mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 23:22:09 +03:00
0bb17b91c6
* fix(deps): bump transitive deps for 6 Dependabot + remaining audit vulns on main Same overrides as #9464 (ip-address, hono, fast-uri, socket.io-parser, undici) applied directly to main. Also covers brace-expansion (scoped), js-yaml v4 copies, and mermaid. npm audit: 6→0 vulnerabilities. Closes Dependabot #161-#166. * fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189, #190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities. * fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture. * feat(telegram): Mini App chat bridge — initData auth, update webhook, chat proxy Implements the Phase-1 slice of the Telegram Mini App integration (docs/proposals/TELEGRAM-MINIAPP.md): - src/lib/telegram/initData.ts — dependency-free WebApp initData HMAC-SHA256 verification (Telegram Bot API spec), with auth_date freshness check. - src/lib/telegram/config.ts — TELEGRAM_BOT_TOKEN / model / API base / timeout env config; token format validation; enabled gate. - src/lib/telegram/botApi.ts — minimal fetch-based Bot API client (sendMessage, editMessageText, setWebhook) + update shape helpers. - src/lib/telegram/chatProxy.ts — maps a Telegram user to a per-user OmniRoute API key (createApiKey, name telegram:<userId>) and proxies prompts through the existing handleChat pipeline. - src/app/api/telegram/update/route.ts — inbound endpoint serving both the Bot API update webhook (/start + chat replies) and the Mini App direct path (initData HMAC verified → 401 on mismatch). Public route prefix; own auth only. - src/app/miniapp/page.tsx — Telegram WebApp SDK chat UI. - Tests: telegram-init-data (7), telegram-botapi (5) — 12/12 pass. - Env docs: TELEGRAM_* vars in .env.example + ENVIRONMENT.md (sync ✓). - Route-validation check: PASS (body validated via Zod). --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: benzntech <bensonkbmca@gmail.com>
31 lines
1016 B
TypeScript
31 lines
1016 B
TypeScript
/**
|
|
* Telegram Mini App configuration.
|
|
*
|
|
* The bot token is read from the environment (TELEGRAM_BOT_TOKEN) so it is
|
|
* never stored in the DB or committed. It doubles as the HMAC secret for
|
|
* initData verification (see ./initData.ts).
|
|
*/
|
|
|
|
const DEFAULT_WEBHOOK_TIMEOUT_MS = 60_000;
|
|
|
|
/** Telegram bot token format: <numeric_id>:<alphanumeric_secret> (min 35 chars after colon). */
|
|
const BOT_TOKEN_RE = /^\d+:[A-Za-z0-9_-]{35,}$/;
|
|
|
|
export function getTelegramBotToken(): string {
|
|
return process.env.TELEGRAM_BOT_TOKEN || "";
|
|
}
|
|
|
|
export function isTelegramEnabled(): boolean {
|
|
return BOT_TOKEN_RE.test(getTelegramBotToken());
|
|
}
|
|
|
|
export function getTelegramWebhookTimeoutMs(): number {
|
|
const raw = process.env.TELEGRAM_WEBHOOK_TIMEOUT_MS;
|
|
const parsed = raw ? Number.parseInt(raw, 10) : NaN;
|
|
return Number.isInteger(parsed) && parsed > 0 ? parsed : DEFAULT_WEBHOOK_TIMEOUT_MS;
|
|
}
|
|
|
|
export function getTelegramBotApiBase(): string {
|
|
return process.env.TELEGRAM_BOT_API_BASE || "https://api.telegram.org";
|
|
}
|