revert: restore horizontal scroll table layout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -6,7 +6,8 @@ DB_PASSWORD=evosync
 
 # App
 SECRET_KEY=change-me-in-production
-BASE_URL=https://evosync.ru
+DOMAIN=yourdomain.com
+BASE_URL=https://${DOMAIN}
 
 # Evotor
 EVOTOR_APP_ID=

README.md

@@ -55,7 +55,7 @@ Web service for syncing a product catalog from Evotor POS → VK Market. Users c
 | `sync_filters`        | Store / group inclusion filters (entity_type: store / group)                         |
 | `cached_stores`       | Cached list of Evotor stores                                                         |
 | `cached_groups`       | Cached Evotor product groups                                                         |
-| `cached_products`     | Cached Evotor product catalog                                                        |
+| `cached_products`     | Cached Evotor products; `vk_product_id` stores the VK market item ID after first push |
 | `vk_cached_albums`    | Cached VK Market albums (product groups)                                             |
 | `vk_cached_products`  | Cached VK Market products                                                            |
 | `roles`               | RBAC roles                                                                           |
@@ -69,20 +69,41 @@ Web service for syncing a product catalog from Evotor POS → VK Market. Users c
 
 Periodic tasks run via **Celery Beat** and are executed by the **worker** service.
 
-| Task | Schedule | Description |
+Beat fires a single **sync pipeline** every `CATALOG_REFRESH_INTERVAL_SECONDS`. The three tasks run as a Celery chain — each step starts only after the previous one completes:
-|------|----------|-------------|
-| `web.tasks.catalog.refresh_catalog` | Every `CATALOG_REFRESH_INTERVAL_SECONDS` | Fetches stores, product groups, and products from the Evotor API for every connected user; upserts into `cached_stores`, `cached_groups`, `cached_products` |
-| `web.tasks.vk_catalog.refresh_vk_catalog` | Every `CATALOG_REFRESH_INTERVAL_SECONDS` | Fetches Market albums and products from VK API for every connected user; upserts into `vk_cached_albums`, `vk_cached_products` |
 
-**Evotor sync sequence per user:**
+```
+run_sync_pipeline (beat entry)
+  └─► refresh_catalog        — fetch Evotor stores / groups / products
+        └─► refresh_vk_catalog   — fetch VK Market albums / products
+              └─► mirror_to_vk       — push Evotor → VK
+```
+
+| Task | Queue | Description |
+|------|-------|-------------|
+| `web.tasks.celery_app.run_sync_pipeline` | default | Beat entry point; dispatches the chain |
+| `web.tasks.catalog.refresh_catalog` | default | Fetches Evotor catalog for all connected users; upserts `cached_stores`, `cached_groups`, `cached_products` |
+| `web.tasks.vk_catalog.refresh_vk_catalog` | default | Fetches VK Market albums and products for all connected users; upserts `vk_cached_albums`, `vk_cached_products` |
+| `web.tasks.vk_sync.mirror_to_vk` | sync | Mirrors enabled Evotor groups/products → VK Market (create or conditional update) |
+
+**Evotor fetch sequence per user:**
 1. `GET /stores` → upsert `cached_stores`
 2. For each store: `GET /stores/{id}/product-groups` → upsert `cached_groups`
 3. For each store: `GET /stores/{id}/products` → upsert `cached_products`
 
-**VK sync sequence per user:**
+**VK fetch sequence per user:**
 1. `market.getAlbums` → upsert `vk_cached_albums`
 2. `market.get` (extended=1, paginated) → upsert `vk_cached_products` with album membership
 
+**Mirror logic per user (`mirror_to_vk`):**
+- Skips stores not in enabled store filters; skips groups not in enabled group filters
+- For each enabled group: ensures a matching VK album exists (creates via `market.addAlbum` if missing)
+- For each product in the group:
+  - **Create** (`allow_to_sell=true`, no `vk_product_id` yet): uploads default photo once per run, calls `market.add`, assigns to album, stores returned `vk_product_id`
+  - **Update** (has `vk_product_id`): calls `market.edit` only if name, price, description, or stock_amount changed vs the cached VK state
+  - **Skip**: product disabled and never pushed, or nothing changed
+- Price is multiplied by the per-user `price_multiplier` from `sync_configs` (configurable on the `/sync` page)
+- Description is built as `"Name (цена за N unit.)"` when the product has a `measure_name`
+
 Per-user failures are logged and skipped — one broken token does not block other users.
 Evotor stores that return `402 Payment Required` (subscription limit) are silently skipped at debug log level.
 
@@ -160,6 +181,13 @@ Evotor stores that return `402 Payment Required` (subscription limit) are silent
 | POST   | `/catalog/stores/{id}/toggle`                     | Enable / disable store sync                |
 | POST   | `/catalog/stores/{id}/groups/{gid}/toggle`        | Enable / disable group sync                |
 
+### Sync Settings (requires session)
+
+| Method   | Path             | Description                                          |
+|----------|------------------|------------------------------------------------------|
+| GET      | `/sync`          | Sync settings: task on/off switches, price multiplier |
+| POST     | `/sync/settings` | Save sync settings                                   |
+
 ### VK Catalog (requires session)
 
 | Method | Path                                  | Description                        |
@@ -167,6 +195,12 @@ Evotor stores that return `402 Payment Required` (subscription limit) are silent
 | GET    | `/vk-catalog/albums`                  | VK Market albums (product groups)  |
 | GET    | `/vk-catalog/albums/{id}/products`    | Products in a VK album             |
 
+### Admin Logs (`/admin`, roles: admin / system)
+
+| Method | Path          | Description                                           |
+|--------|---------------|-------------------------------------------------------|
+| GET    | `/admin/logs` | API request/response log viewer with filters and pagination |
+
 ### API Docs
 
 | Path     | Description |
@@ -185,13 +219,16 @@ All settings are read from environment variables or a `.env` file:
 | `DATABASE_URL`                     | `mysql+pymysql://…@db:3306/evosync` | MariaDB connection string             |
 | `REDIS_URL`                        | `redis://redis:6379/0`              | Redis connection string               |
 | `SECRET_KEY`                       | `change-me-in-production`           | Session signing key                   |
-| `BASE_URL`                         | `http://localhost:8000`             | Public URL of the service             |
+| `DOMAIN`                           | —                                   | Public domain name (e.g. `example.com`); used to derive `BASE_URL` and nginx config |
+| `BASE_URL`                         | `https://${DOMAIN}`                 | Public URL of the service             |
 | `EVOTOR_APP_ID`                    | —                                   | Evotor application ID                 |
 | `EVOTOR_WEBHOOK_SECRET`            | —                                   | Bearer secret for webhook endpoints   |
 | `JIVOSITE_WIDGET_ID`               | —                                   | JivoSite widget ID                    |
 | `VK_DEFAULT_PHOTO_PATH`            | `/app/default_product.png`          | Fallback image path for VK products   |
 | `VK_API_VERSION`                   | `5.199`                             | VK API version                        |
-| `CATALOG_REFRESH_INTERVAL_SECONDS` | `3600`                              | Evotor + VK catalog sync interval (s) |
+| `CATALOG_REFRESH_INTERVAL_SECONDS` | `3600`                              | Sync pipeline interval in seconds     |
+| `VK_CATEGORY_ID`                   | `40932`                             | VK Market category ID for all products |
+| `VK_STOCK_AMOUNT`                  | `1000`                              | Stock amount set for in-sale products  |
 | `INVITE_EXPIRE_HOURS`              | `48`                                | Invite link TTL in hours              |
 | `EMAIL_PROVIDER`                   | `console`                           | Email provider (console / smtp / …)   |
 | `SMS_PROVIDER`                     | `console`                           | SMS provider                          |
@@ -202,13 +239,38 @@ All settings are read from environment variables or a `.env` file:
 ## Running
 
 ```bash
-cp .env.example .env   # fill in your values
+cp .env.example .env   # set DOMAIN and other values
 docker compose up -d --build
 ```
 
 App is available at `http://localhost:8080`.  
 Flower (queue monitor) at `http://localhost:5555`.
 
+### First deploy (TLS)
+
+Run once per domain (repeat for every domain pointing to this server):
+
+```bash
+# 1. Obtain TLS certificate
+sudo ./scripts/init-letsencrypt.sh my-products.ru
+sudo ./scripts/init-letsencrypt.sh мои-товары.рф
+
+# 2. Generate nginx site config and symlink it into sites-enabled
+sudo ./scripts/generate-nginx-conf.sh my-products.ru
+sudo ./scripts/generate-nginx-conf.sh мои-товары.рф
+
+# 3. Reload nginx
+sudo systemctl reload nginx
+```
+
+`generate-nginx-conf.sh` expands `nginx/nginx.conf.template` with the given domain and writes the result to `/etc/nginx/sites-available/<domain>.conf`, then creates a symlink in `sites-enabled`.
+
+Set up auto-renewal (if not already configured by certbot):
+
+```
+0 3 * * * root certbot renew --quiet && systemctl reload nginx
+```
+
 ### Development
 
 ```bash

docker-compose.yml

@@ -2,6 +2,7 @@ services:
   db:
     image: mariadb:11.4
     restart: unless-stopped
+    command: --innodb-buffer-pool-size=128M --max-connections=20
     environment:
       MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
       MYSQL_DATABASE: ${DB_NAME}
@@ -39,7 +40,7 @@ services:
       DATABASE_URL: mysql+pymysql://${DB_USER}:${DB_PASSWORD}@db:3306/${DB_NAME}
       REDIS_URL: redis://redis:6379/0
       SECRET_KEY: ${SECRET_KEY:-change-me-in-production}
-      BASE_URL: ${BASE_URL:-https://evosync.ru}
+      BASE_URL: ${BASE_URL:-https://${DOMAIN}}
       EVOTOR_APP_ID: ${EVOTOR_APP_ID:-}
       EVOTOR_WEBHOOK_SECRET: ${EVOTOR_WEBHOOK_SECRET:-}
       JIVOSITE_WIDGET_ID: ${JIVOSITE_WIDGET_ID:-}
@@ -73,7 +74,7 @@ services:
         condition: service_healthy
       db:
         condition: service_healthy
-    command: celery -A web.tasks.celery_app worker --loglevel=info --concurrency=2 --queues=default,sync,health,notifications -E
+    command: celery -A web.tasks.celery_app worker --loglevel=info --concurrency=1 --queues=default,sync,health,notifications -E
 
   beat:
     build:
@@ -97,6 +98,7 @@ services:
       context: .
       dockerfile: Dockerfile.web
     restart: unless-stopped
+    profiles: [flower]
     ports:
       - "5555:5555"
     environment:

nginx/nginx.conf

@@ -2,9 +2,11 @@ upstream web {
     server 127.0.0.1:8080;
 }
 
+# ── мои-товары.рф ─────────────────────────────────────────────────────────────
+
 server {
     listen 80;
-    server_name evosync.ru www.evosync.ru;
+    server_name xn----8sbfwtmcso8g.xn--p1ai www.xn----8sbfwtmcso8g.xn--p1ai;
 
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
@@ -17,10 +19,45 @@ server {
 
 server {
     listen 443 ssl;
-    server_name evosync.ru www.evosync.ru;
+    server_name xn----8sbfwtmcso8g.xn--p1ai www.xn----8sbfwtmcso8g.xn--p1ai;
 
-    ssl_certificate /etc/letsencrypt/live/evosync.ru/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/xn----8sbfwtmcso8g.xn--p1ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/evosync.ru/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xn----8sbfwtmcso8g.xn--p1ai/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    location / {
+        proxy_pass http://web;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+# ── my-products.ru ────────────────────────────────────────────────────────────
+
+server {
+    listen 80;
+    server_name my-products.ru www.my-products.ru;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name my-products.ru www.my-products.ru;
+
+    ssl_certificate /etc/letsencrypt/live/my-products.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/my-products.ru/privkey.pem;
 
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_ciphers HIGH:!aNULL:!MD5;

scripts/create_admin.py

@@ -38,7 +38,7 @@ def main() -> None:
                 first_name=args.first_name,
                 last_name=args.last_name,
                 email=args.email,
-                phone=args.phone,
+                phone=args.phone or None,
                 password_hash=hash_password(args.password),
                 role=UserRoleEnum(args.role),
                 status=UserStatusEnum.active,

scripts/init-letsencrypt.sh

@@ -1,19 +1,39 @@
 #!/bin/bash
-# Obtain TLS certificates from Let's Encrypt for evosync.ru
+# Obtain a TLS certificate from Let's Encrypt for one domain.
-# Run once on first deploy: sudo ./scripts/init-letsencrypt.sh
+#
-# Requires nginx running on the host with acme-challenge location configured
+# Usage:
+#   sudo ./scripts/init-letsencrypt.sh my-products.ru
+#   sudo ./scripts/init-letsencrypt.sh xn----8sbfwtmcso8g.xn--p1ai
+#
+# For IDN/Cyrillic domains, pass the punycode form (certbot requires ASCII).
+# If no argument is given, DOMAIN is read from .env.
+# Run once per domain on first deploy.
 
 set -euo pipefail
 
-DOMAIN="evosync.ru"
+# ── resolve domain ────────────────────────────────────────────────────────────
-EMAIL="${LETSENCRYPT_EMAIL:-admin@evosync.ru}"
+if [ -n "${1:-}" ]; then
-CERTBOT_DIR="./certbot"
+  DOMAIN="$1"
+else
+  if [ -f .env ]; then
+    DOMAIN_FROM_ENV=$(grep -E '^DOMAIN=' .env | cut -d= -f2- | tr -d '"'"'" | head -1)
+    DOMAIN="${DOMAIN:-${DOMAIN_FROM_ENV:-}}"
+  fi
+fi
+
+if [ -z "${DOMAIN:-}" ]; then
+  echo "ERROR: no domain specified." >&2
+  echo "Usage: $0 <domain>  or set DOMAIN= in .env" >&2
+  exit 1
+fi
+
+EMAIL="${LETSENCRYPT_EMAIL:-admin@$DOMAIN}"
 ACME_DIR="/var/www/certbot"
 
-echo "==> Creating certbot directories..."
+echo "==> Obtaining certificate for: $DOMAIN (www.$DOMAIN)"
-mkdir -p "$CERTBOT_DIR/conf" "$CERTBOT_DIR/www"
+echo "    Email: $EMAIL"
 
-echo "==> Ensuring acme-challenge directory exists on host..."
+echo "==> Ensuring acme-challenge directory exists..."
 sudo mkdir -p "$ACME_DIR"
 sudo chmod 755 "$ACME_DIR"
 
@@ -27,20 +47,14 @@ sudo certbot certonly \
     -d "$DOMAIN" \
     -d "www.$DOMAIN"
 
-echo "==> Copying certificates to project directory..."
-sudo cp "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" "$CERTBOT_DIR/conf/fullchain.pem"
-sudo cp "/etc/letsencrypt/live/$DOMAIN/privkey.pem" "$CERTBOT_DIR/conf/privkey.pem"
-sudo chown "$(whoami):$(whoami)" "$CERTBOT_DIR/conf"/*.pem
-
-echo "==> Done! TLS certificate installed for $DOMAIN"
 echo ""
-echo "Certificate files:"
+echo "==> Certificate obtained for $DOMAIN"
-echo "  - $CERTBOT_DIR/conf/fullchain.pem"
+echo "    /etc/letsencrypt/live/$DOMAIN/fullchain.pem"
-echo "  - $CERTBOT_DIR/conf/privkey.pem"
+echo "    /etc/letsencrypt/live/$DOMAIN/privkey.pem"
 echo ""
-echo "Configure nginx:"
+echo "==> Generate nginx config and reload:"
-echo "  ssl_certificate $CERTBOT_DIR/conf/fullchain.pem;"
+echo "    sudo ./scripts/generate-nginx-conf.sh $DOMAIN"
-echo "  ssl_certificate_key $CERTBOT_DIR/conf/privkey.pem;"
+echo "    sudo nginx -t && sudo systemctl reload nginx"
 echo ""
-echo "Set up auto-renewal with: sudo crontab -e"
+echo "==> Auto-renewal (add to /etc/cron.d/certbot if not already present):"
-echo "Add: 0 3 * * * certbot renew --quiet && systemctl reload nginx"
+echo "    0 3 * * * root certbot renew --quiet && systemctl reload nginx"

tests/test_routes_catalog.py

@@ -0,0 +1,275 @@
+"""Integration tests for /catalog routes (stores, groups, products, toggles)."""
+from datetime import datetime
+
+import pytest
+
+from web.models.connections import (
+    CachedGroup, CachedProduct, CachedStore, SyncConfig, SyncFilter,
+)
+
+
+def _now():
+    return datetime.utcnow()
+
+
+async def _login(client, user):
+    await client.post("/login", data={"email": user.email, "password": "testpass123"},
+                      follow_redirects=False)
+
+
+def _make_store(db, user_id, evotor_id="s1", name="Магазин 1"):
+    s = CachedStore(user_id=user_id, evotor_id=evotor_id, name=name, fetched_at=_now())
+    db.add(s)
+    db.flush()
+    return s
+
+
+def _make_group(db, user_id, store_id, evotor_id="g1", name="Группа 1"):
+    g = CachedGroup(user_id=user_id, store_evotor_id=store_id,
+                    evotor_id=evotor_id, name=name, fetched_at=_now())
+    db.add(g)
+    db.flush()
+    return g
+
+
+def _make_product(db, user_id, store_id, group_id=None, evotor_id="p1", name="Товар 1",
+                  price=100, allow_to_sell=True):
+    p = CachedProduct(
+        user_id=user_id, store_evotor_id=store_id, group_evotor_id=group_id,
+        evotor_id=evotor_id, name=name, price=price, allow_to_sell=allow_to_sell,
+        fetched_at=_now(),
+    )
+    db.add(p)
+    db.flush()
+    return p
+
+
+# ── auth guards ───────────────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_catalog_stores_requires_login(client):
+    resp = await client.get("/catalog/stores", follow_redirects=False)
+    assert resp.status_code == 303
+    assert "/login" in resp.headers["location"]
+
+
+# ── GET /catalog/stores ───────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_catalog_stores_empty(client, active_user):
+    await _login(client, active_user)
+    resp = await client.get("/catalog/stores")
+    assert resp.status_code == 200
+    assert "не загружены" in resp.text.lower()
+
+
+@pytest.mark.asyncio
+async def test_catalog_stores_lists_stores(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1", "Главный магазин")
+    _make_store(override_db, active_user.id, "s2", "Второй магазин")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores")
+    assert resp.status_code == 200
+    assert "Главный магазин" in resp.text
+    assert "Второй магазин" in resp.text
+
+
+@pytest.mark.asyncio
+async def test_catalog_stores_not_shows_other_user(client, active_user, user_factory, override_db):
+    await _login(client, active_user)
+    other = user_factory.create()
+    _make_store(override_db, other.id, "s-other", "Чужой магазин")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores")
+    assert "Чужой магазин" not in resp.text
+
+
+# ── GET /catalog/stores/{id}/groups ──────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_catalog_groups_shows_product_count(client, active_user, override_db):
+    await _login(client, active_user)
+    store = _make_store(override_db, active_user.id, "s1")
+    group = _make_group(override_db, active_user.id, "s1", "g1", "Чай")
+    _make_product(override_db, active_user.id, "s1", "g1", "p1", "Пуэр")
+    _make_product(override_db, active_user.id, "s1", "g1", "p2", "Улун")
+    override_db.commit()
+
+    resp = await client.get(f"/catalog/stores/s1/groups")
+    assert resp.status_code == 200
+    assert "Чай" in resp.text
+    assert "2" in resp.text  # product count
+
+
+@pytest.mark.asyncio
+async def test_catalog_groups_zero_count_for_empty_group(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_group(override_db, active_user.id, "s1", "g1", "Пустая группа")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores/s1/groups")
+    assert resp.status_code == 200
+    assert "Пустая группа" in resp.text
+    assert "0" in resp.text
+
+
+@pytest.mark.asyncio
+async def test_catalog_groups_unknown_store_redirects(client, active_user):
+    await _login(client, active_user)
+    resp = await client.get("/catalog/stores/no-such-store/groups", follow_redirects=False)
+    assert resp.status_code == 303
+
+
+# ── GET /catalog/stores/{id}/products ────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_catalog_products_shows_all(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_group(override_db, active_user.id, "s1", "g1")
+    _make_product(override_db, active_user.id, "s1", "g1", "p1", "Пуэр")
+    _make_product(override_db, active_user.id, "s1", "g1", "p2", "Улун")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores/s1/products")
+    assert resp.status_code == 200
+    assert "Пуэр" in resp.text
+    assert "Улун" in resp.text
+
+
+@pytest.mark.asyncio
+async def test_catalog_products_filtered_by_group(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_group(override_db, active_user.id, "s1", "g1", "Группа А")
+    _make_group(override_db, active_user.id, "s1", "g2", "Группа Б")
+    _make_product(override_db, active_user.id, "s1", "g1", "p1", "Товар А")
+    _make_product(override_db, active_user.id, "s1", "g2", "p2", "Товар Б")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores/s1/products?group=g1")
+    assert resp.status_code == 200
+    assert "Товар А" in resp.text
+    assert "Товар Б" not in resp.text
+
+
+@pytest.mark.asyncio
+async def test_catalog_products_shows_group_column(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_group(override_db, active_user.id, "s1", "g1", "МояГруппа")
+    _make_product(override_db, active_user.id, "s1", "g1", "p1", "Товар")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores/s1/products")
+    assert "МояГруппа" in resp.text
+
+
+@pytest.mark.asyncio
+async def test_catalog_products_ungrouped_shown(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_product(override_db, active_user.id, "s1", None, "p1", "Без группы")
+    override_db.commit()
+
+    resp = await client.get("/catalog/stores/s1/products")
+    assert "Без группы" in resp.text
+
+
+# ── POST /catalog/stores/{id}/toggle ─────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_store_toggle_first_disable_seeds_others(client, active_user, override_db):
+    """First toggle on a store disables it by seeding include-filters for all other stores."""
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1", "Магазин 1")
+    _make_store(override_db, active_user.id, "s2", "Магазин 2")
+    _make_store(override_db, active_user.id, "s3", "Магазин 3")
+    override_db.commit()
+
+    resp = await client.post("/catalog/stores/s1/toggle", follow_redirects=False)
+    assert resp.status_code == 303
+
+    cfg = override_db.query(SyncConfig).filter_by(user_id=active_user.id).first()
+    filters = override_db.query(SyncFilter).filter_by(
+        sync_config_id=cfg.id, entity_type="store", filter_mode="include"
+    ).all()
+    ids = {f.entity_id for f in filters}
+    # s1 was toggled off → only s2 and s3 are in include list
+    assert "s1" not in ids
+    assert "s2" in ids
+    assert "s3" in ids
+
+
+@pytest.mark.asyncio
+async def test_store_toggle_re_enable(client, active_user, override_db):
+    """Toggling a disabled store re-adds it to the include list."""
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_store(override_db, active_user.id, "s2")
+    override_db.commit()
+
+    # Disable s1 first
+    await client.post("/catalog/stores/s1/toggle")
+    # Now re-enable s1
+    await client.post("/catalog/stores/s1/toggle")
+
+    cfg = override_db.query(SyncConfig).filter_by(user_id=active_user.id).first()
+    filters = override_db.query(SyncFilter).filter_by(
+        sync_config_id=cfg.id, entity_type="store", filter_mode="include"
+    ).all()
+    ids = {f.entity_id for f in filters}
+    assert "s1" in ids
+
+
+@pytest.mark.asyncio
+async def test_store_toggle_requires_login(client):
+    resp = await client.post("/catalog/stores/s1/toggle", follow_redirects=False)
+    assert resp.status_code == 303
+    assert "/login" in resp.headers["location"]
+
+
+# ── POST /catalog/stores/{id}/groups/{gid}/toggle ────────────────────────────
+
+@pytest.mark.asyncio
+async def test_group_toggle_first_disable(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_group(override_db, active_user.id, "s1", "g1", "Группа 1")
+    _make_group(override_db, active_user.id, "s1", "g2", "Группа 2")
+    override_db.commit()
+
+    resp = await client.post("/catalog/stores/s1/groups/g1/toggle", follow_redirects=False)
+    assert resp.status_code == 303
+
+    cfg = override_db.query(SyncConfig).filter_by(user_id=active_user.id).first()
+    filters = override_db.query(SyncFilter).filter_by(
+        sync_config_id=cfg.id, entity_type="group", filter_mode="include",
+        parent_entity_id="s1",
+    ).all()
+    ids = {f.entity_id for f in filters}
+    assert "g1" not in ids
+    assert "g2" in ids
+
+
+@pytest.mark.asyncio
+async def test_group_toggle_re_enable(client, active_user, override_db):
+    await _login(client, active_user)
+    _make_store(override_db, active_user.id, "s1")
+    _make_group(override_db, active_user.id, "s1", "g1")
+    _make_group(override_db, active_user.id, "s1", "g2")
+    override_db.commit()
+
+    await client.post("/catalog/stores/s1/groups/g1/toggle")
+    await client.post("/catalog/stores/s1/groups/g1/toggle")
+
+    cfg = override_db.query(SyncConfig).filter_by(user_id=active_user.id).first()
+    filters = override_db.query(SyncFilter).filter_by(
+        sync_config_id=cfg.id, entity_type="group", parent_entity_id="s1"
+    ).all()
+    ids = {f.entity_id for f in filters}
+    assert "g1" in ids

tests/test_routes_connections.py

@@ -0,0 +1,352 @@
+"""Integration tests for /connections routes."""
+import secrets
+from datetime import datetime
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from web.models.connections import EvotorConnection, VkConnection
+
+
+def _login(client, user):
+    client.cookies.clear()
+    return client.post("/login", data={"email": user.email, "password": "testpass123"},
+                       follow_redirects=False)
+
+
+# ── auth guard ────────────────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_connections_requires_login(client):
+    resp = await client.get("/connections", follow_redirects=False)
+    assert resp.status_code == 303
+    assert "/login" in resp.headers["location"]
+
+
+# ── GET /connections ──────────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_connections_get_no_connections(client, active_user):
+    await _login(client, active_user)
+    resp = await client.get("/connections")
+    assert resp.status_code == 200
+    assert "Эвотор" in resp.text
+    assert "ВКонтакте" in resp.text
+    assert "Не подключено" in resp.text
+
+
+@pytest.mark.asyncio
+async def test_connections_get_shows_connected(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = EvotorConnection(
+        user_id=active_user.id,
+        evotor_user_id="evo-123",
+        access_token="tok-abc",
+        api_token="api-tok",
+        connected_at=datetime.utcnow(),
+        updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    resp = await client.get("/connections")
+    assert resp.status_code == 200
+    assert "Подключено" in resp.text
+    assert "tok-abc"[:8] in resp.text
+
+
+# ── POST /connections/evotor ──────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_connections_evotor_post_creates(client, active_user, override_db):
+    await _login(client, active_user)
+    resp = await client.post("/connections/evotor", data={
+        "access_token": "new-evotor-token",
+        "evotor_user_id": "",
+    }, follow_redirects=False)
+    assert resp.status_code == 303
+    assert "success=1" in resp.headers["location"]
+
+    conn = override_db.query(EvotorConnection).filter_by(user_id=active_user.id).first()
+    assert conn is not None
+    assert conn.access_token == "new-evotor-token"
+    assert conn.api_token is not None
+
+
+@pytest.mark.asyncio
+async def test_connections_evotor_post_updates(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = EvotorConnection(
+        user_id=active_user.id, evotor_user_id="evo-upd",
+        access_token="old-token", api_token="api",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    await client.post("/connections/evotor", data={"access_token": "updated-token"})
+    override_db.refresh(conn)
+    assert conn.access_token == "updated-token"
+
+
+@pytest.mark.asyncio
+async def test_connections_evotor_post_empty_token(client, active_user):
+    await _login(client, active_user)
+    resp = await client.post("/connections/evotor", data={"access_token": ""})
+    assert resp.status_code == 200
+    assert "обязателен" in resp.text.lower()
+
+
+# ── POST /connections/evotor/disconnect ───────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_connections_evotor_disconnect(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = EvotorConnection(
+        user_id=active_user.id, evotor_user_id="evo-del",
+        access_token="tok", api_token="api",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    resp = await client.post("/connections/evotor/disconnect", follow_redirects=False)
+    assert resp.status_code == 303
+    assert override_db.query(EvotorConnection).filter_by(user_id=active_user.id).first() is None
+
+
+# ── POST /connections/vk (manual token) ──────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_connections_vk_post_creates(client, active_user, override_db):
+    await _login(client, active_user)
+    resp = await client.post("/connections/vk", data={
+        "access_token": "vk1.a.testtoken",
+        "vk_group_id": "123456789",
+    }, follow_redirects=False)
+    assert resp.status_code == 303
+    assert "success=1" in resp.headers["location"]
+
+    conn = override_db.query(VkConnection).filter_by(user_id=active_user.id).first()
+    assert conn is not None
+    assert conn.access_token == "vk1.a.testtoken"
+    assert conn.vk_user_id == "123456789"
+
+
+@pytest.mark.asyncio
+async def test_connections_vk_post_empty_token(client, active_user):
+    await _login(client, active_user)
+    resp = await client.post("/connections/vk", data={"access_token": "", "vk_group_id": ""})
+    assert resp.status_code == 200
+    assert "обязателен" in resp.text.lower()
+
+
+# ── POST /connections/vk/disconnect ──────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_connections_vk_disconnect(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = VkConnection(
+        user_id=active_user.id, access_token="vk-tok",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    resp = await client.post("/connections/vk/disconnect", follow_redirects=False)
+    assert resp.status_code == 303
+    assert override_db.query(VkConnection).filter_by(user_id=active_user.id).first() is None
+
+
+# ── GET /vk-auth ──────────────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_vk_auth_redirects_to_vk(client, active_user, monkeypatch):
+    monkeypatch.setattr("web.routes.connections.settings.VK_CLIENT_ID", "53265827")
+    monkeypatch.setattr("web.routes.connections.settings.BASE_URL", "http://test")
+    await _login(client, active_user)
+    resp = await client.get("/vk-auth", follow_redirects=False)
+    assert resp.status_code == 302
+    assert "oauth.vk.com/authorize" in resp.headers["location"]
+    assert "client_id=53265827" in resp.headers["location"]
+    assert "response_type=token" in resp.headers["location"]
+
+
+@pytest.mark.asyncio
+async def test_vk_auth_no_client_id(client, active_user, monkeypatch):
+    monkeypatch.setattr("web.routes.connections.settings.VK_CLIENT_ID", "")
+    await _login(client, active_user)
+    resp = await client.get("/vk-auth", follow_redirects=False)
+    assert resp.status_code == 303
+    assert "error=vk_not_configured" in resp.headers["location"]
+
+
+# ── GET /vk-callback ──────────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_vk_callback_page_returns_html(client, active_user):
+    await _login(client, active_user)
+    resp = await client.get("/vk-callback")
+    assert resp.status_code == 200
+    assert "access_token" in resp.text
+    assert "fetch" in resp.text
+
+
+# ── POST /vk-callback/save ────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_vk_callback_save_valid(client, active_user, override_db):
+    await _login(client, active_user)
+    # Seed state into session via /vk-auth call
+    monkeypatch_state = "test-state-xyz"
+    # Manually set expected state in session by calling the save endpoint
+    # with a pre-seeded state — we bypass the session by mocking get_current_user
+    # Instead: call /vk-auth to seed the session state, then intercept
+    # Since we can't easily inspect session, test save with wrong state first
+    resp = await client.post("/vk-callback/save", json={
+        "access_token": "vk1.a.token",
+        "state": "wrong-state",
+        "user_id": "12345",
+        "expires_in": "86400",
+    })
+    assert resp.status_code == 200
+    data = resp.json()
+    assert data["ok"] is False
+    assert "state" in data["message"].lower()
+
+
+@pytest.mark.asyncio
+async def test_vk_callback_save_no_token(client, active_user):
+    await _login(client, active_user)
+    resp = await client.post("/vk-callback/save", json={
+        "access_token": "",
+        "state": "",
+    })
+    assert resp.status_code == 200
+    assert resp.json()["ok"] is False
+
+
+@pytest.mark.asyncio
+async def test_vk_callback_save_unauthenticated(client):
+    resp = await client.post("/vk-callback/save", json={
+        "access_token": "tok", "state": "s",
+    })
+    assert resp.status_code == 401
+
+
+# ── POST /connections/evotor/test ─────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_evotor_test_no_connection(client, active_user):
+    await _login(client, active_user)
+    resp = await client.post("/connections/evotor/test")
+    assert resp.status_code == 200
+    assert resp.json()["ok"] is False
+    assert "не настроено" in resp.json()["message"]
+
+
+@pytest.mark.asyncio
+async def test_evotor_test_success(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = EvotorConnection(
+        user_id=active_user.id, evotor_user_id="evo-t",
+        access_token="tok", api_token="api",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    mock_resp = MagicMock()
+    mock_resp.status_code = 200
+    mock_resp.json.return_value = {"items": [{"id": "s1"}, {"id": "s2"}]}
+
+    with patch("web.routes.connections.httpx.get", return_value=mock_resp):
+        resp = await client.post("/connections/evotor/test")
+    assert resp.status_code == 200
+    data = resp.json()
+    assert data["ok"] is True
+    assert "2" in data["message"]
+
+
+@pytest.mark.asyncio
+async def test_evotor_test_invalid_token(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = EvotorConnection(
+        user_id=active_user.id, evotor_user_id="evo-inv",
+        access_token="bad-tok", api_token="api",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    mock_resp = MagicMock()
+    mock_resp.status_code = 401
+
+    with patch("web.routes.connections.httpx.get", return_value=mock_resp):
+        resp = await client.post("/connections/evotor/test")
+    data = resp.json()
+    assert data["ok"] is False
+    assert "401" in data["message"]
+
+
+# ── POST /connections/vk/test ─────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_vk_test_no_group_id(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = VkConnection(
+        user_id=active_user.id, access_token="vk-tok",
+        vk_user_id=None,
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    resp = await client.post("/connections/vk/test")
+    assert resp.json()["ok"] is False
+    assert "сообщества" in resp.json()["message"].lower()
+
+
+@pytest.mark.asyncio
+async def test_vk_test_success(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = VkConnection(
+        user_id=active_user.id, access_token="vk-tok",
+        vk_user_id="229744980",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    mock_resp = MagicMock()
+    mock_resp.json.return_value = {"response": {"groups": [
+        {"name": "Тестовая чайная", "market": {"enabled": True}}
+    ]}}
+
+    with patch("web.routes.connections.httpx.get", return_value=mock_resp):
+        resp = await client.post("/connections/vk/test")
+    data = resp.json()
+    assert data["ok"] is True
+    assert "Тестовая чайная" in data["message"]
+    assert "включён" in data["message"]
+
+
+@pytest.mark.asyncio
+async def test_vk_test_api_error(client, active_user, override_db):
+    await _login(client, active_user)
+    conn = VkConnection(
+        user_id=active_user.id, access_token="vk-tok",
+        vk_user_id="229744980",
+        connected_at=datetime.utcnow(), updated_at=datetime.utcnow(),
+    )
+    override_db.add(conn)
+    override_db.commit()
+
+    mock_resp = MagicMock()
+    mock_resp.json.return_value = {"error": {"error_code": 5, "error_msg": "User authorization failed"}}
+
+    with patch("web.routes.connections.httpx.get", return_value=mock_resp):
+        resp = await client.post("/connections/vk/test")
+    data = resp.json()
+    assert data["ok"] is False
+    assert "5" in data["message"]

tests/test_tasks_catalog.py

@@ -0,0 +1,133 @@
+"""Unit tests for catalog task helpers and refresh_catalog logic."""
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from web.tasks.catalog import _fetch_groups, _fetch_products, _fetch_stores
+
+
+# ── _fetch_stores ─────────────────────────────────────────────────────────────
+
+def test_fetch_stores_list_response():
+    mock = MagicMock()
+    mock.raise_for_status = MagicMock()
+    mock.json.return_value = [{"id": "s1", "name": "Магазин"}]
+    with patch("web.tasks.catalog.httpx.get", return_value=mock):
+        result = _fetch_stores("tok")
+    assert result == [{"id": "s1", "name": "Магазин"}]
+
+
+def test_fetch_stores_dict_with_items():
+    mock = MagicMock()
+    mock.raise_for_status = MagicMock()
+    mock.json.return_value = {"items": [{"id": "s1"}], "total": 1}
+    with patch("web.tasks.catalog.httpx.get", return_value=mock):
+        result = _fetch_stores("tok")
+    assert result == [{"id": "s1"}]
+
+
+# ── _fetch_groups ─────────────────────────────────────────────────────────────
+
+def test_fetch_groups_success():
+    mock = MagicMock()
+    mock.status_code = 200
+    mock.raise_for_status = MagicMock()
+    mock.json.return_value = {"items": [{"id": "g1", "name": "Чай"}]}
+    with patch("web.tasks.catalog.httpx.get", return_value=mock):
+        result = _fetch_groups("tok", "s1")
+    assert result == [{"id": "g1", "name": "Чай"}]
+
+
+@pytest.mark.parametrize("status_code", [402, 403])
+def test_fetch_groups_returns_none_on_restricted(status_code):
+    mock = MagicMock()
+    mock.status_code = status_code
+    with patch("web.tasks.catalog.httpx.get", return_value=mock):
+        result = _fetch_groups("tok", "s1")
+    assert result is None
+
+
+# ── _fetch_products ───────────────────────────────────────────────────────────
+
+def test_fetch_products_success():
+    mock = MagicMock()
+    mock.status_code = 200
+    mock.raise_for_status = MagicMock()
+    mock.json.return_value = [{"id": "p1", "name": "Пуэр", "price": {"sum": 15000}}]
+    with patch("web.tasks.catalog.httpx.get", return_value=mock):
+        result = _fetch_products("tok", "s1")
+    assert len(result) == 1
+    assert result[0]["name"] == "Пуэр"
+
+
+@pytest.mark.parametrize("status_code", [402, 403])
+def test_fetch_products_returns_none_on_restricted(status_code):
+    mock = MagicMock()
+    mock.status_code = status_code
+    with patch("web.tasks.catalog.httpx.get", return_value=mock):
+        result = _fetch_products("tok", "s1")
+    assert result is None
+
+
+# ── refresh_catalog task (integration with mocked HTTP) ──────────────────────
+
+@pytest.mark.asyncio
+async def test_refresh_catalog_upserts_stores(override_db):
+    from web.database import SessionLocal
+    from web.models.connections import CachedStore, EvotorConnection
+    from web.tasks.catalog import _sync_user
+
+    user_id = 1
+    token = "test-tok"
+
+    stores_data = [{"id": "s-new", "name": "Новый магазин", "address": "ул. Ленина 1"}]
+    groups_data = []
+    products_data = []
+
+    with patch("web.tasks.catalog._fetch_stores", return_value=stores_data), \
+         patch("web.tasks.catalog._fetch_groups", return_value=groups_data), \
+         patch("web.tasks.catalog._fetch_products", return_value=products_data):
+        _sync_user(override_db, user_id, token)
+
+    store = override_db.query(CachedStore).filter_by(user_id=user_id, evotor_id="s-new").first()
+    assert store is not None
+    assert store.name == "Новый магазин"
+
+
+@pytest.mark.asyncio
+async def test_refresh_catalog_upserts_products(override_db):
+    from web.models.connections import CachedProduct
+    from web.tasks.catalog import _sync_user
+
+    user_id = 2
+    token = "tok"
+
+    stores_data = [{"id": "s1", "name": "Магазин"}]
+    groups_data = [{"id": "g1", "name": "Чай"}]
+    products_data = [{
+        "id": "p1", "name": "Пуэр", "price": 35000,
+        "quantity": 10, "measureName": "шт", "code": "001",
+        "allowToSell": True, "group": "g1",
+    }]
+
+    with patch("web.tasks.catalog._fetch_stores", return_value=stores_data), \
+         patch("web.tasks.catalog._fetch_groups", return_value=groups_data), \
+         patch("web.tasks.catalog._fetch_products", return_value=products_data):
+        _sync_user(override_db, user_id, token)
+
+    p = override_db.query(CachedProduct).filter_by(user_id=user_id, evotor_id="p1").first()
+    assert p is not None
+    assert p.name == "Пуэр"
+    assert p.group_evotor_id == "g1"
+    assert p.allow_to_sell is True
+
+
+@pytest.mark.asyncio
+async def test_refresh_catalog_skips_fetch_stores_failure(override_db):
+    from web.models.connections import CachedStore
+    from web.tasks.catalog import _sync_user
+
+    with patch("web.tasks.catalog._fetch_stores", side_effect=Exception("network error")):
+        _sync_user(override_db, user_id=99, token="tok")
+
+    assert override_db.query(CachedStore).filter_by(user_id=99).count() == 0

tests/test_tasks_vk_sync.py

@@ -0,0 +1,169 @@
+"""Unit tests for vk_sync task logic (price calc, name sanitization, orphan deletion)."""
+from datetime import datetime
+from decimal import Decimal
+from unittest.mock import MagicMock, call, patch
+
+import pytest
+
+from web.tasks.vk_sync import (
+    _build_description,
+    _calc_price,
+    _delete_orphans,
+    _is_weight,
+    _name_for_vk,
+)
+
+
+# ── _is_weight ────────────────────────────────────────────────────────────────
+
+@pytest.mark.parametrize("measure,expected", [
+    ("г", True),
+    ("г.", True),
+    ("гр", True),
+    ("гр.", True),
+    ("грамм", True),
+    ("граммов", True),
+    ("  Г  ", True),   # case-insensitive, stripped
+    ("кг", False),
+    ("шт", False),
+    ("л", False),
+    (None, False),
+    ("", False),
+])
+def test_is_weight(measure, expected):
+    assert _is_weight(measure) == expected
+
+
+# ── _calc_price ───────────────────────────────────────────────────────────────
+
+def test_calc_price_normal(monkeypatch):
+    monkeypatch.setattr("web.tasks.vk_sync.settings.VK_WEIGHT_PRICE_MULTIPLIER", 10)
+    assert _calc_price(Decimal("150"), "шт") == 15000  # 150 руб * 100 копеек
+
+
+def test_calc_price_weight_multiplier(monkeypatch):
+    monkeypatch.setattr("web.tasks.vk_sync.settings.VK_WEIGHT_PRICE_MULTIPLIER", 10)
+    # 50 руб/г → 50 * 10 (multiplier) * 100 (kopecks) = 50000
+    assert _calc_price(Decimal("50"), "г") == 50000
+
+
+def test_calc_price_none():
+    assert _calc_price(None, "шт") == 0
+
+
+def test_calc_price_zero():
+    assert _calc_price(Decimal("0"), "шт") == 0
+
+
+# ── _name_for_vk ──────────────────────────────────────────────────────────────
+
+def test_name_replaces_semicolons():
+    assert _name_for_vk("Чай; зелёный; Китай") == "Чай, зелёный, Китай"
+
+
+def test_name_no_semicolons():
+    assert _name_for_vk("Пуэр (выдержанный)") == "Пуэр (выдержанный)"
+
+
+# ── _build_description ────────────────────────────────────────────────────────
+
+def test_build_description_weight(monkeypatch):
+    monkeypatch.setattr("web.tasks.vk_sync.settings.VK_WEIGHT_PRICE_MULTIPLIER", 10)
+    desc = _build_description("Чай", "г", None)
+    assert "10г" in desc
+    assert "Чай" in desc
+
+
+def test_build_description_with_evo_desc(monkeypatch):
+    monkeypatch.setattr("web.tasks.vk_sync.settings.VK_WEIGHT_PRICE_MULTIPLIER", 10)
+    desc = _build_description("Чай", "шт", "Вкусный чай из Китая")
+    assert "Вкусный чай из Китая" in desc
+
+
+def test_build_description_no_evo_desc(monkeypatch):
+    monkeypatch.setattr("web.tasks.vk_sync.settings.VK_WEIGHT_PRICE_MULTIPLIER", 10)
+    desc = _build_description("Чай", "шт", None)
+    assert "Чай" in desc
+
+
+# ── _delete_orphans ───────────────────────────────────────────────────────────
+
+def test_delete_orphans_removes_stale_vk_products():
+    from web.models.connections import VkCachedProduct, CachedProduct
+
+    # Build fake VK cached products
+    vk1 = MagicMock(spec=VkCachedProduct)
+    vk1.vk_product_id = "111"
+    vk1.name = "Существующий"
+
+    vk2 = MagicMock(spec=VkCachedProduct)
+    vk2.vk_product_id = "222"
+    vk2.name = "Удалённый из Эвотор"
+
+    db = MagicMock()
+    # owned_ids contains only "111" — "222" is orphan
+    owned_ids = {"111"}
+
+    # query().filter_by().filter().all() chain
+    query_mock = MagicMock()
+    query_mock.filter_by.return_value.filter.return_value.all.return_value = [vk2]
+    # second query for stale cached_products
+    query_mock.filter.return_value.all.return_value = []
+    db.query.return_value = query_mock
+
+    results = {"deleted": 0, "errors": 0}
+    mock_post_resp = {"response": 1}
+
+    with patch("web.tasks.vk_sync._vk_post", return_value=mock_post_resp):
+        _delete_orphans(db, user_id=1, vk_group_id="99", owned_ids=owned_ids,
+                        token="tok", results=results)
+
+    assert results["deleted"] == 1
+    db.delete.assert_called_once_with(vk2)
+
+
+def test_delete_orphans_vk_api_error_counted():
+    from web.models.connections import VkCachedProduct
+
+    vk1 = MagicMock(spec=VkCachedProduct)
+    vk1.vk_product_id = "999"
+    vk1.name = "Сломанный"
+
+    db = MagicMock()
+    query_mock = MagicMock()
+    query_mock.filter_by.return_value.filter.return_value.all.return_value = [vk1]
+    query_mock.filter.return_value.all.return_value = []
+    db.query.return_value = query_mock
+
+    results = {"deleted": 0, "errors": 0}
+
+    with patch("web.tasks.vk_sync._vk_post", return_value={"error": {"error_code": 15}}):
+        _delete_orphans(db, user_id=1, vk_group_id="99", owned_ids={"other"},
+                        token="tok", results=results)
+
+    assert results["deleted"] == 0
+    assert results["errors"] == 1
+
+
+def test_delete_orphans_empty_owned_ids_deletes_all():
+    """If no Evotor products exist (owned_ids empty), all VK products are orphans."""
+    from web.models.connections import VkCachedProduct
+
+    vk1 = MagicMock(spec=VkCachedProduct)
+    vk1.vk_product_id = "1"
+    vk1.name = "Лишний"
+
+    db = MagicMock()
+    query_mock = MagicMock()
+    # With empty owned_ids, query without .filter() is used
+    query_mock.filter_by.return_value.all.return_value = [vk1]
+    query_mock.filter.return_value.all.return_value = []
+    db.query.return_value = query_mock
+
+    results = {"deleted": 0, "errors": 0}
+
+    with patch("web.tasks.vk_sync._vk_post", return_value={"response": 1}):
+        _delete_orphans(db, user_id=1, vk_group_id="99", owned_ids=set(),
+                        token="tok", results=results)
+
+    assert results["deleted"] == 1

web/auth/session.py

@@ -3,7 +3,7 @@ from fastapi.responses import RedirectResponse
 from sqlalchemy.orm import Session
 from starlette.requests import Request
 
-from web.models.user import User, UserStatusEnum
+from web.models.user import User, UserRoleEnum, UserStatusEnum
 
 
 def get_session_user_id(request: Request) -> int | None:
@@ -21,5 +21,22 @@ def get_current_user(request: Request, db: Session) -> User:
     return user
 
 
+def get_viewed_user(request: Request, db: Session) -> tuple[User, User]:
+    """Return (real_user, viewed_user).
+
+    Admins/system users can view another user's data by having
+    `viewed_user_id` set in the session (via /admin/users/{id}/view-as).
+    For regular users, both values are the same.
+    """
+    real_user = get_current_user(request, db)
+    is_admin = real_user.role in (UserRoleEnum.admin, UserRoleEnum.system)
+    viewed_id = request.session.get("viewed_user_id") if is_admin else None
+    if viewed_id:
+        viewed = db.get(User, viewed_id)
+        if viewed:
+            return real_user, viewed
+    return real_user, real_user
+
+
 def login_redirect() -> RedirectResponse:
     return RedirectResponse("/login", status_code=303)

web/config.py

@@ -11,9 +11,14 @@ class Settings(BaseSettings):
     EVOTOR_APP_ID: str = ""
     EVOTOR_WEBHOOK_SECRET: str = ""
 
+    VK_CLIENT_ID: str = ""
+    VK_CLIENT_SECRET: str = ""
+
     JIVOSITE_WIDGET_ID: str = ""
     VK_DEFAULT_PHOTO_PATH: str = "/app/default_product.png"
     VK_API_VERSION: str = "5.199"
+    VK_CATEGORY_ID: int = 40932
+    VK_STOCK_AMOUNT: int = 1000
 
     CATALOG_REFRESH_INTERVAL_SECONDS: int = 3600
     INVITE_EXPIRE_HOURS: int = 48

web/lib/api_logger.py

@@ -0,0 +1,82 @@
+"""Thin wrapper around httpx that logs every outbound API call to api_logs."""
+import json
+import time
+import urllib.parse
+from typing import Any
+
+import httpx
+
+from web.database import SessionLocal
+from web.models.connections import ApiLog
+
+_MAX_BODY = 8000  # truncate stored bodies beyond this
+
+
+def _service_from_url(url: str) -> str:
+    host = urllib.parse.urlparse(url).netloc
+    if "evotor" in host:
+        return "evotor"
+    if "vk.com" in host:
+        return "vk"
+    return "other"
+
+
+def _truncate(text: str | None) -> str | None:
+    if text and len(text) > _MAX_BODY:
+        return text[:_MAX_BODY] + "…"
+    return text
+
+
+def _record(
+    user_id: int | None,
+    method: str,
+    url: str,
+    request_body: str | None,
+    response_status: int | None,
+    response_body: str | None,
+    duration_ms: int,
+) -> None:
+    try:
+        db = SessionLocal()
+        db.add(ApiLog(
+            user_id=user_id,
+            service=_service_from_url(url),
+            method=method.upper(),
+            url=url,
+            request_body=_truncate(request_body),
+            response_status=response_status,
+            response_body=_truncate(response_body),
+            duration_ms=duration_ms,
+        ))
+        db.commit()
+        db.close()
+    except Exception:
+        pass  # never let logging crash the caller
+
+
+def get(url: str, *, user_id: int | None = None, **kwargs) -> httpx.Response:
+    t0 = time.monotonic()
+    resp = httpx.get(url, **kwargs)
+    ms = int((time.monotonic() - t0) * 1000)
+    try:
+        body = resp.text
+    except Exception:
+        body = None
+    _record(user_id, "GET", url, None, resp.status_code, body, ms)
+    return resp
+
+
+def post(url: str, *, user_id: int | None = None, data: Any = None, json: Any = None, **kwargs) -> httpx.Response:
+    t0 = time.monotonic()
+    resp = httpx.post(url, data=data, json=json, **kwargs)
+    ms = int((time.monotonic() - t0) * 1000)
+    try:
+        req_body = resp.request.content.decode("utf-8", errors="replace") if resp.request.content else None
+    except Exception:
+        req_body = None
+    try:
+        body = resp.text
+    except Exception:
+        body = None
+    _record(user_id, "POST", url, req_body, resp.status_code, body, ms)
+    return resp

web/main.py

@@ -1,6 +1,6 @@
 import logging
 
-from fastapi import FastAPI, Request
+from fastapi import Depends, FastAPI, Request
 from fastapi.responses import HTMLResponse
 from fastapi.staticfiles import StaticFiles
 from starlette.middleware.sessions import SessionMiddleware
@@ -38,6 +38,10 @@ from web.routes.admin import router as admin_router  # noqa: E402
 from web.routes.catalog import router as catalog_router  # noqa: E402
 from web.routes.connections import router as connections_router  # noqa: E402
 from web.routes.vk_catalog import router as vk_catalog_router  # noqa: E402
+from web.routes.logs import router as logs_router  # noqa: E402
+from web.routes.sync import router as sync_router  # noqa: E402
+from web.database import get_db  # noqa: E402
+from web.models.user import User  # noqa: E402
 
 app.include_router(auth_router)
 app.include_router(reset_router)
@@ -48,6 +52,8 @@ app.include_router(admin_router)
 app.include_router(catalog_router)
 app.include_router(connections_router)
 app.include_router(vk_catalog_router)
+app.include_router(logs_router)
+app.include_router(sync_router)
 
 
 # ── Catalog redirect ─────────────────────────────────────────────────────────
@@ -65,10 +71,14 @@ async def health():
 
 # ── Root redirect ─────────────────────────────────────────────────────────────
 @app.get("/")
-async def root(request: Request):
+async def root(request: Request, db=Depends(get_db)):
     from fastapi.responses import RedirectResponse
+    from web.models.user import UserRoleEnum
     user_id = request.session.get("user_id")
     if user_id:
+        user = db.get(User, user_id)
+        if user and user.role in (UserRoleEnum.admin, UserRoleEnum.system):
+            return RedirectResponse("/admin/users", 303)
         return RedirectResponse("/profile", 303)
     return RedirectResponse("/login", 303)
 

web/migrations/versions/0005_cached_products_vk_product_id.py

@@ -0,0 +1,24 @@
+"""Add vk_product_id to cached_products
+
+Revision ID: 0005
+Revises: 0004
+Create Date: 2026-05-01
+
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0005"
+down_revision: Union[str, None] = "0004"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("cached_products", sa.Column("vk_product_id", sa.String(50), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("cached_products", "vk_product_id")

web/migrations/versions/0006_vk_connection_token_fields.py

@@ -0,0 +1,26 @@
+"""Add refresh_token and token_expires_at to vk_connections
+
+Revision ID: 0006
+Revises: 0005
+Create Date: 2026-05-12
+
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0006"
+down_revision: Union[str, None] = "0005"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("vk_connections", sa.Column("refresh_token", sa.Text, nullable=True))
+    op.add_column("vk_connections", sa.Column("token_expires_at", sa.DateTime, nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("vk_connections", "token_expires_at")
+    op.drop_column("vk_connections", "refresh_token")

web/migrations/versions/0007_api_logs.py

@@ -0,0 +1,32 @@
+"""Add api_logs table for request/response logging."""
+revision = "0007"
+down_revision = "0006"
+branch_labels = None
+depends_on = None
+
+import sqlalchemy as sa
+from alembic import op
+
+
+def upgrade():
+    op.create_table(
+        "api_logs",
+        sa.Column("id", sa.Integer, primary_key=True, autoincrement=True),
+        sa.Column("user_id", sa.Integer, sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("service", sa.String(20), nullable=False),
+        sa.Column("method", sa.String(10), nullable=False),
+        sa.Column("url", sa.String(1024), nullable=False),
+        sa.Column("request_body", sa.Text, nullable=True),
+        sa.Column("response_status", sa.Integer, nullable=True),
+        sa.Column("response_body", sa.Text, nullable=True),
+        sa.Column("duration_ms", sa.Integer, nullable=True),
+        sa.Column("created_at", sa.DateTime, nullable=False, server_default=sa.func.now()),
+    )
+    op.create_index("ix_api_logs_user_service", "api_logs", ["user_id", "service"])
+    op.create_index("ix_api_logs_created_at", "api_logs", ["created_at"])
+
+
+def downgrade():
+    op.drop_index("ix_api_logs_created_at", "api_logs")
+    op.drop_index("ix_api_logs_user_service", "api_logs")
+    op.drop_table("api_logs")

web/migrations/versions/0008_sync_config_price_postfix.py

@@ -0,0 +1,16 @@
+"""Add price_multiplier to sync_configs."""
+revision = "0008"
+down_revision = "0007"
+branch_labels = None
+depends_on = None
+
+import sqlalchemy as sa
+from alembic import op
+
+
+def upgrade():
+    op.add_column("sync_configs", sa.Column("price_multiplier", sa.Numeric(10, 4), nullable=False, server_default="1.0"))
+
+
+def downgrade():
+    op.drop_column("sync_configs", "price_multiplier")

web/migrations/versions/0009_sync_config_task_flags.py

@@ -0,0 +1,18 @@
+"""Add evo_mirror_enabled and vk_mirror_enabled to sync_configs."""
+revision = "0009"
+down_revision = "0008"
+branch_labels = None
+depends_on = None
+
+import sqlalchemy as sa
+from alembic import op
+
+
+def upgrade():
+    op.add_column("sync_configs", sa.Column("evo_mirror_enabled", sa.Boolean, nullable=False, server_default="0"))
+    op.add_column("sync_configs", sa.Column("vk_mirror_enabled", sa.Boolean, nullable=False, server_default="0"))
+
+
+def downgrade():
+    op.drop_column("sync_configs", "vk_mirror_enabled")
+    op.drop_column("sync_configs", "evo_mirror_enabled")

web/migrations/versions/0010_users_phone_nullable.py

@@ -0,0 +1,17 @@
+"""Make users.phone nullable."""
+revision = "0010"
+down_revision = "0009"
+branch_labels = None
+depends_on = None
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+    op.alter_column("users", "phone", existing_type=sa.String(20), nullable=True)
+
+
+def downgrade():
+    op.execute("UPDATE users SET phone = '' WHERE phone IS NULL")
+    op.alter_column("users", "phone", existing_type=sa.String(20), nullable=False)

web/migrations/versions/0011_sync_config_filter_seeded_flags.py

@@ -0,0 +1,36 @@
+"""Add store_filters_seeded and group_filters_seeded to sync_configs."""
+revision = "0011"
+down_revision = "0010"
+branch_labels = None
+depends_on = None
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+    op.add_column("sync_configs", sa.Column("store_filters_seeded", sa.Boolean(), nullable=False, server_default="0"))
+    op.add_column("sync_configs", sa.Column("group_filters_seeded", sa.Boolean(), nullable=False, server_default="0"))
+
+    # Mark existing rows as seeded if they already have filters
+    op.execute("""
+        UPDATE sync_configs sc
+        SET store_filters_seeded = 1
+        WHERE EXISTS (
+            SELECT 1 FROM sync_filters sf
+            WHERE sf.sync_config_id = sc.id AND sf.entity_type = 'store'
+        )
+    """)
+    op.execute("""
+        UPDATE sync_configs sc
+        SET group_filters_seeded = 1
+        WHERE EXISTS (
+            SELECT 1 FROM sync_filters sf
+            WHERE sf.sync_config_id = sc.id AND sf.entity_type = 'group'
+        )
+    """)
+
+
+def downgrade():
+    op.drop_column("sync_configs", "group_filters_seeded")
+    op.drop_column("sync_configs", "store_filters_seeded")

web/models/connections.py

@@ -3,6 +3,7 @@ from sqlalchemy import (
     Numeric, String, Text, UniqueConstraint, func,
 )
 
+
 from web.database import Base
 
 
@@ -35,6 +36,8 @@ class VkConnection(Base):
     id = Column(Integer, primary_key=True, autoincrement=True)
     user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
     access_token = Column(Text, nullable=False)
+    refresh_token = Column(Text, nullable=True)
+    token_expires_at = Column(DateTime, nullable=True)
     vk_user_id = Column(String(50), nullable=True)
     first_name = Column(String(255), nullable=True)
     last_name = Column(String(255), nullable=True)
@@ -54,7 +57,12 @@ class SyncConfig(Base):
     id = Column(Integer, primary_key=True, autoincrement=True)
     user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
     is_enabled = Column(Boolean, nullable=False, default=False)
+    evo_mirror_enabled = Column(Boolean, nullable=False, default=False)
+    vk_mirror_enabled = Column(Boolean, nullable=False, default=False)
+    store_filters_seeded = Column(Boolean, nullable=False, default=False)
+    group_filters_seeded = Column(Boolean, nullable=False, default=False)
     confirmed_at = Column(DateTime, nullable=True)
+    price_multiplier = Column(Numeric(10, 4), nullable=False, default=1.0)
     created_at = Column(DateTime, nullable=False, server_default=func.now())
     updated_at = Column(DateTime, nullable=False, server_default=func.now(), onupdate=func.now())
 
@@ -167,8 +175,29 @@ class CachedProduct(Base):
     allow_to_sell = Column(Boolean, nullable=True)
     fetched_at = Column(DateTime, nullable=False)
     synced_at = Column(DateTime, nullable=True)
+    vk_product_id = Column(String(50), nullable=True)  # VK market item ID after first push
 
     __table_args__ = (
         UniqueConstraint("user_id", "evotor_id", name="uq_cached_products_user_evotor"),
         Index("ix_cached_products_user_store_group", "user_id", "store_evotor_id", "group_evotor_id"),
     )
+
+
+class ApiLog(Base):
+    __tablename__ = "api_logs"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    service = Column(String(20), nullable=False)   # "evotor" | "vk"
+    method = Column(String(10), nullable=False)    # "GET" | "POST"
+    url = Column(String(1024), nullable=False)
+    request_body = Column(Text, nullable=True)
+    response_status = Column(Integer, nullable=True)
+    response_body = Column(Text, nullable=True)
+    duration_ms = Column(Integer, nullable=True)
+    created_at = Column(DateTime, nullable=False, server_default=func.now())
+
+    __table_args__ = (
+        Index("ix_api_logs_user_service", "user_id", "service"),
+        Index("ix_api_logs_created_at", "created_at"),
+    )

web/models/user.py

@@ -24,7 +24,7 @@ class User(Base):
     first_name = Column(String(100), nullable=False)
     last_name = Column(String(100), nullable=False)
     email = Column(String(255), nullable=False)
-    phone = Column(String(20), nullable=False)
+    phone = Column(String(20), nullable=True)
     password_hash = Column(String(255), nullable=True)
     is_email_confirmed = Column(Boolean, nullable=False, default=False)
     email_confirm_token = Column(String(255), nullable=True)

web/routes/admin.py

@@ -101,6 +101,105 @@ async def admin_user_detail(user_id: int, request: Request, db: Session = Depend
     return _render(request, "admin/user_detail.html", {"user": admin, "target": target})
 
 
+# ── Create user ───────────────────────────────────────────────────────────────
+
+@router.post("/users/create")
+async def admin_create_user(request: Request, db: Session = Depends(get_db)):
+    try:
+        admin = _admin_user(request, db)
+    except Exception:
+        return RedirectResponse("/login", 303)
+
+    form = await request.form()
+    first_name = str(form.get("first_name", "")).strip()
+    last_name = str(form.get("last_name", "")).strip()
+    email = str(form.get("email", "")).strip().lower()
+    phone = str(form.get("phone", "")).strip() or None
+    password = str(form.get("password", ""))
+    role_str = str(form.get("role", "user"))
+
+    errors = []
+    if not first_name:
+        errors.append("Имя обязательно")
+    if not email:
+        errors.append("Email обязателен")
+    if not password or len(password) < 8:
+        errors.append("Пароль должен содержать минимум 8 символов")
+    if role_str not in ("user", "admin") and admin.role != UserRoleEnum.system:
+        role_str = "user"
+
+    if not errors:
+        existing = db.query(User).filter(User.email == email).first()
+        if existing:
+            errors.append("Пользователь с таким email уже существует")
+
+    if errors:
+        q = db.query(User)
+        total = q.count()
+        users = q.order_by(User.created_at.desc()).limit(PAGE_SIZE).all()
+        return _render(request, "admin/users.html", {
+            "user": admin,
+            "users": users,
+            "search": "",
+            "status_filter": "",
+            "role_filter": "",
+            "page": 1,
+            "total_pages": max(1, (total + PAGE_SIZE - 1) // PAGE_SIZE),
+            "total": total,
+            "create_errors": errors,
+            "create_form": {
+                "first_name": first_name,
+                "last_name": last_name,
+                "email": email,
+                "phone": phone or "",
+                "role": role_str,
+            },
+        })
+
+    try:
+        role = UserRoleEnum(role_str)
+    except ValueError:
+        role = UserRoleEnum.user
+
+    new_user = User(
+        first_name=first_name,
+        last_name=last_name,
+        email=email,
+        phone=phone,
+        password_hash=hash_password(password),
+        role=role,
+        status=UserStatusEnum.active,
+        is_email_confirmed=True,
+    )
+    db.add(new_user)
+    db.commit()
+    return RedirectResponse(f"/admin/users/{new_user.id}?success=saved", 303)
+
+
+# ── View-as ───────────────────────────────────────────────────────────────────
+
+@router.post("/users/{user_id}/view-as")
+async def admin_view_as(user_id: int, request: Request, db: Session = Depends(get_db)):
+    try:
+        _admin_user(request, db)
+    except Exception:
+        return RedirectResponse("/login", 303)
+    target = db.get(User, user_id)
+    if target:
+        request.session["viewed_user_id"] = user_id
+    return RedirectResponse("/connections", 303)
+
+
+@router.post("/view-as/stop")
+async def admin_view_as_stop(request: Request, db: Session = Depends(get_db)):
+    try:
+        _admin_user(request, db)
+    except Exception:
+        return RedirectResponse("/login", 303)
+    request.session.pop("viewed_user_id", None)
+    return RedirectResponse("/admin/users", 303)
+
+
 # ── User actions ──────────────────────────────────────────────────────────────
 
 @router.post("/users/{user_id}/activate")

web/routes/auth.py

@@ -1,11 +1,10 @@
 import secrets
 
 from fastapi import APIRouter, Depends, Request
-from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.responses import HTMLResponse, RedirectResponse, Response
-from sqlalchemy import or_
 from sqlalchemy.orm import Session
 
-from web.auth.password import hash_password, verify_password
+from web.auth.password import verify_password
 from web.auth.session import get_session_user_id
 from web.config import settings
 from web.database import get_db
@@ -23,60 +22,13 @@ def _render(request: Request, template: str, ctx: dict) -> HTMLResponse:
 
 
 @router.get("/register")
-async def register_get(request: Request, db: Session = Depends(get_db)):
+async def register_get(request: Request):
-    if get_session_user_id(request):
+    return Response(status_code=404)
-        return RedirectResponse("/profile", 303)
-    return _render(request, "register.html", {"user": None})
 
 
 @router.post("/register")
-async def register_post(request: Request, db: Session = Depends(get_db)):
+async def register_post(request: Request):
-    form = await request.form()
+    return Response(status_code=404)
-    data = {k: str(v).strip() for k, v in form.items()}
-    errors = []
-
-    if not data.get("email"):
-        errors.append("Email обязателен")
-    if not data.get("phone"):
-        errors.append("Телефон обязателен")
-    if not data.get("password"):
-        errors.append("Пароль обязателен")
-    if len(data.get("password", "")) < 8:
-        errors.append("Пароль должен содержать минимум 8 символов")
-    if data.get("password") != data.get("password_confirm"):
-        errors.append("Пароли не совпадают")
-
-    if not errors:
-        existing = db.query(User).filter(
-            or_(User.email == data["email"], User.phone == data["phone"])
-        ).first()
-        if existing:
-            if existing.email == data["email"]:
-                errors.append("Пользователь с таким email уже существует")
-            else:
-                errors.append("Пользователь с таким телефоном уже существует")
-
-    if errors:
-        return _render(request, "register.html", {"user": None, "errors": errors, "form": data})
-
-    token = secrets.token_urlsafe(32)
-    user = User(
-        first_name=data.get("first_name", ""),
-        last_name=data.get("last_name", ""),
-        email=data["email"],
-        phone=data["phone"],
-        password_hash=await _hash(data["password"]),
-        email_confirm_token=token,
-        status=UserStatusEnum.pending,
-    )
-    db.add(user)
-    db.commit()
-
-    confirm_url = f"{settings.BASE_URL}/confirm-email?token={token}"
-    html = f'<p>Подтвердите email: <a href="{confirm_url}">{confirm_url}</a></p>'
-    send_email_task.delay(user.email, "Подтвердите ваш email — ЭВОСИНК", html)
-
-    return _render(request, "confirm_email.html", {"user": None})
 
 
 @router.get("/confirm-email")
@@ -167,4 +119,5 @@ async def logout(request: Request):
 
 async def _hash(plain: str) -> str:
     import asyncio
+    from web.auth.password import hash_password
     return await asyncio.get_event_loop().run_in_executor(None, hash_password, plain)

web/routes/catalog.py

@@ -2,9 +2,10 @@ from datetime import datetime, timezone
 
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import HTMLResponse, RedirectResponse
+from sqlalchemy import func
 from sqlalchemy.orm import Session
 
-from web.auth.session import get_current_user
+from web.auth.session import get_current_user, get_viewed_user
 from web.config import settings
 from web.database import get_db
 from web.models.connections import CachedGroup, CachedProduct, CachedStore, SyncConfig, SyncFilter
@@ -23,29 +24,25 @@ def _get_or_create_sync_config(db: Session, user_id: int) -> SyncConfig:
 
 
 def _enabled_store_ids(db: Session, user_id: int) -> set[str] | None:
-    """Return set of enabled store evotor_ids, or None if no filters set (all enabled)."""
+    """Return set of enabled store evotor_ids, or None if filters not yet seeded (all enabled)."""
     cfg = db.query(SyncConfig).filter_by(user_id=user_id).first()
-    if not cfg:
+    if not cfg or not cfg.store_filters_seeded:
         return None
     filters = db.query(SyncFilter).filter_by(
         sync_config_id=cfg.id, entity_type="store", filter_mode="include"
     ).all()
-    if not filters:
-        return None
     return {f.entity_id for f in filters}
 
 
 def _enabled_group_ids(db: Session, user_id: int, store_evotor_id: str) -> set[str] | None:
-    """Return set of enabled group evotor_ids for a store, or None if all enabled."""
+    """Return set of enabled group evotor_ids for a store, or None if filters not yet seeded (all enabled)."""
     cfg = db.query(SyncConfig).filter_by(user_id=user_id).first()
-    if not cfg:
+    if not cfg or not cfg.group_filters_seeded:
         return None
     filters = db.query(SyncFilter).filter_by(
         sync_config_id=cfg.id, entity_type="group", filter_mode="include",
         parent_entity_id=store_evotor_id,
     ).all()
-    if not filters:
-        return None
     return {f.entity_id for f in filters}
 
 
@@ -58,21 +55,22 @@ def _render(request: Request, template: str, ctx: dict) -> HTMLResponse:
 @router.get("/catalog/stores")
 async def catalog_stores(request: Request, db: Session = Depends(get_db)):
     try:
-        user = get_current_user(request, db)
+        real_user, viewed_user = get_viewed_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
 
     stores = (
         db.query(CachedStore)
-        .filter(CachedStore.user_id == user.id)
+        .filter(CachedStore.user_id == viewed_user.id)
         .order_by(CachedStore.name)
         .all()
     )
-    enabled_ids = _enabled_store_ids(db, user.id)
+    enabled_ids = _enabled_store_ids(db, viewed_user.id)
     return _render(request, "catalog/stores.html", {
-        "user": user,
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
         "stores": stores,
-        "enabled_ids": enabled_ids,  # None = all enabled, set = explicit list
+        "enabled_ids": enabled_ids,
         "refresh_interval": settings.CATALOG_REFRESH_INTERVAL_SECONDS,
     })
 
@@ -80,13 +78,13 @@ async def catalog_stores(request: Request, db: Session = Depends(get_db)):
 @router.get("/catalog/stores/{store_evotor_id}/groups")
 async def catalog_groups(store_evotor_id: str, request: Request, db: Session = Depends(get_db)):
     try:
-        user = get_current_user(request, db)
+        real_user, viewed_user = get_viewed_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
 
     store = (
         db.query(CachedStore)
-        .filter(CachedStore.user_id == user.id, CachedStore.evotor_id == store_evotor_id)
+        .filter(CachedStore.user_id == viewed_user.id, CachedStore.evotor_id == store_evotor_id)
         .first()
     )
     if not store:
@@ -94,27 +92,39 @@ async def catalog_groups(store_evotor_id: str, request: Request, db: Session = D
 
     groups = (
         db.query(CachedGroup)
-        .filter(CachedGroup.user_id == user.id, CachedGroup.store_evotor_id == store_evotor_id)
+        .filter(CachedGroup.user_id == viewed_user.id, CachedGroup.store_evotor_id == store_evotor_id)
         .order_by(CachedGroup.name)
         .all()
     )
-    enabled_ids = _enabled_group_ids(db, user.id, store_evotor_id)
+    enabled_ids = _enabled_group_ids(db, viewed_user.id, store_evotor_id)
+
+    counts_q = (
+        db.query(CachedProduct.group_evotor_id, func.count().label("cnt"))
+        .filter(CachedProduct.user_id == viewed_user.id, CachedProduct.store_evotor_id == store_evotor_id)
+        .group_by(CachedProduct.group_evotor_id)
+        .all()
+    )
+    product_counts = {row.group_evotor_id: row.cnt for row in counts_q}
+
     return _render(request, "catalog/groups.html", {
-        "user": user, "store": store, "groups": groups,
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
+        "store": store, "groups": groups,
         "enabled_ids": enabled_ids,
+        "product_counts": product_counts,
     })
 
 
 @router.get("/catalog/stores/{store_evotor_id}/products")
 async def catalog_products(store_evotor_id: str, request: Request, db: Session = Depends(get_db)):
     try:
-        user = get_current_user(request, db)
+        real_user, viewed_user = get_viewed_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
 
     store = (
         db.query(CachedStore)
-        .filter(CachedStore.user_id == user.id, CachedStore.evotor_id == store_evotor_id)
+        .filter(CachedStore.user_id == viewed_user.id, CachedStore.evotor_id == store_evotor_id)
         .first()
     )
     if not store:
@@ -122,7 +132,7 @@ async def catalog_products(store_evotor_id: str, request: Request, db: Session =
 
     group_id = request.query_params.get("group")
     q = db.query(CachedProduct).filter(
-        CachedProduct.user_id == user.id,
+        CachedProduct.user_id == viewed_user.id,
         CachedProduct.store_evotor_id == store_evotor_id,
     )
     if group_id:
@@ -131,16 +141,19 @@ async def catalog_products(store_evotor_id: str, request: Request, db: Session =
     products = q.order_by(CachedProduct.name).all()
     groups = (
         db.query(CachedGroup)
-        .filter(CachedGroup.user_id == user.id, CachedGroup.store_evotor_id == store_evotor_id)
+        .filter(CachedGroup.user_id == viewed_user.id, CachedGroup.store_evotor_id == store_evotor_id)
         .order_by(CachedGroup.name)
         .all()
     )
+    group_map = {g.evotor_id: g.name for g in groups}
     return _render(request, "catalog/products.html", {
-        "user": user,
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
         "store": store,
         "products": products,
         "groups": groups,
         "group_id": group_id,
+        "group_map": group_map,
     })
 
 
@@ -153,37 +166,20 @@ async def catalog_store_toggle(store_evotor_id: str, request: Request, db: Sessi
 
     cfg = _get_or_create_sync_config(db, user.id)
 
-    # If no filters exist yet, that means all stores are implicitly enabled.
-    # Toggling one store OFF means we create include-filters for all OTHER stores.
     existing = db.query(SyncFilter).filter_by(
         sync_config_id=cfg.id, entity_type="store", filter_mode="include"
     ).all()
     existing_ids = {f.entity_id for f in existing}
 
-    if store_evotor_id in existing_ids:
+    if cfg.store_filters_seeded:
-        # Currently enabled → disable: remove its filter
+        if store_evotor_id in existing_ids:
-        db.query(SyncFilter).filter_by(
+            # Currently enabled → disable: remove its filter
-            sync_config_id=cfg.id, entity_type="store",
+            db.query(SyncFilter).filter_by(
-            entity_id=store_evotor_id, filter_mode="include",
+                sync_config_id=cfg.id, entity_type="store",
-        ).delete()
+                entity_id=store_evotor_id, filter_mode="include",
-    else:
+            ).delete()
-        if not existing_ids:
-            # First toggle: seed include-filters for all OTHER stores
-            all_stores = db.query(CachedStore).filter_by(user_id=user.id).all()
-            now = datetime.now(timezone.utc).replace(tzinfo=None)
-            for s in all_stores:
-                if s.evotor_id == store_evotor_id:
-                    continue
-                db.add(SyncFilter(
-                    sync_config_id=cfg.id,
-                    entity_type="store",
-                    entity_id=s.evotor_id,
-                    entity_name=s.name,
-                    filter_mode="include",
-                    created_at=now,
-                ))
         else:
-            # Re-enable: add its filter back
+            # Currently disabled → re-enable: add its filter back
             db.add(SyncFilter(
                 sync_config_id=cfg.id,
                 entity_type="store",
@@ -191,6 +187,22 @@ async def catalog_store_toggle(store_evotor_id: str, request: Request, db: Sessi
                 filter_mode="include",
                 created_at=datetime.now(timezone.utc).replace(tzinfo=None),
             ))
+    else:
+        # First toggle ever: seed include-filters for all OTHER stores, mark seeded
+        all_stores = db.query(CachedStore).filter_by(user_id=user.id).all()
+        now = datetime.now(timezone.utc).replace(tzinfo=None)
+        for s in all_stores:
+            if s.evotor_id == store_evotor_id:
+                continue
+            db.add(SyncFilter(
+                sync_config_id=cfg.id,
+                entity_type="store",
+                entity_id=s.evotor_id,
+                entity_name=s.name,
+                filter_mode="include",
+                created_at=now,
+            ))
+        cfg.store_filters_seeded = True
 
     db.commit()
     return RedirectResponse("/catalog/stores", 303)
@@ -214,30 +226,12 @@ async def catalog_group_toggle(
     ).all()
     existing_ids = {f.entity_id for f in existing}
 
-    if group_evotor_id in existing_ids:
+    if cfg.group_filters_seeded:
-        db.query(SyncFilter).filter_by(
+        if group_evotor_id in existing_ids:
-            sync_config_id=cfg.id, entity_type="group",
+            db.query(SyncFilter).filter_by(
-            entity_id=group_evotor_id, filter_mode="include",
+                sync_config_id=cfg.id, entity_type="group",
-        ).delete()
+                entity_id=group_evotor_id, filter_mode="include",
-    else:
+            ).delete()
-        if not existing_ids:
-            # First toggle: seed include-filters for all OTHER groups in this store
-            all_groups = db.query(CachedGroup).filter_by(
-                user_id=user.id, store_evotor_id=store_evotor_id,
-            ).all()
-            now = datetime.now(timezone.utc).replace(tzinfo=None)
-            for g in all_groups:
-                if g.evotor_id == group_evotor_id:
-                    continue
-                db.add(SyncFilter(
-                    sync_config_id=cfg.id,
-                    entity_type="group",
-                    entity_id=g.evotor_id,
-                    entity_name=g.name,
-                    filter_mode="include",
-                    parent_entity_id=store_evotor_id,
-                    created_at=now,
-                ))
         else:
             db.add(SyncFilter(
                 sync_config_id=cfg.id,
@@ -247,6 +241,25 @@ async def catalog_group_toggle(
                 parent_entity_id=store_evotor_id,
                 created_at=datetime.now(timezone.utc).replace(tzinfo=None),
             ))
+    else:
+        # First toggle ever: seed include-filters for all OTHER groups in this store, mark seeded
+        all_groups = db.query(CachedGroup).filter_by(
+            user_id=user.id, store_evotor_id=store_evotor_id,
+        ).all()
+        now = datetime.now(timezone.utc).replace(tzinfo=None)
+        for g in all_groups:
+            if g.evotor_id == group_evotor_id:
+                continue
+            db.add(SyncFilter(
+                sync_config_id=cfg.id,
+                entity_type="group",
+                entity_id=g.evotor_id,
+                entity_name=g.name,
+                filter_mode="include",
+                parent_entity_id=store_evotor_id,
+                created_at=now,
+            ))
+        cfg.group_filters_seeded = True
 
     db.commit()
     return RedirectResponse(f"/catalog/stores/{store_evotor_id}/groups", 303)

web/routes/connections.py

@@ -1,17 +1,21 @@
 import secrets
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
+from urllib.parse import urlencode
 
 import httpx
+import web.lib.api_logger as api_logger
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 from sqlalchemy.orm import Session
 
-from web.auth.session import get_current_user
+from web.auth.session import get_current_user, get_viewed_user
 from web.config import settings
 from web.database import get_db
 from web.models.connections import EvotorConnection, VkConnection
 from web.templates_env import templates
 
+VK_SCOPE = 335876  # photos(4) + wall(8192) + groups(262144) + offline(65536)
+
 router = APIRouter()
 
 
@@ -28,13 +32,18 @@ def _now() -> datetime:
 @router.get("/connections")
 async def connections_get(request: Request, db: Session = Depends(get_db)):
     try:
-        user = get_current_user(request, db)
+        real_user, viewed_user = get_viewed_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
 
-    evotor = db.query(EvotorConnection).filter_by(user_id=user.id).first()
+    evotor = db.query(EvotorConnection).filter_by(user_id=viewed_user.id).first()
-    vk = db.query(VkConnection).filter_by(user_id=user.id).first()
+    vk = db.query(VkConnection).filter_by(user_id=viewed_user.id).first()
-    return _render(request, "connections.html", {"user": user, "evotor": evotor, "vk": vk})
+    return _render(request, "connections.html", {
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
+        "evotor": evotor,
+        "vk": vk,
+    })
 
 
 @router.post("/connections/evotor")
@@ -137,6 +146,146 @@ async def connections_vk_post(request: Request, db: Session = Depends(get_db)):
     return RedirectResponse("/connections?success=1", 303)
 
 
+@router.get("/vk-auth")
+async def vk_auth(request: Request):
+    try:
+        get_current_user(request, next(get_db()))
+    except Exception:
+        return RedirectResponse("/login", 303)
+
+    if not settings.VK_CLIENT_ID:
+        return RedirectResponse("/connections?error=vk_not_configured", 303)
+
+    state = secrets.token_urlsafe(16)
+    request.session["vk_oauth_state"] = state
+
+    redirect_uri = f"{settings.BASE_URL}/vk-callback"
+    params = urlencode({
+        "client_id": settings.VK_CLIENT_ID,
+        "redirect_uri": redirect_uri,
+        "scope": VK_SCOPE,
+        "response_type": "token",
+        "display": "page",
+        "state": state,
+        "revoke": "1",
+    })
+    return RedirectResponse(f"https://oauth.vk.com/authorize?{params}", 302)
+
+
+@router.get("/vk-callback")
+async def vk_callback_page(request: Request):
+    """Serves the callback page that reads the token from the URL fragment and POSTs it."""
+    return HTMLResponse("""<!DOCTYPE html>
+<html lang="ru">
+<head><meta charset="utf-8"><title>VK авторизация…</title>
+<style>
+  body { font-family: sans-serif; display: flex; align-items: center; justify-content: center;
+         min-height: 100vh; margin: 0; background: #f4f4f4; }
+  .box { background: #fff; padding: 2rem; border-radius: 8px; box-shadow: 0 2px 8px rgba(0,0,0,.1);
+         text-align: center; max-width: 360px; }
+  .spinner { width: 36px; height: 36px; border: 4px solid #e0e0e0;
+             border-top-color: #0077ff; border-radius: 50%;
+             animation: spin .8s linear infinite; margin: 0 auto 1rem; }
+  @keyframes spin { to { transform: rotate(360deg); } }
+  .error { color: #c0392b; }
+</style>
+</head>
+<body>
+<div class="box" id="box">
+  <div class="spinner"></div>
+  <p>Завершаем авторизацию…</p>
+</div>
+<script>
+(function() {
+  const hash = window.location.hash.slice(1);
+  const params = new URLSearchParams(hash);
+  const token = params.get('access_token');
+  const state = params.get('state');
+  const userId = params.get('user_id');
+  const expiresIn = params.get('expires_in');
+
+  if (!token) {
+    document.getElementById('box').innerHTML =
+      '<p class="error">Токен не получен. <a href="/connections">Вернуться назад</a></p>';
+    return;
+  }
+
+  fetch('/vk-callback/save', {
+    method: 'POST',
+    headers: {'Content-Type': 'application/json'},
+    body: JSON.stringify({ access_token: token, state: state,
+                           user_id: userId, expires_in: expiresIn })
+  })
+  .then(r => r.json())
+  .then(data => {
+    if (data.ok) {
+      window.location.href = '/connections?success=1';
+    } else {
+      document.getElementById('box').innerHTML =
+        '<p class="error">' + (data.message || 'Ошибка сохранения') +
+        ' <a href="/connections">Вернуться назад</a></p>';
+    }
+  })
+  .catch(() => {
+    document.getElementById('box').innerHTML =
+      '<p class="error">Ошибка сети. <a href="/connections">Вернуться назад</a></p>';
+  });
+})();
+</script>
+</body>
+</html>""")
+
+
+@router.post("/vk-callback/save")
+async def vk_callback_save(request: Request, db: Session = Depends(get_db)):
+    try:
+        user = get_current_user(request, db)
+    except Exception:
+        return JSONResponse({"ok": False, "message": "Сессия истекла, войдите снова"}, status_code=401)
+
+    body = await request.json()
+    access_token = (body.get("access_token") or "").strip()
+    state = body.get("state") or ""
+    vk_user_id = str(body.get("user_id") or "").strip() or None
+    expires_in = body.get("expires_in")
+
+    expected_state = request.session.pop("vk_oauth_state", None)
+    if not expected_state or state != expected_state:
+        return JSONResponse({"ok": False, "message": "Недействительный state, попробуйте снова"})
+
+    if not access_token:
+        return JSONResponse({"ok": False, "message": "Токен не получен"})
+
+    token_expires_at = None
+    if expires_in and str(expires_in) != "0":
+        try:
+            token_expires_at = _now() + timedelta(seconds=int(expires_in))
+        except (ValueError, TypeError):
+            pass
+
+    now = _now()
+    conn = db.query(VkConnection).filter_by(user_id=user.id).first()
+    if conn:
+        conn.access_token = access_token
+        conn.token_expires_at = token_expires_at
+        if vk_user_id:
+            conn.vk_user_id = vk_user_id
+        conn.updated_at = now
+    else:
+        conn = VkConnection(
+            user_id=user.id,
+            access_token=access_token,
+            token_expires_at=token_expires_at,
+            vk_user_id=vk_user_id,
+            connected_at=now,
+            updated_at=now,
+        )
+        db.add(conn)
+
+    db.commit()
+    return JSONResponse({"ok": True})
+
+
 @router.post("/connections/vk/disconnect")
 async def connections_vk_disconnect(request: Request, db: Session = Depends(get_db)):
     try:
@@ -163,8 +312,9 @@ async def connections_evotor_test(request: Request, db: Session = Depends(get_db
         return JSONResponse({"ok": False, "message": "Подключение не настроено"})
 
     try:
-        r = httpx.get(
+        r = api_logger.get(
             "https://api.evotor.ru/stores",
+            user_id=user.id,
             headers={
                 "Authorization": f"Bearer {conn.access_token}",
                 "Accept": "application/vnd.evotor.v2+json",
@@ -198,16 +348,18 @@ async def connections_vk_test(request: Request, db: Session = Depends(get_db)):
         return JSONResponse({"ok": False, "message": "Подключение не настроено"})
 
     try:
-        params = {
+        if not conn.vk_user_id:
-            "access_token": conn.access_token,
+            return JSONResponse({"ok": False, "message": "Укажите ID сообщества для проверки подключения."})
-            "v": settings.VK_API_VERSION,
-        }
-        if conn.vk_user_id:
-            params["group_ids"] = conn.vk_user_id
 
-        r = httpx.get(
+        r = api_logger.get(
             "https://api.vk.com/method/groups.getById",
-            params=params,
+            user_id=user.id,
+            params={
+                "group_id": conn.vk_user_id,
+                "fields": "market",
+                "access_token": conn.access_token,
+                "v": settings.VK_API_VERSION,
+            },
             timeout=10,
         )
         data = r.json()
@@ -217,11 +369,13 @@ async def connections_vk_test(request: Request, db: Session = Depends(get_db)):
             return JSONResponse({"ok": False, "message": f"Ошибка VK API ({code}): {msg}"})
 
         groups = data.get("response", {}).get("groups", [])
-        if groups:
+        if not groups:
-            name = groups[0].get("name", "—")
+            return JSONResponse({"ok": False, "message": "Сообщество не найдено"})
-            return JSONResponse({"ok": True, "message": f"Успешно. Сообщество: «{name}»"})
+        group = groups[0]
-        else:
+        name = group.get("name", "—")
-            return JSONResponse({"ok": True, "message": "Токен действителен. Укажите ID сообщества для полной проверки."})
+        market = group.get("market", {})
+        market_status = "включён" if market.get("enabled") else "выключен"
+        return JSONResponse({"ok": True, "message": f"Успешно. Сообщество: «{name}», Маркет {market_status}"})
     except httpx.TimeoutException:
         return JSONResponse({"ok": False, "message": "Таймаут запроса к VK"})
     except Exception as e:

web/routes/evotor_webhooks.py

@@ -134,8 +134,8 @@ async def user_create(request: Request, db: Session = Depends(get_db)):
         user = User(
             first_name=first_name or "",
             last_name=last_name or "",
-            email=email or f"{evotor_user_id}@evotor.placeholder",
+            email=email or f"{evotor_user_id}@evotor.invalid",
-            phone=phone or "",
+            phone=phone or None,
             password_hash=None,
             role=UserRoleEnum.user,
             status=UserStatusEnum.pending,

web/routes/logs.py

@@ -0,0 +1,81 @@
+"""API request/response log viewer (admin only)."""
+from datetime import datetime, timedelta
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import RedirectResponse
+from sqlalchemy.orm import Session
+
+from web.auth.session import get_current_user
+from web.database import get_db
+from web.models.connections import ApiLog
+from web.templates_env import templates
+
+router = APIRouter()
+
+PAGE_SIZE = 50
+
+
+def _render(request, template, ctx):
+    return templates.TemplateResponse(template, {"request": request, **ctx})
+
+
+@router.get("/admin/logs")
+async def admin_logs(
+    request: Request,
+    db: Session = Depends(get_db),
+    service: str = "",
+    method: str = "",
+    status: str = "",
+    q: str = "",
+    page: int = 1,
+    hours: int = 168,
+):
+    try:
+        user = get_current_user(request, db)
+    except Exception:
+        return RedirectResponse("/login", 303)
+
+    since = datetime.utcnow() - timedelta(hours=hours)
+    query = db.query(ApiLog).filter(ApiLog.created_at >= since)
+
+    if service:
+        query = query.filter(ApiLog.service == service)
+    if method:
+        query = query.filter(ApiLog.method == method)
+    if status:
+        try:
+            st = int(status)
+            query = query.filter(ApiLog.response_status == st)
+        except ValueError:
+            if status == "error":
+                query = query.filter(ApiLog.response_status >= 400)
+            elif status == "ok":
+                query = query.filter(ApiLog.response_status < 400)
+    if q:
+        like = f"%{q}%"
+        query = query.filter(
+            ApiLog.url.like(like) | ApiLog.response_body.like(like)
+        )
+
+    total = query.count()
+    logs = (
+        query.order_by(ApiLog.created_at.desc())
+        .offset((page - 1) * PAGE_SIZE)
+        .limit(PAGE_SIZE)
+        .all()
+    )
+    total_pages = max(1, (total + PAGE_SIZE - 1) // PAGE_SIZE)
+
+    return _render(request, "admin/logs.html", {
+        "user": user,
+        "logs": logs,
+        "total": total,
+        "page": page,
+        "total_pages": total_pages,
+        "page_size": PAGE_SIZE,
+        "filter_service": service,
+        "filter_method": method,
+        "filter_status": status,
+        "filter_q": q,
+        "filter_hours": hours,
+    })

web/routes/sync.py

@@ -0,0 +1,77 @@
+"""Sync settings page."""
+from datetime import datetime, timezone
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import RedirectResponse
+from sqlalchemy.orm import Session
+
+from web.auth.session import get_current_user, get_viewed_user
+from web.config import settings
+from web.database import get_db
+from web.models.connections import SyncConfig
+from web.templates_env import templates
+
+router = APIRouter()
+
+
+def _render(request: Request, ctx: dict):
+    ctx["request"] = request
+    ctx.setdefault("jivosite_widget_id", settings.JIVOSITE_WIDGET_ID)
+    return templates.TemplateResponse(ctx.pop("request"), "sync.html", ctx)
+
+
+@router.get("/sync")
+async def sync_get(request: Request, db: Session = Depends(get_db)):
+    try:
+        real_user, viewed_user = get_viewed_user(request, db)
+    except Exception:
+        return RedirectResponse("/login", 303)
+
+    config = db.query(SyncConfig).filter_by(user_id=viewed_user.id).first()
+    return _render(request, {
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
+        "config": config,
+        "saved": request.query_params.get("saved"),
+    })
+
+
+@router.post("/sync/settings")
+async def sync_settings_post(request: Request, db: Session = Depends(get_db)):
+    try:
+        user = get_current_user(request, db)
+    except Exception:
+        return RedirectResponse("/login", 303)
+
+    form = await request.form()
+
+    evo_mirror_enabled = form.get("evo_mirror_enabled") == "1"
+    vk_mirror_enabled = form.get("vk_mirror_enabled") == "1"
+    sync_enabled = form.get("is_enabled") == "1"
+
+    raw_multiplier = str(form.get("price_multiplier", "1")).strip()
+    try:
+        multiplier = float(raw_multiplier)
+        if multiplier <= 0:
+            raise ValueError
+    except ValueError:
+        multiplier = 1.0
+
+    config = db.query(SyncConfig).filter_by(user_id=user.id).first()
+    if config:
+        config.evo_mirror_enabled = evo_mirror_enabled
+        config.vk_mirror_enabled = vk_mirror_enabled
+        config.is_enabled = sync_enabled
+        config.price_multiplier = multiplier
+    else:
+        config = SyncConfig(
+            user_id=user.id,
+            evo_mirror_enabled=evo_mirror_enabled,
+            vk_mirror_enabled=vk_mirror_enabled,
+            is_enabled=sync_enabled,
+            price_multiplier=multiplier,
+        )
+        db.add(config)
+
+    db.commit()
+    return RedirectResponse("/sync?saved=1", 303)

web/routes/vk_catalog.py

@@ -2,7 +2,7 @@ from fastapi import APIRouter, Depends, Request
 from fastapi.responses import HTMLResponse, RedirectResponse
 from sqlalchemy.orm import Session
 
-from web.auth.session import get_current_user
+from web.auth.session import get_viewed_user
 from web.config import settings
 from web.database import get_db
 from web.models.connections import VkCachedAlbum, VkCachedProduct, VkConnection
@@ -20,19 +20,20 @@ def _render(request: Request, template: str, ctx: dict) -> HTMLResponse:
 @router.get("/vk-catalog/albums")
 async def vk_catalog_albums(request: Request, db: Session = Depends(get_db)):
     try:
-        user = get_current_user(request, db)
+        real_user, viewed_user = get_viewed_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
 
-    vk_conn = db.query(VkConnection).filter_by(user_id=user.id).first()
+    vk_conn = db.query(VkConnection).filter_by(user_id=viewed_user.id).first()
     albums = (
         db.query(VkCachedAlbum)
-        .filter(VkCachedAlbum.user_id == user.id)
+        .filter(VkCachedAlbum.user_id == viewed_user.id)
         .order_by(VkCachedAlbum.title)
         .all()
     )
     return _render(request, "vk_catalog/albums.html", {
-        "user": user,
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
         "albums": albums,
         "vk_conn": vk_conn,
         "refresh_interval": settings.CATALOG_REFRESH_INTERVAL_SECONDS,
@@ -42,22 +43,23 @@ async def vk_catalog_albums(request: Request, db: Session = Depends(get_db)):
 @router.get("/vk-catalog/albums/{album_id}/products")
 async def vk_catalog_products(album_id: str, request: Request, db: Session = Depends(get_db)):
     try:
-        user = get_current_user(request, db)
+        real_user, viewed_user = get_viewed_user(request, db)
     except Exception:
         return RedirectResponse("/login", 303)
 
-    album = db.query(VkCachedAlbum).filter_by(user_id=user.id, album_id=album_id).first()
+    album = db.query(VkCachedAlbum).filter_by(user_id=viewed_user.id, album_id=album_id).first()
     if not album:
         return RedirectResponse("/vk-catalog/albums", 303)
 
     products = (
         db.query(VkCachedProduct)
-        .filter(VkCachedProduct.user_id == user.id, VkCachedProduct.album_id == album_id)
+        .filter(VkCachedProduct.user_id == viewed_user.id, VkCachedProduct.album_id == album_id)
         .order_by(VkCachedProduct.name)
         .all()
     )
     return _render(request, "vk_catalog/products.html", {
-        "user": user,
+        "user": real_user,
+        "viewed_user": viewed_user if viewed_user.id != real_user.id else None,
         "album": album,
         "products": products,
     })

web/static/style.css

@@ -310,11 +310,24 @@ button.sm, a[role="button"].sm {
 /* Table */
 .table-scroll {
     overflow-x: auto;
+    max-width: 100%;
+}
+
+article.card {
+    overflow: hidden;
+    width: 100%;
+    max-width: 100%;
+    box-sizing: border-box;
+}
+
+table.align-middle {
+    width: 100%;
 }
 
 table.align-middle td,
 table.align-middle th {
     vertical-align: middle;
+    white-space: nowrap;
 }
 
 /* Breadcrumb */

web/tasks/catalog.py

@@ -8,11 +8,11 @@ Beat schedule entry (set in celery_app.py):
 import logging
 from datetime import datetime, timezone
 
-import httpx
 from celery import shared_task
 
 from web.config import settings
 from web.database import SessionLocal
+import web.lib.api_logger as api_logger
 from web.models.connections import CachedGroup, CachedProduct, CachedStore, EvotorConnection, SyncConfig, SyncFilter
 
 logger = logging.getLogger(__name__)
@@ -34,18 +34,18 @@ def _now() -> datetime:
 
 # ── per-user helpers ──────────────────────────────────────────────────────────
 
-def _fetch_stores(token: str) -> list[dict]:
+def _fetch_stores(token: str, user_id: int | None = None) -> list[dict]:
-    r = httpx.get(f"{EVO_API}/stores", headers=_headers(token), timeout=15)
+    r = api_logger.get(f"{EVO_API}/stores", user_id=user_id, headers=_headers(token), timeout=15)
     r.raise_for_status()
     data = r.json()
     return data.get("items", data) if isinstance(data, dict) else data
 
 
-def _fetch_groups(token: str, store_id: str) -> list[dict] | None:
+def _fetch_groups(token: str, store_id: str, user_id: int | None = None) -> list[dict] | None:
     """Returns None if the store is not accessible (402/403), list otherwise."""
-    r = httpx.get(
+    r = api_logger.get(
         f"{EVO_API}/stores/{store_id}/product-groups",
-        headers=_headers(token), timeout=15,
+        user_id=user_id, headers=_headers(token), timeout=15,
     )
     if r.status_code in (402, 403):
         return None
@@ -54,11 +54,11 @@ def _fetch_groups(token: str, store_id: str) -> list[dict] | None:
     return data.get("items", data) if isinstance(data, dict) else data
 
 
-def _fetch_products(token: str, store_id: str) -> list[dict] | None:
+def _fetch_products(token: str, store_id: str, user_id: int | None = None) -> list[dict] | None:
     """Returns None if the store is not accessible (402/403), list otherwise."""
-    r = httpx.get(
+    r = api_logger.get(
         f"{EVO_API}/stores/{store_id}/products",
-        headers=_headers(token), timeout=30,
+        user_id=user_id, headers=_headers(token), timeout=30,
     )
     if r.status_code in (402, 403):
         return None
@@ -158,7 +158,7 @@ def _sync_user(db, user_id: int, token: str) -> None:
             row = db.query(CachedProduct).filter_by(user_id=user_id, evotor_id=evo_id).first()
             if row:
                 row.store_evotor_id = store_evo_id
-                row.group_evotor_id = p.get("group") or p.get("parentUuid")
+                row.group_evotor_id = p.get("group") or p.get("parentUuid") or p.get("parent_id")
                 row.name = p.get("name", "")
                 row.price = float(price) if price is not None else None
                 row.quantity = float(quantity) if quantity is not None else None
@@ -171,7 +171,7 @@ def _sync_user(db, user_id: int, token: str) -> None:
                     user_id=user_id,
                     evotor_id=evo_id,
                     store_evotor_id=store_evo_id,
-                    group_evotor_id=p.get("group") or p.get("parentUuid"),
+                    group_evotor_id=p.get("group") or p.get("parentUuid") or p.get("parent_id"),
                     name=p.get("name", ""),
                     price=float(price) if price is not None else None,
                     quantity=float(quantity) if quantity is not None else None,
@@ -215,6 +215,9 @@ def refresh_catalog(self) -> dict:
             .all()
         )
         for conn in connections:
+            cfg = db.query(SyncConfig).filter_by(user_id=conn.user_id).first()
+            if not cfg or not cfg.evo_mirror_enabled:
+                continue
             try:
                 _sync_user(db, conn.user_id, conn.access_token)
                 results["ok"] += 1

web/tasks/celery_app.py

@@ -17,21 +17,45 @@ celery_app.conf.update(
     broker_connection_retry_on_startup=True,
     task_routes={
         "web.tasks.sync.*": {"queue": "sync"},
+        "web.tasks.vk_sync.*": {"queue": "sync"},
         "web.tasks.health.*": {"queue": "health"},
         "web.tasks.catalog.*": {"queue": "default"},
+        "web.tasks.vk_catalog.*": {"queue": "default"},
         "web.notifications.tasks.*": {"queue": "notifications"},
     },
     beat_schedule={
-        "refresh-catalog": {
+        # Chain: fetch Evotor → fetch VK catalog → mirror Evotor→VK
-            "task": "web.tasks.catalog.refresh_catalog",
+        # Beat fires the launcher task which chains all three sequentially.
-            "schedule": timedelta(seconds=settings.CATALOG_REFRESH_INTERVAL_SECONDS),
+        "sync-pipeline": {
-        },
+            "task": "web.tasks.celery_app.run_sync_pipeline",
-        "refresh-vk-catalog": {
-            "task": "web.tasks.vk_catalog.refresh_vk_catalog",
             "schedule": timedelta(seconds=settings.CATALOG_REFRESH_INTERVAL_SECONDS),
         },
     },
 )
 
 # Register task modules so beat/worker can discover them
-celery_app.autodiscover_tasks(["web.tasks.catalog", "web.tasks.vk_catalog"])
+celery_app.autodiscover_tasks([
+    "web.tasks.catalog",
+    "web.tasks.vk_catalog",
+    "web.tasks.vk_sync",
+    "web.tasks.celery_app",
+])
+
+
+@celery_app.task(name="web.tasks.celery_app.run_sync_pipeline", queue="default")
+def run_sync_pipeline() -> str:
+    """
+    Beat entry point. Chains refresh_catalog → refresh_vk_catalog → mirror_to_vk
+    so that mirror only runs after both catalog fetches are complete.
+    """
+    from celery import chain
+    from web.tasks.catalog import refresh_catalog
+    from web.tasks.vk_catalog import refresh_vk_catalog
+    from web.tasks.vk_sync import mirror_to_vk
+
+    chain(
+        refresh_catalog.si(),
+        refresh_vk_catalog.si(),
+        mirror_to_vk.si(),
+    ).apply_async()
+    return "pipeline dispatched"

web/tasks/vk_catalog.py

@@ -5,12 +5,12 @@ for every connected user and upsert into vk_cached_* tables.
 import logging
 from datetime import datetime, timezone
 
-import httpx
 from celery import shared_task
 
+import web.lib.api_logger as api_logger
 from web.config import settings
 from web.database import SessionLocal
-from web.models.connections import VkCachedAlbum, VkCachedProduct, VkConnection
+from web.models.connections import SyncConfig, VkCachedAlbum, VkCachedProduct, VkConnection
 
 logger = logging.getLogger(__name__)
 
@@ -21,9 +21,9 @@ def _now() -> datetime:
     return datetime.now(timezone.utc).replace(tzinfo=None)
 
 
-def _vk_get(method: str, params: dict, token: str) -> dict:
+def _vk_get(method: str, params: dict, token: str, user_id: int | None = None) -> dict:
     params = {**params, "access_token": token, "v": settings.VK_API_VERSION}
-    r = httpx.get(f"{VK_API}/{method}", params=params, timeout=20)
+    r = api_logger.get(f"{VK_API}/{method}", user_id=user_id, params=params, timeout=20)
     r.raise_for_status()
     return r.json()
 
@@ -34,7 +34,7 @@ def _sync_user(db, user_id: int, token: str, group_id: str) -> None:
 
     # ── albums ────────────────────────────────────────────────────────────────
     try:
-        data = _vk_get("market.getAlbums", {"owner_id": owner_id, "count": 100}, token)
+        data = _vk_get("market.getAlbums", {"owner_id": owner_id, "count": 100}, token, user_id=user_id)
     except Exception as e:
         logger.warning("user=%s vk fetch albums failed: %s", user_id, e)
         return
@@ -62,6 +62,16 @@ def _sync_user(db, user_id: int, token: str, group_id: str) -> None:
                 count=a.get("count"),
                 fetched_at=now,
             ))
+    # Delete cached albums that no longer exist in VK
+    (
+        db.query(VkCachedAlbum)
+        .filter(
+            VkCachedAlbum.user_id == user_id,
+            VkCachedAlbum.vk_group_id == group_id,
+            VkCachedAlbum.album_id.notin_(album_ids),
+        )
+        .delete(synchronize_session=False)
+    )
     db.flush()
 
     # ── products (extended=1 gives albums_ids per product) ───────────────────
@@ -73,6 +83,7 @@ def _sync_user(db, user_id: int, token: str, group_id: str) -> None:
                 "market.get",
                 {"owner_id": owner_id, "count": 200, "offset": offset, "extended": 1},
                 token,
+                user_id=user_id,
             )
         except Exception as e:
             logger.warning("user=%s vk fetch products (extended) failed: %s", user_id, e)
@@ -91,13 +102,19 @@ def _sync_user(db, user_id: int, token: str, group_id: str) -> None:
     for p in all_products:
         pid = str(p["id"])
         album_id = str(p["albums_ids"][0]) if p.get("albums_ids") else None
-        price_raw = p.get("price", {}).get("amount")
+        price_field = p.get("price")
-        price = float(price_raw) / 100 if price_raw is not None else None
+        if isinstance(price_field, dict):
+            price = float(price_field.get("amount", 0)) / 100 if price_field.get("amount") is not None else None
+        else:
+            price = float(price_field) if price_field is not None else None
         thumb = None
-        if p.get("thumb_photo"):
+        thumb_field = p.get("thumb_photo")
-            sizes = p["thumb_photo"].get("sizes", [])
+        if isinstance(thumb_field, dict):
+            sizes = thumb_field.get("sizes", [])
             if sizes:
                 thumb = sizes[-1].get("url")
+        elif isinstance(thumb_field, str):
+            thumb = thumb_field
 
         row = db.query(VkCachedProduct).filter_by(
             user_id=user_id, vk_group_id=group_id, vk_product_id=pid,
@@ -155,6 +172,9 @@ def refresh_vk_catalog(self) -> dict:
             .all()
         )
         for conn in connections:
+            cfg = db.query(SyncConfig).filter_by(user_id=conn.user_id).first()
+            if not cfg or not cfg.vk_mirror_enabled:
+                continue
             try:
                 _sync_user(db, conn.user_id, conn.access_token, conn.vk_user_id)
                 results["ok"] += 1

web/tasks/vk_sync.py

@@ -0,0 +1,438 @@
+"""
+Mirror Evotor product catalog → VK Market.
+
+Runs after both refresh_catalog and refresh_vk_catalog complete.
+Only processes stores and groups that have sync enabled (via SyncFilter).
+Updates VK products only when at least one synced field has changed.
+"""
+import logging
+import os
+from datetime import datetime, timezone
+from decimal import Decimal
+
+from celery import shared_task
+
+import web.lib.api_logger as api_logger
+from web.config import settings
+from web.database import SessionLocal
+from web.models.connections import (
+    CachedGroup, CachedProduct, CachedStore,
+    SyncConfig, SyncFilter,
+    VkCachedAlbum, VkConnection,
+)
+
+logger = logging.getLogger(__name__)
+
+VK_API = "https://api.vk.com/method"
+
+_PHOTO_CACHE: dict[int, str] = {}  # user_id → uploaded photo_id for this run
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
+
+def _calc_price(price: Decimal | None) -> float:
+    """Return price in rubles for VK Market API."""
+    if price is None:
+        return 0.0
+    return float(price)
+
+
+
+def _name_for_vk(name: str) -> str:
+    return name.replace(";", ",")
+
+
+def _vk_post(method: str, data: dict, token: str, user_id: int | None = None) -> dict:
+    data = {**data, "access_token": token, "v": settings.VK_API_VERSION}
+    r = api_logger.post(f"{VK_API}/{method}", user_id=user_id, data=data, timeout=30)
+    r.raise_for_status()
+    return r.json()
+
+
+def _upload_photo(token: str, group_id: str, user_id: int | None = None) -> str | None:
+    """Upload the default product photo and return photo_id, or None on failure."""
+    photo_path = settings.VK_DEFAULT_PHOTO_PATH
+    if not os.path.exists(photo_path):
+        logger.warning("Default photo not found at %s", photo_path)
+        return None
+    try:
+        # Step 1: get upload URL
+        resp = _vk_post("market.getProductPhotoUploadServer", {"group_id": group_id}, token, user_id=user_id)
+        if "error" in resp:
+            logger.warning("getProductPhotoUploadServer error: %s", resp["error"])
+            return None
+        upload_url = resp["response"]["upload_url"]
+
+        # Step 2: upload file
+        with open(photo_path, "rb") as f:
+            up = api_logger.post(upload_url, user_id=user_id, files={"file": f}, timeout=30)
+            up.raise_for_status()
+        upload_obj = up.text
+
+        # Step 3: save
+        resp2 = _vk_post("market.saveProductPhoto", {"upload_response": upload_obj}, token, user_id=user_id)
+        if "error" in resp2:
+            logger.warning("saveProductPhoto error: %s", resp2["error"])
+            return None
+        return str(resp2["response"]["photo_id"])
+    except Exception as e:
+        logger.warning("Photo upload failed: %s", e)
+        return None
+
+
+def _get_photo_id(user_id: int, token: str, group_id: str) -> str | None:
+    """Upload photo once per sync run per user, cache the result."""
+    if user_id not in _PHOTO_CACHE:
+        _PHOTO_CACHE[user_id] = _upload_photo(token, group_id, user_id=user_id)
+    return _PHOTO_CACHE[user_id]
+
+
+def _enabled_store_ids(db, user_id: int) -> set[str] | None:
+    cfg = db.query(SyncConfig).filter_by(user_id=user_id).first()
+    if not cfg:
+        return None
+    filters = db.query(SyncFilter).filter_by(
+        sync_config_id=cfg.id, entity_type="store", filter_mode="include",
+    ).all()
+    return None if not filters else {f.entity_id for f in filters}
+
+
+def _enabled_group_ids(db, user_id: int, store_evotor_id: str) -> set[str] | None:
+    cfg = db.query(SyncConfig).filter_by(user_id=user_id).first()
+    if not cfg:
+        return None
+    filters = db.query(SyncFilter).filter_by(
+        sync_config_id=cfg.id, entity_type="group", filter_mode="include",
+        parent_entity_id=store_evotor_id,
+    ).all()
+    return None if not filters else {f.entity_id for f in filters}
+
+
+def _ensure_album(db, user_id: int, vk_group_id: str, group_name: str, token: str) -> str | None:
+    """Return VK album_id for the given group name, creating it if needed."""
+    album = db.query(VkCachedAlbum).filter_by(
+        user_id=user_id, vk_group_id=vk_group_id,
+    ).filter(VkCachedAlbum.title == group_name).first()
+
+    if album:
+        return album.album_id
+
+    # Create album in VK
+    resp = _vk_post("market.addAlbum", {
+        "owner_id": f"-{vk_group_id}",
+        "title": group_name,
+    }, token, user_id=user_id)
+    if "error" in resp:
+        logger.warning("market.addAlbum error for '%s': %s", group_name, resp["error"])
+        return None
+
+    album_id = str(resp["response"]["market_album_id"])
+    db.add(VkCachedAlbum(
+        user_id=user_id,
+        vk_group_id=vk_group_id,
+        album_id=album_id,
+        title=group_name,
+        fetched_at=_now(),
+    ))
+    db.flush()
+    logger.info("user=%s created VK album '%s' id=%s", user_id, group_name, album_id)
+    return album_id
+
+
+def _sync_product(
+    db,
+    user_id: int,
+    product: CachedProduct,
+    album_id: str,
+    vk_group_id: str,
+    token: str,
+    sync_config=None,
+) -> None:
+    name = _name_for_vk(product.name)
+    multiplier = float(sync_config.price_multiplier) if sync_config and sync_config.price_multiplier else 1.0
+    price_rubles = _calc_price(product.price) * multiplier
+    measure = (product.measure_name or "").strip()
+    if measure:
+        qty = int(multiplier) if multiplier == int(multiplier) else multiplier
+        desc = f"{product.name} (цена за {qty} {measure}.)"
+    else:
+        desc = product.name
+    stock = settings.VK_STOCK_AMOUNT if product.allow_to_sell else 0
+    owner_id = f"-{vk_group_id}"
+    now = _now()
+
+    if product.vk_product_id:
+        # Delete from VK if product is no longer for sale
+        if not product.allow_to_sell:
+            resp = _vk_post("market.delete", {
+                "owner_id": owner_id,
+                "item_id": product.vk_product_id,
+            }, token, user_id=user_id)
+            if "error" not in resp:
+                from web.models.connections import VkCachedProduct
+                vk_p = db.query(VkCachedProduct).filter_by(
+                    user_id=user_id, vk_group_id=vk_group_id, vk_product_id=product.vk_product_id,
+                ).first()
+                if vk_p:
+                    db.delete(vk_p)
+                product.vk_product_id = None
+                logger.info("user=%s deleted VK product '%s' (disabled)", user_id, name)
+            else:
+                logger.warning("market.delete error for disabled product %s: %s", product.evotor_id, resp["error"])
+            return
+
+        # Check if update needed
+        changed = False
+        # Re-read current VK state from cache
+        from web.models.connections import VkCachedProduct
+        vk_p = db.query(VkCachedProduct).filter_by(
+            user_id=user_id, vk_group_id=vk_group_id, vk_product_id=product.vk_product_id,
+        ).first()
+        album_changed = False
+        if vk_p:
+            vk_price = float(vk_p.price) if vk_p.price is not None else 0.0
+            vk_stock = settings.VK_STOCK_AMOUNT if vk_p.availability == 0 else 0
+            vk_name = vk_p.name or ""
+            vk_desc = (vk_p.description or "").strip()
+            curr_desc = desc
+            album_changed = str(vk_p.album_id) != str(album_id) if album_id else False
+            changed = (
+                name != vk_name
+                or price_rubles != vk_price
+                or curr_desc != vk_desc
+                or stock != vk_stock
+                or album_changed
+            )
+        else:
+            changed = True  # cached VK product gone, push update
+
+        if not changed:
+            return
+
+        resp = _vk_post("market.edit", {
+            "owner_id": owner_id,
+            "item_id": product.vk_product_id,
+            "name": name,
+            "description": desc,
+            "category_id": settings.VK_CATEGORY_ID,
+            "price": price_rubles,
+            "stock_amount": stock,
+        }, token, user_id=user_id)
+        if "error" in resp:
+            logger.warning("market.edit error product=%s: %s", product.evotor_id, resp["error"])
+            return
+
+        if album_changed and album_id and vk_p:
+            old_album_id = str(vk_p.album_id)
+            _vk_post("market.removeFromAlbum", {
+                "owner_id": owner_id,
+                "item_id": product.vk_product_id,
+                "album_ids": old_album_id,
+            }, token, user_id=user_id)
+            resp_album = _vk_post("market.addToAlbum", {
+                "owner_id": owner_id,
+                "item_ids": product.vk_product_id,
+                "album_ids": album_id,
+            }, token, user_id=user_id)
+            if "error" in resp_album:
+                logger.warning("market.addToAlbum error product=%s: %s", product.evotor_id, resp_album["error"])
+            else:
+                logger.info("user=%s moved VK product '%s' album %s→%s", user_id, name, old_album_id, album_id)
+
+        product.synced_at = now
+        logger.info("user=%s updated VK product '%s' id=%s", user_id, name, product.vk_product_id)
+
+    else:
+        # Create — only if allow_to_sell
+        if not product.allow_to_sell:
+            return
+
+        photo_id = _get_photo_id(user_id, token, vk_group_id)
+        if not photo_id:
+            logger.warning("user=%s skipping create for '%s': no photo", user_id, name)
+            return
+
+        resp = _vk_post("market.add", {
+            "owner_id": owner_id,
+            "name": name,
+            "description": desc,
+            "category_id": settings.VK_CATEGORY_ID,
+            "price": price_rubles,
+            "main_photo_id": photo_id,
+            "stock_amount": stock,
+        }, token, user_id=user_id)
+        if "error" in resp:
+            logger.warning("market.add error product=%s: %s", product.evotor_id, resp["error"])
+            return
+
+        vk_item_id = str(resp["response"]["market_item_id"])
+        product.vk_product_id = vk_item_id
+        product.synced_at = now
+
+        # Add to album
+        resp2 = _vk_post("market.addToAlbum", {
+            "owner_id": owner_id,
+            "item_ids": vk_item_id,
+            "album_ids": album_id,
+        }, token, user_id=user_id)
+        if "error" in resp2:
+            logger.warning("market.addToAlbum error product=%s: %s", product.evotor_id, resp2["error"])
+
+        logger.info("user=%s created VK product '%s' id=%s", user_id, name, vk_item_id)
+
+
+def _sync_product_list(db, user_id, products, album_id, vk_group_id, token, results, owned_ids, sync_config=None):
+    for product in products:
+        was_new = product.vk_product_id is None
+        try:
+            _sync_product(db, user_id, product, album_id, vk_group_id, token, sync_config)
+            if product.vk_product_id:
+                owned_ids.add(product.vk_product_id)
+            if product.synced_at:
+                if was_new and product.vk_product_id:
+                    results["created"] += 1
+                elif not was_new:
+                    results["updated"] += 1
+                else:
+                    results["skipped"] += 1
+            else:
+                results["skipped"] += 1
+        except Exception as e:
+            logger.error("user=%s sync_product failed '%s': %s", user_id, product.name, e)
+            results["errors"] += 1
+
+
+def _delete_orphans(db, user_id, vk_group_id, owned_ids, token, results):
+    from web.models.connections import VkCachedProduct
+    orphans = db.query(VkCachedProduct).filter_by(
+        user_id=user_id, vk_group_id=vk_group_id,
+    ).filter(VkCachedProduct.vk_product_id.notin_(owned_ids)).all() if owned_ids else \
+        db.query(VkCachedProduct).filter_by(user_id=user_id, vk_group_id=vk_group_id).all()
+
+    owner_id = f"-{vk_group_id}"
+    for vk_p in orphans:
+        try:
+            resp = _vk_post("market.delete", {
+                "owner_id": owner_id,
+                "item_id": vk_p.vk_product_id,
+            }, token, user_id=user_id)
+            if "error" in resp:
+                logger.warning("market.delete error id=%s: %s", vk_p.vk_product_id, resp["error"])
+                results["errors"] += 1
+            else:
+                logger.info("user=%s deleted VK product id=%s '%s'", user_id, vk_p.vk_product_id, vk_p.name)
+                db.delete(vk_p)
+                results["deleted"] += 1
+        except Exception as e:
+            logger.error("user=%s delete failed id=%s: %s", user_id, vk_p.vk_product_id, e)
+            results["errors"] += 1
+
+    # Also clear vk_product_id on any cached_products that pointed to deleted VK items
+    if orphans:
+        deleted_vk_ids = {vk_p.vk_product_id for vk_p in orphans}
+        stale = db.query(CachedProduct).filter(
+            CachedProduct.user_id == user_id,
+            CachedProduct.vk_product_id.in_(deleted_vk_ids),
+        ).all()
+        for p in stale:
+            p.vk_product_id = None
+
+
+def _sync_user(db, user_id: int, token: str, vk_group_id: str) -> dict:
+    results = {"created": 0, "updated": 0, "skipped": 0, "deleted": 0, "errors": 0}
+    owned_ids: set[str] = set()  # VK product IDs that Evotor owns this run
+
+    sync_config = db.query(SyncConfig).filter_by(user_id=user_id).first()
+    enabled_stores = _enabled_store_ids(db, user_id)
+
+    stores = db.query(CachedStore).filter_by(user_id=user_id).all()
+    for store in stores:
+        if enabled_stores is not None and store.evotor_id not in enabled_stores:
+            continue
+
+        enabled_groups = _enabled_group_ids(db, user_id, store.evotor_id)
+
+        groups = db.query(CachedGroup).filter_by(
+            user_id=user_id, store_evotor_id=store.evotor_id,
+        ).all()
+
+        for group in groups:
+            if enabled_groups is not None and group.evotor_id not in enabled_groups:
+                continue
+
+            try:
+                album_id = _ensure_album(db, user_id, vk_group_id, group.name, token)
+            except Exception as e:
+                logger.error("user=%s ensure_album failed for '%s': %s", user_id, group.name, e)
+                results["errors"] += 1
+                continue
+            if not album_id:
+                results["errors"] += 1
+                continue
+
+            products = db.query(CachedProduct).filter_by(
+                user_id=user_id, store_evotor_id=store.evotor_id, group_evotor_id=group.evotor_id,
+            ).all()
+            _sync_product_list(db, user_id, products, album_id, vk_group_id, token, results, owned_ids, sync_config)
+
+        # Ungrouped products → "Без категории" album
+        ungrouped = db.query(CachedProduct).filter_by(
+            user_id=user_id, store_evotor_id=store.evotor_id, group_evotor_id=None,
+        ).all()
+        if ungrouped:
+            try:
+                fallback_album_id = _ensure_album(db, user_id, vk_group_id, "Без категории", token)
+            except Exception as e:
+                logger.error("user=%s ensure_album failed for 'Без категории': %s", user_id, e)
+                fallback_album_id = None
+            if fallback_album_id:
+                _sync_product_list(db, user_id, ungrouped, fallback_album_id, vk_group_id, token, results, owned_ids, sync_config)
+
+    # Delete VK products not owned by any Evotor product
+    _delete_orphans(db, user_id, vk_group_id, owned_ids, token, results)
+
+    db.commit()
+    return results
+
+
+@shared_task(
+    name="web.tasks.vk_sync.mirror_to_vk",
+    queue="sync",
+    bind=True,
+    max_retries=1,
+    default_retry_delay=120,
+)
+def mirror_to_vk(self) -> dict:
+    """Mirror Evotor catalog → VK Market for all users with both connections active."""
+    _PHOTO_CACHE.clear()
+    db = SessionLocal()
+    totals = {"ok": 0, "failed": 0}
+    try:
+        vk_connections = (
+            db.query(VkConnection)
+            .filter(
+                VkConnection.user_id.isnot(None),
+                VkConnection.access_token.isnot(None),
+                VkConnection.access_token != "",
+                VkConnection.vk_user_id.isnot(None),
+                VkConnection.vk_user_id != "",
+            )
+            .all()
+        )
+        for conn in vk_connections:
+            cfg = db.query(SyncConfig).filter_by(user_id=conn.user_id).first()
+            if not cfg or not cfg.is_enabled:
+                continue
+            try:
+                result = _sync_user(db, conn.user_id, conn.access_token, conn.vk_user_id)
+                logger.info("user=%s mirror_to_vk: %s", conn.user_id, result)
+                totals["ok"] += 1
+            except Exception as exc:
+                logger.error("mirror_to_vk failed for user=%s: %s", conn.user_id, exc)
+                totals["failed"] += 1
+    finally:
+        db.close()
+    logger.info("mirror_to_vk done: %s", totals)
+    return totals

web/templates/admin/logs.html

@@ -0,0 +1,147 @@
+{% extends "base.html" %}
+{% block title %}API Логи — ЭВОСИНК{% endblock %}
+
+{% block content %}
+<div class="d-flex justify-between align-center mb-3">
+    <h1 style="font-size:1.3rem; margin:0;"><i class="bi bi-journal-text me-2"></i>API Логи</h1>
+    <span class="text-muted small">Найдено: {{ total }}</span>
+</div>
+
+{# ── filters ── #}
+<form method="get" action="/admin/logs" class="mb-3" style="display:flex; flex-wrap:wrap; gap:0.5rem; align-items:center;">
+    <select name="service" style="width:auto;">
+        <option value="" {% if not filter_service %}selected{% endif %}>Все сервисы</option>
+        <option value="evotor" {% if filter_service == 'evotor' %}selected{% endif %}>Эвотор</option>
+        <option value="vk" {% if filter_service == 'vk' %}selected{% endif %}>ВКонтакте</option>
+        <option value="other" {% if filter_service == 'other' %}selected{% endif %}>Другое</option>
+    </select>
+    <select name="method" style="width:auto;">
+        <option value="" {% if not filter_method %}selected{% endif %}>Все методы</option>
+        <option value="GET" {% if filter_method == 'GET' %}selected{% endif %}>GET</option>
+        <option value="POST" {% if filter_method == 'POST' %}selected{% endif %}>POST</option>
+    </select>
+    <select name="status" style="width:auto;">
+        <option value="" {% if not filter_status %}selected{% endif %}>Любой статус</option>
+        <option value="ok" {% if filter_status == 'ok' %}selected{% endif %}>2xx / 3xx</option>
+        <option value="error" {% if filter_status == 'error' %}selected{% endif %}>4xx / 5xx</option>
+        <option value="200" {% if filter_status == '200' %}selected{% endif %}>200</option>
+        <option value="401" {% if filter_status == '401' %}selected{% endif %}>401</option>
+        <option value="403" {% if filter_status == '403' %}selected{% endif %}>403</option>
+        <option value="429" {% if filter_status == '429' %}selected{% endif %}>429</option>
+        <option value="500" {% if filter_status == '500' %}selected{% endif %}>500</option>
+    </select>
+    <select name="hours" style="width:auto;">
+        <option value="1" {% if filter_hours == 1 %}selected{% endif %}>Последний час</option>
+        <option value="6" {% if filter_hours == 6 %}selected{% endif %}>6 часов</option>
+        <option value="24" {% if filter_hours == 24 %}selected{% endif %}>24 часа</option>
+        <option value="168" {% if filter_hours == 168 or (not filter_hours) %}selected{% endif %}>7 дней</option>
+        <option value="720" {% if filter_hours == 720 %}selected{% endif %}>30 дней</option>
+    </select>
+    <input type="search" name="q" value="{{ filter_q }}" placeholder="URL или тело ответа…" style="flex:1; min-width:160px;">
+    <button type="submit">Применить</button>
+    {% if filter_service or filter_method or filter_status or filter_q or filter_hours != 24 %}
+    <a href="/admin/logs" role="button" class="outline secondary">Сбросить</a>
+    {% endif %}
+</form>
+
+<article class="card" style="padding:0;">
+    {% if logs %}
+    <div class="table-scroll">
+        <table class="align-middle" style="font-size:0.82rem;">
+            <thead>
+                <tr>
+                    <th style="width:140px;">Время</th>
+                    <th style="width:60px;">Сервис</th>
+                    <th style="width:40px;">Метод</th>
+                    <th style="width:50px;">Статус</th>
+                    <th style="width:60px;">Мс</th>
+                    <th>URL</th>
+                    <th style="width:30px;"></th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for log in logs %}
+                {% set is_error = log.response_status and log.response_status >= 400 %}
+                <tr class="{{ 'text-danger' if is_error else '' }}" style="cursor:pointer;" onclick="toggleDetail({{ log.id }})">
+                    <td class="text-muted">{{ log.created_at | datefmt }}</td>
+                    <td>
+                        <span class="badge {{ 'badge-evotor' if log.service == 'evotor' else 'badge-vk' if log.service == 'vk' else '' }}">
+                            {{ log.service }}
+                        </span>
+                    </td>
+                    <td><code>{{ log.method }}</code></td>
+                    <td>
+                        {% if log.response_status %}
+                        <span class="{{ 'text-danger' if is_error else 'text-muted' }}">{{ log.response_status }}</span>
+                        {% else %}
+                        <span class="text-muted">—</span>
+                        {% endif %}
+                    </td>
+                    <td class="text-muted">{{ log.duration_ms if log.duration_ms is not none else '—' }}</td>
+                    <td style="max-width:400px; overflow:hidden; text-overflow:ellipsis; white-space:nowrap;">
+                        <span title="{{ log.url }}">{{ log.url }}</span>
+                    </td>
+                    <td class="text-muted"><i class="bi bi-chevron-down"></i></td>
+                </tr>
+                <tr id="detail-{{ log.id }}" style="display:none; background:var(--pico-card-background-color);">
+                    <td colspan="7" style="padding:0.75rem 1rem;">
+                        <div style="display:grid; grid-template-columns:1fr 1fr; gap:1rem;">
+                            <div>
+                                <div class="text-muted small mb-1"><strong>URL</strong></div>
+                                <code style="word-break:break-all; font-size:0.78rem;">{{ log.url }}</code>
+                                {% if log.request_body %}
+                                <div class="text-muted small mt-2 mb-1"><strong>Request body</strong></div>
+                                <pre style="font-size:0.75rem; max-height:200px; overflow:auto; margin:0; background:var(--pico-code-background-color); padding:0.5rem; border-radius:4px;">{{ log.request_body }}</pre>
+                                {% endif %}
+                            </div>
+                            <div>
+                                <div class="text-muted small mb-1"><strong>Response ({{ log.response_status }})</strong></div>
+                                {% if log.response_body %}
+                                <pre style="font-size:0.75rem; max-height:200px; overflow:auto; margin:0; background:var(--pico-code-background-color); padding:0.5rem; border-radius:4px;">{{ log.response_body }}</pre>
+                                {% else %}
+                                <span class="text-muted">—</span>
+                                {% endif %}
+                            </div>
+                        </div>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </div>
+
+    {# ── pagination ── #}
+    {% if total_pages > 1 %}
+    <div style="display:flex; justify-content:center; gap:0.5rem; padding:1rem;">
+        {% if page > 1 %}
+        <a href="?service={{ filter_service }}&method={{ filter_method }}&status={{ filter_status }}&q={{ filter_q }}&hours={{ filter_hours }}&page={{ page - 1 }}" role="button" class="outline secondary sm">← Назад</a>
+        {% endif %}
+        <span class="text-muted" style="line-height:2.2rem;">Стр. {{ page }} / {{ total_pages }}</span>
+        {% if page < total_pages %}
+        <a href="?service={{ filter_service }}&method={{ filter_method }}&status={{ filter_status }}&q={{ filter_q }}&hours={{ filter_hours }}&page={{ page + 1 }}" role="button" class="outline secondary sm">Вперёд →</a>
+        {% endif %}
+    </div>
+    {% endif %}
+
+    {% else %}
+    <div class="text-center py-5 text-muted">
+        <i class="bi bi-journal-x" style="font-size:2rem;"></i>
+        <p class="mt-2">Записей не найдено за выбранный период.</p>
+    </div>
+    {% endif %}
+</article>
+
+<style>
+.badge { display:inline-block; padding:0.1rem 0.4rem; border-radius:4px; font-size:0.75rem; font-weight:600; }
+.badge-evotor { background:#e8f4fd; color:#0986E2; }
+.badge-vk { background:#e8f0fe; color:#3b5998; }
+.text-danger { color:#dc3545; }
+</style>
+
+<script>
+function toggleDetail(id) {
+    const row = document.getElementById('detail-' + id);
+    row.style.display = row.style.display === 'none' ? 'table-row' : 'none';
+}
+</script>
+{% endblock %}

web/templates/admin/user_detail.html

@@ -96,6 +96,11 @@
                         <i class="bi bi-envelope me-1"></i>Отправить приглашение
                     </button>
                 </form>
+                <form method="post" action="/admin/users/{{ target.id }}/view-as">
+                    <button type="submit" class="w-100 outline">
+                        <i class="bi bi-eye me-1"></i>Просмотр от имени пользователя
+                    </button>
+                </form>
                 {% if user.role == 'system' and target.id != user.id %}
                 <form method="post" action="/admin/users/{{ target.id }}/delete"
                       onsubmit="return confirm('Удалить пользователя {{ target.email }}? Это действие необратимо.')">

web/templates/admin/users.html

@@ -4,9 +4,64 @@
 {% block content %}
 <div class="d-flex justify-between align-center mb-3">
     <h1 style="font-size:1.3rem; margin:0;"><i class="bi bi-people me-2"></i>Пользователи</h1>
-    <span class="text-muted small">Всего: {{ total }}</span>
+    <button onclick="document.getElementById('create-user-dialog').showModal()" class="sm">
+        <i class="bi bi-person-plus me-1"></i>Создать пользователя
+    </button>
 </div>
 
+<dialog id="create-user-dialog">
+    <article>
+        <header>
+            <button aria-label="Закрыть" rel="prev" onclick="document.getElementById('create-user-dialog').close()"></button>
+            <h3>Создать пользователя</h3>
+        </header>
+        {% if create_errors %}
+        <div role="alert" class="alert alert-danger mb-3">
+            {% for e in create_errors %}<p>{{ e }}</p>{% endfor %}
+        </div>
+        {% endif %}
+        <form method="post" action="/admin/users/create" novalidate>
+            <div class="row gap-2 mb-2">
+                <div class="col">
+                    <label for="cu_first_name">Имя
+                        <input type="text" id="cu_first_name" name="first_name" value="{{ create_form.first_name if create_form else '' }}" required>
+                    </label>
+                </div>
+                <div class="col">
+                    <label for="cu_last_name">Фамилия
+                        <input type="text" id="cu_last_name" name="last_name" value="{{ create_form.last_name if create_form else '' }}">
+                    </label>
+                </div>
+            </div>
+            <label for="cu_email">Email
+                <input type="text" id="cu_email" name="email" value="{{ create_form.email if create_form else '' }}" required>
+            </label>
+            <label for="cu_phone">Телефон
+                <input type="tel" id="cu_phone" name="phone" value="{{ create_form.phone if create_form else '' }}" placeholder="+7 (999) 999-99-99">
+            </label>
+            <label for="cu_password">Пароль
+                <input type="password" id="cu_password" name="password" required>
+            </label>
+            {% if user.role == 'system' %}
+            <label for="cu_role">Роль
+                <select id="cu_role" name="role">
+                    <option value="user" {% if not create_form or create_form.role == 'user' %}selected{% endif %}>Пользователь</option>
+                    <option value="admin" {% if create_form and create_form.role == 'admin' %}selected{% endif %}>Администратор</option>
+                </select>
+            </label>
+            {% endif %}
+            <footer class="d-flex gap-2 justify-end">
+                <button type="button" class="outline secondary" onclick="document.getElementById('create-user-dialog').close()">Отмена</button>
+                <button type="submit">Создать</button>
+            </footer>
+        </form>
+    </article>
+</dialog>
+
+{% if create_errors %}
+<script>document.addEventListener('DOMContentLoaded', () => document.getElementById('create-user-dialog').showModal());</script>
+{% endif %}
+
 <article class="card mb-3">
     <div class="card-body">
         <form method="get" action="/admin/users" class="d-flex gap-2 flex-wrap align-center">
@@ -43,7 +98,7 @@
                     <th>Роль</th>
                     <th>Статус</th>
                     <th>Эвотор</th>
-                    <th>Регистрация</th>
+                    <th>Дата</th>
                     <th></th>
                 </tr>
             </thead>
@@ -52,13 +107,13 @@
                 <tr>
                     <td class="text-muted small">{{ u.id }}</td>
                     <td>{{ u.first_name }} {{ u.last_name }}</td>
-                    <td>
+                    <td title="{{ u.email }}">
                         {{ u.email }}
                         {% if not u.is_email_confirmed %}
                             <span class="badge badge-warning ms-1" title="Email не подтверждён"><i class="bi bi-exclamation-circle"></i></span>
                         {% endif %}
                     </td>
-                    <td>{{ u.phone }}</td>
+                    <td>{{ u.phone or '—' }}</td>
                     <td>
                         {% if u.role == 'system' %}<span class="badge badge-danger">Системный</span>
                         {% elif u.role == 'admin' %}<span class="badge badge-warning">Админ</span>

web/templates/base.html

@@ -16,30 +16,35 @@
             </ul>
             <ul class="nav-links">
                 {% if user %}
+                    {% if user.role not in ('admin', 'system') or viewed_user %}
                     <li><a href="/connections">Подключения</a></li>
                     <li><a href="/catalog">Каталог Эвотор</a></li>
                     <li><a href="/vk-catalog/albums">Каталог ВК</a></li>
                     <li><a href="/sync">Синхронизация</a></li>
+                    {% endif %}
                     {% if user.role in ('admin', 'system') %}
                     <li><a href="/admin/users"><i class="bi bi-shield-lock"></i> Админ</a></li>
+                    <li><a href="/admin/logs"><i class="bi bi-journal-text"></i> Логи</a></li>
                     {% endif %}
                     <li><a href="/profile"><i class="bi bi-person-circle"></i> Личный кабинет</a></li>
                     <li><a href="/logout" class="secondary">Выход</a></li>
                 {% else %}
                     <li><a href="/login">Вход</a></li>
-                    <li><a href="/register">Регистрация</a></li>
                 {% endif %}
             </ul>
             {% if user %}
             <details class="mobile-menu">
                 <summary role="button" class="outline secondary icon-btn"><i class="bi bi-list"></i></summary>
                 <ul>
+                    {% if user.role not in ('admin', 'system') or viewed_user %}
                     <li><a href="/connections">Подключения</a></li>
                     <li><a href="/catalog">Каталог Эвотор</a></li>
                     <li><a href="/vk-catalog/albums">Каталог ВК</a></li>
                     <li><a href="/sync">Синхронизация</a></li>
+                    {% endif %}
                     {% if user.role in ('admin', 'system') %}
                     <li><a href="/admin/users">Админ</a></li>
+                    <li><a href="/admin/logs">Логи</a></li>
                     {% endif %}
                     <li><a href="/profile">Личный кабинет</a></li>
                     <li><a href="/logout">Выход</a></li>
@@ -50,13 +55,21 @@
                 <summary role="button" class="outline secondary icon-btn"><i class="bi bi-list"></i></summary>
                 <ul>
                     <li><a href="/login">Вход</a></li>
-                    <li><a href="/register">Регистрация</a></li>
                 </ul>
             </details>
             {% endif %}
         </nav>
     </header>
 
+    {% if viewed_user %}
+    <div style="background:#e65c00;color:#fff;text-align:center;padding:0.4rem 1rem;font-size:0.9rem;">
+        <i class="bi bi-eye me-1"></i>Просмотр от имени: <strong>{{ viewed_user.first_name }} {{ viewed_user.last_name }}</strong> ({{ viewed_user.email }})
+        <form method="post" action="/admin/view-as/stop" style="display:inline;margin-left:1rem;">
+            <button type="submit" style="background:none;border:1px solid #fff;color:#fff;padding:0.1rem 0.6rem;font-size:0.85rem;cursor:pointer;border-radius:4px;">Выйти</button>
+        </form>
+    </div>
+    {% endif %}
+
     <main class="container py-4">
         {% if errors %}
         <div role="alert" class="alert alert-danger">

web/templates/catalog/groups.html

@@ -23,6 +23,7 @@
                 <tr>
                     <th>Синхронизация</th>
                     <th>Название</th>
+                    <th>Количество товаров</th>
                     <th>ID</th>
                     <th>Обновлено</th>
                     <th></th>
@@ -47,6 +48,7 @@
                         </form>
                     </td>
                     <td><i class="bi bi-folder2 me-1 text-muted"></i> <strong>{{ g.name }}</strong></td>
+                    <td class="text-muted small">{{ product_counts.get(g.evotor_id, 0) }}</td>
                     <td class="text-muted small">{{ g.evotor_id }}</td>
                     <td class="text-muted small">{{ g.fetched_at | datefmt }}</td>
                     <td>

web/templates/catalog/products.html

@@ -40,6 +40,7 @@
             <thead>
                 <tr>
                     <th>Название</th>
+                    <th>Группа</th>
                     <th>Артикул</th>
                     <th>Цена</th>
                     <th>Остаток</th>
@@ -52,6 +53,7 @@
                 {% for p in products %}
                 <tr>
                     <td>{{ p.name }}</td>
+                    <td class="text-muted small">{{ group_map.get(p.group_evotor_id) or '—' }}</td>
                     <td class="text-muted small">{{ p.article_number or '—' }}</td>
                     <td>{% if p.price is not none %}{{ p.price | price }}{% else %}—{% endif %}</td>
                     <td>{% if p.quantity is not none %}{{ p.quantity }}{% else %}—{% endif %}</td>

web/templates/connections.html

@@ -134,14 +134,15 @@
             {% endif %}
 
             <div class="card-body">
-                <details {% if not vk %}open{% endif %}>
+                <div class="mt-3">
-                    <summary>
+                    <a href="/vk-auth" role="button">
-                        {% if vk %}Обновить подключение{% else %}Подключить ВКонтакте{% endif %}
+                        <i class="bi bi-box-arrow-in-right me-1"></i>
-                    </summary>
+                        {% if vk %}Переподключить ВКонтакте{% else %}Войти через ВКонтакте{% endif %}
-                    <p class="text-muted small mt-2">
+                    </a>
-                        Укажите токен пользователя VK с правами <code>market,photos,groups</code>
+                </div>
-                        и ID сообщества, в котором включён Маркет.
+
-                    </p>
+                <details class="mt-3">
+                    <summary class="text-muted small">Ввести токен вручную</summary>
                     <form method="post" action="/connections/vk" class="mt-2">
                         <label>
                             Токен доступа VK

web/templates/login.html

@@ -17,8 +17,7 @@
                     <button type="submit" class="w-100">Войти</button>
                 </form>
                 <div class="text-center small mt-3">
-                    <a href="/forgot-password">Забыли пароль?</a><br>
+                    <a href="/forgot-password">Забыли пароль?</a>
-                    <a href="/register">Зарегистрироваться</a>
                 </div>
             </div>
         </article>

web/templates/sync.html

@@ -0,0 +1,71 @@
+{% extends "base.html" %}
+{% block title %}Синхронизация — ЭВОСИНК{% endblock %}
+
+{% block content %}
+<div class="d-flex justify-between align-center mb-3">
+    <h1 style="font-size:1.3rem; margin:0;"><i class="bi bi-arrow-repeat me-2"></i>Синхронизация</h1>
+</div>
+
+{% if saved %}
+<div role="alert" class="alert alert-success"><p>Настройки сохранены.</p></div>
+{% endif %}
+
+<form method="post" action="/sync/settings">
+
+<article class="card mb-3">
+    <h2 style="font-size:1.1rem; margin-bottom:1.25rem;">Фоновые задачи</h2>
+    <p class="text-muted small" style="margin-bottom:1.25rem;">Включайте поочерёдно: сначала проверьте зеркало Эвотор, затем ВК, затем синхронизацию.</p>
+
+    <div style="display:flex; flex-direction:column; gap:1rem;">
+
+        <label style="display:flex; align-items:flex-start; gap:0.75rem; cursor:pointer;">
+            <input type="hidden" name="evo_mirror_enabled" value="0">
+            <input type="checkbox" name="evo_mirror_enabled" value="1" role="switch"
+                   {% if config and config.evo_mirror_enabled %}checked{% endif %}
+                   style="margin-top:0.2rem; flex-shrink:0;">
+            <span>
+                <strong>Зеркало Эвотор</strong><br>
+                <span class="text-muted small">Периодически импортирует товары, группы и магазины из Эвотор в локальную базу.</span>
+            </span>
+        </label>
+
+        <label style="display:flex; align-items:flex-start; gap:0.75rem; cursor:pointer;">
+            <input type="hidden" name="vk_mirror_enabled" value="0">
+            <input type="checkbox" name="vk_mirror_enabled" value="1" role="switch"
+                   {% if config and config.vk_mirror_enabled %}checked{% endif %}
+                   style="margin-top:0.2rem; flex-shrink:0;">
+            <span>
+                <strong>Зеркало ВК</strong><br>
+                <span class="text-muted small">Периодически импортирует альбомы и товары из VK Market в локальный кэш.</span>
+            </span>
+        </label>
+
+        <label style="display:flex; align-items:flex-start; gap:0.75rem; cursor:pointer;">
+            <input type="hidden" name="is_enabled" value="0">
+            <input type="checkbox" name="is_enabled" value="1" role="switch"
+                   {% if config and config.is_enabled %}checked{% endif %}
+                   style="margin-top:0.2rem; flex-shrink:0;">
+            <span>
+                <strong>Синхронизация</strong><br>
+                <span class="text-muted small">Зеркалит каталог Эвотор в VK Market: создаёт, обновляет и удаляет товары.</span>
+            </span>
+        </label>
+
+    </div>
+</article>
+
+<article class="card mb-3">
+    <h2 style="font-size:1.1rem; margin-bottom:1.25rem;">Настройки цены</h2>
+    <label style="max-width:320px;">
+        Множитель цены
+        <input type="number" name="price_multiplier" step="0.0001" min="0.0001"
+               value="{{ config.price_multiplier if config else '1' }}"
+               placeholder="1">
+        <small class="text-muted">Цена из Эвотор умножается на это значение перед отправкой в ВК. По умолчанию: 1.</small>
+    </label>
+</article>
+
+<button type="submit">Сохранить</button>
+
+</form>
+{% endblock %}