-
-async def run_web_server():
-    app = web.Application()
-    app.router.add_get('/health', health_check)
-    app.router.add_get('/', health_check)
-    
-    runner = web.AppRunner(app)
-    await runner.setup()
-    site = web.TCPSite(runner, '0.0.0.0', 7860) 
-    await site.start()
-    logger.info("✅ HTTP Health Server is running on http://0.0.0.0:7860")
-    
-    while True:
-        await asyncio.sleep(3600)
-
-# --- الدالة الرئيسية مع معالجة الأخطاء والتنظيف ---
-async def main():
-    logger.info("🚀 جاري بدء تشغيل البوت وتهيئة قاعدة البيانات...")
-    await init_db()
-    
-    dp.include_router(router)
-    
-    # محاولة تنظيف الويب هوك مع تجنب توقف الكود عند بطء الشبكة
-    retries = 3
-    for i in range(retries):
-        try:
-            await bot.delete_webhook(drop_pending_updates=True, request_timeout=30)
-            logger.info("🧹 تم تنظيف الويب هوك القديم بنجاح.")
-            break
-        except Exception as e:
-            logger.warning(f"⚠️ محاولة اتصال ({i+1}/{retries}) فشلت مؤقتاً: {e}")
-            if i == retries - 1:
-                logger.error("❌ فشل الاتصال بخوادم تيليجرام، سيتم تشغيل البوت عبر Polling مباشرة...")
-            else:
-                await asyncio.sleep(5)
-    
-    # تشغيل السيرفر والبوت بالتوازي
-    task_web = asyncio.create_task(run_web_server())
-    task_bot = asyncio.create_task(dp.start_polling(bot, allowed_updates=dp.resolve_used_update_types()))
-    
-    await asyncio.gather(task_web, task_bot)
-
-if __name__ == "__main__":
-    try:
-        asyncio.run(main())
-    except (KeyboardInterrupt, SystemExit):
-        logger.info("🛑 تم إيقاف البوت بنجاح.")
+    kb = InlineKeyboardMarkup(
+        [
+            [
+                InlineKeyboardButton("➕ نقاط", callback_data=f"adm:users:addpts:{target_id}"),
+                InlineKeyboardButton("➖ نقاط", callback_data=f"adm:users:subpts:{target_id}"),
+                InlineKeyboardButton("➕ XP", callback_data=f"adm:users:addxp:{target_id}"),
+            ],
+            [
+                InlineKeyboardButton("🚫 حظر", callback_data=f"adm:users:ban:{target_id}"),
+                InlineKeyboardButton("✅ فك حظر", callback_data=f"adm:users:unban:{target_id}"),
+            ],
+            [
+                InlineKeyboardButton("🧊 تجميد", callback_data=f"adm:users:freeze:{target_id}"),
+                InlineKeyboardButton("🔓 إلغاء تجميد", callback_data=f"adm:users:unfreeze:{target_id}"),
+            ],
+        ]
+    )
+    await message.reply_text(text, reply_markup=kb)
+
+
+# --- قسم المتجر ---
+async def admin_store_menu(query, context, action, rest):
+    if action == "root":
+        products = [p async for p in db.products.find({}).limit(20)]
+        buttons = [[InlineKeyboardButton(f"{p.get('name')} ({p.get('status')})", callback_data=f"adm:store:view:{p['_id']}")] for p in products]
+        buttons.append([InlineKeyboardButton("➕ إضافة منتج (JSON)", callback_data="adm:store:add:")])
+        await query.message.reply_text("🛒 المنتجات:", reply_markup=InlineKeyboardMarkup(buttons))
+    elif action == "add":
+        PENDING[query.from_user.id] = {"flow": "store_add"}
+        await query.message.reply_text(
+            "أرسل بيانات المنتج بصيغة JSON، مثال:\n"
+            '`{"_id":"acc1","name":"حساب VIP","price":20000,"description":"وصف","status":"متوفر"}`',
+            parse_mode=ParseMode.MARKDOWN,
+        )
+    elif action == "view" and rest and rest[0]:
+        pid = rest[0]
+        p = await db.products.find_one({"_id": pid})
+        if not p:
+            await query.message.reply_text("❌ غير موجود.")
+            return
+        kb = InlineKeyboardMarkup(
+            [
+                [InlineKeyboardButton("✏️ تعديل (JSON)", callback_data=f"adm:store:edit:{pid}")],
+                [InlineKeyboardButton("🔥 Flash Sale", callback_data=f"adm:store:flash:{pid}")],
+                [InlineKeyboardButton("🗑️ حذف", callback_data=f"adm:store:del:{pid}")],
+            ]
+        )
+        await query.message.reply_text(f"```{json.dumps(p, ensure_ascii=False, default=str, indent=2)}```", parse_mode=ParseMode.MARKDOWN, reply_markup=kb)
+    elif action == "edit" and rest and rest[0]:
+        PENDING[query.from_user.id] = {"flow": "store_edit", "id": rest[0]}
+        await query.message.reply_text("أرسل الحقول المراد تعديلها بصيغة JSON (سيتم دمجها مع المنتج الحالي):")
+    elif action == "flash" and rest and rest[0]:
+        PENDING[query.from_user.id] = {"flow": "store_flash", "id": rest[0]}
+        await query.message.reply_text('أرسل بيانات العرض JSON، مثال:\n`{"flash_price":15000,"minutes":120,"remaining":1}`', parse_mode=ParseMode.MARKDOWN)
+    elif action == "del" and rest and rest[0]:
+        await db.products.delete_one({"_id": rest[0]})
+        await audit(query.from_user.id, "delete_product", {"id": rest[0]})
+        await query.message.reply_text("🗑️ تم الحذف.")
+
+
+# --- قسم عام: تعديل settings.<section> عبر JSON ---
+async def admin_json_section_menu(query, context, section, label):
+    settings = await get_settings()
+    current = settings.get(section)
+    PENDING[query.from_user.id] = {"flow": "settings_json", "section": section}
+    await query.message.reply_text(
+        f"⚙️ *{label}* — القيمة الحالية:\n```{json.dumps(current, ensure_ascii=False, default=str, indent=2)}```\n\n"
+        "أرسل القيمة الجديدة بصيغة JSON لتحديثها:",
+        parse_mode=ParseMode.MARKDOWN,
+    )
+
+
+# --- قسم عام: عرض/إضافة عناصر مجموعة (codes/vip/boxes/achievements) ---
+async def admin_list_menu(query, context, collection, section, label, name_field):
+    items = [i async for i in collection.find({}).limit(20)]
+    buttons = [[InlineKeyboardButton(str(i.get(name_field, i.get("_id"))), callback_data=f"adm:{section}:view:{i['_id']}")] for i in items]
+    buttons.