m

Running

App Files Files Community

Eluza133 commited on May 7, 2025

Commit

07c4473

verified ·

1 Parent(s): d2493c1

Update app.py

Browse files

Files changed (1) hide show

app.py +239 -111

app.py CHANGED Viewed

@@ -12,15 +12,20 @@ from werkzeug.utils import secure_filename
 import requests
 from io import BytesIO
 import uuid
 app = Flask(__name__)
 app.secret_key = os.getenv("FLASK_SECRET_KEY", "supersecretkey_folders_unique_tma")
 DATA_FILE = 'cloudeng_data_tma.json'
-REPO_ID = "Eluza133/Z1e1u" # Needs to be accessible by the tokens
 HF_TOKEN_WRITE = os.getenv("HF_TOKEN")
 HF_TOKEN_READ = os.getenv("HF_TOKEN_READ") or HF_TOKEN_WRITE
 TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", "6750208873:AAE2hvPlJ99dBdhGa_Brre0IIpUdOvXxHt4")
-ADMIN_TELEGRAM_ID = os.getenv("ADMIN_TELEGRAM_ID", "YOUR_ADMIN_TELEGRAM_USER_ID_HERE") # IMPORTANT: Set this!
 UPLOAD_FOLDER = 'uploads_tma'
 os.makedirs(UPLOAD_FOLDER, exist_ok=True)
@@ -48,8 +53,8 @@ body.dark h2 { color: var(--text-dark); }
 h4 { font-size: 1.1em; margin-top: 15px; margin-bottom: 5px; color: var(--accent); }
 ol, ul { margin-left: 20px; margin-bottom: 15px; }
 li { margin-bottom: 5px; }
-input, textarea { width: 100%; padding: 14px; margin: 12px 0; border: none; border-radius: 14px; background: var(--glass-bg); color: var(--text-light); font-size: 1.1em; box-shadow: inset 0 3px 10px rgba(0, 0, 0, 0.1); }
-body.dark input, body.dark textarea { color: var(--text-dark); }
 input:focus, textarea:focus { outline: none; box-shadow: 0 0 0 4px var(--primary); }
 .btn { padding: 14px 28px; background: var(--primary); color: white; border: none; border-radius: 14px; cursor: pointer; font-size: 1.1em; font-weight: 600; transition: var(--transition); box-shadow: var(--shadow); display: inline-block; text-decoration: none; margin-top: 5px; margin-right: 5px; }
 .btn:hover { transform: scale(1.05); background: #e6415f; }
@@ -166,7 +171,7 @@ def initialize_user_filesystem_tma(user_data, tma_user_id_str):
         user_data['filesystem'] = {
             "type": "folder", "id": "root", "name": "root", "children": []
         }
-    if 'files' in user_data and isinstance(user_data['files'], list): # Migration logic
         for old_file in user_data['files']:
              file_id = old_file.get('id', uuid.uuid4().hex)
              original_filename = old_file.get('filename', 'unknown_file')
@@ -255,7 +260,16 @@ def get_file_type(filename):
 def is_admin_tma():
     if not ADMIN_TELEGRAM_ID or ADMIN_TELEGRAM_ID == "YOUR_ADMIN_TELEGRAM_USER_ID_HERE":
         return False
-    return 'telegram_user_id' in session and session['telegram_user_id'] == ADMIN_TELEGRAM_ID
 TMA_ENTRY_HTML = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
@@ -307,7 +321,6 @@ def auth_via_telegram():
     try:
         payload = request.json
         tg_user_data = payload.get('user')
-        # init_data_str = payload.get('initData') # For future validation if needed
         if not tg_user_data or not tg_user_data.get('id'):
             return jsonify({'status': 'error', 'message': 'Отсутствуют данные пользователя Telegram.'}), 400
@@ -335,9 +348,6 @@ def auth_via_telegram():
         display_name = tg_user_data.get('first_name') or tg_user_data.get('username') or f"User {tma_user_id_str}"
         session['telegram_display_name'] = display_name
-        if is_admin_tma():
-            session['is_admin_flag'] = True # Optional flag
         return jsonify({'status': 'success', 'redirect_url': url_for('tma_dashboard')})
     except Exception as e:
@@ -348,7 +358,7 @@ TMA_DASHBOARD_HTML_TEMPLATE = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Zeus Cloud</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
 <script src="https://telegram.org/js/telegram-web-app.js"></script>
-<style>''' + BASE_STYLE + '''</style></head><body><div class="container">
 <h1>Zeus Cloud</h1><p>Пользователь: {{ display_name }}</p>
 {% with messages = get_flashed_messages(with_categories=true) %}{% if messages %}
     {% for category, message in messages %}<div class="flash {{ category }}">{{ message }}</div>{% endfor %}
@@ -409,14 +419,15 @@ TMA_DASHBOARD_HTML_TEMPLATE = '''
     {% if not items %} <p>Эта папка пуста.</p> {% endif %}
 </div>
 <a href="{{ url_for('tma_logout') }}" class="btn" style="margin-top: 20px;" id="logout-btn">Выйти (очистить сессию)</a>
-{% if is_admin %}
-<a href="{{ url_for('admin_panel_tma') }}" class="btn" style="margin-top: 20px; background-color: var(--accent);">Админ-панель</a>
 {% endif %}
 </div>
 <div class="modal" id="mediaModal" onclick="closeModal(event)"><div class="modal-content" id="modalContentContainer">
 <span onclick="closeModalManual()" class="modal-close-btn">×</span><div id="modalContent"></div></div></div>
 <script>
     window.Telegram.WebApp.ready();
     const repoId = "{{ repo_id_js }}";
     const hfTokenRead = "{{ HF_TOKEN_READ_js or '' }}";
     function hfFileUrl(path, download = false) {
@@ -487,7 +498,7 @@ def tma_dashboard():
         return redirect(url_for('tma_entry_page'))
     user_data = data['users'][tma_user_id]
-    initialize_user_filesystem_tma(user_data, tma_user_id) # Ensure filesystem exists
     current_folder_id = request.args.get('folder_id', 'root')
     current_folder, _ = find_node_by_id(user_data['filesystem'], current_folder_id)
@@ -496,7 +507,7 @@ def tma_dashboard():
         flash('Папка не найдена!', 'error')
         current_folder_id = 'root'
         current_folder, _ = find_node_by_id(user_data['filesystem'], current_folder_id)
-        if not current_folder: # Should not happen if init is correct
              flash('Критическая ошибка: корневая папка не найдена.', 'error')
              session.clear()
              return redirect(url_for('tma_entry_page'))
@@ -525,9 +536,9 @@ def tma_dashboard():
         api = HfApi()
         uploaded_count = 0
         errors_list = []
-        for file in files:
-            if file and file.filename:
-                original_filename = secure_filename(file.filename)
                 name_part, ext_part = os.path.splitext(original_filename)
                 unique_suffix = uuid.uuid4().hex[:8]
                 unique_filename = f"{name_part}_{unique_suffix}{ext_part}"
@@ -535,7 +546,7 @@ def tma_dashboard():
                 hf_path = f"cloud_files/{tma_user_id}/{target_folder_id}/{unique_filename}"
                 temp_path = os.path.join(UPLOAD_FOLDER, f"{file_id}_{unique_filename}")
                 try:
-                    file.save(temp_path)
                     api.upload_file(
                         path_or_fileobj=temp_path, path_in_repo=hf_path, repo_id=REPO_ID,
                         repo_type="dataset", token=HF_TOKEN_WRITE,
@@ -583,17 +594,20 @@ def tma_dashboard():
         current_folder_id=current_folder_id, current_folder=current_folder,
         breadcrumbs=breadcrumbs, repo_id_js=REPO_ID, HF_TOKEN_READ_js=HF_TOKEN_READ,
         hf_file_url_jinja=lambda path, download=False: f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{path}{'?download=true' if download else ''}",
-        is_admin=is_admin_tma())
 @app.route('/create_folder_tma', methods=['POST'])
 def create_folder_tma():
     if 'telegram_user_id' not in session:
-        return jsonify({'status': 'error', 'message': 'Не авторизован'}), 401
     tma_user_id = session['telegram_user_id']
     data = load_data()
     user_data = data['users'].get(tma_user_id)
-    if not user_data: return jsonify({'status': 'error', 'message': 'Пользователь не найден'}), 404
     parent_folder_id = request.form.get('parent_folder_id', 'root')
     folder_name = request.form.get('folder_name', '').strip()
@@ -615,44 +629,82 @@ def create_folder_tma():
 @app.route('/download_tma/<file_id>')
 def download_tma(file_id):
     current_tma_user_id = session.get('telegram_user_id')
-    if not current_tma_user_id:
-        flash('Пожалуйста, авторизуйтесь.', 'error')
-        return redirect(url_for('tma_entry_page'))
     data = load_data()
     file_node = None
-    user_data = data['users'].get(current_tma_user_id)
-    if user_data:
-        file_node, _ = find_node_by_id(user_data['filesystem'], file_id)
-    if not file_node and is_admin_tma():
-        for uid_str, udata_iter in data.get('users', {}).items():
             node, _ = find_node_by_id(udata_iter.get('filesystem', {}), file_id)
             if node and node.get('type') == 'file':
                 file_node = node
                 break
     if not file_node or file_node.get('type') != 'file':
          flash('Файл не найден или доступ запрещен!', 'error')
-         return redirect(request.referrer or url_for('tma_dashboard'))
     hf_path = file_node.get('path')
     original_filename = file_node.get('original_filename', 'downloaded_file')
     if not hf_path:
         flash('Ошибка: Путь к файлу не найден.', 'error')
-        return redirect(request.referrer or url_for('tma_dashboard'))
     file_url = f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{hf_path}?download=true"
     try:
-        headers = {}
-        if HF_TOKEN_READ: headers["authorization"] = f"Bearer {HF_TOKEN_READ}"
-        response = requests.get(file_url, headers=headers, stream=True)
-        response.raise_for_status()
-        return send_file(BytesIO(response.content), as_attachment=True, download_name=original_filename)
-    except Exception as e:
         flash(f'Ошибка скачивания файла: {e}', 'error')
-        return redirect(request.referrer or url_for('tma_dashboard'))
 @app.route('/delete_file_tma/<file_id>', methods=['POST'])
 def delete_file_tma(file_id):
@@ -726,19 +778,28 @@ def delete_folder_tma(folder_id):
 @app.route('/get_text_content_tma/<file_id>')
 def get_text_content_tma(file_id):
     current_tma_user_id = session.get('telegram_user_id')
-    if not current_tma_user_id: return Response("Не авторизован", status=401)
     data = load_data()
     file_node = None
-    user_data = data['users'].get(current_tma_user_id)
-    if user_data:
-        file_node, _ = find_node_by_id(user_data['filesystem'], file_id)
-    if not file_node and is_admin_tma():
         for uid_str, udata_iter in data.get('users', {}).items():
             node, _ = find_node_by_id(udata_iter.get('filesystem', {}), file_id)
             if node and node.get('type') == 'file' and node.get('file_type') == 'text':
                 file_node = node; break
     if not file_node or file_node.get('type') != 'file' or file_node.get('file_type') != 'text':
         return Response("Текстовый файл не найден", status=404)
@@ -746,9 +807,9 @@ def get_text_content_tma(file_id):
     if not hf_path: return Response("Ошибка: путь к файлу отсутствует", status=500)
     file_url = f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{hf_path}?download=true"
     try:
-        headers = {};
-        if HF_TOKEN_READ: headers["authorization"] = f"Bearer {HF_TOKEN_READ}"
-        response = requests.get(file_url, headers=headers)
         response.raise_for_status()
         if len(response.content) > 1 * 1024 * 1024: return Response("Файл слишком большой.", status=413)
         try: text_content = response.content.decode('utf-8')
@@ -758,31 +819,87 @@ def get_text_content_tma(file_id):
 @app.route('/tma_logout')
 def tma_logout():
-    session.clear()
     flash('Вы вышли из сессии приложения.')
     return redirect(url_for('tma_entry_page'))
-ADMIN_PANEL_HTML_TMA_TEMPLATE = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Админ-панель</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
-<style>''' + BASE_STYLE + '''</style></head><body><div class="container"><h1>Админ-панель</h1>
-<a href="{{ url_for('tma_dashboard') }}" class="btn" style="margin-bottom:20px;">Назад в приложение</a>
 {% with messages = get_flashed_messages(with_categories=true) %}{% if messages %}{% for category, message in messages %}<div class="flash {{ category }}">{{ message }}</div>{% endfor %}{% endif %}{% endwith %}
 <h2>Пользователи</h2><div class="user-list">
 {% for user in user_details %}
 <div class="user-item">
-    <a href="{{ url_for('admin_user_files_tma', tma_user_id_str=user.id_key) }}">{{ user.display_name }} (ID: {{user.id_key}})</a>
     <p>Зарегистрирован: {{ user.created_at }}</p><p>Файлов: {{ user.file_count }}</p>
-    <form method="POST" action="{{ url_for('admin_delete_user_tma', tma_user_id_str=user.id_key) }}" style="display: inline; margin-left: 10px;" onsubmit="return confirm('УДАЛИТЬ пользователя {{ user.display_name }} и ВСЕ его файлы? НЕОБРАТИМО!');">
         <button type="submit" class="btn delete-btn" style="padding: 5px 10px; font-size: 0.9em;">Удалить</button>
     </form>
 </div>
 {% else %}<p>Пользователей нет.</p>{% endfor %}</div></div></body></html>'''
 @app.route('/admhosto')
-def admin_panel_tma():
-    if not is_admin_tma():
-        flash('Доступ запрещен.', 'error'); return redirect(url_for('tma_dashboard'))
     data = load_data()
     users = data.get('users', {})
     user_details = []
@@ -799,38 +916,38 @@ def admin_panel_tma():
             'display_name': udata.get('first_name', udata.get('telegram_username', f"User {tma_id_str}")),
             'created_at': udata.get('created_at', 'N/A'), 'file_count': file_count
         })
-    return render_template_string(ADMIN_PANEL_HTML_TMA_TEMPLATE, user_details=user_details)
-ADMIN_USER_FILES_HTML_TMA_TEMPLATE = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Файлы {{ display_name_admin_view }}</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
 <style>''' + BASE_STYLE + '''
-.file-item { background: var(--card-bg); padding: 15px; border-radius: 16px; box-shadow: var(--shadow); transition: var(--transition); display: flex; flex-direction: column; justify-content: space-between; }
-body.dark .file-item { background: var(--card-bg-dark); } .file-item:hover { transform: translateY(-5px); }
 .file-preview { max-width: 100%; height: 100px; object-fit: contain; border-radius: 10px; margin-bottom: 10px; display: block; margin-left: auto; margin-right: auto; }
 .admin-file-actions { margin-top: 10px; display: flex; flex-wrap: wrap; gap: 5px; justify-content: center; }
 .admin-file-actions .btn { font-size: 0.8em; padding: 4px 8px; margin: 0; }
-</style></head><body><div class="container"><h1>Файлы пользователя: {{ display_name_admin_view }} (ID: {{ tma_user_id_str_admin_view }})</h1>
-<a href="{{ url_for('admin_panel_tma') }}" class="btn" style="margin-bottom: 20px;">Назад к пользователям</a>
 {% with messages = get_flashed_messages(with_categories=true) %}{% if messages %}{% for category, message in messages %}<div class="flash {{ category }}">{{ message }}</div>{% endfor %}{% endif %}{% endwith %}
 <div style="display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 20px;">
-{% for file in files %}
 <div class="file-item"><div>
-    {% if file.file_type == 'image' %} <img class="file-preview" src="{{ hf_file_url_jinja(file.path) }}" loading="lazy" onclick="openModalAdmin('{{ hf_file_url_jinja(file.path) }}', '{{ file.file_type }}', '{{ file.id }}')" style="cursor: pointer;">
-    {% elif file.file_type == 'video' %} <video class="file-preview" preload="metadata" muted onclick="openModalAdmin('{{ hf_file_url_jinja(file.path) }}', '{{ file.file_type }}', '{{ file.id }}')" style="cursor: pointer;"><source src="{{ hf_file_url_jinja(file.path, True) }}#t=0.5"></video>
-    {% elif file.file_type == 'pdf' %} <div class="file-preview" style="font-size: 40px; line-height: 100px; text-align: center; color: var(--accent); cursor: pointer;" onclick="openModalAdmin('{{ hf_file_url_jinja(file.path, True) }}', '{{ file.file_type }}', '{{ file.id }}')">📄</div>
-    {% elif file.file_type == 'text' %} <div class="file-preview" style="font-size: 40px; line-height: 100px; text-align: center; color: var(--secondary); cursor: pointer;" onclick="openModalAdmin('{{ url_for('get_text_content_tma', file_id=file.id) }}', '{{ file.file_type }}', '{{ file.id }}')">📝</div>
     {% else %} <div class="file-preview" style="font-size: 40px; line-height: 100px; text-align: center; color: #aaa;">❓</div> {% endif %}
-    <p title="{{ file.original_filename }}"><b>{{ file.original_filename | truncate(30) }}</b></p>
-    <p style="font-size: 0.8em; color: #888;">В папке: {{ file.parent_path_str }}</p>
-    <p style="font-size: 0.8em; color: #888;">Загружен: {{ file.upload_date }}</p>
-    <p style="font-size: 0.7em; color: #ccc;">ID: {{ file.id }}</p>
-    <p style="font-size: 0.7em; color: #ccc; word-break: break-all;">Path: {{ file.path }}</p>
     </div><div class="admin-file-actions">
-        <a href="{{ url_for('download_tma', file_id=file.id) }}" class="btn download-btn">Скачать</a>
-        {% set previewable = file.file_type in ['image', 'video', 'pdf', 'text'] %}
-        {% if previewable %}<button class="btn" style="background: var(--accent);" onclick="openModalAdmin('{{ hf_file_url_jinja(file.path) if file.file_type != 'text' else url_for('get_text_content_tma', file_id=file.id) }}', '{{ file.file_type }}', '{{ file.id }}')">Просмотр</button>{% endif %}
-        <form method="POST" action="{{ url_for('admin_delete_file_tma', tma_user_id_str_form=tma_user_id_str_admin_view, file_id=file.id) }}" style="display: inline-block;" onsubmit="return confirm('Удалить файл {{ file.original_filename }}?');">
              <button type="submit" class="btn delete-btn">Удалить</button></form>
     </div></div>{% else %} <p>У пользователя нет файлов.</p> {% endfor %}</div></div>
 <div class="modal" id="mediaModalAdmin" onclick="closeModalAdminEv(event)"><div class="modal-content" id="modalContentContainerAdmin">
@@ -859,13 +976,12 @@ body.dark .file-item { background: var(--card-bg-dark); } .file-item:hover { tra
 </script></body></html>'''
 @app.route('/admhosto/user/<tma_user_id_str>')
-def admin_user_files_tma(tma_user_id_str):
-    if not is_admin_tma():
-        flash('Доступ запрещен.', 'error'); return redirect(url_for('tma_dashboard'))
     data = load_data()
     user_data = data.get('users', {}).get(tma_user_id_str)
     if not user_data:
-        flash(f'Пользователь ID {tma_user_id_str} не найден.', 'error'); return redirect(url_for('admin_panel_tma'))
     all_files = []
     def collect_files_admin(folder, current_path_id='root'):
@@ -877,75 +993,87 @@ def admin_user_files_tma(tma_user_id_str):
     all_files.sort(key=lambda x: x.get('upload_date', ''), reverse=True)
     display_name_admin_view = user_data.get('first_name', user_data.get('telegram_username', f"User {tma_user_id_str}"))
-    return render_template_string(ADMIN_USER_FILES_HTML_TMA_TEMPLATE,
         tma_user_id_str_admin_view=tma_user_id_str, display_name_admin_view=display_name_admin_view, files=all_files,
         repo_id_js_admin=REPO_ID,
         hf_file_url_jinja=lambda path, download=False: f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{path}{'?download=true' if download else ''}")
 @app.route('/admhosto/delete_user/<tma_user_id_str>', methods=['POST'])
-def admin_delete_user_tma(tma_user_id_str):
-    if not is_admin_tma():
-        flash('Доступ запрещен.', 'error'); return redirect(url_for('tma_dashboard'))
     if not HF_TOKEN_WRITE:
-         flash('Удаление невозможно: токен для записи не настроен.', 'error'); return redirect(url_for('admin_panel_tma'))
     data = load_data()
     if tma_user_id_str not in data['users']:
-        flash('Пользователь не найден!', 'error'); return redirect(url_for('admin_panel_tma'))
     try:
         api = HfApi()
         user_folder_path_on_hf = f"cloud_files/{tma_user_id_str}"
-        api.delete_folder(folder_path=user_folder_path_on_hf, repo_id=REPO_ID, repo_type="dataset", token=HF_TOKEN_WRITE)
     except hf_utils.HfHubHTTPError as e:
-         if e.response.status_code != 404:
-             flash(f'Ошибка удаления файлов пользователя {tma_user_id_str} с сервера: {e}.', 'error'); return redirect(url_for('admin_panel_tma'))
     except Exception as e:
-        flash(f'Ошибка удаления файлов {tma_user_id_str} с сервера: {e}.', 'error'); return redirect(url_for('admin_panel_tma'))
     try:
         del data['users'][tma_user_id_str]
         save_data(data)
-        flash(f'Пользователь {tma_user_id_str} и его файлы удалены.')
     except Exception as e:
-        flash(f'Файлы удалены, но ошибка удаления из базы: {e}', 'error')
-    return redirect(url_for('admin_panel_tma'))
 @app.route('/admhosto/delete_file/<tma_user_id_str_form>/<file_id>', methods=['POST'])
-def admin_delete_file_tma(tma_user_id_str_form, file_id):
-    if not is_admin_tma():
-        flash('Доступ запрещен.', 'error'); return redirect(url_for('tma_dashboard'))
     if not HF_TOKEN_WRITE:
-         flash('Удаление невозможно: токен не настроен.', 'error'); return redirect(url_for('admin_user_files_tma', tma_user_id_str=tma_user_id_str_form))
     data = load_data()
     user_data = data.get('users', {}).get(tma_user_id_str_form)
     if not user_data:
-        flash(f'Пользователь {tma_user_id_str_form} не найден.', 'error'); return redirect(url_for('admin_panel_tma'))
     file_node, _ = find_node_by_id(user_data['filesystem'], file_id)
     if not file_node or file_node.get('type') != 'file':
-        flash('Файл не найден.', 'error'); return redirect(url_for('admin_user_files_tma', tma_user_id_str=tma_user_id_str_form))
     hf_path = file_node.get('path')
     original_filename = file_node.get('original_filename', 'файл')
     if not hf_path:
         if remove_node(user_data['filesystem'], file_id):
-            try: save_data(data); flash(f'Метаданные {original_filename} удалены (путь отсутствовал).')
-            except Exception as e: flash('Ошибка сохранения (путь отсутствовал).', 'error')
-        return redirect(url_for('admin_user_files_tma', tma_user_id_str=tma_user_id_str_form))
     try:
         api = HfApi()
         api.delete_file(path_in_repo=hf_path, repo_id=REPO_ID, repo_type="dataset", token=HF_TOKEN_WRITE)
         if remove_node(user_data['filesystem'], file_id):
-            try: save_data(data); flash(f'Файл {original_filename} удален!')
-            except Exception as e: flash('Файл удален с сервера, ошибка обновления базы.', 'error')
     except hf_utils.EntryNotFoundError:
         if remove_node(user_data['filesystem'], file_id):
-            try: save_data(data); flash(f'Файл {original_filename} не найден на сервере, удален из базы.')
-            except Exception as e: flash('Ошибка сохранения (файл не на сервере).', 'error')
     except Exception as e:
-        flash(f'Ошибка удаления файла {original_filename}: {e}', 'error')
-    return redirect(url_for('admin_user_files_tma', tma_user_id_str=tma_user_id_str_form))
 if __name__ == '__main__':
     if not HF_TOKEN_WRITE: logging.warning("HF_TOKEN (write access) is not set. Uploads/deletions/backups will fail.")
     if not HF_TOKEN_READ: logging.warning("HF_TOKEN_READ is not set. Using HF_TOKEN. Downloads/previews might fail for private repos if HF_TOKEN also lacks read.")
-    if ADMIN_TELEGRAM_ID == "YOUR_ADMIN_TELEGRAM_USER_ID_HERE": logging.warning("ADMIN_TELEGRAM_ID is not set. Admin panel will not be accessible.")
     if HF_TOKEN_WRITE:
         download_db_from_hf()

 import requests
 from io import BytesIO
 import uuid
+from functools import wraps
 app = Flask(__name__)
 app.secret_key = os.getenv("FLASK_SECRET_KEY", "supersecretkey_folders_unique_tma")
 DATA_FILE = 'cloudeng_data_tma.json'
+REPO_ID = "Eluza133/Z1e1u"
 HF_TOKEN_WRITE = os.getenv("HF_TOKEN")
 HF_TOKEN_READ = os.getenv("HF_TOKEN_READ") or HF_TOKEN_WRITE
 TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", "6750208873:AAE2hvPlJ99dBdhGa_Brre0IIpUdOvXxHt4")
+ADMIN_TELEGRAM_ID = os.getenv("ADMIN_TELEGRAM_ID", "YOUR_ADMIN_TELEGRAM_USER_ID_HERE")
+ADMIN_USERNAME = os.getenv("ADMIN_USERNAME", "admin")
+ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD", "zeusadminpass")
 UPLOAD_FOLDER = 'uploads_tma'
 os.makedirs(UPLOAD_FOLDER, exist_ok=True)
 h4 { font-size: 1.1em; margin-top: 15px; margin-bottom: 5px; color: var(--accent); }
 ol, ul { margin-left: 20px; margin-bottom: 15px; }
 li { margin-bottom: 5px; }
+input, textarea, input[type="text"], input[type="password"], input[type="file"] { width: 100%; padding: 14px; margin: 12px 0; border: none; border-radius: 14px; background: var(--glass-bg); color: var(--text-light); font-size: 1.1em; box-shadow: inset 0 3px 10px rgba(0, 0, 0, 0.1); }
+body.dark input, body.dark textarea, body.dark input[type="text"], body.dark input[type="password"], body.dark input[type="file"] { color: var(--text-dark); background: rgba(255,255,255,0.05); }
 input:focus, textarea:focus { outline: none; box-shadow: 0 0 0 4px var(--primary); }
 .btn { padding: 14px 28px; background: var(--primary); color: white; border: none; border-radius: 14px; cursor: pointer; font-size: 1.1em; font-weight: 600; transition: var(--transition); box-shadow: var(--shadow); display: inline-block; text-decoration: none; margin-top: 5px; margin-right: 5px; }
 .btn:hover { transform: scale(1.05); background: #e6415f; }
         user_data['filesystem'] = {
             "type": "folder", "id": "root", "name": "root", "children": []
         }
+    if 'files' in user_data and isinstance(user_data['files'], list):
         for old_file in user_data['files']:
              file_id = old_file.get('id', uuid.uuid4().hex)
              original_filename = old_file.get('filename', 'unknown_file')
 def is_admin_tma():
     if not ADMIN_TELEGRAM_ID or ADMIN_TELEGRAM_ID == "YOUR_ADMIN_TELEGRAM_USER_ID_HERE":
         return False
+    return 'telegram_user_id' in session and str(session['telegram_user_id']) == str(ADMIN_TELEGRAM_ID)
+def admin_browser_login_required(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        if not session.get('admin_browser_logged_in'):
+            return redirect(url_for('admin_login', next=request.url))
+        return f(*args, **kwargs)
+    return decorated_function
 TMA_ENTRY_HTML = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
     try:
         payload = request.json
         tg_user_data = payload.get('user')
         if not tg_user_data or not tg_user_data.get('id'):
             return jsonify({'status': 'error', 'message': 'Отсутствуют данные пользователя Telegram.'}), 400
         display_name = tg_user_data.get('first_name') or tg_user_data.get('username') or f"User {tma_user_id_str}"
         session['telegram_display_name'] = display_name
         return jsonify({'status': 'success', 'redirect_url': url_for('tma_dashboard')})
     except Exception as e:
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Zeus Cloud</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
 <script src="https://telegram.org/js/telegram-web-app.js"></script>
+<style>''' + BASE_STYLE + '''</style></head><body class="dark"><div class="container">
 <h1>Zeus Cloud</h1><p>Пользователь: {{ display_name }}</p>
 {% with messages = get_flashed_messages(with_categories=true) %}{% if messages %}
     {% for category, message in messages %}<div class="flash {{ category }}">{{ message }}</div>{% endfor %}
     {% if not items %} <p>Эта папка пуста.</p> {% endif %}
 </div>
 <a href="{{ url_for('tma_logout') }}" class="btn" style="margin-top: 20px;" id="logout-btn">Выйти (очистить сессию)</a>
+{% if is_tma_user_admin_flag %}
+<a href="{{ url_for('admin_panel') }}" class="btn" style="margin-top: 20px; background-color: var(--accent);">Админ-панель</a>
 {% endif %}
 </div>
 <div class="modal" id="mediaModal" onclick="closeModal(event)"><div class="modal-content" id="modalContentContainer">
 <span onclick="closeModalManual()" class="modal-close-btn">×</span><div id="modalContent"></div></div></div>
 <script>
     window.Telegram.WebApp.ready();
+    document.body.classList.add('dark');
     const repoId = "{{ repo_id_js }}";
     const hfTokenRead = "{{ HF_TOKEN_READ_js or '' }}";
     function hfFileUrl(path, download = false) {
         return redirect(url_for('tma_entry_page'))
     user_data = data['users'][tma_user_id]
+    initialize_user_filesystem_tma(user_data, tma_user_id)
     current_folder_id = request.args.get('folder_id', 'root')
     current_folder, _ = find_node_by_id(user_data['filesystem'], current_folder_id)
         flash('Папка не найдена!', 'error')
         current_folder_id = 'root'
         current_folder, _ = find_node_by_id(user_data['filesystem'], current_folder_id)
+        if not current_folder:
              flash('Критическая ошибка: корневая папка не найдена.', 'error')
              session.clear()
              return redirect(url_for('tma_entry_page'))
         api = HfApi()
         uploaded_count = 0
         errors_list = []
+        for file_obj in files:
+            if file_obj and file_obj.filename:
+                original_filename = secure_filename(file_obj.filename)
                 name_part, ext_part = os.path.splitext(original_filename)
                 unique_suffix = uuid.uuid4().hex[:8]
                 unique_filename = f"{name_part}_{unique_suffix}{ext_part}"
                 hf_path = f"cloud_files/{tma_user_id}/{target_folder_id}/{unique_filename}"
                 temp_path = os.path.join(UPLOAD_FOLDER, f"{file_id}_{unique_filename}")
                 try:
+                    file_obj.save(temp_path)
                     api.upload_file(
                         path_or_fileobj=temp_path, path_in_repo=hf_path, repo_id=REPO_ID,
                         repo_type="dataset", token=HF_TOKEN_WRITE,
         current_folder_id=current_folder_id, current_folder=current_folder,
         breadcrumbs=breadcrumbs, repo_id_js=REPO_ID, HF_TOKEN_READ_js=HF_TOKEN_READ,
         hf_file_url_jinja=lambda path, download=False: f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{path}{'?download=true' if download else ''}",
+        is_tma_user_admin_flag=is_admin_tma())
 @app.route('/create_folder_tma', methods=['POST'])
 def create_folder_tma():
     if 'telegram_user_id' not in session:
+        flash('Не авторизован', 'error')
+        return redirect(url_for('tma_entry_page'))
     tma_user_id = session['telegram_user_id']
     data = load_data()
     user_data = data['users'].get(tma_user_id)
+    if not user_data:
+        flash('Пользователь не найден', 'error')
+        return redirect(url_for('tma_entry_page'))
     parent_folder_id = request.form.get('parent_folder_id', 'root')
     folder_name = request.form.get('folder_name', '').strip()
 @app.route('/download_tma/<file_id>')
 def download_tma(file_id):
     current_tma_user_id = session.get('telegram_user_id')
+    is_browser_admin_session = session.get('admin_browser_logged_in', False)
     data = load_data()
     file_node = None
+    if is_browser_admin_session:
+        for uid_str_iter, udata_iter in data.get('users', {}).items():
             node, _ = find_node_by_id(udata_iter.get('filesystem', {}), file_id)
             if node and node.get('type') == 'file':
                 file_node = node
                 break
+    elif current_tma_user_id:
+        user_data = data['users'].get(current_tma_user_id)
+        if user_data:
+            file_node, _ = find_node_by_id(user_data['filesystem'], file_id)
+        if not file_node and is_admin_tma():
+            for uid_str_iter, udata_iter in data.get('users', {}).items():
+                node, _ = find_node_by_id(udata_iter.get('filesystem', {}), file_id)
+                if node and node.get('type') == 'file':
+                    file_node = node
+                    break
+    else:
+        flash('Пожалуйста, авторизуйтесь.', 'error')
+        return redirect(url_for('tma_entry_page'))
+    redirect_url = request.referrer
+    if not redirect_url:
+        if is_browser_admin_session:
+            redirect_url = url_for('admin_panel')
+        else:
+            redirect_url = url_for('tma_dashboard')
     if not file_node or file_node.get('type') != 'file':
          flash('Файл не найден или доступ запрещен!', 'error')
+         return redirect(redirect_url)
     hf_path = file_node.get('path')
     original_filename = file_node.get('original_filename', 'downloaded_file')
     if not hf_path:
         flash('Ошибка: Путь к файлу не найден.', 'error')
+        return redirect(redirect_url)
     file_url = f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{hf_path}?download=true"
     try:
+        req_headers = {}
+        if HF_TOKEN_READ: req_headers["authorization"] = f"Bearer {HF_TOKEN_READ}"
+        r = requests.get(file_url, headers=req_headers, stream=True)
+        r.raise_for_status()
+        def generate_chunks():
+            for chunk in r.iter_content(chunk_size=8192):
+                yield chunk
+        mimetype = 'application/octet-stream'
+        if '.' in original_filename:
+            ext = original_filename.rsplit('.', 1)[1].lower()
+            content_types = {
+                'pdf': 'application/pdf', 'jpg': 'image/jpeg', 'jpeg': 'image/jpeg',
+                'png': 'image/png', 'gif': 'image/gif', 'txt': 'text/plain',
+                'mp4': 'video/mp4', 'mov': 'video/quicktime', 'avi': 'video/x-msvideo',
+                'zip': 'application/zip', 'rar': 'application/x-rar-compressed',
+            }
+            mimetype = content_types.get(ext, 'application/octet-stream')
+        resp = Response(generate_chunks(), mimetype=mimetype)
+        resp.headers['Content-Disposition'] = f'attachment; filename="{original_filename}"'
+        return resp
+    except requests.exceptions.RequestException as e:
         flash(f'Ошибка скачивания файла: {e}', 'error')
+    except Exception as e:
+        flash(f'Внутренняя ошибка при скачивании: {e}', 'error')
+    return redirect(redirect_url)
 @app.route('/delete_file_tma/<file_id>', methods=['POST'])
 def delete_file_tma(file_id):
 @app.route('/get_text_content_tma/<file_id>')
 def get_text_content_tma(file_id):
     current_tma_user_id = session.get('telegram_user_id')
+    is_browser_admin_session = session.get('admin_browser_logged_in', False)
     data = load_data()
     file_node = None
+    if is_browser_admin_session:
         for uid_str, udata_iter in data.get('users', {}).items():
             node, _ = find_node_by_id(udata_iter.get('filesystem', {}), file_id)
             if node and node.get('type') == 'file' and node.get('file_type') == 'text':
                 file_node = node; break
+    elif current_tma_user_id:
+        user_data = data['users'].get(current_tma_user_id)
+        if user_data:
+            file_node, _ = find_node_by_id(user_data['filesystem'], file_id)
+        if not file_node and is_admin_tma():
+            for uid_str, udata_iter in data.get('users', {}).items():
+                node, _ = find_node_by_id(udata_iter.get('filesystem', {}), file_id)
+                if node and node.get('type') == 'file' and node.get('file_type') == 'text':
+                    file_node = node; break
+    else:
+        return Response("Не авторизован", status=401)
     if not file_node or file_node.get('type') != 'file' or file_node.get('file_type') != 'text':
         return Response("Текстовый файл не найден", status=404)
     if not hf_path: return Response("Ошибка: путь к файлу отсутствует", status=500)
     file_url = f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{hf_path}?download=true"
     try:
+        req_headers = {};
+        if HF_TOKEN_READ: req_headers["authorization"] = f"Bearer {HF_TOKEN_READ}"
+        response = requests.get(file_url, headers=req_headers)
         response.raise_for_status()
         if len(response.content) > 1 * 1024 * 1024: return Response("Файл слишком большой.", status=413)
         try: text_content = response.content.decode('utf-8')
 @app.route('/tma_logout')
 def tma_logout():
+    session.pop('telegram_user_id', None)
+    session.pop('telegram_display_name', None)
     flash('Вы вышли из сессии приложения.')
     return redirect(url_for('tma_entry_page'))
+ADMIN_LOGIN_HTML_TEMPLATE = '''
+<!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Admin Login</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
+<style>
+{{ admin_base_style_css }}
+body { display: flex; justify-content: center; align-items: center; height: 100vh; background: var(--background-dark); }
+.login-container { text-align: center; padding: 40px; background: var(--card-bg-dark); border-radius: 20px; box-shadow: var(--shadow); width: 100%; max-width: 400px; }
+h1 { color: var(--primary); margin-bottom: 20px; }
+input[type="text"], input[type="password"] { background: rgba(255,255,255,0.1); color: var(--text-dark); margin-bottom: 20px; }
+.btn { background: var(--accent); width: 100%; }
+</style>
+</head><body class="dark">
+<div class="login-container">
+    <h1>Admin Login</h1>
+    {% with messages = get_flashed_messages(with_categories=true) %}
+        {% if messages %}
+            {% for category, message in messages %}
+            <div class="flash {{ category }}">{{ message }}</div>
+            {% endfor %}
+        {% endif %}
+    {% endwith %}
+    <form method="POST" action="{{ url_for('admin_login') }}">
+        <input type="hidden" name="next" value="{{ request.args.get('next', '') }}">
+        <input type="text" name="username" placeholder="Username" required>
+        <input type="password" name="password" placeholder="Password" required>
+        <button type="submit" class="btn">Login</button>
+    </form>
+</div>
+</body></html>
+'''
+@app.route('/admin/login', methods=['GET', 'POST'])
+def admin_login():
+    if request.method == 'POST':
+        username = request.form.get('username')
+        password = request.form.get('password')
+        next_url = request.form.get('next')
+        if username == ADMIN_USERNAME and password == ADMIN_PASSWORD:
+            session['admin_browser_logged_in'] = True
+            flash('Успешный вход в админ-панель.', 'success')
+            if next_url:
+                return redirect(next_url)
+            return redirect(url_for('admin_panel'))
+        else:
+            flash('Неверное имя пользователя или пароль.', 'error')
+    return render_template_string(ADMIN_LOGIN_HTML_TEMPLATE, admin_base_style_css=BASE_STYLE)
+@app.route('/admin/logout')
+def admin_logout():
+    session.pop('admin_browser_logged_in', None)
+    flash('Вы вышли из админ-панели.', 'success')
+    return redirect(url_for('admin_login'))
+ADMIN_PANEL_HTML_TEMPLATE = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Админ-панель</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
+<style>''' + BASE_STYLE + '''</style></head><body class="dark"><div class="container"><h1>Админ-панель</h1>
+<a href="{{ url_for('admin_logout') }}" class="btn" style="margin-bottom:20px; background-color: var(--accent);">Выйти из админ-панели</a>
+<a href="{{ url_for('tma_dashboard') }}" class="btn" style="margin-bottom:20px;">В приложение (если TMA сессия есть)</a>
 {% with messages = get_flashed_messages(with_categories=true) %}{% if messages %}{% for category, message in messages %}<div class="flash {{ category }}">{{ message }}</div>{% endfor %}{% endif %}{% endwith %}
 <h2>Пользователи</h2><div class="user-list">
 {% for user in user_details %}
 <div class="user-item">
+    <a href="{{ url_for('admin_user_files', tma_user_id_str=user.id_key) }}">{{ user.display_name }} (ID: {{user.id_key}})</a>
     <p>Зарегистрирован: {{ user.created_at }}</p><p>Файлов: {{ user.file_count }}</p>
+    <form method="POST" action="{{ url_for('admin_delete_user', tma_user_id_str=user.id_key) }}" style="display: inline; margin-left: 10px;" onsubmit="return confirm('УДАЛИТЬ пользователя {{ user.display_name }} и ВСЕ его файлы? НЕОБРАТИМО!');">
         <button type="submit" class="btn delete-btn" style="padding: 5px 10px; font-size: 0.9em;">Удалить</button>
     </form>
 </div>
 {% else %}<p>Пользователей нет.</p>{% endfor %}</div></div></body></html>'''
 @app.route('/admhosto')
+@admin_browser_login_required
+def admin_panel():
     data = load_data()
     users = data.get('users', {})
     user_details = []
             'display_name': udata.get('first_name', udata.get('telegram_username', f"User {tma_id_str}")),
             'created_at': udata.get('created_at', 'N/A'), 'file_count': file_count
         })
+    user_details.sort(key=lambda x: x.get('created_at', ''), reverse=True)
+    return render_template_string(ADMIN_PANEL_HTML_TEMPLATE, user_details=user_details)
+ADMIN_USER_FILES_HTML_TEMPLATE = '''
 <!DOCTYPE html><html lang="ru"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Файлы {{ display_name_admin_view }}</title><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
 <style>''' + BASE_STYLE + '''
+.file-item { background: var(--card-bg-dark); padding: 15px; border-radius: 16px; box-shadow: var(--shadow); transition: var(--transition); display: flex; flex-direction: column; justify-content: space-between; }
 .file-preview { max-width: 100%; height: 100px; object-fit: contain; border-radius: 10px; margin-bottom: 10px; display: block; margin-left: auto; margin-right: auto; }
 .admin-file-actions { margin-top: 10px; display: flex; flex-wrap: wrap; gap: 5px; justify-content: center; }
 .admin-file-actions .btn { font-size: 0.8em; padding: 4px 8px; margin: 0; }
+</style></head><body class="dark"><div class="container"><h1>Файлы пользователя: {{ display_name_admin_view }} (ID: {{ tma_user_id_str_admin_view }})</h1>
+<a href="{{ url_for('admin_panel') }}" class="btn" style="margin-bottom: 20px;">Назад к пользователям</a>
 {% with messages = get_flashed_messages(with_categories=true) %}{% if messages %}{% for category, message in messages %}<div class="flash {{ category }}">{{ message }}</div>{% endfor %}{% endif %}{% endwith %}
 <div style="display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 20px;">
+{% for file_item in files %}
 <div class="file-item"><div>
+    {% if file_item.file_type == 'image' %} <img class="file-preview" src="{{ hf_file_url_jinja(file_item.path) }}" loading="lazy" onclick="openModalAdmin('{{ hf_file_url_jinja(file_item.path) }}', '{{ file_item.file_type }}', '{{ file_item.id }}')" style="cursor: pointer;">
+    {% elif file_item.file_type == 'video' %} <video class="file-preview" preload="metadata" muted onclick="openModalAdmin('{{ hf_file_url_jinja(file_item.path) }}', '{{ file_item.file_type }}', '{{ file_item.id }}')" style="cursor: pointer;"><source src="{{ hf_file_url_jinja(file_item.path, True) }}#t=0.5"></video>
+    {% elif file_item.file_type == 'pdf' %} <div class="file-preview" style="font-size: 40px; line-height: 100px; text-align: center; color: var(--accent); cursor: pointer;" onclick="openModalAdmin('{{ hf_file_url_jinja(file_item.path, True) }}', '{{ file_item.file_type }}', '{{ file_item.id }}')">📄</div>
+    {% elif file_item.file_type == 'text' %} <div class="file-preview" style="font-size: 40px; line-height: 100px; text-align: center; color: var(--secondary); cursor: pointer;" onclick="openModalAdmin('{{ url_for('get_text_content_tma', file_id=file_item.id) }}', '{{ file_item.file_type }}', '{{ file_item.id }}')">📝</div>
     {% else %} <div class="file-preview" style="font-size: 40px; line-height: 100px; text-align: center; color: #aaa;">❓</div> {% endif %}
+    <p title="{{ file_item.original_filename }}"><b>{{ file_item.original_filename | truncate(30) }}</b></p>
+    <p style="font-size: 0.8em; color: #888;">В папке: {{ file_item.parent_path_str }}</p>
+    <p style="font-size: 0.8em; color: #888;">Загружен: {{ file_item.upload_date }}</p>
+    <p style="font-size: 0.7em; color: #ccc;">ID: {{ file_item.id }}</p>
+    <p style="font-size: 0.7em; color: #ccc; word-break: break-all;">Path: {{ file_item.path }}</p>
     </div><div class="admin-file-actions">
+        <a href="{{ url_for('download_tma', file_id=file_item.id) }}" class="btn download-btn">Скачать</a>
+        {% set previewable = file_item.file_type in ['image', 'video', 'pdf', 'text'] %}
+        {% if previewable %}<button class="btn" style="background: var(--accent);" onclick="openModalAdmin('{{ hf_file_url_jinja(file_item.path) if file_item.file_type != 'text' else url_for('get_text_content_tma', file_id=file_item.id) }}', '{{ file_item.file_type }}', '{{ file_item.id }}')">Просмотр</button>{% endif %}
+        <form method="POST" action="{{ url_for('admin_delete_file', tma_user_id_str_form=tma_user_id_str_admin_view, file_id=file_item.id) }}" style="display: inline-block;" onsubmit="return confirm('Удалить файл {{ file_item.original_filename }}?');">
              <button type="submit" class="btn delete-btn">Удалить</button></form>
     </div></div>{% else %} <p>У пользователя нет файлов.</p> {% endfor %}</div></div>
 <div class="modal" id="mediaModalAdmin" onclick="closeModalAdminEv(event)"><div class="modal-content" id="modalContentContainerAdmin">
 </script></body></html>'''
 @app.route('/admhosto/user/<tma_user_id_str>')
+@admin_browser_login_required
+def admin_user_files(tma_user_id_str):
     data = load_data()
     user_data = data.get('users', {}).get(tma_user_id_str)
     if not user_data:
+        flash(f'Пользователь ID {tma_user_id_str} не найден.', 'error'); return redirect(url_for('admin_panel'))
     all_files = []
     def collect_files_admin(folder, current_path_id='root'):
     all_files.sort(key=lambda x: x.get('upload_date', ''), reverse=True)
     display_name_admin_view = user_data.get('first_name', user_data.get('telegram_username', f"User {tma_user_id_str}"))
+    return render_template_string(ADMIN_USER_FILES_HTML_TEMPLATE,
         tma_user_id_str_admin_view=tma_user_id_str, display_name_admin_view=display_name_admin_view, files=all_files,
         repo_id_js_admin=REPO_ID,
         hf_file_url_jinja=lambda path, download=False: f"https://huggingface.co/datasets/{REPO_ID}/resolve/main/{path}{'?download=true' if download else ''}")
 @app.route('/admhosto/delete_user/<tma_user_id_str>', methods=['POST'])
+@admin_browser_login_required
+def admin_delete_user(tma_user_id_str):
     if not HF_TOKEN_WRITE:
+         flash('Удаление невозможно: токен для записи не настроен.', 'error'); return redirect(url_for('admin_panel'))
     data = load_data()
     if tma_user_id_str not in data['users']:
+        flash('Пользователь не найден!', 'error'); return redirect(url_for('admin_panel'))
     try:
         api = HfApi()
         user_folder_path_on_hf = f"cloud_files/{tma_user_id_str}"
+        api.delete_folder(folder_path=user_folder_path_on_hf, repo_id=REPO_ID, repo_type="dataset", token=HF_TOKEN_WRITE, ignore_patterns=[".keep"])
     except hf_utils.HfHubHTTPError as e:
+         if e.response.status_code != 404: # 404 means folder not found, which is fine for deletion.
+             flash(f'Ошибка удаления файлов пользователя {tma_user_id_str} с сервера: {e}. Пользователь из базы не удален.', 'error'); return redirect(url_for('admin_panel'))
+         logging.info(f"Folder {user_folder_path_on_hf} not found on HF Hub for user {tma_user_id_str} or was already empty, proceeding with DB deletion.")
     except Exception as e:
+        flash(f'Ошибка удаления файлов пользователя {tma_user_id_str} с сервера: {e}. Пользователь из базы не удален.', 'error'); return redirect(url_for('admin_panel'))
     try:
         del data['users'][tma_user_id_str]
         save_data(data)
+        flash(f'Пользователь {tma_user_id_str} и его файлы (если были) удалены.')
     except Exception as e:
+        flash(f'Файлы на сервере могли быть удалены, но произошла ошибка удаления пользователя из базы данных: {e}', 'error')
+    return redirect(url_for('admin_panel'))
 @app.route('/admhosto/delete_file/<tma_user_id_str_form>/<file_id>', methods=['POST'])
+@admin_browser_login_required
+def admin_delete_file(tma_user_id_str_form, file_id):
     if not HF_TOKEN_WRITE:
+         flash('Удаление невозможно: токен для записи не настроен.', 'error'); return redirect(url_for('admin_user_files', tma_user_id_str=tma_user_id_str_form))
     data = load_data()
     user_data = data.get('users', {}).get(tma_user_id_str_form)
     if not user_data:
+        flash(f'Пользователь {tma_user_id_str_form} не найден.', 'error'); return redirect(url_for('admin_panel'))
     file_node, _ = find_node_by_id(user_data['filesystem'], file_id)
     if not file_node or file_node.get('type') != 'file':
+        flash('Файл не найден в базе данных этого пользователя.', 'error'); return redirect(url_for('admin_user_files', tma_user_id_str=tma_user_id_str_form))
     hf_path = file_node.get('path')
     original_filename = file_node.get('original_filename', 'файл')
     if not hf_path:
         if remove_node(user_data['filesystem'], file_id):
+            try: save_data(data); flash(f'Метаданные файла {original_filename} удалены из базы (путь к файлу на сервере отсутствовал).')
+            except Exception as e: flash('Ошибка сохранения данных после удаления метаданных (путь отсутствовал).', 'error')
+        return redirect(url_for('admin_user_files', tma_user_id_str=tma_user_id_str_form))
     try:
         api = HfApi()
         api.delete_file(path_in_repo=hf_path, repo_id=REPO_ID, repo_type="dataset", token=HF_TOKEN_WRITE)
         if remove_node(user_data['filesystem'], file_id):
+            try: save_data(data); flash(f'Файл {original_filename} успешно удален с сервера и из базы данных!')
+            except Exception as e: flash('Файл удален с сервера, но произошла ошибка при обновлении базы данных.', 'error')
+        else:
+             flash(f'Файл {original_filename} удален с сервера, но не найден в структуре папок пользователя для удаления из базы.', 'error')
     except hf_utils.EntryNotFoundError:
+        flash(f'Файл {original_filename} не найден на сервере. Удаляем из базы данных.')
         if remove_node(user_data['filesystem'], file_id):
+            try: save_data(data); flash(f'Запись о файле {original_filename} удалена из базы.')
+            except Exception as e: flash('Ошибка сохранения данных после удаления записи о файле (файл не на сервере).', 'error')
     except Exception as e:
+        flash(f'Ошибка при удалении файла {original_filename}: {e}', 'error')
+    return redirect(url_for('admin_user_files', tma_user_id_str=tma_user_id_str_form))
 if __name__ == '__main__':
     if not HF_TOKEN_WRITE: logging.warning("HF_TOKEN (write access) is not set. Uploads/deletions/backups will fail.")
     if not HF_TOKEN_READ: logging.warning("HF_TOKEN_READ is not set. Using HF_TOKEN. Downloads/previews might fail for private repos if HF_TOKEN also lacks read.")
+    if ADMIN_TELEGRAM_ID == "YOUR_ADMIN_TELEGRAM_USER_ID_HERE": logging.warning("ADMIN_TELEGRAM_ID is not set. TMA admin features might not work as expected for specific users.")
+    if ADMIN_USERNAME == "admin" and ADMIN_PASSWORD == "zeusadminpass":
+        logging.warning("Using default admin username/password for browser admin panel. Please change ADMIN_USERNAME and ADMIN_PASSWORD environment variables.")
     if HF_TOKEN_WRITE:
         download_db_from_hf()