fix: address issues from PR #9 code review

Made-with: Cursor

Author: ddddeadispose

public/css/style.css

@@ -2195,6 +2195,12 @@ html {
     background: var(--accent);
 }
 
+.radio-group {
+    display: flex;
+    gap: 16px;
+    flex-wrap: wrap;
+}
+
 .form-group .datetime-input {
     color-scheme: dark;
     padding-right: 44px;

src/routes/panel.js

@@ -847,24 +847,14 @@ router.post('/users/:userId', requireAuth, async (req, res) => {
             const parsedExpireAt = new Date(expireAtRaw);
 
             if (Number.isNaN(parsedExpireAt.getTime())) {
+                draftUser.expireAt = null;
                 return render(res, 'user-form', {
-                    title: `Редактирование ${req.params.userId}`,
+                    title: res.locals.t('users.editUser') + ' ' + req.params.userId,
                     page: 'users',
                     groups: availableGroups,
                     user: draftUser,
                     isEdit: true,
-                    error: 'Некорректный формат даты/времени окончания',
-                });
-            }
-
-            if (parsedExpireAt.getTime() < Date.now()) {
-                return render(res, 'user-form', {
-                    title: `Редактирование ${req.params.userId}`,
-                    page: 'users',
-                    groups: availableGroups,
-                    user: draftUser,
-                    isEdit: true,
-                    error: 'Дата/время окончания не может быть в прошлом',
+                    error: res.locals.t('users.expireAtInvalidError'),
                 });
             }
 
@@ -896,6 +886,8 @@ router.post('/users/:userId', requireAuth, async (req, res) => {
         await cache.clearDeviceIPs(req.params.userId);
         await cache.invalidateDashboardCounts();
 
+        webhookService.emit(webhookService.EVENTS.USER_UPDATED, { userId: req.params.userId, updates });
+
         res.redirect(`/panel/users/${req.params.userId}`);
     } catch (error) {
         res.status(500).send('Ошибка: ' + error.message);

views/user-detail.ejs

@@ -103,14 +103,16 @@
             </div>
             <div class="card-body">
                 <div class="actions-list">
-                    <% if (user.enabled) { %>
-                    <button class="btn btn-warning btn-block" onclick="toggleUser(false)">
-                        <%= t('users.disableUser') %>
-                    </button>
-                    <% } else { %>
-                    <button class="btn btn-success btn-block" onclick="toggleUser(true)">
-                        <%= t('users.enableUser') %>
-                    </button>
+                    <% if (!isExpired) { %>
+                        <% if (user.enabled) { %>
+                        <button class="btn btn-warning btn-block" onclick="toggleUser(false)">
+                            <%= t('users.disableUser') %>
+                        </button>
+                        <% } else { %>
+                        <button class="btn btn-success btn-block" onclick="toggleUser(true)">
+                            <%= t('users.enableUser') %>
+                        </button>
+                        <% } %>
                     <% } %>
                     
                     <a href="/panel/users/<%= user.userId %>/edit" class="btn btn-primary btn-block">

views/user-form.ejs

@@ -7,10 +7,7 @@ const selectedGroupIds = new Set(
 const trafficLimitGB = isEditMode ? Math.round((user.trafficLimit || 0) / (1024 * 1024 * 1024)) : 0;
 const maxDevicesValue = isEditMode ? (parseInt(user.maxDevices, 10) || 0) : 0;
 const hasExpireAt = isEditMode && user.expireAt;
-const expireAtDate = hasExpireAt ? new Date(user.expireAt) : null;
-const expireAtLocalValue = expireAtDate && !Number.isNaN(expireAtDate.getTime())
-    ? new Date(expireAtDate.getTime() - (expireAtDate.getTimezoneOffset() * 60000)).toISOString().slice(0, 16)
-    : '';
+const expireAtIso = hasExpireAt ? new Date(user.expireAt).toISOString() : '';
 %>
 <div class="page-header">
     <a href="/panel/users" class="btn btn-back"><%= t('common.backToList') %></a>
@@ -93,11 +90,11 @@ const expireAtLocalValue = expireAtDate && !Number.isNaN(expireAtDate.getTime())
 
             <div class="form-group" id="expireDatetimeGroup" style="display: <%= hasExpireAt ? 'block' : 'none' %>;">
                 <label for="expireAtLocal"><%= t('users.expireAtLabel') %></label>
-                <input type="datetime-local" id="expireAtLocal" name="expireAtLocal" class="datetime-input" value="<%= expireAtLocalValue %>">
+                <input type="datetime-local" id="expireAtLocal" name="expireAtLocal" class="datetime-input" data-utc="<%= expireAtIso %>">
                 <small><%= t('users.expireAtHint') %></small>
             </div>
 
-            <input type="hidden" id="expireAt" name="expireAt" value="<%= hasExpireAt ? new Date(user.expireAt).toISOString() : '' %>">
+            <input type="hidden" id="expireAt" name="expireAt" value="<%= expireAtIso %>">
 
             <div class="form-group">
                 <label class="checkbox-label">
@@ -123,14 +120,28 @@ const expireAtLocalValue = expireAtDate && !Number.isNaN(expireAtDate.getTime())
             const expireAtInput = document.getElementById('expireAt');
             const form = document.getElementById('userForm');
 
-            function updateExpireMode() {
+            function utcToLocal(isoString) {
+                if (!isoString) return '';
+                const d = new Date(isoString);
+                if (Number.isNaN(d.getTime())) return '';
+                const local = new Date(d.getTime() - d.getTimezoneOffset() * 60000);
+                return local.toISOString().slice(0, 16);
+            }
+
+            function initExpireAtLocal() {
+                const utc = expireAtLocalInput.dataset.utc;
+                if (utc) {
+                    expireAtLocalInput.value = utcToLocal(utc);
+                }
+            }
+
+            function updateExpireMode(skipInit) {
                 const selectedMode = document.querySelector('input[name="expireMode"]:checked').value;
 
                 if (selectedMode === 'datetime') {
                     expireDaysGroup.style.display = 'none';
                     expireDatetimeGroup.style.display = 'block';
                     expireDaysInput.value = '';
-                    syncExpireAt();
                 } else {
                     expireDaysGroup.style.display = 'block';
                     expireDatetimeGroup.style.display = 'none';
@@ -155,7 +166,7 @@ const expireAtLocalValue = expireAtDate && !Number.isNaN(expireAtDate.getTime())
             }
 
             expireModeInputs.forEach((input) => {
-                input.addEventListener('change', updateExpireMode);
+                input.addEventListener('change', () => updateExpireMode());
             });
 
             expireAtLocalInput.addEventListener('change', syncExpireAt);
@@ -174,6 +185,7 @@ const expireAtLocalValue = expireAtDate && !Number.isNaN(expireAtDate.getTime())
                 syncExpireAt();
             });
 
+            initExpireAtLocal();
             updateExpireMode();
         })();
     </script>

views/users.ejs

@@ -255,15 +255,15 @@ function getSortIcon(field) {
 %>
 
 <script>
-const baseUrl = <%- JSON.stringify(baseUrl) %>;
-const currentSortBy = <%- JSON.stringify(query.sortBy || "createdAt") %>;
-const currentSortOrder = <%- JSON.stringify(query.sortOrder || "desc") %>;
+const baseUrl = <%= JSON.stringify(baseUrl) %>;
+const currentSortBy = <%= JSON.stringify(String(query.sortBy || "createdAt").replace(/[<>]/g, "")) %>;
+const currentSortOrder = <%= JSON.stringify(String(query.sortOrder || "desc").replace(/[<>]/g, "")) %>;
 const i18n = {
-    turnedOn: <%- JSON.stringify(t("users.turnedOn")) %>,
-    turnedOff: <%- JSON.stringify(t("users.turnedOff")) %>,
-    error: <%- JSON.stringify(t("common.error")) %>,
-    linkCopied: <%- JSON.stringify(t("users.linkCopied")) %>,
-    copyError: <%- JSON.stringify(t("users.copyError")) %>
+    turnedOn: <%= JSON.stringify(t("users.turnedOn")) %>,
+    turnedOff: <%= JSON.stringify(t("users.turnedOff")) %>,
+    error: <%= JSON.stringify(t("common.error")) %>,
+    linkCopied: <%= JSON.stringify(t("users.linkCopied")) %>,
+    copyError: <%= JSON.stringify(t("users.copyError")) %>
 };
 
 // Debounced search