chore(deps): update dependency microsoft.identity.web to 4.10.0

Reviewed-on: #26

README.md

@@ -1,165 +1,295 @@
 # UniVerse
 
-UniVerse — backend (ASP.NET Core) для университетской платформы расписания, лекций, отзывов и геймификации.
+UniVerse - веб-платформа для открытых межнаправленческих лекций университета. Система помогает студентам находить занятия других направлений, записываться на них, получать напоминания, оставлять отзывы, а преподавателям и администраторам - видеть аналитику посещаемости и качества обратной связи.
 
-[Документация API](backend/UniVerse.Api/openapi.json)  
+Проект состоит из Vue 3 frontend, ASP.NET Core backend и PostgreSQL-хранилища. Backend предоставляет REST API, интегрируется с Microsoft Entra ID, Modeus API и OpenAI-compatible LLM, а frontend реализует отдельные сценарии для ролей `Student`, `Teacher` и `Admin`.
-[Документация бекнда](docs/backend.md)  
 
-## Что внутри
+- [OpenAPI snapshot](backend/UniVerse.Api/openapi.json)
+- [Backend notes](docs/backend.md)
+- [Frontend E2E tests](docs/playwright-tests.md)
+- [Load testing](docs/load-testing-k6.md)
 
-- Расписание/события и сущности: курсы, лекции, аудитории (locations)
+## Возможности
-- Отзывы студентов с фоновым LLM-анализом (качество/тональность/теги)
-- Геймификация: XP/уровни, монеты, достижения
-- JWT-аутентификация и роли (`Admin`, `Teacher`, `Student`)
-- Swagger/OpenAPI в Development
 
-## Технологии
+### Для студента
 
-- .NET 10 / ASP.NET Core
+- Каталог открытых лекций с поиском, фильтрацией, карточками и деталями занятия.
-- PostgreSQL + EF Core (Npgsql)
+- Запись на лекцию и отмена записи с учетом лимитов мест и персонального лимита активных записей.
-- Serilog
+- Личный дашборд: ближайшие лекции, прогресс уровня, XP, монеты, достижения и статистика.
-- Swagger (Swashbuckle)
+- Мои лекции: список записей, скачивание `.ics` для одной лекции или всего расписания, ссылка календарной подписки.
+- Отзывы о лекциях с оценкой `Like`, `Neutral`, `Dislike`.
+- Уведомления и профиль пользователя.
 
-## Структура репозитория
+### Для преподавателя
 
-Код backend лежит в папке `backend/` и собран в solution `backend/UniVerse.sln`:
+- Дашборд преподавателя по своим занятиям.
+- Просмотр списка лекций и записей.
+- Аналитика отзывов: тональность, информативность, теги LLM и агрегированные показатели.
+- Работа с отзывами без раскрытия лишних персональных данных студентам.
 
-- `backend/UniVerse.Api` — Web API (контроллеры, middleware, background services)
+### Для администратора
-- `backend/UniVerse.Application` — DTO, интерфейсы сервисов, маппинги
+
-- `backend/UniVerse.Domain` — доменные сущности/enum/исключения
+- Административная панель со статистикой пользователей, лекций, записей и ожидающих LLM-анализа отзывов.
-- `backend/UniVerse.Infrastructure` — EF Core, миграции, реализации сервисов, внешние клиенты
+- Управление пользователями: роли `Student`, `Teacher`, `Admin`, блокировка и разблокировка аккаунтов.
+- Управление лекциями и создание новых занятий.
+- Синхронизация расписания, аудиторий и преподавателей из Modeus.
+- Модерация отзывов, повторный запуск LLM-анализа и настройка промпта.
+- Управление курсами, тегами, локациями и достижениями через API.
+
+### Платформенные функции
+
+- Microsoft Entra ID login и dev-login для локальной разработки.
+- JWT access token и refresh flow через cookie.
+- Ролевая защита маршрутов frontend и endpoint-level авторизация backend.
+- Фоновая очередь анализа отзывов через LLM.
+- Геймификация: XP, уровни, монеты, достижения и транзакции.
+- Email-уведомления и планировщик Quartz.
+- Rate limiting, Serilog, Prometheus metrics и Swagger UI в Development.
+- Aspire AppHost для совместного локального запуска API и Vite frontend.
+- Docker Compose для production-окружения с backend, frontend и PostgreSQL.
+
+## Архитектура
+
+```mermaid
+flowchart LR
+    Student[Student UI] --> Frontend[Vue 3 frontend]
+    Teacher[Teacher UI] --> Frontend
+    Admin[Admin UI] --> Frontend
+
+    Frontend -->|/api/v1 JSON| Api[ASP.NET Core Web API]
+    Api --> Auth[Auth and RBAC]
+    Api --> App[Application services]
+    App --> Domain[Domain model]
+    App --> Infra[Infrastructure]
+    Infra --> Db[(PostgreSQL)]
+    Infra --> Llm[OpenAI-compatible LLM]
+    Infra --> Modeus[Modeus schedule API]
+    Infra --> Mail[SMTP email]
+
+    Api --> Quartz[Quartz jobs]
+    Quartz --> Mail
+    Api --> Metrics[Prometheus /metrics]
+```
+
+Backend следует Clean Architecture:
+
+- `UniVerse.Api` - controllers, middleware, Swagger, DI, background services.
+- `UniVerse.Application` - DTO, interfaces, service contracts, mappings, prompts.
+- `UniVerse.Domain` - entities, enums, domain exceptions, domain services.
+- `UniVerse.Infrastructure` - EF Core, migrations, external clients, notification and business service implementations.
+- `UniVerse.AppHost` - Aspire host для локального запуска API и frontend.
+- `UniVerse.Api.Tests` - unit и integration tests.
+
+Frontend построен на Vue 3, TypeScript, Vite, Pinia и Vue Router:
+
+- `src/views/student` - кабинет студента, каталог, карточка лекции, мои лекции, отзывы, профиль, уведомления.
+- `src/views/teacher` - кабинет преподавателя, лекции, аналитика.
+- `src/views/admin` - дашборд, пользователи, лекции, отзывы.
+- `src/api` - typed API client, DTO-типы и мапперы.
+- `src/components/ui` и `src/components/layout` - переиспользуемые UI и layout-компоненты.
+
+## Сценарий записи и анализа отзыва
+
+```mermaid
+sequenceDiagram
+    actor S as Student
+    participant UI as Vue frontend
+    participant API as UniVerse API
+    participant DB as PostgreSQL
+    participant Q as ReviewAnalysisQueue
+    participant LLM as LLM API
+    participant G as GamificationService
+
+    S->>UI: Выбирает открытую лекцию
+    UI->>API: POST /api/v1/lectures/{id}/enroll
+    API->>DB: Проверяет лимиты и сохраняет запись
+    API-->>UI: 204 No Content
+    S->>UI: Оставляет отзыв
+    UI->>API: POST /api/v1/reviews
+    API->>DB: Сохраняет отзыв со статусом Pending
+    API->>Q: Ставит отзыв в очередь анализа
+    Q->>LLM: Анализ качества, тональности и тегов
+    LLM-->>Q: Результат анализа
+    Q->>DB: Обновляет отзыв
+    Q->>G: Начисляет XP, монеты и достижения
+    G->>DB: Сохраняет транзакции и награды
+```
+
+Основные группы таблиц:
+
+- Пользователи и доступ: `users`, `user_roles`, `student_profiles`, `teacher_profiles`, `refresh_tokens`.
+- Расписание: `courses`, `lectures`, `locations`, `tags`, `course_tags`.
+- Участие и обратная связь: `lecture_enrollments`, `reviews`, `review_prompt_settings`.
+- Геймификация: `achievements`, `user_achievements`, `coin_transactions`, `level_thresholds`.
+- Уведомления: `user_notifications`.
+
+## API
+
+Базовый префикс: `/api/v1`.
+
+- `/auth` - Microsoft login, dev-login, refresh, logout, текущий пользователь.
+- `/users` - профиль, статистика, роли, активность, записи, достижения, транзакции, `.ics`.
+- `/lectures` - каталог лекций, CRUD, запись, посещаемость, отзывы по лекции.
+- `/reviews` - создание, список, модерация, повторный анализ, настройка LLM-промпта.
+- `/courses` - курсы и привязка тегов.
+- `/tags` - теги и дерево тегов.
+- `/locations` - аудитории и локации.
+- `/achievements` - каталог достижений.
+- `/notifications` - уведомления, отметка прочтения, отправка и планирование.
+- `/sync` - синхронизация расписания, аудиторий и преподавателей из Modeus.
+
+В Development Swagger UI доступен по адресу `http://localhost:5019/api/docs`.
+
+## Стек
+
+### Frontend
+
+- Vue 3, TypeScript, Vite.
+- Pinia, Vue Router.
+- Playwright E2E tests.
+- Nginx для production-раздачи и проксирования.
+
+### Backend
+
+- .NET 10, ASP.NET Core Web API.
+- EF Core 10, Npgsql, PostgreSQL.
+- Swashbuckle/OpenAPI.
+- Serilog, Prometheus, ASP.NET Core Rate Limiting.
+- Quartz для отложенных уведомлений.
+- Aspire AppHost.
+- xUnit, NSubstitute, WebApplicationFactory.
+
+### Интеграции
+
+- Microsoft Entra ID.
+- Modeus schedule API.
+- OpenAI-compatible LLM API.
+- SMTP email.
 
 ## Требования
 
-- .NET SDK 10 (`dotnet --version` должен показать `10.x`)
+- .NET SDK 10.x.
-- PostgreSQL 14+ (или Docker для поднятия Postgres)
+- Node.js `^20.19.0 || >=22.12.0`.
+- pnpm.
+- PostgreSQL 17+ или Docker.
+- Для production - Docker Engine и Docker Compose.
 
 ## Конфигурация
 
-Основные настройки лежат в `backend/UniVerse.Api/appsettings.json`:
+Backend читает настройки из `backend/UniVerse.Api/appsettings.json`, `appsettings.Development.json` и переменных окружения в формате `Section__Key`.
 
-- `ConnectionStrings:DefaultConnection` — строка подключения к Postgres
+Основные секции:
-- `Jwt:*` — секрет/issuer/audience и сроки жизни токенов
-- `Cors:Origins` — origin’ы фронтенда
-- `Llm:*` — настройки LLM (OpenAI-compatible)
-- `ModeusApi:*` — настройки интеграции с Modeus
 
-Можно переопределять через переменные окружения в формате `Section__Key`, например:
+- `ConnectionStrings:DefaultConnection` - подключение к PostgreSQL.
+- `Jwt:*` - issuer, audience, secret и сроки жизни токенов.
+- `AzureAd:*` - Microsoft Entra ID.
+- `Cors:Origins` - разрешенные origin frontend.
+- `RateLimiting:*` - глобальный fixed-window limiter.
+- `Llm:*` - base URL, API key, model и параметры анализа отзывов.
+- `ModeusApi:*` - base URL, API key и timeout.
+- `Email:Smtp:*` - SMTP-настройки для уведомлений.
 
-- `ConnectionStrings__DefaultConnection`
+Frontend использует переменные:
-- `Jwt__Secret`
-- `Llm__ApiKey`
-- `ModeusApi__ApiKey`
 
-## Быстрый старт (локально)
+- `VITE_API_BASE_URL` - базовый адрес API, по умолчанию `/api`.
+- `VITE_API_PROXY_TARGET` - target для Vite proxy при запуске через Aspire.
+- `VITE_AUTH_RETURN_URL` - frontend callback URL, по умолчанию `/auth/callback`.
 
-1) Поднять Postgres (пример через Docker):
+## Быстрый старт
+
+### 1. Установить зависимости frontend
+
+```bash
+pnpm -C frontend install
+```
+
+### 2. Поднять PostgreSQL
 
 ```bash
 docker run --rm --name universe-postgres \
-	-e POSTGRES_DB=universe \
+  -e POSTGRES_DB=universe \
-	-e POSTGRES_USER=postgres \
+  -e POSTGRES_USER=postgres \
-	-e POSTGRES_PASSWORD=postgres \
+  -e POSTGRES_PASSWORD=postgres \
-	-p 5432:5432 \
+  -p 5432:5432 \
-	postgres:18
+  postgres:18
 ```
 
-2) Применить миграции (первый раз потребуется `dotnet-ef`):
+### 3. Применить миграции
 
 ```bash
 dotnet tool install --global dotnet-ef
 
 cd backend
 dotnet ef database update \
-	--project UniVerse.Infrastructure \
+  --project UniVerse.Infrastructure \
-	--startup-project UniVerse.Api
+  --startup-project UniVerse.Api
 ```
 
-3) Запустить API:
+### 4. Запустить backend
 
 ```bash
-cd backend
+dotnet run --project backend/UniVerse.Api --launch-profile http
-dotnet run --project UniVerse.Api --launch-profile http
 ```
 
-По умолчанию (профиль `http`) API поднимется на `http://localhost:5019`.
+API по умолчанию слушает `http://localhost:5019`.
-Swagger UI доступен в Development по адресу: `http://localhost:5019/swagger`.
 
-## Запуск в Docker
+### 5. Запустить frontend
-
-В `backend/UniVerse.Api/Dockerfile` настроена сборка контейнера API.
 
 ```bash
-cd backend
+pnpm -C frontend dev
-docker build -f UniVerse.Api/Dockerfile -t universe-api .
-
-docker run --rm -p 8080:8080 \
-	-e ASPNETCORE_URLS=http://+:8080 \
-	-e ConnectionStrings__DefaultConnection="Host=host.docker.internal;Port=5432;Database=universe;Username=postgres;Password=postgres" \
-	universe-api
 ```
 
-Примечание: на Linux `host.docker.internal` может быть недоступен — проще запускать Postgres тоже в Docker и соединять контейнеры в одной сети.
+Vite frontend по умолчанию слушает `http://localhost:5173` и проксирует `/api` на `http://localhost:5019`.
 
-## Аутентификация
+## Запуск через Aspire
 
-- `POST /api/v1/auth/login/dev` — дев-логин (только в `Development`). Удобно для локальной разработки.
+Aspire AppHost запускает API и Vite frontend вместе:
-- `GET /api/v1/auth/login/microsoft` — старт входа через Microsoft Entra ID (бэкенд сам делает редирект на Microsoft).
-- `GET /api/v1/auth/callback/microsoft` — callback, куда Microsoft возвращает `code`.
-- `POST /api/v1/auth/login/microsoft` — обмен `authorizationCode` на токены (полезно для интеграций/ручных тестов). Тело: `{ "authorizationCode": "...", "redirectUri"?: "..." }`.
-- `POST /api/v1/auth/refresh`, `POST /api/v1/auth/logout`, `GET /api/v1/auth/me`
 
-Для Microsoft Entra ID нужны настройки (через env или appsettings): `AzureAd:TenantId`, `AzureAd:ClientId`, `AzureAd:ClientSecret` (и при необходимости `AzureAd:Instance`, `AzureAd:RedirectUri`, `AzureAd:PostLoginRedirectUri`).
+```bash
+pnpm -C frontend install
+dotnet run --project backend/UniVerse.AppHost/UniVerse.AppHost.csproj
+```
 
-Большинство методов API защищены `[Authorize]`.
+Frontend обычно доступен на `http://localhost:5173`. Target API передается во frontend через `VITE_API_PROXY_TARGET`.
 
-## Фоновый LLM-анализ отзывов
+## Docker Compose
 
-Сервис `LlmProcessingBackgroundService` раз в ~2 минуты берёт отзывы со статусом `Pending` и прогоняет через LLM-клиент.
+Production compose описан в `docker-compose-prod.yml`:
-LLM-ключ задаётся через `Llm:ApiKey`.
 
-Если ключ не задан или внешний сервис недоступен — анализ будет ретраиться, а ошибки логироваться.
+- `app` - ASP.NET Core backend.
+- `frontend` - собранный Vue frontend и Nginx.
+- `db` - PostgreSQL.
 
-## Интеграция с Modeus
+Перед запуском задайте переменные окружения для PostgreSQL, JWT, Microsoft auth, CORS и внешних интеграций:
 
-Эндпоинты синхронизации доступны только администратору:
+```bash
+docker compose -f docker-compose-prod.yml up -d
+```
 
-- `POST /api/v1/sync/schedule`
+Тестовый compose находится в `docker-compose-test.yml`.
-- `POST /api/v1/sync/rooms`
-- `POST /api/v1/sync/employees`
-- `GET /api/v1/sync/status`
-
-Ключ (если нужен) задаётся через `ModeusApi:ApiKey`.
-
-## Карта API (high-level)
-
-Базовый префикс: `/api/v1`.
-
-- `/auth` — логин/refresh/logout/me
-- `/users` — профиль/статистика/достижения/транзакции (часть методов — только `Admin`)
-- `/courses` — курсы и теги (CRUD в основном для `Admin`)
-- `/lectures` — лекции, записи, посещаемость, отзывы
-- `/reviews` — отзывы (создание студентом; модерация/реанализ для `Admin`)
-- `/tags` — теги + дерево тегов
-- `/locations` — аудитории/локации
-- `/achievements` — достижения
-- `/sync` — синхронизация с внешним расписанием (только `Admin`)
-
-Точные схемы запросов/ответов удобнее смотреть в Swagger.
 
 ## Тестирование
 
-В проекте настроено модульное и интеграционное тестирование (папка `backend/UniVerse.Api.Tests`):
+Backend:
-
-- **xUnit** в качестве основного фреймворка для тестирования.
-- **NSubstitute** для создания заглушек (моков) зависимостей сервисов.
-- Используется `WebApplicationFactory` (`ApiWebApplicationFactory.cs`) для поднятия интеграционного тестового сервера с подменой БД на `InMemory` и отключенными фоновыми сервисами (например, LLM-интеграциями) для изоляции.
-- Реализованы полные тесты ролевой модели и авторизации (`EndpointAuthorizationTests.cs`), надежно проверяющие все API-конечные точки на политики доступа от имени различных ролей (`Admin`, `Teacher`, `Student`, `Anonymous`).
-
-Запуск тестов:
 
 ```bash
-cd backend
+dotnet test backend/UniVerse.sln
-dotnet test
 ```
 
+Frontend type-check и production build:
+
+```bash
+pnpm -C frontend build
+```
+
+Frontend E2E с mock API:
+
+```bash
+pnpm -C frontend test:e2e
+```
+
+Load testing helper:
+
+```bash
+node frontend/scripts/loadtest-endpoints.js
+```

backend/UniVerse.Api.Tests/Application/MappingExtensionsTests.cs

@@ -53,6 +53,7 @@ public class MappingExtensionsTests
             EndsAt = startsAt.AddHours(2),
             IsOpen = true,
             MaxEnrollments = 25,
+            MandatoryAttendeesCount = 30,
             Enrollments =
             [
                 new LectureEnrollment { UserId = 1 },
@@ -66,7 +67,7 @@ public class MappingExtensionsTests
         Assert.Equal("", dto.CourseName);
         Assert.Null(dto.TeacherName);
         Assert.Null(dto.LocationName);
-        Assert.Equal(2, dto.EnrollmentsCount);
+        Assert.Equal(32, dto.EnrollmentsCount);
         Assert.True(dto.IsEnrolled);
         Assert.False(detail.IsEnrolled);
     }

backend/UniVerse.Api.Tests/Authorization/EndpointAuthorizationTests.cs

@@ -47,6 +47,9 @@ public class EndpointAuthorizationTests : IClassFixture<ApiWebApplicationFactory
             body: """{"displayName":"Test","avatarUrl":null}""");
         yield return E("users/me/stats [AnyAuth]",         "GET",    "api/v1/users/me/stats", "Student");
         yield return E("users/me/enrollments [AnyAuth]",   "GET",    "api/v1/users/me/enrollments", "Student");
+        yield return E("users/me/enrollments/calendar-subscription [AnyAuth]", "GET", "api/v1/users/me/enrollments/calendar-subscription", "Student");
+        yield return E("users/me/enrollments.ics [AnyAuth]", "GET",  "api/v1/users/me/enrollments.ics", "Student");
+        yield return E("users/me/enrollments/{id}.ics [AnyAuth]", "GET", "api/v1/users/me/enrollments/1.ics", "Student");
         yield return E("users/me/reviews [AnyAuth]",       "GET",    "api/v1/users/me/reviews", "Student");
         yield return E("users/me/achievements [AnyAuth]",  "GET",    "api/v1/users/me/achievements", "Student");
         yield return E("users/me/transactions [AnyAuth]",  "GET",    "api/v1/users/me/transactions", "Student");
@@ -192,6 +195,7 @@ public class EndpointAuthorizationTests : IClassFixture<ApiWebApplicationFactory
         // dev login доступен в окружении Development
         yield return new object[] { "auth/login/dev POST", "POST", "api/v1/auth/login/dev",
             """{"email":"test@test.com","displayName":"Test","role":"Student"}""" };
+        yield return new object[] { "users/calendar/enrollments/{token}.ics GET", "GET", "api/v1/users/calendar/enrollments/bad-token.ics" };
         // refresh читает из cookie — возвращает 401, если нет cookie, но это не 401 от промежуточного ПО авторизации
         // (он возвращает 401 явно в теле действия, что отличается от Auth Challenge)
         // Мы тестируем это отдельно, чтобы убедиться, что заголовок JWT не требуется

backend/UniVerse.Api.Tests/Helpers/ApiWebApplicationFactory.cs

@@ -20,6 +20,7 @@ using UniVerse.Application.DTOs.Tags;
 using UniVerse.Application.DTOs.Users;
 using UniVerse.Application.Interfaces;
 using UniVerse.Domain.Enums;
+using UniVerse.Domain.Exceptions;
 using UniVerse.Infrastructure.Data;
 
 namespace UniVerse.Api.Tests.Helpers;
@@ -177,6 +178,13 @@ public class ApiWebApplicationFactory : WebApplicationFactory<Program>
             3,
             [new EnrollmentSlotRuleDto(1, 3), new EnrollmentSlotRuleDto(3, 5), new EnrollmentSlotRuleDto(4, 7)]));
         stub.GetEnrollmentsAsync(Arg.Any<int>(), Arg.Any<PaginationRequest>()).Returns(pagedLectures);
+        stub.GetMyEnrollmentsIcsAsync(Arg.Any<int>()).Returns("BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n");
+        stub.GetEnrollmentIcsAsync(Arg.Any<int>(), Arg.Any<int>()).Returns("BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n");
+        stub.GetCalendarSubscriptionTokenAsync(Arg.Any<int>()).Returns("test-token");
+        stub.GetEnrollmentsIcsBySubscriptionTokenAsync("bad-token")
+            .Returns(Task.FromException<string>(new ForbiddenException("Invalid calendar subscription token.")));
+        stub.GetEnrollmentsIcsBySubscriptionTokenAsync(Arg.Is<string>(token => token != "bad-token"))
+            .Returns(Task.FromResult("BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n"));
         stub.GetAllAsync(Arg.Any<UserFilterRequest>()).Returns(pagedUsers);
         stub.SetRolesAsync(Arg.Any<int>(), Arg.Any<IReadOnlyCollection<UserRole>>()).Returns(Task.CompletedTask);
         stub.SetActiveAsync(Arg.Any<int>(), Arg.Any<bool>()).Returns(Task.CompletedTask);

backend/UniVerse.Api.Tests/Lectures/LectureServiceTests.cs

@@ -166,6 +166,29 @@ public class LectureServiceTests
         Assert.True(await db.LectureEnrollments.AnyAsync(e => e.LectureId == 100 && e.UserId == 1));
     }
 
+    [Fact]
+    public async Task EnrollAsync_CountsMandatoryAttendeesTowardLectureCapacity()
+    {
+        await using var db = CreateDbContext();
+        var gamification = Substitute.For<IGamificationService>();
+        gamification.CalculateLevelAsync(Arg.Any<int>()).Returns(1);
+        var service = new LectureService(db, gamification, Substitute.For<INotificationScheduler>());
+        var lecture = Lecture(1, DateTime.UtcNow.AddDays(1));
+        lecture.MaxEnrollments = 31;
+        lecture.MandatoryAttendeesCount = 30;
+
+        db.Users.AddRange(
+            new User { Id = 1, Email = "first@test.local" },
+            new User { Id = 2, Email = "second@test.local" });
+        db.Courses.Add(new Course { Id = 1, Name = "Course" });
+        db.Lectures.Add(lecture);
+        await db.SaveChangesAsync();
+
+        await service.EnrollAsync(1, 1);
+
+        await Assert.ThrowsAsync<ConflictException>(() => service.EnrollAsync(1, 2));
+    }
+
     [Fact]
     public async Task UnenrollAsync_CancelsLectureReminders()
     {

backend/UniVerse.Api.Tests/RateLimiting/RateLimitingTests.cs

@@ -0,0 +1,37 @@
+using System.Net;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.Configuration;
+using UniVerse.Api.Tests.Helpers;
+using Xunit;
+
+namespace UniVerse.Api.Tests.RateLimiting;
+
+public class RateLimitingTests
+{
+    [Fact]
+    public async Task GlobalRateLimiter_Returns429_WhenPartitionExceedsLimit()
+    {
+        await using var factory = new ApiWebApplicationFactory()
+            .WithWebHostBuilder(builder =>
+            {
+                builder.ConfigureAppConfiguration((_, config) =>
+                {
+                    config.AddInMemoryCollection(new Dictionary<string, string?>
+                    {
+                        ["RateLimiting:PermitLimit"] = "1",
+                        ["RateLimiting:WindowSeconds"] = "60",
+                        ["RateLimiting:QueueLimit"] = "0"
+                    });
+                });
+            });
+
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Add("Authorization", TestJwtFactory.BearerHeader("Student"));
+
+        using var firstResponse = await client.GetAsync("api/v1/tags");
+        using var secondResponse = await client.GetAsync("api/v1/tags");
+
+        Assert.NotEqual(HttpStatusCode.TooManyRequests, firstResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.TooManyRequests, secondResponse.StatusCode);
+    }
+}

backend/UniVerse.Api.Tests/Sync/ModeusApiClientTests.cs

@@ -0,0 +1,62 @@
+using System.Net;
+using System.Text.Json;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using UniVerse.Application.DTOs.Sync;
+using UniVerse.Infrastructure.ExternalServices;
+using Xunit;
+
+namespace UniVerse.Api.Tests.Sync;
+
+public class ModeusApiClientTests
+{
+    [Fact]
+    public async Task SearchEventsAsync_RequestsIctisEndpointWithCounts()
+    {
+        var handler = new CapturingHandler();
+        var http = new HttpClient(handler)
+        {
+            BaseAddress = new Uri("https://schedule.test")
+        };
+        var config = new ConfigurationBuilder().Build();
+        var client = new ModeusApiClient(http, config, NullLogger<ModeusApiClient>.Instance);
+
+        await client.SearchEventsAsync(new SyncScheduleRequest(
+            SpecialtyCode: ["09.03.04"],
+            TimeMin: new DateTime(2026, 4, 30, 21, 0, 0, DateTimeKind.Utc),
+            TimeMax: new DateTime(2026, 6, 13, 20, 59, 0, DateTimeKind.Utc),
+            TypeId: ["LECT"],
+            Size: 50));
+
+        Assert.Equal(HttpMethod.Post, handler.RequestMethod);
+        Assert.Equal("/api/ictis?includeCounts=true", handler.RequestPathAndQuery);
+        Assert.NotNull(handler.RequestBody);
+        using var body = JsonDocument.Parse(handler.RequestBody);
+        Assert.Equal(50, body.RootElement.GetProperty("size").GetInt32());
+        Assert.Equal("09.03.04", body.RootElement.GetProperty("specialtyCode")[0].GetString());
+        Assert.Equal("LECT", body.RootElement.GetProperty("typeId")[0].GetString());
+    }
+
+    private sealed class CapturingHandler : HttpMessageHandler
+    {
+        public HttpMethod? RequestMethod { get; private set; }
+        public string? RequestPathAndQuery { get; private set; }
+        public string? RequestBody { get; private set; }
+
+        protected override async Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            RequestMethod = request.Method;
+            RequestPathAndQuery = request.RequestUri?.PathAndQuery;
+            RequestBody = request.Content is null
+                ? null
+                : await request.Content.ReadAsStringAsync(cancellationToken);
+
+            return new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new StringContent("""{"events":[]}""")
+            };
+        }
+    }
+}

backend/UniVerse.Api.Tests/Sync/ScheduleSyncServiceTests.cs

@@ -129,6 +129,56 @@ public class ScheduleSyncServiceTests
         Assert.Equal(48, lecture.MaxEnrollments);
     }
 
+    [Fact]
+    public async Task SyncScheduleAsync_SavesMandatoryAttendeesFromIctisStats()
+    {
+        await using var db = CreateDbContext();
+        var modeus = Substitute.For<IModeusApiClient>();
+        modeus.SearchEventsAsync(Arg.Any<SyncScheduleRequest>())
+            .Returns(new ModeusEventsResponse
+            {
+                Embedded = new ModeusEventsEmbedded
+                {
+                    Events =
+                    [
+                        new ModeusEvent
+                        {
+                            Id = "event-1",
+                            Name = "Open lecture",
+                            StartsAt = new DateTime(2026, 5, 13, 9, 0, 0, DateTimeKind.Utc),
+                            EndsAt = new DateTime(2026, 5, 13, 10, 30, 0, DateTimeKind.Utc),
+                            IctisStats = new ModeusIctisStats(StudentCount: 30, TeacherCount: 1)
+                        }
+                    ],
+                    EventRooms =
+                    [
+                        new ModeusEventRoom
+                        {
+                            Links = new ModeusEventRoomLinks
+                            {
+                                Event = new ModeusHrefLink("/events/event-1"),
+                                Room = new ModeusHrefLink("/rooms/room-1")
+                            }
+                        }
+                    ],
+                    Rooms =
+                    [
+                        new ModeusRoom("room-1", "Room 101", "101", null, TotalCapacity: 120, WorkingCapacity: 120)
+                    ]
+                }
+            });
+
+        var service = new ScheduleSyncService(db, modeus, NullLogger<ScheduleSyncService>.Instance);
+
+        var result = await service.SyncScheduleAsync(new SyncScheduleRequest(null, null, null, null));
+
+        var lecture = await db.Lectures.SingleAsync();
+        Assert.Null(result.Error);
+        Assert.Equal(1, result.Created);
+        Assert.Equal(120, lecture.MaxEnrollments);
+        Assert.Equal(31, lecture.MandatoryAttendeesCount);
+    }
+
     [Fact]
     public async Task SyncScheduleAsync_UsesModeusEventAttendeeTeacher()
     {

backend/UniVerse.Api.Tests/UniVerse.Api.Tests.csproj

@@ -14,7 +14,7 @@
     <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.13.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.0">
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>

backend/UniVerse.Api.Tests/Users/UserServiceTests.cs

@@ -1,4 +1,5 @@
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging.Abstractions;
 using NSubstitute;
 using UniVerse.Application.DTOs.Notifications;
@@ -193,6 +194,56 @@ public class UserServiceTests
         Assert.Equal(2, Assert.Single(result.Items).Id);
     }
 
+    [Fact]
+    public async Task CalendarSubscriptionToken_Roundtrip_ReturnsUserEnrollmentsIcs()
+    {
+        await using var db = CreateDbContext();
+        var startsAt = new DateTime(2026, 1, 10, 9, 0, 0, DateTimeKind.Utc);
+        db.Users.Add(new User { Id = 1, Email = "student@test.local" });
+        db.Courses.Add(new Course { Id = 1, Name = "Course" });
+        db.Lectures.Add(Lecture(1, startsAt));
+        db.LectureEnrollments.Add(new LectureEnrollment { LectureId = 1, UserId = 1 });
+        await db.SaveChangesAsync();
+        var service = CreateService(db);
+
+        var token = await service.GetCalendarSubscriptionTokenAsync(1);
+        var ics = await service.GetEnrollmentsIcsBySubscriptionTokenAsync(token);
+
+        Assert.Contains("BEGIN:VCALENDAR", ics);
+        Assert.Contains("Lecture 1", ics);
+    }
+
+    [Fact]
+    public async Task CalendarSubscriptionToken_RejectsTamperedToken()
+    {
+        await using var db = CreateDbContext();
+        db.Users.Add(new User { Id = 1, Email = "student@test.local" });
+        await db.SaveChangesAsync();
+        var service = CreateService(db);
+        var token = await service.GetCalendarSubscriptionTokenAsync(1);
+        var tampered = token[..^1] + (token[^1] == 'A' ? 'B' : 'A');
+
+        await Assert.ThrowsAsync<ForbiddenException>(() =>
+            service.GetEnrollmentsIcsBySubscriptionTokenAsync(tampered));
+    }
+
+    [Fact]
+    public async Task GetEnrollmentIcsAsync_ReturnsLectureIcsWithoutEnrollment()
+    {
+        await using var db = CreateDbContext();
+        var startsAt = new DateTime(2026, 2, 10, 9, 0, 0, DateTimeKind.Utc);
+        db.Users.Add(new User { Id = 1, Email = "student@test.local" });
+        db.Courses.Add(new Course { Id = 1, Name = "Course" });
+        db.Lectures.Add(Lecture(1853, startsAt));
+        await db.SaveChangesAsync();
+        var service = CreateService(db);
+
+        var ics = await service.GetEnrollmentIcsAsync(1, 1853);
+
+        Assert.Contains("BEGIN:VCALENDAR", ics);
+        Assert.Contains("Lecture 1853", ics);
+    }
+
     private static AppDbContext CreateDbContext()
     {
         var options = new DbContextOptionsBuilder<AppDbContext>()
@@ -215,7 +266,13 @@ public class UserServiceTests
             .Returns(Task.CompletedTask);
 
         var gamification = new GamificationService(db, notifications, NullLogger<GamificationService>.Instance);
-        return new UserService(db, gamification);
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["Jwt:Secret"] = "test-calendar-subscription-secret-32chars"
+            })
+            .Build();
+        return new UserService(db, gamification, config);
     }
 
     private static void SeedLevelThresholds(AppDbContext db)

backend/UniVerse.Api/Controllers/UsersController.cs

@@ -5,6 +5,7 @@ using UniVerse.Application.DTOs.Users;
 using UniVerse.Application.Interfaces;
 using UniVerse.Domain.Enums;
 using System.Security.Claims;
+using System.Text;
 
 namespace UniVerse.Api.Controllers;
 
@@ -83,6 +84,52 @@ public class UsersController : ControllerBase
     public async Task<ActionResult> MyEnrollments([FromQuery] PaginationRequest pagination) =>
         Ok(await _users.GetEnrollmentsAsync(CurrentUserId, pagination));
 
+    [HttpGet("me/enrollments/calendar-subscription")]
+    [ProducesResponseType(typeof(CalendarSubscriptionDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    public async Task<ActionResult<CalendarSubscriptionDto>> CalendarSubscription()
+    {
+        var token = await _users.GetCalendarSubscriptionTokenAsync(CurrentUserId);
+        var feedUrl = Url.Action(
+            nameof(CalendarEnrollmentsIcs),
+            null,
+            new { token },
+            Request.Scheme)
+            ?? $"{Request.Scheme}://{Request.Host}/api/v1/users/calendar/enrollments/{token}.ics";
+
+        return Ok(new CalendarSubscriptionDto(feedUrl));
+    }
+
+    [AllowAnonymous]
+    [HttpGet("calendar/enrollments/{token}.ics")]
+    [Produces("text/calendar")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<FileContentResult> CalendarEnrollmentsIcs(string token)
+    {
+        var ics = await _users.GetEnrollmentsIcsBySubscriptionTokenAsync(token);
+        return File(Encoding.UTF8.GetBytes(ics), "text/calendar; charset=utf-8", "my-lectures.ics");
+    }
+
+    [HttpGet("me/enrollments.ics")]
+    [Produces("text/calendar")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public async Task<FileContentResult> MyEnrollmentsIcs()
+    {
+        var ics = await _users.GetMyEnrollmentsIcsAsync(CurrentUserId);
+        return File(Encoding.UTF8.GetBytes(ics), "text/calendar; charset=utf-8", "my-lectures.ics");
+    }
+
+    [HttpGet("me/enrollments/{lectureId:int}.ics")]
+    [Produces("text/calendar")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<FileContentResult> EnrollmentIcs(int lectureId)
+    {
+        var ics = await _users.GetEnrollmentIcsAsync(CurrentUserId, lectureId);
+        return File(Encoding.UTF8.GetBytes(ics), "text/calendar; charset=utf-8", $"lecture-{lectureId}.ics");
+    }
+
     /// <summary>Получить отзывы текущего пользователя.</summary>
     /// <param name="pagination">Параметры пагинации.</param>
     /// <response code="200">Список отзывов (пагинированный).</response>
@@ -159,6 +206,19 @@ public class UsersController : ControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     public async Task<ActionResult<UserStatsDto>> Stats(int id) => Ok(await _users.GetStatsAsync(id));
 
+    /// <summary>Получить статистику для админского дашборда.</summary>
+    /// <remarks>Только Admin.</remarks>
+    /// <response code="200">Агрегированная статистика дашборда.</response>
+    /// <response code="401">Требуется аутентификация.</response>
+    /// <response code="403">Требуется роль Admin.</response>
+    [Authorize(Roles = "Admin")]
+    [HttpGet("admin/stats")]
+    [ProducesResponseType(typeof(AdminDashboardStatsDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult<AdminDashboardStatsDto>> AdminStats() =>
+        Ok(await _users.GetAdminDashboardStatsAsync());
+
     /// <summary>Получить список записей пользователя на лекции.</summary>
     /// <remarks>Только Admin. Для текущего пользователя используйте GET /api/v1/users/me/enrollments.</remarks>
     /// <param name="id">ID пользователя.</param>

backend/UniVerse.Api/Middleware/LocalNetworksOnlyMiddleware.cs

@@ -0,0 +1,71 @@
+using System.Net;
+using System.Net.Sockets;
+
+namespace UniVerse.Api.Middleware;
+
+public sealed class LocalNetworksOnlyMiddleware
+{
+    private readonly RequestDelegate _next;
+    private readonly ILogger<LocalNetworksOnlyMiddleware> _logger;
+
+    public LocalNetworksOnlyMiddleware(RequestDelegate next, ILogger<LocalNetworksOnlyMiddleware> logger)
+    {
+        _next = next;
+        _logger = logger;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        var remoteIpAddress = context.Connection.RemoteIpAddress;
+
+        if (remoteIpAddress is null || !IsLocalNetwork(remoteIpAddress))
+        {
+            _logger.LogWarning("Blocked metrics request from non-local address {RemoteIpAddress}", remoteIpAddress);
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            await context.Response.WriteAsync("Metrics endpoint is available only from local networks.");
+            return;
+        }
+
+        await _next(context);
+    }
+
+    private static bool IsLocalNetwork(IPAddress ipAddress)
+    {
+        if (IPAddress.IsLoopback(ipAddress))
+        {
+            return true;
+        }
+
+        if (ipAddress.IsIPv4MappedToIPv6)
+        {
+            ipAddress = ipAddress.MapToIPv4();
+        }
+
+        return ipAddress.AddressFamily switch
+        {
+            AddressFamily.InterNetwork => IsPrivateOrLinkLocalIPv4(ipAddress),
+            AddressFamily.InterNetworkV6 => IsPrivateOrLinkLocalIPv6(ipAddress),
+            _ => false
+        };
+    }
+
+    private static bool IsPrivateOrLinkLocalIPv4(IPAddress ipAddress)
+    {
+        var bytes = ipAddress.GetAddressBytes();
+
+        return bytes[0] == 10
+               || bytes[0] == 127
+               || (bytes[0] == 192 && bytes[1] == 168)
+               || (bytes[0] == 172 && bytes[1] is >= 16 and <= 31)
+               || (bytes[0] == 169 && bytes[1] == 254);
+    }
+
+    private static bool IsPrivateOrLinkLocalIPv6(IPAddress ipAddress)
+    {
+        var bytes = ipAddress.GetAddressBytes();
+
+        return ipAddress.IsIPv6LinkLocal
+               || ipAddress.IsIPv6SiteLocal
+               || (bytes[0] & 0xfe) == 0xfc;
+    }
+}

backend/UniVerse.Api/Options/RateLimitingOptions.cs

@@ -0,0 +1,12 @@
+namespace UniVerse.Api.Options;
+
+public class RateLimitingOptions
+{
+    public const string SectionName = "RateLimiting";
+
+    public int PermitLimit { get; set; } = 600;
+
+    public int WindowSeconds { get; set; } = 60;
+
+    public int QueueLimit { get; set; } = 100;
+}

backend/UniVerse.Api/Program.cs

@@ -1,11 +1,16 @@
+using System.Security.Claims;
 using System.Text;
 using System.Text.Json.Serialization;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
 using Microsoft.IdentityModel.Tokens;
 using Microsoft.OpenApi;
+using Prometheus;
 using Quartz;
 using Serilog;
+using System.Threading.RateLimiting;
 using UniVerse.Api.BackgroundServices;
 using UniVerse.Api.Filters;
 using UniVerse.Api.Middleware;
@@ -68,6 +73,50 @@ builder.Services.AddAuthentication(options =>
 });
 builder.Services.AddAuthorization();
 
+builder.Services.AddOptions<RateLimitingOptions>()
+    .Bind(builder.Configuration.GetSection(RateLimitingOptions.SectionName))
+    .Validate(options => options.PermitLimit >= 1,
+        "RateLimiting:PermitLimit must be greater than or equal to 1.")
+    .Validate(options => options.WindowSeconds >= 1,
+        "RateLimiting:WindowSeconds must be greater than or equal to 1.")
+    .Validate(options => options.QueueLimit >= 0,
+        "RateLimiting:QueueLimit must be greater than or equal to 0.")
+    .ValidateOnStart();
+
+builder.Services.AddRateLimiter(options =>
+{
+    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
+    options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(context =>
+    {
+        var rateLimitingOptions = context.RequestServices.GetRequiredService<IOptions<RateLimitingOptions>>().Value;
+        return RateLimitPartition.GetFixedWindowLimiter(
+            GetRateLimitPartitionKey(context),
+            _ => new FixedWindowRateLimiterOptions
+            {
+                PermitLimit = rateLimitingOptions.PermitLimit,
+                Window = TimeSpan.FromSeconds(rateLimitingOptions.WindowSeconds),
+                QueueProcessingOrder = QueueProcessingOrder.OldestFirst,
+                QueueLimit = rateLimitingOptions.QueueLimit,
+                AutoReplenishment = true
+            });
+    });
+    options.OnRejected = async (context, cancellationToken) =>
+    {
+        if (context.Lease.TryGetMetadata(MetadataName.RetryAfter, out var retryAfter))
+            context.HttpContext.Response.Headers.RetryAfter = ((int)retryAfter.TotalSeconds).ToString();
+
+        context.HttpContext.Response.ContentType = "application/problem+json";
+        await context.HttpContext.Response.WriteAsJsonAsync(new
+        {
+            type = "https://httpstatuses.com/429",
+            title = "Too Many Requests",
+            status = StatusCodes.Status429TooManyRequests,
+            detail = "Rate limit exceeded. Please try again later.",
+            traceId = context.HttpContext.TraceIdentifier
+        }, cancellationToken);
+    };
+});
+
 // --- CORS ---
 builder.Services.AddCors(options =>
 {
@@ -135,7 +184,7 @@ builder.Services.AddHttpClient<ILlmClient, LlmClient>(client =>
 builder.Services.AddHttpClient<IModeusApiClient, ModeusApiClient>(client =>
 {
     client.BaseAddress = new Uri(builder.Configuration["ModeusApi:BaseUrl"] ?? "https://schedule.rdcenter.ru");
-    client.Timeout = TimeSpan.FromSeconds(30);
+    client.Timeout = TimeSpan.FromSeconds(builder.Configuration.GetValue("ModeusApi:TimeoutSeconds", 180));
 });
 
 // --- Background Services ---
@@ -220,7 +269,9 @@ if (app.Environment.IsDevelopment())
 
 app.UseCors();
 app.UseAuthentication();
+app.UseRateLimiter();
 app.UseAuthorization();
+app.UseHttpMetrics();
 if (app.Environment.IsDevelopment())
 {
     app.UseAntiforgery();
@@ -228,4 +279,22 @@ if (app.Environment.IsDevelopment())
 }
 app.MapControllers();
 
+// Restrict Prometheus scrape endpoint to local and private networks.
+app.UseWhen(
+    context => context.Request.Path.StartsWithSegments("/metrics", StringComparison.OrdinalIgnoreCase),
+    branch => branch.UseMiddleware<LocalNetworksOnlyMiddleware>());
+app.MapMetrics();
+
 app.Run();
+
+static string GetRateLimitPartitionKey(HttpContext context)
+{
+    var userId = context.User.FindFirstValue(ClaimTypes.NameIdentifier)
+        ?? context.User.FindFirstValue("sub");
+
+    if (!string.IsNullOrWhiteSpace(userId))
+        return $"user:{userId}";
+
+    var ipAddress = context.Connection.RemoteIpAddress?.ToString();
+    return string.IsNullOrWhiteSpace(ipAddress) ? "anonymous:unknown" : $"ip:{ipAddress}";
+}

backend/UniVerse.Api/UniVerse.Api.csproj

@@ -22,7 +22,7 @@
           <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
           <PrivateAssets>all</PrivateAssets>
         </PackageReference>
-        <PackageReference Include="Microsoft.Identity.Web" Version="4.9.0" />
+        <PackageReference Include="Microsoft.Identity.Web" Version="4.10.0" />
         <PackageReference Include="Microsoft.Identity.Web.MicrosoftGraph" Version="4.9.0" />
         <PackageReference Include="Quartz.Dashboard" Version="3.18.1" />
         <PackageReference Include="Swashbuckle.AspNetCore" Version="10.1.7" />
@@ -30,6 +30,7 @@
         <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
         <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.1" />
         <PackageReference Include="Quartz.Extensions.Hosting" Version="3.18.1" />
+        <PackageReference Include="prometheus-net.AspNetCore" Version="8.2.1" />
     </ItemGroup>
 
     <ItemGroup>

backend/UniVerse.Api/appsettings.json

@@ -13,6 +13,11 @@
       "http://localhost:3000"
     ]
   },
+  "RateLimiting": {
+    "PermitLimit": 600,
+    "WindowSeconds": 60,
+    "QueueLimit": 100
+  },
   "Llm": {
     "BaseUrl": "https://api.openai.com/v1/",
     "ApiKey": "",
@@ -23,7 +28,8 @@
   },
   "ModeusApi": {
     "BaseUrl": "https://schedule.rdcenter.ru",
-    "ApiKey": ""
+    "ApiKey": "",
+    "TimeoutSeconds": 180
   },
   "Serilog": {
     "MinimumLevel": {

backend/UniVerse.Api/openapi.json

@@ -3789,6 +3789,146 @@
         ]
       }
     },
+    "/api/v1/users/me/enrollments/calendar-subscription": {
+      "get": {
+        "tags": [
+          "Users"
+        ],
+        "description": "**Required:** any authenticated user",
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CalendarSubscriptionDto"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Bearer": [ ]
+          }
+        ]
+      }
+    },
+    "/api/v1/users/calendar/enrollments/{token}.ics": {
+      "get": {
+        "tags": [
+          "Users"
+        ],
+        "parameters": [
+          {
+            "name": "token",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "403": {
+            "description": "Forbidden",
+            "content": {
+              "text/calendar": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/users/me/enrollments.ics": {
+      "get": {
+        "tags": [
+          "Users"
+        ],
+        "description": "**Required:** any authenticated user",
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "401": {
+            "description": "Unauthorized — JWT token missing or invalid"
+          }
+        },
+        "security": [
+          {
+            "Bearer": [ ]
+          }
+        ]
+      }
+    },
+    "/api/v1/users/me/enrollments/{lectureId}.ics": {
+      "get": {
+        "tags": [
+          "Users"
+        ],
+        "description": "**Required:** any authenticated user",
+        "parameters": [
+          {
+            "name": "lectureId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer",
+              "format": "int32"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "text/calendar": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              },
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized — JWT token missing or invalid"
+          }
+        },
+        "security": [
+          {
+            "Bearer": [ ]
+          }
+        ]
+      }
+    },
     "/api/v1/users/me/reviews": {
       "get": {
         "tags": [
@@ -4158,6 +4298,52 @@
         ]
       }
     },
+    "/api/v1/users/admin/stats": {
+      "get": {
+        "tags": [
+          "Users"
+        ],
+        "summary": "Получить статистику для админского дашборда.",
+        "description": "Только Admin.\n\n**Required roles:** Admin",
+        "responses": {
+          "200": {
+            "description": "Агрегированная статистика дашборда.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminDashboardStatsDto"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Требуется аутентификация.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Требуется роль Admin.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDetails"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Bearer": [ ]
+          }
+        ]
+      }
+    },
     "/api/v1/users/{id}/enrollments": {
       "get": {
         "tags": [
@@ -4758,6 +4944,28 @@
         },
         "additionalProperties": false
       },
+      "AdminDashboardStatsDto": {
+        "type": "object",
+        "properties": {
+          "usersCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "lecturesCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "enrollmentsCount": {
+            "type": "integer",
+            "format": "int32"
+          },
+          "pendingReviewsCount": {
+            "type": "integer",
+            "format": "int32"
+          }
+        },
+        "additionalProperties": false
+      },
       "AuthResponse": {
         "type": "object",
         "properties": {
@@ -4775,6 +4983,16 @@
         },
         "additionalProperties": false
       },
+      "CalendarSubscriptionDto": {
+        "type": "object",
+        "properties": {
+          "feedUrl": {
+            "type": "string",
+            "nullable": true
+          }
+        },
+        "additionalProperties": false
+      },
       "CoinTransactionDto": {
         "type": "object",
         "properties": {

backend/UniVerse.AppHost/UniVerse.AppHost.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Aspire.AppHost.Sdk/13.2.2">
+<Project Sdk="Aspire.AppHost.Sdk/13.3.5">
 
     <PropertyGroup>
         <OutputType>Exe</OutputType>

backend/UniVerse.Application/DTOs/Users/UserDtos.cs

@@ -42,8 +42,17 @@ public record UserStatsDto(
     IReadOnlyList<EnrollmentSlotRuleDto> EnrollmentSlotRules
 );
 
+public record AdminDashboardStatsDto(
+    int UsersCount,
+    int LecturesCount,
+    int EnrollmentsCount,
+    int PendingReviewsCount
+);
+
 public record EnrollmentSlotRuleDto(int Level, int Slots);
 
+public record CalendarSubscriptionDto(string FeedUrl);
+
 public record UpdateUserRequest(
     string? DisplayName,
     string? AvatarUrl

backend/UniVerse.Application/Interfaces/IScheduleSyncService.cs

@@ -29,11 +29,14 @@ public class ModeusEvent
     public string? TypeId { get; init; }
     public DateTime StartsAt { get; init; }
     public DateTime EndsAt { get; init; }
+    public ModeusIctisStats? IctisStats { get; init; }
 
     [JsonPropertyName("_links")]
     public ModeusEventLinks? Links { get; init; }
 }
 
+public record ModeusIctisStats(int? StudentCount, int? TeacherCount);
+
 public class ModeusEventLinks
 {
     [JsonPropertyName("course-unit-realization")]

backend/UniVerse.Application/Interfaces/IUserService.cs

@@ -10,7 +10,12 @@ public interface IUserService
     Task<UserDto> GetByIdAsync(int id);
     Task<UserDto> UpdateProfileAsync(int id, UpdateUserRequest request);
     Task<UserStatsDto> GetStatsAsync(int id);
+    Task<AdminDashboardStatsDto> GetAdminDashboardStatsAsync();
     Task<PagedResult<LectureDto>> GetEnrollmentsAsync(int id, PaginationRequest pagination);
+    Task<string> GetMyEnrollmentsIcsAsync(int userId);
+    Task<string> GetEnrollmentIcsAsync(int userId, int lectureId);
+    Task<string> GetCalendarSubscriptionTokenAsync(int userId);
+    Task<string> GetEnrollmentsIcsBySubscriptionTokenAsync(string token);
     Task<PagedResult<UserDto>> GetAllAsync(UserFilterRequest filter);
     Task SetRolesAsync(int id, IReadOnlyCollection<UserRole> roles);
     Task SetActiveAsync(int id, bool isActive);

backend/UniVerse.Application/Mappings/MappingExtensions.cs

@@ -13,6 +13,9 @@ namespace UniVerse.Application.Mappings;
 
 public static class MappingExtensions
 {
+    private static int OccupiedSeatsCount(this Lecture lecture) =>
+        Math.Max(0, lecture.MandatoryAttendeesCount) + lecture.Enrollments.Count;
+
     // --- User ---
     public static UserDto ToDto(this User user, int level) => new(
         user.Id, user.Email, user.DisplayName, user.AvatarUrl,
@@ -57,7 +60,7 @@ public static class MappingExtensions
         lecture.LocationId, lecture.Location?.Name,
         lecture.Title, lecture.Description, lecture.Format,
         lecture.StartsAt, lecture.EndsAt, lecture.IsOpen,
-        lecture.MaxEnrollments, lecture.Enrollments.Count,
+        lecture.MaxEnrollments, lecture.OccupiedSeatsCount(),
         lecture.OnlineUrl, lecture.CreatedAt, isEnrolled
     );
 
@@ -67,7 +70,7 @@ public static class MappingExtensions
         lecture.LocationId, lecture.Location?.Name,
         lecture.Title, lecture.Description, lecture.Format,
         lecture.StartsAt, lecture.EndsAt, lecture.IsOpen,
-        lecture.MaxEnrollments, lecture.Enrollments.Count,
+        lecture.MaxEnrollments, lecture.OccupiedSeatsCount(),
         lecture.OnlineUrl, lecture.CreatedAt, isEnrolled
     );
 

backend/UniVerse.Application/Prompts/ReviewPromptTemplate.cs

@@ -6,11 +6,37 @@ public static class ReviewPromptTemplate
     public const string ReviewTextPlaceholder = "{reviewText}";
 
     public const string Default = """
-        Проанализируй отзыв студента о лекции. Верни объект JSON со следующими полями: 
+        Проанализируй отзыв студента о лекции. Главная задача - определить, насколько отзыв информативен и полезен для аналитики качества лекции и обратной связи преподавателю.
-        - quality_score: число от 0 до 1, указывающее на качество отзыва;
+
-        - sentiment: «Положительный», «Нейтральный» или «Отрицательный»; 
+        Верни только валидный JSON-объект без Markdown, пояснений и дополнительного текста:
-        - tags: массив соответствующих тематических тегов;
+        {
-        - is_informative: логическое значение, указывающее, является ли отзыв информативным.
+          "quality_score": 0.0,
+          "sentiment": "Нейтральный",
+          "tags": [],
+          "is_informative": false
+        }
+
+        Правила оценки:
+        - quality_score: число от 0 до 1. Оценивай содержательность, конкретику, аргументацию, конструктивность и развернутость отзыва, а не оценку лекции как таковой.
+        - is_informative: true, если отзыв содержит конкретные наблюдения о лекции, преподавании, структуре, материалах, темпе, сложности, практике, организации или полезности. false для односложных, шаблонных, эмоциональных без конкретики или нерелевантных отзывов.
+        - sentiment: строго одно из значений "Положительный", "Нейтральный", "Отрицательный".
+        - tags: массив коротких тематических тегов на русском языке. Используй 1-5 тегов, если они подходят; для неинформативного отзыва можно вернуть пустой массив.
+
+        Базовые теги:
+        - "структура лекции"
+        - "понятность объяснения"
+        - "темп"
+        - "сложность"
+        - "практические примеры"
+        - "материалы"
+        - "актуальность темы"
+        - "вовлеченность"
+        - "организация"
+        - "технические проблемы"
+        - "польза для обучения"
+        - "неинформативный отзыв"
+
+        Можно добавлять новые теги, если они точнее отражают содержание отзыва. Не добавляй теги, которых нет в тексте отзыва или контексте лекции.
 
         Контекст лекции: {lectureContext}
         Текст отзыва: {reviewText}

backend/UniVerse.Domain/Entities/Lecture.cs

@@ -15,6 +15,7 @@ public class Lecture
     public DateTime EndsAt { get; set; }
     public bool IsOpen { get; set; } = true;
     public int MaxEnrollments { get; set; }
+    public int MandatoryAttendeesCount { get; set; }
     public string? ExternalId { get; set; }
     public string? OnlineUrl { get; set; }
     public DateTime CreatedAt { get; set; } = DateTime.UtcNow;

backend/UniVerse.Infrastructure/Data/Configurations/LectureConfiguration.cs

@@ -22,6 +22,7 @@ public class LectureConfiguration : IEntityTypeConfiguration<Lecture>
         builder.Property(l => l.EndsAt).HasColumnName("ends_at");
         builder.Property(l => l.IsOpen).HasColumnName("is_open").HasDefaultValue(true);
         builder.Property(l => l.MaxEnrollments).HasColumnName("max_enrollments").HasDefaultValue(0);
+        builder.Property(l => l.MandatoryAttendeesCount).HasColumnName("mandatory_attendees_count").HasDefaultValue(0);
         builder.Property(l => l.ExternalId).HasColumnName("external_id").HasMaxLength(255);
         builder.Property(l => l.OnlineUrl).HasColumnName("online_url").HasMaxLength(500);
         builder.Property(l => l.CreatedAt).HasColumnName("created_at").HasDefaultValueSql("NOW()");

backend/UniVerse.Infrastructure/ExternalServices/ModeusApiClient.cs

@@ -42,12 +42,11 @@ public class ModeusApiClient : IModeusApiClient
         AddNonEmpty(body, "curriculumId", request.CurriculumId);
         AddNonEmpty(body, "typeId", request.TypeId);
 
-        var response = await _http.PostAsJsonAsync("/api/proxy/events/search", body);
         var requestJson = JsonSerializer.Serialize(body);
-        await EnsureSuccessAsync(response, "Modeus events search",
+        var requestSummary = $"POST /api/ictis?includeCounts=true. Request JSON: {requestJson}";
-            BuildEventsRequestSummary(requestJson));
+        var response = await _http.PostAsJsonAsync("/api/ictis?includeCounts=true", body);
-        return await ReadJsonAsync<ModeusEventsResponse>(response, "Modeus events search",
+        await EnsureSuccessAsync(response, "ICTIS events search", requestSummary);
-            BuildEventsRequestSummary(requestJson))
+        return await ReadJsonAsync<ModeusEventsResponse>(response, "ICTIS events search", requestSummary)
             ?? new ModeusEventsResponse();
     }
 
@@ -98,8 +97,6 @@ public class ModeusApiClient : IModeusApiClient
             response.StatusCode);
     }
 
-    private static string BuildEventsRequestSummary(string requestJson) => $"Request JSON: {requestJson}";
-
     private static void AddNonEmpty<T>(
         IDictionary<string, object?> body,
         string key,

backend/UniVerse.Infrastructure/Migrations/20260530105758_MandatoryAttendeesCount.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace UniVerse.Infrastructure.Migrations
+{
+    /// <inheritdoc />
+    public partial class MandatoryAttendeesCount : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "mandatory_attendees_count",
+                table: "lectures",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "mandatory_attendees_count",
+                table: "lectures");
+        }
+    }
+}

backend/UniVerse.Infrastructure/Migrations/AppDbContextModelSnapshot.cs

@@ -17,7 +17,7 @@ namespace UniVerse.Infrastructure.Migrations
         {
 #pragma warning disable 612, 618
             modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.7")
+                .HasAnnotation("ProductVersion", "10.0.8")
                 .HasAnnotation("Relational:MaxIdentifierLength", 63);
 
             NpgsqlModelBuilderExtensions.HasPostgresEnum(modelBuilder, "coin_transaction_type", "coin_transaction_type", new[] { "review_reward", "achievement_reward", "attendance_reward", "admin_adjustment" });
@@ -250,6 +250,12 @@ namespace UniVerse.Infrastructure.Migrations
                         .HasColumnType("integer")
                         .HasColumnName("location_id");
 
+                    b.Property<int>("MandatoryAttendeesCount")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer")
+                        .HasDefaultValue(0)
+                        .HasColumnName("mandatory_attendees_count");
+
                     b.Property<int>("MaxEnrollments")
                         .ValueGeneratedOnAdd()
                         .HasColumnType("integer")

backend/UniVerse.Infrastructure/Services/LectureService.cs

@@ -122,7 +122,8 @@ public class LectureService : ILectureService
             .FirstOrDefaultAsync(l => l.Id == lectureId) ?? throw new NotFoundException("Lecture", lectureId);
         var user = await _db.Users.FindAsync(userId) ?? throw new NotFoundException("User", userId);
         if (!lecture.IsOpen) throw new ConflictException("Lecture is not open for enrollment.");
-        if (lecture.MaxEnrollments > 0 && lecture.Enrollments.Count >= lecture.MaxEnrollments)
+        var occupiedSeatsCount = Math.Max(0, lecture.MandatoryAttendeesCount) + lecture.Enrollments.Count;
+        if (lecture.MaxEnrollments > 0 && occupiedSeatsCount >= lecture.MaxEnrollments)
             throw new ConflictException("Lecture is full.");
         if (lecture.Enrollments.Any(e => e.UserId == userId))
             throw new ConflictException("Already enrolled.");

backend/UniVerse.Infrastructure/Services/ScheduleSyncService.cs

@@ -1,6 +1,5 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
-using System.Text.Json;
 using UniVerse.Application.DTOs.Sync;
 using UniVerse.Application.Interfaces;
 using UniVerse.Domain.Entities;
@@ -55,6 +54,7 @@ public class ScheduleSyncService : IScheduleSyncService
                 }
 
                 var lectureCapacity = maxEnrollments ?? GetEventTeamSize(events, ev.Id) ?? 0;
+                var mandatoryAttendeesCount = GetMandatoryAttendeesCount(ev.IctisStats);
                 var startsAt = EnsureUtc(ev.StartsAt);
                 var endsAt = EnsureUtc(ev.EndsAt);
 
@@ -68,6 +68,7 @@ public class ScheduleSyncService : IScheduleSyncService
                     existing.LocationId = location?.Id;
                     existing.TeacherId = teacher?.Id;
                     existing.MaxEnrollments = lectureCapacity;
+                    existing.MandatoryAttendeesCount = mandatoryAttendeesCount;
                     existing.UpdatedAt = DateTime.UtcNow;
                     updated++;
                 }
@@ -91,7 +92,8 @@ public class ScheduleSyncService : IScheduleSyncService
                         ExternalId = ev.Id,
                         StartsAt = startsAt,
                         EndsAt = endsAt,
-                        MaxEnrollments = lectureCapacity
+                        MaxEnrollments = lectureCapacity,
+                        MandatoryAttendeesCount = mandatoryAttendeesCount
                     });
                     created++;
                 }
@@ -111,7 +113,7 @@ public class ScheduleSyncService : IScheduleSyncService
                 updated,
                 skipped,
                 [
-                    $"requestJson={BuildScheduleRequestJson(request)}",
+                    "endpoint=POST /api/ictis?includeCounts=true",
                     $"timeMin={request.TimeMin:O}",
                     $"timeMax={request.TimeMax:O}"
                 ]));
@@ -443,6 +445,9 @@ public class ScheduleSyncService : IScheduleSyncService
     private static int? NormalizeCapacity(int? capacity) =>
         capacity is > 0 ? capacity : null;
 
+    private static int GetMandatoryAttendeesCount(ModeusIctisStats? stats) =>
+        Math.Max(0, stats?.StudentCount ?? 0) + Math.Max(0, stats?.TeacherCount ?? 0);
+
     private static string BuildModeusTeacherEmail(string personId) =>
         $"modeus-{personId}@modeus.local".ToLowerInvariant();
 
@@ -488,37 +493,6 @@ public class ScheduleSyncService : IScheduleSyncService
         return details;
     }
 
-    private static string BuildScheduleRequestJson(SyncScheduleRequest request)
-    {
-        var body = new Dictionary<string, object?>
-        {
-            ["size"] = request.Size is > 0 ? request.Size.Value : 900,
-            ["timeMin"] = request.TimeMin,
-            ["timeMax"] = request.TimeMax
-        };
-
-        AddNonEmpty(body, "roomId", request.RoomId);
-        AddNonEmpty(body, "attendeePersonId", request.AttendeePersonId);
-        AddNonEmpty(body, "courseUnitRealizationId", request.CourseUnitRealizationId);
-        AddNonEmpty(body, "cycleRealizationId", request.CycleRealizationId);
-        AddNonEmpty(body, "specialtyCode", request.SpecialtyCode);
-        AddNonEmpty(body, "learningStartYear", request.LearningStartYear);
-        AddNonEmpty(body, "profileName", request.ProfileName);
-        AddNonEmpty(body, "curriculumId", request.CurriculumId);
-        AddNonEmpty(body, "typeId", request.TypeId);
-
-        return JsonSerializer.Serialize(body);
-    }
-
-    private static void AddNonEmpty<T>(
-        IDictionary<string, object?> body,
-        string key,
-        IReadOnlyList<T>? values)
-    {
-        if (values is { Count: > 0 })
-            body[key] = values;
-    }
-
     private static string? GetHrefId(string? href)
     {
         if (string.IsNullOrWhiteSpace(href))

backend/UniVerse.Infrastructure/Services/UserService.cs

@@ -1,4 +1,12 @@
+using System.Buffers.Binary;
+using System.Security.Cryptography;
+using System.Text;
+using Ical.Net;
+using Ical.Net.CalendarComponents;
+using Ical.Net.DataTypes;
+using Ical.Net.Serialization;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
 using UniVerse.Application.DTOs.Common;
 using UniVerse.Application.DTOs.Lectures;
 using UniVerse.Application.DTOs.Users;
@@ -13,13 +21,20 @@ namespace UniVerse.Infrastructure.Services;
 
 public class UserService : IUserService
 {
+    private const byte CalendarTokenVersion = 1;
+    private const int CalendarTokenPayloadLength = 5;
+    private const int CalendarTokenSignatureLength = 32;
+    private const string CalendarTokenKeyContext = "universe-calendar-subscription-v1";
+
     private readonly AppDbContext _db;
     private readonly IGamificationService _gamification;
+    private readonly IConfiguration _config;
 
-    public UserService(AppDbContext db, IGamificationService gamification)
+    public UserService(AppDbContext db, IGamificationService gamification, IConfiguration config)
     {
         _db = db;
         _gamification = gamification;
+        _config = config;
     }
 
     public async Task<UserDto> GetByIdAsync(int id)
@@ -74,6 +89,17 @@ public class UserService : IUserService
         );
     }
 
+    public async Task<AdminDashboardStatsDto> GetAdminDashboardStatsAsync()
+    {
+        var usersCount = await _db.Users
+            .CountAsync(user => !user.Roles.Any(role => role.Role == UserRole.Teacher));
+        var lecturesCount = await _db.Lectures.CountAsync();
+        var enrollmentsCount = await _db.LectureEnrollments.CountAsync();
+        var pendingReviewsCount = await _db.Reviews.CountAsync(review => review.LlmStatus == ReviewLlmStatus.Pending);
+
+        return new AdminDashboardStatsDto(usersCount, lecturesCount, enrollmentsCount, pendingReviewsCount);
+    }
+
     public async Task<PagedResult<LectureDto>> GetEnrollmentsAsync(int id, PaginationRequest pagination)
     {
         if (!await _db.Users.AnyAsync(u => u.Id == id))
@@ -104,6 +130,154 @@ public class UserService : IUserService
             pagination.PageSize);
     }
 
+
+    public async Task<string> GetMyEnrollmentsIcsAsync(int userId)
+    {
+        if (!await _db.Users.AnyAsync(u => u.Id == userId))
+            throw new NotFoundException("User", userId);
+
+        var lectures = await _db.LectureEnrollments
+            .Where(e => e.UserId == userId)
+            .Include(e => e.Lecture)
+            .ThenInclude(l => l.Teacher)
+            .Include(e => e.Lecture)
+            .ThenInclude(l => l.Location)
+            .OrderBy(e => e.Lecture.StartsAt)
+            .Select(e => e.Lecture)
+            .ToListAsync();
+
+        return BuildIcs(lectures, userId);
+    }
+
+    public async Task<string> GetEnrollmentIcsAsync(int userId, int lectureId)
+    {
+        if (!await _db.Users.AnyAsync(u => u.Id == userId))
+            throw new NotFoundException("User", userId);
+
+        var lecture = await _db.Lectures
+            .Include(l => l.Teacher)
+            .Include(l => l.Location)
+            .FirstOrDefaultAsync(l => l.Id == lectureId)
+            ?? throw new NotFoundException("Lecture", lectureId);
+
+        return BuildIcs([lecture], userId);
+    }
+
+    public async Task<string> GetCalendarSubscriptionTokenAsync(int userId)
+    {
+        if (!await _db.Users.AnyAsync(u => u.Id == userId))
+            throw new NotFoundException("User", userId);
+
+        Span<byte> payload = stackalloc byte[CalendarTokenPayloadLength];
+        payload[0] = CalendarTokenVersion;
+        BinaryPrimitives.WriteInt32BigEndian(payload[1..], userId);
+
+        var signature = SignCalendarTokenPayload(payload);
+        var tokenBytes = new byte[CalendarTokenPayloadLength + CalendarTokenSignatureLength];
+        payload.CopyTo(tokenBytes);
+        signature.CopyTo(tokenBytes.AsSpan(CalendarTokenPayloadLength));
+
+        return ToBase64Url(tokenBytes);
+    }
+
+    public async Task<string> GetEnrollmentsIcsBySubscriptionTokenAsync(string token)
+    {
+        var userId = ValidateCalendarSubscriptionToken(token);
+        return await GetMyEnrollmentsIcsAsync(userId);
+    }
+
+    private int ValidateCalendarSubscriptionToken(string token)
+    {
+        var tokenBytes = FromBase64Url(token);
+        if (tokenBytes.Length != CalendarTokenPayloadLength + CalendarTokenSignatureLength)
+            throw new ForbiddenException("Invalid calendar subscription token.");
+
+        var payload = tokenBytes.AsSpan(0, CalendarTokenPayloadLength);
+        var signature = tokenBytes.AsSpan(CalendarTokenPayloadLength, CalendarTokenSignatureLength);
+        if (payload[0] != CalendarTokenVersion)
+            throw new ForbiddenException("Invalid calendar subscription token.");
+
+        var expectedSignature = SignCalendarTokenPayload(payload);
+        if (!CryptographicOperations.FixedTimeEquals(signature, expectedSignature))
+            throw new ForbiddenException("Invalid calendar subscription token.");
+
+        var userId = BinaryPrimitives.ReadInt32BigEndian(payload[1..]);
+        if (userId <= 0)
+            throw new ForbiddenException("Invalid calendar subscription token.");
+
+        return userId;
+    }
+
+    private byte[] SignCalendarTokenPayload(ReadOnlySpan<byte> payload)
+    {
+        var calendarKey = DeriveCalendarTokenKey();
+        return HMACSHA256.HashData(calendarKey, payload);
+    }
+
+    private byte[] DeriveCalendarTokenKey()
+    {
+        var jwtSecret = _config["Jwt:Secret"];
+        if (string.IsNullOrWhiteSpace(jwtSecret))
+            throw new InvalidOperationException("Jwt:Secret is not configured.");
+
+        return HMACSHA256.HashData(
+            Encoding.UTF8.GetBytes(jwtSecret),
+            Encoding.UTF8.GetBytes(CalendarTokenKeyContext));
+    }
+
+    private static string ToBase64Url(ReadOnlySpan<byte> bytes) =>
+        Convert.ToBase64String(bytes)
+            .TrimEnd('=')
+            .Replace('+', '-')
+            .Replace('/', '_');
+
+    private static byte[] FromBase64Url(string value)
+    {
+        try
+        {
+            var padded = value.Replace('-', '+').Replace('_', '/');
+            padded = padded.PadRight(padded.Length + (4 - padded.Length % 4) % 4, '=');
+            return Convert.FromBase64String(padded);
+        }
+        catch (FormatException)
+        {
+            throw new ForbiddenException("Invalid calendar subscription token.");
+        }
+    }
+
+    private static string BuildIcs(List<Domain.Entities.Lecture> lectures, int userId)
+    {
+        var calendar = new Calendar
+        {
+            Method = "PUBLISH",
+            ProductId = "-//UniVerse//Lectures Calendar//EN"
+        };
+
+        foreach (var lecture in lectures)
+        {
+            var location = lecture.Location is null
+                ? string.Empty
+                : $"{lecture.Location.Building}{(string.IsNullOrWhiteSpace(lecture.Location.Room) ? string.Empty : $", ауд. {lecture.Location.Room}")}";
+
+            var teacherName = lecture.Teacher?.DisplayName
+                ?? lecture.Teacher?.Email
+                ?? "не указан";
+
+            calendar.Events.Add(new CalendarEvent
+            {
+                Uid = $"lecture-{lecture.Id}-user-{userId}@universe.local",
+                Summary = lecture.Title,
+                Description = $"{lecture.Description}\nПреподаватель: {teacherName}",
+                Location = location,
+                DtStart = new CalDateTime(DateTime.SpecifyKind(lecture.StartsAt, DateTimeKind.Utc)),
+                DtEnd = new CalDateTime(DateTime.SpecifyKind(lecture.EndsAt, DateTimeKind.Utc)),
+                DtStamp = new CalDateTime(DateTime.UtcNow)
+            });
+        }
+
+        return new CalendarSerializer().SerializeToString(calendar) ?? string.Empty;
+    }
+
     public async Task<PagedResult<UserDto>> GetAllAsync(UserFilterRequest filter)
     {
         var query = _db.Users.AsQueryable();

backend/UniVerse.Infrastructure/UniVerse.Infrastructure.csproj

@@ -13,6 +13,7 @@
         <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.8" />
         <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.18.0" />
         <PackageReference Include="Quartz" Version="3.18.1" />
+        <PackageReference Include="Ical.Net" Version="5.2.2" />
     </ItemGroup>
 
     <ItemGroup>

docker-compose-prod.yml

@@ -26,6 +26,10 @@ services:
 
       - Cors:Origins=${CORS_ALLOWED_ORIGINS:-http://localhost:3000}
 
+      - RateLimiting:PermitLimit=${RATE_LIMITING_PERMIT_LIMIT:-600}
+      - RateLimiting:WindowSeconds=${RATE_LIMITING_WINDOW_SECONDS:-60}
+      - RateLimiting:QueueLimit=${RATE_LIMITING_QUEUE_LIMIT:-100}
+
       - Llm:BaseUrl=${LLM_BASE_URL}
       - Llm:ApiKey=${LLM_API_KEY}
       - Llm:Model=${LLM_MODEL}

frontend/src/api/client.ts

@@ -81,3 +81,30 @@ export function extractItems<T>(payload: T[] | { items?: T[] } | undefined): T[]
   if (Array.isArray(payload)) return payload
   return payload?.items ?? []
 }
+
+
+export async function apiRequestBlob(
+  path: string,
+  options: RequestInit & { query?: Record<string, unknown> } = {},
+): Promise<Blob> {
+  const headers = new Headers(options.headers)
+  if (!headers.has('Accept')) headers.set('Accept', 'text/calendar')
+  if (accessToken) headers.set('Authorization', `Bearer ${accessToken}`)
+
+  const response = await fetch(makeUrl(path, options.query), {
+    ...options,
+    headers,
+    credentials: 'include',
+  })
+
+  if (!response.ok) {
+    const body = await parseResponse(response)
+    const message =
+      typeof body === 'object' && body && 'message' in body
+        ? String((body as { message: unknown }).message)
+        : `API request failed with status ${response.status}`
+    throw new ApiError(message, response.status, body)
+  }
+
+  return response.blob()
+}

frontend/src/api/index.ts

@@ -1,4 +1,4 @@
-import { apiRequest, extractItems } from './client'
+import { apiRequest, apiRequestBlob, extractItems } from './client'
 import type {
   AchievementDto,
   AuthResponse,
@@ -18,6 +18,8 @@ import type {
   TagDto,
   UpdateReviewPromptRequest,
   UserAchievementDto,
+  AdminDashboardStatsDto,
+  CalendarSubscriptionDto,
   CurrentUserDto,
   UserDto,
   UserQuery,
@@ -68,12 +70,18 @@ export const usersApi = {
       body: JSON.stringify(payload),
     }),
   myStats: () => apiRequest<UserStatsDto>('/users/me/stats'),
+  adminStats: () => apiRequest<AdminDashboardStatsDto>('/users/admin/stats'),
   async myEnrollments() {
     const payload = await apiRequest<PagedResult<LectureDto> | LectureDto[] | undefined>(
       '/users/me/enrollments',
     )
     return extractItems(payload)
   },
+  downloadMyEnrollmentsIcs: () => apiRequestBlob('/users/me/enrollments.ics'),
+  downloadEnrollmentIcs: (lectureId: string | number) =>
+    apiRequestBlob(`/users/me/enrollments/${lectureId}.ics`),
+  getCalendarSubscription: () =>
+    apiRequest<CalendarSubscriptionDto>('/users/me/enrollments/calendar-subscription'),
   async myAchievements() {
     const payload = await apiRequest<
       PagedResult<UserAchievementDto> | UserAchievementDto[] | AchievementDto[]

frontend/src/api/types.ts

@@ -76,6 +76,17 @@ export interface UserStatsDto {
   enrollmentSlotRules: EnrollmentSlotRuleDto[]
 }
 
+export interface AdminDashboardStatsDto {
+  usersCount: number
+  lecturesCount: number
+  enrollmentsCount: number
+  pendingReviewsCount: number
+}
+
+export interface CalendarSubscriptionDto {
+  feedUrl: string
+}
+
 export interface EnrollmentSlotRuleDto {
   level: number
   slots: number

frontend/src/utils/downloadFile.ts

@@ -0,0 +1,10 @@
+export function downloadFile(blob: Blob, fileName: string) {
+  const url = URL.createObjectURL(blob)
+  const link = document.createElement('a')
+  link.href = url
+  link.download = fileName
+  document.body.appendChild(link)
+  link.click()
+  link.remove()
+  URL.revokeObjectURL(url)
+}

frontend/src/views/admin/AdminDashboardView.vue

@@ -3,17 +3,11 @@ import { computed, onMounted, ref } from 'vue'
 import GlassCard from '@/components/ui/GlassCard.vue'
 import StatsWidget from '@/components/ui/StatsWidget.vue'
 import StatusBadge from '@/components/ui/StatusBadge.vue'
-import { lecturesApi, reviewsApi, syncApi, usersApi } from '@/api'
+import { syncApi, usersApi } from '@/api'
-import type { LectureDto, SyncStatusDto, UserDto } from '@/api/types'
+import type { AdminDashboardStatsDto, SyncStatusDto } from '@/api/types'
 
-const users = ref<UserDto[]>([])
+const stats = ref<AdminDashboardStatsDto | null>(null)
-const lectures = ref<LectureDto[]>([])
-const pendingReviewsCount = ref(0)
 const syncStatus = ref<SyncStatusDto | null>(null)
-
-const enrollmentCount = computed(() =>
-  lectures.value.reduce((sum, lecture) => sum + lecture.enrollmentsCount, 0),
-)
 const syncMeta = computed(() =>
   syncStatus.value?.lastSyncAt
     ? `Последняя синхронизация: ${new Date(syncStatus.value.lastSyncAt).toLocaleString('ru-RU')}`
@@ -21,16 +15,8 @@ const syncMeta = computed(() =>
 )
 
 onMounted(async () => {
-  const [usersResult, lecturesResult, reviewsResult, syncResult] = await Promise.allSettled([
+  const [statsResult, syncResult] = await Promise.allSettled([usersApi.adminStats(), syncApi.status()])
-    usersApi.list({ PageSize: 100 }),
+  if (statsResult.status === 'fulfilled') stats.value = statsResult.value
-    lecturesApi.list({ PageSize: 100 }),
-    reviewsApi.listPage({ Page: 1, PageSize: 1, LlmStatus: 'Pending' }),
-    syncApi.status(),
-  ])
-  if (usersResult.status === 'fulfilled') users.value = usersResult.value
-  if (lecturesResult.status === 'fulfilled') lectures.value = lecturesResult.value
-  if (reviewsResult.status === 'fulfilled')
-    pendingReviewsCount.value = reviewsResult.value.totalCount
   if (syncResult.status === 'fulfilled') syncStatus.value = syncResult.value
 })
 </script>
@@ -40,12 +26,17 @@ onMounted(async () => {
     <h1 class="page-title">Дашборд администратора</h1>
 
     <div class="stats-row">
-      <StatsWidget label="Пользователей" :value="users.length" icon="users" color="green" />
+      <StatsWidget label="Пользователей" :value="stats?.usersCount ?? 0" icon="users" color="green" />
-      <StatsWidget label="Лекций" :value="lectures.length" icon="books" color="aqua" />
+      <StatsWidget label="Лекций" :value="stats?.lecturesCount ?? 0" icon="books" color="aqua" />
-      <StatsWidget label="Записей" :value="enrollmentCount" icon="calendar-event" color="orange" />
+      <StatsWidget
+        label="Записей"
+        :value="stats?.enrollmentsCount ?? 0"
+        icon="calendar-event"
+        color="orange"
+      />
       <StatsWidget
         label="Отзывы на проверке"
-        :value="pendingReviewsCount"
+        :value="stats?.pendingReviewsCount ?? 0"
         icon="message-circle"
         color="purple"
       />

frontend/src/views/student/DashboardView.vue

@@ -2,6 +2,8 @@
 import { computed, inject, onMounted, ref } from 'vue'
 import { useRouter } from 'vue-router'
 import { useAuthStore } from '@/stores/auth'
+import { usersApi } from '@/api'
+import { downloadFile } from '@/utils/downloadFile'
 import { useLecturesStore } from '@/stores/lectures'
 import { useUserStore } from '@/stores/user'
 import GlassCard from '@/components/ui/GlassCard.vue'
@@ -66,6 +68,16 @@ const levelProgressText = computed(() =>
     : `${userXp.value} XP`,
 )
 
+async function downloadLectureIcs(id: string) {
+  try {
+    const blob = await usersApi.downloadEnrollmentIcs(id)
+    downloadFile(blob, `lecture-${id}.ics`)
+    addToast?.("Файл календаря скачан", "success")
+  } catch (err) {
+    addToast?.(err instanceof Error ? err.message : "Не удалось скачать .ics", "error")
+  }
+}
+
 onMounted(async () => {
   await Promise.all([
     lectures.all.length ? Promise.resolve() : lectures.fetchLectures(),
@@ -125,7 +137,7 @@ async function registerLecture(id: string) {
           <button class="btn-primary" @click="router.push(`/lecture/${nextLecture.id}`)">
             Открыть
           </button>
-          <button class="btn-secondary">Добавить в календарь</button>
+          <button class="btn-secondary" @click="downloadLectureIcs(nextLecture.id)">Скачать .ics</button>
         </div>
       </div>
     </GlassCard>

frontend/src/views/student/LectureDetailView.vue

@@ -1,6 +1,8 @@
 <script setup lang="ts">
 import { computed, inject, onMounted, ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
+import { usersApi } from '@/api'
+import { downloadFile } from '@/utils/downloadFile'
 import { useLecturesStore } from '@/stores/lectures'
 import { useUserStore } from '@/stores/user'
 import GlassCard from '@/components/ui/GlassCard.vue'
@@ -37,6 +39,16 @@ onMounted(async () => {
   await lecturesStore.fetchLecture(lectureId.value)
 })
 
+async function downloadLectureIcs(id: string) {
+  try {
+    const blob = await usersApi.downloadEnrollmentIcs(id)
+    downloadFile(blob, `lecture-${id}.ics`)
+    addToast?.("Файл календаря скачан", "success")
+  } catch (err) {
+    addToast?.(err instanceof Error ? err.message : "Не удалось скачать .ics", "error")
+  }
+}
+
 async function registerLecture() {
   if (!lecture.value) return
   if (slotRegistrationDisabled.value) {
@@ -90,7 +102,7 @@ async function registerLecture() {
         <button v-else class="btn-secondary" @click="lecturesStore.unregister(lecture.id)">
           Отменить запись
         </button>
-        <button class="btn-secondary">Добавить в календарь</button>
+        <button class="btn-secondary" @click="downloadLectureIcs(lecture.id)">Скачать .ics</button>
         <button v-if="isAttended" class="btn-primary" @click="router.push(`/review/${lecture.id}`)">
           Оставить отзыв
         </button>

frontend/src/views/student/MyLecturesView.vue

@@ -1,6 +1,8 @@
 <script setup lang="ts">
-import { computed, onMounted, ref } from 'vue'
+import { computed, inject, onMounted, ref } from 'vue'
 import { useRouter } from 'vue-router'
+import { usersApi } from '@/api'
+import { downloadFile } from '@/utils/downloadFile'
 import { useLecturesStore } from '@/stores/lectures'
 import { useAuthStore } from '@/stores/auth'
 import GlassCard from '@/components/ui/GlassCard.vue'
@@ -14,6 +16,11 @@ const router = useRouter()
 const activeTab = ref<'upcoming' | 'history'>('upcoming')
 const cancelModal = ref(false)
 const selectedId = ref<string | null>(null)
+const calendarSubscriptionUrl = ref<string | null>(null)
+const calendarActionPending = ref(false)
+const addToast = inject('addToast') as
+  | ((message: string, type?: 'success' | 'error' | 'info') => void)
+  | undefined
 
 const upcoming = computed(() =>
   lecturesStore.registeredLectures.map((l) => ({ ...l, status: 'registered' })),
@@ -26,6 +33,98 @@ onMounted(async () => {
   if (auth.user) await lecturesStore.fetchRegisteredForCurrentUser()
 })
 
+async function downloadLectureIcs(id: string) {
+  try {
+    const blob = await usersApi.downloadEnrollmentIcs(id)
+    downloadFile(blob, `lecture-${id}.ics`)
+  } catch (err) {
+    addToast?.(err instanceof Error ? err.message : 'Не удалось скачать .ics', 'error')
+  }
+}
+
+async function downloadAllIcs() {
+  try {
+    const blob = await usersApi.downloadMyEnrollmentsIcs()
+    downloadFile(blob, 'my-lectures.ics')
+  } catch (err) {
+    addToast?.(err instanceof Error ? err.message : 'Не удалось скачать .ics', 'error')
+  }
+}
+
+async function getCalendarSubscriptionUrl() {
+  if (calendarSubscriptionUrl.value) return calendarSubscriptionUrl.value
+  const subscription = await usersApi.getCalendarSubscription()
+  calendarSubscriptionUrl.value = subscription.feedUrl
+  return subscription.feedUrl
+}
+
+async function copyText(value: string) {
+  if (navigator.clipboard?.writeText) {
+    try {
+      await navigator.clipboard.writeText(value)
+      return true
+    } catch {
+      // Browser may block async clipboard writes after awaiting the subscription request.
+    }
+  }
+
+  const textarea = document.createElement('textarea')
+  textarea.value = value
+  textarea.style.position = 'fixed'
+  textarea.style.left = '-9999px'
+  document.body.appendChild(textarea)
+  textarea.focus()
+  textarea.select()
+  const copied = document.execCommand('copy')
+  textarea.remove()
+  return copied
+}
+
+async function copyCalendarSubscriptionUrl() {
+  try {
+    calendarActionPending.value = true
+    const feedUrl = await getCalendarSubscriptionUrl()
+    if (!await copyText(feedUrl)) throw new Error('Браузер заблокировал копирование ссылки')
+    addToast?.('ICS-ссылка скопирована', 'success')
+  } catch (err) {
+    addToast?.(err instanceof Error ? err.message : 'Не удалось скопировать ссылку', 'error')
+  } finally {
+    calendarActionPending.value = false
+  }
+}
+
+async function syncWithGoogleCalendar() {
+  const googleWindow = window.open('about:blank', '_blank')
+
+  try {
+    calendarActionPending.value = true
+    const feedUrl = await getCalendarSubscriptionUrl()
+    const copied = await copyText(feedUrl)
+
+    const googleUrl = `https://calendar.google.com/calendar/r?cid=${encodeURIComponent(feedUrl)}`
+    if (googleWindow) {
+      googleWindow.opener = null
+      googleWindow.location.href = googleUrl
+    } else {
+      window.open(googleUrl, '_blank', 'noopener,noreferrer')
+    }
+    addToast?.(
+      copied
+        ? 'ICS-ссылка скопирована. Google Calendar открыт в новой вкладке.'
+        : 'Google Calendar открыт. Если ссылка не подставилась, скопируйте ICS-ссылку отдельно.',
+      copied ? 'success' : 'info',
+    )
+  } catch (err) {
+    googleWindow?.close()
+    addToast?.(
+      err instanceof Error ? err.message : 'Не удалось подготовить ссылку для Google Calendar',
+      'error',
+    )
+  } finally {
+    calendarActionPending.value = false
+  }
+}
+
 function openCancel(id: string) {
   selectedId.value = id
   cancelModal.value = true
@@ -46,7 +145,25 @@ async function confirmCancel() {
           Управляйте регистрациями, экспортируйте расписание и оставляйте отзывы.
         </p>
       </div>
-      <button class="btn-secondary">Экспорт в календарь</button>
+      <div class="calendar-actions">
+        <button
+          class="btn-primary"
+          :disabled="calendarActionPending"
+          @click="syncWithGoogleCalendar"
+        >
+          Синхронизировать с Google Calendar
+        </button>
+        <button
+          class="btn-secondary"
+          :disabled="calendarActionPending"
+          @click="copyCalendarSubscriptionUrl"
+        >
+          Скопировать ICS-ссылку
+        </button>
+        <button class="btn-secondary" @click="downloadAllIcs">
+          Скачать все мои лекции (.ics)
+        </button>
+      </div>
     </div>
 
     <div class="tabs">
@@ -76,7 +193,7 @@ async function confirmCancel() {
         </div>
         <div class="lecture-actions">
           <StatusBadge status="registered" />
-          <button class="btn-secondary btn-sm">Добавить в календарь</button>
+          <button class="btn-secondary btn-sm" @click="downloadLectureIcs(item.id)">Скачать .ics</button>
           <button class="btn-danger btn-sm" @click="openCancel(item.id)">Отменить</button>
         </div>
       </GlassCard>
@@ -133,6 +250,13 @@ async function confirmCancel() {
   gap: 12px;
   flex-wrap: wrap;
 }
+.calendar-actions {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 8px;
+  flex-wrap: wrap;
+}
 .tabs {
   display: inline-flex;
   width: fit-content;

frontend/src/views/teacher/TeacherAnalyticsView.vue

@@ -9,7 +9,6 @@ import { mapApiReview } from '@/api/mappers'
 import { useLecturesStore } from '@/stores/lectures'
 import { useAuthStore } from '@/stores/auth'
 
-const ratingTrend = [4.2, 4.5, 4.6, 4.8, 4.7]
 const lecturesStore = useLecturesStore()
 const auth = useAuthStore()
 const reviews = ref<Review[]>([])
@@ -17,8 +16,9 @@ const reviews = ref<Review[]>([])
 const positive = computed(() => reviews.value.filter((r) => r.sentiment === 'positive').length)
 const neutral = computed(() => reviews.value.filter((r) => r.sentiment === 'neutral').length)
 const negative = computed(() => reviews.value.filter((r) => r.sentiment === 'negative').length)
-const total = computed(() => reviews.value.length || 1)
+const total = computed(() => reviews.value.length)
-const pct = (value: number) => Math.round((value / total.value) * 100)
+const pct = (value: number) => (total.value ? Math.round((value / total.value) * 100) : 0)
+const ratio = (value: number) => `${value}/${total.value}`
 
 async function fetchTeacherAnalytics() {
   if (!auth.user?.id) return
@@ -39,37 +39,28 @@ watch(() => auth.user?.id, fetchTeacherAnalytics)
     <h1 class="page-title">Аналитика преподавателя</h1>
 
     <div class="grid">
-      <GlassCard>
-        <div class="section-title">Динамика оценок</div>
-        <div class="chart">
-          <div v-for="(value, i) in ratingTrend" :key="i" class="bar">
-            <div class="bar-fill" :style="{ height: `${value * 18}px` }"></div>
-            <span class="bar-label">Нед {{ i + 1 }}</span>
-          </div>
-        </div>
-        <div class="avg">Средняя оценка: 4.6</div>
-      </GlassCard>
-
       <GlassCard>
         <div class="section-title">Sentiment-анализ отзывов</div>
         <div class="sentiment">
           <div>
-            <div class="sentiment-label">Позитивные {{ pct(positive) }}%</div>
+            <div class="sentiment-label">Позитивные {{ ratio(positive) }}</div>
-            <ProgressBar :value="pct(positive)" :max="100" />
+            <ProgressBar :value="pct(positive)" :max="100" :text="ratio(positive)" />
           </div>
           <div>
-            <div class="sentiment-label">Нейтральные {{ pct(neutral) }}%</div>
+            <div class="sentiment-label">Нейтральные {{ ratio(neutral) }}</div>
             <ProgressBar
               :value="pct(neutral)"
               :max="100"
+              :text="ratio(neutral)"
               color="linear-gradient(90deg, #7DD3FC, #BAE6FD)"
             />
           </div>
           <div>
-            <div class="sentiment-label">Негативные {{ pct(negative) }}%</div>
+            <div class="sentiment-label">Негативные {{ ratio(negative) }}</div>
             <ProgressBar
               :value="pct(negative)"
               :max="100"
+              :text="ratio(negative)"
               color="linear-gradient(90deg, #FCA5A5, #FECACA)"
             />
           </div>
@@ -117,32 +108,6 @@ watch(() => auth.user?.id, fetchTeacherAnalytics)
   grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
   gap: 16px;
 }
-.chart {
-  display: flex;
-  gap: 12px;
-  align-items: flex-end;
-  height: 160px;
-  padding: 10px 0;
-}
-.bar {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 6px;
-}
-.bar-fill {
-  width: 26px;
-  border-radius: 6px 6px 0 0;
-  background: linear-gradient(180deg, #22c55e, #86efac);
-}
-.bar-label {
-  font-size: 11px;
-  color: var(--color-text-secondary);
-}
-.avg {
-  margin-top: 6px;
-  font-weight: 600;
-}
 .sentiment {
   display: flex;
   flex-direction: column;

frontend/src/views/teacher/TeacherDashboardView.vue

@@ -20,9 +20,6 @@ const upcoming = computed(() =>
 const enrolledTotal = computed(() =>
   teacherLectures.value.reduce((sum, l) => sum + l.enrolledSeats, 0),
 )
-const visibility = computed(() =>
-  teacherLectures.value.length ? Math.min(100, Math.round(enrolledTotal.value * 4)) : 0,
-)
 
 function fetchTeacherLectures() {
   if (!auth.user?.id) return
@@ -48,13 +45,7 @@ watch(() => auth.user?.id, fetchTeacherLectures)
     <div class="stats-row">
       <StatsWidget label="Предстоящие лекции" :value="upcoming.length" icon="📅" color="green" />
       <StatsWidget label="Записавшихся" :value="enrolledTotal" icon="👥" color="aqua" />
-      <StatsWidget label="Средняя оценка" :value="'—'" icon="⭐" color="orange" />
+      <StatsWidget label="Средняя оценка (0-1)" :value="'—'" icon="⭐" color="orange" />
-      <StatsWidget
-        label="Вовлеченность вне направления"
-        :value="`${visibility}%`"
-        icon="🌍"
-        color="purple"
-      />
     </div>
 
     <GlassCard>