@lacrous/omnicloud 0.2.7 → 0.2.9

package/dist/index.d.cts

@@ -1604,6 +1604,23 @@ declare class TelegramStorageProvider implements StorageProvider {
 }
 
 declare const TELEGRAM_PROVIDER = "telegram";
+interface QrLoginToken {
+    /** The `tg://login?token=…` link to render as a QR code. */
+    url: string;
+    /** Unix time in milliseconds when this token stops being valid. */
+    expiresAt: number;
+}
+type QrStatus = {
+    status: "waiting";
+    token: QrLoginToken;
+} | {
+    status: "approved";
+    user: UserRecord;
+} | {
+    status: "password_required";
+} | {
+    status: "expired";
+};
 type VerifyCodeResult = {
     status: "ok";
     user: UserRecord;
@@ -1620,6 +1637,7 @@ declare class TelegramConnectionService {
     private readonly clientManager;
     private readonly credentials;
     private flows;
+    private qrFlows;
     constructor(repos: Repos, clientManager: TelegramClientManager, credentials: TelegramCredentials);
     /** Sends the Telegram confirmation code for the phone number. */
     startLogin(phone: string): Promise<void>;
@@ -1627,6 +1645,35 @@ declare class TelegramConnectionService {
     verifyCode(phone: string, code: string): Promise<VerifyCodeResult>;
     /** Completes sign-in for accounts with two-factor authentication enabled. */
     verifyPassword(phone: string, password: string): Promise<VerifyCodeResult>;
+    /**
+     * Starts a QR sign-in. Returns a flow id and the first login token. The phone
+     * approves the token in the Telegram app; `pollQrLogin` reports the result.
+     */
+    startQrLogin(): Promise<{
+        flowId: string;
+        token: QrLoginToken;
+    }>;
+    /**
+     * Reports where a QR sign-in stands. While waiting, returns a fresh token
+     * (Telegram rotates them every few seconds). On approval, completes the login.
+     */
+    pollQrLogin(flowId: string): Promise<QrStatus>;
+    /** Completes a QR sign-in for an account with two-factor authentication. */
+    submitQrPassword(flowId: string, password: string): Promise<{
+        status: "approved";
+        user: UserRecord;
+    }>;
+    private exportQrToken;
+    /** Waits for the phone to approve the token, then marks the flow approved. */
+    private watchQrApproval;
+    /**
+     * Asks Telegram whether the token was approved. Approval is observed by
+     * `ExportLoginToken` returning `LoginTokenSuccess` (or a DC migration).
+     */
+    private probeQrApproval;
+    private completeQrLogin;
+    private requireQrFlow;
+    private sweepExpiredQrFlows;
     /** Aborts a pending login flow (disconnects the client). */
     cancelLogin(phone: string): Promise<void>;
     /**
@@ -1637,6 +1684,12 @@ declare class TelegramConnectionService {
     ensureStorageForClient(userId: string, client: TelegramClient): Promise<StorageRecord>;
     private requireFlow;
     private finalizeLogin;
+    /**
+     * Saves an authorized client's session, upserts the user and creates storage.
+     * `phone` is the number the user typed; QR sign-in passes null and relies on
+     * the number Telegram reports.
+     */
+    private finalizeConnectedClient;
     private sweepExpiredFlows;
     private disconnectQuietly;
 }

package/dist/index.d.ts

@@ -1604,6 +1604,23 @@ declare class TelegramStorageProvider implements StorageProvider {
 }
 
 declare const TELEGRAM_PROVIDER = "telegram";
+interface QrLoginToken {
+    /** The `tg://login?token=…` link to render as a QR code. */
+    url: string;
+    /** Unix time in milliseconds when this token stops being valid. */
+    expiresAt: number;
+}
+type QrStatus = {
+    status: "waiting";
+    token: QrLoginToken;
+} | {
+    status: "approved";
+    user: UserRecord;
+} | {
+    status: "password_required";
+} | {
+    status: "expired";
+};
 type VerifyCodeResult = {
     status: "ok";
     user: UserRecord;
@@ -1620,6 +1637,7 @@ declare class TelegramConnectionService {
     private readonly clientManager;
     private readonly credentials;
     private flows;
+    private qrFlows;
     constructor(repos: Repos, clientManager: TelegramClientManager, credentials: TelegramCredentials);
     /** Sends the Telegram confirmation code for the phone number. */
     startLogin(phone: string): Promise<void>;
@@ -1627,6 +1645,35 @@ declare class TelegramConnectionService {
     verifyCode(phone: string, code: string): Promise<VerifyCodeResult>;
     /** Completes sign-in for accounts with two-factor authentication enabled. */
     verifyPassword(phone: string, password: string): Promise<VerifyCodeResult>;
+    /**
+     * Starts a QR sign-in. Returns a flow id and the first login token. The phone
+     * approves the token in the Telegram app; `pollQrLogin` reports the result.
+     */
+    startQrLogin(): Promise<{
+        flowId: string;
+        token: QrLoginToken;
+    }>;
+    /**
+     * Reports where a QR sign-in stands. While waiting, returns a fresh token
+     * (Telegram rotates them every few seconds). On approval, completes the login.
+     */
+    pollQrLogin(flowId: string): Promise<QrStatus>;
+    /** Completes a QR sign-in for an account with two-factor authentication. */
+    submitQrPassword(flowId: string, password: string): Promise<{
+        status: "approved";
+        user: UserRecord;
+    }>;
+    private exportQrToken;
+    /** Waits for the phone to approve the token, then marks the flow approved. */
+    private watchQrApproval;
+    /**
+     * Asks Telegram whether the token was approved. Approval is observed by
+     * `ExportLoginToken` returning `LoginTokenSuccess` (or a DC migration).
+     */
+    private probeQrApproval;
+    private completeQrLogin;
+    private requireQrFlow;
+    private sweepExpiredQrFlows;
     /** Aborts a pending login flow (disconnects the client). */
     cancelLogin(phone: string): Promise<void>;
     /**
@@ -1637,6 +1684,12 @@ declare class TelegramConnectionService {
     ensureStorageForClient(userId: string, client: TelegramClient): Promise<StorageRecord>;
     private requireFlow;
     private finalizeLogin;
+    /**
+     * Saves an authorized client's session, upserts the user and creates storage.
+     * `phone` is the number the user typed; QR sign-in passes null and relies on
+     * the number Telegram reports.
+     */
+    private finalizeConnectedClient;
     private sweepExpiredFlows;
     private disconnectQuietly;
 }

package/dist/index.js

@@ -3095,10 +3095,13 @@ var TelegramStorageProvider = class {
 };
 
 // ../telegram/src/connection.ts
+import { randomUUID } from "crypto";
 import { Api as Api3 } from "telegram";
 import { computeCheck } from "telegram/Password.js";
 var TELEGRAM_PROVIDER = "telegram";
 var LOGIN_FLOW_TTL_MS = 5 * 60 * 1e3;
+var QR_FLOW_TTL_MS = 5 * 60 * 1e3;
+var QR_APPROVAL_POLL_MS = 2e3;
 var TelegramConnectionService = class {
   constructor(repos, clientManager, credentials) {
     this.repos = repos;
@@ -3109,6 +3112,7 @@ var TelegramConnectionService = class {
   clientManager;
   credentials;
   flows = /* @__PURE__ */ new Map();
+  qrFlows = /* @__PURE__ */ new Map();
   /** Sends the Telegram confirmation code for the phone number. */
   async startLogin(phone) {
     this.sweepExpiredFlows();
@@ -3157,6 +3161,167 @@ var TelegramConnectionService = class {
     }
     return this.finalizeLogin(flow);
   }
+  /**
+   * Starts a QR sign-in. Returns a flow id and the first login token. The phone
+   * approves the token in the Telegram app; `pollQrLogin` reports the result.
+   */
+  async startQrLogin() {
+    this.sweepExpiredQrFlows();
+    const client = newTelegramClient(this.credentials);
+    try {
+      await client.connect();
+      const flow = {
+        client,
+        createdAt: Date.now(),
+        approved: false,
+        needsPassword: false,
+        failure: null
+      };
+      const flowId = randomUUID();
+      const token = await this.exportQrToken(client);
+      this.qrFlows.set(flowId, flow);
+      this.watchQrApproval(flowId, flow);
+      return { flowId, token };
+    } catch (error) {
+      await this.disconnectQuietly(client);
+      throw mapTelegramError(error, "Could not start Telegram QR sign-in");
+    }
+  }
+  /**
+   * Reports where a QR sign-in stands. While waiting, returns a fresh token
+   * (Telegram rotates them every few seconds). On approval, completes the login.
+   */
+  async pollQrLogin(flowId) {
+    const flow = this.requireQrFlow(flowId);
+    if (flow.failure) {
+      this.qrFlows.delete(flowId);
+      await this.disconnectQuietly(flow.client);
+      throw new TelegramConnectionError(flow.failure);
+    }
+    if (flow.needsPassword) return { status: "password_required" };
+    if (!flow.approved) {
+      const token = await this.exportQrToken(flow.client).catch((error) => {
+        this.qrFlows.delete(flowId);
+        void this.disconnectQuietly(flow.client);
+        throw mapTelegramError(error, "Could not refresh the Telegram QR code");
+      });
+      return { status: "waiting", token };
+    }
+    return this.completeQrLogin(flowId, flow);
+  }
+  /** Completes a QR sign-in for an account with two-factor authentication. */
+  async submitQrPassword(flowId, password) {
+    const flow = this.requireQrFlow(flowId);
+    try {
+      const passwordInfo = await flow.client.invoke(new Api3.account.GetPassword());
+      const check = await computeCheck(passwordInfo, password);
+      await flow.client.invoke(new Api3.auth.CheckPassword({ password: check }));
+    } catch (error) {
+      throw mapTelegramError(error, "Telegram sign-in failed");
+    }
+    return this.completeQrLogin(flowId, flow);
+  }
+  async exportQrToken(client) {
+    const result = await client.invoke(
+      new Api3.auth.ExportLoginToken({
+        apiId: this.credentials.apiId,
+        apiHash: this.credentials.apiHash,
+        exceptIds: []
+      })
+    );
+    if (!(result instanceof Api3.auth.LoginToken)) {
+      throw new TelegramConnectionError("Telegram did not issue a QR login token");
+    }
+    const tokenBase64 = Buffer.from(result.token).toString("base64url");
+    return {
+      url: `tg://login?token=${tokenBase64}`,
+      expiresAt: result.expires * 1e3
+    };
+  }
+  /** Waits for the phone to approve the token, then marks the flow approved. */
+  watchQrApproval(flowId, flow) {
+    const timer = setInterval(() => {
+      if (Date.now() - flow.createdAt > QR_FLOW_TTL_MS) {
+        clearInterval(timer);
+        this.qrFlows.delete(flowId);
+        void this.disconnectQuietly(flow.client);
+        return;
+      }
+      if (flow.approved || flow.needsPassword || flow.failure) {
+        clearInterval(timer);
+        return;
+      }
+      this.probeQrApproval(flow).then(
+        (state) => {
+          if (state === "approved") {
+            flow.approved = true;
+            clearInterval(timer);
+          } else if (state === "password") {
+            flow.needsPassword = true;
+            clearInterval(timer);
+          }
+        },
+        (error) => {
+          flow.failure = mapTelegramError(error, "Telegram QR sign-in failed").message;
+          clearInterval(timer);
+        }
+      );
+    }, QR_APPROVAL_POLL_MS);
+    timer.unref();
+  }
+  /**
+   * Asks Telegram whether the token was approved. Approval is observed by
+   * `ExportLoginToken` returning `LoginTokenSuccess` (or a DC migration).
+   */
+  async probeQrApproval(flow) {
+    try {
+      const result = await flow.client.invoke(
+        new Api3.auth.ExportLoginToken({
+          apiId: this.credentials.apiId,
+          apiHash: this.credentials.apiHash,
+          exceptIds: []
+        })
+      );
+      if (result instanceof Api3.auth.LoginTokenSuccess) return "approved";
+      if (result instanceof Api3.auth.LoginTokenMigrateTo) {
+        await flow.client._switchDC(result.dcId);
+        const migrated = await flow.client.invoke(
+          new Api3.auth.ImportLoginToken({ token: result.token })
+        );
+        if (migrated instanceof Api3.auth.LoginTokenSuccess) return "approved";
+      }
+      return "pending";
+    } catch (error) {
+      if (isPasswordRequiredError(error)) return "password";
+      throw error;
+    }
+  }
+  async completeQrLogin(flowId, flow) {
+    this.qrFlows.delete(flowId);
+    const user = await this.finalizeConnectedClient(flow.client, null);
+    return { status: "approved", user };
+  }
+  requireQrFlow(flowId) {
+    const flow = this.qrFlows.get(flowId);
+    if (!flow) {
+      throw new NotFoundError("This Telegram QR sign-in has ended. Start again.");
+    }
+    if (Date.now() - flow.createdAt > QR_FLOW_TTL_MS) {
+      this.qrFlows.delete(flowId);
+      void this.disconnectQuietly(flow.client);
+      throw new ValidationError("The QR sign-in expired. Start again.");
+    }
+    return flow;
+  }
+  sweepExpiredQrFlows() {
+    const now = Date.now();
+    for (const [flowId, flow] of this.qrFlows) {
+      if (now - flow.createdAt > QR_FLOW_TTL_MS) {
+        this.qrFlows.delete(flowId);
+        void this.disconnectQuietly(flow.client);
+      }
+    }
+  }
   /** Aborts a pending login flow (disconnects the client). */
   async cancelLogin(phone) {
     const flow = this.flows.get(phone);
@@ -3218,11 +3383,20 @@ var TelegramConnectionService = class {
   }
   async finalizeLogin(flow) {
     this.flows.delete(flow.phone);
+    const user = await this.finalizeConnectedClient(flow.client, flow.phone);
+    return { status: "ok", user };
+  }
+  /**
+   * Saves an authorized client's session, upserts the user and creates storage.
+   * `phone` is the number the user typed; QR sign-in passes null and relies on
+   * the number Telegram reports.
+   */
+  async finalizeConnectedClient(client, phone) {
     let stringSession;
     let user;
     try {
-      stringSession = flow.client.session.save();
-      const me = await flow.client.getMe();
+      stringSession = client.session.save();
+      const me = await client.getMe();
       if (!(me instanceof Api3.User)) {
         throw new Error("Telegram did not return the authenticated user");
       }
@@ -3231,16 +3405,16 @@ var TelegramConnectionService = class {
         username: me.username ?? null,
         firstName: me.firstName ?? null,
         lastName: me.lastName ?? null,
-        phone: me.phone ?? flow.phone
+        phone: me.phone ?? phone ?? ""
       });
     } catch (error) {
-      await this.disconnectQuietly(flow.client);
+      await this.disconnectQuietly(client);
       throw mapTelegramError(error, "Could not complete the Telegram connection");
     }
     await this.repos.sessions.save(user.id, stringSession);
-    await this.ensureStorageForClient(user.id, flow.client);
-    this.clientManager.cacheClient(user.id, flow.client);
-    return { status: "ok", user };
+    await this.ensureStorageForClient(user.id, client);
+    this.clientManager.cacheClient(user.id, client);
+    return user;
   }
   sweepExpiredFlows() {
     const now = Date.now();