strdst7/Arah2
1
0
Fork 0
forked from c-fu/arah2
Code Pull Requests Activity

fix(02-bot-skeleton-initdata-security): WR-02 fail-closed /telegram/webhook — unarmed WEBHOOK_SECRET rejects (constant 500, category-only log) before grammY's accept-everything compare

Browse Source
This commit is contained in:
araharah-executor
2026-10-22 20:18:34 +08:00
parent 8995498bff
commit 3ea1fdd932
3 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot/src/config.ts
+4
View File
@@ -3,6 +3,10 @@
export interface Env {
BOT_TOKEN: string; // wrangler secret (D-15) — Telegram Bot API token from @BotFather
// WEBHOOK_SECRET MUST be a non-empty secret (D-15) — /telegram/webhook
// fails closed at request time when missing/empty (WR-02), refusing all
// deliveries rather than letting grammY's secret check degrade to
// accept-everything.
WEBHOOK_SECRET: string; // wrangler secret (D-15) — value Telegram echoes in X-Telegram-Bot-Api-Secret-Token
chat_sessions: KVNamespace; // TTL-only namespace — first durable KV namespace (PRIV-02)
}