fix document 500 error and fix users tabel for bot

apps/api-gateway/src/controllers/admin.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, ForbiddenException, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
+import { firstValueFrom } from 'rxjs';
 import { map } from 'rxjs';
 import { CoreGrpcService } from '../core-grpc.service';
 import { CurrentAdmin } from '../decorators/current-admin.decorator';
@@ -76,6 +77,38 @@ export class AdminController {
     return this.core.admin.SetSuperAdmin({ actorUserId: admin.id, userId, isSuperAdmin: dto.isSuperAdmin });
   }
 
+  @Get('bot-accounts')
+  @ApiOperation({ summary: 'Системные учётные записи ботов', description: 'Возвращает пользователей, связанных с Telegram-ботами (BotFather и боты пользователей).' })
+  listBotAccounts(@Query() query: ListUsersQueryDto, @CurrentAdmin() admin: AdminRequestUser) {
+    if (!admin.canViewUsers && !admin.canManageUsers && !admin.isSuperAdmin && !admin.permissions.includes('bots.manage.all')) {
+      throw new ForbiddenException('Недостаточно прав для просмотра ботов');
+    }
+    return this.core.admin.ListBotAccounts(query).pipe(
+      map((response) => {
+        const payload = response as { users?: Array<{ roles?: string[] }> };
+        return {
+          users: (payload.users ?? []).map((user) => ({
+            ...user,
+            roles: user.roles ?? []
+          }))
+        };
+      })
+    );
+  }
+
+  @Post(':userId/totp/admin-disable')
+  @UseGuards(SuperAdminGuard)
+  @ApiOperation({ summary: 'Отключить 2FA пользователя', description: 'Супер-администратор может принудительно отключить TOTP без кода пользователя.' })
+  @ApiParam({ name: 'userId', description: 'ID пользователя' })
+  adminDisableTotp(@Param('userId') userId: string, @CurrentAdmin() admin: AdminRequestUser) {
+    return firstValueFrom(
+      this.core.security.AdminDisableTotp({
+        actorUserId: admin.id,
+        userId
+      })
+    );
+  }
+
   @Patch(':userId/verification')
   @ApiOperation({ summary: 'Верифицировать или снять верификацию', description: 'Требуется право users.verify.' })
   @ApiParam({ name: 'userId', description: 'ID пользователя' })

apps/api-gateway/src/controllers/documents.controller.ts

@@ -2,7 +2,6 @@ import { Body, Controller, Delete, Get, Headers, Param, Patch, Post } from '@nes
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';
 import { JwtService } from '@nestjs/jwt';
 import { firstValueFrom } from 'rxjs';
-import { map } from 'rxjs';
 import { CoreGrpcService } from '../core-grpc.service';
 import { assertDocumentsReadAccess, assertDocumentsWriteAccess } from '../document-access';
 import { CreateDocumentDto, UpdateDocumentDto } from '../dto/documents.dto';
@@ -43,14 +42,10 @@ export class DocumentsController {
   @ApiParam({ name: 'userId', description: 'ID пользователя' })
   async list(@Headers('authorization') authorization: string | undefined, @Param('userId') userId: string) {
     await assertDocumentsReadAccess(this.jwt, this.core, authorization, userId);
-    return firstValueFrom(
-      this.core.documents.ListDocuments({ userId }).pipe(
-        map((response) => {
-          const payload = response as { documents?: unknown[] };
-          return { documents: payload.documents ?? [] };
-        })
-      )
-    );
+    const result = (await firstValueFrom(this.core.documents.ListDocuments({ userId }))) as {
+      documents?: unknown[];
+    };
+    return { documents: result.documents ?? [] };
   }
 
   @Get(':documentId')

apps/api-gateway/src/document-access.ts

@@ -13,6 +13,11 @@ interface RequesterProfile {
 async function getRequesterProfile(jwt: JwtService, core: CoreGrpcService, authorization?: string): Promise<RequesterProfile> {
   const payload = await verifyAccessToken(jwt, authorization);
   await assertSessionUnlocked(core, payload);
+
+  if (payload.isSuperAdmin) {
+    return { id: payload.sub, isSuperAdmin: true, canViewUserDocuments: true };
+  }
+
   const profile = (await firstValueFrom(core.auth.GetMe({ userId: payload.sub }))) as RequesterProfile & { id: string };
   return { id: profile.id, isSuperAdmin: profile.isSuperAdmin, canViewUserDocuments: profile.canViewUserDocuments };
 }