@rubytech/create-realagent-code 0.1.582 → 0.1.584

package/payload/platform/lib/telegram-managed-bot/dist/index.js

@@ -0,0 +1,351 @@
+"use strict";
+/**
+ * Task 2618 — Telegram's managed-bot surface, and the webhook registration that
+ * a newly provisioned bot needs.
+ *
+ * This is a shared lib rather than plugin code because BOTH sides need it. The
+ * `managed_bot` update lands on the UI webhook route, which must fetch the new
+ * bot's token, persist it and register its webhook; the `telegram-bot-provision`
+ * MCP tool needs the same four Bot API calls for its own actions. UI production
+ * code does not import plugin source, so the alternative was a second copy of
+ * `TELEGRAM_ALLOWED_UPDATES` on the UI side — and two lists that must agree, of
+ * a set where naming any class replaces Telegram's default, is exactly the drift
+ * Task 2612 spent a task fixing.
+ *
+ * `TELEGRAM_ALLOWED_UPDATES` and `setTelegramWebhook` MOVED here from
+ * `plugins/telegram/mcp/src/lib/telegram.ts`, which now re-exports both so every
+ * existing plugin import keeps its path.
+ *
+ * Every name below is quoted from core.telegram.org/bots/api, read 2026-08-09.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANAGED_BOT_METHODS = exports.MAX_ADDED_USER_IDS = exports.MANAGED_BOT_REQUEST_ID_MAX = exports.TELEGRAM_ALLOWED_UPDATES = void 0;
+exports.setTelegramWebhook = setTelegramWebhook;
+exports.writeTelegramBotEntry = writeTelegramBotEntry;
+exports.getTelegramWebhookInfo = getTelegramWebhookInfo;
+exports.readTelegramBotEntry = readTelegramBotEntry;
+exports.buildManagedBotRequestKeyboard = buildManagedBotRequestKeyboard;
+exports.getManagedBotToken = getManagedBotToken;
+exports.replaceManagedBotToken = replaceManagedBotToken;
+exports.getManagedBotAccessSettings = getManagedBotAccessSettings;
+exports.setManagedBotAccessSettings = setManagedBotAccessSettings;
+exports.botCanManageBots = botCanManageBots;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const TELEGRAM_API = "https://api.telegram.org";
+/**
+ * Task 2612 — the update classes this install asks Telegram for.
+ *
+ * The trap: naming ANY class replaces Telegram's default set, so a class that
+ * works today and is missing from this list stops arriving with no error
+ * anywhere. Telegram's default is every class except `chat_member`,
+ * `message_reaction` and `message_reaction_count`.
+ *
+ * Task 2618 — `managed_bot` is fifteenth. It IS in Telegram's default set, so it
+ * arrives on an install that names nothing; but this install names its list, so
+ * omitting it here is the difference between a tapped provisioning button that
+ * works and one that silently does nothing.
+ *
+ * The order is the one Task 2612 states, and the registration test asserts the
+ * whole array rather than membership — the failure guarded against is a name
+ * silently dropped, which a membership check cannot see.
+ */
+exports.TELEGRAM_ALLOWED_UPDATES = [
+    "message",
+    "edited_message",
+    "callback_query",
+    "poll_answer",
+    "poll",
+    "message_reaction",
+    "pre_checkout_query",
+    "shipping_query",
+    "subscription",
+    "my_chat_member",
+    "business_connection",
+    "business_message",
+    "edited_business_message",
+    "deleted_business_messages",
+    "managed_bot",
+    // Task 2616 — the group set. `chat_member` (another member's membership
+    // changed, as against `my_chat_member` for the bot's own) and
+    // `message_reaction_count` (the anonymous tally that pairs with
+    // `message_reaction`) are OUTSIDE Telegram's default, so neither arrives until
+    // a bot re-registers. `chat_join_request` and the two boost classes are inside
+    // it and are named so that making the list explicit is not itself a regression.
+    "chat_member",
+    "chat_join_request",
+    "message_reaction_count",
+    "chat_boost",
+    "removed_chat_boost",
+    // Task 2617 — the channel pair. Both are INSIDE Telegram's default set, so they
+    // would arrive on an install that names nothing; this install names its own
+    // list, so they are named here for the reason `chat_join_request` and the two
+    // boost classes are — making the list explicit must not itself be a regression.
+    //
+    // Without them a channel post never reaches the route at all, and the failure is
+    // silent: Telegram reports no error for a class it was not asked for.
+    "channel_post",
+    "edited_channel_post",
+];
+/**
+ * Register a webhook URL with Telegram and generate a cryptographic secret.
+ *
+ * The secret is generated via crypto.randomBytes (64 hex chars), passed as
+ * `secret_token`, and written to disk ONLY after the API confirms success. That
+ * order prevents orphaned secret files when the call fails, and avoids
+ * overwriting a working secret during a failed re-registration.
+ *
+ * Telegram sends the secret in the X-Telegram-Bot-Api-Secret-Token header on
+ * every delivery; the webhook route validates it before processing.
+ *
+ * If secretFilePath is omitted, no secret is generated.
+ */
+async function setTelegramWebhook(botToken, webhookUrl, secretFilePath, fetchImpl = fetch) {
+    const secret = secretFilePath ? (0, node_crypto_1.randomBytes)(32).toString("hex") : undefined;
+    // Task 2612 — `allowed_updates` travels on every registration.
+    const body = {
+        url: webhookUrl,
+        allowed_updates: [...exports.TELEGRAM_ALLOWED_UPDATES],
+    };
+    if (secret) {
+        body.secret_token = secret;
+    }
+    const res = await fetchImpl(`${TELEGRAM_API}/bot${botToken}/setWebhook`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    const data = (await res.json());
+    if (!data.ok) {
+        return { ok: false, error: data.description ?? "Failed to set webhook" };
+    }
+    if (secret && secretFilePath) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(secretFilePath), { recursive: true });
+        (0, node_fs_1.writeFileSync)(secretFilePath, secret, { mode: 0o600 });
+        console.error(`[telegram] webhook secret written to ${secretFilePath} (${secret.length} chars)`);
+    }
+    return { ok: true, secret };
+}
+/** Merge one bot entry into an account's `telegram.bots[]`, replacing any entry
+ *  with the same id and leaving every other entry and every other key
+ *  byte-identical.
+ *
+ *  THE single writer of that array. Two callers reach it: the plugin's
+ *  `persistTelegramBot`, which adds the brand-containment assertion it needs
+ *  because it resolves this directory from an untrusted `accountId`; and the UI
+ *  webhook route, which already holds a directory that came from the platform's
+ *  own account enumeration. A bot registry with two writers is one that
+ *  eventually disagrees with itself about who is registered.
+ *
+ *  Task 2368's invariant is carried unchanged: registering, re-pointing or
+ *  rotating one bot cannot disturb another. */
+function writeTelegramBotEntry(accountDir, entry) {
+    const configPath = (0, node_path_1.join)(accountDir, "account.json");
+    if (!(0, node_fs_1.existsSync)(configPath)) {
+        return { ok: false, error: `account.json not found at ${configPath}` };
+    }
+    let config;
+    try {
+        config = JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+    }
+    catch (e) {
+        // Refuse rather than overwrite. A file that will not parse holds state this
+        // merge cannot preserve, and replacing it would drop every other bot.
+        return { ok: false, error: `account.json parse failed: ${e.message}` };
+    }
+    const telegram = config.telegram ?? {};
+    const bots = Array.isArray(telegram.bots) ? telegram.bots : [];
+    const at = bots.findIndex((b) => b && typeof b === "object" && b.id === entry.id);
+    if (at >= 0)
+        bots[at] = entry;
+    else
+        bots.push(entry);
+    telegram.bots = bots;
+    config.telegram = telegram;
+    (0, node_fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+    return { ok: true };
+}
+/** What Telegram says it is currently delivering for this bot.
+ *
+ *  Task 2618 — MOVED here from the plugin, which re-exports it. Three callers
+ *  now: the plugin's registration probe, the tool's rotate action reading the URL
+ *  to restore, and the UI's hourly managed-bot census. */
+async function getTelegramWebhookInfo(botToken, fetchImpl = fetch) {
+    const res = await fetchImpl(`${TELEGRAM_API}/bot${botToken}/getWebhookInfo`);
+    const data = (await res.json());
+    return {
+        url: data.result.url,
+        pendingUpdateCount: data.result.pending_update_count,
+        lastErrorDate: data.result.last_error_date ?? 0,
+        allowedUpdates: data.result.allowed_updates ?? [],
+        ...(data.result.last_error_message !== undefined
+            ? { lastErrorMessage: data.result.last_error_message }
+            : {}),
+    };
+}
+/** One stored entry, whole, or null when the account holds no bot with that id.
+ *
+ *  The point is "whole". `listRegisteredBots` returns `{ id, role, agent }` for
+ *  the callers that only need to name a bot, and a rotation that spread THAT into
+ *  the writer would silently drop `adminUsers`, `dmPolicy`, `allowFrom` and
+ *  `managed` — replacing a token would quietly un-admit every admin on the bot.
+ *  A rotation changes one field and must carry the rest through untouched. */
+function readTelegramBotEntry(accountDir, botId) {
+    const configPath = (0, node_path_1.join)(accountDir, "account.json");
+    if (!(0, node_fs_1.existsSync)(configPath))
+        return null;
+    try {
+        const config = JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+        const bots = config.telegram?.bots;
+        if (!Array.isArray(bots))
+            return null;
+        return bots.find((b) => b && typeof b === "object" && b.id === botId) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The largest `request_id` Telegram accepts: it is a signed 32-bit integer. */
+exports.MANAGED_BOT_REQUEST_ID_MAX = 2_147_483_647;
+/** The one reply keyboard this install builds: a single button asking the user to
+ *  create a bot for this bot to manage.
+ *
+ *  Shared because both doors send it — the MCP tool's `offer` action and, if a
+ *  later caller needs it, the UI's own outbound. One builder, because a button
+ *  whose `request_id` is built two ways is a button whose answer cannot be
+ *  correlated.
+ *
+ *  One button in one row: `request_id` must be "unique within the message" and
+ *  nothing here has a reason to send two at once. `one_time_keyboard` so it
+ *  disappears once tapped rather than sitting in the operator's chat. */
+function buildManagedBotRequestKeyboard(input) {
+    if (!Number.isInteger(input.requestId) ||
+        input.requestId < 1 ||
+        input.requestId > exports.MANAGED_BOT_REQUEST_ID_MAX) {
+        // Refused here, not by Telegram: Telegram rejects the send with a description
+        // that never names the field, so the operator would see a failed offer and no
+        // reason for it.
+        throw new Error(`request_id ${input.requestId} is not a positive signed 32-bit integer, which is what Telegram requires`);
+    }
+    return {
+        keyboard: [
+            [
+                {
+                    text: input.text,
+                    request_managed_bot: {
+                        request_id: input.requestId,
+                        ...(input.suggestedName !== undefined ? { suggested_name: input.suggestedName } : {}),
+                        ...(input.suggestedUsername !== undefined
+                            ? { suggested_username: input.suggestedUsername }
+                            : {}),
+                    },
+                },
+            ],
+        ],
+        one_time_keyboard: true,
+        resize_keyboard: true,
+    };
+}
+/** Telegram caps `added_user_ids` at ten. Refused locally so the cap is named,
+ *  rather than surfacing as an opaque API error with no number in it. */
+exports.MAX_ADDED_USER_IDS = 10;
+/** The four Bot API methods this module owns, keyed by the action that uses each.
+ *  Read by the plugin's `OWNED_METHODS` census and by its `api-guard` refusals,
+ *  so neither can disagree with this module about what it covers. */
+exports.MANAGED_BOT_METHODS = Object.freeze({
+    token: "getManagedBotToken",
+    rotate: "replaceManagedBotToken",
+    accessRead: "getManagedBotAccessSettings",
+    accessWrite: "setManagedBotAccessSettings",
+});
+async function call(botToken, method, body, fetchImpl) {
+    try {
+        const res = await fetchImpl(`${TELEGRAM_API}/bot${botToken}/${method}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        const data = (await res.json());
+        if (!data.ok)
+            return { ok: false, error: data.description ?? `${method} failed` };
+        return { ok: true, result: data.result };
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+}
+/** "Use this method to get the token of a managed bot. Returns the token as
+ *  String on success." `userId` is the MANAGED bot's own user id, which is also
+ *  the numeric prefix of the token this returns.
+ *
+ *  The token is a credential. Every caller persists it and nothing logs it. */
+async function getManagedBotToken(managingBotToken, userId, fetchImpl = fetch) {
+    const r = await call(managingBotToken, exports.MANAGED_BOT_METHODS.token, { user_id: userId }, fetchImpl);
+    if (!r.ok)
+        return r;
+    return typeof r.result === "string"
+        ? { ok: true, token: r.result }
+        : { ok: false, error: "no-token-in-result" };
+}
+/** "Use this method to revoke the current token of a managed bot and generate a
+ *  new one. Returns the new token as String on success."
+ *
+ *  The bot's user id is unchanged by a rotation, so the new token has the same
+ *  numeric prefix and the bot keys on nothing new. */
+async function replaceManagedBotToken(managingBotToken, userId, fetchImpl = fetch) {
+    const r = await call(managingBotToken, exports.MANAGED_BOT_METHODS.rotate, { user_id: userId }, fetchImpl);
+    if (!r.ok)
+        return r;
+    return typeof r.result === "string"
+        ? { ok: true, token: r.result }
+        : { ok: false, error: "no-token-in-result" };
+}
+/** "Returns a BotAccessSettings object on success." */
+async function getManagedBotAccessSettings(managingBotToken, userId, fetchImpl = fetch) {
+    const r = await call(managingBotToken, exports.MANAGED_BOT_METHODS.accessRead, { user_id: userId }, fetchImpl);
+    if (!r.ok)
+        return r;
+    const s = r.result;
+    return {
+        ok: true,
+        isAccessRestricted: s?.is_access_restricted === true,
+        addedUserIds: (s?.added_users ?? [])
+            .map((u) => u?.id)
+            .filter((id) => typeof id === "number"),
+    };
+}
+/** "Use this method to change the access settings of a managed bot. Returns True
+ *  on success." `addedUserIds` is "Ignored if is_access_restricted is False",
+ *  which is Telegram's behaviour and is not re-implemented here. */
+async function setManagedBotAccessSettings(managingBotToken, userId, isAccessRestricted, addedUserIds, fetchImpl = fetch) {
+    if (addedUserIds && addedUserIds.length > exports.MAX_ADDED_USER_IDS) {
+        return { ok: false, error: "too-many-added-user-ids" };
+    }
+    const r = await call(managingBotToken, exports.MANAGED_BOT_METHODS.accessWrite, {
+        user_id: userId,
+        is_access_restricted: isAccessRestricted,
+        ...(addedUserIds ? { added_user_ids: addedUserIds } : {}),
+    }, fetchImpl);
+    return r.ok ? { ok: true } : { ok: false, error: r.error };
+}
+/** The managing bot's own `getMe`, for the one field that gates provisioning.
+ *  A bot without `can_manage_bots` cannot offer the request button at all, and
+ *  the switch lives in the @BotFather Mini App rather than behind any API call. */
+async function botCanManageBots(botToken, fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(`${TELEGRAM_API}/bot${botToken}/getMe`);
+        const data = (await res.json());
+        if (!data.ok)
+            return { ok: false, error: data.description ?? "getMe failed" };
+        return {
+            ok: true,
+            canManageBots: data.result?.can_manage_bots === true,
+            username: data.result?.username ?? "unknown",
+        };
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/telegram-managed-bot/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA4EH,gDAsCC;AAgDD,sDAyBC;AAsBD,wDAuBC;AASD,oDAgBC;AAmED,wEAoCC;AAyCD,gDAUC;AAOD,wDAUC;AAWD,kEAoBC;AAKD,kEAqBC;AAKD,4CAoBC;AA5fD,6CAA0C;AAC1C,qCAA6E;AAC7E,yCAA0C;AAE1C,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,wBAAwB,GAAsB;IACzD,SAAS;IACT,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,MAAM;IACN,kBAAkB;IAClB,oBAAoB;IACpB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,qBAAqB;IACrB,kBAAkB;IAClB,yBAAyB;IACzB,2BAA2B;IAC3B,aAAa;IACb,wEAAwE;IACxE,8DAA8D;IAC9D,gEAAgE;IAChE,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,aAAa;IACb,mBAAmB;IACnB,wBAAwB;IACxB,YAAY;IACZ,oBAAoB;IACpB,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,gFAAgF;IAChF,EAAE;IACF,iFAAiF;IACjF,sEAAsE;IACtE,cAAc;IACd,qBAAqB;CACtB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,UAAkB,EAClB,cAAuB,EACvB,YAA0B,KAAK;IAE/B,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5E,+DAA+D;IAC/D,MAAM,IAAI,GAA4B;QACpC,GAAG,EAAE,UAAU;QACf,eAAe,EAAE,CAAC,GAAG,gCAAwB,CAAC;KAC/C,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,YAAY,OAAO,QAAQ,aAAa,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;IAEzE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,uBAAuB,EAAE,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAA,uBAAa,EAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,CACX,wCAAwC,cAAc,KAAK,MAAM,CAAC,MAAM,SAAS,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAmCD;;;;;;;;;;;;+CAY+C;AAC/C,SAAgB,qBAAqB,CACnC,UAAkB,EAClB,KAA4B;IAE5B,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,UAAU,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,4EAA4E;QAC5E,sEAAsE;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAI,MAAM,CAAC,QAAoC,IAAI,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,IAAA,uBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAiBD;;;;0DAI0D;AACnD,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,YAAY,OAAO,QAAQ,iBAAiB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAQ7B,CAAC;IACF,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;QACpB,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;QACpD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC;QAC/C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE;QACjD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;YAC9C,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;8EAM8E;AAC9E,SAAgB,oBAAoB,CAClC,UAAkB,EAClB,KAAa;IAEb,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAE1D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAwCD,gFAAgF;AACnE,QAAA,0BAA0B,GAAG,aAAa,CAAC;AAexD;;;;;;;;;;yEAUyE;AACzE,SAAgB,8BAA8B,CAAC,KAK9C;IACC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAClC,KAAK,CAAC,SAAS,GAAG,CAAC;QACnB,KAAK,CAAC,SAAS,GAAG,kCAA0B,EAC5C,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,iBAAiB;QACjB,MAAM,IAAI,KAAK,CACb,cAAc,KAAK,CAAC,SAAS,2EAA2E,CACzG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR;gBACE;oBACE,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,mBAAmB,EAAE;wBACnB,UAAU,EAAE,KAAK,CAAC,SAAS;wBAC3B,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrF,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;4BACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,EAAE;4BACjD,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;aACF;SACF;QACD,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED;yEACyE;AAC5D,QAAA,kBAAkB,GAAG,EAAE,CAAC;AAErC;;qEAEqE;AACxD,QAAA,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,wBAAwB;IAChC,UAAU,EAAE,6BAA6B;IACzC,WAAW,EAAE,6BAA6B;CAClC,CAAC,CAAC;AAEZ,KAAK,UAAU,IAAI,CACjB,QAAgB,EAChB,MAAc,EACd,IAA6B,EAC7B,SAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,YAAY,OAAO,QAAQ,IAAI,MAAM,EAAE,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;+EAI+E;AACxE,KAAK,UAAU,kBAAkB,CACtC,gBAAwB,EACxB,MAAc,EACd,YAA0B,KAAK;IAE/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,2BAAmB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IAClG,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACjD,CAAC;AAED;;;;sDAIsD;AAC/C,KAAK,UAAU,sBAAsB,CAC1C,gBAAwB,EACxB,MAAc,EACd,YAA0B,KAAK;IAE/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,2BAAmB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QAC/B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACjD,CAAC;AAUD,uDAAuD;AAChD,KAAK,UAAU,2BAA2B,CAC/C,gBAAwB,EACxB,MAAc,EACd,YAA0B,KAAK;IAE/B,MAAM,CAAC,GAAG,MAAM,IAAI,CAClB,gBAAgB,EAChB,2BAAmB,CAAC,UAAU,EAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,EACnB,SAAS,CACV,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAiF,CAAC;IAC9F,OAAO;QACL,EAAE,EAAE,IAAI;QACR,kBAAkB,EAAE,CAAC,EAAE,oBAAoB,KAAK,IAAI;QACpD,YAAY,EAAE,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;aACjB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;oEAEoE;AAC7D,KAAK,UAAU,2BAA2B,CAC/C,gBAAwB,EACxB,MAAc,EACd,kBAA2B,EAC3B,YAAkC,EAClC,YAA0B,KAAK;IAE/B,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,0BAAkB,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAClB,gBAAgB,EAChB,2BAAmB,CAAC,WAAW,EAC/B;QACE,OAAO,EAAE,MAAM;QACf,oBAAoB,EAAE,kBAAkB;QACxC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,EACD,SAAS,CACV,CAAC;IACF,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED;;mFAEmF;AAC5E,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAA0B,KAAK;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,YAAY,OAAO,QAAQ,QAAQ,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI;YACpD,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,SAAS;SAC7C,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/payload/platform/lib/telegram-managed-bot/src/__tests__/managed-bot.test.ts

@@ -0,0 +1,251 @@
+import { describe, it, expect } from "vitest";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  TELEGRAM_ALLOWED_UPDATES,
+  setTelegramWebhook,
+  getManagedBotToken,
+  replaceManagedBotToken,
+  getManagedBotAccessSettings,
+  setManagedBotAccessSettings,
+  MANAGED_BOT_METHODS,
+  MAX_ADDED_USER_IDS,
+  writeTelegramBotEntry,
+} from "../index.js";
+
+/** One captured request: the method name off the URL, and the parsed JSON body. */
+interface Captured {
+  method: string;
+  body: Record<string, unknown>;
+}
+
+function stub(result: unknown, captured: Captured[] = [], ok = true) {
+  return (async (url: string | URL, init?: RequestInit) => {
+    const u = String(url);
+    captured.push({
+      method: u.slice(u.lastIndexOf("/") + 1),
+      body: init?.body ? JSON.parse(String(init.body)) : {},
+    });
+    return {
+      json: async () => (ok ? { ok: true, result } : { ok: false, description: "nope" }),
+    } as Response;
+  }) as unknown as typeof fetch;
+}
+
+describe("TELEGRAM_ALLOWED_UPDATES", () => {
+  // Asserted as the WHOLE array, not membership. Naming any class replaces
+  // Telegram's default set, so a name silently dropped stops that class arriving
+  // with no error anywhere, and a membership check cannot see a deletion.
+  // This is the THIRD site asserting this one array, after the plugin's
+  // webhook-register test and the UI's provisioning-arm test. It went stale
+  // without anybody noticing: the group work took the list from fifteen names to
+  // twenty and left this expectation at fifteen, and nothing caught it because no
+  // gate runs this lib's suite. Whoever changes the constant next must change
+  // three expectations, and only two of them are reachable from a `npm test` in
+  // platform/ui.
+  it("is the twenty-two names, in order", () => {
+    expect([...TELEGRAM_ALLOWED_UPDATES]).toEqual([
+      "message",
+      "edited_message",
+      "callback_query",
+      "poll_answer",
+      "poll",
+      "message_reaction",
+      "pre_checkout_query",
+      "shipping_query",
+      "subscription",
+      "my_chat_member",
+      "business_connection",
+      "business_message",
+      "edited_business_message",
+      "deleted_business_messages",
+      "managed_bot",
+      // the group set
+      "chat_member",
+      "chat_join_request",
+      "message_reaction_count",
+      "chat_boost",
+      "removed_chat_boost",
+      // the channel pair
+      "channel_post",
+      "edited_channel_post",
+    ]);
+  });
+
+  it("carries managed_bot, without which no provisioning update ever arrives", () => {
+    expect(TELEGRAM_ALLOWED_UPDATES).toContain("managed_bot");
+  });
+});
+
+describe("setTelegramWebhook", () => {
+  it("sends the whole allowed_updates array", async () => {
+    const cap: Captured[] = [];
+    const r = await setTelegramWebhook("111:AAA", "https://x/api/telegram/", undefined, stub(true, cap));
+    expect(r.ok).toBe(true);
+    expect(cap[0]?.method).toBe("setWebhook");
+    expect(cap[0]?.body.allowed_updates).toEqual([...TELEGRAM_ALLOWED_UPDATES]);
+  });
+
+  it("writes the secret only after Telegram confirms", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "mb-"));
+    const path = join(dir, "111");
+    await setTelegramWebhook("111:AAA", "https://x/api/telegram/", path, stub(true));
+    expect(readFileSync(path, "utf-8")).toHaveLength(64);
+  });
+});
+
+describe("getManagedBotToken", () => {
+  it("asks for the named managed bot and returns its token", async () => {
+    const cap: Captured[] = [];
+    const r = await getManagedBotToken("111:AAA", 999, stub("999:NEWTOKEN", cap));
+    expect(cap[0]?.method).toBe("getManagedBotToken");
+    expect(cap[0]?.body).toEqual({ user_id: 999 });
+    expect(r).toEqual({ ok: true, token: "999:NEWTOKEN" });
+  });
+
+  it("reports a Telegram refusal rather than throwing", async () => {
+    const r = await getManagedBotToken("111:AAA", 999, stub(null, [], false));
+    expect(r).toEqual({ ok: false, error: "nope" });
+  });
+});
+
+describe("replaceManagedBotToken", () => {
+  it("revokes and returns the new token", async () => {
+    const cap: Captured[] = [];
+    const r = await replaceManagedBotToken("111:AAA", 999, stub("999:ROTATED", cap));
+    expect(cap[0]?.method).toBe("replaceManagedBotToken");
+    expect(cap[0]?.body).toEqual({ user_id: 999 });
+    expect(r).toEqual({ ok: true, token: "999:ROTATED" });
+  });
+});
+
+describe("getManagedBotAccessSettings", () => {
+  it("maps Telegram's snake_case into the settings shape", async () => {
+    const r = await getManagedBotAccessSettings(
+      "111:AAA",
+      999,
+      stub({ is_access_restricted: true, added_users: [{ id: 7 }, { id: 8 }] }),
+    );
+    expect(r).toEqual({ ok: true, isAccessRestricted: true, addedUserIds: [7, 8] });
+  });
+
+  it("reads an absent added_users as nobody, not as unknown", async () => {
+    const r = await getManagedBotAccessSettings("111:AAA", 999, stub({ is_access_restricted: false }));
+    expect(r).toEqual({ ok: true, isAccessRestricted: false, addedUserIds: [] });
+  });
+});
+
+describe("setManagedBotAccessSettings", () => {
+  it("sends the restriction flag and the id list", async () => {
+    const cap: Captured[] = [];
+    const r = await setManagedBotAccessSettings("111:AAA", 999, true, [7, 8], stub(true, cap));
+    expect(r.ok).toBe(true);
+    expect(cap[0]?.method).toBe("setManagedBotAccessSettings");
+    expect(cap[0]?.body).toEqual({ user_id: 999, is_access_restricted: true, added_user_ids: [7, 8] });
+  });
+
+  it("omits added_user_ids when none were given", async () => {
+    const cap: Captured[] = [];
+    await setManagedBotAccessSettings("111:AAA", 999, true, undefined, stub(true, cap));
+    expect(cap[0]?.body).toEqual({ user_id: 999, is_access_restricted: true });
+  });
+
+  // Telegram documents "up to 10". Refusing locally names the cap; letting
+  // Telegram refuse would surface as an opaque API error with no number in it.
+  it("refuses more than ten ids before calling Telegram", async () => {
+    const cap: Captured[] = [];
+    const r = await setManagedBotAccessSettings(
+      "111:AAA",
+      999,
+      true,
+      Array.from({ length: MAX_ADDED_USER_IDS + 1 }, (_, i) => i + 1),
+      stub(true, cap),
+    );
+    expect(r).toEqual({ ok: false, error: "too-many-added-user-ids" });
+    expect(cap).toHaveLength(0);
+  });
+});
+
+/**
+ * The single writer of `telegram.bots[]`.
+ *
+ * Both callers reach it: the plugin's `persistTelegramBot`, which adds the
+ * brand-containment assertion it needs because it resolves the directory from an
+ * untrusted accountId, and the UI webhook route, which already holds a directory
+ * that came from the platform's own account enumeration. One implementation of
+ * the array merge, because a bot registry with two writers is a bot registry that
+ * eventually disagrees with itself about who is registered.
+ */
+describe("writeTelegramBotEntry", () => {
+  function accountDir(existing?: unknown): string {
+    const dir = mkdtempSync(join(tmpdir(), "acct-"));
+    writeFileSync(
+      join(dir, "account.json"),
+      JSON.stringify(existing ?? { accountId: "a", telegram: {} }),
+    );
+    return dir;
+  }
+
+  const read = (dir: string) => JSON.parse(readFileSync(join(dir, "account.json"), "utf-8"));
+
+  it("appends an unbound entry to an account holding none", () => {
+    const dir = accountDir();
+    expect(writeTelegramBotEntry(dir, { id: "999", token: "999:C", role: "unbound" })).toEqual({
+      ok: true,
+    });
+    expect(read(dir).telegram.bots).toEqual([{ id: "999", token: "999:C", role: "unbound" }]);
+  });
+
+  // Task 2368's invariant, carried over: registering or re-pointing one bot
+  // cannot disturb another.
+  it("replaces only the entry with the same id, leaving every other byte-identical", () => {
+    const dir = accountDir({
+      accountId: "a",
+      telegram: {
+        bots: [
+          { id: "111", token: "111:A", role: "admin", adminUsers: [42] },
+          { id: "999", token: "999:OLD", role: "unbound" },
+        ],
+      },
+    });
+    writeTelegramBotEntry(dir, { id: "999", token: "999:NEW", role: "unbound" });
+    expect(read(dir).telegram.bots).toEqual([
+      { id: "111", token: "111:A", role: "admin", adminUsers: [42] },
+      { id: "999", token: "999:NEW", role: "unbound" },
+    ]);
+  });
+
+  it("leaves every non-telegram key untouched", () => {
+    const dir = accountDir({ accountId: "a", name: "Acme", telegram: {} });
+    writeTelegramBotEntry(dir, { id: "999", token: "999:C", role: "unbound" });
+    expect(read(dir).name).toBe("Acme");
+    expect(read(dir).accountId).toBe("a");
+  });
+
+  it("refuses when there is no account.json to merge into", () => {
+    const dir = mkdtempSync(join(tmpdir(), "acct-"));
+    expect(writeTelegramBotEntry(dir, { id: "999", token: "999:C", role: "unbound" })).toMatchObject(
+      { ok: false },
+    );
+  });
+
+  it("refuses rather than overwriting when account.json will not parse", () => {
+    const dir = mkdtempSync(join(tmpdir(), "acct-"));
+    writeFileSync(join(dir, "account.json"), "{ not json");
+    const before = readFileSync(join(dir, "account.json"), "utf-8");
+    expect(writeTelegramBotEntry(dir, { id: "9", token: "9:C", role: "unbound" }).ok).toBe(false);
+    expect(readFileSync(join(dir, "account.json"), "utf-8")).toBe(before);
+  });
+});
+
+describe("MANAGED_BOT_METHODS", () => {
+  it("names the four Bot API methods this module owns", () => {
+    expect(Object.values(MANAGED_BOT_METHODS).sort()).toEqual([
+      "getManagedBotAccessSettings",
+      "getManagedBotToken",
+      "replaceManagedBotToken",
+      "setManagedBotAccessSettings",
+    ]);
+  });
+});