admin: gift granting, collectible attribute/number control, and Layer 228 moderation tools

Admin console additions (Layer 228):
- Give Gifts: dedicated tab with sorted Lottie/TGS gift picker + inline form; grant any catalog gift to a user/channel from 777000 (no charge)
- Upgraded/collectible delivery: mint a unique gift with admin-selected model/pattern/backdrop and custom number, or random/auto (DB FK + UNIQUE(gift_id,num) enforce invariants)
- SCAM/FAKE flags for users/channels (migration 0136) with configurable profile warning (TELESRV_SCAM_WARNING/TELESRV_FAKE_WARNING)
- Support toggle, force channel settings incl. gigagroup (migration 0137), username management, cosmetic color/emoji-status
- Emoji admin tab (custom emoji list + document IDs + Lottie/TGS preview)
- Bot management; soft UI / dark theme
Wired through Router -> admin.Service -> adminapi -> BFF -> React panel (en/zh/ru).

internal/rpc/convert_channels_core.go

@@ -450,6 +450,9 @@ func tgChannel(viewerUserID int64, ch domain.Channel, self *domain.ChannelMember
 	out := &tg.Channel{
 		Creator:    ch.CreatorUserID == viewerUserID && viewerUserID != 0,
 		Verified:   ch.Verified,
+		Scam:       ch.Scam,
+		Fake:       ch.Fake,
+		Gigagroup:  ch.Gigagroup,
 		Broadcast:  ch.Broadcast,
 		Megagroup:  ch.Megagroup,
 		Forum:      ch.Forum,
@@ -540,6 +543,16 @@ func tgChannel(viewerUserID int64, ch domain.Channel, self *domain.ChannelMember
 	return out
 }
 
+// channelAboutWithModerationWarning decorates the projected channel/supergroup
+// About with the scam/fake warning when set (group vs channel wording).
+func channelAboutWithModerationWarning(ch domain.Channel) string {
+	scamText, fakeText := defaultScamWarningChannel, defaultFakeWarningChannel
+	if ch.Megagroup && !ch.Broadcast {
+		scamText, fakeText = defaultScamWarningGroup, defaultFakeWarningGroup
+	}
+	return aboutWithModerationWarning(ch.About, scamText, fakeText, ch.Scam, ch.Fake)
+}
+
 func tgChannelFull(view domain.ChannelView, publicBaseURL ...string) *tg.ChannelFull {
 	ch := view.Channel
 	full := &tg.ChannelFull{
@@ -550,7 +563,7 @@ func tgChannelFull(view domain.ChannelView, publicBaseURL ...string) *tg.Channel
 		CanSetUsername:      view.Self.Role == domain.ChannelRoleCreator,
 		CanDeleteChannel:    view.Self.Role == domain.ChannelRoleCreator,
 		ID:                  ch.ID,
-		About:               ch.About,
+		About:               channelAboutWithModerationWarning(ch),
 		ReadInboxMaxID:      view.Dialog.ReadInboxMaxID,
 		ReadOutboxMaxID:     view.Dialog.ReadOutboxMaxID,
 		UnreadCount:         view.Dialog.UnreadCount,

internal/rpc/convert_flags.go

@@ -0,0 +1,81 @@
+package rpc
+
+import (
+	"strings"
+	"sync/atomic"
+)
+
+// Scam/fake profile warnings surfaced in the full-profile About text.
+//
+// Telegram Desktop only ships the SCAM/FAKE badge strings and renders no
+// warning paragraph, while iOS/Android show a localized warning. To make the
+// warning visible on every client, the server injects it into the projected
+// getFullUser/getFullChannel About field. Injection is non-destructive: the
+// stored bio/description is never overwritten, only the response is decorated,
+// so clearing the flag restores the original text and the warning survives the
+// owner editing their bio/description (it is re-applied from the flag on every
+// read).
+//
+// The text is server-provided (clients cannot localize it). Operators override
+// it via TELESRV_SCAM_WARNING / TELESRV_FAKE_WARNING; when unset the built-in
+// per-peer-type English defaults are used. scam takes precedence over fake.
+const (
+	defaultScamWarningUser    = "\u26A0\uFE0F Warning: Many users reported this account as a scam. Please be careful, especially if it asks you for money."
+	defaultFakeWarningUser    = "\u26A0\uFE0F Warning: Many users reported that this account impersonates a famous person or organization."
+	defaultScamWarningChannel = "\u26A0\uFE0F Warning: Many users reported this channel as a scam. Please be careful, especially if it asks you for money."
+	defaultFakeWarningChannel = "\u26A0\uFE0F Warning: Many users reported that this channel impersonates a famous person or organization."
+	defaultScamWarningGroup   = "\u26A0\uFE0F Warning: Many users reported this group as a scam. Please be careful, especially if it asks you for money."
+	defaultFakeWarningGroup   = "\u26A0\uFE0F Warning: Many users reported that this group impersonates a famous person or organization."
+)
+
+// moderationWarningOverrides holds the operator-configured texts. They are set
+// once at startup (SetModerationWarnings) before any request is served, and
+// read on the hot path; atomic.Pointer keeps that race-free without locking.
+var moderationWarningOverrides atomic.Pointer[moderationWarningConfig]
+
+type moderationWarningConfig struct {
+	scam string
+	fake string
+}
+
+// SetModerationWarnings installs operator overrides for the scam/fake profile
+// warnings. Empty strings keep the built-in per-peer-type defaults. A single
+// override applies to every peer type (user/channel/group).
+func SetModerationWarnings(scam, fake string) {
+	moderationWarningOverrides.Store(&moderationWarningConfig{
+		scam: strings.TrimSpace(scam),
+		fake: strings.TrimSpace(fake),
+	})
+}
+
+func moderationOverride() moderationWarningConfig {
+	if cfg := moderationWarningOverrides.Load(); cfg != nil {
+		return *cfg
+	}
+	return moderationWarningConfig{}
+}
+
+// aboutWithModerationWarning prepends the scam/fake warning to a profile About.
+// It returns about unchanged when neither flag is set. The operator override
+// wins over the per-type default; scam wins over fake when both are set.
+func aboutWithModerationWarning(about, scamDefault, fakeDefault string, scam, fake bool) string {
+	override := moderationOverride()
+	warning := ""
+	switch {
+	case scam:
+		if warning = override.scam; warning == "" {
+			warning = scamDefault
+		}
+	case fake:
+		if warning = override.fake; warning == "" {
+			warning = fakeDefault
+		}
+	}
+	if warning == "" {
+		return about
+	}
+	if about = strings.TrimSpace(about); about == "" {
+		return warning
+	}
+	return warning + "\n\n" + about
+}

internal/rpc/convert_users.go

@@ -52,6 +52,8 @@ func tgUser(u domain.User) *tg.User {
 		Username:      u.Username,
 		Phone:         u.Phone,
 		Verified:      u.Verified,
+		Scam:          u.Scam,
+		Fake:          u.Fake,
 		Support:       u.Support,
 		Contact:       u.Contact,
 		MutualContact: u.Mutual,

internal/rpc/payments_star_gifts.go

@@ -269,9 +269,9 @@ func (r *Router) sendStarGiftMemoryPurchase(ctx context.Context, userID int64, p
 	var updates *tg.Updates
 	switch peer.Type {
 	case domain.PeerTypeUser:
-		updates, err = r.sendStarGiftToUser(ctx, userID, peer.ID, gift, inv.HideName, giftMessage, upgradeStars)
+		_, updates, err = r.sendStarGiftToUser(ctx, userID, peer.ID, gift, inv.HideName, giftMessage, upgradeStars)
 	case domain.PeerTypeChannel:
-		updates, err = r.sendStarGiftToChannel(ctx, userID, peer.ID, gift, inv.HideName, giftMessage, upgradeStars)
+		_, updates, err = r.sendStarGiftToChannel(ctx, userID, peer.ID, gift, inv.HideName, giftMessage, upgradeStars)
 	default:
 		err = domain.ErrStarGiftInvalid
 	}
@@ -363,19 +363,19 @@ func (r *Router) sendStarsTopupForm(ctx context.Context, userID, formID int64, i
 	return &tg.PaymentsPaymentResult{Updates: starsBalanceUpdates(balance.Balance, r.clock.Now().Unix())}, nil
 }
 
-func (r *Router) sendStarGiftToUser(ctx context.Context, senderID, recipientID int64, gift domain.StarGift, hideName bool, message string, prepaidUpgradeStars int64) (*tg.Updates, error) {
+func (r *Router) sendStarGiftToUser(ctx context.Context, senderID, recipientID int64, gift domain.StarGift, hideName bool, message string, prepaidUpgradeStars int64) (domain.SavedStarGiftRef, *tg.Updates, error) {
 	prepaidUpgradeHash := ""
 	if prepaidUpgradeStars == 0 && gift.UpgradeStars > 0 && gift.UpgradeIssued < gift.UpgradeTotal {
 		var token [32]byte
 		if _, err := rand.Read(token[:]); err != nil {
-			return nil, err
+			return domain.SavedStarGiftRef{}, nil, err
 		}
 		prepaidUpgradeHash = base64.RawURLEncoding.EncodeToString(token[:])
 	}
 	// 2. 投递礼物服务消息到收礼人私聊（双盒 + 推送）。
 	send, err := r.deliverStarGift(ctx, senderID, recipientID, gift, hideName, message, prepaidUpgradeStars, prepaidUpgradeHash)
 	if err != nil {
-		return nil, err
+		return domain.SavedStarGiftRef{}, nil, err
 	}
 	// 3. 记账：收礼人收到一份礼物实例（msg_id = 收礼人侧消息 id）。
 	if _, err := r.deps.Gifts.RecordSavedGift(ctx, domain.SavedStarGift{
@@ -392,17 +392,18 @@ func (r *Router) sendStarGiftToUser(ctx context.Context, senderID, recipientID i
 		PrepaidUpgradeHash:  prepaidUpgradeHash,
 		Message:             message,
 	}); err != nil {
-		return nil, err
+		return domain.SavedStarGiftRef{}, nil, err
 	}
 	// 收礼人 stargifts_count 变化 → 失效其 userFull 投影，资料页 Gifts 区段才会出现。
 	r.invalidateRPCProjectionForUser(recipientID)
 
+	ref := domain.SavedStarGiftRef{Owner: domain.Peer{Type: domain.PeerTypeUser, ID: recipientID}, MsgID: send.RecipientMessage.ID}
 	users := r.usersForMessageUpdate(ctx, senderID, send.SenderMessage)
 	chats := r.chatsForMessageUpdate(ctx, senderID, send.SenderMessage)
-	return tgPrivateMessageUpdates(send.SenderEvent, send.SenderMessage, 0, false, users, chats), nil
+	return ref, tgPrivateMessageUpdates(send.SenderEvent, send.SenderMessage, 0, false, users, chats), nil
 }
 
-func (r *Router) sendStarGiftToChannel(ctx context.Context, senderID, channelID int64, gift domain.StarGift, hideName bool, message string, prepaidUpgradeStars int64) (*tg.Updates, error) {
+func (r *Router) sendStarGiftToChannel(ctx context.Context, senderID, channelID int64, gift domain.StarGift, hideName bool, message string, prepaidUpgradeStars int64) (domain.SavedStarGiftRef, *tg.Updates, error) {
 	now := int(r.clock.Now().Unix())
 	sticker := gift.Sticker
 	action := domain.ChannelMessageAction{
@@ -438,7 +439,7 @@ func (r *Router) sendStarGiftToChannel(ctx context.Context, senderID, channelID
 		Message:             message,
 	})
 	if err != nil {
-		return nil, err
+		return domain.SavedStarGiftRef{}, nil, err
 	}
 	action.StarGift.PeerChannelID = channelID
 	action.StarGift.SavedID = savedID
@@ -451,7 +452,8 @@ func (r *Router) sendStarGiftToChannel(ctx context.Context, senderID, channelID
 		)
 	}
 	r.invalidateRPCProjectionForChannel(channelID)
-	return nil, nil
+	ref := domain.SavedStarGiftRef{Owner: domain.Peer{Type: domain.PeerTypeChannel, ID: channelID}, SavedID: savedID}
+	return ref, nil, nil
 }
 
 // deliverStarGift 经 SendPrivateText 把 messageActionStarGift 服务消息投递到收礼人私聊。

internal/rpc/payments_star_gifts_admin.go

@@ -0,0 +1,99 @@
+package rpc
+
+import (
+	"context"
+	"fmt"
+
+	"telesrv/internal/domain"
+)
+
+// AdminGrantStarGift delivers a catalog gift to a recipient peer on behalf of
+// grant.SenderID without charging any Stars. It powers the admin console "Give
+// gift" action: the gift is loaded from the catalog and delivered through the
+// exact same path a paid send uses (messageActionStarGift service message for
+// users, saved-gift + admin log for channels), only the Stars debit is skipped.
+//
+// When SenderID is zero the official system account (777000, the telesrv
+// service account) is used as the sender. When Upgrade is true the granted gift
+// is immediately upgraded to a genuine collectible (unique) gift. The optional
+// ModelAttributeID / PatternAttributeID / BackdropAttributeID / Num pin specific
+// collectible facts (0 => random model/pattern/backdrop, auto sequential
+// number); the DB constraints remain the source of truth. Upgraded delivery is
+// supported for user recipients only.
+func (r *Router) AdminGrantStarGift(ctx context.Context, grant domain.AdminStarGiftGrant) error {
+	senderID := grant.SenderID
+	if senderID <= 0 {
+		senderID = domain.OfficialSystemUserID
+	}
+	if grant.GiftID <= 0 {
+		return fmt.Errorf("gift_id is required")
+	}
+	if grant.Recipient.ID <= 0 {
+		return fmt.Errorf("recipient is required")
+	}
+	if r.deps.Gifts == nil {
+		return fmt.Errorf("gifts dependency is not configured")
+	}
+	gift, ok, err := r.deps.Gifts.GiftByID(ctx, grant.GiftID)
+	if err != nil {
+		return err
+	}
+	if !ok {
+		return fmt.Errorf("gift %d not found", grant.GiftID)
+	}
+	if grant.Upgrade {
+		return r.adminGrantUpgradedStarGift(ctx, senderID, gift, grant)
+	}
+	switch grant.Recipient.Type {
+	case domain.PeerTypeUser:
+		_, _, err = r.sendStarGiftToUser(ctx, senderID, grant.Recipient.ID, gift, grant.HideName, grant.Message, 0)
+		return err
+	case domain.PeerTypeChannel:
+		_, _, err = r.sendStarGiftToChannel(ctx, senderID, grant.Recipient.ID, gift, grant.HideName, grant.Message, 0)
+		return err
+	default:
+		return fmt.Errorf("unsupported recipient peer type %q", grant.Recipient.Type)
+	}
+}
+
+// adminGrantUpgradedStarGift grants a base gift carrying a prepaid upgrade
+// entitlement and then mints the collectible via the standard zero-charge
+// prepaid upgrade path, so the recipient ends up owning a real unique gift with
+// the requested (or random) attributes and number.
+func (r *Router) adminGrantUpgradedStarGift(ctx context.Context, senderID int64, gift domain.StarGift, grant domain.AdminStarGiftGrant) error {
+	if grant.Recipient.Type != domain.PeerTypeUser {
+		return fmt.Errorf("upgraded gift delivery is supported for user recipients only")
+	}
+	preview, found, err := r.deps.Gifts.CollectiblePreview(ctx, gift.ID)
+	if err != nil {
+		return err
+	}
+	if !found || preview.UpgradeStars <= 0 {
+		return fmt.Errorf("gift %d has no published collectible upgrade", gift.ID)
+	}
+	if preview.Issued >= preview.SupplyTotal {
+		return fmt.Errorf("gift %d collectible supply is exhausted", gift.ID)
+	}
+	// Grant the base gift with a prepaid-upgrade entitlement so the upgrade
+	// below runs on the zero-charge RequirePrepaid path.
+	ref, _, err := r.sendStarGiftToUser(ctx, senderID, grant.Recipient.ID, gift, grant.HideName, grant.Message, preview.UpgradeStars)
+	if err != nil {
+		return err
+	}
+	commandKey := fmt.Sprintf("admin-grant-upgrade:%d:%d:%d", grant.Recipient.ID, gift.ID, ref.MsgID)
+	if _, err := r.deps.Gifts.Upgrade(ctx, domain.StarGiftUpgradeRequest{
+		UserID:              grant.Recipient.ID,
+		Ref:                 ref,
+		RequirePrepaid:      true,
+		CommandKey:          commandKey,
+		Date:                int(r.clock.Now().Unix()),
+		ModelAttributeID:    grant.ModelAttributeID,
+		PatternAttributeID:  grant.PatternAttributeID,
+		BackdropAttributeID: grant.BackdropAttributeID,
+		Num:                 grant.Num,
+	}); err != nil {
+		return err
+	}
+	r.invalidateStarGiftOwnerProjection(grant.Recipient)
+	return nil
+}

internal/rpc/users.go

@@ -247,6 +247,11 @@ func (r *Router) buildUserFullProjection(ctx context.Context, currentUserID int6
 			about = ""
 		}
 	}
+	// Surface the scam/fake warning to other viewers (never to the account
+	// itself), non-destructively over the projected About.
+	if u.ID != currentUserID {
+		about = aboutWithModerationWarning(about, defaultScamWarningUser, defaultFakeWarningUser, u.Scam, u.Fake)
+	}
 	full := tg.UserFull{
 		ID:             u.ID,
 		About:          about,