External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Telegram V3 — Mini App cockpit (initData auth + /tg surface) (#554)

Browse Source 
* feat(telegram): Mini App auth — initData validation mints the cloud-auth session cookie

* feat(panel): /tg Mini App cockpit — approvals, inbox, read-only board, A2A chat

* fix(telegram,panel): unconditional webapp-auth rate limit, future-dated initData rejection, anchored /tg matcher

* docs(map,rag): Telegram Mini App auth route, initData validator, (tg) surface

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This commit is contained in:
Renzo F
2026-07-18 02:47:59 +02:00
committed by GitHub
co-authored by Renn F
parent 3b88c706dd
commit c40a7a39c3
33 changed files with 1725 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+8
View File
@@ -538,6 +538,14 @@ services:
# above); the whole bridge stays inert until that flag AND credentials
# are both set, so arming this alone does nothing yet.
ROBOCO_TELEGRAM_INBOUND_ENABLED: ${ROBOCO_TELEGRAM_INBOUND_ENABLED:-true}
# Telegram Mini App sign-in: validates Telegram's signed WebApp initData
# and mints the same cloud-auth session cookie /api/auth/login issues,
# so the CEO's phone becomes an authenticated panel client. Requires
# ROBOCO_CLOUD_AUTH_ENABLED=true (startup fails loud otherwise) AND a
# public HTTPS origin (the cookie is secure-only, and Telegram itself
# only opens Mini Apps over https). Default OFF; not armed here — the
# operator flips it on once TLS + cloud-auth creds are both live.
ROBOCO_TELEGRAM_MINIAPP_ENABLED: ${ROBOCO_TELEGRAM_MINIAPP_ENABLED:-false}
ROBOCO_OBSIDIAN_VAULT_ENABLED: ${ROBOCO_OBSIDIAN_VAULT_ENABLED:-true}
ROBOCO_VAULT_PATH: ${ROBOCO_VAULT_PATH:-/app/vault}
ROBOCO_VAULT_INTAKE_ENABLED: ${ROBOCO_VAULT_INTAKE_ENABLED:-true}