feat!: Telegram bot MVP + Telegram auth, Redis, MongoDB audit, structured logging#92
Merged
Conversation
…essions - Replace in-memory tokenStore Map with Redis (30-day TTL per session) - Switch all API rate limiters to rate-limit-redis RedisStore - Add Redis service to compose.yaml and compose.dev.yaml - Mock ioredis in jest (SCRIPT LOAD + EVALSHA simulation, no real connection) - Add REDIS_URL to env examples; set via compose environment for Docker Co-authored-by: Bohdan Matula <matula.bohdan@gmail.com>
- Add Pino logging (replace all console.*) in API and bot - Add request correlation ID via AsyncLocalStorage (requestId on every log) - Add X-Request-Id response header - Move redis.ts → lib/redis.ts in API and bot (infra singleton convention) - Fix startup: connect Redis before dynamic import of app (no rate-limit init warnings) - Fix errorHandler: 4xx → WARN, 5xx → ERROR - Add Redis graceful shutdown (redis.quit()) - Persist audit events to MongoDB (auth events)
Let users authenticate and link their account via the Telegram Login
Widget so the bot recognises the same person by telegram_id, closing
the gap between web and bot identities.
- web: add TelegramLoginWidget + AuthProviderIcons, wire into popups
- api: add /auth/telegram/exchange (bot|widget) and /auth/link/telegram
- bot: rename BOT_TOKEN to TELEGRAM_BOT_TOKEN, send {source:bot} payload
- config: fail fast on missing TELEGRAM_BOT_TOKEN/GOOGLE_CLIENT_ID and
invalid PORT/SMTP_PORT
- docs: sync auth.yml swagger and contributor env docs with the code
Hardcoded UI strings remain English; i18n is tracked as a follow-up.
BREAKING CHANGE: the API now requires TELEGRAM_BOT_TOKEN and
GOOGLE_CLIENT_ID at startup and exits if either is missing. Existing
deployments must set both before upgrading.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
BODMAT
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Brings up the Telegram bot as a second FinTrack client and the infra to support it as a real account surface.
Bot (grammY + @grammyjs/conversations)
+1500 salary/-50 coffee), optional location share./summary,/history,/delete,/edit(set/remove location),/help,/start.conversation.externalwrapper returning replay-safe serializable results;telegramIdread fromctx.frominside conversations (replay-safe).Auth (breaking)
/auth/telegramexchange on API, bot token store.Infra / observability
Closes #91
Type of change
How Has This Been Tested?
Unit tests (Jest/Vitest)
Integration tests
Manual testing (screenshots/screencasts encouraged)
API: auth integration tests, seed idempotency, authSecurity unit tests, ioredis mock.
Bot:
history.formatunit tests (Jest).Manual: bot flows (add/summary/history/edit/delete/pagination) against local API; Telegram Login Widget login on web; Redis sessions survive bot restart; Mongo audit entries written on auth events.
Checklist: