Arah2

Files

T

araharah-executor 54bffe728c feat(02-02): validateInitData — SubtleCrypto HMAC core with rejection classes (D-13, D-14)

- GREENs the plan-01 RED vector suite: T1-T7 all PASS (10/10 cases)
- Telegram-verified two-step key derivation: secretKey = HMAC(botToken, key=salt), checkHex = HMAC(dataCheckString, secretKey bytes)
- Sort by field name, hash/signature excluded, values decoded once with '+' literal (no URLSearchParams)
- Rejection precedence: malformed (hash/user.id/auth_date) -> tampered (timing-safe hex compare) -> stale (>900s, D-13)
- Hand-rolled WebAppInitUser/WebAppInitChat types (grammy ships none); zero deps of any kind — pure (raw, botToken, opts)

2026-10-22 11:41:46 +08:00

src

feat(02-02): validateInitData — SubtleCrypto HMAC core with rejection classes (D-13, D-14)

2026-10-22 11:41:46 +08:00

test

test(02-01): hand-rolled harness + RED initdata vector suite (D-12, TDD RED)

2026-10-22 11:38:06 +08:00

.dev.vars.example

feat(02-01): bot workspace scaffold with Env contract (D-09/D-10/D-11/D-15)

2026-10-22 11:35:54 +08:00

.gitignore

feat(02-01): bot workspace scaffold with Env contract (D-09/D-10/D-11/D-15)