From 43da33397063bd98ffabdfdc32e344e4e5ce1bf0 Mon Sep 17 00:00:00 2001 From: Benson K B Date: Tue, 11 Aug 2026 16:57:26 +0530 Subject: [PATCH] docs(proposals): Telegram Mini App integration feasibility analysis (#9810) Assess adding a Telegram Mini App chat surface to OmniRoute. Verifies against current main (918fba5e3) what exists (outbound telegram webhook integration, bot-token validation + encryption gate) and what is missing (inbound Bot API listener, WebApp initData HMAC verification, mini app hosting, per-user API key mapping). Concludes: feasible with moderate effort (2-4 dev-days for a working slice). Identifies constraints (public HTTPS webhook, no native streaming to Telegram, server-side initData trust, encryption gate) and a phased next-steps plan (spike, minimal chat slice, hardening). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --- docs/proposals/TELEGRAM-MINIAPP.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/proposals/TELEGRAM-MINIAPP.md b/docs/proposals/TELEGRAM-MINIAPP.md index b7f390ac54..884e5c4959 100644 --- a/docs/proposals/TELEGRAM-MINIAPP.md +++ b/docs/proposals/TELEGRAM-MINIAPP.md @@ -58,7 +58,7 @@ the natural shape is: - **Public HTTPS required.** Telegram only delivers updates to an HTTPS endpoint with a valid cert. Self-hosted OmniRoute behind Tailscale/ngrok needs a public tunnel or Cloudflare Tunnel for the webhook path - (a future webhook-URL setting). The dashboard can render the current + (`TELEGRAM_WEBHOOK_URL`-style env). The dashboard can render the current public origin (`OMNIROUTE_PUBLIC_BASE_URL`) but no webhook registration helper exists. - **Encryption gate.** `webhooks/route.ts:77` already refuses telegram @@ -102,7 +102,7 @@ the natural shape is: 1. Add `grammy` or `telegraf` (or ~60 lines of hand-rolled HMAC + fetch). 2. Implement `src/lib/telegram/initData.ts` — `verifyInitData(initData, botToken)`. 3. Stand up a throwaway `POST /api/telegram/miniapp/webhook` route behind - a dedicated webhook secret; register via `setWebhook` once, locally. + `TELEGRAM_WEBHOOK_SECRET`; register via `setWebhook` once, locally. ### Phase 1 — Minimal chat slice (1–2 dev-days)