common-tg-service 1.3.214 → 1.3.216

package/dist/app.module.js

@@ -37,6 +37,7 @@ const guards_1 = require("./guards");
 const components_1 = require("./components");
 const interceptors_1 = require("./interceptors");
 const event_manager_module_1 = require("./components/event-manager/event-manager.module");
+const collection_insights_module_1 = require("./components/collection-insights/collection-insights.module");
 let AppModule = class AppModule {
     configure(consumer) {
         consumer.apply(logger_middleware_1.LoggerMiddleware).forRoutes('*');
@@ -71,6 +72,7 @@ exports.AppModule = AppModule = __decorate([
             timestamp_module_1.TimestampModule,
             dynamic_data_module_1.DynamicDataModule,
             event_manager_module_1.EventManagerModule,
+            collection_insights_module_1.CollectionInsightsModule,
         ],
         providers: [
             {
@@ -96,6 +98,7 @@ exports.AppModule = AppModule = __decorate([
             transaction_module_1.TransactionModule,
             timestamp_module_1.TimestampModule,
             event_manager_module_1.EventManagerModule,
+            collection_insights_module_1.CollectionInsightsModule,
         ]
     })
 ], AppModule);

package/dist/app.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwE;AACxE,kEAA8D;AAC9D,8EAAyE;AACzE,sEAAkE;AAClE,2EAAuE;AACvE,2FAAsF;AACtF,gGAA2F;AAC3F,4EAAwE;AACxE,2EAAuE;AACvE,qDAAiD;AACjD,uEAAmE;AACnE,mEAA+D;AAC/D,wEAAkE;AAClE,uFAAiF;AACjF,gEAA4D;AAC5D,mEAA+D;AAC/D,wFAAmF;AACnF,8FAAyF;AACzF,6EAAwE;AACxE,qFAAiF;AACjF,+EAA2E;AAC3E,uFAAkF;AAClF,kEAA6D;AAC7D,0FAAqF;AACrF,6FAAwF;AACxF,uCAAqD;AACrD,qCAAqC;AACrC,6CAA0C;AAC1C,iDAAkD;AAClD,0FAAqF;AAwD9E,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,oCAAgB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAJY,8BAAS;oBAAT,SAAS;IAtDrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,wBAAU;YACV,gCAAc;YACd,uBAAU;YACV,6CAAoB;YACpB,4BAAY;YACZ,yCAAkB;YAClB,+BAAa;YACb,yCAAkB;YAClB,2CAAmB;YACnB,iCAAc;YACd,0BAAW;YACX,yCAAkB;YAClB,gCAAc;YACd,2CAAmB;YACnB,0BAAW;YACX,4BAAW;YACX,sCAAgB;YAChB,uCAAiB;YACjB,wBAAU;YACV,0BAAW;YACX,iCAAc;YACd,sCAAiB;YACjB,kCAAe;YACf,uCAAiB;YACjB,yCAAkB;SACnB;QACD,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,kBAAS;aACpB;YACD;gBACE,OAAO,EAAE,iBAAU;gBACnB,QAAQ,EAAE,+BAAgB;aAC3B;SACF;QACD,WAAW,EAAE,CAAC,8BAAa,CAAC;QAC5B,OAAO,EAAE;YACP,gCAAc;YACd,6CAAoB;YACpB,4BAAY;YACZ,iCAAc;YACd,0BAAW;YACX,yCAAkB;YAClB,gCAAc;YACd,2CAAmB;YACnB,iCAAc;YACd,sCAAiB;YACjB,kCAAe;YACf,yCAAkB;SACnB;KACF,CAAC;GACW,SAAS,CAIrB"}
+{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwE;AACxE,kEAA8D;AAC9D,8EAAyE;AACzE,sEAAkE;AAClE,2EAAuE;AACvE,2FAAsF;AACtF,gGAA2F;AAC3F,4EAAwE;AACxE,2EAAuE;AACvE,qDAAiD;AACjD,uEAAmE;AACnE,mEAA+D;AAC/D,wEAAkE;AAClE,uFAAiF;AACjF,gEAA4D;AAC5D,mEAA+D;AAC/D,wFAAmF;AACnF,8FAAyF;AACzF,6EAAwE;AACxE,qFAAiF;AACjF,+EAA2E;AAC3E,uFAAkF;AAClF,kEAA6D;AAC7D,0FAAqF;AACrF,6FAAwF;AACxF,uCAAqD;AACrD,qCAAqC;AACrC,6CAA0C;AAC1C,iDAAkD;AAClD,0FAAqF;AACrF,4GAAuG;AA0DhG,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,oCAAgB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAJY,8BAAS;oBAAT,SAAS;IAxDrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,wBAAU;YACV,gCAAc;YACd,uBAAU;YACV,6CAAoB;YACpB,4BAAY;YACZ,yCAAkB;YAClB,+BAAa;YACb,yCAAkB;YAClB,2CAAmB;YACnB,iCAAc;YACd,0BAAW;YACX,yCAAkB;YAClB,gCAAc;YACd,2CAAmB;YACnB,0BAAW;YACX,4BAAW;YACX,sCAAgB;YAChB,uCAAiB;YACjB,wBAAU;YACV,0BAAW;YACX,iCAAc;YACd,sCAAiB;YACjB,kCAAe;YACf,uCAAiB;YACjB,yCAAkB;YAClB,qDAAwB;SACzB;QACD,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,kBAAS;aACpB;YACD;gBACE,OAAO,EAAE,iBAAU;gBACnB,QAAQ,EAAE,+BAAgB;aAC3B;SACF;QACD,WAAW,EAAE,CAAC,8BAAa,CAAC;QAC5B,OAAO,EAAE;YACP,gCAAc;YACd,6CAAoB;YACpB,4BAAY;YACZ,iCAAc;YACd,0BAAW;YACX,yCAAkB;YAClB,gCAAc;YACd,2CAAmB;YACnB,iCAAc;YACd,sCAAiB;YACjB,kCAAe;YACf,yCAAkB;YAClB,qDAAwB;SACzB;KACF,CAAC;GACW,SAAS,CAIrB"}

package/dist/components/Telegram/Telegram.controller.d.ts

@@ -1,4 +1,4 @@
-import { Response } from 'express';
+import { Request, Response } from 'express';
 import { TelegramService } from './Telegram.service';
 import { SendMediaDto, GroupSettingsDto, GroupMemberOperationDto, AdminOperationDto, ChatCleanupDto, PrivacySettingsDto, ProfilePhotoDto, ScheduleMessageDto, BatchProcessDto, ForwardBatchDto, ContactExportImportDto, ContactBlockListDto, AddContactsDto, createGroupDto, ViewOnceMediaDto, CreateTgBotDto } from './dto';
 import { CreateChatFolderDto } from './dto/create-chat-folder.dto';
@@ -13,6 +13,19 @@ import { UpdateProfileDto } from './dto/update-profile.dto';
 export declare class TelegramController {
     private readonly telegramService;
     constructor(telegramService: TelegramService);
+    private parseIntegerQuery;
+    private parseBooleanQuery;
+    private parseThumbnailMode;
+    private sanitizeFilename;
+    private getRequestBaseUrl;
+    private getRequestApiKey;
+    private parseRangeHeader;
+    private sendRangeNotSatisfiable;
+    private waitForDrainOrClose;
+    private writeResponseChunk;
+    private isNotFoundMediaError;
+    private isUnsupportedMediaError;
+    private isUnavailableThumbnailError;
     connect(mobile: string, autoDisconnect?: boolean, handler?: boolean): Promise<{
         message: string;
     }>;
@@ -71,11 +84,11 @@ export declare class TelegramController {
     addContactsBulk(mobile: string, contactsDto: AddContactsDto): Promise<void>;
     getContacts(mobile: string): Promise<import("telegram").Api.contacts.TypeContacts>;
     sendMedia(mobile: string, sendMediaDto: SendMediaDto): Promise<void>;
-    downloadMedia(mobile: string, chatId: string, messageId: number, res: Response): Promise<Response<any, Record<string, any>>>;
-    getThumbnail(mobile: string, chatId: string, messageId: number, quality: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    downloadMedia(mobile: string, chatId: string, messageId: unknown, res: Response): Promise<Response<any, Record<string, any>>>;
+    getThumbnail(mobile: string, chatId: string, messageId: unknown, quality: string, res: Response): Promise<Response<any, Record<string, any>>>;
     sendMediaAlbum(mobile: string, albumDto: MediaAlbumOptions): Promise<import("./dto").AlbumSendResult>;
-    getMediaMetadata(mobile: string, chatId: string, types?: string | string[], startDate?: string, endDate?: string, limit?: number, maxId?: number, minId?: number): Promise<import("./dto").MediaListResponse>;
-    getFilteredMedia(mobile: string, chatId: string, types?: string | string[], startDate?: string, endDate?: string, limit?: number, maxId?: number, minId?: number): Promise<import("./dto").FilteredMediaListResponse>;
+    getMediaMetadata(mobile: string, chatId: string, types?: string | string[], startDate?: string, endDate?: string, limit?: unknown, maxId?: unknown, minId?: unknown): Promise<import("./dto").MediaListResponse>;
+    getFilteredMedia(mobile: string, chatId: string, types?: string | string[], startDate?: string, endDate?: string, limit?: unknown, maxId?: unknown, minId?: unknown, thumbnailMode?: unknown, inlineThumbnailLimit?: unknown, includeThumbnails?: unknown, apiKey?: string, req?: Request): Promise<import("./dto").FilteredMediaListResponse>;
     getGroupMembers(mobile: string, groupId: string, offset?: number, limit?: number): Promise<import("./dto").PaginatedGroupMembers>;
     blockChat(mobile: string, chatId: string): Promise<void>;
     deleteChatHistory(mobile: string, deleteHistoryDto: DeleteHistoryDto): Promise<void>;

package/dist/components/Telegram/Telegram.controller.js

@@ -67,10 +67,147 @@ const update_username_dto_1 = require("./dto/update-username.dto");
 const send_message_dto_1 = require("./dto/send-message.dto");
 const update_profile_dto_1 = require("./dto/update-profile.dto");
 const big_integer_1 = __importDefault(require("big-integer"));
+const MEDIA_HTTP_MAX_LIMIT = 200;
+const INLINE_THUMBNAIL_HTTP_MAX_LIMIT = 50;
 let TelegramController = class TelegramController {
     constructor(telegramService) {
         this.telegramService = telegramService;
     }
+    parseIntegerQuery(value, name, options = {}) {
+        const { required = false, min = 1, max = Number.MAX_SAFE_INTEGER } = options;
+        const rawValue = Array.isArray(value) ? value[0] : value;
+        if (rawValue === undefined || rawValue === null || rawValue === '') {
+            if (required)
+                throw new common_1.BadRequestException(`${name} is required`);
+            return undefined;
+        }
+        const valueText = String(rawValue).trim();
+        if (!/^\d+$/.test(valueText)) {
+            throw new common_1.BadRequestException(`${name} must be an integer`);
+        }
+        const parsed = Number(valueText);
+        if (!Number.isSafeInteger(parsed) || parsed < min || parsed > max) {
+            throw new common_1.BadRequestException(`${name} must be between ${min} and ${max}`);
+        }
+        return parsed;
+    }
+    parseBooleanQuery(value, name) {
+        const rawValue = Array.isArray(value) ? value[0] : value;
+        if (rawValue === undefined || rawValue === null || rawValue === '')
+            return undefined;
+        const valueText = String(rawValue).trim().toLowerCase();
+        if (['true', '1', 'yes'].includes(valueText))
+            return true;
+        if (['false', '0', 'no'].includes(valueText))
+            return false;
+        throw new common_1.BadRequestException(`${name} must be a boolean`);
+    }
+    parseThumbnailMode(value) {
+        const rawValue = Array.isArray(value) ? value[0] : value;
+        if (rawValue === undefined || rawValue === null || rawValue === '')
+            return 'url';
+        const mode = String(rawValue).trim().toLowerCase();
+        if (mode === 'url' || mode === 'base64' || mode === 'none')
+            return mode;
+        throw new common_1.BadRequestException('thumbnailMode must be one of: url, base64, none');
+    }
+    sanitizeFilename(filename) {
+        const sanitized = (filename || 'media.bin').replace(/[\r\n"]/g, '_').trim();
+        return (sanitized || 'media.bin').slice(0, 180);
+    }
+    getRequestBaseUrl(req) {
+        const forwardedProto = req.headers['x-forwarded-proto'];
+        const forwardedHost = req.headers['x-forwarded-host'];
+        const proto = Array.isArray(forwardedProto)
+            ? forwardedProto[0]
+            : forwardedProto || req.protocol || 'http';
+        const host = Array.isArray(forwardedHost)
+            ? forwardedHost[0]
+            : forwardedHost || req.get('host');
+        return host ? `${proto}://${host}` : '';
+    }
+    getRequestApiKey(req, queryApiKey) {
+        const headerApiKey = req.headers['x-api-key'];
+        return queryApiKey
+            || (Array.isArray(headerApiKey) ? headerApiKey[0] : headerApiKey)
+            || undefined;
+    }
+    parseRangeHeader(range, fileSize) {
+        const match = /^bytes=(\d*)-(\d*)$/.exec(range.trim());
+        if (!match || fileSize <= 0)
+            return null;
+        const [, startText, endText] = match;
+        if (!startText && !endText)
+            return null;
+        let start;
+        let end;
+        if (!startText) {
+            const suffixLength = Number(endText);
+            if (!Number.isSafeInteger(suffixLength) || suffixLength <= 0)
+                return null;
+            start = Math.max(fileSize - suffixLength, 0);
+            end = fileSize - 1;
+        }
+        else {
+            start = Number(startText);
+            end = endText ? Number(endText) : fileSize - 1;
+            if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end))
+                return null;
+        }
+        if (start < 0 || end < 0 || start > end || start >= fileSize || end >= fileSize) {
+            return null;
+        }
+        return { start, end, length: end - start + 1 };
+    }
+    sendRangeNotSatisfiable(res, fileSize) {
+        res.status(416).setHeader('Content-Range', `bytes */${fileSize}`);
+        return res.end();
+    }
+    waitForDrainOrClose(res) {
+        return new Promise((resolve, reject) => {
+            const cleanup = () => {
+                res.off('drain', onDrain);
+                res.off('close', onClose);
+                res.off('error', onError);
+            };
+            const onDrain = () => {
+                cleanup();
+                resolve();
+            };
+            const onClose = () => {
+                cleanup();
+                resolve();
+            };
+            const onError = (error) => {
+                cleanup();
+                reject(error);
+            };
+            res.once('drain', onDrain);
+            res.once('close', onClose);
+            res.once('error', onError);
+        });
+    }
+    async writeResponseChunk(res, chunk) {
+        if (res.destroyed)
+            return false;
+        if (!chunk.length)
+            return true;
+        if (res.write(chunk))
+            return true;
+        await this.waitForDrainOrClose(res);
+        return !res.destroyed;
+    }
+    isNotFoundMediaError(error) {
+        const message = String(error?.message || error || '');
+        return message.includes('FILE_REFERENCE_EXPIRED') || message.toLowerCase().includes('not found');
+    }
+    isUnsupportedMediaError(error) {
+        return String(error?.message || error || '').toLowerCase().includes('unsupported media type');
+    }
+    isUnavailableThumbnailError(error) {
+        const message = String(error?.message || error || '').toLowerCase();
+        return this.isNotFoundMediaError(error) || message.includes('not available');
+    }
     async connect(mobile, autoDisconnect, handler) {
         const options = { autoDisconnect, handler };
         await this.telegramService.connect(mobile, options);
@@ -225,36 +362,32 @@ let TelegramController = class TelegramController {
         }
     }
     async downloadMedia(mobile, chatId, messageId, res) {
-        if (!messageId || messageId <= 0 || !Number.isInteger(messageId)) {
-            throw new common_1.BadRequestException('Message ID must be a positive integer');
-        }
+        const parsedMessageId = this.parseIntegerQuery(messageId, 'messageId', { required: true });
         if (!chatId || chatId.trim().length === 0) {
             throw new common_1.BadRequestException('Chat ID is required and cannot be empty');
         }
         try {
-            const fileInfo = await this.telegramService.getMediaFileDownloadInfo(mobile, messageId, chatId);
+            const fileInfo = await this.telegramService.getMediaFileDownloadInfo(mobile, parsedMessageId, chatId);
+            const safeFilename = this.sanitizeFilename(fileInfo.filename);
             if (res.req.headers['if-none-match'] === fileInfo.etag) {
                 return res.status(304).end();
             }
             const range = res.req.headers.range;
             const ifRange = res.req.headers['if-range'];
             const chunkSize = 512 * 1024;
-            const rangeValid = range && fileInfo.fileSize > 0 && (!ifRange || ifRange === fileInfo.etag);
-            if (rangeValid) {
-                const parts = range.replace(/bytes=/, "").split("-");
-                const start = parseInt(parts[0], 10);
-                const end = parts[1] ? parseInt(parts[1], 10) : fileInfo.fileSize - 1;
-                const chunksize = (end - start) + 1;
-                if (start >= fileInfo.fileSize || end >= fileInfo.fileSize || start > end) {
-                    res.status(416).setHeader('Content-Range', `bytes */${fileInfo.fileSize}`);
-                    return res.end();
-                }
+            const rangeRequested = Boolean(range && fileInfo.fileSize > 0 && (!ifRange || ifRange === fileInfo.etag));
+            const parsedRange = rangeRequested ? this.parseRangeHeader(String(range), fileInfo.fileSize) : null;
+            if (rangeRequested && !parsedRange) {
+                return this.sendRangeNotSatisfiable(res, fileInfo.fileSize);
+            }
+            if (parsedRange) {
+                const { start, end, length } = parsedRange;
                 res.status(206);
                 res.setHeader('Content-Range', `bytes ${start}-${end}/${fileInfo.fileSize}`);
                 res.setHeader('Accept-Ranges', 'bytes');
-                res.setHeader('Content-Length', chunksize);
+                res.setHeader('Content-Length', length);
                 res.setHeader('Content-Type', fileInfo.contentType);
-                res.setHeader('Content-Disposition', `inline; filename="${fileInfo.filename}"`);
+                res.setHeader('Content-Disposition', `inline; filename="${safeFilename}"`);
                 res.setHeader('Cache-Control', 'public, max-age=86400, immutable');
                 res.setHeader('ETag', fileInfo.etag);
                 res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -262,8 +395,9 @@ let TelegramController = class TelegramController {
                 res.setHeader('Access-Control-Expose-Headers', 'Content-Length, Content-Range, Accept-Ranges');
                 const alignedStart = Math.floor(start / chunkSize) * chunkSize;
                 const skipBytes = start - alignedStart;
-                const fetchLimit = chunksize + skipBytes;
+                const fetchLimit = length + skipBytes;
                 let skipped = 0;
+                let remaining = length;
                 for await (const chunk of this.telegramService.streamMediaFile(mobile, fileInfo.fileLocation, (0, big_integer_1.default)(alignedStart), fetchLimit, chunkSize, fileInfo.fileSize || undefined, fileInfo.dcId)) {
                     if (res.destroyed)
                         break;
@@ -273,13 +407,22 @@ let TelegramController = class TelegramController {
                         data = data.subarray(toSkip);
                         skipped += toSkip;
                     }
-                    if (data.length > 0)
-                        res.write(data);
+                    if (data.length > remaining) {
+                        data = data.subarray(0, remaining);
+                    }
+                    if (data.length > 0) {
+                        const canContinue = await this.writeResponseChunk(res, data);
+                        if (!canContinue)
+                            return;
+                        remaining -= data.length;
+                    }
+                    if (remaining <= 0)
+                        break;
                 }
             }
             else {
                 res.setHeader('Content-Type', fileInfo.contentType);
-                res.setHeader('Content-Disposition', `inline; filename="${fileInfo.filename}"`);
+                res.setHeader('Content-Disposition', `inline; filename="${safeFilename}"`);
                 res.setHeader('Cache-Control', 'public, max-age=86400, immutable');
                 res.setHeader('ETag', fileInfo.etag);
                 res.setHeader('Accept-Ranges', 'bytes');
@@ -289,46 +432,56 @@ let TelegramController = class TelegramController {
                 if (fileInfo.fileSize > 0) {
                     res.setHeader('Content-Length', fileInfo.fileSize);
                 }
-                for await (const chunk of this.telegramService.streamMediaFile(mobile, fileInfo.fileLocation, (0, big_integer_1.default)(0), 5 * 1024 * 1024, chunkSize, fileInfo.fileSize || undefined, fileInfo.dcId)) {
+                for await (const chunk of this.telegramService.streamMediaFile(mobile, fileInfo.fileLocation, (0, big_integer_1.default)(0), fileInfo.fileSize > 0 ? fileInfo.fileSize : undefined, chunkSize, fileInfo.fileSize || undefined, fileInfo.dcId)) {
                     if (res.destroyed)
                         break;
-                    res.write(chunk);
+                    const canContinue = await this.writeResponseChunk(res, chunk);
+                    if (!canContinue)
+                        return;
                 }
             }
-            res.end();
+            if (!res.destroyed)
+                res.end();
         }
         catch (error) {
-            console.error(`[Download] Error messageId=${messageId} chatId=${chatId}:`, error.message || error, error.stack?.split('\n')[1]);
-            if (error.message?.includes('FILE_REFERENCE_EXPIRED') || error.message?.includes('not found')) {
+            if (res.headersSent) {
+                console.error(`[Download] Stream failed messageId=${parsedMessageId} chatId=${chatId}:`, error.message || error, error.stack?.split('\n')[1]);
+                if (!res.destroyed)
+                    res.destroy(error);
+                return;
+            }
+            if (this.isNotFoundMediaError(error)) {
+                console.warn(`[Download] Media unavailable messageId=${parsedMessageId} chatId=${chatId}:`, error.message || error);
                 return res.status(404).send(error.message || 'File reference expired');
             }
-            if (!res.headersSent) {
-                res.status(500).send(`Error downloading media: ${error.message || 'Unknown error'}`);
+            if (this.isUnsupportedMediaError(error)) {
+                console.warn(`[Download] Unsupported media messageId=${parsedMessageId} chatId=${chatId}:`, error.message || error);
+                return res.status(415).send(error.message || 'Unsupported media type');
             }
+            console.error(`[Download] Error messageId=${parsedMessageId} chatId=${chatId}:`, error.message || error, error.stack?.split('\n')[1]);
+            res.status(500).send(`Error downloading media: ${error.message || 'Unknown error'}`);
         }
     }
     async getThumbnail(mobile, chatId, messageId, quality, res) {
-        if (!messageId || messageId <= 0 || !Number.isInteger(messageId)) {
-            throw new common_1.BadRequestException('Message ID must be a positive integer');
-        }
+        const parsedMessageId = this.parseIntegerQuery(messageId, 'messageId', { required: true });
         if (!chatId || chatId.trim().length === 0) {
             throw new common_1.BadRequestException('Chat ID is required and cannot be empty');
         }
         const q = quality === 'high' ? 'high' : 'low';
         try {
-            const thumbnail = await this.telegramService.getThumbnail(mobile, messageId, chatId, q);
+            const thumbnail = await this.telegramService.getThumbnail(mobile, parsedMessageId, chatId, q);
             if (res.req.headers['if-none-match'] === thumbnail.etag) {
                 return res.status(304).end();
             }
             res.setHeader('Content-Type', thumbnail.contentType);
-            res.setHeader('Content-Disposition', `inline; filename="${thumbnail.filename}"`);
+            res.setHeader('Content-Disposition', `inline; filename="${this.sanitizeFilename(thumbnail.filename)}"`);
             res.setHeader('Cache-Control', 'public, max-age=604800, immutable');
             res.setHeader('ETag', thumbnail.etag);
             res.setHeader('Content-Length', thumbnail.buffer.length);
             return res.send(thumbnail.buffer);
         }
         catch (error) {
-            if (error.message?.includes('FILE_REFERENCE_EXPIRED') || error.message?.includes('not found') || error.message?.includes('not available')) {
+            if (this.isUnavailableThumbnailError(error)) {
                 return res.status(404).send(error.message || 'Thumbnail not available');
             }
             if (!res.headersSent) {
@@ -349,16 +502,16 @@ let TelegramController = class TelegramController {
         if (!chatId || chatId.trim().length === 0) {
             throw new common_1.BadRequestException('Chat ID is required and cannot be empty');
         }
-        if (limit !== undefined && (limit <= 0 || limit > 1000)) {
-            throw new common_1.BadRequestException('Limit must be between 1 and 1000');
-        }
+        const parsedLimit = this.parseIntegerQuery(limit, 'limit', { required: false, max: MEDIA_HTTP_MAX_LIMIT });
+        const parsedMaxId = this.parseIntegerQuery(maxId, 'maxId', { required: false });
+        const parsedMinId = this.parseIntegerQuery(minId, 'minId', { required: false });
         let parsedTypes;
         if (types) {
             const typesArray = Array.isArray(types) ? types : [types];
             const validTypes = ['photo', 'video', 'document', 'voice', 'audio', 'gif', 'roundVideo', 'sticker', 'all'];
             parsedTypes = typesArray
-                .filter(t => validTypes.includes(t.toLowerCase()) || validTypes.includes(t))
-                .map(t => t);
+                .map(t => validTypes.find(validType => validType.toLowerCase() === String(t).trim().toLowerCase()))
+                .filter((t) => Boolean(t));
             if (parsedTypes.length === 0) {
                 throw new common_1.BadRequestException(`Invalid types. Must be one or more of: ${validTypes.join(', ')}`);
             }
@@ -385,25 +538,35 @@ let TelegramController = class TelegramController {
             types: parsedTypes,
             startDate: parsedStartDate,
             endDate: parsedEndDate,
-            limit,
-            maxId,
-            minId
+            limit: parsedLimit,
+            maxId: parsedMaxId,
+            minId: parsedMinId
         });
     }
-    async getFilteredMedia(mobile, chatId, types, startDate, endDate, limit, maxId, minId) {
+    async getFilteredMedia(mobile, chatId, types, startDate, endDate, limit, maxId, minId, thumbnailMode, inlineThumbnailLimit, includeThumbnails, apiKey, req) {
         if (!chatId || chatId.trim().length === 0) {
             throw new common_1.BadRequestException('Chat ID is required and cannot be empty');
         }
-        if (limit !== undefined && (limit <= 0 || limit > 1000)) {
-            throw new common_1.BadRequestException('Limit must be between 1 and 1000');
+        const parsedLimit = this.parseIntegerQuery(limit, 'limit', { required: false, max: MEDIA_HTTP_MAX_LIMIT });
+        const parsedMaxId = this.parseIntegerQuery(maxId, 'maxId', { required: false });
+        const parsedMinId = this.parseIntegerQuery(minId, 'minId', { required: false });
+        const parsedInlineThumbnailLimit = this.parseIntegerQuery(inlineThumbnailLimit, 'inlineThumbnailLimit', {
+            required: false,
+            min: 0,
+            max: INLINE_THUMBNAIL_HTTP_MAX_LIMIT,
+        });
+        const parsedIncludeThumbnails = this.parseBooleanQuery(includeThumbnails, 'includeThumbnails');
+        let parsedThumbnailMode = this.parseThumbnailMode(thumbnailMode);
+        if (parsedIncludeThumbnails === false) {
+            parsedThumbnailMode = 'none';
         }
         let parsedTypes;
         if (types) {
             const typesArray = Array.isArray(types) ? types : [types];
             const validTypes = ['photo', 'video', 'document', 'voice', 'audio', 'gif', 'roundVideo', 'sticker', 'all'];
             parsedTypes = typesArray
-                .filter(t => validTypes.includes(t.toLowerCase()) || validTypes.includes(t))
-                .map(t => t);
+                .map(t => validTypes.find(validType => validType.toLowerCase() === String(t).trim().toLowerCase()))
+                .filter((t) => Boolean(t));
             if (parsedTypes.length === 0) {
                 throw new common_1.BadRequestException(`Invalid types. Must be one or more of: ${validTypes.join(', ')}`);
             }
@@ -430,9 +593,13 @@ let TelegramController = class TelegramController {
             types: parsedTypes,
             startDate: parsedStartDate,
             endDate: parsedEndDate,
-            limit,
-            maxId,
-            minId
+            limit: parsedLimit,
+            maxId: parsedMaxId,
+            minId: parsedMinId,
+            thumbnailMode: parsedThumbnailMode,
+            inlineThumbnailLimit: parsedInlineThumbnailLimit,
+            thumbnailApiKey: req ? this.getRequestApiKey(req, typeof apiKey === 'string' ? apiKey : undefined) : undefined,
+            thumbnailBaseUrl: req ? this.getRequestBaseUrl(req) : undefined,
         });
     }
     async getGroupMembers(mobile, groupId, offset, limit) {
@@ -1135,7 +1302,7 @@ __decorate([
     __param(2, (0, common_1.Query)('messageId')),
     __param(3, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, Number, Object]),
+    __metadata("design:paramtypes", [String, String, Object, Object]),
     __metadata("design:returntype", Promise)
 ], TelegramController.prototype, "downloadMedia", null);
 __decorate([
@@ -1187,7 +1354,7 @@ __decorate([
     __param(3, (0, common_1.Query)('quality')),
     __param(4, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, Number, String, Object]),
+    __metadata("design:paramtypes", [String, String, Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], TelegramController.prototype, "getThumbnail", null);
 __decorate([
@@ -1265,7 +1432,7 @@ __decorate([
     }),
     (0, swagger_1.ApiQuery)({
         name: 'limit',
-        description: 'Maximum number of messages to fetch (default: 50, max: 1000)',
+        description: 'Maximum number of messages to fetch (default: 50, max: 200)',
         required: false,
         type: Number
     }),
@@ -1299,14 +1466,14 @@ __decorate([
     __param(6, (0, common_1.Query)('maxId')),
     __param(7, (0, common_1.Query)('minId')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, Object, String, String, Number, Number, Number]),
+    __metadata("design:paramtypes", [String, String, Object, String, String, Object, Object, Object]),
     __metadata("design:returntype", Promise)
 ], TelegramController.prototype, "getMediaMetadata", null);
 __decorate([
     (0, common_1.Get)('media/filter/:mobile'),
     (0, swagger_1.ApiOperation)({
         summary: 'Get filtered media messages from a chat',
-        description: 'Get filtered list of media messages with detailed metadata including thumbnails. Returns standardized paginated response. Use maxId for pagination (get messages with ID less than maxId).'
+        description: 'Get filtered list of media messages with detailed metadata. Returns thumbnail URLs by default; inline base64 thumbnails are opt-in and capped. Use maxId for pagination (get messages with ID less than maxId).'
     }),
     (0, swagger_1.ApiParam)({ name: 'mobile', description: 'Mobile number of the Telegram account', required: true }),
     (0, swagger_1.ApiQuery)({
@@ -1335,7 +1502,7 @@ __decorate([
         name: 'limit',
         required: false,
         type: Number,
-        description: 'Maximum number of media items to fetch (default: 50, max: 1000)'
+        description: 'Maximum number of media items to fetch (default: 50, max: 200)'
     }),
     (0, swagger_1.ApiQuery)({
         name: 'maxId',
@@ -1349,6 +1516,24 @@ __decorate([
         type: Number,
         description: 'Minimum message ID to include'
     }),
+    (0, swagger_1.ApiQuery)({
+        name: 'thumbnailMode',
+        required: false,
+        enum: ['url', 'base64', 'none'],
+        description: 'Thumbnail response mode. url is default and avoids inline media memory growth; base64 is capped by inlineThumbnailLimit.'
+    }),
+    (0, swagger_1.ApiQuery)({
+        name: 'inlineThumbnailLimit',
+        required: false,
+        type: Number,
+        description: 'Maximum number of inline base64 thumbnails when thumbnailMode=base64 (default: 25, max: 50)'
+    }),
+    (0, swagger_1.ApiQuery)({
+        name: 'includeThumbnails',
+        required: false,
+        type: Boolean,
+        description: 'Compatibility flag. false maps thumbnailMode to none; true maps unset thumbnailMode to url.'
+    }),
     (0, swagger_1.ApiResponse)({
         status: 200,
         description: 'Paginated media response with standardized format',
@@ -1366,8 +1551,13 @@ __decorate([
     __param(5, (0, common_1.Query)('limit')),
     __param(6, (0, common_1.Query)('maxId')),
     __param(7, (0, common_1.Query)('minId')),
+    __param(8, (0, common_1.Query)('thumbnailMode')),
+    __param(9, (0, common_1.Query)('inlineThumbnailLimit')),
+    __param(10, (0, common_1.Query)('includeThumbnails')),
+    __param(11, (0, common_1.Query)('apiKey')),
+    __param(12, (0, common_1.Req)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, Object, String, String, Number, Number, Number]),
+    __metadata("design:paramtypes", [String, String, Object, String, String, Object, Object, Object, Object, Object, Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], TelegramController.prototype, "getFilteredMedia", null);
 __decorate([