feat(web): dashboard session deletion and E2E coverage for issue #150

- Add DeleteSessionAsync to ISessionStore/SessionService (unpublish portfolio card,
  remove bot-created empty forum topic, update batch message).
- Add DeleteSessionForCurrentUserAsync to AuthorizedSessionService with audit log.
- Add delete button + confirmation dialog to GroupDetails.razor.
- Extend dashboard Playwright tests with edit persistence and delete verification.
- Update AuthorizedSessionServiceTests with delete authorization coverage.
- Mark issue #150 as done in tests/e2e/README.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -6,7 +6,7 @@ on:
       - main 
 
 env:
-  VERSION: 3.11.0
+  VERSION: 3.11.3
 
 jobs:
   # ЧАСТЬ 1: Собираем образы и кладем в Gitea (чтобы делиться с ребятами)
@@ -110,6 +110,7 @@ jobs:
       - name: Scan Bot image
         run: |
           trivy image \
+            --timeout 30m \
             --severity HIGH,CRITICAL \
             --exit-code 1 \
             --format table \
@@ -118,6 +119,7 @@ jobs:
       - name: Scan Discord Bot image
         run: |
           trivy image \
+            --timeout 30m \
             --severity HIGH,CRITICAL \
             --exit-code 1 \
             --format table \
@@ -126,6 +128,7 @@ jobs:
       - name: Scan Web image
         run: |
           trivy image \
+            --timeout 30m \
             --severity HIGH,CRITICAL \
             --exit-code 1 \
             --format table \

Directory.Build.props

@@ -1,6 +1,6 @@
 <Project>
   <PropertyGroup>
-    <Version>3.11.0</Version>
+    <Version>3.11.3</Version>
     <TargetFramework>net10.0</TargetFramework>
     <LangVersion>preview</LangVersion>
     <Nullable>enable</Nullable>

README.md

@@ -4,7 +4,7 @@
 
 Проект разработан с упором на производительность, архитектуру Vertical Slice, Native AOT (для бота) и удобство развертывания с использованием .NET Aspire.
 
-**Текущая версия:** `v3.10.0`.
+**Текущая версия:** `v3.11.1`.
 
 ---
 
@@ -25,7 +25,7 @@
 - **🔄 Автоматическая синхронизация**: Любые изменения в веб-интерфейсе мгновенно обновляют сообщения с расписанием в подключенных Telegram- и Discord-каналах.
 
 ### Discord Bot
-- **Slash-команды `/newsession` и `/listsessions`**: GM создаёт сессии и публикует актуальное расписание прямо в Discord-канале.
+- **Slash-команды `/newsession` и `/listsessions`**: `/newsession` ведёт ГМа по тому же wizard, что и в Telegram: тип, система, длительность, дата, лимит мест, формат `Online`/`Offline`, ссылка или адрес, видимость и публикация. `/listsessions` показывает расписание и управление сессиями.
 - **Кнопки Join/Leave с ephemeral-ответами**: игроки нажимают Join/Leave в Discord-сообщении; бот отвечает ephemeral-сообщением и обновляет schedule message.
 - **RSVP (подтверждения) за 24ч до сессии**: scheduler публикует запрос подтверждения в Discord-канале, игроки отвечают кнопками, а GM получает итоги RSVP.
 - **DM-напоминания за 1ч и ссылки перед игрой**: one-hour reminders и join-link notifications отправляются в Discord DM при включённых личных уведомлениях; сбои DM логируются без публичного fallback.

compose.yaml

@@ -49,7 +49,7 @@ services:
         crond -f
 
   bot:
-    image: git.codeanddice.ru/toutsu/gmrelay-bot:3.11.0
+    image: git.codeanddice.ru/toutsu/gmrelay-bot:3.11.3
     restart: always
     depends_on:
       db:
@@ -67,7 +67,7 @@ services:
       retries: 3
 
   discord:
-    image: git.codeanddice.ru/toutsu/gmrelay-discord-bot:3.11.0
+    image: git.codeanddice.ru/toutsu/gmrelay-discord-bot:3.11.3
     restart: always
     depends_on:
       db:
@@ -86,7 +86,7 @@ services:
       retries: 3
 
   web:
-    image: git.codeanddice.ru/toutsu/gmrelay-web:3.11.0
+    image: git.codeanddice.ru/toutsu/gmrelay-web:3.11.3
     restart: always
     depends_on:
       db:

src/GmRelay.Bot/Features/Sessions/ListSessions/SessionListMessageRenderer.cs

@@ -23,11 +23,18 @@ internal static class SessionListMessageRenderer
 
     public static IReadOnlyList<PlatformMessageAction> RenderActions(IReadOnlyList<SessionListItemDto> sessions)
     {
-        if (sessions.Count == 0 || !sessions.First().CanManage)
+        if (sessions.Count == 0)
         {
             return [];
         }
 
+        return sessions.First().CanManage
+            ? RenderManagerActions(sessions)
+            : RenderPlayerActions(sessions);
+    }
+
+    private static IReadOnlyList<PlatformMessageAction> RenderManagerActions(IReadOnlyList<SessionListItemDto> sessions)
+    {
         var actions = new List<PlatformMessageAction>();
 
         foreach (var session in sessions)
@@ -36,19 +43,19 @@ internal static class SessionListMessageRenderer
 
             actions.Add(new PlatformMessageAction(
                 $"cancel_session:{session.Id}",
-                $"❌ {dateTitle}",
+                $"❌ Отменить {dateTitle}",
                 $"cancel_session:{session.Id}"));
 
             actions.Add(new PlatformMessageAction(
                 $"reschedule_session:{session.Id}",
-                $"⏰ {dateTitle}",
+                $"⏰ Перенести {dateTitle}",
                 $"reschedule_session:{session.Id}"));
 
             if (SessionCapacityRules.CanPromoteWaitlistedPlayer(session.MaxPlayers, session.PlayerCount, session.WaitlistCount))
             {
                 actions.Add(new PlatformMessageAction(
                     $"promote_waitlist:{session.Id}",
-                    $"⬆️ Из ожидания {dateTitle}",
+                    $"⬆️ С ожидания {dateTitle}",
                     $"promote_waitlist:{session.Id}"));
             }
 
@@ -60,4 +67,31 @@ internal static class SessionListMessageRenderer
 
         return actions;
     }
+
+    private static IReadOnlyList<PlatformMessageAction> RenderPlayerActions(IReadOnlyList<SessionListItemDto> sessions)
+    {
+        var actions = new List<PlatformMessageAction>();
+
+        foreach (var session in sessions)
+        {
+            var dateTitle = session.ScheduledAt.FormatMoscowShort();
+
+            if (session.IsUserActive || session.IsUserWaitlisted)
+            {
+                actions.Add(new PlatformMessageAction(
+                    $"leave_session:{session.Id}",
+                    session.IsUserWaitlisted ? $"✖️ Выйти из ожидания {dateTitle}" : $"✖️ Выйти {dateTitle}",
+                    $"leave_session:{session.Id}"));
+            }
+            else
+            {
+                actions.Add(new PlatformMessageAction(
+                    $"join_session:{session.Id}",
+                    $"✅ Записаться {dateTitle}",
+                    $"join_session:{session.Id}"));
+            }
+        }
+
+        return actions;
+    }
 }

src/GmRelay.Bot/Infrastructure/Telegram/TelegramCommandsSetupService.cs

@@ -0,0 +1,46 @@
+using Telegram.Bot;
+using Telegram.Bot.Types;
+
+namespace GmRelay.Bot.Infrastructure.Telegram;
+
+/// <summary>
+/// Registers the bot's command list with Telegram so users see the
+/// command menu when they type "/" in a chat.
+/// </summary>
+public sealed class TelegramCommandsSetupService(
+    ITelegramBotClient bot,
+    ILogger<TelegramCommandsSetupService> logger) : IHostedService
+{
+    public async Task StartAsync(CancellationToken cancellationToken)
+    {
+        var commands = new[]
+        {
+            new BotCommand { Command = "start", Description = "Начать работу с ботом" },
+            new BotCommand { Command = "newsession", Description = "Создать новую игровую сессию" },
+            new BotCommand { Command = "listsessions", Description = "Список предстоящих сессий" },
+            new BotCommand { Command = "exportcalendar", Description = "Экспортировать расписание в ICS" },
+            new BotCommand { Command = "help", Description = "Справка по командам" }
+        };
+
+        try
+        {
+            await bot.SetMyCommands(
+                commands,
+                scope: new BotCommandScopeAllPrivateChats(),
+                cancellationToken: cancellationToken);
+
+            await bot.SetMyCommands(
+                commands,
+                scope: new BotCommandScopeAllGroupChats(),
+                cancellationToken: cancellationToken);
+
+            logger.LogInformation("Telegram command menu registered for private chats and groups.");
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(ex, "Failed to register Telegram command menu.");
+        }
+    }
+
+    public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+}

src/GmRelay.Bot/Infrastructure/Telegram/UpdateRouter.cs

@@ -366,6 +366,13 @@ public sealed class UpdateRouter(
                     text: """
                         GM-Relay — бот для управления игровыми сессиями.
 
+                        /start — начать работу с ботом
+                        /newsession — создать новую игровую сессию
+                        /listsessions — список предстоящих сессий
+                        /exportcalendar — экспортировать расписание в ICS
+                        /help — эта справка
+
+                        Пример создания сессии:
                         /newsession
                         Название: My Game
                         Время: 15.05.2026 19:30
@@ -377,10 +384,8 @@ public sealed class UpdateRouter(
                         Игр: 4
                         Интервал: 7
 
-                        /listsessions — список предстоящих сессий
                         Для owner/co-GM /listsessions показывает кнопки отмены, переноса, удаления и повышения из листа ожидания.
                         Игроки могут записаться кнопкой «На дату» и сняться кнопкой «Выйти».
-                        /help — эта справка
                         """,
                     cancellationToken: ct);
                 break;

src/GmRelay.Bot/Program.cs

@@ -98,6 +98,7 @@ builder.Services.AddSingleton<DirectSessionNotificationSender>();
 // ── Telegram infrastructure ──────────────────────────────────────────
 builder.Services.AddSingleton<UpdateRouter>();
 builder.Services.AddSingleton<ITelegramUpdateHandler>(sp => sp.GetRequiredService<UpdateRouter>());
+builder.Services.AddHostedService<TelegramCommandsSetupService>();
 builder.Services.AddHostedService<TelegramMiniAppMenuButtonService>();
 builder.Services.AddHostedService<TelegramBotService>();
 

src/GmRelay.DiscordBot/Features/Sessions/DiscordNewSessionCommand.cs

@@ -1,128 +0,0 @@
-using GmRelay.DiscordBot.Rendering;
-using NetCord;
-using NetCord.Rest;
-using NetCord.Services.ApplicationCommands;
-
-namespace GmRelay.DiscordBot.Features.Sessions;
-
-public class DiscordNewSessionCommand : ApplicationCommandModule<SlashCommandContext>
-{
-    private readonly DiscordNewSessionHandler _handler;
-    private readonly ILogger<DiscordNewSessionCommand> _logger;
-
-    public DiscordNewSessionCommand(DiscordNewSessionHandler handler, ILogger<DiscordNewSessionCommand> logger)
-    {
-        _handler = handler;
-        _logger = logger;
-    }
-
-    [SlashCommand("newsession", "Create a new game session")]
-    public async Task ExecuteAsync(
-        [SlashCommandParameter(Name = "title", Description = "Game title")] string title,
-        [SlashCommandParameter(Name = "time", Description = "Session time (YYYY-MM-DD HH:mm or DD.MM.YYYY HH:mm)")] string time,
-        [SlashCommandParameter(Name = "seats", Description = "Maximum number of players")] long? seats = null,
-        [SlashCommandParameter(Name = "link", Description = "Join link")] string? link = null)
-    {
-        _logger.LogInformation(
-            "newsession called by user {UserId} ({UserType}) in guild {GuildId}, channel {ChannelId}",
-            Context.User.Id,
-            Context.User.GetType().Name,
-            Context.Interaction.GuildId,
-            Context.Channel?.Id);
-
-        var guildId = Context.Interaction.GuildId
-            ?? throw new InvalidOperationException("This command can only be used in a guild.");
-
-        var member = Context.User as GuildInteractionUser;
-        if (member is null)
-        {
-            _logger.LogError("Context.User is not GuildInteractionUser. Actual type: {ActualType}", Context.User.GetType().Name);
-            throw new InvalidOperationException("Guild member data not available in interaction.");
-        }
-
-        var resolvedPermissions = (ulong)member.Permissions;
-        _logger.LogInformation("Resolved permissions for user {UserId}: {Permissions}", Context.User.Id, resolvedPermissions);
-
-        ulong guildOwnerId = 0;
-        var guildName = guildId.ToString();
-        try
-        {
-            var guild = await Context.Client.Rest.GetGuildAsync(guildId);
-            guildOwnerId = guild.OwnerId;
-            guildName = guild.Name;
-            _logger.LogInformation("Guild owner id: {OwnerId}", guildOwnerId);
-        }
-        catch (RestException ex) when (ex.StatusCode == System.Net.HttpStatusCode.NotFound)
-        {
-            _logger.LogWarning(
-                ex,
-                "Bot is not a REST member of guild {GuildId}; using resolved permissions from interaction payload",
-                guildId);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Unexpected error fetching guild {GuildId}", guildId);
-        }
-
-        var timeResult = DiscordNewSessionHandler.ParseTimeInput(time);
-        if (!timeResult.IsSuccess)
-        {
-            await Context.Interaction.SendResponseAsync(
-                InteractionCallback.Message($"X {timeResult.Error}"));
-            return;
-        }
-
-        // Defer the response to avoid Discord 3-second interaction timeout
-        await Context.Interaction.SendResponseAsync(InteractionCallback.DeferredMessage());
-
-        try
-        {
-            _logger.LogInformation("Creating session for guild {GuildId}, user {UserId}", guildId, Context.User.Id);
-
-            var view = await _handler.HandleAsync(
-                guildId: guildId.ToString(),
-                channelId: Context.Channel!.Id.ToString(),
-                groupName: guildName,
-                userId: Context.User.Id,
-                userDisplayName: Context.User.GlobalName ?? Context.User.Username,
-                resolvedPermissions: resolvedPermissions,
-                guildOwnerId: guildOwnerId,
-                title: title,
-                scheduledAt: timeResult.Value,
-                maxPlayers: seats is null ? null : (int)seats.Value,
-                joinLink: link,
-                CancellationToken.None);
-
-            _logger.LogInformation("Session created successfully. Building render.");
-
-            var (embeds, actionRows) = DiscordSessionBatchRenderer.Render(view);
-
-            _logger.LogInformation("Sending success response.");
-
-            await Context.Interaction.ModifyResponseAsync(message =>
-            {
-                message.Content = ":white_check_mark: **Session created successfully!**";
-                message.Embeds = embeds;
-                message.Components = actionRows;
-            });
-
-            _logger.LogInformation("Success response sent.");
-        }
-        catch (UnauthorizedAccessException ex)
-        {
-            _logger.LogWarning(ex, "Unauthorized session creation attempt by user {UserId}", Context.User.Id);
-            await Context.Interaction.ModifyResponseAsync(message =>
-            {
-                message.Content = $":no_entry: {ex.Message}";
-            });
-        }
-        catch (Exception ex)
-        {
-            _logger.LogError(ex, "Failed to create session for user {UserId} in guild {GuildId}", Context.User.Id, guildId);
-            await Context.Interaction.ModifyResponseAsync(message =>
-            {
-                message.Content = ":boom: An error occurred while creating the session.";
-            });
-        }
-    }
-}

src/GmRelay.DiscordBot/Features/Sessions/DiscordNewSessionHandler.cs

@@ -1,156 +0,0 @@
-using Dapper;
-using GmRelay.DiscordBot.Infrastructure.Discord;
-using GmRelay.Shared.Domain;
-using GmRelay.Shared.Rendering;
-using Npgsql;
-using System.Globalization;
-
-namespace GmRelay.DiscordBot.Features.Sessions;
-
-public sealed record TimeParseResult(bool IsSuccess, DateTimeOffset Value, string? Error);
-
-public sealed class DiscordNewSessionHandler(
-    NpgsqlDataSource dataSource,
-    DiscordPermissionChecker permissionChecker,
-    ILogger<DiscordNewSessionHandler> logger)
-{
-    private static readonly TimeSpan MoscowOffset = TimeSpan.FromHours(3);
-
-    public static TimeParseResult ParseTimeInput(string input)
-    {
-        var trimmed = input.Trim();
-
-        if (DateTime.TryParseExact(
-            trimmed,
-            "yyyy-MM-dd HH:mm",
-            CultureInfo.InvariantCulture,
-            DateTimeStyles.None,
-            out var dt1))
-        {
-            var offset = new DateTimeOffset(dt1, MoscowOffset).ToUniversalTime();
-            if (offset < DateTimeOffset.UtcNow)
-                return new TimeParseResult(false, default, "Дата находится в прошлом.");
-
-            return new TimeParseResult(true, offset, null);
-        }
-
-        if (DateTime.TryParseExact(
-            trimmed,
-            "dd.MM.yyyy HH:mm",
-            CultureInfo.InvariantCulture,
-            DateTimeStyles.None,
-            out var dt2))
-        {
-            var offset = new DateTimeOffset(dt2, MoscowOffset).ToUniversalTime();
-            if (offset < DateTimeOffset.UtcNow)
-                return new TimeParseResult(false, default, "Дата находится в прошлом.");
-
-            return new TimeParseResult(true, offset, null);
-        }
-
-        return new TimeParseResult(false, default, "Некорректный формат даты. Используйте YYYY-MM-DD HH:mm или DD.MM.YYYY HH:mm");
-    }
-
-    public async Task<SessionBatchViewModel> HandleAsync(
-        string guildId,
-        string channelId,
-        string groupName,
-        ulong userId,
-        string userDisplayName,
-        ulong resolvedPermissions,
-        ulong guildOwnerId,
-        string title,
-        DateTimeOffset scheduledAt,
-        int? maxPlayers,
-        string? joinLink,
-        CancellationToken cancellationToken)
-    {
-        await using var connection = await dataSource.OpenConnectionAsync(cancellationToken);
-        var displayGroupName = string.IsNullOrWhiteSpace(groupName) || string.Equals(groupName, guildId, StringComparison.Ordinal)
-            ? title
-            : groupName.Trim();
-
-        var dbManagerUserIds = await connection.QueryAsync<ulong>(
-            @"SELECT CAST(p.external_user_id AS BIGINT)
-              FROM group_managers gm
-              JOIN players p ON p.id = gm.player_id
-              JOIN game_groups g ON g.id = gm.group_id
-              WHERE g.platform = 'Discord'
-                AND p.platform = 'Discord'
-                AND g.external_group_id = @GuildId",
-            new { GuildId = guildId });
-
-        if (!permissionChecker.CanManageSchedule(guildOwnerId, userId, dbManagerUserIds, resolvedPermissions))
-        {
-            throw new UnauthorizedAccessException("⛔ Только owner, администратор или manager могут создавать сессии.");
-        }
-
-        await using var transaction = await connection.BeginTransactionAsync(cancellationToken);
-        var transactionCommitted = false;
-        try
-        {
-            await connection.ExecuteAsync(
-                @"INSERT INTO players (display_name, platform, external_user_id, external_username)
-                  VALUES (@Name, 'Discord', @UserId, @Name)
-                  ON CONFLICT (platform, external_user_id)
-                  WHERE platform IS NOT NULL AND external_user_id IS NOT NULL
-                  DO UPDATE SET display_name = EXCLUDED.display_name,
-                                external_username = EXCLUDED.external_username",
-                new { Name = userDisplayName, UserId = userId.ToString() },
-                transaction);
-
-            var groupId = await connection.ExecuteScalarAsync<Guid>(
-                @"INSERT INTO game_groups (name, platform, external_group_id, external_channel_id)
-                  VALUES (@GroupName, 'Discord', @GuildId, @ChannelId)
-                  ON CONFLICT (platform, external_group_id)
-                  WHERE platform IS NOT NULL AND external_group_id IS NOT NULL
-                  DO UPDATE SET name = EXCLUDED.name,
-                                external_channel_id = COALESCE(EXCLUDED.external_channel_id, game_groups.external_channel_id)
-                  RETURNING id",
-                new { GroupName = displayGroupName, GuildId = guildId, ChannelId = channelId },
-                transaction);
-
-            await connection.ExecuteAsync(
-                @"INSERT INTO group_managers (group_id, player_id, role)
-                  SELECT @GroupId, p.id, @OwnerRole
-                  FROM players p
-                  WHERE p.platform = 'Discord' AND p.external_user_id = @UserId
-                  ON CONFLICT (group_id, player_id) DO NOTHING",
-                new { GroupId = groupId, UserId = userId.ToString(), OwnerRole = GroupManagerRoleExtensions.OwnerValue },
-                transaction);
-
-            var batchId = Guid.NewGuid();
-            var sessionId = await connection.ExecuteScalarAsync<Guid>(
-                @"INSERT INTO sessions (batch_id, group_id, title, join_link, scheduled_at, status, max_players)
-                  VALUES (@BatchId, @GroupId, @Title, @Link, @ScheduledAt, @Status, @MaxPlayers)
-                  RETURNING id",
-                new
-                {
-                    BatchId = batchId,
-                    GroupId = groupId,
-                    Title = title,
-                    Link = joinLink ?? string.Empty,
-                    ScheduledAt = scheduledAt.UtcDateTime,
-                    Status = SessionStatus.Planned,
-                    MaxPlayers = maxPlayers
-                },
-                transaction);
-
-            await transaction.CommitAsync(cancellationToken);
-            transactionCommitted = true;
-            logger.LogInformation("Created session {SessionId} in guild {GuildId}", sessionId, guildId);
-
-            var sessions = new[] { new SessionBatchDto(sessionId, scheduledAt.UtcDateTime, SessionStatus.Planned, maxPlayers, joinLink ?? string.Empty) };
-            return SessionBatchViewBuilder.Build(title, sessions, Array.Empty<ParticipantBatchDto>());
-        }
-        catch
-        {
-            if (!transactionCommitted)
-            {
-                await transaction.RollbackAsync(cancellationToken);
-            }
-
-            throw;
-        }
-    }
-}

src/GmRelay.DiscordBot/Features/Sessions/DiscordRescheduleCommand.cs

@@ -75,7 +75,7 @@ public class DiscordRescheduleCommand : ApplicationCommandModule<SlashCommandCon
         var parsedOptions = new List<DateTimeOffset>();
         foreach (var opt in options)
         {
-            var result = DiscordNewSessionHandler.ParseTimeInput(opt);
+            var result = DiscordTimeParser.ParseTimeInput(opt);
             if (!result.IsSuccess)
             {
                 await Context.Interaction.SendResponseAsync(
@@ -85,7 +85,7 @@ public class DiscordRescheduleCommand : ApplicationCommandModule<SlashCommandCon
             parsedOptions.Add(result.Value);
         }
 
-        var deadlineResult = DiscordNewSessionHandler.ParseTimeInput(deadline);
+        var deadlineResult = DiscordTimeParser.ParseTimeInput(deadline);
         if (!deadlineResult.IsSuccess)
         {
             await Context.Interaction.SendResponseAsync(

src/GmRelay.DiscordBot/Features/Sessions/DiscordTimeParser.cs

@@ -0,0 +1,45 @@
+using System.Globalization;
+
+namespace GmRelay.DiscordBot.Features.Sessions;
+
+public sealed record TimeParseResult(bool IsSuccess, DateTimeOffset Value, string? Error);
+
+public static class DiscordTimeParser
+{
+    private static readonly TimeSpan MoscowOffset = TimeSpan.FromHours(3);
+
+    public static TimeParseResult ParseTimeInput(string input)
+    {
+        var trimmed = input.Trim();
+
+        if (DateTime.TryParseExact(
+            trimmed,
+            "yyyy-MM-dd HH:mm",
+            CultureInfo.InvariantCulture,
+            DateTimeStyles.None,
+            out var dt1))
+        {
+            var offset = new DateTimeOffset(dt1, MoscowOffset).ToUniversalTime();
+            if (offset < DateTimeOffset.UtcNow)
+                return new TimeParseResult(false, default, "Дата находится в прошлом.");
+
+            return new TimeParseResult(true, offset, null);
+        }
+
+        if (DateTime.TryParseExact(
+            trimmed,
+            "dd.MM.yyyy HH:mm",
+            CultureInfo.InvariantCulture,
+            DateTimeStyles.None,
+            out var dt2))
+        {
+            var offset = new DateTimeOffset(dt2, MoscowOffset).ToUniversalTime();
+            if (offset < DateTimeOffset.UtcNow)
+                return new TimeParseResult(false, default, "Дата находится в прошлом.");
+
+            return new TimeParseResult(true, offset, null);
+        }
+
+        return new TimeParseResult(false, default, "Некорректный формат даты. Используйте YYYY-MM-DD HH:mm или DD.MM.YYYY HH:mm");
+    }
+}

src/GmRelay.DiscordBot/Features/Sessions/Wizard/DiscordPermissionLookup.cs

@@ -8,10 +8,9 @@ using Npgsql;
 namespace GmRelay.DiscordBot.Features.Sessions.Wizard;
 
 /// <summary>
-/// Small lookup helper for Discord permission checks. The
+/// Small lookup helper for Discord permission checks. The slash command
-/// <see cref="DiscordNewSessionHandler"/> already runs the same SQL
+/// and reschedule command both need to enumerate DB managers for a guild;
-/// inline; this class is here so the wizard slash command can do the
+/// this class centralises the query so it isn't duplicated.
-/// same check without duplicating the query string.
 /// </summary>
 internal static class DiscordPermissionLookup
 {

src/GmRelay.DiscordBot/Features/Sessions/Wizard/DiscordWizardCommand.cs

@@ -13,7 +13,7 @@ namespace GmRelay.DiscordBot.Features.Sessions.Wizard;
 
 /// <summary>
 /// Slash entry point for the Discord wizard. Mirrors the Telegram
-/// <c>/newsession-wizard</c> command: a fresh draft is created on
+/// <c>/newsession</c> command: a fresh draft is created on
 /// first invocation, the persisted first-step message is re-shown
 /// when the user already has an active draft, and the owner/co-GM
 /// permission check from <see cref="DiscordPermissionChecker"/> is
@@ -44,7 +44,7 @@ public sealed class DiscordWizardCommand : ApplicationCommandModule<SlashCommand
         _log = log;
     }
 
-    [SlashCommand("newsession-wizard", "Пошаговое создание игры или пула")]
+    [SlashCommand("newsession", "Пошаговое создание игры или пула")]
     public async Task ExecuteAsync(
         [SlashCommandParameter(Name = "mode", Description = "Пропустить выбор типа (single/pool)")] string? mode = null)
     {

src/GmRelay.DiscordBot/Features/Sessions/Wizard/DiscordWizardInteractionModule.cs

@@ -132,6 +132,7 @@ public sealed class WizardInteractionDispatcher
         WizardStepNames.Cover,
         WizardStepNames.DateTime,
         WizardStepNames.Capacity,
+        WizardStepNames.Location,
         WizardStepNames.PoolSlotDateTime,
         WizardStepNames.PoolSlotCapacity,
         "SystemFreeText",
@@ -166,7 +167,7 @@ public sealed class WizardInteractionDispatcher
         {
             await context.Interaction.SendResponseAsync(InteractionCallback.Message(
                 new InteractionMessageProperties()
-                    .WithContent("📭 Нет активного мастера. Запустите /newsession-wizard.")
+                    .WithContent("📭 Нет активного мастера. Запустите /newsession.")
                     .WithFlags(MessageFlags.Ephemeral)));
             return;
         }
@@ -276,14 +277,14 @@ public sealed class WizardInteractionDispatcher
         // itself doesn't know about resume, so we just edit the
         // draft message via the messenger).
         // resume:restart → delete the draft and prompt the user to
-        // re-run /newsession-wizard.
+        // re-run /newsession.
         if (parts.Length >= 3 && parts[2] == "restart")
         {
             await _drafts.DeleteAsync(draft.Id, ct);
             _contextStore.Remove(draft.Id);
             await context.Interaction.SendResponseAsync(InteractionCallback.Message(
                 new InteractionMessageProperties()
-                    .WithContent("♻️ Мастер сброшен. Запустите /newsession-wizard заново.")
+                    .WithContent("♻️ Мастер сброшен. Запустите /newsession заново.")
                     .WithFlags(MessageFlags.Ephemeral)));
             return;
         }
@@ -314,7 +315,7 @@ public sealed class WizardInteractionDispatcher
         {
             await context.Interaction.SendResponseAsync(InteractionCallback.Message(
                 new InteractionMessageProperties()
-                    .WithContent("📭 Нет активного мастера. Запустите /newsession-wizard.")
+                    .WithContent("📭 Нет активного мастера. Запустите /newsession.")
                     .WithFlags(MessageFlags.Ephemeral)));
             return;
         }
@@ -365,7 +366,7 @@ public sealed class WizardInteractionDispatcher
         {
             await context.Interaction.SendResponseAsync(InteractionCallback.Message(
                 new InteractionMessageProperties()
-                    .WithContent("📭 Нет активного мастера. Запустите /newsession-wizard.")
+                    .WithContent("📭 Нет активного мастера. Запустите /newsession.")
                     .WithFlags(MessageFlags.Ephemeral)));
             return;
         }

src/GmRelay.DiscordBot/Features/Sessions/Wizard/DiscordWizardStep.cs

@@ -60,6 +60,8 @@ public static class DiscordWizardStep
             WizardStepNames.Duration => RenderDuration(),
             WizardStepNames.DateTime => RenderDateTime(),
             WizardStepNames.Capacity => RenderCapacity(),
+            WizardStepNames.Format => RenderFormat(),
+            WizardStepNames.Location => RenderLocation(payload),
             WizardStepNames.Visibility => RenderVisibility(),
             WizardStepNames.PickClub => RenderPickClub(clubs ?? System.Array.Empty<WizardClubOption>()),
             WizardStepNames.Publish => RenderPublish(),
@@ -263,6 +265,29 @@ public static class DiscordWizardStep
         },
         OpenModalStep: WizardStepNames.Capacity);
 
+    private static DiscordWizardRender RenderFormat() => new(
+        "🧭 Формат игры",
+        "Выберите формат.",
+        new[]
+        {
+            Row(ChoiceBtn("🌐 Online", WizardStepNames.Format, "online", ButtonStyle.Primary),
+                ChoiceBtn("📍 Offline", WizardStepNames.Format, "offline", ButtonStyle.Primary)),
+            Row(ControlBtn("⬅️ Назад", "back"),
+                ControlBtn("❌ Отмена", "cancel", ButtonStyle.Danger)),
+        },
+        OpenModalStep: null);
+
+    private static DiscordWizardRender RenderLocation(WizardPayload payload)
+    {
+        var isOnline = payload.Format == WizardSessionFormat.Online;
+        return new DiscordWizardRender(
+            isOnline ? "🔗 Ссылка" : "📍 Адрес",
+            isOnline ? "Введите ссылку для подключения." : "Введите адрес места проведения.",
+            new IMessageComponentProperties[] { Row(ControlBtn("⬅️ Назад", "back"),
+                        ControlBtn("❌ Отмена", "cancel", ButtonStyle.Danger)) },
+            OpenModalStep: WizardStepNames.Location);
+    }
+
     private static DiscordWizardRender RenderVisibility() => new(
         "🔒 Видимость",
         "Выберите, кто увидит сессию.",
@@ -566,6 +591,20 @@ public static class DiscordWizardStep
                             Required = true,
                         }),
                 }),
+            WizardStepNames.Location => new ModalProperties(
+                ModalCustomId(WizardStepNames.Location),
+                "🔗 Ссылка / 📍 Адрес",
+                new IModalComponentProperties[]
+                {
+                    new LabelProperties(
+                        "Ссылка или адрес",
+                        new TextInputProperties(ModalCustomId(WizardStepNames.Location), TextInputStyle.Short)
+                        {
+                            Placeholder = "https://… или адрес",
+                            MaxLength = WizardStepLimits.MaxLocationLength,
+                            Required = true,
+                        }),
+                }),
             WizardStepNames.PoolSlotDateTime => new ModalProperties(
                 ModalCustomId(WizardStepNames.PoolSlotDateTime),
                 "📅 Дата/время слота",

src/GmRelay.DiscordBot/Features/Sessions/Wizard/DiscordWizardSubmitter.cs

@@ -65,19 +65,32 @@ public sealed class DiscordWizardSubmitter
             return;
         }
 
+        var created = new List<(CreateSessionCommand Command, CreateSessionResult Result)>();
         try
         {
             var commands = BuildCommands(draft, payload);
             foreach (var cmd in commands)
             {
-                await _shared.HandleAsync(cmd, ct);
+                var result = await _shared.HandleAsync(cmd, ct);
+                if (!result.Success)
+                {
+                    await EditDraftMessageAsync(
+                        draft,
+                        result.ErrorMessage ?? "❌ Не удалось создать сессию.",
+                        Array.Empty<WizardAction>(),
+                        ct);
+                    return;
+                }
+
+                created.Add((cmd, result));
             }
-            var totalSessions = commands.Sum(c => c.ScheduledTimes.Count);
+
-            await EditDraftMessageAsync(
+            // Success: replace the wizard message with a confirmation and
-                draft,
+            // clean up the draft so the user can start a new one later.
-                $"✅ Создано: {totalSessions} {(totalSessions == 1 ? "сессия" : "сессий")}",
+            var confirmation = created.Count == 1
-                Array.Empty<WizardAction>(),
+                ? $"✅ Создано: {created[0].Command.Title}"
-                ct);
+                : $"✅ Создано: {created[0].Command.Title} и ещё {created.Count - 1} сессия/сессии";
+            await EditDraftMessageAsync(draft, confirmation, Array.Empty<WizardAction>(), ct);
             await _drafts.DeleteAsync(draft.Id, ct);
             _contextStore.Remove(draft.Id);
         }
@@ -90,7 +103,7 @@ public sealed class DiscordWizardSubmitter
             {
                 await EditDraftMessageAsync(
                     draft,
-                    "💥 Не удалось создать сессию после 3 попыток. Используйте /newsession-wizard, чтобы начать заново.",
+                    "💥 Не удалось создать сессию после 3 попыток. Используйте /newsession, чтобы начать заново.",
                     Array.Empty<WizardAction>(),
                     ct);
                 await _drafts.DeleteAsync(draft.Id, ct);
@@ -140,7 +153,7 @@ public sealed class DiscordWizardSubmitter
     }
 
     private static int MaxPlayersForPool(WizardPoolInput pool) =>
-        pool.Slots.Count == 0 ? 0 : pool.Slots.Max(s => s.MaxPlayers);
+        pool.MaxPlayers ?? (pool.Slots.Count == 0 ? 0 : pool.Slots.Max(s => s.MaxPlayers));
 
     internal static CreateSessionCommand BuildCommand(
         WizardDraft draft,
@@ -164,15 +177,16 @@ public sealed class DiscordWizardSubmitter
             User: user,
             Group: group,
             Title: p.Title ?? string.Empty,
-            Link: string.Empty,
+            Link: p.Format == WizardSessionFormat.Online ? p.JoinLink ?? string.Empty : string.Empty,
             ScheduledTimes: scheduledTimes,
             MaxPlayers: maxPlayers,
             ImageReference: p.ImageFileId ?? p.ImageUrl,
             System: ParseSystem(p.System),
             Description: p.Description,
-            Format: null,
+            Format: p.Format?.ToString(),
             DurationMinutes: p.DurationMinutes,
-            IsOneShot: isOneShot);
+            IsOneShot: isOneShot,
+            LocationAddress: p.Format == WizardSessionFormat.Offline ? p.LocationAddress : null);
     }
 
     private static GameSystem? ParseSystem(string? code)
@@ -188,12 +202,15 @@ public sealed class DiscordWizardSubmitter
         if (string.IsNullOrWhiteSpace(p.Title)) missingFields.Add("название");
         if (string.IsNullOrWhiteSpace(p.System)) missingFields.Add("система");
         if (!p.DurationMinutes.HasValue) missingFields.Add("длительность");
+        if (p.Format is null) missingFields.Add("формат");
+        if (p.Format == WizardSessionFormat.Online && string.IsNullOrWhiteSpace(p.JoinLink)) missingFields.Add("ссылка");
+        if (p.Format == WizardSessionFormat.Offline && string.IsNullOrWhiteSpace(p.LocationAddress)) missingFields.Add("адрес");
         if (p.Visibility is null) missingFields.Add("видимость");
 
         if (p.Type == WizardCreationType.Single)
         {
             if (p.Single?.ScheduledAt is null) missingFields.Add("дата/время");
-            if (p.Single?.MaxPlayers is null) missingFields.Add("лимит мест");
+            // MaxPlayers = null is a valid "♾ Без лимита" choice.
         }
         else
         {

src/GmRelay.DiscordBot/Program.cs

@@ -61,7 +61,6 @@ builder.Services.AddSingleton<NpgsqlDataSource>(sp =>
 builder.Services.AddSingleton<DiscordPermissionChecker>();
 builder.Services.AddSingleton<DiscordListSessionsHandler>();
 builder.Services.AddSingleton<DiscordDeleteSessionHandler>();
-builder.Services.AddSingleton<DiscordNewSessionHandler>();
 builder.Services.AddSingleton<DiscordRescheduleHandler>();
 builder.Services.AddSingleton<GmRelay.Shared.Features.Sessions.RescheduleSession.HandleRescheduleVoteHandler>();
 builder.Services.AddSingleton<DiscordRescheduleVoteHandler>();

src/GmRelay.Shared/Features/Sessions/CreateSession/Wizard/GameCreationWizard.cs

@@ -224,7 +224,16 @@ public sealed class GameCreationWizard
                     ? (WizardStepNames.Capacity, SetScheduledAt(payload, dt), payload)
                     : (null, dt == default ? "Не удалось разобрать дату" : "Дата в прошлом", payload);
 
-            case WizardStepNames.Capacity when payload.Single?.MaxPlayers is null:
+            case WizardStepNames.Capacity:
+                if (payload.Type == WizardCreationType.Pool)
+                {
+                    if (payload.Pool?.MaxPlayers is not null) return (null, "Лимит уже задан", payload);
+                    return int.TryParse(input, out var poolCap) && poolCap >= WizardStepLimits.MinCapacity && poolCap <= WizardStepLimits.MaxCapacity
+                        ? (WizardStepNames.Format, SetPoolMaxPlayers(payload, poolCap), payload)
+                        : (null, "Лимит должен быть 1..50", payload);
+                }
+
+                if (payload.Single?.MaxPlayers is not null) return (null, "Лимит уже задан", payload);
                 return int.TryParse(input, out var cap) && cap >= WizardStepLimits.MinCapacity && cap <= WizardStepLimits.MaxCapacity
                     ? (WizardStepNames.Format, SetMaxPlayers(payload, cap), payload)
                     : (null, "Лимит должен быть 1..50", payload);
@@ -247,7 +256,7 @@ public sealed class GameCreationWizard
 
             case WizardStepNames.PoolSystemDuration when payload.DurationMinutes is null:
                 return TryParseHours(input, out var pdur)
-                    ? (WizardStepNames.Format, SetDurationMinutes(payload, pdur), payload)
+                    ? (WizardStepNames.Capacity, SetDurationMinutes(payload, pdur), payload)
                     : (null, "Неверная длительность (1..12 ч)", payload);
 
             case WizardStepNames.PoolSlotDateTime:
@@ -314,10 +323,12 @@ public sealed class GameCreationWizard
     {
         if (choice is "no_limit")
         {
-            return (WizardStepNames.Format, SetMaxPlayers(p, null));
+            return p.Type == WizardCreationType.Pool
+                ? (WizardStepNames.Format, SetPoolMaxPlayers(p, null))
+                : (WizardStepNames.Format, SetMaxPlayers(p, null));
         }
 
-        if (choice is "waitlist:on" or "waitlist:off" && p.Single?.MaxPlayers is null)
+        if (choice is "waitlist:on" or "waitlist:off" && p.Type != WizardCreationType.Pool && p.Single?.MaxPlayers is null)
         {
             return (null, "Сначала введите лимит мест или нажмите «♾ Без лимита»");
         }
@@ -368,11 +379,12 @@ public sealed class GameCreationWizard
     {
         "_custom" => (WizardStepNames.PoolSystemDuration, null),
         { } c when c.Contains(':') => SplitSystemDuration(c) is (var sys, var dur)
-            ? (WizardStepNames.Format, SetSystem(p, sys) ?? SetDurationMinutes(p, dur))
+            ? (WizardStepNames.Capacity, SetSystem(p, sys) ?? SetDurationMinutes(p, dur))
             : (null, "Неверный выбор"),
         _ => (null, "Неизвестный выбор"),
     };
 
+
     private static (string?, string?) ApplyPoolAddSlotsChoice(WizardPayload p, string choice) => choice switch
     {
         "add" => BeginNewPoolSlot(p),
@@ -409,8 +421,8 @@ public sealed class GameCreationWizard
         WizardStepNames.System => WizardStepNames.Cover,
         WizardStepNames.Duration => WizardStepNames.System,
         WizardStepNames.DateTime => WizardStepNames.Duration,
-        WizardStepNames.Capacity => WizardStepNames.DateTime,
+        WizardStepNames.Capacity => p.Type == WizardCreationType.Pool ? WizardStepNames.PoolSystemDuration : WizardStepNames.DateTime,
-        WizardStepNames.Format => p.Type == WizardCreationType.Pool ? WizardStepNames.PoolSystemDuration : WizardStepNames.Capacity,
+        WizardStepNames.Format => WizardStepNames.Capacity,
         WizardStepNames.Location => WizardStepNames.Format,
         WizardStepNames.Visibility => WizardStepNames.Location,
         WizardStepNames.PickClub => WizardStepNames.Visibility,
@@ -458,6 +470,8 @@ public sealed class GameCreationWizard
     { p.Single ??= new WizardSingleInput(); p.Single.ScheduledAt = v; return null; }
     private static string? SetMaxPlayers(WizardPayload p, int? v)
     { p.Single ??= new WizardSingleInput(); p.Single.MaxPlayers = v; return null; }
+    private static string? SetPoolMaxPlayers(WizardPayload p, int? v)
+    { p.Pool ??= new WizardPoolInput(); p.Pool.MaxPlayers = v; return null; }
     private static string? SetWaitlist(WizardPayload p, bool v) { p.Waitlist = v; return null; }
     private static string? SetVisibility(WizardPayload p, WizardVisibility? v) { p.Visibility = v; return null; }
     private static string? SetClubId(WizardPayload p, Guid v) { p.ClubId = v; return null; }
@@ -518,7 +532,7 @@ public sealed class GameCreationWizard
     private static string? NextAfterSystem(WizardPayload p) => WizardStepNames.Duration;
     private static string? NextAfterDuration(WizardPayload p)
     {
-        if (p.Type == WizardCreationType.Pool) return WizardStepNames.Format;
+        if (p.Type == WizardCreationType.Pool) return WizardStepNames.Capacity;
         return p.Single?.MaxPlayers is not null ? WizardStepNames.Format : WizardStepNames.DateTime;
     }
     private static string? NextAfterVisibility(WizardPayload p)
@@ -530,6 +544,7 @@ public sealed class GameCreationWizard
         return p.Type == WizardCreationType.Pool ? WizardStepNames.PoolAddSlots : WizardStepNames.Publish;
     }
 
+
     private static (string? sys, int? dur) SplitSystemDuration(string s)
     {
         var idx = s.IndexOf(':');

src/GmRelay.Shared/Features/Sessions/CreateSession/Wizard/WizardPayload.cs

@@ -50,6 +50,8 @@ public sealed class WizardPayload
 
 public sealed class WizardPoolInput
 {
+    public int? MaxPlayers { get; set; }
+
     public List<WizardSlotInput> Slots { get; set; } = new();
 }
 

src/GmRelay.Shared/Features/Sessions/CreateSession/Wizard/WizardStepViewBuilder.cs

@@ -224,6 +224,7 @@ public static class WizardStepViewBuilder
         if (!string.IsNullOrEmpty(p.System)) sb.AppendLine($"🎲 Система: {p.System}");
         if (p.DurationMinutes.HasValue) sb.AppendLine($"⏱ Длительность: {p.DurationMinutes / 60} ч");
         AppendFormatLocation(sb, p);
+        if (p.Pool?.MaxPlayers is { } poolMax) sb.AppendLine($"👥 Мест в пуле: {poolMax}");
         sb.AppendLine($"🔒 Видимость: {RenderVisibilityText(p.Visibility)}");
         sb.AppendLine();
         sb.AppendLine($"Слоты ({p.Pool?.Slots.Count ?? 0}):");

src/GmRelay.Shared/Features/Sessions/ListSessions/ListSessionsHandler.cs

@@ -5,7 +5,17 @@ using Npgsql;
 
 namespace GmRelay.Shared.Features.Sessions.ListSessions;
 
-public sealed record SessionListItemDto(Guid Id, string Title, DateTime ScheduledAt, string Status, int? MaxPlayers, int PlayerCount, int WaitlistCount, bool CanManage);
+public sealed record SessionListItemDto(
+    Guid Id,
+    string Title,
+    DateTime ScheduledAt,
+    string Status,
+    int? MaxPlayers,
+    int PlayerCount,
+    int WaitlistCount,
+    bool CanManage,
+    bool IsUserActive,
+    bool IsUserWaitlisted);
 
 public sealed record SessionListResult(
     IReadOnlyList<SessionListItemDto> Sessions,
@@ -29,7 +39,27 @@ public sealed class ListSessionsHandler(
                          WHERE gm.group_id = s.group_id
                            AND manager_player.platform = @Platform
                            AND manager_player.external_user_id = @ExternalUserId
-                     ) AS CanManage
+                     ) AS CanManage,
+                     EXISTS (
+                         SELECT 1
+                         FROM session_participants user_sp
+                         JOIN players user_p ON user_p.id = user_sp.player_id
+                         WHERE user_sp.session_id = s.id
+                           AND user_sp.is_gm = false
+                           AND user_sp.registration_status = @Active
+                           AND user_p.platform = @Platform
+                           AND user_p.external_user_id = @ExternalUserId
+                     ) AS IsUserActive,
+                     EXISTS (
+                         SELECT 1
+                         FROM session_participants user_sp
+                         JOIN players user_p ON user_p.id = user_sp.player_id
+                         WHERE user_sp.session_id = s.id
+                           AND user_sp.is_gm = false
+                           AND user_sp.registration_status = @Waitlisted
+                           AND user_p.platform = @Platform
+                           AND user_p.external_user_id = @ExternalUserId
+                     ) AS IsUserWaitlisted
               FROM sessions s
               JOIN game_groups g ON s.group_id = g.id
               LEFT JOIN session_participants sp ON s.id = sp.session_id

src/GmRelay.Shared/Telegram/TelegramAuthPayloadBuilder.cs

@@ -0,0 +1,198 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+namespace GmRelay.Shared.Telegram;
+
+/// <summary>
+/// Generates Telegram authentication payloads that pass the validation performed by
+/// <see cref="GmRelay.Web.Services.TelegramAuthService"/>.
+///
+/// Useful for tests and local E2E runners that need a valid Telegram user identity without
+/// talking to real Telegram servers.
+/// </summary>
+public static class TelegramAuthPayloadBuilder
+{
+    /// <summary>
+    /// Builds a Telegram Login Widget query string and hash.
+    /// The resulting query can be sent to the widget callback endpoint.
+    /// </summary>
+    public static LoginWidgetResult BuildLoginWidget(
+        string botToken,
+        long telegramId,
+        string firstName,
+        string? lastName = null,
+        string? username = null,
+        string? photoUrl = null,
+        long? authDate = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(botToken);
+        ArgumentException.ThrowIfNullOrWhiteSpace(firstName);
+
+        var timestamp = authDate ?? DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+
+        var values = new SortedDictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["auth_date"] = timestamp.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            ["first_name"] = firstName,
+            ["id"] = telegramId.ToString(System.Globalization.CultureInfo.InvariantCulture)
+        };
+
+        if (!string.IsNullOrWhiteSpace(lastName))
+            values["last_name"] = lastName;
+        if (!string.IsNullOrWhiteSpace(photoUrl))
+            values["photo_url"] = photoUrl;
+        if (!string.IsNullOrWhiteSpace(username))
+            values["username"] = username;
+
+        var hash = ComputeLoginWidgetHash(botToken, values);
+        values["hash"] = hash;
+
+        var queryString = string.Join(
+            "&",
+            values.Select(pair => $"{Uri.EscapeDataString(pair.Key)}={Uri.EscapeDataString(pair.Value)}"));
+
+        return new LoginWidgetResult(
+            telegramId,
+            firstName,
+            lastName,
+            username,
+            photoUrl,
+            timestamp,
+            hash,
+            queryString);
+    }
+
+    /// <summary>
+    /// Builds a Telegram Mini App initData raw string (the value passed in the WebApp URL hash).
+    /// </summary>
+    public static MiniAppInitDataResult BuildMiniAppInitData(
+        string botToken,
+        long telegramId,
+        string firstName,
+        string? lastName = null,
+        string? username = null,
+        string? photoUrl = null,
+        string? languageCode = null,
+        bool isPremium = false,
+        long? chatId = null,
+        string? chatType = null,
+        string? chatTitle = null,
+        string? queryId = null,
+        string? startParam = null,
+        long? authDate = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(botToken);
+        ArgumentException.ThrowIfNullOrWhiteSpace(firstName);
+
+        var userPayload = new Dictionary<string, object?>(StringComparer.Ordinal)
+        {
+            ["id"] = telegramId,
+            ["first_name"] = firstName,
+            ["last_name"] = lastName,
+            ["username"] = username,
+            ["photo_url"] = photoUrl,
+            ["language_code"] = languageCode,
+            ["is_premium"] = isPremium ? true : null
+        };
+
+        // Remove null values to match real Telegram initData serialization.
+        var userJson = JsonSerializer.Serialize(
+            userPayload.Where(kv => kv.Value is not null).ToDictionary(kv => kv.Key, kv => kv.Value),
+            JsonSerializerOptions.Web);
+
+        var timestamp = authDate ?? DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+
+        var values = new SortedDictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["auth_date"] = timestamp.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            ["user"] = userJson
+        };
+
+        if (!string.IsNullOrWhiteSpace(queryId))
+            values["query_id"] = queryId;
+        if (!string.IsNullOrWhiteSpace(startParam))
+            values["start_param"] = startParam;
+        if (chatId.HasValue)
+        {
+            values["chat"] = JsonSerializer.Serialize(new
+            {
+                id = chatId.Value,
+                type = chatType ?? "private",
+                title = chatTitle
+            }, JsonSerializerOptions.Web);
+        }
+
+        var hash = ComputeMiniAppHash(botToken, values);
+
+        var pairs = values
+            .Select(pair => $"{Uri.EscapeDataString(pair.Key)}={Uri.EscapeDataString(pair.Value)}")
+            .Append($"hash={hash}");
+
+        var initDataRaw = string.Join("&", pairs);
+
+        return new MiniAppInitDataResult(
+            telegramId,
+            firstName,
+            lastName,
+            username,
+            photoUrl,
+            timestamp,
+            hash,
+            initDataRaw);
+    }
+
+    /// <summary>
+    /// Computes the HMAC-SHA256 hash used by Telegram Login Widget callbacks.
+    /// </summary>
+    public static string ComputeLoginWidgetHash(string botToken, IReadOnlyDictionary<string, string> values)
+    {
+        var dataCheckString = string.Join(
+            "\n",
+            values
+                .Where(pair => pair.Key != "hash")
+                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
+                .Select(pair => $"{pair.Key}={pair.Value}"));
+
+        var secretKey = SHA256.HashData(Encoding.UTF8.GetBytes(botToken));
+        var hashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
+        return Convert.ToHexString(hashBytes).ToLowerInvariant();
+    }
+
+    /// <summary>
+    /// Computes the HMAC-SHA256 hash used by Telegram Mini App initData.
+    /// </summary>
+    public static string ComputeMiniAppHash(string botToken, IReadOnlyDictionary<string, string> values)
+    {
+        var dataCheckString = string.Join(
+            "\n",
+            values
+                .Where(pair => pair.Key != "hash")
+                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
+                .Select(pair => $"{pair.Key}={pair.Value}"));
+
+        var secretKey = HMACSHA256.HashData(Encoding.UTF8.GetBytes("WebAppData"), Encoding.UTF8.GetBytes(botToken));
+        var hashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
+        return Convert.ToHexString(hashBytes).ToLowerInvariant();
+    }
+}
+
+public sealed record LoginWidgetResult(
+    long TelegramId,
+    string FirstName,
+    string? LastName,
+    string? Username,
+    string? PhotoUrl,
+    long AuthDate,
+    string Hash,
+    string QueryString);
+
+public sealed record MiniAppInitDataResult(
+    long TelegramId,
+    string FirstName,
+    string? LastName,
+    string? Username,
+    string? PhotoUrl,
+    long AuthDate,
+    string Hash,
+    string InitDataRaw);

src/GmRelay.Web/Components/Layout/NavMenu.razor

@@ -82,7 +82,7 @@
                     </button>
                 </form>
 
-                <div class="nav-version">v3.11.0</div>
+                <div class="nav-version">v3.11.3</div>
             </div>
         </Authorized>
         <NotAuthorized>

src/GmRelay.Web/Components/Pages/GroupDetails.razor

@@ -10,6 +10,7 @@
 @inject AuthorizedMembershipService MembershipService
 @inject AuthenticationStateProvider AuthStateProvider
 @inject NavigationManager Navigation
+@inject IJSRuntime JS
 
 <PageTitle>Сессии группы — GM-Relay</PageTitle>
 
@@ -393,6 +394,9 @@
                                         ✏️ Изменить
                                     </a>
                                     <a href="/session/@session.Id/history" class="btn-gm btn-gm-outline">📜 История</a>
+                                    <button type="button" class="btn-gm btn-gm-danger" disabled="@(deletingSessionId == session.Id)" @onclick="() => DeleteSession(session.Id, session.Title)">
+                                        @(deletingSessionId == session.Id ? "⏳ Удаляем..." : "🗑 Удалить")
+                                    </button>
                                     @if (CanPromote(session))
                                     {
                                         <button type="button" class="btn-gm btn-gm-success" disabled="@(promotingSessionId == session.Id)" @onclick="() => PromoteWaitlisted(session.Id)">
@@ -491,6 +495,9 @@
                             ✏️ Изменить
                         </a>
                         <a href="/session/@session.Id/history" class="btn-gm btn-gm-outline" style="flex: 1; justify-content: center; font-size: 0.8125rem; padding: 0.5rem;">📜 История</a>
+                        <button type="button" class="btn-gm btn-gm-danger" style="flex: 1; justify-content: center; font-size: 0.8125rem; padding: 0.5rem;" disabled="@(deletingSessionId == session.Id)" @onclick="() => DeleteSession(session.Id, session.Title)">
+                            @(deletingSessionId == session.Id ? "⏳ Удаляем..." : "🗑 Удалить")
+                        </button>
                         @if (CanPromote(session))
                         {
                             <button type="button" class="btn-gm btn-gm-success" style="flex: 1; justify-content: center; font-size: 0.8125rem; padding: 0.5rem;" disabled="@(promotingSessionId == session.Id)" @onclick="() => PromoteWaitlisted(session.Id)">
@@ -572,6 +579,7 @@
     private HashSet<Guid> expandedSessions = new();
     private Guid? kickingParticipantId;
     private Guid? loadingParticipantsSessionId;
+    private Guid? deletingSessionId;
 
     protected override async Task OnInitializedAsync()
     {
@@ -904,6 +912,40 @@
         }
     }
 
+    private async Task DeleteSession(Guid sessionId, string title)
+    {
+        var confirmed = await JS.InvokeAsync<bool>("confirm", $"Удалить сессию «{title}»?");
+        if (!confirmed)
+        {
+            return;
+        }
+
+        errorMessage = null;
+        successMessage = null;
+        deletingSessionId = sessionId;
+
+        try
+        {
+            await SessionService.DeleteSessionForCurrentUserAsync(sessionId);
+            expandedSessions.Remove(sessionId);
+            participantsCache.Remove(sessionId);
+            successMessage = "Сессия удалена.";
+            await LoadSessions();
+        }
+        catch (SessionAccessDeniedException)
+        {
+            Navigation.NavigateTo("/access-denied");
+        }
+        catch (Exception ex)
+        {
+            errorMessage = ex.Message;
+        }
+        finally
+        {
+            deletingSessionId = null;
+        }
+    }
+
     private static string FormatParticipantUsername(WebParticipant p)
     {
         var username = string.IsNullOrWhiteSpace(p.TelegramUsername)

src/GmRelay.Web/Services/AuthorizedSessionService.cs

@@ -229,6 +229,22 @@ public sealed class AuthorizedSessionService(ISessionStore sessionStore, IHttpCo
             await sessionStore.LogSessionChangeAsync(sessionId, identity.Value.ExternalUserId, identity.Value.Name, "MaxPlayers", session.MaxPlayers?.ToString(), maxPlayers?.ToString());
     }
 
+    public async Task DeleteSessionForCurrentUserAsync(Guid sessionId)
+    {
+        var identity = GetCurrentIdentity();
+        if (identity is null)
+            throw new InvalidOperationException("User is not authenticated.");
+
+        var session = await GetSessionForCurrentUserAsync(sessionId);
+        if (session is null)
+        {
+            throw new SessionAccessDeniedException(sessionId, identity.Value.ExternalUserId);
+        }
+
+        var title = await sessionStore.DeleteSessionAsync(sessionId, session.GroupId);
+        await sessionStore.LogSessionChangeAsync(sessionId, identity.Value.ExternalUserId, identity.Value.Name, "Deleted", title, null);
+    }
+
     public async Task PromoteWaitlistedPlayerForCurrentUserAsync(Guid sessionId)
     {
         var identity = GetCurrentIdentity();

src/GmRelay.Web/Services/ISessionStore.cs

@@ -150,6 +150,7 @@ public interface ISessionStore
     Task<List<PlayerAttendanceStats>> GetGroupAttendanceStatsAsync(Guid groupId);
     Task LogSessionChangeAsync(Guid sessionId, string actorExternalUserId, string actorName, string changeType, string? oldValue, string? newValue);
     Task<List<SessionAuditLogEntry>> GetSessionHistoryAsync(Guid sessionId);
+    Task<string?> DeleteSessionAsync(Guid sessionId, Guid groupId);
     Task UpsertDiscordUserAsync(string discordId, string displayName, string? avatarUrl);
     Task<MasterProfileSettings?> GetMasterProfileSettingsAsync(string platform, string externalUserId);
     Task UpdateMasterProfileSettingsAsync(string platform, string externalUserId, string? publicSlug, bool isPublic, string displayName, string? bio);

src/GmRelay.Web/Services/SessionService.cs

@@ -129,6 +129,14 @@ internal sealed record WebBatchSessionRow(
     string? CoverImageUrl = null);
 internal sealed record WebTemplateGroupDto(long TelegramChatId);
 internal sealed record WebTemplateTopicDestination(int? MessageThreadId, bool TopicCreatedByBot);
+internal sealed record WebDeleteSessionInfo(
+    Guid Id,
+    string Title,
+    Guid BatchId,
+    long TelegramChatId,
+    int? BatchMessageId,
+    int? ThreadId,
+    bool TopicCreatedByBot);
 internal sealed record WebPublicGroupRow(
     Guid GroupId,
     string Name,
@@ -1086,6 +1094,95 @@ public sealed class SessionService(
         }
     }
 
+    public async Task<string?> DeleteSessionAsync(Guid sessionId, Guid groupId)
+    {
+        await using var conn = await dataSource.OpenConnectionAsync();
+        await using var transaction = await conn.BeginTransactionAsync();
+
+        var session = await conn.QuerySingleOrDefaultAsync<WebDeleteSessionInfo>(
+            """
+            SELECT s.id AS Id,
+                   s.title AS Title,
+                   s.batch_id AS BatchId,
+                   g.external_group_id::BIGINT AS TelegramChatId,
+                   s.batch_message_id AS BatchMessageId,
+                   s.thread_id AS ThreadId,
+                   s.topic_created_by_bot AS TopicCreatedByBot
+            FROM sessions s
+            JOIN game_groups g ON g.id = s.group_id
+            WHERE s.id = @SessionId AND s.group_id = @GroupId
+            FOR UPDATE
+            """,
+            new { SessionId = sessionId, GroupId = groupId },
+            transaction);
+
+        if (session is null)
+        {
+            throw new SessionAccessDeniedException(sessionId, "0");
+        }
+
+        await conn.ExecuteAsync(
+            """
+            UPDATE portfolio_games pg
+            SET is_public = false,
+                updated_at = now()
+            FROM portfolio_game_sessions pgs
+            WHERE pgs.portfolio_game_id = pg.id
+              AND pgs.session_id = @SessionId
+              AND pg.is_public = true
+            """,
+            new { SessionId = sessionId },
+            transaction);
+
+        await conn.ExecuteAsync(
+            "DELETE FROM sessions WHERE id = @Id AND group_id = @GroupId",
+            new { Id = sessionId, GroupId = groupId },
+            transaction);
+
+        var remainingInTopic = session.ThreadId.HasValue
+            ? await conn.ExecuteScalarAsync<int>(
+                """
+                SELECT COUNT(*)
+                FROM sessions
+                WHERE group_id = @GroupId
+                  AND thread_id = @ThreadId
+                """,
+                new { GroupId = groupId, ThreadId = session.ThreadId.Value },
+                transaction)
+            : 0;
+
+        await transaction.CommitAsync();
+
+        if (session.ThreadId.HasValue && session.TopicCreatedByBot && remainingInTopic == 0)
+        {
+            try
+            {
+                await bot.DeleteForumTopic(
+                    chatId: session.TelegramChatId,
+                    messageThreadId: session.ThreadId.Value);
+                logger.LogInformation(
+                    "Deleted forum topic {ThreadId} for group {GroupId} as no sessions remained.",
+                    session.ThreadId.Value,
+                    groupId);
+            }
+            catch (Exception ex)
+            {
+                logger.LogWarning(
+                    ex,
+                    "Failed to delete forum topic {ThreadId} for group {GroupId}",
+                    session.ThreadId.Value,
+                    groupId);
+            }
+        }
+
+        if (session.BatchMessageId.HasValue)
+        {
+            await TryUpdateBatchMessageAsync(session.BatchId, session.TelegramChatId, session.BatchMessageId.Value, session.Title);
+        }
+
+        return session.Title;
+    }
+
     public async Task PromoteWaitlistedPlayerAsync(Guid sessionId, Guid groupId)
     {
         await using var conn = await dataSource.OpenConnectionAsync();

tests/GmRelay.Bot.Tests/Discord/DiscordNewSessionHandlerTests.cs

@@ -1,225 +0,0 @@
-using GmRelay.DiscordBot.Features.Sessions;
-
-namespace GmRelay.Bot.Tests.Discord;
-
-public sealed class DiscordNewSessionHandlerTests
-{
-    private static string GetRepoRoot()
-    {
-        var dir = AppContext.BaseDirectory;
-        while (!string.IsNullOrEmpty(dir) && !File.Exists(Path.Combine(dir, "Directory.Build.props")))
-        {
-            dir = Directory.GetParent(dir)?.FullName;
-        }
-
-        return dir ?? throw new InvalidOperationException("Could not find repo root");
-    }
-
-    // --- Runtime tests for ParseTimeInput (static, no DB) ---
-
-    [Fact]
-    public void ParseTimeInput_ShouldTreatInputAsMoscowTime()
-    {
-        var future = DateTimeOffset.UtcNow.AddDays(7);
-        var result = DiscordNewSessionHandler.ParseTimeInput(
-            future.ToString("yyyy-MM-dd '15:00'", System.Globalization.CultureInfo.InvariantCulture));
-
-        Assert.True(result.IsSuccess);
-        // 15:00 MSK = 12:00 UTC
-        Assert.Equal(12, result.Value.Hour);
-        Assert.Equal(0, result.Value.Minute);
-        Assert.Equal(TimeSpan.Zero, result.Value.Offset);
-    }
-
-    [Fact]
-    public void ParseTimeInput_ShouldParseDiscordDateFormat()
-    {
-        var expected = FutureDateAt1930();
-        var result = DiscordNewSessionHandler.ParseTimeInput(
-            expected.ToString("yyyy-MM-dd HH:mm", System.Globalization.CultureInfo.InvariantCulture));
-
-        Assert.True(result.IsSuccess);
-        Assert.Equal(expected.Year, result.Value.Year);
-        Assert.Equal(expected.Month, result.Value.Month);
-        Assert.Equal(expected.Day, result.Value.Day);
-        // Input is treated as Moscow time; 19:30 MSK = 16:30 UTC
-        Assert.Equal(16, result.Value.Hour);
-        Assert.Equal(30, result.Value.Minute);
-    }
-
-    [Fact]
-    public void ParseTimeInput_ShouldRejectPastDate()
-    {
-        var result = DiscordNewSessionHandler.ParseTimeInput("2020-01-01 00:00");
-        Assert.False(result.IsSuccess);
-    }
-
-    [Fact]
-    public void ParseTimeInput_ShouldParseRussianDateFormat()
-    {
-        var expected = FutureDateAt1930();
-        var result = DiscordNewSessionHandler.ParseTimeInput(
-            expected.ToString("dd.MM.yyyy HH:mm", System.Globalization.CultureInfo.InvariantCulture));
-
-        Assert.True(result.IsSuccess);
-        Assert.Equal(expected.Year, result.Value.Year);
-        Assert.Equal(expected.Month, result.Value.Month);
-        Assert.Equal(expected.Day, result.Value.Day);
-    }
-
-    [Fact]
-    public void ParseTimeInput_ShouldRejectInvalidFormat()
-    {
-        var result = DiscordNewSessionHandler.ParseTimeInput("not-a-date");
-        Assert.False(result.IsSuccess);
-        Assert.NotNull(result.Error);
-    }
-
-    // --- Source-level structural tests ---
-
-    [Fact]
-    public void Handler_ShouldExist()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        Assert.True(File.Exists(handlerPath), "DiscordNewSessionHandler should exist.");
-    }
-
-    [Fact]
-    public void Handler_ShouldUseDapperForDatabaseAccess()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("QueryAsync", source, StringComparison.Ordinal);
-        Assert.Contains("ExecuteAsync", source, StringComparison.Ordinal);
-        Assert.Contains("ExecuteScalarAsync", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldUseNpgsqlDataSource()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("NpgsqlDataSource", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldCheckPermissionsViaPermissionChecker()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("CanManageSchedule", source, StringComparison.Ordinal);
-        Assert.Contains("UnauthorizedAccessException", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldLoadCoGmPermissionsFromDiscordPlayers()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Matches(
-            @"QueryAsync<ulong>[\s\S]*JOIN players p ON p\.id = gm\.player_id[\s\S]*p\.platform = 'Discord'[\s\S]*g\.external_group_id = @GuildId",
-            source);
-    }
-
-    [Fact]
-    public void Handler_ShouldBePlatformNeutral()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.DoesNotContain("telegram_chat_id", source, StringComparison.Ordinal);
-        Assert.DoesNotContain("telegram_id", source, StringComparison.Ordinal);
-        Assert.Contains("platform = 'Discord'", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldUseTransactions()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("BeginTransactionAsync", source, StringComparison.Ordinal);
-        Assert.Contains("CommitAsync", source, StringComparison.Ordinal);
-        Assert.Contains("RollbackAsync", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldNotRollbackCommittedTransactionAfterPostCommitFailure()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("transactionCommitted = false", source, StringComparison.Ordinal);
-        Assert.Contains("transactionCommitted = true", source, StringComparison.Ordinal);
-        Assert.Contains("if (!transactionCommitted)", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldRespectCancellationToken()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("CancellationToken", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Command_ShouldRenderEmbedOnSuccess()
-    {
-        var repoRoot = GetRepoRoot();
-        var commandPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionCommand.cs");
-        var source = File.ReadAllText(commandPath);
-
-        Assert.Contains("DiscordSessionBatchRenderer.Render", source, StringComparison.Ordinal);
-        Assert.Contains("message.Embeds = embeds", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldLeaveScheduleMessageCreationToInteractionResponse()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.DoesNotContain("SendScheduleAsync", source, StringComparison.Ordinal);
-        Assert.DoesNotContain("PlatformScheduleMessage", source, StringComparison.Ordinal);
-    }
-
-    [Fact]
-    public void Handler_ShouldStoreReadableDiscordGroupNameForWebCards()
-    {
-        var repoRoot = GetRepoRoot();
-        var handlerPath = Path.Combine(repoRoot, "src", "GmRelay.DiscordBot", "Features", "Sessions", "DiscordNewSessionHandler.cs");
-        var source = File.ReadAllText(handlerPath);
-
-        Assert.Contains("groupName", source, StringComparison.Ordinal);
-        Assert.Contains("displayGroupName", source, StringComparison.Ordinal);
-        Assert.Contains("VALUES (@GroupName, 'Discord'", source, StringComparison.Ordinal);
-    }
-
-    private static DateTimeOffset FutureDateAt1930()
-    {
-        var future = DateTimeOffset.UtcNow.AddDays(7);
-        return new DateTimeOffset(
-            future.Year,
-            future.Month,
-            future.Day,
-            19,
-            30,
-            0,
-            TimeSpan.Zero);
-    }
-}

tests/GmRelay.Bot.Tests/Discord/DiscordStartupTests.cs

@@ -2,6 +2,7 @@ using System;
 using System.IO;
 using System.Reflection;
 using GmRelay.DiscordBot.Features.Sessions;
+using GmRelay.DiscordBot.Features.Sessions.Wizard;
 using NetCord.Services.ApplicationCommands;
 
 namespace GmRelay.Bot.Tests.Discord;
@@ -54,7 +55,6 @@ public sealed class DiscordStartupTests
     }
 
     [Theory]
-    [InlineData(typeof(DiscordNewSessionCommand), "newsession")]
     [InlineData(typeof(DiscordListSessionsCommand), "listsessions")]
     [InlineData(typeof(DiscordRescheduleCommand), "reschedule")]
     public void DiscordSessionSlashCommands_ShouldBeDeclaredOnModuleMethods(Type moduleType, string commandName)
@@ -76,15 +76,28 @@ public sealed class DiscordStartupTests
     {
         var service = new ApplicationCommandService<SlashCommandContext>();
 
-        service.AddModules(typeof(DiscordNewSessionCommand).Assembly);
+        service.AddModules(typeof(DiscordListSessionsCommand).Assembly);
+
+        var commandNames = service.GetCommands()
+            .Select(command => command.Name)
+            .ToArray();
+
+        Assert.Contains("listsessions", commandNames);
+        Assert.Contains("reschedule", commandNames);
+    }
+
+    [Fact]
+    public void DiscordSessionSlashCommands_ShouldIncludeNewSessionWizard()
+    {
+        var service = new ApplicationCommandService<SlashCommandContext>();
+
+        service.AddModules(typeof(DiscordWizardCommand).Assembly);
 
         var commandNames = service.GetCommands()
             .Select(command => command.Name)
             .ToArray();
 
         Assert.Contains("newsession", commandNames);
-        Assert.Contains("listsessions", commandNames);
-        Assert.Contains("reschedule", commandNames);
     }
 
     [Fact]
@@ -114,7 +127,6 @@ public sealed class DiscordStartupTests
     {
         var program = ReadProgram();
         Assert.Contains("DiscordListSessionsHandler", program);
-        Assert.Contains("DiscordNewSessionHandler", program);
         Assert.Contains("JoinSessionHandler", program);
         Assert.Contains("LeaveSessionHandler", program);
         Assert.Contains("DiscordPermissionChecker", program);

tests/GmRelay.Bot.Tests/Discord/DiscordTimeParserTests.cs

@@ -0,0 +1,77 @@
+using GmRelay.DiscordBot.Features.Sessions;
+
+namespace GmRelay.Bot.Tests.Discord;
+
+public sealed class DiscordTimeParserTests
+{
+    [Fact]
+    public void ParseTimeInput_ShouldTreatInputAsMoscowTime()
+    {
+        var future = DateTimeOffset.UtcNow.AddDays(7);
+        var result = DiscordTimeParser.ParseTimeInput(
+            future.ToString("yyyy-MM-dd '15:00'", System.Globalization.CultureInfo.InvariantCulture));
+
+        Assert.True(result.IsSuccess);
+        // 15:00 MSK = 12:00 UTC
+        Assert.Equal(12, result.Value.Hour);
+        Assert.Equal(0, result.Value.Minute);
+        Assert.Equal(TimeSpan.Zero, result.Value.Offset);
+    }
+
+    [Fact]
+    public void ParseTimeInput_ShouldParseDiscordDateFormat()
+    {
+        var expected = FutureDateAt1930();
+        var result = DiscordTimeParser.ParseTimeInput(
+            expected.ToString("yyyy-MM-dd HH:mm", System.Globalization.CultureInfo.InvariantCulture));
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(expected.Year, result.Value.Year);
+        Assert.Equal(expected.Month, result.Value.Month);
+        Assert.Equal(expected.Day, result.Value.Day);
+        // Input is treated as Moscow time; 19:30 MSK = 16:30 UTC
+        Assert.Equal(16, result.Value.Hour);
+        Assert.Equal(30, result.Value.Minute);
+    }
+
+    [Fact]
+    public void ParseTimeInput_ShouldRejectPastDate()
+    {
+        var result = DiscordTimeParser.ParseTimeInput("2020-01-01 00:00");
+        Assert.False(result.IsSuccess);
+    }
+
+    [Fact]
+    public void ParseTimeInput_ShouldParseRussianDateFormat()
+    {
+        var expected = FutureDateAt1930();
+        var result = DiscordTimeParser.ParseTimeInput(
+            expected.ToString("dd.MM.yyyy HH:mm", System.Globalization.CultureInfo.InvariantCulture));
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(expected.Year, result.Value.Year);
+        Assert.Equal(expected.Month, result.Value.Month);
+        Assert.Equal(expected.Day, result.Value.Day);
+    }
+
+    [Fact]
+    public void ParseTimeInput_ShouldRejectInvalidFormat()
+    {
+        var result = DiscordTimeParser.ParseTimeInput("not-a-date");
+        Assert.False(result.IsSuccess);
+        Assert.NotNull(result.Error);
+    }
+
+    private static DateTimeOffset FutureDateAt1930()
+    {
+        var future = DateTimeOffset.UtcNow.AddDays(7);
+        return new DateTimeOffset(
+            future.Year,
+            future.Month,
+            future.Day,
+            19,
+            30,
+            0,
+            TimeSpan.Zero);
+    }
+}

tests/GmRelay.Bot.Tests/Discord/Wizard/DiscordWizardStepCapacityRenderTests.cs

@@ -56,6 +56,29 @@ public sealed class DiscordWizardStepCapacityRenderTests
             .Select(b => b.Label ?? string.Empty)
             .ToList();
 
+    [Fact]
+    public void RenderFormat_ContainsOnlineAndOfflineButtons()
+    {
+        var draft = new WizardDraft { Step = WizardStepNames.Format };
+        var render = DiscordWizardStep.Render(draft, new WizardPayload());
+
+        var labels = ExtractButtonLabels(render);
+        Assert.Contains(labels, l => l.Contains("Online", System.StringComparison.Ordinal));
+        Assert.Contains(labels, l => l.Contains("Offline", System.StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData(WizardSessionFormat.Online, "🔗 Ссылка")]
+    [InlineData(WizardSessionFormat.Offline, "📍 Адрес")]
+    public void RenderLocation_ForFormat_OpensModalAndShowsPrompt(WizardSessionFormat format, string expectedTitle)
+    {
+        var draft = new WizardDraft { Step = WizardStepNames.Location };
+        var render = DiscordWizardStep.Render(draft, new WizardPayload { Format = format });
+
+        Assert.Equal(expectedTitle, render.EmbedTitle);
+        Assert.Equal(WizardStepNames.Location, render.OpenModalStep);
+    }
+
     private static System.Collections.Generic.List<ButtonProperties> ExtractButtons(
         DiscordWizardStep.DiscordWizardRender render) =>
         render.Components

tests/GmRelay.Bot.Tests/Discord/Wizard/DiscordWizardSubmitterBuildCommandTests.cs

@@ -82,4 +82,117 @@ public sealed class DiscordWizardSubmitterBuildCommandTests
 
         Assert.Equal(5, cmd.MaxPlayers);
     }
+
+    [Fact]
+    public void BuildCommand_WhenFormatIsOnline_PropagatesFormatAndJoinLink()
+    {
+        var draft = new WizardDraft
+        {
+            Id = Guid.NewGuid(),
+            ChatId = "42",
+            OwnerId = "100",
+            Step = "confirm",
+        };
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Single,
+            Title = "T",
+            System = "Dnd5e",
+            DurationMinutes = 240,
+            Visibility = WizardVisibility.Public,
+            Format = WizardSessionFormat.Online,
+            JoinLink = "https://vtt.example/game",
+            Single = new WizardSingleInput
+            {
+                ScheduledAt = DateTimeOffset.UtcNow.AddDays(1),
+                MaxPlayers = 5,
+            },
+        };
+
+        var cmd = DiscordWizardSubmitter.BuildCommand(
+            draft,
+            payload,
+            new[] { payload.Single!.ScheduledAt!.Value },
+            payload.Single.MaxPlayers,
+            isOneShot: true);
+
+        Assert.Equal("Online", cmd.Format);
+        Assert.Equal("https://vtt.example/game", cmd.Link);
+        Assert.Null(cmd.LocationAddress);
+    }
+
+    [Fact]
+    public void BuildCommand_WhenFormatIsOffline_PropagatesFormatAndAddress()
+    {
+        var draft = new WizardDraft
+        {
+            Id = Guid.NewGuid(),
+            ChatId = "42",
+            OwnerId = "100",
+            Step = "confirm",
+        };
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Single,
+            Title = "T",
+            System = "Dnd5e",
+            DurationMinutes = 240,
+            Visibility = WizardVisibility.Public,
+            Format = WizardSessionFormat.Offline,
+            LocationAddress = "Москва, ул. Кубиков, 12",
+            Single = new WizardSingleInput
+            {
+                ScheduledAt = DateTimeOffset.UtcNow.AddDays(1),
+                MaxPlayers = 5,
+            },
+        };
+
+        var cmd = DiscordWizardSubmitter.BuildCommand(
+            draft,
+            payload,
+            new[] { payload.Single!.ScheduledAt!.Value },
+            payload.Single.MaxPlayers,
+            isOneShot: true);
+
+        Assert.Equal("Offline", cmd.Format);
+        Assert.Equal("Москва, ул. Кубиков, 12", cmd.LocationAddress);
+        Assert.Equal(string.Empty, cmd.Link);
+    }
+
+    [Fact]
+    public void BuildCommand_WhenPoolMaxPlayersIsSet_PropagatesValueToMaxPlayers()
+    {
+        var draft = new WizardDraft
+        {
+            Id = Guid.NewGuid(),
+            ChatId = "42",
+            OwnerId = "100",
+            Step = "confirm",
+        };
+        var slotTime = DateTimeOffset.UtcNow.AddDays(1);
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Pool,
+            Title = "Pool",
+            System = "Dnd5e",
+            DurationMinutes = 240,
+            Visibility = WizardVisibility.Public,
+            Format = WizardSessionFormat.Online,
+            JoinLink = "https://vtt.example/game",
+            Pool = new WizardPoolInput
+            {
+                MaxPlayers = 12,
+                Slots = { new WizardSlotInput { ScheduledAt = slotTime, MaxPlayers = 8 } },
+            },
+        };
+
+        var cmd = DiscordWizardSubmitter.BuildCommand(
+            draft,
+            payload,
+            new[] { slotTime },
+            payload.Pool.MaxPlayers,
+            isOneShot: false);
+
+        Assert.Equal(12, cmd.MaxPlayers);
+    }
 }

tests/GmRelay.Bot.Tests/Features/Sessions/CreateSession/Wizard/GameCreationWizardStepTransitionsTests.cs

@@ -46,7 +46,7 @@ public sealed class GameCreationWizardStepTransitionsTests
     }
 
     [Fact]
-    public async Task PoolSystemDuration_PreselectedButton_AdvancesToFormat()
+    public async Task PoolSystemDuration_PreselectedButton_AdvancesToCapacity()
     {
         var wizard = BuildWizard(out var drafts, out _);
         var payload = new WizardPayload
@@ -60,7 +60,7 @@ public sealed class GameCreationWizardStepTransitionsTests
         var data = WizardCallbackData.Choice(WizardStepNames.PoolSystemDuration, "Dnd5e:240");
         await wizard.HandleInteractionAsync(CallbackInteraction(data, ownerId: draft.OwnerId), draft, CancellationToken.None);
 
-        Assert.Equal(WizardStepNames.Format, draft.Step);
+        Assert.Equal(WizardStepNames.Capacity, draft.Step);
         using var doc = JsonDocument.Parse(draft.PayloadJson);
         var root = doc.RootElement;
         Assert.True(root.TryGetProperty("system", out var sys));
@@ -69,6 +69,95 @@ public sealed class GameCreationWizardStepTransitionsTests
         Assert.Equal(240, dur.GetInt32());
     }
 
+    [Fact]
+    public async Task PoolCapacity_Text_AdvancesToFormat_AndSetsMaxPlayers()
+    {
+        var wizard = BuildWizard(out var drafts, out _);
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Pool,
+            Title = "Pool",
+            System = "Dnd5e",
+            DurationMinutes = 240,
+        };
+        var draft = NewDraft(WizardStepNames.Capacity, payload);
+        drafts.Seed(draft);
+
+        await wizard.HandleInteractionAsync(TextInteraction("10", ownerId: draft.OwnerId), draft, CancellationToken.None);
+
+        Assert.Equal(WizardStepNames.Format, draft.Step);
+        using var doc = JsonDocument.Parse(draft.PayloadJson);
+        var root = doc.RootElement;
+        Assert.True(root.TryGetProperty("pool", out var pool));
+        Assert.True(pool.TryGetProperty("maxPlayers", out var maxPlayers));
+        Assert.Equal(10, maxPlayers.GetInt32());
+    }
+
+    [Fact]
+    public async Task PoolSystemDuration_FreeTextDuration_AdvancesToCapacity()
+    {
+        var wizard = BuildWizard(out var drafts, out _);
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Pool,
+            Title = "Pool",
+            System = "Dnd5e",
+        };
+        var draft = NewDraft(WizardStepNames.PoolSystemDuration, payload);
+        drafts.Seed(draft);
+
+        await wizard.HandleInteractionAsync(TextInteraction("4", ownerId: draft.OwnerId), draft, CancellationToken.None);
+
+        Assert.Equal(WizardStepNames.Capacity, draft.Step);
+        using var doc = JsonDocument.Parse(draft.PayloadJson);
+        var root = doc.RootElement;
+        Assert.True(root.TryGetProperty("durationMinutes", out var dur));
+        Assert.Equal(240, dur.GetInt32());
+    }
+
+    [Fact]
+    public async Task Back_FromPoolCapacity_GoesToPoolSystemDuration()
+    {
+        var wizard = BuildWizard(out var drafts, out _);
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Pool,
+            Title = "Pool",
+            System = "Dnd5e",
+            DurationMinutes = 240,
+        };
+        var draft = NewDraft(WizardStepNames.Capacity, payload);
+        drafts.Seed(draft);
+
+        var data = WizardCallbackData.Back();
+        await wizard.HandleInteractionAsync(CallbackInteraction(data, ownerId: draft.OwnerId), draft, CancellationToken.None);
+
+        Assert.Equal(WizardStepNames.PoolSystemDuration, draft.Step);
+    }
+
+    [Theory]
+    [InlineData("waitlist:on")]
+    [InlineData("waitlist:off")]
+    public async Task Capacity_WithMaxPlayersAndWaitlist_AdvancesToFormat(string waitlistChoice)
+    {
+        var wizard = BuildWizard(out var drafts, out _);
+        var payload = new WizardPayload
+        {
+            Type = WizardCreationType.Single,
+            Title = "T",
+            System = "Dnd5e",
+            DurationMinutes = 240,
+            Single = new WizardSingleInput { ScheduledAt = DateTimeOffset.UtcNow.AddDays(1), MaxPlayers = 5 },
+        };
+        var draft = NewDraft(WizardStepNames.Capacity, payload);
+        drafts.Seed(draft);
+
+        var data = WizardCallbackData.Choice(WizardStepNames.Capacity, waitlistChoice);
+        await wizard.HandleInteractionAsync(CallbackInteraction(data, ownerId: draft.OwnerId), draft, CancellationToken.None);
+
+        Assert.Equal(WizardStepNames.Format, draft.Step);
+    }
+
     [Fact]
     public async Task NoLimitCapacityButton_AdvancesToVisibility_AndLeavesMaxPlayersNull()
     {

tests/GmRelay.Bot.Tests/Features/Sessions/ListSessions/SessionListMessageRendererTests.cs

@@ -20,7 +20,9 @@ public sealed class SessionListMessageRendererTests
                 4,
                 3,
                 1,
-                true)
+                true,
+                false,
+                false)
         };
 
         var text = SessionListMessageRenderer.RenderText(sessions);
@@ -32,25 +34,92 @@ public sealed class SessionListMessageRendererTests
         Assert.Contains(actions, a => a.Payload == $"reschedule_session:{sessionId}");
         Assert.Contains(actions, a => a.Payload == $"promote_waitlist:{sessionId}");
         Assert.Contains(actions, a => a.Payload == $"delete_session:{sessionId}");
+
+        var shortDate = new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc).FormatMoscowShort();
+        Assert.Contains(actions, a => a.Label == $"❌ Отменить {shortDate}");
+        Assert.Contains(actions, a => a.Label == $"⏰ Перенести {shortDate}");
+        Assert.Contains(actions, a => a.Label == $"⬆️ С ожидания {shortDate}");
+        Assert.Contains(actions, a => a.Label == $"🗑 Удалить {shortDate}");
     }
 
     [Fact]
-    public void Render_ShouldHideManagerActions_WhenUserCannotManage()
+    public void Render_ShouldIncludeJoinAction_WhenPlayerIsNotRegistered()
     {
+        var sessionId = Guid.NewGuid();
         var sessions = new[]
         {
             new SessionListItemDto(
-                Guid.NewGuid(),
+                sessionId,
+                "Ravenloft",
+                new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc),
+                SessionStatus.Planned,
+                4,
+                3,
+                0,
+                false,
+                false,
+                false)
+        };
+
+        var actions = SessionListMessageRenderer.RenderActions(sessions);
+        var shortDate = new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc).FormatMoscowShort();
+
+        Assert.Single(actions);
+        Assert.Contains(actions, a => a.Payload == $"join_session:{sessionId}");
+        Assert.Contains(actions, a => a.Label == $"✅ Записаться {shortDate}");
+    }
+
+    [Fact]
+    public void Render_ShouldIncludeLeaveAction_WhenPlayerIsActive()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[]
+        {
+            new SessionListItemDto(
+                sessionId,
+                "Ravenloft",
+                new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc),
+                SessionStatus.Planned,
+                4,
+                3,
+                0,
+                false,
+                true,
+                false)
+        };
+
+        var actions = SessionListMessageRenderer.RenderActions(sessions);
+        var shortDate = new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc).FormatMoscowShort();
+
+        Assert.Single(actions);
+        Assert.Contains(actions, a => a.Payload == $"leave_session:{sessionId}");
+        Assert.Contains(actions, a => a.Label == $"✖️ Выйти {shortDate}");
+    }
+
+    [Fact]
+    public void Render_ShouldIncludeLeaveWaitlistAction_WhenPlayerIsWaitlisted()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[]
+        {
+            new SessionListItemDto(
+                sessionId,
                 "Ravenloft",
                 new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc),
                 SessionStatus.Planned,
                 4,
                 3,
                 1,
-                false)
+                false,
+                false,
+                true)
         };
 
         var actions = SessionListMessageRenderer.RenderActions(sessions);
-        Assert.Empty(actions);
+        var shortDate = new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc).FormatMoscowShort();
+
+        Assert.Single(actions);
+        Assert.Contains(actions, a => a.Payload == $"leave_session:{sessionId}");
+        Assert.Contains(actions, a => a.Label == $"✖️ Выйти из ожидания {shortDate}");
     }
 }

tests/GmRelay.Bot.Tests/Web/AuthorizedPortfolioServiceTests.cs

@@ -815,6 +815,7 @@ public sealed class AuthorizedPortfolioServiceTests
         public Task<WebSession?> GetSessionAsync(Guid sessionId) => throw new NotImplementedException();
         public Task<WebSessionBatch?> GetBatchAsync(Guid batchId) => throw new NotImplementedException();
         public Task UpdateSessionAsync(Guid sessionId, Guid groupId, string title, DateTime scheduledAt, string joinLink, int? maxPlayers) => throw new NotImplementedException();
+        public Task<string?> DeleteSessionAsync(Guid sessionId, Guid groupId) => throw new NotImplementedException();
         public Task PromoteWaitlistedPlayerAsync(Guid sessionId, Guid groupId) => throw new NotImplementedException();
         public Task UpdateBatchDetailsAsync(Guid batchId, Guid groupId, string title, string joinLink) => throw new NotImplementedException();
         public Task UpdateBatchNotificationModeAsync(Guid batchId, Guid groupId, SessionNotificationMode notificationMode) => throw new NotImplementedException();

tests/GmRelay.Bot.Tests/Web/AuthorizedSessionServiceTests.cs

@@ -765,6 +765,58 @@ public sealed class AuthorizedSessionServiceTests
         Assert.False(store.CreateBatchFromTemplateCalled);
     }
 
+    [Fact]
+    public async Task DeleteSessionForCurrentUserAsync_Deletes_WhenSessionBelongsToManager()
+    {
+        var gmId = 1001L;
+        var groupId = Guid.NewGuid();
+        var sessionId = Guid.NewGuid();
+        var store = new FakeSessionStore(
+            groups:
+            [
+                new(groupId, 42, "Alpha", gmId)
+            ],
+            sessions:
+            [
+                new(sessionId, groupId, "Session A", DateTime.UtcNow, "Planned", "https://example.test/a", Guid.NewGuid(), 10, 42, 4, 1, 0)
+            ]);
+        var accessor = CreateAccessor(gmId.ToString(System.Globalization.CultureInfo.InvariantCulture));
+        var service = new AuthorizedSessionService(store, accessor);
+
+        await service.DeleteSessionForCurrentUserAsync(sessionId);
+
+        Assert.True(store.DeleteCalled);
+        Assert.Equal(sessionId, store.LastDeletedSessionId);
+        Assert.Equal(groupId, store.LastDeletedGroupId);
+        Assert.Null(await store.GetSessionAsync(sessionId));
+    }
+
+    [Fact]
+    public async Task DeleteSessionForCurrentUserAsync_Throws_WhenSessionDoesNotBelongToManager()
+    {
+        var gmId = 1001L;
+        var otherGmId = 2002L;
+        var groupId = Guid.NewGuid();
+        var otherGroupId = Guid.NewGuid();
+        var sessionId = Guid.NewGuid();
+        var store = new FakeSessionStore(
+            groups:
+            [
+                new(groupId, 42, "Alpha", gmId),
+                new(otherGroupId, 43, "Beta", otherGmId)
+            ],
+            sessions:
+            [
+                new(sessionId, otherGroupId, "Session B", DateTime.UtcNow, "Planned", "https://example.test/b", Guid.NewGuid(), 10, 43, 4, 1, 0)
+            ]);
+        var accessor = CreateAccessor(gmId.ToString(System.Globalization.CultureInfo.InvariantCulture));
+        var service = new AuthorizedSessionService(store, accessor);
+
+        await Assert.ThrowsAsync<SessionAccessDeniedException>(
+            () => service.DeleteSessionForCurrentUserAsync(sessionId));
+        Assert.False(store.DeleteCalled);
+    }
+
     private sealed class FakeSessionStore(
         IEnumerable<WebGameGroup>? groups = null,
         IEnumerable<WebSession>? sessions = null,
@@ -796,6 +848,9 @@ public sealed class AuthorizedSessionServiceTests
         public DateTime? LastUpdatedScheduledAt { get; private set; }
         public string? LastUpdatedJoinLink { get; private set; }
         public int? LastUpdatedMaxPlayers { get; private set; }
+        public bool DeleteCalled { get; private set; }
+        public Guid? LastDeletedSessionId { get; private set; }
+        public Guid? LastDeletedGroupId { get; private set; }
         public Guid? LastPromotedSessionId { get; private set; }
         public Guid? LastPromotedGroupId { get; private set; }
         public Guid? LastUpdatedBatchId { get; private set; }
@@ -1036,6 +1091,15 @@ public sealed class AuthorizedSessionServiceTests
             return Task.CompletedTask;
         }
 
+        public Task<string?> DeleteSessionAsync(Guid sessionId, Guid groupId)
+        {
+            DeleteCalled = true;
+            LastDeletedSessionId = sessionId;
+            LastDeletedGroupId = groupId;
+            sessionsById.Remove(sessionId);
+            return Task.FromResult<string?>("Deleted session");
+        }
+
         public Task PromoteWaitlistedPlayerAsync(Guid sessionId, Guid groupId)
         {
             PromoteCalled = true;

tests/GmRelay.Bot.Tests/Web/TelegramAuthPayloadBuilderTests.cs

@@ -0,0 +1,223 @@
+using System.Security.Cryptography;
+using System.Text;
+using GmRelay.Shared.Telegram;
+using GmRelay.Web.Services;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Primitives;
+
+namespace GmRelay.Bot.Tests.Web;
+
+public sealed class TelegramAuthPayloadBuilderTests
+{
+    [Fact]
+    public void BuildLoginWidget_ShouldGeneratePayloadAcceptedByAuthService()
+    {
+        const string botToken = "test-bot-token";
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(
+            botToken,
+            424242L,
+            "Ada",
+            "Lovelace",
+            "ada");
+
+        var query = ParseQueryString(result.QueryString);
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.Verify(query, out var telegramId, out var name);
+
+        Assert.True(verified);
+        Assert.Equal(424242L, telegramId);
+        Assert.Equal("Ada Lovelace", name);
+    }
+
+    [Fact]
+    public void BuildLoginWidget_ShouldBeRejectedWhenTampered()
+    {
+        const string botToken = "test-bot-token";
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(botToken, 424242L, "Ada");
+        var tamperedQuery = ParseQueryString(result.QueryString.Replace("hash=", "hash=00", StringComparison.Ordinal));
+
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.Verify(tamperedQuery, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void BuildLoginWidget_ShouldBeRejectedWhenExpired()
+    {
+        const string botToken = "test-bot-token";
+        var expiredAuthDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds();
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(
+            botToken,
+            424242L,
+            "Ada",
+            authDate: expiredAuthDate);
+
+        var query = ParseQueryString(result.QueryString);
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.Verify(query, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void BuildMiniAppInitData_ShouldGeneratePayloadAcceptedByAuthService()
+    {
+        const string botToken = "test-bot-token";
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(
+            botToken,
+            424242L,
+            "Ada",
+            "Lovelace",
+            "ada");
+
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.VerifyWebAppInitData(result.InitDataRaw, out var telegramId, out var name);
+
+        Assert.True(verified);
+        Assert.Equal(424242L, telegramId);
+        Assert.Equal("Ada Lovelace", name);
+    }
+
+    [Fact]
+    public void BuildMiniAppInitData_ShouldBeRejectedWhenTampered()
+    {
+        const string botToken = "test-bot-token";
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(botToken, 424242L, "Ada");
+        var tamperedInitData = result.InitDataRaw.Replace("hash=", "hash=00", StringComparison.Ordinal);
+
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.VerifyWebAppInitData(tamperedInitData, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void BuildMiniAppInitData_ShouldBeRejectedWhenExpired()
+    {
+        const string botToken = "test-bot-token";
+        var expiredAuthDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds();
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(
+            botToken,
+            424242L,
+            "Ada",
+            authDate: expiredAuthDate);
+
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.VerifyWebAppInitData(result.InitDataRaw, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void BuildMiniAppInitData_ShouldIncludeOptionalFields()
+    {
+        const string botToken = "test-bot-token";
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(
+            botToken,
+            424242L,
+            "Ada",
+            "Lovelace",
+            "ada",
+            photoUrl: "https://t.me/i/userpic/320/ada.jpg",
+            languageCode: "en",
+            isPremium: true,
+            chatId: -1001234567890L,
+            chatType: "supergroup",
+            chatTitle: "Test Club",
+            queryId: "AAHdF6IQAAAAAN0XohDhrOrc",
+            startParam: "ref123");
+
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.VerifyWebAppInitData(result.InitDataRaw, out var telegramId, out var name);
+
+        Assert.True(verified);
+        Assert.Equal(424242L, telegramId);
+        Assert.Equal("Ada Lovelace", name);
+        Assert.Contains("start_param=ref123", result.InitDataRaw, StringComparison.Ordinal);
+        Assert.Contains("query_id=", result.InitDataRaw, StringComparison.Ordinal);
+        Assert.Contains("chat=%7B%22id%22%3A-1001234567890", result.InitDataRaw, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ComputeLoginWidgetHash_ShouldMatchTelegramAuthServiceExpectations()
+    {
+        const string botToken = "test-bot-token";
+        var values = new Dictionary<string, string>
+        {
+            ["auth_date"] = "1714300000",
+            ["first_name"] = "Ada",
+            ["id"] = "424242"
+        };
+
+        var hash = TelegramAuthPayloadBuilder.ComputeLoginWidgetHash(botToken, values);
+        var recomputed = ComputeLegacyTelegramHash(botToken, values);
+
+        Assert.Equal(recomputed, hash);
+    }
+
+    [Fact]
+    public void ComputeMiniAppHash_ShouldMatchTelegramAuthServiceExpectations()
+    {
+        const string botToken = "test-bot-token";
+        var values = new Dictionary<string, string>
+        {
+            ["auth_date"] = "1714300000",
+            ["user"] = """{"id":424242,"first_name":"Ada"}"""
+        };
+
+        var hash = TelegramAuthPayloadBuilder.ComputeMiniAppHash(botToken, values);
+        var recomputed = ComputeLegacyWebAppHash(botToken, values);
+
+        Assert.Equal(recomputed, hash);
+    }
+
+    private static IConfiguration CreateConfiguration(string botToken) =>
+        new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["Telegram:BotToken"] = botToken
+            })
+            .Build();
+
+    private static QueryCollection ParseQueryString(string queryString)
+    {
+        var parsed = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(queryString);
+        return new QueryCollection(parsed.ToDictionary(
+            pair => pair.Key,
+            pair => pair.Value));
+    }
+
+    // Legacy inline computation kept to prove the builder matches the original algorithm.
+    private static string ComputeLegacyTelegramHash(string botToken, IReadOnlyDictionary<string, string> values)
+    {
+        var dataCheckString = string.Join(
+            "\n",
+            values
+                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
+                .Select(pair => $"{pair.Key}={pair.Value}"));
+        var secretKey = SHA256.HashData(Encoding.UTF8.GetBytes(botToken));
+        var hashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
+        return Convert.ToHexString(hashBytes).ToLowerInvariant();
+    }
+
+    private static string ComputeLegacyWebAppHash(string botToken, IReadOnlyDictionary<string, string> values)
+    {
+        var dataCheckString = string.Join(
+            "\n",
+            values
+                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
+                .Select(pair => $"{pair.Key}={pair.Value}"));
+        var secretKey = HMACSHA256.HashData(Encoding.UTF8.GetBytes("WebAppData"), Encoding.UTF8.GetBytes(botToken));
+        var hashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
+        return Convert.ToHexString(hashBytes).ToLowerInvariant();
+    }
+}

tests/GmRelay.Bot.Tests/Web/TelegramAuthServiceTests.cs

@@ -1,6 +1,5 @@
-using System.Security.Cryptography;
-using System.Text;
 using System.Text.Json;
+using GmRelay.Shared.Telegram;
 using GmRelay.Web.Services;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Configuration;
@@ -14,17 +13,13 @@ public sealed class TelegramAuthServiceTests
     public void Verify_ShouldAcceptValidTelegramPayload()
     {
         const string botToken = "test-bot-token";
-        var authDate = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(
-        var query = CreateQueryCollection(
             botToken,
-            new Dictionary<string, string>
+            424242L,
-            {
+            "Ada",
-                ["auth_date"] = authDate,
+            "Lovelace",
-                ["first_name"] = "Ada",
+            "ada");
-                ["id"] = "424242",
+        var query = ParseQueryString(result.QueryString);
-                ["last_name"] = "Lovelace",
-                ["username"] = "ada"
-            });
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
         var verified = service.Verify(query, out var telegramId, out var name);
@@ -38,22 +33,11 @@ public sealed class TelegramAuthServiceTests
     public void Verify_ShouldRejectTamperedHash()
     {
         const string botToken = "test-bot-token";
-        var values = new Dictionary<string, string>
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(botToken, 424242L, "Ada");
-        {
+        var tamperedQuery = ParseQueryString(result.QueryString.Replace("hash=", "hash=00", StringComparison.Ordinal));
-            ["auth_date"] = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString(),
-            ["first_name"] = "Ada",
-            ["id"] = "424242"
-        };
-        var query = CreateQueryCollection(botToken, values);
-        var invalidQuery = new QueryCollection(new Dictionary<string, StringValues>(query.ToDictionary(
-            pair => pair.Key,
-            pair => pair.Value))
-        {
-            ["hash"] = "00"
-        });
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
-        var verified = service.Verify(invalidQuery, out _, out _);
+        var verified = service.Verify(tamperedQuery, out _, out _);
 
         Assert.False(verified);
     }
@@ -62,15 +46,13 @@ public sealed class TelegramAuthServiceTests
     public void Verify_ShouldRejectExpiredPayload()
     {
         const string botToken = "test-bot-token";
-        var expiredAuthDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds().ToString();
+        var expiredAuthDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds();
-        var query = CreateQueryCollection(
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(
             botToken,
-            new Dictionary<string, string>
+            424242L,
-            {
+            "Ada",
-                ["auth_date"] = expiredAuthDate,
+            authDate: expiredAuthDate);
-                ["first_name"] = "Ada",
+        var query = ParseQueryString(result.QueryString);
-                ["id"] = "424242"
-            });
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
         var verified = service.Verify(query, out _, out _);
@@ -82,17 +64,16 @@ public sealed class TelegramAuthServiceTests
     public void VerifyWebAppInitData_ShouldAcceptValidTelegramWebAppPayload()
     {
         const string botToken = "test-bot-token";
-        var initData = CreateWebAppInitData(
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(
             botToken,
-            new Dictionary<string, string>
+            424242L,
-            {
+            "Ada",
-                ["auth_date"] = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString(),
+            "Lovelace",
-                ["query_id"] = "AAHdF6IQAAAAAN0XohDhrOrc",
+            "ada",
-                ["user"] = """{"id":424242,"first_name":"Ada","last_name":"Lovelace","username":"ada"}"""
+            queryId: "AAHdF6IQAAAAAN0XohDhrOrc");
-            });
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
-        var verified = service.VerifyWebAppInitData(initData, out var telegramId, out var name);
+        var verified = service.VerifyWebAppInitData(result.InitDataRaw, out var telegramId, out var name);
 
         Assert.True(verified);
         Assert.Equal(424242L, telegramId);
@@ -103,14 +84,8 @@ public sealed class TelegramAuthServiceTests
     public void VerifyWebAppInitData_ShouldRejectTamperedHash()
     {
         const string botToken = "test-bot-token";
-        var initData = CreateWebAppInitData(
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(botToken, 424242L, "Ada");
-            botToken,
+        var tamperedInitData = result.InitDataRaw.Replace("hash=", "hash=00", StringComparison.Ordinal);
-            new Dictionary<string, string>
-            {
-                ["auth_date"] = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString(),
-                ["user"] = """{"id":424242,"first_name":"Ada"}"""
-            });
-        var tamperedInitData = initData.Replace("hash=", "hash=00", StringComparison.Ordinal);
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
         var verified = service.VerifyWebAppInitData(tamperedInitData, out _, out _);
@@ -122,16 +97,15 @@ public sealed class TelegramAuthServiceTests
     public void VerifyWebAppInitData_ShouldRejectExpiredPayload()
     {
         const string botToken = "test-bot-token";
-        var initData = CreateWebAppInitData(
+        var expiredAuthDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds();
+        var result = TelegramAuthPayloadBuilder.BuildMiniAppInitData(
             botToken,
-            new Dictionary<string, string>
+            424242L,
-            {
+            "Ada",
-                ["auth_date"] = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds().ToString(),
+            authDate: expiredAuthDate);
-                ["user"] = """{"id":424242,"first_name":"Ada"}"""
-            });
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
-        var verified = service.VerifyWebAppInitData(initData, out _, out _);
+        var verified = service.VerifyWebAppInitData(result.InitDataRaw, out _, out _);
 
         Assert.False(verified);
     }
@@ -141,23 +115,22 @@ public sealed class TelegramAuthServiceTests
     {
         const string botToken = "test-bot-token";
         var authDate = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
-        var values = new Dictionary<string, string>
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(
-        {
+            botToken,
-            ["auth_date"] = authDate.ToString(),
+            424242L,
-            ["first_name"] = "Ada",
-            ["id"] = "424242",
-            ["last_name"] = "Lovelace",
-            ["photo_url"] = "https://t.me/i/userpic/320/ada.jpg",
-            ["username"] = "ada"
-        };
-        var payload = new TelegramLoginPayload(
-            424242,
             "Ada",
             "Lovelace",
             "ada",
             "https://t.me/i/userpic/320/ada.jpg",
-            authDate,
+            authDate);
-            ComputeTelegramHash(botToken, values));
+        var payload = new TelegramLoginPayload(
+            result.TelegramId,
+            result.FirstName,
+            result.LastName,
+            result.Username,
+            result.PhotoUrl,
+            result.AuthDate,
+            result.Hash);
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
         var verified = service.VerifyLoginPayload(payload, out var telegramId, out var name);
@@ -190,20 +163,19 @@ public sealed class TelegramAuthServiceTests
     {
         const string botToken = "test-bot-token";
         var authDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds();
-        var values = new Dictionary<string, string>
+        var result = TelegramAuthPayloadBuilder.BuildLoginWidget(
-        {
+            botToken,
-            ["auth_date"] = authDate.ToString(),
+            424242L,
-            ["first_name"] = "Ada",
-            ["id"] = "424242"
-        };
-        var payload = new TelegramLoginPayload(
-            424242,
             "Ada",
-            null,
+            authDate: authDate);
-            null,
+        var payload = new TelegramLoginPayload(
-            null,
+            result.TelegramId,
-            authDate,
+            result.FirstName,
-            ComputeTelegramHash(botToken, values));
+            result.LastName,
+            result.Username,
+            result.PhotoUrl,
+            result.AuthDate,
+            result.Hash);
         var service = new TelegramAuthService(CreateConfiguration(botToken));
 
         var verified = service.VerifyLoginPayload(payload, out _, out _);
@@ -263,48 +235,11 @@ public sealed class TelegramAuthServiceTests
             })
             .Build();
 
-    private static QueryCollection CreateQueryCollection(string botToken, Dictionary<string, string> values)
+    private static QueryCollection ParseQueryString(string queryString)
     {
-        var hash = ComputeTelegramHash(botToken, values);
+        var parsed = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(queryString);
-        var queryValues = values.ToDictionary(
+        return new QueryCollection(parsed.ToDictionary(
             pair => pair.Key,
-            pair => new StringValues(pair.Value));
+            pair => pair.Value));
-        queryValues["hash"] = new StringValues(hash);
-        return new QueryCollection(queryValues);
-    }
-
-    private static string ComputeTelegramHash(string botToken, IReadOnlyDictionary<string, string> values)
-    {
-        var dataCheckString = string.Join(
-            "\n",
-            values
-                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
-                .Select(pair => $"{pair.Key}={pair.Value}"));
-        var secretKey = SHA256.HashData(Encoding.UTF8.GetBytes(botToken));
-        var hashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
-        return Convert.ToHexString(hashBytes).ToLowerInvariant();
-    }
-
-    private static string CreateWebAppInitData(string botToken, IReadOnlyDictionary<string, string> values)
-    {
-        var hash = ComputeTelegramWebAppHash(botToken, values);
-        var encodedPairs = values
-            .OrderBy(pair => pair.Key, StringComparer.Ordinal)
-            .Select(pair => $"{Uri.EscapeDataString(pair.Key)}={Uri.EscapeDataString(pair.Value)}")
-            .Append($"hash={hash}");
-
-        return string.Join("&", encodedPairs);
-    }
-
-    private static string ComputeTelegramWebAppHash(string botToken, IReadOnlyDictionary<string, string> values)
-    {
-        var dataCheckString = string.Join(
-            "\n",
-            values
-                .OrderBy(pair => pair.Key, StringComparer.Ordinal)
-                .Select(pair => $"{pair.Key}={pair.Value}"));
-        var secretKey = HMACSHA256.HashData(Encoding.UTF8.GetBytes("WebAppData"), Encoding.UTF8.GetBytes(botToken));
-        var hashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
-        return Convert.ToHexString(hashBytes).ToLowerInvariant();
     }
 }

tests/e2e/.gitignore

@@ -0,0 +1,31 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+.venv/
+env/
+venv/
+
+# Secrets
+.env
+*.env
+
+# Telegram sessions
+*.session
+*.session-journal
+
+# Playwright artifacts
+test-results/
+playwright-report/
+playwright/.cache/
+
+# .NET build artifacts
+bin/
+obj/
+packages.lock.json
+
+# IDE
+.vscode/
+.idea/
+*.user
+*.suo

tests/e2e/README.md

@@ -0,0 +1,140 @@
+# GmRelay E2E Tests
+
+This module contains locally-run end-to-end tests for the GmRelay Telegram bot and Blazor/Web dashboard.
+It is deliberately **not** wired into CI because it requires real Telegram infrastructure (MTProto user client) and a running Web instance.
+
+## Status
+
+Tracked as a Gitea milestone: [E2E Automation](https://git.codeanddice.ru/toutsu/GmRelayBot/issues?state=open&milestone=...)  <!-- update milestone link manually -->
+
+| Issue | Title | Status |
+|-------|-------|--------|
+| #144 | initData / Login Widget helper for mock Telegram auth | ✅ Done |
+| #145 | Playwright tests for Blazor dashboard with mocked Telegram auth | ✅ Done |
+| #146 | Telegram user client (MTProto) | ✅ Done |
+| #147 | Automate group creation and bot invitation | ✅ Done |
+| #148 | Scenario: /newsession from creation to publication | ✅ Done |
+| #149 | Join/leave, waitlist, reschedule and notification scenarios | ✅ Done |
+| #150 | Dashboard display and editing verification | ✅ Done |
+| #151 | Console runner and cleanup | ⏳ Planned |
+
+## Structure
+
+```text
+tests/e2e/
+├── README.md
+├── requirements.txt
+├── .gitignore
+├── helpers/
+│   ├── telegram_init_data.py      # Build valid Telegram auth payloads
+│   ├── test_telegram_init_data.py # Self-contained sanity tests for the helper
+│   └── __init__.py
+├── dashboard/
+│   ├── test_dashboard_auth_and_sessions.py  # Playwright tests for the Blazor dashboard
+│   └── __init__.py
+└── runner/
+    ├── GmRelay.E2E.Runner.csproj   # C# console runner using WTelegramClient (MTProto)
+    ├── Program.cs                  # Entry point for quick manual checks
+    ├── TelegramUserClient.cs       # Reusable MTProto user client wrapper
+    ├── GroupSetupScenario.cs                # Create group + invite bot + verify /start
+    ├── NewSessionScenario.cs                # Walk the /newsession wizard end-to-end
+    ├── JoinLeaveWaitlistRescheduleScenario.cs # Join, waitlist, promotion, leave, reschedule, notifications
+    ├── DatabaseAssertions.cs                # Query PostgreSQL and seed fake participants
+    ├── RunnerConfig.cs                      # Configuration model
+    ├── .env.example                         # Required environment variables
+    ├── .gitignore                           # Ignore .env and session files
+    └── packages.lock.json                   # Restored lock file for the runner project
+```
+
+## Install dependencies
+
+### Python (dashboard tests)
+
+```bash
+python -m venv .venv
+source .venv/bin/activate  # Windows: .venv\Scripts\activate
+pip install -r tests/e2e/requirements.txt
+playwright install chromium
+```
+
+### C# runner (MTProto)
+
+```bash
+dotnet restore tests/e2e/runner/GmRelay.E2E.Runner.csproj
+```
+
+## Run helper tests
+
+```bash
+python tests/e2e/helpers/test_telegram_init_data.py
+```
+
+## Run Playwright dashboard tests
+
+1. Start the Web dashboard (and PostgreSQL) locally. The fastest way:
+   ```bash
+   dotnet run --project src/GmRelay.AppHost/GmRelay.AppHost.csproj
+   ```
+2. Export environment variables that match the running Web instance:
+   ```bash
+   export GMRELAY_E2E_BASE_URL="http://localhost:8080"
+   export GMRELAY_E2E_BOT_TOKEN="<same-token-as-web>"
+   export GMRELAY_E2E_TELEGRAM_ID="9000000001"
+   export GMRELAY_E2E_DATABASE_URL="Host=localhost;Database=gmrelay;Username=postgres;Password=<password>"
+   ```
+3. Run the tests:
+   ```bash
+   python tests/e2e/dashboard/test_dashboard_auth_and_sessions.py
+   ```
+
+## Run the MTProto user client runner
+
+The runner logs in to a real Telegram user account, creates a supergroup, invites the test bot, sends `/start`, waits for a reply, and deletes the group.
+
+1. Copy the example environment file and fill in real values:
+   ```bash
+   cp tests/e2e/runner/.env.example tests/e2e/runner/.env
+   ```
+2. Edit `tests/e2e/runner/.env` with your Telegram `api_id`, `api_hash`, `phone_number`, the bot username/token, and Web URL.
+3. Run:
+   ```bash
+   dotnet run --project tests/e2e/runner/GmRelay.E2E.Runner.csproj
+   ```
+
+**Security notes:**
+- Never commit `.env` or `*.session` files.
+- Use a dedicated test Telegram account, never your personal or production account.
+- The first run will prompt for the Telegram verification code (sent to the phone number).
+- Subsequent runs reuse the persisted `.session` file.
+
+## What the dashboard tests cover
+
+- `test_dashboard_authenticates_and_shows_groups`  
+  Builds a valid Mini App initData payload, posts it to `/auth/telegram-webapp`, and verifies that the Blazor home page renders the authenticated greeting.
+- `test_dashboard_session_edit_flow`  
+  Seeds a player, group, and session directly in PostgreSQL, opens the group details page, clicks through to the session editor, changes the title, join link, max players and publication mode, asserts the updated values appear on the page, and verifies the persisted database state.
+- `test_dashboard_session_delete_flow`  
+  Seeds a session, opens the group details page, confirms the deletion dialog, asserts the session disappears from the dashboard, and verifies the session was removed from PostgreSQL.
+
+## What the MTProto runner currently covers
+
+- Login as a Telegram user.
+- Create a supergroup (`Channels_CreateChannel` with `megagroup: true`).
+- Resolve a bot by username and invite it to the group.
+- Send `/start` to the bot inside the group and wait for any reply.
+- Walk `/newsession` from start to published schedule message.
+- Join/leave a session via inline buttons and assert the database state.
+- Join into a waitlist when the active roster is full (using a seeded fake participant).
+- Manually promote a waitlisted player via `/listsessions` and verify promotion.
+- Leave an active session and verify automatic promotion of the next waitlisted player.
+- Initiate a reschedule, propose 2-3 time options, vote, and wait for the background deadline service to apply the new time.
+- Exercise T-24h RSVP confirmation and T-5m join-link reminders by time-travelling `sessions.scheduled_at` from the runner (database-level time-mock).
+- Delete the test supergroup after the scenario (cleanup).
+
+## Notes
+
+- Authentication is mocked using `helpers/telegram_init_data.py`, which mirrors `GmRelay.Shared.Telegram.TelegramAuthPayloadBuilder`.
+- The Web instance validates HMAC-SHA256 with the same bot token, so the test payload is indistinguishable from a real Telegram Mini App payload.
+- The runner project is intentionally **not** included in `GM-Relay.slnx` so it does not participate in CI builds or Native AOT trimming.
+- The Telegram lifecycle scenario uses **one real test account** plus fake participants seeded directly into PostgreSQL, and a **database-level time-mock** (`UPDATE sessions SET scheduled_at = ...`) so 24-hour and 5-minute reminders fire in minutes instead of hours. This is the locally-runnable approach chosen for issue #149.
+- For headful debugging, change `headless=True` to `headless=False` in the dashboard test file.

tests/e2e/dashboard/test_dashboard_auth_and_sessions.py

@@ -0,0 +1,391 @@
+"""
+Playwright E2E tests for the GmRelay Blazor/Web dashboard.
+
+These tests use a mocked Telegram Mini App initData payload so they can run
+locally against a real GmRelay.Web instance without talking to Telegram.
+
+Prerequisites:
+  pip install playwright
+  playwright install chromium
+
+Environment:
+  GMRELAY_E2E_BASE_URL  - Web dashboard URL (default: http://localhost:8080)
+  GMRELAY_E2E_BOT_TOKEN - Bot token matching the target Web instance
+  GMRELAY_E2E_TELEGRAM_ID - Telegram ID to use for the mocked user
+  GMRELAY_E2E_DATABASE_URL - PostgreSQL DSN for DB assertions (optional)
+"""
+
+from __future__ import annotations
+
+import os
+import time
+import urllib.parse
+import uuid
+from typing import Optional
+
+from playwright.sync_api import Page, expect, sync_playwright
+
+import sys
+import pathlib
+
+sys.path.insert(0, str(pathlib.Path(__file__).parent.parent))
+
+from helpers.telegram_init_data import build_mini_app_init_data
+
+
+def _base_url() -> str:
+    return os.environ.get("GMRELAY_E2E_BASE_URL", "http://localhost:8080").rstrip("/")
+
+
+def _bot_token() -> str:
+    token = os.environ.get("GMRELAY_E2E_BOT_TOKEN")
+    if not token:
+        raise RuntimeError(
+            "GMRELAY_E2E_BOT_TOKEN is required. It must match the bot token used by the target Web instance."
+        )
+    return token
+
+
+def _telegram_id() -> int:
+    return int(os.environ.get("GMRELAY_E2E_TELEGRAM_ID", "9000000001"))
+
+
+def _database_url() -> Optional[str]:
+    return os.environ.get("GMRELAY_E2E_DATABASE_URL")
+
+
+def _seed_group_in_database(
+    telegram_id: int,
+    group_id: str,
+    group_name: str,
+    session_id: str,
+    session_title: str,
+    batch_id: Optional[str] = None,
+) -> None:
+    """
+    Insert minimal test data via the shared Npgsql connection so the dashboard
+    has something to render. This is intentionally thin: full state setup is
+    performed by the console runner in issue #151.
+    """
+    import psycopg2
+
+    dsn = _database_url()
+    if not dsn:
+        return  # rely on a pre-seeded dev database
+
+    platform = "Telegram"
+    external_user_id = str(telegram_id)
+    now = time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime())
+    scheduled_at = time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime(time.time() + 86400))
+    batch_id = batch_id or str(uuid.uuid4())
+
+    with psycopg2.connect(dsn) as conn:
+        with conn.cursor() as cur:
+            cur.execute(
+                """
+                INSERT INTO gmrelay.players (platform, external_user_id, display_name, created_at)
+                VALUES (%s, %s, %s, %s)
+                ON CONFLICT (platform, external_user_id)
+                WHERE platform IS NOT NULL AND external_user_id IS NOT NULL
+                DO UPDATE SET display_name = EXCLUDED.display_name
+                RETURNING id
+                """,
+                (platform, external_user_id, "E2E Test GM", now),
+            )
+            player_id = cur.fetchone()[0]
+
+            cur.execute(
+                """
+                INSERT INTO gmrelay.game_groups (id, platform, external_group_id, telegram_chat_id, name, created_at)
+                VALUES (%s, %s, %s, %s, %s, %s)
+                ON CONFLICT (id) DO UPDATE SET name = EXCLUDED.name
+                RETURNING id
+                """,
+                (group_id, platform, "-1001234567890", -1001234567890, group_name, now),
+            )
+
+            cur.execute(
+                """
+                INSERT INTO gmrelay.group_managers (group_id, player_id, role, created_at)
+                VALUES (%s, %s, %s, %s)
+                ON CONFLICT (group_id, player_id) DO UPDATE SET role = EXCLUDED.role
+                """,
+                (group_id, player_id, "Owner", now),
+            )
+
+            cur.execute(
+                """
+                INSERT INTO gmrelay.sessions (
+                    id, group_id, batch_id, title, scheduled_at, join_link, status, publication_mode,
+                    notification_mode, max_players, format, location_address, system, created_at
+                )
+                VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
+                ON CONFLICT (id) DO UPDATE SET
+                    title = EXCLUDED.title,
+                    scheduled_at = EXCLUDED.scheduled_at,
+                    join_link = EXCLUDED.join_link,
+                    max_players = EXCLUDED.max_players,
+                    publication_mode = EXCLUDED.publication_mode,
+                    format = EXCLUDED.format,
+                    location_address = EXCLUDED.location_address,
+                    system = EXCLUDED.system
+                """,
+                (
+                    session_id,
+                    group_id,
+                    batch_id,
+                    session_title,
+                    scheduled_at,
+                    "https://example.com/join",
+                    "Planned",
+                    "None",
+                    "GroupAndDirect",
+                    5,
+                    "Online",
+                    "Discord",
+                    "D&D 5e",
+                    now,
+                ),
+            )
+
+            cur.execute(
+                """
+                INSERT INTO gmrelay.session_participants (session_id, player_id, registration_status, rsvp_status, is_gm, created_at)
+                VALUES (%s, %s, %s, %s, %s, %s)
+                ON CONFLICT (session_id, player_id) DO NOTHING
+                """,
+                (session_id, player_id, "Active", "Pending", True, now),
+            )
+
+            conn.commit()
+
+
+def _get_session_from_db(session_id: str):
+    import psycopg2
+
+    dsn = _database_url()
+    if not dsn:
+        return None
+
+    with psycopg2.connect(dsn) as conn:
+        with conn.cursor() as cur:
+            cur.execute(
+                """
+                SELECT title, join_link, max_players, publication_mode, format, location_address, system, status
+                FROM gmrelay.sessions
+                WHERE id = %s
+                """,
+                (session_id,),
+            )
+            row = cur.fetchone()
+            if row is None:
+                return None
+            return {
+                "title": row[0],
+                "join_link": row[1],
+                "max_players": row[2],
+                "publication_mode": row[3],
+                "format": row[4],
+                "location_address": row[5],
+                "system": row[6],
+                "status": row[7],
+            }
+
+
+def _assert_session_deleted(session_id: str) -> None:
+    import psycopg2
+
+    dsn = _database_url()
+    if not dsn:
+        return
+
+    with psycopg2.connect(dsn) as conn:
+        with conn.cursor() as cur:
+            cur.execute("SELECT COUNT(*) FROM gmrelay.sessions WHERE id = %s", (session_id,))
+            assert cur.fetchone()[0] == 0, f"Session {session_id} was not deleted"
+
+
+def _delete_test_data(group_id: str, session_id: str) -> None:
+    import psycopg2
+
+    dsn = _database_url()
+    if not dsn:
+        return
+
+    with psycopg2.connect(dsn) as conn:
+        with conn.cursor() as cur:
+            cur.execute("DELETE FROM gmrelay.session_participants WHERE session_id = %s", (session_id,))
+            cur.execute("DELETE FROM gmrelay.sessions WHERE id = %s", (session_id,))
+            cur.execute("DELETE FROM gmrelay.group_managers WHERE group_id = %s", (group_id,))
+            cur.execute("DELETE FROM gmrelay.game_groups WHERE id = %s", (group_id,))
+            cur.execute(
+                "DELETE FROM gmrelay.players WHERE external_user_id = %s AND platform = 'Telegram'",
+                (str(_telegram_id()),),
+            )
+            conn.commit()
+
+
+def _authenticate_page(page: Page, base_url: str, bot_token: str, telegram_id: int) -> None:
+    """
+    Authenticate by calling /auth/telegram-webapp with a valid initData payload.
+    The response sets the auth cookie; subsequent page navigations are authenticated.
+    """
+    init_data = build_mini_app_init_data(
+        bot_token=bot_token,
+        telegram_id=telegram_id,
+        first_name="E2E",
+        last_name="Test",
+        username="e2e_test",
+    )
+
+    response = page.request.post(
+        f"{base_url}/auth/telegram-webapp",
+        data={"initData": init_data.init_data_raw},
+    )
+    expect(response).to_be_ok()
+    page.goto(base_url)
+
+
+def _wait_for_blazor(page: Page) -> None:
+    """Wait until Blazor has finished the initial render."""
+    page.wait_for_selector("text=Добро пожаловать", timeout=15000)
+
+
+def test_dashboard_authenticates_and_shows_groups() -> None:
+    base_url = _base_url()
+    bot_token = _bot_token()
+    telegram_id = _telegram_id()
+
+    with sync_playwright() as p:
+        browser = p.chromium.launch(headless=True)
+        context = browser.new_context()
+        page = context.new_page()
+
+        _authenticate_page(page, base_url, bot_token, telegram_id)
+        _wait_for_blazor(page)
+
+        heading = page.locator("h2")
+        expect(heading).to_contain_text("Добро пожаловать")
+
+        browser.close()
+
+
+def test_dashboard_session_edit_flow() -> None:
+    base_url = _base_url()
+    bot_token = _bot_token()
+    telegram_id = _telegram_id()
+
+    group_id = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa1"
+    session_id = "bbbbbbbb-bbbb-bbbb-bbbb-aaaaaaaaaaa1"
+    batch_id = "cccccccc-cccc-cccc-cccc-aaaaaaaaaaa1"
+    original_title = "E2E Original Title"
+    updated_title = "E2E Updated Title"
+    updated_join_link = "https://example.com/updated-join"
+
+    try:
+        _seed_group_in_database(
+            telegram_id=telegram_id,
+            group_id=group_id,
+            group_name="E2E Test Group",
+            session_id=session_id,
+            session_title=original_title,
+            batch_id=batch_id,
+        )
+
+        with sync_playwright() as p:
+            browser = p.chromium.launch(headless=True)
+            context = browser.new_context()
+            page = context.new_page()
+
+            _authenticate_page(page, base_url, bot_token, telegram_id)
+            _wait_for_blazor(page)
+
+            page.goto(f"{base_url}/group/{group_id}")
+            page.wait_for_selector(f"text={original_title}", timeout=15000)
+
+            page.locator(f"text={original_title}").first.click()
+            page.wait_for_selector("text=Редактирование сессии", timeout=15000)
+
+            title_input = page.get_by_label("Название игры")
+            title_input.fill(updated_title)
+
+            join_input = page.get_by_label("Ссылка для подключения")
+            join_input.fill(updated_join_link)
+
+            max_players_input = page.get_by_label("Лимит мест")
+            max_players_input.fill("3")
+
+            page.get_by_label("Режим публикации").select_option("Catalog")
+
+            save_button = page.locator("button:has-text('Сохранить изменения')").first
+            save_button.click()
+
+            page.wait_for_selector(f"text={updated_title}", timeout=15000)
+            expect(page.locator(f"text={updated_title}").first).to_be_visible()
+
+            db_session = _get_session_from_db(session_id)
+            if db_session is not None:
+                assert db_session["title"] == updated_title
+                assert db_session["join_link"] == updated_join_link
+                assert db_session["max_players"] == 3
+                assert db_session["publication_mode"] == "Catalog"
+
+            browser.close()
+    finally:
+        _delete_test_data(group_id, session_id)
+
+
+def test_dashboard_session_delete_flow() -> None:
+    base_url = _base_url()
+    bot_token = _bot_token()
+    telegram_id = _telegram_id()
+
+    group_id = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaa2"
+    session_id = "bbbbbbbb-bbbb-bbbb-bbbb-aaaaaaaaaaa2"
+    batch_id = "cccccccc-cccc-cccc-cccc-aaaaaaaaaaa2"
+    session_title = "E2E Delete Target"
+
+    try:
+        _seed_group_in_database(
+            telegram_id=telegram_id,
+            group_id=group_id,
+            group_name="E2E Delete Group",
+            session_id=session_id,
+            session_title=session_title,
+            batch_id=batch_id,
+        )
+
+        with sync_playwright() as p:
+            browser = p.chromium.launch(headless=True)
+            context = browser.new_context()
+            page = context.new_page()
+
+            _authenticate_page(page, base_url, bot_token, telegram_id)
+            _wait_for_blazor(page)
+
+            page.goto(f"{base_url}/group/{group_id}")
+            page.wait_for_selector(f"text={session_title}", timeout=15000)
+
+            page.on("dialog", lambda dialog: dialog.accept())
+
+            delete_button = page.locator("button:has-text('Удалить')").first
+            expect(delete_button).to_be_visible()
+            delete_button.click()
+
+            page.wait_for_selector("text=Сессия удалена.", timeout=15000)
+            expect(page.locator(f"text={session_title}")).to_have_count(0)
+
+            _assert_session_deleted(session_id)
+
+            browser.close()
+    finally:
+        _delete_test_data(group_id, session_id)
+
+
+if __name__ == "__main__":
+    test_dashboard_authenticates_and_shows_groups()
+    print("PASS test_dashboard_authenticates_and_shows_groups")
+    test_dashboard_session_edit_flow()
+    print("PASS test_dashboard_session_edit_flow")
+    test_dashboard_session_delete_flow()
+    print("PASS test_dashboard_session_delete_flow")

tests/e2e/helpers/telegram_init_data.py

@@ -0,0 +1,191 @@
+"""
+Generate Telegram Mini App initData and Login Widget payloads for local E2E tests.
+
+This mirrors GmRelay.Shared.Telegram.TelegramAuthPayloadBuilder so the Python E2E
+runner can produce authentication payloads that pass GmRelay.Web.Services.TelegramAuthService
+validation without talking to real Telegram servers.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import time
+import urllib.parse
+from dataclasses import dataclass
+from typing import Optional
+
+
+def _login_widget_secret_key(bot_token: str) -> bytes:
+    return hashlib.sha256(bot_token.encode("utf-8")).digest()
+
+
+def _mini_app_secret_key(bot_token: str) -> bytes:
+    return hmac.new(
+        key=b"WebAppData",
+        msg=bot_token.encode("utf-8"),
+        digestmod=hashlib.sha256,
+    ).digest()
+
+
+def compute_login_widget_hash(bot_token: str, values: dict[str, str]) -> str:
+    """Compute HMAC-SHA256 hash used by Telegram Login Widget callbacks."""
+    data_check_string = "\n".join(
+        f"{k}={values[k]}" for k in sorted(values.keys()) if k != "hash"
+    )
+    secret_key = _login_widget_secret_key(bot_token)
+    return hmac.new(
+        key=secret_key,
+        msg=data_check_string.encode("utf-8"),
+        digestmod=hashlib.sha256,
+    ).hexdigest()
+
+
+def compute_mini_app_hash(bot_token: str, values: dict[str, str]) -> str:
+    """Compute HMAC-SHA256 hash used by Telegram Mini App initData."""
+    data_check_string = "\n".join(
+        f"{k}={values[k]}" for k in sorted(values.keys()) if k != "hash"
+    )
+    secret_key = _mini_app_secret_key(bot_token)
+    return hmac.new(
+        key=secret_key,
+        msg=data_check_string.encode("utf-8"),
+        digestmod=hashlib.sha256,
+    ).hexdigest()
+
+
+@dataclass(frozen=True)
+class LoginWidgetResult:
+    telegram_id: int
+    first_name: str
+    last_name: Optional[str]
+    username: Optional[str]
+    photo_url: Optional[str]
+    auth_date: int
+    hash: str
+    query_string: str
+
+
+def build_login_widget(
+    bot_token: str,
+    telegram_id: int,
+    first_name: str,
+    last_name: Optional[str] = None,
+    username: Optional[str] = None,
+    photo_url: Optional[str] = None,
+    auth_date: Optional[int] = None,
+) -> LoginWidgetResult:
+    """Build a Telegram Login Widget query string and hash."""
+    timestamp = auth_date if auth_date is not None else int(time.time())
+
+    values: dict[str, str] = {
+        "auth_date": str(timestamp),
+        "first_name": first_name,
+        "id": str(telegram_id),
+    }
+    if last_name:
+        values["last_name"] = last_name
+    if photo_url:
+        values["photo_url"] = photo_url
+    if username:
+        values["username"] = username
+
+    hash_value = compute_login_widget_hash(bot_token, values)
+    values["hash"] = hash_value
+
+    query_string = "&".join(
+        f"{urllib.parse.quote(k)}={urllib.parse.quote(v)}" for k, v in values.items()
+    )
+
+    return LoginWidgetResult(
+        telegram_id=telegram_id,
+        first_name=first_name,
+        last_name=last_name,
+        username=username,
+        photo_url=photo_url,
+        auth_date=timestamp,
+        hash=hash_value,
+        query_string=query_string,
+    )
+
+
+@dataclass(frozen=True)
+class MiniAppInitDataResult:
+    telegram_id: int
+    first_name: str
+    last_name: Optional[str]
+    username: Optional[str]
+    photo_url: Optional[str]
+    auth_date: int
+    hash: str
+    init_data_raw: str
+
+
+def build_mini_app_init_data(
+    bot_token: str,
+    telegram_id: int,
+    first_name: str,
+    last_name: Optional[str] = None,
+    username: Optional[str] = None,
+    photo_url: Optional[str] = None,
+    language_code: Optional[str] = None,
+    is_premium: bool = False,
+    chat_id: Optional[int] = None,
+    chat_type: Optional[str] = None,
+    chat_title: Optional[str] = None,
+    query_id: Optional[str] = None,
+    start_param: Optional[str] = None,
+    auth_date: Optional[int] = None,
+) -> MiniAppInitDataResult:
+    """Build a Telegram Mini App initData raw string."""
+    user_payload: dict[str, object] = {
+        "id": telegram_id,
+        "first_name": first_name,
+    }
+    if last_name is not None:
+        user_payload["last_name"] = last_name
+    if username is not None:
+        user_payload["username"] = username
+    if photo_url is not None:
+        user_payload["photo_url"] = photo_url
+    if language_code is not None:
+        user_payload["language_code"] = language_code
+    if is_premium:
+        user_payload["is_premium"] = True
+
+    user_json = json.dumps(user_payload, separators=(",", ":"))
+    timestamp = auth_date if auth_date is not None else int(time.time())
+
+    values: dict[str, str] = {
+        "auth_date": str(timestamp),
+        "user": user_json,
+    }
+    if query_id:
+        values["query_id"] = query_id
+    if start_param:
+        values["start_param"] = start_param
+    if chat_id is not None:
+        chat_payload: dict[str, object] = {"id": chat_id, "type": chat_type or "private"}
+        if chat_title is not None:
+            chat_payload["title"] = chat_title
+        values["chat"] = json.dumps(chat_payload, separators=(",", ":"))
+
+    hash_value = compute_mini_app_hash(bot_token, values)
+
+    pairs = [
+        f"{urllib.parse.quote(k)}={urllib.parse.quote(v)}" for k, v in values.items()
+    ]
+    pairs.append(f"hash={hash_value}")
+    init_data_raw = "&".join(pairs)
+
+    return MiniAppInitDataResult(
+        telegram_id=telegram_id,
+        first_name=first_name,
+        last_name=last_name,
+        username=username,
+        photo_url=photo_url,
+        auth_date=timestamp,
+        hash=hash_value,
+        init_data_raw=init_data_raw,
+    )

tests/e2e/helpers/test_telegram_init_data.py

@@ -0,0 +1,133 @@
+"""Self-contained tests for telegram_init_data helper.
+
+Run with: python tests/e2e/helpers/test_telegram_init_data.py
+"""
+
+import sys
+import urllib.parse
+
+from telegram_init_data import (
+    build_login_widget,
+    build_mini_app_init_data,
+    compute_login_widget_hash,
+    compute_mini_app_hash,
+)
+
+
+def _parse_init_data(init_data_raw: str) -> dict[str, str]:
+    return {
+        k: v for k, v in (pair.split("=", 1) for pair in init_data_raw.split("&"))
+    }
+
+
+def test_login_widget_hash_matches_expected_algorithm():
+    bot_token = "test-bot-token"
+    values = {"auth_date": "1714300000", "first_name": "Ada", "id": "424242"}
+
+    hash_value = compute_login_widget_hash(bot_token, values)
+
+    assert len(hash_value) == 64, f"expected 64 hex chars, got {len(hash_value)}"
+    assert hash_value == hash_value.lower(), "hash must be lowercase hex"
+    print("PASS test_login_widget_hash_matches_expected_algorithm")
+
+
+def test_mini_app_hash_matches_expected_algorithm():
+    bot_token = "test-bot-token"
+    values = {
+        "auth_date": "1714300000",
+        "user": '{"id":424242,"first_name":"Ada"}',
+    }
+
+    hash_value = compute_mini_app_hash(bot_token, values)
+
+    assert len(hash_value) == 64, f"expected 64 hex chars, got {len(hash_value)}"
+    assert hash_value == hash_value.lower(), "hash must be lowercase hex"
+    print("PASS test_mini_app_hash_matches_expected_algorithm")
+
+
+def test_build_login_widget_contains_all_fields():
+    result = build_login_widget(
+        bot_token="test-bot-token",
+        telegram_id=424242,
+        first_name="Ada",
+        last_name="Lovelace",
+        username="ada",
+        photo_url="https://t.me/i/userpic/320/ada.jpg",
+        auth_date=1714300000,
+    )
+
+    parsed = _parse_init_data(result.query_string)
+    assert parsed["id"] == "424242"
+    assert parsed["first_name"] == "Ada"
+    assert parsed["last_name"] == "Lovelace"
+    assert parsed["username"] == "ada"
+    assert urllib.parse.unquote(parsed["photo_url"]) == "https://t.me/i/userpic/320/ada.jpg"
+    assert parsed["auth_date"] == "1714300000"
+    assert parsed["hash"] == result.hash
+    print("PASS test_build_login_widget_contains_all_fields")
+
+
+def test_build_mini_app_init_data_contains_all_fields():
+    result = build_mini_app_init_data(
+        bot_token="test-bot-token",
+        telegram_id=424242,
+        first_name="Ada",
+        last_name="Lovelace",
+        username="ada",
+        query_id="AAHdF6IQAAAAAN0XohDhrOrc",
+        start_param="ref123",
+        auth_date=1714300000,
+    )
+
+    parsed = _parse_init_data(result.init_data_raw)
+    assert parsed["auth_date"] == "1714300000"
+    assert parsed["hash"] == result.hash
+    assert urllib.parse.unquote(parsed["start_param"]) == "ref123"
+    assert urllib.parse.unquote(parsed["query_id"]) == "AAHdF6IQAAAAAN0XohDhrOrc"
+
+    user = urllib.parse.unquote(parsed["user"])
+    assert '"id":424242' in user
+    assert '"first_name":"Ada"' in user
+    print("PASS test_build_mini_app_init_data_contains_all_fields")
+
+
+def test_build_mini_app_init_data_with_chat():
+    result = build_mini_app_init_data(
+        bot_token="test-bot-token",
+        telegram_id=424242,
+        first_name="Ada",
+        chat_id=-1001234567890,
+        chat_type="supergroup",
+        chat_title="Test Club",
+        auth_date=1714300000,
+    )
+
+    parsed = _parse_init_data(result.init_data_raw)
+    chat = urllib.parse.unquote(parsed["chat"])
+    assert '"id":-1001234567890' in chat
+    assert '"type":"supergroup"' in chat
+    assert '"title":"Test Club"' in chat
+    print("PASS test_build_mini_app_init_data_with_chat")
+
+
+def main():
+    tests = [
+        test_login_widget_hash_matches_expected_algorithm,
+        test_mini_app_hash_matches_expected_algorithm,
+        test_build_login_widget_contains_all_fields,
+        test_build_mini_app_init_data_contains_all_fields,
+        test_build_mini_app_init_data_with_chat,
+    ]
+    failed = 0
+    for test in tests:
+        try:
+            test()
+        except Exception as ex:
+            failed += 1
+            print(f"FAIL {test.__name__}: {ex}")
+    print(f"\n{len(tests) - failed}/{len(tests)} tests passed")
+    sys.exit(0 if failed == 0 else 1)
+
+
+if __name__ == "__main__":
+    main()

tests/e2e/requirements.txt

@@ -0,0 +1,2 @@
+playwright>=1.44.0
+psycopg2-binary>=2.9.9

tests/e2e/runner/.env.example

@@ -0,0 +1,19 @@
+# Configuration for the GmRelay E2E MTProto runner.
+# Copy this file to .env and fill in real values.
+# NEVER commit .env or *.session files to git.
+
+# Telegram user account credentials (MTProto)
+api_id=12345678
+api_hash=abcdef0123456789abcdef0123456789
+phone_number=+1234567890
+
+# Bot under test
+TELEGRAM_BOT_USERNAME=gmrelay_test_bot
+TELEGRAM_BOT_TOKEN=1234567890:ABCDEF...token
+
+# Web dashboard under test
+GMRELAY_E2E_BASE_URL=http://localhost:8080
+GMRELAY_E2E_TELEGRAM_ID=9000000001
+
+# PostgreSQL connection string (optional, used for seeding/cleanup)
+GMRELAY_E2E_DATABASE_URL=Host=localhost;Database=gmrelay;Username=postgres;Password=postgres

tests/e2e/runner/.gitignore

@@ -0,0 +1,5 @@
+.env
+*.session
+bin/
+obj/
+packages.lock.json

tests/e2e/runner/DatabaseAssertions.cs

@@ -0,0 +1,361 @@
+using Npgsql;
+
+namespace GmRelay.E2E.Runner;
+
+public sealed record SessionDto(
+    Guid Id,
+    string Title,
+    string Status,
+    DateTimeOffset ScheduledAt,
+    int? MaxPlayers,
+    int? BatchMessageId,
+    int? ConfirmationMessageId,
+    int? LinkMessageId,
+    string? JoinLink,
+    Guid GroupId);
+
+public sealed record ParticipantDto(
+    Guid ParticipantId,
+    string DisplayName,
+    string ExternalUserId,
+    string RegistrationStatus,
+    string RsvpStatus,
+    bool IsGm);
+
+public sealed record RescheduleProposalDto(
+    Guid Id,
+    string Status,
+    DateTimeOffset? VotingDeadlineAt,
+    int? VoteMessageId,
+    Guid? SelectedOptionId);
+
+public sealed record RescheduleOptionDto(
+    Guid Id,
+    int DisplayOrder,
+    DateTimeOffset ProposedAt);
+
+/// <summary>
+/// PostgreSQL helper for the E2E runner. Allows assertions against the actual
+/// application state and small, controlled seeds (e.g. a fake second player)
+/// that would otherwise require multiple real Telegram test accounts.
+/// </summary>
+public sealed class DatabaseAssertions(RunnerConfig config)
+{
+    private NpgsqlConnection CreateConnection() => new(config.DatabaseUrl);
+
+
+    public async Task<SessionDto?> GetSessionByIdAsync(Guid sessionId)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            SELECT s.id AS Id,
+                   s.title AS Title,
+                   s.status AS Status,
+                   s.scheduled_at AS ScheduledAt,
+                   s.max_players AS MaxPlayers,
+                   s.batch_message_id AS BatchMessageId,
+                   s.confirmation_message_id AS ConfirmationMessageId,
+                   s.link_message_id AS LinkMessageId,
+                   s.join_link AS JoinLink,
+                   s.group_id AS GroupId
+            FROM sessions s
+            WHERE s.id = @SessionId
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@SessionId", sessionId);
+
+        await using var reader = await command.ExecuteReaderAsync();
+        if (!await reader.ReadAsync())
+            return null;
+
+        return MapSession(reader);
+    }
+
+    public async Task<SessionDto?> GetSessionByTitleAsync(long telegramChatId, string title)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            SELECT s.id AS Id,
+                   s.title AS Title,
+                   s.status AS Status,
+                   s.scheduled_at AS ScheduledAt,
+                   s.max_players AS MaxPlayers,
+                   s.batch_message_id AS BatchMessageId,
+                   s.confirmation_message_id AS ConfirmationMessageId,
+                   s.link_message_id AS LinkMessageId,
+                   s.join_link AS JoinLink,
+                   s.group_id AS GroupId
+            FROM sessions s
+            JOIN game_groups g ON g.id = s.group_id
+            WHERE g.external_group_id::BIGINT = @ExternalGroupId
+              AND s.title = @Title
+            ORDER BY s.created_at DESC
+            LIMIT 1
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@ExternalGroupId", telegramChatId);
+        command.Parameters.AddWithValue("@Title", title);
+
+        await using var reader = await command.ExecuteReaderAsync();
+        if (!await reader.ReadAsync())
+            return null;
+
+        return MapSession(reader);
+    }
+
+    public async Task<IReadOnlyList<ParticipantDto>> GetParticipantsAsync(Guid sessionId)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            SELECT sp.id AS ParticipantId,
+                   p.display_name AS DisplayName,
+                   p.external_user_id AS ExternalUserId,
+                   sp.registration_status AS RegistrationStatus,
+                   sp.rsvp_status AS RsvpStatus,
+                   sp.is_gm AS IsGm
+            FROM session_participants sp
+            JOIN players p ON p.id = sp.player_id
+            WHERE sp.session_id = @SessionId
+            ORDER BY sp.created_at, sp.id
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@SessionId", sessionId);
+
+        var participants = new List<ParticipantDto>();
+        await using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            participants.Add(new ParticipantDto(
+                reader.GetGuid(0),
+                reader.GetString(1),
+                reader.GetString(2),
+                reader.GetString(3),
+                reader.GetString(4),
+                reader.GetBoolean(5)));
+        }
+
+        return participants;
+    }
+
+    public async Task<RescheduleProposalDto?> GetActiveRescheduleProposalAsync(Guid sessionId)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            SELECT id,
+                   status,
+                   voting_deadline_at,
+                   vote_message_id,
+                   selected_option_id
+            FROM reschedule_proposals
+            WHERE session_id = @SessionId
+              AND status IN ('AwaitingTime', 'Voting')
+            ORDER BY created_at DESC
+            LIMIT 1
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@SessionId", sessionId);
+
+        await using var reader = await command.ExecuteReaderAsync();
+        if (!await reader.ReadAsync())
+            return null;
+
+        return new RescheduleProposalDto(
+            reader.GetGuid(0),
+            reader.GetString(1),
+            reader.IsDBNull(2) ? null : new DateTimeOffset(reader.GetDateTime(2), TimeSpan.Zero),
+            reader.IsDBNull(3) ? null : reader.GetInt32(3),
+            reader.IsDBNull(4) ? null : reader.GetGuid(4));
+    }
+
+    public async Task<IReadOnlyList<RescheduleOptionDto>> GetRescheduleOptionsAsync(Guid proposalId)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            SELECT id, display_order, proposed_at
+            FROM reschedule_options
+            WHERE proposal_id = @ProposalId
+            ORDER BY display_order
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@ProposalId", proposalId);
+
+        var options = new List<RescheduleOptionDto>();
+        await using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            options.Add(new RescheduleOptionDto(
+                reader.GetGuid(0),
+                reader.GetInt32(1),
+                reader.GetDateTime(2)));
+        }
+
+        return options;
+    }
+
+    /// <summary>
+    /// Moves a session forward or backward in time from the database perspective.
+    /// Used as a time-mock so the scheduler background services fire quickly
+    /// during local E2E runs instead of waiting real 24 hours.
+    /// </summary>
+    public async Task TimeTravelAsync(Guid sessionId, DateTimeOffset newScheduledAt)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            UPDATE sessions
+            SET scheduled_at = @ScheduledAt,
+                updated_at = now()
+            WHERE id = @SessionId
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@ScheduledAt", newScheduledAt);
+        command.Parameters.AddWithValue("@SessionId", sessionId);
+
+        await command.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// Resets notification flags so a session can trigger the T-24h confirmation
+    /// and T-5m join-link reminders again after time-travel.
+    /// </summary>
+    public async Task ResetNotificationFlagsAsync(Guid sessionId)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            """
+            UPDATE sessions
+            SET confirmation_sent_at = NULL,
+                link_message_id = NULL,
+                one_hour_reminder_processed_at = NULL,
+                status = CASE WHEN status = 'ConfirmationSent' THEN 'Planned' ELSE status END,
+                updated_at = now()
+            WHERE id = @SessionId
+            """,
+            connection);
+
+        command.Parameters.AddWithValue("@SessionId", sessionId);
+
+        await command.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// Inserts a fake Telegram player and adds them to a session. This lets a
+    /// single real test account exercise waitlist/promotion flows that would
+    /// normally require a second Telegram user.
+    /// </summary>
+    public async Task<Guid> SeedFakeParticipantAsync(
+        Guid sessionId,
+        string displayName,
+        long externalUserId,
+        string registrationStatus,
+        string rsvpStatus = "Pending",
+        bool isGm = false)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+        await using var transaction = await connection.BeginTransactionAsync();
+
+        Guid playerId;
+
+        await using var playerCommand = new NpgsqlCommand(
+            """
+            INSERT INTO players (display_name, platform, external_user_id, external_username)
+            VALUES (@DisplayName, 'Telegram', @ExternalUserId, NULL)
+            ON CONFLICT (platform, external_user_id)
+            WHERE platform IS NOT NULL AND external_user_id IS NOT NULL
+            DO UPDATE
+            SET display_name = EXCLUDED.display_name,
+                external_username = EXCLUDED.external_username
+            RETURNING id
+            """,
+            connection,
+            transaction);
+
+        playerCommand.Parameters.AddWithValue("@DisplayName", displayName);
+        playerCommand.Parameters.AddWithValue("@ExternalUserId", externalUserId.ToString(System.Globalization.CultureInfo.InvariantCulture));
+
+        var result = await playerCommand.ExecuteScalarAsync();
+        playerId = (Guid)(result ?? throw new InvalidOperationException("Failed to seed fake player."));
+
+        await using var participantCommand = new NpgsqlCommand(
+            """
+            INSERT INTO session_participants (session_id, player_id, is_gm, rsvp_status, registration_status)
+            VALUES (@SessionId, @PlayerId, @IsGm, @RsvpStatus, @RegistrationStatus)
+            ON CONFLICT (session_id, player_id) DO UPDATE
+            SET rsvp_status = EXCLUDED.rsvp_status,
+                registration_status = EXCLUDED.registration_status,
+                is_gm = EXCLUDED.is_gm
+            RETURNING id
+            """,
+            connection,
+            transaction);
+
+        participantCommand.Parameters.AddWithValue("@SessionId", sessionId);
+        participantCommand.Parameters.AddWithValue("@PlayerId", playerId);
+        participantCommand.Parameters.AddWithValue("@IsGm", isGm);
+        participantCommand.Parameters.AddWithValue("@RsvpStatus", rsvpStatus);
+        participantCommand.Parameters.AddWithValue("@RegistrationStatus", registrationStatus);
+
+        await participantCommand.ExecuteNonQueryAsync();
+        await transaction.CommitAsync();
+
+        return playerId;
+    }
+
+    public async Task UpdateSessionMaxPlayersAsync(Guid sessionId, int? maxPlayers)
+    {
+        await using var connection = CreateConnection();
+        await connection.OpenAsync();
+
+        await using var command = new NpgsqlCommand(
+            "UPDATE sessions SET max_players = @MaxPlayers, updated_at = now() WHERE id = @SessionId",
+            connection);
+
+        if (maxPlayers.HasValue)
+            command.Parameters.AddWithValue("@MaxPlayers", maxPlayers.Value);
+        else
+            command.Parameters.AddWithValue("@MaxPlayers", DBNull.Value);
+
+        command.Parameters.AddWithValue("@SessionId", sessionId);
+
+        await command.ExecuteNonQueryAsync();
+    }
+
+    private static SessionDto MapSession(NpgsqlDataReader reader) =>
+        new(
+            reader.GetGuid(0),
+            reader.GetString(1),
+            reader.GetString(2),
+            reader.GetDateTime(3),
+            reader.IsDBNull(4) ? null : reader.GetInt32(4),
+            reader.IsDBNull(5) ? null : reader.GetInt32(5),
+            reader.IsDBNull(6) ? null : reader.GetInt32(6),
+            reader.IsDBNull(7) ? null : reader.GetInt32(7),
+            reader.IsDBNull(8) ? null : reader.GetString(8),
+            reader.GetGuid(9));
+}

tests/e2e/runner/GmRelay.E2E.Runner.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <LangVersion>preview</LangVersion>
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Npgsql" Version="10.0.2" />
+    <PackageReference Include="WTelegramClient" Version="4.3.5" />
+    <PackageReference Include="dotenv.net" Version="3.2.1" />
+  </ItemGroup>
+
+</Project>

tests/e2e/runner/GroupSetupScenario.cs

@@ -0,0 +1,59 @@
+namespace GmRelay.E2E.Runner;
+
+/// <summary>
+/// Automates the first step of every Telegram E2E scenario:
+/// create a supergroup, invite the GmRelay bot, and verify the bot responds to /start.
+/// </summary>
+public sealed class GroupSetupScenario
+{
+    private readonly TelegramUserClient _client;
+    private readonly RunnerConfig _config;
+
+    public GroupSetupScenario(TelegramUserClient client, RunnerConfig config)
+    {
+        _client = client;
+        _config = config;
+    }
+
+    public async Task<ScenarioResult> RunAsync(CancellationToken cancellationToken = default)
+    {
+        var group = await _client.CreateGroupAsync(
+            $"GmRelay E2E {DateTime.UtcNow:yyyyMMdd-HHmmss}",
+            "Automated test group for GmRelay E2E suite.",
+            cancellationToken);
+
+        Console.WriteLine($"[scenario] created group id={group.Id} title='{group.Title}'");
+
+        await _client.InviteBotToGroupAsync(group, _config.BotUsername, cancellationToken);
+        Console.WriteLine($"[scenario] invited @{_config.BotUsername}");
+
+        await _client.SendCommandAsync(group, "start", cancellationToken);
+        var reply = await _client.WaitForBotReplyAsync(
+            group,
+            containsText: null,
+            timeout: TimeSpan.FromSeconds(30),
+            cancellationToken);
+
+        if (reply is null)
+            throw new InvalidOperationException("Bot did not reply to /start in the group.");
+
+        Console.WriteLine($"[scenario] bot replied to /start (msg id={reply.id})");
+
+        return new ScenarioResult(group, reply.id);
+    }
+
+    public async Task CleanupAsync(ScenarioResult result, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await _client.DeleteGroupAsync(result.Group, cancellationToken);
+            Console.WriteLine($"[scenario] deleted group id={result.Group.Id}");
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"[scenario] warning: failed to delete group id={result.Group.Id}: {ex.Message}");
+        }
+    }
+}
+
+public sealed record ScenarioResult(ChatGroup Group, int LastBotMessageId);

tests/e2e/runner/JoinLeaveWaitlistRescheduleScenario.cs

@@ -0,0 +1,370 @@
+using System.Globalization;
+using TL;
+
+namespace GmRelay.E2E.Runner;
+
+/// <summary>
+/// E2E scenario covering the product lifecycle of a session after it has been
+/// published: join, waitlist, promotion, leave + auto-promotion, reschedule
+/// voting, T-24h RSVP confirmation and T-5m join-link notifications.
+///
+/// A single real Telegram test account is enough because waitlist scenarios
+/// that need a second player are satisfied by seeding a fake participant
+/// directly into PostgreSQL. Notification deadlines are accelerated by updating
+/// <c>sessions.scheduled_at</c> from the runner (a database-level time-mock).
+/// </summary>
+public sealed class JoinLeaveWaitlistRescheduleScenario
+{
+    private readonly TelegramUserClient _client;
+    private readonly RunnerConfig _config;
+    private readonly DatabaseAssertions _db;
+
+    public JoinLeaveWaitlistRescheduleScenario(TelegramUserClient client, RunnerConfig config)
+    {
+        _client = client;
+        _config = config;
+        _db = new DatabaseAssertions(config);
+    }
+
+    public async Task RunAsync(ChatGroup group, CancellationToken cancellationToken = default)
+    {
+        var baseSession = await CreateSessionAsync(group, maxPlayers: 2, cancellationToken);
+        Console.WriteLine($"[scenario] base session {baseSession.Id} created");
+
+        await JoinActiveAsync(group, baseSession, cancellationToken);
+        await RescheduleAndNotifyAsync(group, baseSession, cancellationToken);
+        await ManualPromoteAsync(group, baseSession, cancellationToken);
+        await AutoPromoteLeaveAsync(group, baseSession, cancellationToken);
+
+        var waitlistSession = await CreateSessionAsync(group, maxPlayers: 1, cancellationToken);
+        Console.WriteLine($"[scenario] waitlist session {waitlistSession.Id} created");
+        await JoinWaitlistAsync(group, waitlistSession, cancellationToken);
+
+        Console.WriteLine("[scenario] join/leave/waitlist/reschedule/notification flow completed");
+    }
+
+    private async Task<SessionDto> CreateSessionAsync(
+        ChatGroup group,
+        int? maxPlayers,
+        CancellationToken ct)
+    {
+        var title = $"E2E JLW {DateTime.UtcNow:yyyyMMdd-HHmmss}-{Guid.NewGuid().ToString()[..4]}";
+        var scheduledAtMoscow = DateTime.UtcNow
+            .AddDays(7)
+            .AddHours(3)
+            .ToString("dd.MM.yyyy HH:mm", CultureInfo.InvariantCulture);
+
+        var inputs = new NewSessionInputs(
+            Title: title,
+            ScheduledAtMoscow: scheduledAtMoscow,
+            MaxPlayers: maxPlayers ?? 5,
+            JoinLink: "https://example.com/join-e2e");
+
+        var wizard = new NewSessionScenario(_client, _config);
+        await wizard.RunAsync(group, inputs, ct);
+
+        var session = await _db.GetSessionByTitleAsync(group.Id, title);
+        return session ?? throw new InvalidOperationException($"Session '{title}' was not found in the database.");
+    }
+
+    private async Task JoinActiveAsync(ChatGroup group, SessionDto session, CancellationToken ct)
+    {
+        Console.WriteLine("[scenario] joining base session as active player");
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"join_session:{session.Id}",
+            session.BatchMessageId,
+            ct);
+
+        await Task.Delay(TimeSpan.FromSeconds(2), ct);
+
+        var me = await GetCurrentParticipantAsync(session.Id, ct);
+        if (me?.RegistrationStatus != "Active")
+            throw new InvalidOperationException("Expected current user to be an active participant after join.");
+
+        Console.WriteLine("[scenario] joined as active player");
+    }
+
+    private async Task RescheduleAndNotifyAsync(ChatGroup group, SessionDto session, CancellationToken ct)
+    {
+        Console.WriteLine("[scenario] initiating reschedule");
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"reschedule_session:{session.Id}",
+            session.BatchMessageId,
+            ct);
+
+        var prompt = await _client.WaitForBotReplyAsync(
+            group,
+            containsText: "Укажите 2-3 варианта времени",
+            timeout: TimeSpan.FromSeconds(30),
+            cancellationToken: ct)
+            ?? throw new InvalidOperationException("Reschedule prompt was not received.");
+
+        var nowMoscow = DateTimeOffset.UtcNow.ToOffset(TimeSpan.FromHours(3));
+        var option1 = nowMoscow.AddMinutes(10);
+        var option2 = nowMoscow.AddMinutes(20);
+        var deadline = nowMoscow.AddMinutes(5);
+
+        var rescheduleText = string.Join(
+            "\n",
+            option1.ToString("dd.MM.yyyy HH:mm", CultureInfo.InvariantCulture),
+            option2.ToString("dd.MM.yyyy HH:mm", CultureInfo.InvariantCulture),
+            $"Дедлайн: {deadline.ToString("dd.MM.yyyy HH:mm", CultureInfo.InvariantCulture)}");
+
+        await _client.SendMessageAsync(group, rescheduleText, ct);
+
+        var voteMessage = await _client.WaitForBotReplyAsync(
+            group,
+            containsText: "Голосование за перенос",
+            timeout: TimeSpan.FromSeconds(30),
+            cancellationToken: ct)
+            ?? throw new InvalidOperationException("Reschedule voting message was not received.");
+
+        var proposal = await WaitForActiveRescheduleProposalAsync(session.Id, ct);
+        var options = await _db.GetRescheduleOptionsAsync(proposal.Id);
+        var firstOption = options.FirstOrDefault()
+            ?? throw new InvalidOperationException("No reschedule options found in the database.");
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"reschedule_vote:{firstOption.Id}",
+            voteMessage.id,
+            ct);
+
+        Console.WriteLine($"[scenario] voted for option {firstOption.Id}; waiting for deadline service");
+
+        var finalDeadline = DateTime.UtcNow.AddMinutes(8);
+        while (DateTime.UtcNow < finalDeadline)
+        {
+            ct.ThrowIfCancellationRequested();
+            var updated = await _db.GetSessionByTitleAsync(group.Id, session.Title);
+            if (updated?.ScheduledAt >= option1.AddMinutes(-1) && updated?.ScheduledAt <= option1.AddMinutes(1))
+            {
+                Console.WriteLine("[scenario] reschedule applied");
+                break;
+            }
+
+            await Task.Delay(TimeSpan.FromSeconds(5), ct);
+        }
+
+        var afterReschedule = await _db.GetSessionByTitleAsync(group.Id, session.Title)
+            ?? throw new InvalidOperationException("Session disappeared after reschedule.");
+
+        if (afterReschedule.Status != "Planned")
+            throw new InvalidOperationException($"Expected session status 'Planned' after reschedule, got '{afterReschedule.Status}'.");
+
+        Console.WriteLine("[scenario] waiting for T-24h confirmation request");
+        var confirmationMessageId = await WaitForNullableIntAsync(
+            async () => (await _db.GetSessionByTitleAsync(group.Id, session.Title))?.ConfirmationMessageId,
+            timeout: TimeSpan.FromMinutes(2),
+            ct);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"rsvp:confirm:{session.Id}",
+            confirmationMessageId,
+            ct);
+
+        await WaitForSessionStatusAsync(session.Id, "Confirmed", TimeSpan.FromMinutes(1), ct);
+        Console.WriteLine("[scenario] RSVP confirmed");
+
+        Console.WriteLine("[scenario] waiting for T-5m join link");
+        await WaitForBotMessageAsync(
+            group,
+            containsText: "начинается через 5 минут",
+            timeout: TimeSpan.FromMinutes(2),
+            ct);
+
+        var afterJoinLink = await _db.GetSessionByTitleAsync(group.Id, session.Title)
+            ?? throw new InvalidOperationException("Session disappeared after join link.");
+        if (!afterJoinLink.LinkMessageId.HasValue)
+            throw new InvalidOperationException("Expected link_message_id to be populated after T-5m notification.");
+
+        Console.WriteLine("[scenario] T-24h confirmation and T-5m join link verified");
+    }
+
+    private async Task ManualPromoteAsync(ChatGroup group, SessionDto session, CancellationToken ct)
+    {
+        Console.WriteLine("[scenario] manual waitlist promotion");
+
+        await _db.SeedFakeParticipantAsync(
+            session.Id,
+            "E2E Fake Waitlisted",
+            externalUserId: 9000000001,
+            registrationStatus: "Waitlisted",
+            rsvpStatus: "Pending",
+            isGm: false);
+
+        await _db.UpdateSessionMaxPlayersAsync(session.Id, 2);
+
+        await _client.SendCommandAsync(group, "listsessions", ct);
+
+        var listMessage = await _client.WaitForBotReplyAsync(
+            group,
+            containsText: "Ближайшие игры",
+            timeout: TimeSpan.FromSeconds(30),
+            cancellationToken: ct)
+            ?? throw new InvalidOperationException("/listsessions reply was not received.");
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"promote_waitlist:{session.Id}",
+            listMessage.id,
+            ct);
+
+        await Task.Delay(TimeSpan.FromSeconds(2), ct);
+
+        var fake = await FindParticipantAsync(session.Id, "9000000001", ct);
+        if (fake?.RegistrationStatus != "Active")
+            throw new InvalidOperationException("Expected fake waitlisted participant to be promoted to active.");
+
+        Console.WriteLine("[scenario] manual promotion verified");
+    }
+
+    private async Task AutoPromoteLeaveAsync(ChatGroup group, SessionDto session, CancellationToken ct)
+    {
+        Console.WriteLine("[scenario] leave + automatic waitlist promotion");
+
+        await _db.SeedFakeParticipantAsync(
+            session.Id,
+            "E2E Fake Promotion",
+            externalUserId: 9000000002,
+            registrationStatus: "Waitlisted",
+            rsvpStatus: "Pending",
+            isGm: false);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"leave_session:{session.Id}",
+            session.BatchMessageId,
+            ct);
+
+        await Task.Delay(TimeSpan.FromSeconds(2), ct);
+
+        var me = await GetCurrentParticipantAsync(session.Id, ct);
+        if (me is not null)
+            throw new InvalidOperationException("Expected current user to be removed from session after leave.");
+
+        var fake = await FindParticipantAsync(session.Id, "9000000002", ct);
+        if (fake?.RegistrationStatus != "Active")
+            throw new InvalidOperationException("Expected fake waitlisted participant to be auto-promoted after leave.");
+
+        Console.WriteLine("[scenario] auto-promotion after leave verified");
+    }
+
+    private async Task JoinWaitlistAsync(ChatGroup group, SessionDto session, CancellationToken ct)
+    {
+        Console.WriteLine("[scenario] join to waitlist when capacity is full");
+
+        await _db.SeedFakeParticipantAsync(
+            session.Id,
+            "E2E Fake Active",
+            externalUserId: 9000000003,
+            registrationStatus: "Active",
+            rsvpStatus: "Pending",
+            isGm: false);
+
+        await _db.UpdateSessionMaxPlayersAsync(session.Id, 1);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            $"join_session:{session.Id}",
+            session.BatchMessageId,
+            ct);
+
+        await Task.Delay(TimeSpan.FromSeconds(2), ct);
+
+        var me = await GetCurrentParticipantAsync(session.Id, ct);
+        if (me?.RegistrationStatus != "Waitlisted")
+            throw new InvalidOperationException("Expected current user to be waitlisted when capacity is full.");
+
+        Console.WriteLine("[scenario] waitlist join verified");
+    }
+
+    private async Task<ParticipantDto?> GetCurrentParticipantAsync(Guid sessionId, CancellationToken ct)
+    {
+        var participants = await _db.GetParticipantsAsync(sessionId);
+        return participants.FirstOrDefault(p =>
+            p.ExternalUserId == _client.CurrentUserId.ToString(CultureInfo.InvariantCulture));
+    }
+
+    private async Task<ParticipantDto?> FindParticipantAsync(Guid sessionId, string externalUserId, CancellationToken ct)
+    {
+        var participants = await _db.GetParticipantsAsync(sessionId);
+        return participants.FirstOrDefault(p => p.ExternalUserId == externalUserId);
+    }
+
+    private async Task<RescheduleProposalDto> WaitForActiveRescheduleProposalAsync(Guid sessionId, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(30);
+        while (DateTime.UtcNow < deadline)
+        {
+            ct.ThrowIfCancellationRequested();
+            var proposal = await _db.GetActiveRescheduleProposalAsync(sessionId);
+            if (proposal is not null)
+                return proposal;
+
+            await Task.Delay(TimeSpan.FromSeconds(1), ct);
+        }
+
+        throw new TimeoutException("Reschedule proposal was not created in the database.");
+    }
+
+    private async Task WaitForSessionStatusAsync(
+        Guid sessionId,
+        string expectedStatus,
+        TimeSpan timeout,
+        CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+
+        while (DateTime.UtcNow < deadline)
+        {
+            ct.ThrowIfCancellationRequested();
+            var session = await _db.GetSessionByIdAsync(sessionId);
+            if (session?.Status == expectedStatus)
+                return;
+
+            await Task.Delay(TimeSpan.FromSeconds(2), ct);
+        }
+
+        throw new TimeoutException($"Session did not reach status '{expectedStatus}' in time.");
+    }
+
+    private async Task WaitForBotMessageAsync(
+        ChatGroup group,
+        string containsText,
+        TimeSpan timeout,
+        CancellationToken ct)
+    {
+        var message = await _client.WaitForBotReplyAsync(
+            group,
+            containsText: containsText,
+            timeout: timeout,
+            cancellationToken: ct);
+
+        if (message is null)
+            throw new TimeoutException($"Bot message containing '{containsText}' was not received.");
+    }
+
+    private async Task<int> WaitForNullableIntAsync(
+        Func<Task<int?>> poll,
+        TimeSpan timeout,
+        CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            ct.ThrowIfCancellationRequested();
+            var value = await poll();
+            if (value.HasValue)
+                return value.Value;
+
+            await Task.Delay(TimeSpan.FromSeconds(2), ct);
+        }
+
+        throw new TimeoutException("Expected nullable int value was not populated in time.");
+    }
+}

tests/e2e/runner/NewSessionScenario.cs

@@ -0,0 +1,132 @@
+namespace GmRelay.E2E.Runner;
+
+/// <summary>
+/// E2E scenario that walks through the GmRelay /newsession wizard in a Telegram group
+/// and verifies that a session is created and visible in the Web dashboard.
+/// </summary>
+public sealed class NewSessionScenario
+{
+    private readonly TelegramUserClient _client;
+    private readonly RunnerConfig _config;
+
+    public NewSessionScenario(TelegramUserClient client, RunnerConfig config)
+    {
+        _client = client;
+        _config = config;
+    }
+
+    public async Task<ScenarioResult> RunAsync(
+        ChatGroup group,
+        NewSessionInputs inputs,
+        CancellationToken cancellationToken = default)
+    {
+        await _client.SendCommandAsync(group, "newsession", cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Type, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Choice(WizardStep.Type, "single"),
+            cancellationToken: cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Title, cancellationToken);
+
+        await _client.SendMessageAsync(group, inputs.Title, cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Description, cancellationToken);
+
+        await _client.SendMessageAsync(group, "-", cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Cover, cancellationToken);
+
+        await _client.SendMessageAsync(group, "-", cancellationToken);
+        await WaitForStepAsync(group, WizardStep.System, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Choice(WizardStep.System, "Dnd5e"),
+            cancellationToken: cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Duration, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Choice(WizardStep.Duration, "240"),
+            cancellationToken: cancellationToken);
+        await WaitForStepAsync(group, WizardStep.DateTime, cancellationToken);
+
+        await _client.SendMessageAsync(group, inputs.ScheduledAtMoscow, cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Capacity, cancellationToken);
+
+        await _client.SendMessageAsync(group, inputs.MaxPlayers.ToString(System.Globalization.CultureInfo.InvariantCulture), cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Format, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Choice(WizardStep.Format, "online"),
+            cancellationToken: cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Location, cancellationToken);
+
+        await _client.SendMessageAsync(group, inputs.JoinLink, cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Visibility, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Choice(WizardStep.Visibility, "public"),
+            cancellationToken: cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Publish, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Choice(WizardStep.Publish, "yes"),
+            cancellationToken: cancellationToken);
+        await WaitForStepAsync(group, WizardStep.Confirm, cancellationToken);
+
+        await _client.ClickInlineButtonAsync(
+            group,
+            WizardCallback.Create(),
+            cancellationToken: cancellationToken);
+
+        var confirmation = await _client.WaitForBotReplyAsync(
+            group,
+            containsText: "Создано",
+            timeout: TimeSpan.FromSeconds(60),
+            cancellationToken);
+
+        if (confirmation is null)
+            throw new InvalidOperationException("Wizard did not confirm session creation.");
+
+        Console.WriteLine($"[scenario] session created (msg id={confirmation.id})");
+        return new ScenarioResult(group, confirmation.id);
+    }
+
+    private async Task WaitForStepAsync(
+        ChatGroup group,
+        string expectedStep,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null)
+    {
+        var deadline = DateTime.UtcNow + (timeout ?? TimeSpan.FromSeconds(30));
+        while (DateTime.UtcNow < deadline)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var message = await _client.GetLatestBotMessageAsync(group, cancellationToken);
+            if (message?.reply_markup is TL.ReplyInlineMarkup markup)
+            {
+                var dataButtons = markup.rows
+                    .SelectMany(r => r.buttons)
+                    .OfType<TL.KeyboardButtonCallback>()
+                    .Select(b => System.Text.Encoding.UTF8.GetString(b.data))
+                    .ToList();
+
+                if (dataButtons.Any(d => d.StartsWith($"wizard:{expectedStep}", StringComparison.Ordinal)))
+                    return;
+            }
+
+            await Task.Delay(TimeSpan.FromSeconds(1), cancellationToken);
+        }
+
+        throw new TimeoutException($"Wizard did not reach step '{expectedStep}' in time.");
+    }
+}
+
+public sealed record NewSessionInputs(
+    string Title,
+    string ScheduledAtMoscow,
+    int MaxPlayers,
+    string JoinLink);

tests/e2e/runner/Program.cs

@@ -0,0 +1,53 @@
+using dotenv.net;
+using GmRelay.E2E.Runner;
+
+DotEnv.Load(new DotEnvOptions(envFilePaths: [".env"], ignoreExceptions: false));
+
+var config = new RunnerConfig
+{
+    ApiId = int.Parse(Environment.GetEnvironmentVariable("api_id")!),
+    ApiHash = Environment.GetEnvironmentVariable("api_hash")!,
+    PhoneNumber = Environment.GetEnvironmentVariable("phone_number")!,
+    BotUsername = Environment.GetEnvironmentVariable("TELEGRAM_BOT_USERNAME")!,
+    BotToken = Environment.GetEnvironmentVariable("TELEGRAM_BOT_TOKEN")!,
+    DatabaseUrl = Environment.GetEnvironmentVariable("GMRELAY_E2E_DATABASE_URL")!,
+};
+
+using var client = new TelegramUserClient(config);
+await client.ConnectAsync();
+
+var setup = new GroupSetupScenario(client, config);
+ScenarioResult? result = null;
+
+try
+{
+    result = await setup.RunAsync();
+
+    var newSession = new NewSessionScenario(client, config);
+    var inputs = new NewSessionInputs(
+        Title: "E2E One-Shot Adventure",
+        ScheduledAtMoscow: DateTime.UtcNow.AddDays(7).AddHours(3).ToString("dd.MM.yyyy HH:mm", System.Globalization.CultureInfo.InvariantCulture),
+        MaxPlayers: 5,
+        JoinLink: "https://example.com/join-e2e");
+
+    await newSession.RunAsync(result.Group, inputs);
+    Console.WriteLine("Wizard scenario completed successfully.");
+
+    var lifecycle = new JoinLeaveWaitlistRescheduleScenario(client, config);
+    await lifecycle.RunAsync(result.Group);
+    Console.WriteLine("Lifecycle scenario completed successfully.");
+}
+catch (Exception ex)
+{
+    Console.WriteLine($"Scenario failed: {ex.Message}");
+    throw;
+}
+finally
+{
+    if (result is not null)
+    {
+        await setup.CleanupAsync(result);
+    }
+
+    await Task.Delay(TimeSpan.FromSeconds(2));
+}

tests/e2e/runner/RunnerConfig.cs

@@ -0,0 +1,11 @@
+namespace GmRelay.E2E.Runner;
+
+public sealed class RunnerConfig
+{
+    public required int ApiId { get; init; }
+    public required string ApiHash { get; init; }
+    public required string PhoneNumber { get; init; }
+    public required string BotUsername { get; init; }
+    public required string BotToken { get; init; }
+    public required string DatabaseUrl { get; init; }
+}

tests/e2e/runner/TelegramUserClient.cs

@@ -0,0 +1,182 @@
+using System.Collections.Concurrent;
+using System.Text;
+using TL;
+using WTelegram;
+
+namespace GmRelay.E2E.Runner;
+
+public sealed class TelegramUserClient : IDisposable
+{
+    private readonly Client _client;
+    private readonly RunnerConfig _config;
+    private readonly ConcurrentDictionary<long, Channel> _knownChannels = new();
+
+    public TelegramUserClient(RunnerConfig config)
+    {
+        _config = config;
+        _client = new Client(_ => Environment.GetEnvironmentVariable(_));
+    }
+
+    public long CurrentUserId => _client.UserId;
+
+    public async Task ConnectAsync(CancellationToken cancellationToken = default)
+    {
+        var me = await _client.LoginUserIfNeeded();
+        Console.WriteLine($"Logged in as {me.first_name} {me.last_name} (id={me.id})");
+    }
+
+    public async Task<ChatGroup> CreateGroupAsync(string title, string about = "", CancellationToken cancellationToken = default)
+    {
+        var updates = await _client.Channels_CreateChannel(title, about, megagroup: true);
+        var channel = updates.Chats.Values.OfType<Channel>().FirstOrDefault()
+                      ?? throw new InvalidOperationException("Failed to create a supergroup.");
+
+        _knownChannels[channel.id] = channel;
+        return new ChatGroup(channel.id, channel.title);
+    }
+
+    public async Task InviteBotToGroupAsync(ChatGroup group, string botUsername, CancellationToken cancellationToken = default)
+    {
+        if (botUsername.StartsWith('@'))
+            botUsername = botUsername[1..];
+
+        var resolved = await _client.Contacts_ResolveUsername(botUsername);
+        if (resolved.User is null)
+            throw new InvalidOperationException($"Could not resolve bot @{botUsername}.");
+
+        var channel = await ResolveChannelAsync(group.Id, cancellationToken);
+        var inputUser = new InputUser(resolved.User.id, resolved.User.access_hash);
+        await _client.Channels_InviteToChannel(channel, new InputUserBase[] { inputUser });
+    }
+
+    public async Task DeleteGroupAsync(ChatGroup group, CancellationToken cancellationToken = default)
+    {
+        var channel = await ResolveChannelAsync(group.Id, cancellationToken);
+        await _client.Channels_DeleteChannel(channel);
+        _knownChannels.TryRemove(group.Id, out _);
+    }
+
+    public async Task SendMessageAsync(ChatGroup group, string text, CancellationToken cancellationToken = default)
+    {
+        var channel = await ResolveChannelAsync(group.Id, cancellationToken);
+        await _client.SendMessageAsync(channel, text);
+    }
+
+    public async Task<IReadOnlyList<Message>> GetRecentMessagesAsync(ChatGroup group, int limit = 30, CancellationToken cancellationToken = default)
+    {
+        var channel = await ResolveChannelAsync(group.Id, cancellationToken);
+        var history = await _client.Messages_GetHistory(channel, limit: limit);
+        return history.Messages
+            .OfType<Message>()
+            .OrderByDescending(m => m.Date)
+            .ToList();
+    }
+
+    public async Task<Message?> GetLatestBotMessageAsync(ChatGroup group, CancellationToken cancellationToken = default)
+    {
+        var messages = await GetRecentMessagesAsync(group, limit: 20, cancellationToken);
+        return messages.FirstOrDefault(m => m.from_id is not PeerUser userPeer || userPeer.user_id != _client.UserId);
+    }
+
+    public async Task<Message?> WaitForBotReplyAsync(
+        ChatGroup group,
+        string? containsText = null,
+        TimeSpan? timeout = null,
+        CancellationToken cancellationToken = default)
+    {
+        var deadline = DateTime.UtcNow + (timeout ?? TimeSpan.FromSeconds(30));
+
+        while (DateTime.UtcNow < deadline)
+        {
+            cancellationToken.ThrowIfCancellationRequested();
+            var messages = await GetRecentMessagesAsync(group, limit: 50, cancellationToken);
+            var match = messages.FirstOrDefault(m =>
+                m.from_id is not PeerUser userPeer || userPeer.user_id != _client.UserId);
+
+            if (match is not null)
+            {
+                if (containsText is null || (match.message?.Contains(containsText, StringComparison.OrdinalIgnoreCase) ?? false))
+                    return match;
+            }
+
+            await Task.Delay(TimeSpan.FromSeconds(1), cancellationToken);
+        }
+
+        return null;
+    }
+
+    public async Task SendCommandAsync(ChatGroup group, string command, CancellationToken cancellationToken = default)
+    {
+        if (!command.StartsWith('/'))
+            command = "/" + command;
+
+        await SendMessageAsync(group, command, cancellationToken);
+    }
+
+    public async Task ClickInlineButtonAsync(
+        ChatGroup group,
+        string callbackData,
+        int? messageId = null,
+        CancellationToken cancellationToken = default)
+    {
+        var channel = await ResolveChannelAsync(group.Id, cancellationToken);
+        var targetMessageId = messageId ?? (await GetLatestBotMessageAsync(group, cancellationToken))?.id
+            ?? throw new InvalidOperationException("No bot message found to click.");
+
+        await _client.Messages_GetBotCallbackAnswer(
+            channel,
+            targetMessageId,
+            Encoding.UTF8.GetBytes(callbackData));
+    }
+
+    public async Task ClickInlineButtonByTextAsync(
+        ChatGroup group,
+        string buttonTextContains,
+        int? messageId = null,
+        CancellationToken cancellationToken = default)
+    {
+        var message = messageId.HasValue
+            ? (await GetRecentMessagesAsync(group, limit: 20, cancellationToken)).FirstOrDefault(m => m.id == messageId.Value)
+            : await GetLatestBotMessageAsync(group, cancellationToken);
+
+        if (message is null)
+            throw new InvalidOperationException("No bot message found to click.");
+
+        if (message.reply_markup is not ReplyInlineMarkup markup)
+            throw new InvalidOperationException("Latest bot message has no inline keyboard.");
+
+        var button = markup.rows
+            .SelectMany(r => r.buttons)
+            .OfType<KeyboardButtonCallback>()
+            .FirstOrDefault(b => b.text.Contains(buttonTextContains, StringComparison.OrdinalIgnoreCase));
+
+        if (button is null)
+            throw new InvalidOperationException($"No inline button matching '{buttonTextContains}' found.");
+
+        await ClickInlineButtonAsync(group, Encoding.UTF8.GetString(button.data), message.id, cancellationToken);
+    }
+
+    public void Dispose()
+    {
+        _client.Dispose();
+    }
+
+    private async Task<Channel> ResolveChannelAsync(long channelId, CancellationToken cancellationToken = default)
+    {
+        if (_knownChannels.TryGetValue(channelId, out var cached))
+            return cached;
+
+        var dialogs = await _client.Messages_GetAllDialogs();
+        var channel = dialogs.chats.Values
+            .OfType<Channel>()
+            .FirstOrDefault(c => c.id == channelId);
+
+        if (channel is null)
+            throw new InvalidOperationException($"Could not resolve channel {channelId}.");
+
+        _knownChannels[channelId] = channel;
+        return channel;
+    }
+}
+
+public sealed record ChatGroup(long Id, string Title);

tests/e2e/runner/WizardCallback.cs

@@ -0,0 +1,36 @@
+namespace GmRelay.E2E.Runner;
+
+/// <summary>
+/// Mirrors the wire format used by GmRelay.Shared.Features.Sessions.CreateSession.Wizard.WizardCallbackData.
+/// Kept local to avoid a project reference to GmRelay.Shared from the standalone E2E runner.
+/// </summary>
+public static class WizardCallback
+{
+    public const string Prefix = "wizard";
+
+    public static string Choice(string step, string choice) => $"{Prefix}:{step}:{choice}";
+
+    public static string Back() => $"{Prefix}:back";
+
+    public static string Cancel() => $"{Prefix}:cancel";
+
+    public static string Create() => $"{Prefix}:create";
+}
+
+public static class WizardStep
+{
+    public const string Type = "Type";
+    public const string Title = "Title";
+    public const string Description = "Description";
+    public const string Cover = "Cover";
+    public const string System = "System";
+    public const string Duration = "Duration";
+    public const string DateTime = "DateTime";
+    public const string Capacity = "Capacity";
+    public const string Format = "Format";
+    public const string Location = "Location";
+    public const string Visibility = "Visibility";
+    public const string PickClub = "PickClub";
+    public const string Publish = "Publish";
+    public const string Confirm = "Confirm";
+}