feat(core-api,console): add Telegram bot pairing flow - #542
Conversation
- Add TelegramConnect entity, DTOs, and migration for pairing tokens - Implement telegram-connect, telegram-polling, telegram-webhook services - Add /integrations/:id/connects endpoints for token generation and status - Add /integrations/:id/webhook/:integrationId endpoint for Telegram updates - Create console Telegram connect UI with QR code display and polling - Add CopyableValue component for token display - Update Integration entity with telegramConnects relation - Update generated API hooks (orval)
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
🚧 Files skipped from review as they are similar to previous changes (7)
📝 WalkthroughWalkthroughTelegram integrations now support persisted pairing connections, webhook or polling-based ChangesTelegram pairing and delivery
Reusable API key copy control
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Console
participant IntegrationsController
participant TelegramConnectService
participant Database
participant Telegram
participant TelegramWebhookService
Console->>IntegrationsController: Request pairing token
IntegrationsController->>TelegramConnectService: createPairing
TelegramConnectService->>Database: Store pending connection
Telegram->>IntegrationsController: Send /start webhook update
IntegrationsController->>TelegramWebhookService: processUpdate
TelegramWebhookService->>TelegramConnectService: confirmConnection
TelegramConnectService->>Database: Mark connection CONNECTED
Console->>IntegrationsController: Poll connected connections
IntegrationsController->>Database: Read connection records
Database-->>Console: Return connected devices
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
core-api/src/modules/integrations/connectors/telegram.connector.ts (3)
131-135: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAdd a timeout to each Telegram API request.
Without an abort timeout, an unresponsive Telegram request can hold this notification worker indefinitely. Apply the project-standard HTTP timeout and propagate a bounded failure.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core-api/src/modules/integrations/connectors/telegram.connector.ts` around lines 131 - 135, Update the Telegram API request in the connector’s fetch flow to use the project-standard HTTP timeout via an abort signal, ensuring every request is bounded. Propagate the timeout as a failure through the existing error-handling path rather than allowing the notification worker to remain blocked indefinitely.
129-159: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove Telegram chat IDs and raw API bodies from logs.
chatIdis a persistent user identifier, whileerrorBodymay contain additional Telegram account details. Log the integration ID, HTTP status, and a sanitized error instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core-api/src/modules/integrations/connectors/telegram.connector.ts` around lines 129 - 159, Update the Telegram send flow around the response error handling to remove chatId and raw errorBody from logs. In the logger.error call within the fetch response check, log the integration ID, HTTP status, and a sanitized error message instead, while preserving the existing thrown error behavior unless required to sanitize its logging only.
121-160: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winDo not abort fan-out after the first failed chat.
A blocked or deleted first chat throws immediately, preventing all later connected chats from receiving the alert. Attempt every destination and aggregate/report failures after the loop.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core-api/src/modules/integrations/connectors/telegram.connector.ts` around lines 121 - 160, Update the chatId fan-out loop to continue sending to every destination when a fetch or Telegram response fails instead of throwing immediately. Capture each chat-specific failure, complete all attempts, then aggregate and report the failures after the loop while preserving successful sends and existing error details.
🧹 Nitpick comments (1)
console/src/components/common/copyable-value.tsx (1)
20-26: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winHandle clipboard write errors gracefully.
navigator.clipboard.writeTextcan throw an error or reject the promise if the document lacks focus or if the browser blocks the clipboard permission. Wrapping the call in atry/catchprevents an unhandled promise rejection and allows you to notify the user if the copy action fails.🛡️ Proposed fix to handle clipboard errors
const handleCopy = async () => { if (!value) return; - await navigator.clipboard.writeText(value); - setCopied(true); - toast.success('Copied to clipboard'); - setTimeout(() => setCopied(false), 2000); + try { + await navigator.clipboard.writeText(value); + setCopied(true); + toast.success('Copied to clipboard'); + setTimeout(() => setCopied(false), 2000); + } catch (err) { + toast.error('Failed to copy to clipboard'); + } };🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@console/src/components/common/copyable-value.tsx` around lines 20 - 26, Update handleCopy to wrap navigator.clipboard.writeText in try/catch, keeping the success state, toast, and reset timer only after a successful write. In the catch path, notify the user that copying failed and prevent the rejected promise from propagating.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@console/package.json`:
- Line 82: Remove the duplicate qrcode.react entry from the package
dependencies, keeping only one declaration and preserving its existing version
constraint so Biome’s duplicate-key validation passes.
In `@console/src/pages/integrations/components/telegram-connect.tsx`:
- Around line 412-442: Update the empty-state condition in the Telegram
connections component so it also requires connectsQuery.isError to be false,
preventing “No connected devices yet” from rendering after a failed query while
preserving the existing loading and activeConnects checks.
- Around line 152-155: Update the deepLink construction to use Telegram’s start
query parameter with the encoded pairingToken, while preserving the existing
pairingToken and effectiveBotUsername guard and URL structure.
In `@core-api/src/modules/integrations/entities/telegram-connect.entity.ts`:
- Line 4: Update the TypeORM import in the Telegram connect entity to import
Relation as a type-only symbol, while keeping the runtime imports Column,
Entity, Index, JoinColumn, and ManyToOne unchanged.
In `@core-api/src/modules/integrations/telegram-connect.service.ts`:
- Around line 171-178: Update the failure messages sent through
sendTelegramMessage in the invalid-token and expired-token branches to use
Telegram-compatible HTML markup instead of Markdown asterisks, preserving the
existing message text and parse_mode behavior.
- Around line 280-292: Update the disconnect flow in the Telegram integration
controller and service to accept and propagate userId. In disconnect, include
userId alongside workspace and integration identifiers in the connection lookup
before deletion, while preserving the existing not-found behavior.
- Around line 124-126: All Telegram API requests need per-request deadlines
instead of relying only on shutdown cancellation. Update fetchBotUsername and
sendTelegramMessage in
core-api/src/modules/integrations/telegram-connect.service.ts (lines 124-126 and
381-390), the relevant request in integrations.service.ts (lines 51-59), and
getUpdates in telegram-polling.service.ts (lines 114-117) to use timeout-based
AbortSignals, while preserving the polling service’s existing app-shutdown
cancellation by combining both abort conditions.
In `@core-api/src/modules/integrations/telegram-polling.service.ts`:
- Around line 9-11: Persist the Telegram update offset durably rather than
keeping it only in worker memory, and restore it when acquiring a lease so
polling resumes after restarts or TTL expiry without replaying updates. Extend
LOCK_TTL_MS beyond the 30-second POLL_TIMEOUT with sufficient processing
headroom, while preserving the existing polling and lease flow.
In `@core-api/src/modules/integrations/telegram-webhook.service.ts`:
- Around line 69-75: Update the success log in the Telegram connection flow to
remove all pairing-token content, including the token prefix from
token.substring. Use the available connection or integration ID for correlation
instead, while preserving the existing success message context and failure
logging in the surrounding method.
- Around line 45-67: Bind Telegram updates and pairing-token confirmation to the
receiving integration. In
core-api/src/modules/integrations/telegram-webhook.service.ts:45-67, accept
integrationId in processUpdate and pass it to confirmConnection; in
core-api/src/modules/integrations/integrations.controller.ts:213-220, forward
the route integrationId; in
core-api/src/modules/integrations/telegram-polling.service.ts:136-140, forward
integration.id; and in
core-api/src/modules/integrations/telegram-connect.service.ts:153-155, include
integrationId in the pending-token lookup.
---
Outside diff comments:
In `@core-api/src/modules/integrations/connectors/telegram.connector.ts`:
- Around line 131-135: Update the Telegram API request in the connector’s fetch
flow to use the project-standard HTTP timeout via an abort signal, ensuring
every request is bounded. Propagate the timeout as a failure through the
existing error-handling path rather than allowing the notification worker to
remain blocked indefinitely.
- Around line 129-159: Update the Telegram send flow around the response error
handling to remove chatId and raw errorBody from logs. In the logger.error call
within the fetch response check, log the integration ID, HTTP status, and a
sanitized error message instead, while preserving the existing thrown error
behavior unless required to sanitize its logging only.
- Around line 121-160: Update the chatId fan-out loop to continue sending to
every destination when a fetch or Telegram response fails instead of throwing
immediately. Capture each chat-specific failure, complete all attempts, then
aggregate and report the failures after the loop while preserving successful
sends and existing error details.
---
Nitpick comments:
In `@console/src/components/common/copyable-value.tsx`:
- Around line 20-26: Update handleCopy to wrap navigator.clipboard.writeText in
try/catch, keeping the success state, toast, and reset timer only after a
successful write. In the catch path, notify the user that copying failed and
prevent the rejected promise from propagating.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ccbaced1-e057-4373-b32f-e4045b5f3307
⛔ Files ignored due to path filters (4)
console/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlconsole/src/services/apis/gen/queries.tsis excluded by!**/gen/**package-lock.jsonis excluded by!**/package-lock.jsonpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (22)
console/package.jsonconsole/src/components/common/copyable-value.tsxconsole/src/pages/integrations/components/integration-detail-sheet.tsxconsole/src/pages/integrations/components/telegram-connect.tsxconsole/src/pages/settings/components/api-keys-settings.tsxcore-api/src/common/enums/enum.tscore-api/src/database/migrations/1784101236391-AddTelegramConnects.tscore-api/src/modules/auth/entities/user.entity.tscore-api/src/modules/integrations/connectors/telegram.connector.tscore-api/src/modules/integrations/dto/create-telegram-pairing.dto.tscore-api/src/modules/integrations/dto/telegram-connect.dto.tscore-api/src/modules/integrations/entities/integration.entity.tscore-api/src/modules/integrations/entities/telegram-connect.entity.tscore-api/src/modules/integrations/integrations.controller.tscore-api/src/modules/integrations/integrations.module.tscore-api/src/modules/integrations/integrations.service.tscore-api/src/modules/integrations/schemas/telegram.schema.tscore-api/src/modules/integrations/telegram-connect.service.tscore-api/src/modules/integrations/telegram-polling.service.tscore-api/src/modules/integrations/telegram-webhook.service.tscore-api/src/modules/notifications/processors/notifications.processor.tscore-api/src/services/redis/distributed-lock.service.ts
💤 Files with no reviewable changes (1)
- core-api/src/services/redis/distributed-lock.service.ts
| const deepLink = | ||
| pairingToken && effectiveBotUsername | ||
| ? `https://t.me/${effectiveBotUsername}?text=${encodeURIComponent('/start ' + pairingToken)}` | ||
| : null; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file='console/src/pages/integrations/components/telegram-connect.tsx'
echo '--- file outline ---'
ast-grep outline "$file" --view expanded || true
echo
echo '--- relevant lines ---'
sed -n '130,175p' "$file"Repository: oasm-platform/open-asm
Length of output: 2885
🌐 Web query:
Telegram bot deep link parameter start t.me bot features text parameter
💡 Result:
Telegram deep linking is a feature that allows you to pass additional parameters to a bot when a user initiates a conversation [1][2]. By using a specifically formatted URL, you can trigger the bot with the /start command and include a payload that the bot can interpret to perform custom actions [1][3][4]. The standard format for a deep link is: https://t.me/your_bot_username?start=payload When a user clicks this link, their Telegram client opens the bot's chat and displays a Start button [4]. Once the user clicks Start, the bot receives the /start command, and the provided payload is passed as an argument to the command handler [3][4]. Key features and considerations: 1. Payload Content: The payload is typically a string. While basic alphanumeric characters (A-Z, a-z, 0-9), underscores (_), and hyphens (-) are generally safe, you can use base64url encoding to support special characters or more complex data structures [2][5][6]. 2. Use Cases: Common applications include passing authentication tokens to link a user's Telegram account with an external service, triggering specific onboarding flows, or directing users to specific content within the bot [2][6]. 3. Implementation: Most major Telegram bot frameworks (such as aiogram or python-telegram-bot) provide utility functions to simplify the creation of these links [2][5][6]. These utilities often handle the necessary formatting and, if requested, the base64url encoding of the payload [2][6]. 4. Developer Handling: On the backend, you define a handler for the /start command. Your code should extract the arguments provided with the command and parse the payload to determine the appropriate response or action [2][3][7]. For group or channel links, Telegram also supports similar functionality (often using startgroup) to initiate a bot's inclusion in a chat with a specific parameter [8][2][6].
Citations:
- 1: https://core.telegram.org/bots/features
- 2: https://docs.aiogram.dev/en/v3.19.0/utils/deep_linking.html
- 3: https://stackoverflow.com/questions/63529906/link-to-a-telegram-bot-with-pre-written-command
- 4: https://stackoverflow.com/questions/62077693/generate-an-url-to-a-telegram-bot-command
- 5: https://docs.python-telegram-bot.org/en/v13.8.1/telegram.utils.helpers.html
- 6: https://docs.aiogram.dev/en/v3.27.0/utils/deep_linking.html
- 7: https://docs.python-telegram-bot.org/en/v22.4/examples.deeplinking.html
- 8: https://core.telegram.org/api/links
Use the Telegram start deep link parameter. ?text= won’t pass the pairing token into the bot’s /start flow; use ?start=${encodeURIComponent(pairingToken)} instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@console/src/pages/integrations/components/telegram-connect.tsx` around lines
152 - 155, Update the deepLink construction to use Telegram’s start query
parameter with the encoded pairingToken, while preserving the existing
pairingToken and effectiveBotUsername guard and URL structure.
| private async fetchBotUsername(botToken: string): Promise<string> { | ||
| const url = `${TELEGRAM_API_BASE}/bot${botToken}/getMe`; | ||
| const response = await fetch(url); |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- telegram-connect.service.ts relevant sections ---'
sed -n '110,150p' core-api/src/modules/integrations/telegram-connect.service.ts
echo
sed -n '370,405p' core-api/src/modules/integrations/telegram-connect.service.ts
echo '--- integrations.service.ts relevant section ---'
sed -n '1,90p' core-api/src/modules/integrations/integrations.service.ts
echo '--- telegram-polling.service.ts relevant section ---'
sed -n '90,160p' core-api/src/modules/integrations/telegram-polling.service.ts
echo '--- search for AbortController / timeout / fetch wrappers in integrations module ---'
rg -n "AbortController|setTimeout\\(|timeout|signal:|fetch\\(" core-api/src/modules/integrationsRepository: oasm-platform/open-asm
Length of output: 9251
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo 'ping'Repository: oasm-platform/open-asm
Length of output: 165
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
paths = [
"core-api/src/modules/integrations/telegram-connect.service.ts",
"core-api/src/modules/integrations/integrations.service.ts",
"core-api/src/modules/integrations/telegram-polling.service.ts",
]
for p in paths:
print(f"\n=== {p} ===")
text = Path(p).read_text()
for i, line in enumerate(text.splitlines(), 1):
if "fetch(" in line or "AbortController" in line or "AbortSignal" in line or "signal" in line or "timeout" in line:
start = max(1, i-3)
end = min(len(text.splitlines()), i+5)
print(f"-- around line {i} --")
for j in range(start, end+1):
print(f"{j:4}: {text.splitlines()[j-1]}")
PYRepository: oasm-platform/open-asm
Length of output: 4885
Add request deadlines to Telegram API calls
These fetch calls can still hang indefinitely: fetchBotUsername, sendTelegramMessage, and autoConfigureTelegramWebhook have no timeout, and getUpdates only has the app-shutdown AbortController, not a per-request deadline. A stalled Telegram endpoint can tie up request handlers and the polling loop.
core-api/src/modules/integrations/telegram-connect.service.ts#L124-L126core-api/src/modules/integrations/telegram-connect.service.ts#L381-L390core-api/src/modules/integrations/integrations.service.ts#L51-L59core-api/src/modules/integrations/telegram-polling.service.ts#L114-L117
📍 Affects 3 files
core-api/src/modules/integrations/telegram-connect.service.ts#L124-L126(this comment)core-api/src/modules/integrations/telegram-connect.service.ts#L381-L390core-api/src/modules/integrations/integrations.service.ts#L51-L59core-api/src/modules/integrations/telegram-polling.service.ts#L114-L117
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-api/src/modules/integrations/telegram-connect.service.ts` around lines
124 - 126, All Telegram API requests need per-request deadlines instead of
relying only on shutdown cancellation. Update fetchBotUsername and
sendTelegramMessage in
core-api/src/modules/integrations/telegram-connect.service.ts (lines 124-126 and
381-390), the relevant request in integrations.service.ts (lines 51-59), and
getUpdates in telegram-polling.service.ts (lines 114-117) to use timeout-based
AbortSignals, while preserving the polling service’s existing app-shutdown
cancellation by combining both abort conditions.
| const POLL_TIMEOUT = 30; // seconds | ||
| const POLL_INTERVAL_MS = 3000; // 3 seconds between poll cycles | ||
| const LOCK_TTL_MS = 35_000; // 35 seconds — must be > POLL_TIMEOUT * 1000 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the target file and nearby symbols first.
ast-grep outline core-api/src/modules/integrations/telegram-polling.service.ts --view expanded || true
# Show line numbers around the referenced ranges.
sed -n '1,240p' core-api/src/modules/integrations/telegram-polling.service.ts | cat -n
# Find related polling/offset/lock references in the module.
rg -n "offset|lock|poll|lease|redis|telegram" core-api/src/modules/integrations -SRepository: oasm-platform/open-asm
Length of output: 40697
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the Redis lock implementation to see whether the lease is renewed.
sed -n '1,260p' core-api/src/services/redis/distributed-lock.service.ts | cat -n
# Inspect usages of withLock to understand expected lock lifetime semantics.
rg -n "withLock\(" core-api/src -SRepository: oasm-platform/open-asm
Length of output: 6356
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check whether duplicate update delivery is idempotent or side-effectful.
sed -n '1,220p' core-api/src/modules/integrations/telegram-webhook.service.ts | cat -nRepository: oasm-platform/open-asm
Length of output: 2777
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect confirmConnection to see whether replayed /start updates are idempotent.
sed -n '140,280p' core-api/src/modules/integrations/telegram-connect.service.ts | cat -nRepository: oasm-platform/open-asm
Length of output: 5675
Persist the Telegram offset outside memory. A worker that wins the next lease after a restart or TTL expiry starts from 0, so already-processed getUpdates results can be replayed. The 35s lock also leaves little headroom over the 30s long poll, so longer update handling can overlap the next poll. Storing offsets durably and extending the lease would avoid that.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-api/src/modules/integrations/telegram-polling.service.ts` around lines 9
- 11, Persist the Telegram update offset durably rather than keeping it only in
worker memory, and restore it when acquiring a lease so polling resumes after
restarts or TTL expiry without replaying updates. Extend LOCK_TTL_MS beyond the
30-second POLL_TIMEOUT with sufficient processing headroom, while preserving the
existing polling and lease flow.
| async processUpdate(update: TelegramUpdate): Promise<void> { | ||
| const message = update.message; | ||
| if (!message?.text) return; | ||
|
|
||
| // Parse /start <token> or /start | ||
| const text = message.text.trim(); | ||
| if (!text.startsWith('/start')) return; | ||
|
|
||
| const token = text.split(/\s+/)[1]; | ||
| if (!token) { | ||
| this.logger.debug('Ignored /start without token'); | ||
| return; | ||
| } | ||
|
|
||
| const chatId = String(message.chat.id); | ||
|
|
||
| try { | ||
| await this.telegramConnectService.confirmConnection(token, { | ||
| chatId, | ||
| username: message.chat.username ?? message.from?.username, | ||
| firstName: message.chat.first_name ?? message.from?.first_name, | ||
| lastName: message.chat.last_name ?? message.from?.last_name, | ||
| }); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Bind every update and pairing token to the bot integration that received it. Currently any bot's webhook or poller can confirm a token belonging to another integration.
core-api/src/modules/integrations/telegram-webhook.service.ts#L45-L67: accept anintegrationIdand pass it into confirmation.core-api/src/modules/integrations/integrations.controller.ts#L213-L220: forward the route'sintegrationId.core-api/src/modules/integrations/telegram-polling.service.ts#L136-L140: forwardintegration.idfrom the active poller.core-api/src/modules/integrations/telegram-connect.service.ts#L153-L155: includeintegrationIdin the pending-token lookup.
📍 Affects 4 files
core-api/src/modules/integrations/telegram-webhook.service.ts#L45-L67(this comment)core-api/src/modules/integrations/integrations.controller.ts#L213-L220core-api/src/modules/integrations/telegram-polling.service.ts#L136-L140core-api/src/modules/integrations/telegram-connect.service.ts#L153-L155
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-api/src/modules/integrations/telegram-webhook.service.ts` around lines
45 - 67, Bind Telegram updates and pairing-token confirmation to the receiving
integration. In
core-api/src/modules/integrations/telegram-webhook.service.ts:45-67, accept
integrationId in processUpdate and pass it to confirmConnection; in
core-api/src/modules/integrations/integrations.controller.ts:213-220, forward
the route integrationId; in
core-api/src/modules/integrations/telegram-polling.service.ts:136-140, forward
integration.id; and in
core-api/src/modules/integrations/telegram-connect.service.ts:153-155, include
integrationId in the pending-token lookup.
| this.logger.log( | ||
| `Telegram chat ${chatId} connected via token (first ${token.substring(0, 8)}...)`, | ||
| ); | ||
| } catch (error: unknown) { | ||
| const err = error as Error; | ||
| this.logger.warn( | ||
| `Failed to connect Telegram chat ${chatId}: ${err.message}`, |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Do not log any portion of the pairing token.
The token is an authentication capability. Remove the prefix from the success log and use the connection or integration ID for correlation instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-api/src/modules/integrations/telegram-webhook.service.ts` around lines
69 - 75, Update the success log in the Telegram connection flow to remove all
pairing-token content, including the token prefix from token.substring. Use the
available connection or integration ID for correlation instead, while preserving
the existing success message context and failure logging in the surrounding
method.
Source: Linters/SAST tools
- console/package.json: remove duplicate qrcode.react entry - console/copyable-value.tsx: wrap clipboard write in try/catch - console/telegram-connect.tsx: add !isError to empty state, fix deepLink to use ?start= - core-api/telegram-connect.entity.ts: type-only import for Relation - core-api/telegram-connect.service.ts: fix HTML markup (*bold* -> <b>bold</b>), add userId scope to disconnect(), add AbortSignal.timeout to fetch calls - core-api/telegram-webhook.service.ts: stop logging token prefix - core-api/telegram.connector.ts: add AbortSignal.timeout, continue on per-chat failure instead of throwing on first error - core-api/integrations.controller.ts: forward userId to disconnect
1 participant
Summary by CodeRabbit
New Features
Bug Fixes