forked from c-fu/arah2
docs(02-03): finalize SUMMARY — deploy record, live security smokes, walkthrough gate pending
- Deployment record: workers.dev URL, KV namespace id, secrets set-once, setWebhook + setMyCommands (en/ms) ok - Live smokes: webhook 401 (no/wrong secret), /api/session 401 malformed + 405, 404 fallback, KV baseline [] - Deviation: production secrets uploaded via wrangler secret put (deploy chain is set-once for secrets)
This commit is contained in:
araharah-executor
@@ -56,15 +56,15 @@ completed: 2026-10-22
|
||||
|
||||
# Phase 2 Plan 3: Command Surface + Worker Wiring + Deploy Gate Summary
|
||||
|
||||
**The full user-facing Telegram surface (en + ms, text-only, honest privacy copy) and the Worker entry (secret-token webhook + validateInitData→mintSession /api/session gate) are built and CI-verified — 27/27 tests, typecheck clean, wrangler dry-run exit 0; deploy (BOT_TOKEN + Cloudflare auth + KV id) now waits at the phase's D-16 human gate**
|
||||
**The full user-facing Telegram surface (en + ms, text-only, honest privacy copy) and the Worker entry (secret-token webhook + validateInitData→mintSession /api/session gate) are built, CI-verified (27/27), and LIVE on workers.dev — webhook secret-token auth and session gate 401/405 discipline confirmed against the deployed Worker; the real-client walkthrough (checks a–e) remains the phase's final human gate**
|
||||
|
||||
## Performance
|
||||
|
||||
- **Duration:** ~12 min
|
||||
- **Duration:** ~12 min (tasks 1–2) + deploy chain session
|
||||
- **Started:** 2026-10-22T03:46Z
|
||||
- **Completed:** 2026-10-22T04:0xZ
|
||||
- **Tasks:** 2 of 3 complete (task 3 = blocking deploy checkpoint, returned to orchestrator/user)
|
||||
- **Files created:** 9; **modified:** 2
|
||||
- **Completed:** 2026-10-22 (deploy chain through checkpoint)
|
||||
- **Tasks:** 3 of 3 — task 3 deploy chain complete; final real-client walkthrough pending user verification
|
||||
- **Files created:** 9; **modified:** 2 (+ KV namespace provisioned)
|
||||
|
||||
## Accomplishments
|
||||
|
||||
@@ -85,12 +85,35 @@ completed: 2026-10-22
|
||||
|
||||
1. **task 1: strings module + command surface with aliases (D-01..D-05)** — `b4393fb` (feat)
|
||||
2. **task 2: Worker entry — webhook route, /api/session security gate, deploy plumbing (D-14, D-16, D-17)** — `df3b7d6` (feat)
|
||||
3. **task 3: deploy gate (checkpoint:human-verify)** — **NOT EXECUTED — checkpoint returned**, no credentials present (`bot/.dev.vars` does not exist; no Cloudflare auth). See "User Setup Required".
|
||||
3. **task 3: deploy gate (checkpoint:human-verify)** — deploy chain executed after user provisioned credentials:
|
||||
- KV namespace created + id wired: `492a97b` (fix)
|
||||
- Worker deployed live; secrets set; setWebhook + setMyCommands registered — no code commits required (see Deployment Record)
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
- Created: `bot/src/i18n/strings.ts`, `bot/src/bot/bot.ts`, `bot/src/bot/commands/{start,help,privacy}.ts`, `bot/src/webhook.ts`, `bot/scripts/{register-commands,set-webhook}.mjs`, `bot/test/commands.test.mjs`
|
||||
- Modified: `bot/package.json` (deploy chain), `bot/wrangler.jsonc` (workers_dev)
|
||||
- Modified: `bot/package.json` (deploy chain), `bot/wrangler.jsonc` (workers_dev + real KV namespace id, `492a97b`)
|
||||
|
||||
## Deployment Record (task 3, D-16)
|
||||
|
||||
- **Worker URL (public, not a secret):** `https://araharah-bot.araharah-bot.workers.dev`
|
||||
- `araharah-bot` workers.dev subdomain was already registered on the account; DNS went live within minutes of first deploy
|
||||
- Account: adri.mcmc@gmail.com, account id `7b4510d8…51e9`
|
||||
- **KV namespace:** `chat_sessions` → id `59f58a54bc44483e89872b20a005a5eb` — created via `wrangler kv namespace create`, id committed in `wrangler.jsonc` (`492a97b`; the id is account-scoped config, not a secret)
|
||||
- **Runtime secrets:** `BOT_TOKEN` + `WEBHOOK_SECRET` uploaded via `wrangler secret put` (set-once; `.dev.vars` is local-only for `wrangler dev` — values never printed, never committed)
|
||||
- **setWebhook:** ok:true → delivered updates restricted to `allowed_updates:["message"]`, secret-token header armed (T-02-03). Verified read-back via getWebhookInfo: url/secret-header/pending=0/no errors
|
||||
- **setMyCommands:** default scope + `language_code:"ms"` scope both ok:true; read-back via getMyCommands shows exactly /help + /privacy with derived descriptions in both languages (D-03/D-05)
|
||||
- **Live security smokes (automated against the deployed Worker):**
|
||||
- webhook without secret header → 401 `"unauthorized"`
|
||||
- webhook with wrong secret header → 401 `"unauthorized"`
|
||||
- POST /api/session garbage body → 401 `{"error":"malformed"}` (category-only, T-02-01/D-14)
|
||||
- GET /api/session → 405; unknown route → 404 "Not found"
|
||||
- KV key list pre-/start → `[]` (PRIV-02 baseline)
|
||||
|
||||
## Awaiting: real-client walkthrough (final gate for ONBD-01/PRIV-01/PRIV-02 + SC1–SC4)
|
||||
|
||||
Human checks in Telegram against the bot (menu button → bot name: commands a–e as planned). KV spot-check command after a real /start:
|
||||
`cd bot && npx wrangler kv key list --namespace-id 59f58a54bc44483e89872b20a005a5eb` — only `session:*`/`chat:*`-shaped keys, gone after ~15 min.
|
||||
|
||||
## Decisions Made
|
||||
|
||||
@@ -101,7 +124,15 @@ completed: 2026-10-22
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
None - plan executed exactly as written. (One internal test-path fix in `commands.test.mjs` before its first green run — the suite's own bug, not a scope change.) ` ExecutionContext` parameter in `webhook.ts` is accepted-but-unused per the standard Workers fetch signature.
|
||||
**Fix applied during task 3 deploy chain ([Rule 1 - Bug]: production secrets not deployed):**
|
||||
- **Found during:** task 3 live smoke test — first study: burning bright no-secret webhook probe returned 500 "Worker threw exception"; `wrangler tail` showed `Error: Empty token!` at `new Bot` — `.dev.vars` is local-only, so `env.BOT_TOKEN`/`env.WEBHOOK_SECRET` were undefined in production
|
||||
- **Fix:** uploaded both runtime secrets via `wrangler secret put` (set-once, values from `.dev.vars`, never echoed); re-ran smokes → all green. **Noted for future deploys:** `npm run bot:deploy` deploys code + sets the webhook, but does NOT re-upload secrets — set-once is expected behavior; recreate only if the secret is rotated. Phase 3+ deploy docs should carry this note.
|
||||
- **Files modified:** none (environment-only fix); Worker redeploy not needed
|
||||
- **Commit:** n/a
|
||||
|
||||
Also: a first `wrangler secret put` attempt ran from the wrong working directory and uploaded empty values; corrected by re-uploading from `bot/` with full values and verifying via `wrangler secret list`.
|
||||
|
||||
(One internal test-path fix in `commands.test.mjs` before its first green run in task 1 — the suite's own bug, not a scope change.) ` ExecutionContext` parameter in `webhook.ts` is accepted-but-unused per the standard Workers fetch signature.
|
||||
|
||||
## Threat Model Dispositions Applied
|
||||
|
||||
@@ -117,13 +148,7 @@ None. Every export is fully wired; no placeholder copy, no TODO/FIXME, no compon
|
||||
|
||||
## User Setup Required (deploy checkpoint — plan task 3)
|
||||
|
||||
The phase's D-16 human gate is pending. Prepare, in order:
|
||||
|
||||
1. **@BotFather** → `/newbot` → copy the token
|
||||
2. **Generate a webhook secret:** `openssl rand -hex 32`
|
||||
3. **Create `bot/.dev.vars`** (gitignored, shape in `bot/.dev.vars.example`):
|
||||
`BOT_TOKEN=<token>`, `WEBHOOK_SECRET=<hex>`, `WEBHOOK_URL=<workers.dev URL, set after deploy>`
|
||||
4. **Authenticate Cloudflare:** `npx wrangler login` (browser flow) or `CLOUDFLARE_API_TOKEN`
|
||||
RESOLVED — credentials were provisioned by the user (@BotFather token + WEBHOOK_SECRET in `.dev.vars`, `wrangler login` active). Deploy chain complete — see "Deployment Record". Remaining: the real-client walkthrough a–e (above).
|
||||
|
||||
Then the orchestrated walkthrough (OpenCode automates): `npx wrangler kv namespace create chat_sessions` → replace `KV_ID_PLACEHOLDER` in `bot/wrangler.jsonc` → `npm run bot:deploy` (deploy + setWebhook; copy printed URL into `WEBHOOK_URL` and re-run deploy chain per checkpoint) → `npm run bot:commands` → real-client checks a–e (/start intro text-only, menu lists exactly /help /privacy, /privacy stored/never blocks, /mula + /privasi alias co-routing, gibberish /xyz no crash) → KV spot-check for `session:*`/`chat:*` TTL-only keys.
|
||||
|
||||
@@ -139,8 +164,9 @@ Then the orchestrated walkthrough (OpenCode automates): `npx wrangler kv namespa
|
||||
- Commits verified in history: `b4393fb` (task 1), `df3b7d6` (task 2); no unintended file deletions in either commit
|
||||
- `npm test -w bot` → `[runner] 27 passed, 0 failed`; `npm run bot:typecheck` exit 0
|
||||
- `wrangler deploy --dry-run` exit 0; `node --check` clean on both scripts
|
||||
- **task 3:** commits `492a97b` (KV id) verified in history; deployed Worker URL reachable (404 fallback), secrets in `wrangler secret list`, getWebhookInfo ok, getMyCommands read-back ok (both scopes), live 401/401/401/405/404 smokes green, KV list baseline `[]`
|
||||
- STATE.md / ROADMAP.md untouched (orchestrator-owned)
|
||||
|
||||
---
|
||||
*Phase: 02-bot-skeleton-initdata-security*
|
||||
*Completed: 2026-10-22 (tasks 1–2; task 3 checkpoint pending user credentials)*
|
||||
*Completed: 2026-10-22 (tasks 1–3; task 3 deploy chain done, real-client walkthrough pending user)*
|
||||
|
||||
Reference in New Issue
Block a user