arcodange/telegram-gateway
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity
6 Commits 1 Branch 0 Tags
07115e3162eb581de8f902dcd7a7e0a0e2cf911f
Commit Graph
6 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
arcodange 07115e3162 Phase 1.5 — auth layer (Redis sessions, allowlist, requireAuth)
Docker Build / build-and-push-image (push) Failing after 18s
Details 
Adds an authentication layer in front of the bot handlers :

- Auth handler on the principal bot (@arcodange_factory_bot, slug
  factory) parses /start, /auth <code>, /whoami, /logout. On a
  successful /auth, the message containing the code is best-effort
  deleted from the user's chat (replay defense).
- Redis-backed sessions (key tg-gw:auth:<from.id>, TTL 24h, configurable
  via AUTH_SESSION_TTL). Constant-time secret compare via crypto/subtle.
- ALLOWED_USERS env (CSV of Telegram user IDs) — silent-drops anyone
  not in the list before the auth gate runs.
- New per-bot field 'requireAuth' (pointer-bool). Default = true (secure
  by default). Auto-forced to false for handler=auth (chicken-and-egg).
- Server gates: allowlist first, then requireAuth before handler dispatch.
- Fail-at-startup if a bot is configured with handler=auth or
  requireAuth: true while AUTH_SECRET is unset.

Design: factory/docs/adr/20260509-telegram-gateway-auth.md (in factory PR).
User docs: AUTH.md (new), HOWTO_ADD_BOT.md (Cas 2 updated for default
true and gated flow).

New deps: github.com/redis/go-redis/v9.

Refs ~/.claude/plans/pour-les-notifications-on-inherited-seal.md § Phase 1.5.
 2026-05-09 13:56:30 +02:00
arcodange 6228169ac1 docs: HOWTO_ADD_BOT — 3 cases (outbound only / echo via gateway / agent-driven)
Docker Build / build-and-push-image (push) Successful in 40s
Details
2026-05-09 13:12:55 +02:00
arcodange d8b102fbf9 server: don't reject Telegram updates with unknown fields
Docker Build / build-and-push-image (push) Successful in 42s
Details 
DisallowUnknownFields rejected real Telegram payloads (entities, from,
date, etc. that our minimal structs don't cover). Lenient decode is the
right default for an upstream webhook we don't control.
 2026-05-09 13:06:40 +02:00
arcodange 5044890e7d chart: pin image.tag to 'latest' 
Workflow Gitea Actions ne produit que :latest et la branch ref ;
appVersion (0.1.0) n'existe pas → ImagePullBackOff.
 2026-05-09 12:51:16 +02:00
arcodange 13dc7aee13 rename: homelab-gateway → telegram-gateway
Docker Build / build-and-push-image (push) Successful in 44s
Details 
Aligns the project name with the public URL (tg.arcodange.fr) and the
Arcodange organization conventions. The 'homelab-gateway' name was too
generic.

Touches: chart name + helpers, image registry path, Go module path,
secret/configmap names, deployment mountPath, all docs.
 2026-05-09 12:35:03 +02:00
arcodange ee832de089 Phase 1 MVP — echo bot factory
Docker Build / build-and-push-image (push) Successful in 1m8s
Details
2026-05-09 12:23:59 +02:00