araharah-executor 22fda6d12a fix(03-04): HMAC data-check-string excludes only hash — signature field participates (real clients rejected as tampered; erratum M6)

2026-10-23 01:34:19 +08:00

..

bot

feat(03-01): GEO-02 server half both directions — chat-keyboard fallback + GET /api/location + POST /api/location-fallback (claim-scoped)

2026-10-22 23:33:01 +08:00

i18n

feat(03-01): GEO-02 server half both directions — chat-keyboard fallback + GET /api/location + POST /api/location-fallback (claim-scoped)

2026-10-22 23:33:01 +08:00

kv

feat(03-01): TTL-only KV location-pin layer under the existing privacy gates (GEO-03, PRIV-02)

2026-10-22 23:25:59 +08:00

security

fix(03-04): HMAC data-check-string excludes only hash — signature field participates (real clients rejected as tampered; erratum M6)

2026-10-23 01:34:19 +08:00

config.ts

fix(02-bot-skeleton-initdata-security): WR-02 fail-closed /telegram/webhook — unarmed WEBHOOK_SECRET rejects (constant 500, category-only log) before grammY's accept-everything compare

2026-10-22 20:18:34 +08:00

webhook.ts

feat(03-01): GEO-02 server half both directions — chat-keyboard fallback + GET /api/location + POST /api/location-fallback (claim-scoped)

2026-10-22 23:33:01 +08:00