telegix 1.1.1

package/lib/webapp.js

@@ -0,0 +1,65 @@
+/**
+ * Telegix - Telegram Web App InitData Validator
+ */
+
+import crypto from 'crypto';
+
+/**
+ * Validates Telegram Web App initData string according to official Telegram documentation
+ * @param {string} initDataStr - Raw initData string from Telegram Web App (window.Telegram.WebApp.initData)
+ * @param {string} botToken - Telegram Bot Token
+ * @param {object} [options] - { maxAgeSeconds?: number } (default 86400 / 24 hours)
+ * @returns {object|null} Parsed user data object if valid, or null if invalid
+ */
+export function validateWebAppInitData(initDataStr, botToken, options = {}) {
+  if (!initDataStr || !botToken) return null;
+
+  try {
+    const params = new URLSearchParams(initDataStr);
+    const hash = params.get('hash');
+    if (!hash) return null;
+
+    params.delete('hash');
+
+    const entries = [];
+    for (const [key, value] of params.entries()) {
+      entries.push(`${key}=${value}`);
+    }
+    entries.sort();
+    const dataCheckString = entries.join('\n');
+
+    // Secret key is HMAC-SHA256 of "WebAppData" using bot token as key
+    const secretKey = crypto.createHmac('sha256', 'WebAppData').update(botToken).digest();
+
+    // Calculated hash is HMAC-SHA256 of data-check-string using secret key
+    const calculatedHash = crypto.createHmac('sha256', secretKey).update(dataCheckString).digest('hex');
+
+    if (calculatedHash !== hash) {
+      return null;
+    }
+
+    // Optional freshness check (default max age 24 hours)
+    const authDate = parseInt(params.get('auth_date') || '0', 10);
+    const maxAge = options.maxAgeSeconds !== undefined ? options.maxAgeSeconds : 86400;
+    if (maxAge > 0 && authDate > 0) {
+      const now = Math.floor(Date.now() / 1000);
+      if (now - authDate > maxAge) {
+        return null; // Expired
+      }
+    }
+
+    // Parse data fields
+    const result = {};
+    for (const [key, value] of params.entries()) {
+      try {
+        result[key] = JSON.parse(value);
+      } catch {
+        result[key] = value;
+      }
+    }
+
+    return result;
+  } catch (err) {
+    return null;
+  }
+}

package/lib/webhook.js

@@ -0,0 +1,86 @@
+/**
+ * Telegix - Webhook Handler & Adapter
+ * @module telegix/webhook
+ */
+
+/**
+ * Creates a webhook HTTP request handler compatible with Node http, Express, Connect, Fastify, etc.
+ * @param {import('./telegix.js').Telegix} bot
+ * @param {string} [path='/']
+ * @param {object} [options]
+ * @param {string} [options.secretToken] - Secret token for header verification
+ * @returns {Function} Request handler (req, res, next)
+ */
+export function createWebhookCallback(bot, path = '/', options = {}) {
+  const secretToken = options.secretToken;
+
+  return async function webhookCallback(req, res, next) {
+    // Check path if specified and not root wildcard
+    const reqUrl = req.url ? req.url.split('?')[0] : '/';
+    if (path && path !== '/' && reqUrl !== path) {
+      if (typeof next === 'function') return next();
+      res.statusCode = 404;
+      res.end('Not Found');
+      return;
+    }
+
+    // Check method
+    if (req.method !== 'POST') {
+      res.statusCode = 405;
+      res.end('Method Not Allowed');
+      return;
+    }
+
+    // Check secret token if configured
+    if (secretToken) {
+      const receivedToken =
+        req.headers?.['x-telegram-bot-api-secret-token'] ||
+        req.headers?.['X-Telegram-Bot-Api-Secret-Token'];
+      if (receivedToken !== secretToken) {
+        res.statusCode = 403;
+        res.end('Forbidden: Invalid Secret Token');
+        return;
+      }
+    }
+
+    let update = null;
+
+    try {
+      // If body is already parsed (e.g. express.json() middleware)
+      if (req.body && typeof req.body === 'object') {
+        update = req.body;
+      } else {
+        // Read stream body
+        const chunks = [];
+        for await (const chunk of req) {
+          chunks.push(chunk);
+        }
+        const rawBody = Buffer.concat(chunks).toString('utf8');
+        update = JSON.parse(rawBody);
+      }
+
+      if (!update || typeof update !== 'object') {
+        res.statusCode = 400;
+        res.end('Bad Request: Invalid Telegram Update Payload');
+        return;
+      }
+
+      // Process update through Telegix pipeline
+      await bot.handleUpdate(update);
+
+      if (!res.writableEnded) {
+        res.statusCode = 200;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ ok: true }));
+      }
+    } catch (err) {
+      if (bot.errorHandler) {
+        bot.errorHandler(err);
+      }
+      if (!res.writableEnded) {
+        res.statusCode = 500;
+        res.end('Internal Server Error');
+      }
+    }
+  };
+}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "telegix",
+  "version": "1.1.1",
+  "description": "Lightweight Telegram Bot API framework for Node.js.",
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js",
+      "require": "./index.cjs"
+    }
+  },
+  "files": [
+    "lib",
+    "index.js",
+    "index.cjs",
+    "index.d.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "telegram",
+    "telegram-bot",
+    "telegram-bot-api",
+    "bot",
+    "bot-api",
+    "telegix",
+    "telegram-api",
+    "node-telegram-bot-api",
+    "telegraf",
+    "node"
+  ],
+  "author": "KazeDevID",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/KazeDevID/telegix.git"
+  }
+}