feat(integrations): implement telegram bot command framework - #549
Merged
Conversation
- Add TelegramBotService for centralized bot API interactions - Register /pair, /unpair, and /help commands - Map /start to /pair for deep link support - Improve user instructions for connection process
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughTelegram bot API access is centralized in a cached service. Connection flows use that service, while webhook and polling updates now provide bot context to dispatch ChangesTelegram integration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Telegram
participant integrationsController
participant telegramWebhookService
participant TelegramBotService
participant TelegramConnectService
Telegram->>integrationsController: Send webhook update
integrationsController->>telegramWebhookService: processUpdate with bot context
telegramWebhookService->>TelegramBotService: Synchronize commands
telegramWebhookService->>TelegramConnectService: Confirm or remove connection
TelegramConnectService->>TelegramBotService: Send connection response
TelegramBotService->>Telegram: Deliver message
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
core-api/src/modules/integrations/integrations.controller.ts (1)
214-232: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAuthenticate Telegram webhook requests.
This public route accepts arbitrary updates, so a forged POST can spoof/unpairand disconnect a chat from the integration. Pass a webhook secret tosetWebhookand reject requests whoseX-Telegram-Bot-Api-Secret-Tokenheader doesn’t match before callingprocessUpdate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core-api/src/modules/integrations/integrations.controller.ts` around lines 214 - 232, Authenticate requests in telegramWebhook before invoking TelegramWebhookService.processUpdate: load the configured webhook secret, compare it against the X-Telegram-Bot-Api-Secret-Token header, and reject mismatches or missing headers. Update the webhook registration path to pass the same secret to setWebhook, while preserving the existing botToken and integrationId handling.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@core-api/src/modules/integrations/integrations.module.ts`:
- Line 11: Replace the relative TelegramBotService imports with the configured
`@/` alias in integrations.module.ts (11-11), telegram-connect.service.ts (18-18),
and telegram-webhook.service.ts (3-3), preserving the existing imported symbol
and usage.
In `@core-api/src/modules/integrations/telegram-webhook.service.ts`:
- Around line 131-149: Update handlePair to HTML-escape ctx.firstName before
interpolating it into the instruction message, reusing the existing
HTML-escaping helper and preserving the “there” fallback so names containing
special characters cannot break Telegram’s HTML message.
---
Outside diff comments:
In `@core-api/src/modules/integrations/integrations.controller.ts`:
- Around line 214-232: Authenticate requests in telegramWebhook before invoking
TelegramWebhookService.processUpdate: load the configured webhook secret,
compare it against the X-Telegram-Bot-Api-Secret-Token header, and reject
mismatches or missing headers. Update the webhook registration path to pass the
same secret to setWebhook, while preserving the existing botToken and
integrationId handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f5c4f724-c9fe-4570-bf8a-9d341afa919b
📒 Files selected for processing (7)
core-api/package.jsoncore-api/src/modules/integrations/integrations.controller.tscore-api/src/modules/integrations/integrations.module.tscore-api/src/modules/integrations/telegram-bot.service.tscore-api/src/modules/integrations/telegram-connect.service.tscore-api/src/modules/integrations/telegram-polling.service.tscore-api/src/modules/integrations/telegram-webhook.service.ts
| import { TelegramConnectService } from './telegram-connect.service'; | ||
| import { TelegramWebhookService } from './telegram-webhook.service'; | ||
| import { TelegramPollingService } from './telegram-polling.service'; | ||
| import { TelegramBotService } from './telegram-bot.service'; |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Use @/ aliases for the new internal imports.
core-api/src/modules/integrations/integrations.module.ts#L11-L11: replace the relativeTelegramBotServiceimport.core-api/src/modules/integrations/telegram-connect.service.ts#L18-L18: replace the relativeTelegramBotServiceimport.core-api/src/modules/integrations/telegram-webhook.service.ts#L3-L3: replace the relativeTelegramBotServiceimport.
As per coding guidelines, “Use @/ alias for imports in core-api.”
📍 Affects 3 files
core-api/src/modules/integrations/integrations.module.ts#L11-L11(this comment)core-api/src/modules/integrations/telegram-connect.service.ts#L18-L18core-api/src/modules/integrations/telegram-webhook.service.ts#L3-L3
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-api/src/modules/integrations/integrations.module.ts` at line 11, Replace
the relative TelegramBotService imports with the configured `@/` alias in
integrations.module.ts (11-11), telegram-connect.service.ts (18-18), and
telegram-webhook.service.ts (3-3), preserving the existing imported symbol and
usage.
Source: Coding guidelines
Comment on lines
+131
to
+149
| private async handlePair(args: string, ctx: CommandContext): Promise<void> { | ||
| if (!args) { | ||
| const firstName = ctx.firstName ?? 'there'; | ||
| const instruction = | ||
| `👋 Hi ${firstName}!\n\n` + | ||
| `To connect your Telegram chat to OpenASM, you need to send a pairing token.\n\n` + | ||
| `📋 <b>How to connect:</b>\n` + | ||
| `1. Open OpenASM Console → Integrations → Telegram\n` + | ||
| `2. Click <b>"Pair"</b> to generate a pairing token\n` + | ||
| `3. Send the token here:\n` + | ||
| ` <code>/pair <your-token></code>\n\n` + | ||
| `❓ If you need help, type /help`; | ||
|
|
||
| if (ctx.botToken) { | ||
| await this.telegramBotService.sendMessage( | ||
| ctx.botToken, | ||
| ctx.chatId, | ||
| instruction, | ||
| ); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the service and any HTML-escaping helpers/usages nearby.
git ls-files 'core-api/src/modules/integrations/telegram-webhook.service.ts' \
'core-api/src/**/*' | sed -n '1,200p'
printf '\n--- outline ---\n'
ast-grep outline core-api/src/modules/integrations/telegram-webhook.service.ts --view expanded
printf '\n--- search for escaping helpers/usages ---\n'
rg -n "escape|html|firstName|sendMessage\\(" core-api/src/modules/integrations -g '!**/dist/**' -g '!**/build/**'
printf '\n--- relevant slice ---\n'
sed -n '120,170p' core-api/src/modules/integrations/telegram-webhook.service.tsRepository: oasm-platform/open-asm
Length of output: 17617
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,120p' core-api/src/modules/integrations/telegram-bot.service.ts
printf '\n---\n'
sed -n '360,420p' core-api/src/modules/integrations/telegram-connect.service.tsRepository: oasm-platform/open-asm
Length of output: 3601
Escape ctx.firstName before building the HTML message. In core-api/src/modules/integrations/telegram-webhook.service.ts:133, TelegramBotService.sendMessage() sends with parse_mode: 'HTML', so names containing <, > or & can break the greeting and stop the /pair instructions from being delivered. Reuse the existing HTML-escaping helper here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-api/src/modules/integrations/telegram-webhook.service.ts` around lines
131 - 149, Update handlePair to HTML-escape ctx.firstName before interpolating
it into the instruction message, reusing the existing HTML-escaping helper and
preserving the “there” fallback so names containing special characters cannot
break Telegram’s HTML message.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
/start <token>compatibility for existing pairing flows.