telenode-js - npm Package Compare versions

Comparing version 1.1.0 to 1.1.1

package.json

 {
 	"name": "telenode-js",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "Lightweight Telegram API framework for Node.js",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

 # Telenode
 
-
 Lightweight Telegram API framework for Node.js
@@ -12,2 +11,14 @@
 
+## Features
+
+✅ Explicit messages handlers
+<br>
+✅ Fallback messages handler (empty string)
+<br>
+✅ Regex matching on text messages
+<br>
+✅ Buttons support (inline keyboard, reply keyboard and remove reply keyboard)
+<br>
+✅ Secret token support
+
 ## Getting started
@@ -25,3 +36,4 @@
 <br>
-The webhook url will be stored in a `.env` file in the root of your project as `WEBHOOK=https://your_amazing_webhook.com`.
+The webhook url will be stored in a `.env` file in the root of your project
+as `WEBHOOK=https://your_amazing_webhook.com`.
 <br>
@@ -52,6 +64,24 @@ Then you can execute the following command:
 
-In this example the bot will listen only to 'hello' text messages and will respond to the user 'hello back'. Any other message will be ignored.
+In this example the bot will listen only to 'hello' text messages and will respond to the user 'hello back'. Any other
+message will be ignored.
 
 Additional examples can be found in the [examples folder](https://github.com/NivEz/telenode/tree/main/examples).
 
+### Webhook security with secret token
+
+You can secure your webhook with a secret token via the `setWebhook` method. You can do that by creating
+a `SECRET_TOKEN` variable in the `.env` file of your project and run the `npx set-webhook` command. The command will
+tell Telegram servers to send the secret token in each request to your webhook as `x-telegram-bot-api-secret-token`
+header.
+
+In order for the bot to use the secret token you need to pass to the `Telenode` class you instanciate the `secretToken`
+parameter.
+
+You will have to pass a `secretToken` parameter to the `telenodeHandler` method as well.
+
+You can pass a third parameter called `unauthorizedCallback` - a callback that will fire in case the request wasn't
+authorized.
+
+You can find the example in the [secretToken.js example](https://github.com/NivEz/telenode/tree/main/examples/secretToken.js) and the implementation in [src/server.js](https://github.com/NivEz/telenode/tree/main/src/server.js) as well.
+
 ---
@@ -63,9 +93,14 @@
 
-For local development you need to set a webhook as well with the `set-webhook` command. How you execute the command is slightly different from using the installed package like explained above. Instead of `npx` just use `npm run`:
+For local development you need to set a webhook as well with the `set-webhook` command. How you execute the command is
+slightly different from using the installed package like explained above. Instead of `npx` just use `npm run`:
+
 ```
 npm run set-webhook
 ```
+
 The webhook url should be presented in the `.env` file or be exported as an environment variable.
 
-In order to develop a new feature or to run an existing one you should use the `dev` command from the `package.json` with the `--file` flag like so:
+In order to develop a new feature or to run an existing one you should use the `dev` command from the `package.json`
+with the `--file` flag like so:
+
 ```
@@ -75,13 +110,2 @@ npm run dev --file=<example>
 
-
-## Features
-
-✅ Explicit messages handlers
-<br>
-✅ Fallback messages handler (empty string)
-<br>
-✅ Regex matching on text messages
-<br>
-✅ Buttons support (inline keyboard, reply keyboard and remove reply keyboard)
-
 ## TODO's
@@ -94,2 +118,3 @@
 - [ ] Support edit reply markup
+- [ ] Add extra security with query params token
 - [ ] Add tests

scripts/setWebhook.js

@@ -8,2 +8,3 @@ #!/usr/bin/env node
 const webhook = process.env.WEBHOOK;
+const secretToken = process.env.SECRET_TOKEN;
 
@@ -14,7 +15,12 @@ const url = `https://api.telegram.org/bot${apiToken}/setWebhook`;
 	try {
-		const res = await axios.post(url, {}, {
-			params: {
-				url: webhook,
+		const res = await axios.post(
+			url,
+			{},
+			{
+				params: {
+					url: webhook,
+					secret_token: secretToken,
+				},
 			},
-		});
+		);
 		if (res.status === 200) {
@@ -29,2 +35,1 @@ console.log(res.data.description);
 })();
-

src/bot.js

@@ -6,4 +6,5 @@ const { runServer } = require('./server');
 	#baseUrl;
+	#secretToken;
 
-	constructor({ apiToken }) {
+	constructor({ apiToken, secretToken }) {
 		this.textHandlers = {};
@@ -14,9 +15,17 @@ this.arrRegexHandlers = [];
 		this.#baseUrl = 'https://api.telegram.org/bot' + apiToken;
+		this.#secretToken = secretToken;
 	}
 
-	createServer() {
+	createServer(unauthorizedHandler) {
+		this.unauthorizedHandler = unauthorizedHandler;
 		runServer(this);
 	}
 
-	telenodeHandler(reqBody) {
+	telenodeHandler(reqBody, headersSecretToken, unauthorizedCallback) {
+		if (this.#secretToken && this.#secretToken !== headersSecretToken) {
+			if (unauthorizedCallback) {
+				unauthorizedCallback();
+			}
+			return;
+		}
 		// TODO - get message type and use switch case for the types
@@ -23,0 +32,0 @@ if (!reqBody) {

src/server.js

@@ -9,3 +9,4 @@ const express = require('express');
 	server.post('/', (req, res) => {
-		bot.telenodeHandler(req.body);
+		const secretToken = req.headers['x-telegram-bot-api-secret-token'];
+		bot.telenodeHandler(req.body, secretToken, bot.unauthorizedHandler);
 		res.end();
@@ -12,0 +13,0 @@ });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

9890

increased by19.04%

Lines of code

180

increased by9.76%

Number of lines in readme file

115

increased by27.78%

Worsened metrics

Number of low supply chain risk alerts

3

increased by50%

No dependency changes