v1.6.0: max_bot fixes — feature keys, flush→commit, test-run, categories, broadcast page, proxy error handling, deploy scripts

max_bot/tests/conftest.py

@@ -0,0 +1,78 @@
+import os
+os.environ["WEBHOOK_SECRET"] = "test-secret"
+os.environ["DATABASE_URL"] = "sqlite+aiosqlite://"
+os.environ["APP_ENV"] = "test"
+
+import asyncio
+from typing import AsyncGenerator
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+import pytest_asyncio
+from httpx import ASGITransport, AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
+
+from app.config import Settings, get_settings
+from app.database import get_db
+from app.models.models import Base
+
+get_settings.cache_clear()
+from app.main import app  # noqa: E402
+
+
+@pytest.fixture(scope="session")
+def event_loop():
+    loop = asyncio.new_event_loop()
+    yield loop
+    loop.close()
+
+
+@pytest_asyncio.fixture(scope="session")
+async def test_engine():
+    engine = create_async_engine("sqlite+aiosqlite://", echo=False)
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+    yield engine
+    await engine.dispose()
+
+
+@pytest_asyncio.fixture
+async def test_session(test_engine) -> AsyncGenerator[AsyncSession, None]:
+    TestSession = async_sessionmaker(test_engine, expire_on_commit=False)
+    async with TestSession() as session:
+        yield session
+
+
+@pytest_asyncio.fixture
+async def client(test_session: AsyncSession) -> AsyncGenerator:
+    async def override_get_db() -> AsyncGenerator[AsyncSession, None]:
+        yield test_session
+
+    app.dependency_overrides[get_db] = override_get_db
+
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as ac:
+        yield ac
+
+    app.dependency_overrides.clear()
+
+
+@pytest.fixture
+def mock_max_api():
+    mock = AsyncMock()
+    mock.send_message = AsyncMock(return_value={"ok": True})
+    mock.send_message_with_keyboard = AsyncMock(return_value={"ok": True})
+    mock.send_file = AsyncMock(return_value={"ok": True})
+    mock.get_file_url = AsyncMock(return_value="https://example.com/file")
+    mock.send_contact_request = AsyncMock(return_value={"ok": True})
+    mock.answer_callback = AsyncMock(return_value={"ok": True})
+    mock.get_me = AsyncMock(return_value={"ok": True, "bot": "test"})
+    mock.subscribe_webhook = AsyncMock(return_value={"ok": True})
+    mock.verify_webhook_secret = MagicMock(return_value=True)
+    mock.verify_contact_hash = MagicMock(return_value=True)
+    return mock
+
+
+@pytest.fixture
+def bot():
+    return None

max_bot/tests/test_fsm.py

@@ -0,0 +1,168 @@
+from app.fsm import BotState, FSM, STATE_TRANSITIONS
+
+
+class TestFSM:
+    def test_initial_state(self):
+        FSM.clear_all()
+        assert FSM.get_state(1) == BotState.IDLE
+
+    def test_set_and_get_state(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.NAME_REQUEST)
+        assert FSM.get_state(1) == BotState.NAME_REQUEST
+
+    def test_reset(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.NAME_REQUEST)
+        FSM.reset(1)
+        assert FSM.get_state(1) == BotState.IDLE
+
+    def test_valid_transition(self):
+        FSM.clear_all()
+        result = FSM.transition(1, "start")
+        assert result == BotState.NAME_REQUEST
+
+    def test_invalid_transition_returns_same(self):
+        FSM.clear_all()
+        # From IDLE, "unknown" should keep us at IDLE
+        result = FSM.transition(1, "unknown_event")
+        assert result == BotState.IDLE
+
+    def test_can_transition_true(self):
+        FSM.clear_all()
+        assert FSM.can_transition(1, "start") is True
+
+    def test_can_transition_false(self):
+        FSM.clear_all()
+        assert FSM.can_transition(1, "unknown_event") is False
+
+    def test_full_greeting_flow(self):
+        FSM.clear_all()
+        assert FSM.transition(1, "start") == BotState.NAME_REQUEST
+        assert FSM.transition(1, "name_provided") == BotState.CONSENT_REQUEST
+        assert FSM.transition(1, "consent_given") == BotState.CONTACT_REQUEST
+        assert FSM.transition(1, "contact_provided") == BotState.INQUIRY_REQUEST
+        assert FSM.transition(1, "inquiry_provided") == BotState.CATEGORY_SELECT
+        assert FSM.transition(1, "category_selected") == BotState.CONFIRMATION
+        assert FSM.transition(1, "done") == BotState.IDLE
+
+    def test_consent_refused_flow(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.CONSENT_REQUEST)
+        assert FSM.transition(1, "consent_refused") == BotState.IDLE
+
+    def test_handoff_flow(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.HANDOFF_REQUEST)
+        assert FSM.transition(1, "confirmed") == BotState.HANDOFF_CONFIRMATION
+        assert FSM.transition(1, "done") == BotState.IDLE
+
+    def test_handoff_cancel_to_menu(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.HANDOFF_REQUEST)
+        assert FSM.transition(1, "cancel") == BotState.MAIN_MENU
+
+    def test_main_menu_new_inquiry(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "new_inquiry") == BotState.NAME_REQUEST
+
+    def test_main_menu_features(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_risk_score") == BotState.FEATURE_RISK_SCORE
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_sla_status") == BotState.FEATURE_SLA_STATUS
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_photo_report") == BotState.FEATURE_PHOTO_REPORT
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_appointment") == BotState.FEATURE_APPOINTMENT
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_quality_rate") == BotState.FEATURE_QUALITY_RATE
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_commercial") == BotState.FEATURE_COMMERCIAL
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "feature_my_objects") == BotState.FEATURE_MY_OBJECTS
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "sla_ticket_create") == BotState.SLA_TICKET_CREATE
+
+    def test_feature_done_returns_to_menu(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.FEATURE_RISK_SCORE)
+        assert FSM.transition(1, "done") == BotState.MAIN_MENU
+        FSM.set_state(1, BotState.FEATURE_RISK_SCORE)
+        assert FSM.transition(1, "cancel") == BotState.MAIN_MENU
+
+    def test_out_of_hours_flow(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.OUT_OF_HOURS)
+        assert FSM.transition(1, "leave_message") == BotState.INQUIRY_REQUEST
+        FSM.set_state(1, BotState.OUT_OF_HOURS)
+        assert FSM.transition(1, "callback") == BotState.NAME_REQUEST
+        FSM.set_state(1, BotState.OUT_OF_HOURS)
+        assert FSM.transition(1, "cancel") == BotState.IDLE
+        FSM.set_state(1, BotState.OUT_OF_HOURS)
+        assert FSM.transition(1, "main_menu") == BotState.MAIN_MENU
+
+    def test_category_select_flow(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.CATEGORY_SELECT)
+        assert FSM.transition(1, "category_selected") == BotState.CONFIRMATION
+        FSM.set_state(1, BotState.CATEGORY_SELECT)
+        assert FSM.transition(1, "cancel") == BotState.IDLE
+
+    def test_kb_search_found(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.KB_SEARCH)
+        assert FSM.transition(1, "found") == BotState.MAIN_MENU
+        FSM.set_state(1, BotState.KB_SEARCH)
+        assert FSM.transition(1, "not_found") == BotState.INQUIRY_REQUEST
+
+    def test_waiting_1c_response(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.WAITING_1C_RESPONSE)
+        assert FSM.transition(1, "received") == BotState.MAIN_MENU
+        FSM.set_state(1, BotState.WAITING_1C_RESPONSE)
+        assert FSM.transition(1, "timeout") == BotState.IDLE
+
+    def test_rating_flow(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.AWAITING_RATING)
+        assert FSM.transition(1, "rating_provided") == BotState.IDLE
+
+    def test_new_user_start_via_callback(self):
+        FSM.clear_all()
+        # Simulate callback: from MAIN_MENU, cancel goes to IDLE
+        FSM.set_state(1, BotState.MAIN_MENU)
+        assert FSM.transition(1, "cancel") == BotState.IDLE
+
+    def test_idle_handoff_event(self):
+        FSM.clear_all()
+        assert FSM.transition(1, "handoff") == BotState.HANDOFF_REQUEST
+
+    def test_edit_from_confirmation(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.CONFIRMATION)
+        assert FSM.transition(1, "edit_name") == BotState.NAME_REQUEST
+        FSM.set_state(1, BotState.CONFIRMATION)
+        assert FSM.transition(1, "edit_contact") == BotState.CONTACT_REQUEST
+        FSM.set_state(1, BotState.CONFIRMATION)
+        assert FSM.transition(1, "edit_inquiry") == BotState.INQUIRY_REQUEST
+
+    def test_clear_all(self):
+        FSM.clear_all()
+        FSM.set_state(1, BotState.NAME_REQUEST)
+        FSM.set_state(2, BotState.CONSENT_REQUEST)
+        FSM.clear_all()
+        assert FSM.get_state(1) == BotState.IDLE
+        assert FSM.get_state(2) == BotState.IDLE
+
+    def test_all_states_have_transitions(self):
+        for state in BotState:
+            assert state in STATE_TRANSITIONS, f"{state} missing from STATE_TRANSITIONS"
+
+    def test_all_transitions_go_to_valid_states(self):
+        for state, events in STATE_TRANSITIONS.items():
+            for event, target in events.items():
+                assert target in BotState.__members__.values(), \
+                    f"{state}.{event} -> {target} is not a valid BotState"

max_bot/tests/test_handlers.py

@@ -0,0 +1,179 @@
+import pytest
+from unittest.mock import AsyncMock
+
+from app.fsm import BotState, FSM
+from app.handlers.greeting import handle_start
+from app.handlers.consent import handle_consent_request, handle_consent_given, handle_consent_refused
+from app.handlers.main_menu import handle_main_menu
+from app.settings_cache import SettingsCache
+
+
+@pytest.mark.asyncio
+async def test_handle_start_new_user(test_session, mock_max_api, bot):
+    FSM.clear_all()
+    user_data = {"user_id": 12345, "first_name": "Иван", "last_name": "Петров"}
+
+    await SettingsCache.refresh(test_session)
+    await handle_start(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    call_args = mock_max_api.send_message_with_keyboard.call_args
+    assert call_args[0][0] == 12345
+    assert FSM.get_state(12345) == BotState.IDLE
+
+
+@pytest.mark.asyncio
+async def test_handle_start_returning_user(test_session, mock_max_api, bot):
+    from app.conversation import get_or_create_user, create_conversation
+    FSM.clear_all()
+    user_data = {"user_id": 67890, "first_name": "Пётр"}
+
+    user = await get_or_create_user(test_session, 67890, "Пётр")
+    await test_session.flush()
+    await create_conversation(test_session, user.id)
+    await test_session.flush()
+
+    await SettingsCache.refresh(test_session)
+    await handle_start(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(67890) == BotState.IDLE
+
+
+@pytest.mark.asyncio
+async def test_handle_consent_request(test_session, mock_max_api, bot):
+    FSM.clear_all()
+    user_data = {"user_id": 111, "first_name": "Анна"}
+
+    await SettingsCache.refresh(test_session)
+    await handle_consent_request(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(111) == BotState.CONSENT_REQUEST
+
+
+@pytest.mark.asyncio
+async def test_handle_consent_given(test_session, mock_max_api, bot):
+    from app.conversation import get_or_create_user
+    FSM.clear_all()
+    user_data = {"user_id": 222}
+
+    user = await get_or_create_user(test_session, 222)
+    await test_session.flush()
+
+    await handle_consent_given(bot, user_data, test_session, mock_max_api)
+
+    assert user.consent_given is True
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(222) == BotState.CONTACT_REQUEST
+
+
+@pytest.mark.asyncio
+async def test_handle_consent_refused(test_session, mock_max_api, bot):
+    from app.conversation import get_or_create_user
+    FSM.clear_all()
+    user_data = {"user_id": 333}
+
+    user = await get_or_create_user(test_session, 333)
+    await test_session.flush()
+
+    await SettingsCache.refresh(test_session)
+    await handle_consent_refused(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(333) == BotState.IDLE
+
+
+@pytest.mark.asyncio
+async def test_handle_main_menu_new_inquiry_without_consent(test_session, mock_max_api, bot):
+    FSM.clear_all()
+    user_data = {"user_id": 444, "payload": "new_inquiry"}
+
+    await SettingsCache.refresh(test_session)
+    await handle_main_menu(bot, user_data, test_session, mock_max_api)
+
+    # Should go to consent request
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_handle_main_menu_cancel(test_session, mock_max_api, bot):
+    FSM.clear_all()
+    user_data = {"user_id": 555, "payload": "cancel"}
+
+    await SettingsCache.refresh(test_session)
+    await handle_main_menu(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(555) == BotState.IDLE
+
+
+@pytest.mark.asyncio
+async def test_handle_main_menu_unknown_payload(test_session, mock_max_api, bot):
+    FSM.clear_all()
+    user_data = {"user_id": 666, "payload": "unknown_command"}
+
+    await SettingsCache.refresh(test_session)
+    await handle_main_menu(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(666) == BotState.IDLE
+
+
+@pytest.mark.asyncio
+async def test_handle_main_menu_handoff(test_session, mock_max_api, bot):
+    from app.conversation import get_or_create_user
+    from app.handlers.handoff import handle_handoff_request
+    FSM.clear_all()
+    user_data = {"user_id": 668, "payload": "handoff"}
+
+    await get_or_create_user(test_session, 668, "Тест")
+    await test_session.flush()
+
+    await SettingsCache.refresh(test_session)
+    # Call directly (goes to out_of_hours if after hours, or handoff template)
+    await handle_handoff_request(bot, user_data, test_session, mock_max_api)
+
+    # Either send_message (handoff) or send_message_with_keyboard (out_of_hours)
+    assert mock_max_api.send_message.called or mock_max_api.send_message_with_keyboard.called
+
+
+@pytest.mark.asyncio
+async def test_handle_out_of_hours(test_session, mock_max_api, bot):
+    from app.handlers.out_of_hours import handle_out_of_hours
+    FSM.clear_all()
+    user_data = {"user_id": 777}
+
+    await SettingsCache.refresh(test_session)
+    await handle_out_of_hours(bot, user_data, test_session, mock_max_api)
+
+    mock_max_api.send_message_with_keyboard.assert_called_once()
+    assert FSM.get_state(777) == BotState.OUT_OF_HOURS
+
+
+@pytest.mark.asyncio
+async def test_handle_out_of_hours_leave_message(test_session, mock_max_api, bot):
+    from app.handlers.out_of_hours import handle_out_of_hours_callback
+    FSM.clear_all()
+    user_data = {"user_id": 888, "text": "тестовое обращение"}
+    FSM.set_state(888, BotState.OUT_OF_HOURS)
+
+    await SettingsCache.refresh(test_session)
+    await handle_out_of_hours_callback(bot, user_data, test_session, mock_max_api, "leave_message")
+
+    # handle_inquiry completes the flow → ends at CONFIRMATION
+    assert FSM.get_state(888) == BotState.CONFIRMATION
+
+
+@pytest.mark.asyncio
+async def test_handle_out_of_hours_callback_request(test_session, mock_max_api, bot):
+    from app.handlers.out_of_hours import handle_out_of_hours_callback
+    FSM.clear_all()
+    user_data = {"user_id": 999}
+    FSM.set_state(999, BotState.OUT_OF_HOURS)
+
+    await SettingsCache.refresh(test_session)
+    await handle_out_of_hours_callback(bot, user_data, test_session, mock_max_api, "callback")
+
+    mock_max_api.send_message.assert_called_once()
+    assert FSM.get_state(999) == BotState.NAME_REQUEST

max_bot/tests/test_max_api.py

@@ -0,0 +1,134 @@
+from unittest.mock import AsyncMock, patch, MagicMock
+
+import pytest
+
+from app.max_api import MaxAPIClient
+
+
+@pytest.fixture
+def api():
+    return MaxAPIClient(token="test-token")
+
+
+@pytest.mark.asyncio
+async def test_send_message(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.send_message(user_id=123, text="Hello")
+    assert result == {"ok": True}
+    api._request.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_send_message_with_chat_id(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.send_message(chat_id=456, text="Hello")
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_send_message_with_keyboard(api):
+    api.send_message = AsyncMock(return_value={"ok": True})
+    buttons = [[{"type": "message", "text": "Test", "payload": "test"}]]
+    result = await api.send_message_with_keyboard(user_id=123, text="Menu", buttons=buttons)
+    assert result == {"ok": True}
+    api.send_message.assert_called_once()
+    _, kwargs = api.send_message.call_args
+    assert kwargs["user_id"] == 123
+    assert kwargs["text"] == "Menu"
+    assert len(kwargs["attachments"]) == 1
+
+
+@pytest.mark.asyncio
+async def test_get_me(api):
+    api._request = AsyncMock(return_value={"ok": True, "bot": "test"})
+    result = await api.get_me()
+    assert result["bot"] == "test"
+
+
+@pytest.mark.asyncio
+async def test_subscribe_webhook(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.subscribe_webhook(url="https://example.com/webhook", secret="secret123")
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_answer_callback(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.answer_callback(callback_id="cb_123", text="Thanks")
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_send_file(api):
+    api.upload_file = AsyncMock(return_value={"file_id": "file_123"})
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.send_file(user_id=123, file_path="/tmp/test.pdf", caption="Here")
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_get_file_url(api):
+    api._request = AsyncMock(return_value={"url": "https://example.com/file.pdf"})
+    result = await api.get_file_url("file_123")
+    assert result == "https://example.com/file.pdf"
+
+
+@pytest.mark.asyncio
+async def test_send_contact_request(api):
+    api.send_message = AsyncMock(return_value={"ok": True})
+    result = await api.send_contact_request(user_id=123)
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_edit_message(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.edit_message(message_id=1, text="Updated")
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_get_subscriptions(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.get_subscriptions()
+    assert result == {"ok": True}
+
+
+@pytest.mark.asyncio
+async def test_unsubscribe_webhook(api):
+    api._request = AsyncMock(return_value={"ok": True})
+    result = await api.unsubscribe_webhook()
+    assert result == {"ok": True}
+
+
+def test_verify_webhook_secret_valid(api):
+    assert api.verify_webhook_secret("secret123", "secret123") is True
+
+
+def test_verify_webhook_secret_invalid(api):
+    assert api.verify_webhook_secret("wrong", "secret123") is False
+
+
+def test_verify_webhook_secret_empty(api):
+    assert api.verify_webhook_secret("anything", "") is True
+
+
+def test_verify_contact_hash(api):
+    result = api.verify_contact_hash("test vcf", "access_token", "some_hash")
+    assert result is False or result is True
+
+
+def test_headers(api):
+    headers = api._headers()
+    assert headers["Authorization"] == "test-token"
+    assert headers["Content-Type"] == "application/json"
+
+
+@pytest.mark.asyncio
+async def test_close(api):
+    session = AsyncMock()
+    session.closed = False
+    api._session = session
+    await api.close()
+    session.close.assert_awaited_once()

max_bot/tests/test_webhook.py

@@ -0,0 +1,183 @@
+import json
+
+import pytest
+
+
+class TestWebhook:
+    @pytest.mark.asyncio
+    async def test_health_endpoint(self, client):
+        response = await client.get("/health")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["status"] == "ok"
+        assert data["bot"] == "София"
+
+    @pytest.mark.asyncio
+    async def test_webhook_missing_secret(self, client):
+        payload = {"update_type": "bot_started", "user": {"user_id": 123}}
+        response = await client.post(
+            "/webhook",
+            content=json.dumps(payload),
+            headers={"Content-Type": "application/json"},
+        )
+        assert response.status_code == 403
+
+    @pytest.mark.asyncio
+    async def test_webhook_with_secret(self, client):
+        payload = {"update_type": "bot_started", "user": {"user_id": 12345}}
+        response = await client.post(
+            "/webhook",
+            content=json.dumps(payload),
+            headers={
+                "Content-Type": "application/json",
+                "X-Max-Bot-Api-Secret": "test-secret",
+            },
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["ok"] is True
+
+    @pytest.mark.asyncio
+    async def test_webhook_message_created(self, client):
+        payload = {
+            "update_type": "message_created",
+            "user": {"user_id": 99999, "first_name": "Тест"},
+            "message": {"body": {"text": "Привет"}},
+        }
+        response = await client.post(
+            "/webhook",
+            content=json.dumps(payload),
+            headers={
+                "Content-Type": "application/json",
+                "X-Max-Bot-Api-Secret": "test-secret",
+            },
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["ok"] is True
+
+    @pytest.mark.asyncio
+    async def test_webhook_invalid_json(self, client):
+        response = await client.post(
+            "/webhook",
+            content="not json",
+            headers={
+                "Content-Type": "application/json",
+                "X-Max-Bot-Api-Secret": "test-secret",
+            },
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["ok"] is False
+
+    @pytest.mark.asyncio
+    async def test_webhook_message_callback(self, client):
+        payload = {
+            "update_type": "message_callback",
+            "user": {"user_id": 88888},
+            "callback": {"payload": "cancel", "id": "cb_001"},
+        }
+        response = await client.post(
+            "/webhook",
+            content=json.dumps(payload),
+            headers={
+                "Content-Type": "application/json",
+                "X-Max-Bot-Api-Secret": "test-secret",
+            },
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["ok"] is True
+
+
+class TestAPI:
+    @pytest.mark.asyncio
+    async def test_api_settings(self, client):
+        response = await client.get("/api/bot/settings")
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_api_features(self, client):
+        response = await client.get("/api/bot/features")
+        assert response.status_code == 200
+        data = response.json()
+        assert isinstance(data, list)
+
+    @pytest.mark.asyncio
+    async def test_api_categories(self, client):
+        response = await client.get("/api/bot/categories")
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_api_templates(self, client):
+        response = await client.get("/api/bot/templates")
+        assert response.status_code == 200
+
+    @pytest.mark.asyncio
+    async def test_api_users(self, client):
+        response = await client.get("/api/bot/users")
+        assert response.status_code == 200
+        data = response.json()
+        assert "total" in data
+        assert "users" in data
+
+    @pytest.mark.asyncio
+    async def test_api_conversations(self, client):
+        response = await client.get("/api/bot/conversations")
+        assert response.status_code == 200
+        data = response.json()
+        assert isinstance(data, list)
+
+    @pytest.mark.asyncio
+    async def test_api_analytics(self, client):
+        response = await client.get("/api/bot/analytics")
+        assert response.status_code == 200
+        data = response.json()
+        assert "total_users" in data
+
+    @pytest.mark.asyncio
+    async def test_api_test_run(self, client):
+        response = await client.post(
+            "/api/bot/test-run",
+            content=json.dumps({"scenario": "new_dialog", "messages": []}),
+            headers={"Content-Type": "application/json"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["scenario"] == "new_dialog"
+
+    @pytest.mark.asyncio
+    async def test_api_test_run_out_of_hours(self, client):
+        response = await client.post(
+            "/api/bot/test-run",
+            content=json.dumps({"scenario": "out_of_hours", "messages": []}),
+            headers={"Content-Type": "application/json"},
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["scenario"] == "out_of_hours"
+        # Should have at least a bot response and mention out_of_hours template
+        assert len(data.get("conversation", [])) >= 1
+
+    @pytest.mark.asyncio
+    async def test_api_broadcast_recipients(self, client):
+        response = await client.get("/api/bot/broadcast/recipients")
+        assert response.status_code == 200
+        data = response.json()
+        assert "total" in data
+        assert "users" in data
+
+    @pytest.mark.asyncio
+    async def test_api_broadcast_history(self, client):
+        response = await client.get("/api/bot/broadcast/history")
+        assert response.status_code == 200
+        data = response.json()
+        assert "total" in data
+        assert "broadcasts" in data
+
+    @pytest.mark.asyncio
+    async def test_api_kb(self, client):
+        response = await client.get("/api/bot/kb")
+        assert response.status_code == 200
+        data = response.json()
+        assert isinstance(data, list)