smartxtrader 3.8.1-xm.0

package/api/deriv/auth.js

@@ -0,0 +1,501 @@
+const crypto = require('crypto');
+const {
+    storeSession,
+    ensureSecretKey,
+    SESSION_TTL_SECONDS,
+} = require('../_lib/telegram_session_store');
+const {
+    ensureUserSubscription,
+    hasActiveSubscription,
+} = require('../_lib/telegram_subscription');
+
+const MAX_AUTH_AGE_SECONDS = Number(process.env.TELEGRAM_MAX_AUTH_AGE || 5 * 60);
+const BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN;
+const BOT_USERNAME = process.env.TELEGRAM_BOT_USERNAME;
+const TELEGRAM_MINI_APP_URL = process.env.TELEGRAM_MINI_APP_URL;
+const TELEGRAM_WEB_APP_URL = process.env.TELEGRAM_WEB_APP_URL;
+const TELEGRAM_DEEP_LINK = process.env.TELEGRAM_DEEP_LINK;
+
+const fetchFn = typeof fetch === 'function'
+    ? fetch.bind(globalThis)
+    : (...args) => import('node-fetch').then(({ default: fetchModule }) => fetchModule(...args));
+
+const SESSION_TTL_HUMAN = SESSION_TTL_SECONDS > 0
+    ? `${Math.round(SESSION_TTL_SECONDS / 60)} minute(s)`
+    : 'unlimited';
+
+const getBotDeepLink = () => TELEGRAM_DEEP_LINK || (BOT_USERNAME ? `https://t.me/${BOT_USERNAME}` : null);
+
+const sendJson = (res, statusCode, payload) => {
+    res.statusCode = statusCode;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(payload));
+};
+
+const createHttpError = (statusCode, message) => {
+    const error = new Error(message);
+    error.statusCode = statusCode;
+    return error;
+};
+
+const normalizeBody = (req) => {
+    if (req.body && typeof req.body === 'object') {
+        return req.body;
+    }
+
+    let raw = req.body;
+
+    if (!raw) {
+        raw = req.__body || '';
+    }
+
+    if (Buffer.isBuffer(raw)) {
+        raw = raw.toString('utf8');
+    }
+
+    if (typeof raw !== 'string') {
+        return {};
+    }
+
+    try {
+        return JSON.parse(raw);
+    } catch (error) {
+        return {};
+    }
+};
+
+const getTelegramInitData = (payload) => {
+    if (!payload) return null;
+
+    if (payload.telegram_init_data) {
+        return payload.telegram_init_data;
+    }
+
+    if (payload.telegram && payload.telegram.init_data) {
+        return payload.telegram.init_data;
+    }
+
+    return null;
+};
+
+const parseTelegramInitData = (initDataRaw) => new URLSearchParams(initDataRaw);
+
+const computeTelegramHash = (secretKey, dataCheckString) => crypto
+    .createHmac('sha256', secretKey)
+    .update(dataCheckString)
+    .digest('hex');
+
+const buildDataCheckString = (params) => {
+    const entries = [];
+
+    params.forEach((value, key) => {
+        if (key === 'hash') return;
+        entries.push(`${key}=${value}`);
+    });
+
+    entries.sort();
+
+    return entries.join('\n');
+};
+
+const getTelegramSecretKey = (botToken) => crypto
+    .createHmac('sha256', 'WebAppData')
+    .update(botToken)
+    .digest();
+
+const verifyTelegramSignature = (initDataRaw, botToken) => {
+    if (!botToken) {
+        throw new Error('Telegram bot token is not configured.');
+    }
+
+    if (!initDataRaw) {
+        throw new Error('Missing Telegram init data.');
+    }
+
+    const params = parseTelegramInitData(initDataRaw);
+    const providedHash = params.get('hash');
+
+    if (!providedHash) {
+        throw new Error('Telegram init data hash is missing.');
+    }
+
+    const dataCheckString = buildDataCheckString(params);
+    const secretKey = getTelegramSecretKey(botToken);
+    const expectedHash = computeTelegramHash(secretKey, dataCheckString);
+
+    if (expectedHash !== providedHash) {
+        throw new Error('Invalid Telegram signature.');
+    }
+
+    const authDateValue = params.get('auth_date');
+    if (authDateValue) {
+        const authDate = Number(authDateValue);
+        const now = Math.floor(Date.now() / 1000);
+        if (Number.isFinite(authDate) && MAX_AUTH_AGE_SECONDS > 0 && now - authDate > MAX_AUTH_AGE_SECONDS) {
+            throw new Error('Telegram init data has expired.');
+        }
+    }
+
+    return params;
+};
+
+const safeJsonParse = (value, fallback = null) => {
+    if (!value) return fallback;
+
+    try {
+        return JSON.parse(value);
+    } catch (error) {
+        return fallback;
+    }
+};
+
+const getTelegramContext = (params) => {
+    if (!params) return {};
+
+    const user = safeJsonParse(params.get('user'));
+    const chat = safeJsonParse(params.get('chat'));
+
+    return { user, chat };
+};
+
+const buildTelegramMenu = (payload = {}) => {
+    const inlineKeyboard = [];
+    const deepLink = getBotDeepLink();
+
+    if (payload.redirect_url) {
+        inlineKeyboard.push([{ text: 'Открыть Deriv', url: payload.redirect_url }]);
+    }
+
+    if (TELEGRAM_MINI_APP_URL) {
+        inlineKeyboard.push([{ text: 'Mini App', web_app: { url: TELEGRAM_MINI_APP_URL } }]);
+    }
+
+    if (TELEGRAM_WEB_APP_URL) {
+        inlineKeyboard.push([{ text: 'Web App', url: TELEGRAM_WEB_APP_URL }]);
+    }
+
+    if (deepLink && payload.intent_id) {
+        const refreshStart = encodeURIComponent(`refresh:${payload.intent_id}`);
+        inlineKeyboard.push([{ text: 'Обновить сессию', url: `${deepLink}?start=${refreshStart}` }]);
+    }
+
+    if (deepLink && Array.isArray(payload.accounts)) {
+        payload.accounts.slice(0, 5).forEach((account) => {
+            if (account?.loginid) {
+                const accountStart = encodeURIComponent(`account:${account.loginid}`);
+                inlineKeyboard.push([{
+                    text: `Аккаунт ${account.loginid}`,
+                    url : `${deepLink}?start=${accountStart}`,
+                }]);
+            }
+        });
+    }
+
+    if (deepLink) {
+        inlineKeyboard.push([{ text: 'Меню бота', url: deepLink }]);
+    }
+
+    return inlineKeyboard.length ? { inline_keyboard: inlineKeyboard } : null;
+};
+
+const postTelegramNotification = async (botToken, chatId, text, options = {}) => {
+    if (!botToken) {
+        return { ok: false, reason: 'BOT_TOKEN_MISSING' };
+    }
+
+    if (!chatId) {
+        return { ok: false, reason: 'CHAT_ID_MISSING' };
+    }
+
+    if (!text) {
+        return { ok: false, reason: 'MESSAGE_EMPTY' };
+    }
+
+    const { replyMarkup = null, parseMode = null } = options;
+
+    const url = `https://api.telegram.org/bot${botToken}/sendMessage`;
+
+    try {
+        const body = {
+            chat_id: chatId,
+            text,
+            disable_web_page_preview: true,
+        };
+
+        if (parseMode) {
+            body.parse_mode = parseMode;
+        }
+
+        if (replyMarkup) {
+            body.reply_markup = replyMarkup;
+        }
+
+        const response = await fetchFn(url, {
+            method : 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body   : JSON.stringify(body),
+        });
+
+        if (!response.ok) {
+            const errorText = await response.text();
+            console.warn('[telegram-bridge] Failed to send Telegram notification', response.status, errorText);
+            return {
+                ok         : false,
+                status     : response.status,
+                description: errorText,
+            };
+        }
+
+        return { ok: true };
+    } catch (error) {
+        console.warn('[telegram-bridge] Unexpected error when sending Telegram notification', error);
+        return {
+            ok    : false,
+            reason: 'NETWORK_ERROR',
+            error : error.message,
+        };
+    }
+};
+
+const buildSuccessResponse = (payload, telegramContext, sessionRecord, replyMarkup, subscriptionStatus) => {
+    const response = {
+        message: 'Deriv session successfully linked with Telegram.',
+        intent : payload.intent_id,
+    };
+
+    if (TELEGRAM_MINI_APP_URL) {
+        response.telegram_mini_app_url = TELEGRAM_MINI_APP_URL;
+    }
+
+    if (TELEGRAM_WEB_APP_URL) {
+        response.telegram_web_app_url = TELEGRAM_WEB_APP_URL;
+    }
+
+    const deepLink = getBotDeepLink();
+    if (deepLink) {
+        response.telegram_deep_link = deepLink;
+    }
+
+    if (replyMarkup?.inline_keyboard?.length) {
+        response.telegram_menu = replyMarkup.inline_keyboard;
+    }
+
+    if (telegramContext?.user) {
+        response.telegram_user = {
+            id        : telegramContext.user.id,
+            username  : telegramContext.user.username,
+            first_name: telegramContext.user.first_name,
+            last_name : telegramContext.user.last_name,
+        };
+    }
+
+    if (payload.locale) {
+        response.locale = payload.locale;
+    }
+
+    if (payload.ui_theme) {
+        response.ui_theme = payload.ui_theme;
+    }
+
+    if (payload.chart) {
+        response.chart = payload.chart;
+    }
+
+    if (sessionRecord) {
+        response.session = {
+            owner_id   : telegramContext?.user?.id || telegramContext?.chat?.id,
+            stored_at  : new Date(sessionRecord.stored_at).toISOString(),
+            expires_at : sessionRecord.expires_at
+                ? new Date(sessionRecord.expires_at).toISOString()
+                : null,
+            account_ids: (payload.accounts || []).map(account => account.loginid),
+            ttl        : SESSION_TTL_SECONDS,
+        };
+    }
+
+    if (subscriptionStatus) {
+        const subscriptionPayload = {
+            required  : subscriptionStatus.required,
+            ok        : subscriptionStatus.ok,
+            is_active : hasActiveSubscription(subscriptionStatus),
+            status    : hasActiveSubscription(subscriptionStatus) ? 'active' : 'inactive',
+            checked_at: subscriptionStatus.checkedAt || new Date().toISOString(),
+        };
+
+        if (Array.isArray(subscriptionStatus.chats)) {
+            subscriptionPayload.chats = subscriptionStatus.chats;
+        }
+
+        if (subscriptionStatus.subscribeLink) {
+            subscriptionPayload.subscribe_url = subscriptionStatus.subscribeLink;
+        }
+
+        if (subscriptionStatus.message) {
+            subscriptionPayload.message = subscriptionStatus.message;
+        }
+
+        response.subscription = subscriptionPayload;
+    }
+
+    return response;
+};
+
+const validatePayload = (payload) => {
+    if (!payload || typeof payload !== 'object') {
+        throw new Error('Invalid payload.');
+    }
+
+    if (!payload.intent_id) {
+        throw new Error('Missing intent identifier.');
+    }
+
+    if (!Array.isArray(payload.accounts)) {
+        throw new Error('Missing accounts list.');
+    }
+
+    return payload;
+};
+
+const getSessionOwnerId = (telegramContext) => {
+    if (!telegramContext) return null;
+    if (telegramContext.user?.id) return telegramContext.user.id;
+    if (telegramContext.chat?.id) return telegramContext.chat.id;
+    return null;
+};
+
+const buildSessionPayload = (payload, telegramContext) => ({
+    intent_id     : payload.intent_id,
+    accounts      : payload.accounts,
+    active_loginid: payload.active_loginid || null,
+    email         : payload.email || null,
+    residence     : payload.residence || null,
+    session_start : payload.session_start || null,
+    redirect_url  : payload.redirect_url || null,
+    locale        : payload.locale || null,
+    ui_theme      : payload.ui_theme || null,
+    chart         : payload.chart || null,
+    telegram_user : telegramContext?.user ? {
+        id        : telegramContext.user.id,
+        username  : telegramContext.user.username,
+        first_name: telegramContext.user.first_name,
+        last_name : telegramContext.user.last_name,
+    } : null,
+});
+
+module.exports = async (req, res) => {
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        return sendJson(res, 405, { error: 'Method not allowed.' });
+    }
+
+    const payload = normalizeBody(req);
+
+    try {
+        validatePayload(payload);
+
+        const initDataRaw = getTelegramInitData(payload);
+        const params = verifyTelegramSignature(initDataRaw, BOT_TOKEN);
+        const telegramContext = getTelegramContext(params);
+
+        if (!payload.accounts.length) {
+            throw createHttpError(400, 'At least one Deriv account is required.');
+        }
+
+        const sessionOwnerId = getSessionOwnerId(telegramContext);
+        if (!sessionOwnerId) {
+            throw createHttpError(400, 'Telegram user information is missing. Launch the WebApp from Telegram to continue.');
+        }
+
+        ensureSecretKey();
+
+        const subscriptionStatus = await ensureUserSubscription(sessionOwnerId, {
+            forceRefresh: true,
+        });
+
+        const sessionPayload = buildSessionPayload(payload, telegramContext);
+        const sessionRecord = await storeSession(sessionOwnerId, sessionPayload);
+
+        const replyMarkup = buildTelegramMenu(payload);
+        const chatId = telegramContext?.chat?.id || telegramContext?.user?.id;
+        const activeLogin = payload.active_loginid || payload.accounts[0]?.loginid || 'unknown account';
+        const lines = [
+            '✅ Deriv session linked with Telegram.',
+            `Intent: ${payload.intent_id}`,
+            `Account: ${activeLogin}`,
+        ];
+
+        if (payload.locale) {
+            lines.push(`Locale: ${payload.locale}`);
+        }
+
+        lines.push(`Stored for ${SESSION_TTL_HUMAN}.`);
+
+        if (subscriptionStatus?.required) {
+            lines.push('Subscription: active');
+        }
+
+        if (replyMarkup) {
+            lines.push('Используйте меню ниже, чтобы открыть приложение или сменить аккаунт.');
+        }
+
+        const notification = await postTelegramNotification(BOT_TOKEN, chatId, lines.join('\n'), {
+            replyMarkup,
+        });
+
+        if (!notification.ok && notification.reason === 'CHAT_ID_MISSING') {
+            console.warn('[telegram-bridge] Telegram chat identifier is missing in init data');
+        }
+
+        const response = buildSuccessResponse(
+            payload,
+            telegramContext,
+            sessionRecord,
+            replyMarkup,
+            subscriptionStatus,
+        );
+        if (notification.ok) {
+            response.notification = { ok: true };
+        } else {
+            response.notification = {
+                ok    : false,
+                reason: notification.reason || null,
+                status: notification.status || null,
+                error : notification.error || notification.description || null,
+            };
+
+            if (notification.status === 403) {
+                response.notification.hint = 'Убедитесь, что пользователь начал диалог с ботом и не остановил его.';
+            }
+        }
+
+        return sendJson(res, 200, response);
+    } catch (error) {
+        const statusCode = error.statusCode || (error.code === 'TELEGRAM_SESSION_SECRET_MISSING' ? 500 : 400);
+        const message = error.message || 'Unable to process Telegram bridge request.';
+        const responsePayload = { error: message };
+
+        if (error.details && typeof error.details === 'object') {
+            const details = error.details;
+            const subscriptionPayload = {
+                required  : details.required,
+                ok        : details.ok,
+                is_active : hasActiveSubscription(details),
+                status    : hasActiveSubscription(details) ? 'active' : 'inactive',
+                checked_at: details.checkedAt || null,
+                message   : details.message || message,
+            };
+
+            if (Array.isArray(details.chats)) {
+                subscriptionPayload.chats = details.chats;
+            }
+
+            if (details.subscribeLink) {
+                subscriptionPayload.subscribe_url = details.subscribeLink;
+            }
+
+            responsePayload.subscription = subscriptionPayload;
+        }
+
+        return sendJson(res, statusCode, responsePayload);
+    }
+};

package/api/legal/accept.js

@@ -0,0 +1,99 @@
+const {
+  parseJsonBody,
+  getRequestUrl,
+  sendJson,
+  verifySharedSecret,
+  respondWithOptions,
+} = require('../_lib/http_utils');
+
+const { storeConsent } = require('../_lib/legal_consent_store');
+
+const extractTelegramId = (req) => {
+  const url = getRequestUrl(req);
+  const searchParams = url.searchParams;
+  const queryKeys = ['tg_user_id', 'user_id', 'chat_id', 'tg_chat_id'];
+
+  for (const key of queryKeys) {
+    const value = searchParams.get(key);
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+  }
+
+  const body = parseJsonBody(req);
+  const bodyKeys = ['tg_user_id', 'user_id', 'chat_id', 'tg_chat_id'];
+  for (const key of bodyKeys) {
+    const value = body?.[key];
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      return String(value);
+    }
+  }
+
+  return null;
+};
+
+const sanitize = (record) => {
+  if (!record || typeof record !== 'object') return null;
+  return {
+    doc_version: record.doc_version || null,
+    offer_accepted_at: record.offer_accepted_at || null,
+    pd_consent_accepted_at: record.pd_consent_accepted_at || null,
+    analytics_consent: Boolean(record.analytics_consent),
+    stored_at: record.stored_at || null,
+  };
+};
+
+module.exports = async (req, res) => {
+  if (req.method === 'OPTIONS') {
+    respondWithOptions(res, ['POST', 'OPTIONS']);
+    return;
+  }
+
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'POST, OPTIONS');
+    sendJson(res, 405, { error: 'Method not allowed.' });
+    return;
+  }
+
+  const verification = verifySharedSecret(req);
+  if (!verification.ok) {
+    sendJson(res, verification.statusCode, { error: verification.message });
+    return;
+  }
+
+  const telegramId = extractTelegramId(req);
+  if (!telegramId) {
+    sendJson(res, 400, { error: 'Missing tg_user_id (telegram id).' });
+    return;
+  }
+
+  const body = parseJsonBody(req);
+
+  const docVersion = typeof body.doc_version === 'string' ? body.doc_version.trim() : null;
+  const offerAcceptedAt = typeof body.offer_accepted_at === 'string' ? body.offer_accepted_at : null;
+  const pdAcceptedAt = typeof body.pd_consent_accepted_at === 'string' ? body.pd_consent_accepted_at : null;
+  const analytics = Boolean(body.analytics_consent);
+
+  if (!docVersion || !offerAcceptedAt || !pdAcceptedAt) {
+    sendJson(res, 400, {
+      error: 'Missing required fields: doc_version, offer_accepted_at, pd_consent_accepted_at.',
+    });
+    return;
+  }
+
+  try {
+    const stored = await storeConsent(telegramId, {
+      doc_version: docVersion,
+      offer_accepted_at: offerAcceptedAt,
+      pd_consent_accepted_at: pdAcceptedAt,
+      analytics_consent: analytics,
+    });
+
+    sendJson(res, 200, { ok: true, consent: sanitize(stored) });
+  } catch (error) {
+    sendJson(res, 500, { error: error.message || 'Failed to store consent.' });
+  }
+};

package/api/legal/delete.js

@@ -0,0 +1,77 @@
+const {
+  parseJsonBody,
+  getRequestUrl,
+  sendJson,
+  verifySharedSecret,
+  respondWithOptions,
+} = require('../_lib/http_utils');
+
+const { deleteSession } = require('../_lib/telegram_session_store');
+const { deleteConsent } = require('../_lib/legal_consent_store');
+
+const extractTelegramId = (req) => {
+  const url = getRequestUrl(req);
+  const searchParams = url.searchParams;
+  const queryKeys = ['tg_user_id', 'user_id', 'chat_id', 'tg_chat_id'];
+
+  for (const key of queryKeys) {
+    const value = searchParams.get(key);
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+  }
+
+  const body = parseJsonBody(req);
+  const bodyKeys = ['tg_user_id', 'user_id', 'chat_id', 'tg_chat_id'];
+  for (const key of bodyKeys) {
+    const value = body?.[key];
+    if (typeof value === 'string' && value.trim()) {
+      return value.trim();
+    }
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      return String(value);
+    }
+  }
+
+  return null;
+};
+
+module.exports = async (req, res) => {
+  if (req.method === 'OPTIONS') {
+    respondWithOptions(res, ['POST', 'OPTIONS']);
+    return;
+  }
+
+  if (req.method !== 'POST') {
+    res.setHeader('Allow', 'POST, OPTIONS');
+    sendJson(res, 405, { error: 'Method not allowed.' });
+    return;
+  }
+
+  const verification = verifySharedSecret(req);
+  if (!verification.ok) {
+    sendJson(res, verification.statusCode, { error: verification.message });
+    return;
+  }
+
+  const telegramId = extractTelegramId(req);
+  if (!telegramId) {
+    sendJson(res, 400, { error: 'Missing tg_user_id.' });
+    return;
+  }
+
+  try {
+    const sessionDeleted = await deleteSession(telegramId);
+    const consentDeleted = await deleteConsent(telegramId);
+
+    sendJson(res, 200, {
+      ok: true,
+      deleted: {
+        session: Boolean(sessionDeleted),
+        legal_consent: Boolean(consentDeleted),
+      },
+    });
+  } catch (error) {
+    sendJson(res, 500, { error: error.message || 'Failed to delete data.' });
+  }
+};