Validate Telegram bot username and prevent broken deep links - #31
Open
tiero wants to merge 2 commits into
Open
Conversation
The auth challenge endpoint built the Telegram deep link as https://t.me/${TELEGRAM_BOT_USERNAME}?start=... while only checking that TELEGRAM_BOT_TOKEN was set. deploy.sh silently skips empty secrets, so a deploy with the bot token but no username left the binding undefined and the API handed out https://t.me/undefined?start=... — a link to a Telegram user that doesn't exist. - Add buildTelegramDeepLink/normalizeBotUsername: trim whitespace, strip a leading @, validate the username shape; return null (with a logged warning) instead of interpolating a broken value - Mark TELEGRAM_BOT_USERNAME optional in Env to match runtime reality - deploy.sh: refuse to deploy a bot token with a missing/invalid username, and normalize a pasted @botName - Runbook: troubleshooting entry for the t.me/undefined symptom - Unit tests for the deep link builder Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ViuX4CKbdKKhoeyJeYoG9e
tiero
marked this pull request as ready for review
July 24, 2026 23:43
…routing-a748nr # Conflicts: # api/src/index.ts
Deploying claw-cash-landing-page with
|
| Latest commit: |
2c2dd2b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://34eab34c.claw-cash-landing-page.pages.dev |
| Branch Preview URL: | https://claude-telegram-link-routing.claw-cash-landing-page.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add validation for the
TELEGRAM_BOT_USERNAMEconfiguration to prevent deploying broken Telegram deep links (e.g.,https://t.me/undefined?start=...). The changes include username normalization logic, deployment-time validation, and runtime safeguards.Key Changes
New
telegram.tsmodule with two functions:normalizeBotUsername(): Validates and normalizes bot usernames (strips@, trims whitespace, enforces Telegram username rules: 5-32 chars, letters/digits/underscore, must start with letter)buildTelegramDeepLink(): Safely constructs auth deep links, returningnullif the username is invalid instead of emitting a broken linkDeployment validation in
scripts/deploy.sh:check_telegram_config()function validates that ifTELEGRAM_BOT_TOKENis set,TELEGRAM_BOT_USERNAMEmust also be set and validdeploy_api()anddeploy_worker_api()to fail fast before deploymentRuntime safety in
api/src/index.ts:buildTelegramDeepLink()instead of string interpolationdeep_link(returnsnull) if the username is invalid, rather than emitting a broken linkType safety in
api/src/bindings.ts:TELEGRAM_BOT_USERNAMEfrom required to optional (?) to reflect thatdeploy.shmay skip empty secretsDocumentation in
docs/runbook.md:Implementation Details
The username validation regex (
^[A-Za-z][A-Za-z0-9_]{4,31}$) enforces Telegram's official username rules and is duplicated in both the TypeScript code and the bash deployment script to catch errors at both layers. ThenormalizeBotUsername()function is defensive—it accepts common paste errors (leading@, surrounding whitespace) but rejects invalid formats early, preventing the API from ever emitting a link to a nonexistent user.https://claude.ai/code/session_01ViuX4CKbdKKhoeyJeYoG9e