15672803049

Committed 16 Jun 2025 05:42AM UTC coverage: 79.352% (-2.1%) from 81.499%

Build # 15672803049

Build Type

Pull #294

github

Committed by

umputun

Commit Message

Add CLI override functionality for auth credentials in database mode

- Created applyCLIOverrides function to handle selective CLI parameter overrides
- Currently handles --server.auth and --server.auth-hash overrides
- Only applies overrides when values differ from defaults
- Auth hash takes precedence over password when both are provided
- Added comprehensive unit tests covering all override scenarios
- Function is extensible for future CLI override needs (documented in comments)

This fixes the issue where users couldn't change auth credentials when using
database configuration mode (--confdb), as the save-config command would
overwrite all settings rather than just the auth credentials.

Pull Request Pull Request #294: Implement database configuration support

Run Details

891 of 1298 new or added lines in 9 files covered. (68.64%)

174 existing lines in 4 files now uncovered.

5734 of 7226 relevant lines covered (79.35%)

57.45 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

52.7

/app/main.go

package main

import (
        "context"
        "encoding/json"
        "errors"
        "fmt"
        "io"
        "log"
        "math"
        "net/http"
        "os"
        "os/exec"
        "os/signal"
        "path/filepath"
        "sort"
        "strconv"
        "strings"
        "syscall"
        "time"

        tbapi "github.com/OvyFlash/telegram-bot-api"
        "github.com/fatih/color"
        "github.com/go-pkgz/fileutils"
        "github.com/go-pkgz/lgr"
        "github.com/go-pkgz/rest"
        "github.com/jessevdk/go-flags"
        "github.com/sashabaranov/go-openai"
        "gopkg.in/natefinch/lumberjack.v2"

        "github.com/umputun/tg-spam/app/bot"
        "github.com/umputun/tg-spam/app/config"
        "github.com/umputun/tg-spam/app/events"
        "github.com/umputun/tg-spam/app/storage"
        "github.com/umputun/tg-spam/app/storage/engine"
        "github.com/umputun/tg-spam/app/webapi"
        "github.com/umputun/tg-spam/lib/tgspam"
        "github.com/umputun/tg-spam/lib/tgspam/plugin"
)

type options struct {
        InstanceID         string `long:"instance-id" env:"INSTANCE_ID" default:"tg-spam" description:"instance id"`
        DataBaseURL        string `long:"db" env:"DB" default:"tg-spam.db" description:"database URL, if empty uses sqlite"`
        ConfigDB           bool   `long:"confdb" env:"CONFDB" description:"load configuration from database"`
        ConfigDBEncryptKey string `long:"confdb-encrypt-key" env:"CONFDB_ENCRYPT_KEY" description:"encryption key for sensitive config values in database"`

        Telegram struct {
                Token        string        `long:"token" env:"TOKEN" description:"telegram bot token"`
                Group        string        `long:"group" env:"GROUP" description:"group name/id"`
                Timeout      time.Duration `long:"timeout" env:"TIMEOUT" default:"30s" description:"http client timeout for telegram" `
                IdleDuration time.Duration `long:"idle" env:"IDLE" default:"30s" description:"idle duration"`
        } `group:"telegram" namespace:"telegram" env-namespace:"TELEGRAM"`

        AdminGroup              string `long:"admin.group" env:"ADMIN_GROUP" description:"admin group name, or channel id"`
        DisableAdminSpamForward bool   `long:"disable-admin-spam-forward" env:"DISABLE_ADMIN_SPAM_FORWARD" description:"disable handling messages forwarded to admin group as spam"`

        TestingIDs []int64 `long:"testing-id" env:"TESTING_ID" env-delim:"," description:"testing ids, allow bot to reply to them"`

        HistoryDuration time.Duration `long:"history-duration" env:"HISTORY_DURATION" default:"24h" description:"history duration"`
        HistoryMinSize  int           `long:"history-min-size" env:"HISTORY_MIN_SIZE" default:"1000" description:"history minimal size to keep"`
        StorageTimeout  time.Duration `long:"storage-timeout" env:"STORAGE_TIMEOUT" default:"0s" description:"storage timeout"`

        Logger struct {
                Enabled    bool   `long:"enabled" env:"ENABLED" description:"enable spam rotated logs"`
                FileName   string `long:"file" env:"FILE"  default:"tg-spam.log" description:"location of spam log"`
                MaxSize    string `long:"max-size" env:"MAX_SIZE" default:"100M" description:"maximum size before it gets rotated"`
                MaxBackups int    `long:"max-backups" env:"MAX_BACKUPS" default:"10" description:"maximum number of old log files to retain"`
        } `group:"logger" namespace:"logger" env-namespace:"LOGGER"`

        SuperUsers          events.SuperUsers `long:"super" env:"SUPER_USER" env-delim:"," description:"super-users"`
        NoSpamReply         bool              `long:"no-spam-reply" env:"NO_SPAM_REPLY" description:"do not reply to spam messages"`
        SuppressJoinMessage bool              `long:"suppress-join-message" env:"SUPPRESS_JOIN_MESSAGE" description:"delete join message if user is kicked out"`

        CAS struct {
                API       string        `long:"api" env:"API" default:"https://api.cas.chat" description:"CAS API"`
                Timeout   time.Duration `long:"timeout" env:"TIMEOUT" default:"5s" description:"CAS timeout"`
                UserAgent string        `long:"user-agent" env:"USER_AGENT" description:"User-Agent header for CAS API requests"`
        } `group:"cas" namespace:"cas" env-namespace:"CAS"`

        Meta struct {
                LinksLimit      int    `long:"links-limit" env:"LINKS_LIMIT" default:"-1" description:"max links in message, disabled by default"`
                MentionsLimit   int    `long:"mentions-limit" env:"MENTIONS_LIMIT" default:"-1" description:"max mentions in message, disabled by default"`
                ImageOnly       bool   `long:"image-only" env:"IMAGE_ONLY" description:"enable image only check"`
                LinksOnly       bool   `long:"links-only" env:"LINKS_ONLY" description:"enable links only check"`
                VideosOnly      bool   `long:"video-only" env:"VIDEO_ONLY" description:"enable video only check"`
                AudiosOnly      bool   `long:"audio-only" env:"AUDIO_ONLY" description:"enable audio only check"`
                Forward         bool   `long:"forward" env:"FORWARD" description:"enable forward check"`
                Keyboard        bool   `long:"keyboard" env:"KEYBOARD" description:"enable keyboard check"`
                UsernameSymbols string `long:"username-symbols" env:"USERNAME_SYMBOLS" description:"prohibited symbols in username, disabled by default"`
        } `group:"meta" namespace:"meta" env-namespace:"META"`

        OpenAI struct {
                Token             string   `long:"token" env:"TOKEN" description:"openai token, disabled if not set"`
                APIBase           string   `long:"apibase" env:"API_BASE" description:"custom openai API base, default is https://api.openai.com/v1"`
                Veto              bool     `long:"veto" env:"VETO" description:"veto mode, confirm detected spam"`
                Prompt            string   `long:"prompt" env:"PROMPT" default:"" description:"openai system prompt, if empty uses builtin default"`
                CustomPrompts     []string `long:"custom-prompt" env:"CUSTOM_PROMPTS" env-delim:"," description:"custom prompts for special cases"`
                ReasoningEffort   string   `long:"reasoning-effort" env:"REASONING_EFFORT" default:"" description:"reasoning effort level (low, medium, high)"`
                Model             string   `long:"model" env:"MODEL" default:"gpt-4o-mini" description:"openai model"`
                MaxTokensResponse int      `long:"max-tokens-response" env:"MAX_TOKENS_RESPONSE" default:"1024" description:"openai max tokens in response"`
                MaxTokensRequest  int      `long:"max-tokens-request" env:"MAX_TOKENS_REQUEST" default:"2048" description:"openai max tokens in request"`
                MaxSymbolsRequest int      `long:"max-symbols-request" env:"MAX_SYMBOLS_REQUEST" default:"16000" description:"openai max symbols in request, failback if tokenizer failed"`
                RetryCount        int      `long:"retry-count" env:"RETRY_COUNT" default:"1" description:"openai retry count"`
                HistorySize       int      `long:"history-size" env:"HISTORY_SIZE" default:"0" description:"openai history size"`
        } `group:"openai" namespace:"openai" env-namespace:"OPENAI"`

        LuaPlugins struct {
                Enabled        bool     `long:"enabled" env:"ENABLED" description:"enable Lua plugins"`
                PluginsDir     string   `long:"plugins-dir" env:"PLUGINS_DIR" description:"directory with Lua plugins"`
                EnabledPlugins []string `long:"enabled-plugins" env:"ENABLED_PLUGINS" env-delim:"," description:"list of enabled plugins (by name, without .lua extension)"`
                DynamicReload  bool     `long:"dynamic-reload" env:"DYNAMIC_RELOAD" description:"dynamically reload plugins when they change"`
        } `group:"lua-plugins" namespace:"lua-plugins" env-namespace:"LUA_PLUGINS"`

        AbnormalSpacing struct {
                Enabled                 bool    `long:"enabled" env:"ENABLED" description:"enable abnormal words check"`
                SpaceRatioThreshold     float64 `long:"ratio" env:"RATIO" default:"0.3" description:"the ratio of spaces to all characters in the message"`
                ShortWordRatioThreshold float64 `long:"short-ratio" env:"SHORT_RATIO" default:"0.7" description:"the ratio of short words to all words in the message"`
                ShortWordLen            int     `long:"short-word" env:"SHORT_WORD" default:"3" description:"the length of the word to be considered short"`
                MinWords                int     `long:"min-words" env:"MIN_WORDS" default:"5" description:"the minimum number of words in the message to check"`
        } `group:"space" namespace:"space" env-namespace:"SPACE"`

        Files struct {
                SamplesDataPath string        `long:"samples" env:"SAMPLES" default:"preset" description:"samples data path, deprecated"`
                DynamicDataPath string        `long:"dynamic" env:"DYNAMIC" default:"data" description:"dynamic data path"`
                WatchInterval   time.Duration `long:"watch-interval" env:"WATCH_INTERVAL" default:"5s" description:"watch interval for dynamic files, deprecated"`
        } `group:"files" namespace:"files" env-namespace:"FILES"`

        SimilarityThreshold float64 `long:"similarity-threshold" env:"SIMILARITY_THRESHOLD" default:"0.5" description:"spam threshold"`
        MinMsgLen           int     `long:"min-msg-len" env:"MIN_MSG_LEN" default:"50" description:"min message length to check"`
        MaxEmoji            int     `long:"max-emoji" env:"MAX_EMOJI" default:"2" description:"max emoji count in message, -1 to disable check"`
        MinSpamProbability  float64 `long:"min-probability" env:"MIN_PROBABILITY" default:"50" description:"min spam probability percent to ban"`
        MultiLangWords      int     `long:"multi-lang" env:"MULTI_LANG" default:"0" description:"number of words in different languages to consider as spam"`

        ParanoidMode       bool `long:"paranoid" env:"PARANOID" description:"paranoid mode, check all messages"`
        FirstMessagesCount int  `long:"first-messages-count" env:"FIRST_MESSAGES_COUNT" default:"1" description:"number of first messages to check"`

        Message struct {
                Startup string `long:"startup" env:"STARTUP" default:"" description:"startup message"`
                Spam    string `long:"spam" env:"SPAM" default:"this is spam" description:"spam message"`
                Dry     string `long:"dry" env:"DRY" default:"this is spam (dry mode)" description:"spam dry message"`
                Warn    string `long:"warn" env:"WARN" default:"You've violated our rules and this is your first and last warning. Further violations will lead to permanent access denial. Stay compliant or face the consequences!" description:"warning message"`
        } `group:"message" namespace:"message" env-namespace:"MESSAGE"`

        Server struct {
                Enabled    bool   `long:"enabled" env:"ENABLED" description:"enable web server"`
                ListenAddr string `long:"listen" env:"LISTEN" default:":8080" description:"listen address"`
                AuthUser   string `long:"auth-user" env:"AUTH_USER" default:"tg-spam" description:"basic auth username"`
                AuthPasswd string `long:"auth" env:"AUTH" default:"auto" description:"basic auth password"`
                AuthHash   string `long:"auth-hash" env:"AUTH_HASH" default:"" description:"basic auth password hash"`
        } `group:"server" namespace:"server" env-namespace:"SERVER"`

        Training bool `long:"training" env:"TRAINING" description:"training mode, passive spam detection only"`
        SoftBan  bool `long:"soft-ban" env:"SOFT_BAN" description:"soft ban mode, restrict user actions but not ban"`

        HistorySize int    `long:"history-size" env:"LAST_MSGS_HISTORY_SIZE" default:"100" description:"history size"`
        Convert     string `long:"convert" choice:"only" choice:"enabled" choice:"disabled" default:"enabled" description:"convert mode for txt samples and other storage files to DB"`

        MaxBackups int `long:"max-backups" env:"MAX_BACKUPS" default:"10" description:"maximum number of backups to keep, set 0 to disable"`

        Dry   bool `long:"dry" env:"DRY" description:"dry mode, no bans"`
        Dbg   bool `long:"dbg" env:"DEBUG" description:"debug mode"`
        TGDbg bool `long:"tg-dbg" env:"TG_DEBUG" description:"telegram debug mode"`
}

// default file names
const (
        samplesSpamFile   = "spam-samples.txt"
        samplesHamFile    = "ham-samples.txt"
        excludeTokensFile = "exclude-tokens.txt" //nolint:gosec // false positive
        stopWordsFile     = "stop-words.txt"     //nolint:gosec // false positive
        dynamicSpamFile   = "spam-dynamic.txt"
        dynamicHamFile    = "ham-dynamic.txt"
        dataFile          = "tg-spam.db"
)

var revision = "local"

func main() {
        fmt.Printf("tg-spam %s\n", revision)
        var opts options
        p := flags.NewParser(&opts, flags.PrintErrors|flags.PassDoubleDash|flags.HelpFlag)
        p.SubcommandsOptional = true

        // add save-config command
        if _, err := p.AddCommand("save-config", "Save current configuration to database",
                "Saves all current settings to the database for future use with --confdb",
                &struct{}{}); err != nil {
                log.Printf("[ERROR] failed to add save-config command: %v", err)
                os.Exit(1)
        }
        if _, err := p.Parse(); err != nil {
                if !errors.Is(err.(*flags.Error).Type, flags.ErrHelp) {
                        log.Printf("[ERROR] cli error: %v", err)
                        os.Exit(1)
                }
                os.Exit(2)
        }

        // determine configuration source based on --confdb flag
        var appSettings *config.Settings

        if opts.ConfigDB {
                // database configuration mode - load from database first
                ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
                defer cancel()

                log.Printf("[INFO] loading configuration from database")

                // create a new settings instance
                appSettings = config.New()

                // set transient values needed for database connection BEFORE loading
                appSettings.Transient.ConfigDB = opts.ConfigDB
                appSettings.Transient.ConfigDBEncryptKey = opts.ConfigDBEncryptKey
                appSettings.Transient.DataBaseURL = opts.DataBaseURL
                appSettings.InstanceID = opts.InstanceID
                // set DynamicDataPath from opts so makeDB can properly construct the database path
                appSettings.Files.DynamicDataPath = opts.Files.DynamicDataPath

                // load settings from database
                if err := loadConfigFromDB(ctx, appSettings); err != nil {
                        log.Printf("[ERROR] failed to load configuration from database: %v", err)
                        cancel()
                        os.Exit(1) //nolint:gocritic // cancel is called before exit
                }

                // apply remaining transient values from CLI (these are never stored in DB)
                appSettings.Transient.Dbg = opts.Dbg
                appSettings.Transient.TGDbg = opts.TGDbg
                appSettings.Dry = opts.Dry

                // apply explicit CLI overrides for non-transient values
                applyCLIOverrides(appSettings, opts)
        } else {
                // traditional mode - CLI is source of truth
                appSettings = optToSettings(opts)
        }

        // handle save-config command
        if p.Active != nil && p.Active.Name == "save-config" {
                ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
                exitCode := 0
                if err := saveConfigToDB(ctx, appSettings); err != nil {
                        log.Printf("[ERROR] failed to save configuration to database: %v", err)
                        exitCode = 1
                }
                cancel()
                os.Exit(exitCode)
        }

        // setup logger with masked secrets, accessing them directly from domain models
        masked := []string{}

        // add tokens from domain models
        if appSettings.Telegram.Token != "" {
                masked = append(masked, appSettings.Telegram.Token)
        }
        if appSettings.OpenAI.Token != "" {
                masked = append(masked, appSettings.OpenAI.Token)
        }

        // add temporary web password if not "auto"
        if appSettings.Transient.WebAuthPasswd != "auto" && appSettings.Transient.WebAuthPasswd != "" {
                // auto passwd should not be masked as we print it
                masked = append(masked, appSettings.Transient.WebAuthPasswd)
        }

        // add auth hash
        if appSettings.Server.AuthHash != "" {
                masked = append(masked, appSettings.Server.AuthHash)
        }

        setupLog(appSettings.Transient.Dbg, masked...)
        log.Printf("[DEBUG] settings: %+v", appSettings)

        ctx, cancel := context.WithCancel(context.Background())

        go func() {
                // catch signal and invoke graceful termination
                stop := make(chan os.Signal, 1)
                signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
                <-stop
                log.Printf("[WARN] interrupt signal")
                cancel()
        }()

        // expand, make absolute paths
        appSettings.Files.DynamicDataPath = expandPath(appSettings.Files.DynamicDataPath)
        appSettings.Files.SamplesDataPath = expandPath(appSettings.Files.SamplesDataPath)

        if err := execute(ctx, appSettings); err != nil {
                log.Printf("[ERROR] %v", err)
                os.Exit(1)
        }
}

func execute(ctx context.Context, settings *config.Settings) error {
        if settings.Dry {
                log.Print("[WARN] dry mode, no actual bans")
        }

        convertOnly := settings.Convert == "only"
        if !settings.Server.Enabled && !convertOnly && (settings.Telegram.Token == "" || settings.Telegram.Group == "") {
                return errors.New("telegram token and group are required")
        }

        checkVolumeMount(settings) // show warning if dynamic files dir not mounted

        // make samples and dynamic data dirs
        if err := os.MkdirAll(settings.Files.SamplesDataPath, 0o700); err != nil {
                return fmt.Errorf("can't make samples dir, %w", err)
        }

        dataDB, err := makeDB(ctx, settings)
        if err != nil {
                return fmt.Errorf("can't make db, %w", err)
        }

        // make detector with all sample files loaded
        detector := makeDetector(settings)

        // make spam bot
        spamBot, err := makeSpamBot(ctx, settings, dataDB, detector)
        if err != nil {
                return fmt.Errorf("can't make spam bot, %w", err)
        }
        if settings.Convert == "only" {
                log.Print("[WARN] convert only mode, converting text samples and exit")
                return nil
        }

        // make store and load approved users
        approvedUsersStore, auErr := storage.NewApprovedUsers(ctx, dataDB)
        if auErr != nil {
                return fmt.Errorf("can't make approved users store, %w", auErr)
        }

        count, err := detector.WithUserStorage(approvedUsersStore)
        if err != nil {
                return fmt.Errorf("can't load approved users, %w", err)
        }
        log.Printf("[DEBUG] approved users loaded: %d", count)

        // make locator
        locator, err := storage.NewLocator(ctx, settings.History.Duration, settings.History.MinSize, dataDB)
        if err != nil {
                return fmt.Errorf("can't make locator, %w", err)
        }

        // activate web server if enabled
        if settings.Server.Enabled {
                // server starts in background goroutine
                if srvErr := activateServer(ctx, settings, spamBot, locator, dataDB); srvErr != nil {
                        return fmt.Errorf("can't activate web server, %w", srvErr)
                }
                // if no telegram token and group set, just run the server
                if settings.Telegram.Token == "" || settings.Telegram.Group == "" {
                        log.Printf("[WARN] no telegram token and group set, web server only mode")
                        <-ctx.Done()
                        return nil
                }
        }

        // make telegram bot
        tbAPI, err := tbapi.NewBotAPI(settings.Telegram.Token)
        if err != nil {
                return fmt.Errorf("can't make telegram bot, %w", err)
        }
        tbAPI.Debug = settings.Transient.TGDbg

        // make spam logger writer
        loggerWr, err := makeSpamLogWriter(settings)
        if err != nil {
                return fmt.Errorf("can't make spam log writer, %w", err)
        }
        defer loggerWr.Close()

        // make spam logger
        spamLogger, err := makeSpamLogger(ctx, settings.InstanceID, loggerWr, dataDB)
        if err != nil {
                return fmt.Errorf("can't make spam logger, %w", err)
        }

        // make telegram listener
        tgListener := events.TelegramListener{
                TbAPI:                   tbAPI,
                Group:                   settings.Telegram.Group,
                IdleDuration:            settings.Telegram.IdleDuration,
                SuperUsers:              settings.Admin.SuperUsers,
                Bot:                     spamBot,
                StartupMsg:              settings.Message.Startup,
                WarnMsg:                 settings.Message.Warn,
                NoSpamReply:             settings.NoSpamReply,
                SuppressJoinMessage:     settings.SuppressJoinMessage,
                SpamLogger:              spamLogger,
                AdminGroup:              settings.Admin.AdminGroup,
                TestingIDs:              settings.Admin.TestingIDs,
                Locator:                 locator,
                TrainingMode:            settings.Training,
                SoftBanMode:             settings.SoftBan,
                DisableAdminSpamForward: settings.Admin.DisableAdminSpamForward,
                Dry:                     settings.Dry,
        }

        log.Printf("[DEBUG] telegram listener config: {group: %s, idle: %v, super: %v, admin: %s, testing: %v, no-reply: %v,"+
                " suppress: %v, dry: %v, training: %v}", tgListener.Group, tgListener.IdleDuration, tgListener.SuperUsers,
                tgListener.AdminGroup, tgListener.TestingIDs, tgListener.NoSpamReply, tgListener.SuppressJoinMessage, tgListener.Dry,
                tgListener.TrainingMode)

        // run telegram listener and event processor loop
        if err := tgListener.Do(ctx); err != nil {
                return fmt.Errorf("telegram listener failed, %w", err)
        }
        return nil
}

// makeDB creates database connection based on the settings model
func makeDB(ctx context.Context, settings *config.Settings) (*engine.SQL, error) {
        if settings.Transient.DataBaseURL == "" {
                return nil, errors.New("empty database URL")
        }
        dbURL := settings.Transient.DataBaseURL

        // if dbURL has no path separator, assume it is a file name and add dynamic data path for sqlite
        if !strings.Contains(dbURL, "/") && !strings.Contains(dbURL, "\\") {
                dbURL = filepath.Join(settings.Files.DynamicDataPath, dbURL)
        }
        log.Printf("[DEBUG] data db: %s", dbURL)

        db, err := engine.New(ctx, dbURL, settings.InstanceID)
        if err != nil {
                return nil, fmt.Errorf("can't make db %s, %w", settings.Transient.DataBaseURL, err)
        }

        // backup db on version change for sqlite
        if db.Type() == engine.Sqlite {
                // get file name from dbURL for sqlite
                dbFile := dbURL
                dbFile = strings.TrimPrefix(dbFile, "file://")
                dbFile = strings.TrimPrefix(dbFile, "file:")

                // make backup of db on version change for sqlite
                if settings.MaxBackups > 0 {
                        if err := backupDB(dbFile, revision, settings.MaxBackups); err != nil {
                                return nil, fmt.Errorf("backup on version change failed, %w", err)
                        }
                } else {
                        log.Print("[WARN] database backups disabled")
                }
        }
        return db, nil
}

// checkVolumeMount checks if dynamic files location mounted in docker and shows warning if not
// returns true if running not in docker or dynamic files dir mounted
func checkVolumeMount(settings *config.Settings) (ok bool) {
        if os.Getenv("TGSPAM_IN_DOCKER") != "1" {
                return true
        }
        log.Printf("[DEBUG] running in docker")
        warnMsg := fmt.Sprintf("dynamic files dir %q is not mounted, changes will be lost on container restart", settings.Files.DynamicDataPath)

        // check if dynamic files dir not present. This means it is not mounted
        _, err := os.Stat(settings.Files.DynamicDataPath)
        if err != nil {
                log.Printf("[WARN] %s", warnMsg)
                // no dynamic files dir, no need to check further
                return false
        }

        // check if .not_mounted file missing, this means it is mounted
        if _, err = os.Stat(filepath.Join(settings.Files.DynamicDataPath, ".not_mounted")); err != nil {
                return true
        }

        // if .not_mounted file present, it can be mounted anyway with docker named volumes
        output, err := exec.Command("mount").Output()
        if err != nil {
                log.Printf("[WARN] %s, can't check mount: %v", warnMsg, err)
                return true
        }
        // check if the output contains the specified directory
        for _, line := range strings.Split(string(output), "\n") {
                if strings.Contains(line, settings.Files.DynamicDataPath) {
                        return true
                }
        }

        log.Printf("[WARN] %s", warnMsg)
        return false
}

func activateServer(ctx context.Context, settings *config.Settings, sf *bot.SpamFilter, loc *storage.Locator, db *engine.SQL) (err error) {
        // handle authentication - always use bcrypt hash for security
        authPasswd := settings.Transient.WebAuthPasswd
        authHash := settings.Server.AuthHash

        // if hash is provided, use it directly
        if authHash != "" {
                log.Printf("[INFO] using provided bcrypt hash for authentication")
        } else if authPasswd != "" {
                // generate hash from password if no hash but password is provided
                authHash, err = generateAuthHash(authPasswd)
                if err != nil {
                        return fmt.Errorf("can't handle authentication setup: %w", err)
                }
                // store the hash directly in the Server settings domain
                settings.Server.AuthHash = authHash
        }
        // when neither hash nor password is provided, auth will be disabled

        // make store and load approved users
        detectedSpamStore, dsErr := storage.NewDetectedSpam(ctx, db)
        if dsErr != nil {
                return fmt.Errorf("can't make detected spam store, %w", dsErr)
        }

        // create settings store for database access if config DB mode is enabled
        var settingsStore *config.Store
        if settings.Transient.ConfigDB {
                store, err := config.NewStore(ctx, db)
                if err != nil {
                        return fmt.Errorf("failed to create settings store: %w", err)
                }
                settingsStore = store
        }

        srv := webapi.Server{Config: webapi.Config{
                ListenAddr:    settings.Server.ListenAddr,
                Detector:      sf.Detector,
                SpamFilter:    sf,
                Locator:       loc,
                DetectedSpam:  detectedSpamStore,
                StorageEngine: db,            // add database engine for backup functionality
                SettingsStore: settingsStore, // may be nil if ConfigDB is false
                AuthUser:      settings.Server.AuthUser,
                AuthHash:      authHash, // use the hash (either from options or generated)
                Version:       revision,
                Dbg:           settings.Transient.Dbg,
                AppSettings:   settings,
                ConfigDBMode:  settings.Transient.ConfigDB, // indicate we're running with database config
        }}

        go func() {
                if err := srv.Run(ctx); err != nil {
                        log.Printf("[ERROR] web server failed, %v", err)
                }
        }()
        return nil
}

// makeDetector creates spam detector with all checkers and updaters
// it loads samples and dynamic files
func makeDetector(settings *config.Settings) *tgspam.Detector {
        detectorConfig := tgspam.Config{
                MaxAllowedEmoji:     settings.MaxEmoji,
                MinMsgLen:           settings.MinMsgLen,
                SimilarityThreshold: settings.SimilarityThreshold,
                MinSpamProbability:  settings.MinSpamProbability,
                CasAPI:              settings.CAS.API,
                CasUserAgent:        settings.CAS.UserAgent,
                HTTPClient:          &http.Client{Timeout: settings.CAS.Timeout},
                FirstMessageOnly:    !settings.ParanoidMode,
                FirstMessagesCount:  settings.FirstMessagesCount,
                OpenAIVeto:          settings.OpenAI.Veto,
                OpenAIHistorySize:   settings.OpenAI.HistorySize, // how many last requests sent to openai
                MultiLangWords:      settings.MultiLangWords,
                HistorySize:         settings.History.Size, // how many last request stored in memory
        }

        // FirstMessagesCount and ParanoidMode are mutually exclusive.
        // ParanoidMode still here for backward compatibility only.
        if settings.FirstMessagesCount > 0 { // if FirstMessagesCount is set, FirstMessageOnly is enforced
                detectorConfig.FirstMessageOnly = true
        }
        if settings.ParanoidMode { // if ParanoidMode is set, FirstMessagesCount is ignored
                detectorConfig.FirstMessageOnly = false
                detectorConfig.FirstMessagesCount = 0
        }
        if settings.Transient.StorageTimeout > 0 { // if StorageTimeout is non-zero, set it. If zero, storage timeout is disabled
                detectorConfig.StorageTimeout = settings.Transient.StorageTimeout
        }

        detector := tgspam.NewDetector(detectorConfig)

        if settings.IsOpenAIEnabled() {
                log.Printf("[WARN] openai enabled")
                openAIConfig := tgspam.OpenAIConfig{
                        SystemPrompt:      settings.OpenAI.Prompt,
                        CustomPrompts:     settings.OpenAI.CustomPrompts,
                        ReasoningEffort:   settings.OpenAI.ReasoningEffort,
                        Model:             settings.OpenAI.Model,
                        MaxTokensResponse: settings.OpenAI.MaxTokensResponse,
                        MaxTokensRequest:  settings.OpenAI.MaxTokensRequest,
                        MaxSymbolsRequest: settings.OpenAI.MaxSymbolsRequest,
                        RetryCount:        settings.OpenAI.RetryCount,
                }

                openaiConfig := openai.DefaultConfig(settings.OpenAI.Token)
                if settings.OpenAI.APIBase != "" {
                        openaiConfig.BaseURL = settings.OpenAI.APIBase
                }
                log.Printf("[DEBUG] openai config: %+v", openAIConfig)

                detector.WithOpenAIChecker(openai.NewClientWithConfig(openaiConfig), openAIConfig)
        }

        if settings.AbnormalSpace.Enabled {
                log.Printf("[INFO] words spacing check enabled")
                detector.AbnormalSpacing.Enabled = true
                detector.AbnormalSpacing.ShortWordLen = settings.AbnormalSpace.ShortWordLen
                detector.AbnormalSpacing.ShortWordRatioThreshold = settings.AbnormalSpace.ShortWordRatioThreshold
                detector.AbnormalSpacing.SpaceRatioThreshold = settings.AbnormalSpace.SpaceRatioThreshold
                detector.AbnormalSpacing.MinWordsCount = settings.AbnormalSpace.MinWords
        }

        metaChecks := []tgspam.MetaCheck{}
        if settings.Meta.ImageOnly {
                log.Printf("[INFO] image only check enabled")
                metaChecks = append(metaChecks, tgspam.ImagesCheck())
        }
        if settings.Meta.VideosOnly {
                log.Printf("[INFO] videos only check enabled")
                metaChecks = append(metaChecks, tgspam.VideosCheck())
        }
        if settings.Meta.LinksLimit >= 0 {
                log.Printf("[INFO] links check enabled, limit: %d", settings.Meta.LinksLimit)
                metaChecks = append(metaChecks, tgspam.LinksCheck(settings.Meta.LinksLimit))
        }
        if settings.Meta.MentionsLimit >= 0 {
                log.Printf("[INFO] mentions check enabled, limit: %d", settings.Meta.MentionsLimit)
                metaChecks = append(metaChecks, tgspam.MentionsCheck(settings.Meta.MentionsLimit))
        }
        if settings.Meta.LinksOnly {
                log.Printf("[INFO] links only check enabled")
                metaChecks = append(metaChecks, tgspam.LinkOnlyCheck())
        }
        if settings.Meta.Forward {
                log.Printf("[INFO] forward check enabled")
                metaChecks = append(metaChecks, tgspam.ForwardedCheck())
        }
        if settings.Meta.Keyboard {
                log.Printf("[INFO] keyboard check enabled")
                metaChecks = append(metaChecks, tgspam.KeyboardCheck())
        }
        if settings.Meta.UsernameSymbols != "" {
                log.Printf("[INFO] username symbols check enabled, prohibited symbols: %q", settings.Meta.UsernameSymbols)
                metaChecks = append(metaChecks, tgspam.UsernameSymbolsCheck(settings.Meta.UsernameSymbols))
        }
        detector.WithMetaChecks(metaChecks...)

        log.Printf("[DEBUG] detector config: %+v", detectorConfig)

        // initialize Lua plugins if enabled
        if settings.LuaPlugins.Enabled {
                initLuaPlugins(detector, settings)
        }

        return detector
}

// initLuaPlugins initializes Lua plugin engine and configures it
func initLuaPlugins(detector *tgspam.Detector, settings *config.Settings) {
        // copy Lua plugin settings to detector config
        detector.LuaPlugins.Enabled = true
        detector.LuaPlugins.PluginsDir = settings.LuaPlugins.PluginsDir
        detector.LuaPlugins.EnabledPlugins = settings.LuaPlugins.EnabledPlugins
        detector.LuaPlugins.DynamicReload = settings.LuaPlugins.DynamicReload

        // create and initialize the plugin engine
        luaEngine := plugin.NewChecker()
        if err := detector.WithLuaEngine(luaEngine); err != nil {
                log.Printf("[WARN] failed to initialize Lua plugins: %v", err)
                return
        }

        // log successful initialization
        log.Printf("[INFO] lua plugins enabled from directory: %s", settings.LuaPlugins.PluginsDir)

        // log which plugins are enabled
        if len(settings.LuaPlugins.EnabledPlugins) > 0 {
                log.Printf("[INFO] enabled Lua plugins: %v", settings.LuaPlugins.EnabledPlugins)
        } else {
                log.Print("[INFO] all Lua plugins from directory are enabled")
        }

        // log if dynamic reloading is enabled
        if settings.LuaPlugins.DynamicReload {
                log.Print("[INFO] dynamic reloading of Lua plugins enabled")
        }
}

func makeSpamBot(ctx context.Context, settings *config.Settings, dataDB *engine.SQL, detector *tgspam.Detector) (*bot.SpamFilter, error) {
        if dataDB == nil || detector == nil {
                return nil, errors.New("nil datadb or detector")
        }

        // make samples store
        samplesStore, err := storage.NewSamples(ctx, dataDB)
        if err != nil {
                return nil, fmt.Errorf("can't make samples store, %w", err)
        }
        if err = migrateSamples(ctx, settings, samplesStore); err != nil {
                return nil, fmt.Errorf("can't migrate samples, %w", err)
        }

        // make dictionary store
        dictionaryStore, err := storage.NewDictionary(ctx, dataDB)
        if err != nil {
                return nil, fmt.Errorf("can't make dictionary store, %w", err)
        }
        if err := migrateDicts(ctx, settings, dictionaryStore); err != nil {
                return nil, fmt.Errorf("can't migrate dictionary, %w", err)
        }

        spamBotParams := bot.SpamConfig{
                GroupID:      settings.InstanceID,
                SamplesStore: samplesStore,
                DictStore:    dictionaryStore,
                SpamMsg:      settings.Message.Spam,
                SpamDryMsg:   settings.Message.Dry,
                Dry:          settings.Dry,
        }
        spamBot := bot.NewSpamFilter(detector, spamBotParams)
        log.Printf("[DEBUG] spam bot config: %+v", spamBotParams)

        if err := spamBot.ReloadSamples(); err != nil {
                return nil, fmt.Errorf("can't reload samples, %w", err)
        }

        // set detector samples updaters
        detector.WithSpamUpdater(storage.NewSampleUpdater(samplesStore, storage.SampleTypeSpam, settings.Transient.StorageTimeout))
        detector.WithHamUpdater(storage.NewSampleUpdater(samplesStore, storage.SampleTypeHam, settings.Transient.StorageTimeout))

        return spamBot, nil
}

// expandPath expands ~ to home dir and makes the absolute path
func expandPath(path string) string {
        if path == "" {
                return ""
        }
        if path[0] == '~' {
                home, err := os.UserHomeDir()
                if err != nil {
                        return ""
                }
                return filepath.Join(home, path[1:])
        }
        ep, err := filepath.Abs(path)
        if err != nil {
                return path
        }
        return ep
}

type nopWriteCloser struct{ io.Writer }

func (n nopWriteCloser) Close() error { return nil }

// makeSpamLogger creates spam logger to keep reports about spam messages
// it writes json lines to the provided writer
func makeSpamLogger(ctx context.Context, gid string, wr io.Writer, dataDB *engine.SQL) (events.SpamLogger, error) {
        // make store and load approved users
        detectedSpamStore, auErr := storage.NewDetectedSpam(ctx, dataDB)
        if auErr != nil {
                return nil, fmt.Errorf("can't make approved users store, %w", auErr)
        }

        logWr := events.SpamLoggerFunc(func(msg *bot.Message, response *bot.Response) {
                userName := msg.From.Username
                if userName == "" {
                        userName = msg.From.DisplayName
                }
                // write to log file
                text := strings.ReplaceAll(msg.Text, "\n", " ")
                text = strings.TrimSpace(text)
                log.Printf("[DEBUG] spam detected from %v, text: %s", msg.From, text)
                m := struct {
                        TimeStamp   string `json:"ts"`
                        DisplayName string `json:"display_name"`
                        UserName    string `json:"user_name"`
                        UserID      int64  `json:"user_id"`
                        Text        string `json:"text"`
                }{
                        TimeStamp:   time.Now().In(time.Local).Format(time.RFC3339),
                        DisplayName: msg.From.DisplayName,
                        UserName:    msg.From.Username,
                        UserID:      msg.From.ID,
                        Text:        text,
                }
                line, err := json.Marshal(&m)
                if err != nil {
                        log.Printf("[WARN] can't marshal json, %v", err)
                        return
                }
                if _, err := wr.Write(append(line, '\n')); err != nil {
                        log.Printf("[WARN] can't write to log, %v", err)
                }

                // write to db store
                rec := storage.DetectedSpamInfo{
                        Text:      text,
                        UserID:    msg.From.ID,
                        UserName:  userName,
                        Timestamp: time.Now().In(time.Local),
                        GID:       gid,
                }
                if err := detectedSpamStore.Write(ctx, rec, response.CheckResults); err != nil {
                        log.Printf("[WARN] can't write to db, %v", err)
                }
        })

        return logWr, nil
}

// makeSpamLogWriter creates spam log writer to keep reports about spam messages
// it parses settings and makes lumberjack logger with rotation
func makeSpamLogWriter(settings *config.Settings) (accessLog io.WriteCloser, err error) {
        if !settings.Logger.Enabled {
                return nopWriteCloser{io.Discard}, nil
        }

        sizeParse := func(inp string) (uint64, error) {
                if inp == "" {
                        return 0, errors.New("empty value")
                }
                for i, sfx := range []string{"k", "m", "g", "t"} {
                        if strings.HasSuffix(inp, strings.ToUpper(sfx)) || strings.HasSuffix(inp, strings.ToLower(sfx)) {
                                val, err := strconv.Atoi(inp[:len(inp)-1])
                                if err != nil {
                                        return 0, fmt.Errorf("can't parse %s: %w", inp, err)
                                }
                                return uint64(float64(val) * math.Pow(float64(1024), float64(i+1))), nil
                        }
                }
                return strconv.ParseUint(inp, 10, 64)
        }

        maxSize, perr := sizeParse(settings.Logger.MaxSize)
        if perr != nil {
                return nil, fmt.Errorf("can't parse logger MaxSize: %w", perr)
        }

        maxSize /= 1048576

        log.Printf("[INFO] logger enabled for %s, max size %dM", settings.Logger.FileName, maxSize)
        return &lumberjack.Logger{
                Filename:   settings.Logger.FileName,
                MaxSize:    int(maxSize), //nolint:gosec // size in MB not that big to cause overflow
                MaxBackups: settings.Logger.MaxBackups,
                Compress:   true,
                LocalTime:  true,
        }, nil
}

// migrateSamples runs migrations from legacy text files samples to db, if such files found
func migrateSamples(ctx context.Context, settings *config.Settings, samplesDB *storage.Samples) error {
        if settings.Convert == "disabled" {
                log.Print("[DEBUG] samples migration disabled")
                return nil
        }
        migrateSamples := func(file string, sampleType storage.SampleType, origin storage.SampleOrigin) (*storage.SamplesStats, error) {
                if _, err := os.Stat(file); err != nil {
                        log.Printf("[DEBUG] samples file %s not found, skip", file)
                        return &storage.SamplesStats{}, nil
                }
                fh, err := os.Open(file) //nolint:gosec // file path is controlled by the app
                if err != nil {
                        return nil, fmt.Errorf("can't open samples file, %w", err)
                }
                defer fh.Close()
                stats, err := samplesDB.Import(ctx, sampleType, origin, fh, true) // clean records before import
                if err != nil {
                        return nil, fmt.Errorf("can't load samples, %w", err)
                }
                if err := fh.Close(); err != nil {
                        return nil, fmt.Errorf("can't close samples file, %w", err)
                }
                if err := os.Rename(file, file+".loaded"); err != nil {
                        return nil, fmt.Errorf("can't rename samples file, %w", err)
                }
                return stats, nil
        }

        if samplesDB == nil {
                return errors.New("samples db is nil")
        }

        // migrate preset spam samples if files exist
        spamPresetFile := filepath.Join(settings.Files.SamplesDataPath, samplesSpamFile)
        s, err := migrateSamples(spamPresetFile, storage.SampleTypeSpam, storage.SampleOriginPreset)
        if err != nil {
                return fmt.Errorf("can't migrate spam preset samples, %w", err)
        }
        if s.PresetHam > 0 {
                log.Printf("[DEBUG] spam preset samples loaded: %s", s)
        }

        // migrate preset ham samples if files exist
        hamPresetFile := filepath.Join(settings.Files.SamplesDataPath, samplesHamFile)
        s, err = migrateSamples(hamPresetFile, storage.SampleTypeHam, storage.SampleOriginPreset)
        if err != nil {
                return fmt.Errorf("can't migrate ham preset samples, %w", err)
        }
        if s.PresetHam > 0 {
                log.Printf("[DEBUG] ham preset samples loaded: %s", s)
        }

        // migrate dynamic spam samples if files exist
        dynSpamFile := filepath.Join(settings.Files.DynamicDataPath, dynamicSpamFile)
        s, err = migrateSamples(dynSpamFile, storage.SampleTypeSpam, storage.SampleOriginUser)
        if err != nil {
                return fmt.Errorf("can't migrate spam dynamic samples, %w", err)
        }
        if s.UserSpam > 0 {
                log.Printf("[DEBUG] spam dynamic samples loaded: %s", s)
        }

        // migrate dynamic ham samples if files exist
        dynHamFile := filepath.Join(settings.Files.DynamicDataPath, dynamicHamFile)
        s, err = migrateSamples(dynHamFile, storage.SampleTypeHam, storage.SampleOriginUser)
        if err != nil {
                return fmt.Errorf("can't migrate ham dynamic samples, %w", err)
        }
        if s.UserHam > 0 {
                log.Printf("[DEBUG] ham dynamic samples loaded: %s", s)
        }

        if s.TotalHam > 0 || s.TotalSpam > 0 {
                log.Printf("[INFO] samples migration done: %s", s)
        }
        return nil
}

// migrateDicts runs migrations from legacy dictionary text files to db, if needed
func migrateDicts(ctx context.Context, settings *config.Settings, dictDB *storage.Dictionary) error {
        if settings.Convert == "disabled" {
                log.Print("[DEBUG] dictionary migration disabled")
                return nil
        }

        migrateDict := func(file string, dictType storage.DictionaryType) (*storage.DictionaryStats, error) {
                if _, err := os.Stat(file); err != nil {
                        log.Printf("[DEBUG] dictionary file %s not found, skip", file)
                        return &storage.DictionaryStats{}, nil
                }
                fh, err := os.Open(file) //nolint:gosec // file path is controlled by the app
                if err != nil {
                        return nil, fmt.Errorf("can't open dictionary file, %w", err)
                }
                defer fh.Close()
                stats, err := dictDB.Import(ctx, dictType, fh, true) // clean records before import
                if err != nil {
                        return nil, fmt.Errorf("can't load dictionary, %w", err)
                }
                if err := fh.Close(); err != nil {
                        return nil, fmt.Errorf("can't close dictionary file, %w", err)
                }
                if err := os.Rename(file, file+".loaded"); err != nil {
                        return nil, fmt.Errorf("can't rename dictionary file, %w", err)
                }
                return stats, nil
        }

        if dictDB == nil {
                return errors.New("dictionary db is nil")
        }

        // migrate stop-words if files exist
        stopWordsFile := filepath.Join(settings.Files.SamplesDataPath, stopWordsFile)
        s, err := migrateDict(stopWordsFile, storage.DictionaryTypeStopPhrase)
        if err != nil {
                return fmt.Errorf("can't migrate stop words, %w", err)
        }
        if s.TotalStopPhrases > 0 {
                log.Printf("[INFO] stop words loaded: %s", s)
        }

        // migrate excluded tokens if files exist
        excludeTokensFile := filepath.Join(settings.Files.SamplesDataPath, excludeTokensFile)
        s, err = migrateDict(excludeTokensFile, storage.DictionaryTypeIgnoredWord)
        if err != nil {
                return fmt.Errorf("can't migrate excluded tokens, %w", err)
        }
        if s.TotalIgnoredWords > 0 {
                log.Printf("[INFO] excluded tokens loaded: %s", s)
        }

        if s.TotalIgnoredWords > 0 || s.TotalStopPhrases > 0 {
                log.Printf("[DEBUG] dictionaries migration done: %s", s)
        }
        return nil
}

// backupDB creates a backup of the db file if the version has changed. It copies the db file to a new db file
// named as the original file with a version suffix, e.g., tg-spam.db.master-77e0bfd-20250107T23:17:34.
// The file is created only if the version has changed and a backup file with the name tg-spam.db.<version> does not exist.
// It keeps up to maxBackups files; if maxBackups is 0, no backups are made.
// Files are removed based on the final part of the version, i.e., 20250107T23:17:34, with the oldest backups removed first.
// If the backup file extension suffix with the timestamp is not found, the modification time of the file is used instead.
func backupDB(dbFile, version string, maxBackups int) error {
        if maxBackups == 0 {
                return nil
        }
        backupFile := dbFile + "." + strings.ReplaceAll(version, ".", "_") // replace dots with underscores for file name
        if _, err := os.Stat(backupFile); err == nil {
                // backup file for the version already exists, no need to make it again
                return nil
        }
        if _, err := os.Stat(dbFile); err != nil {
                // db file not found, no need to backup. This is legit if the db is not created yet on the first run
                log.Printf("[WARN] db file not found: %s, skip backup", dbFile)
                return nil
        }

        log.Printf("[DEBUG] db backup: %s -> %s", dbFile, backupFile)
        // copy current db to the backup file
        if err := fileutils.CopyFile(dbFile, backupFile); err != nil {
                return fmt.Errorf("failed to copy db file: %w", err)
        }
        log.Printf("[INFO] db backup created: %s", backupFile)

        // cleanup old backups if needed
        files, err := filepath.Glob(dbFile + ".*")
        if err != nil {
                return fmt.Errorf("failed to list backup files: %w", err)
        }

        if len(files) <= maxBackups {
                return nil
        }

        // sort files by timestamp in version suffix or mod time if suffix not formatted as timestamp
        sort.Slice(files, func(i, j int) bool {
                getTime := func(f string) time.Time {
                        base := filepath.Base(f) // file name like this: tg-spam.db.master-77e0bfd-20250107T23:17:34
                        // try to get timestamp from version suffix first
                        parts := strings.Split(base, "-")
                        if len(parts) >= 3 {
                                suffix := parts[len(parts)-1]
                                if t, err := time.ParseInLocation("20060102T15:04:05", suffix, time.Local); err == nil {
                                        return t
                                }
                        }
                        // fallback to modification time for non-versioned files
                        fi, err := os.Stat(f)
                        if err != nil {
                                log.Printf("[WARN] can't stat file %s: %v", f, err)
                                return time.Now().Local() // treat errored files as newest to avoid deleting them
                        }
                        return fi.ModTime().Local() // convert to local for consistent comparison
                }
                return getTime(files[i]).Before(getTime(files[j]))
        })

        // remove oldest files
        for i := 0; i < len(files)-maxBackups; i++ {
                if err := os.Remove(files[i]); err != nil {
                        return fmt.Errorf("failed to remove old backup %s: %w", files[i], err)
                }
                log.Printf("[DEBUG] db backup removed: %s", files[i])
        }
        return nil
}

// generateAuthHash creates a bcrypt hash from the given password
// If the password is "auto", generates a random password first
func generateAuthHash(password string) (string, error) {
        var hashSource string
        var randomPassword string
        var err error

        // generate random password if needed
        if password == "auto" {
                randomPassword, err = webapi.GenerateRandomPassword(20)
                if err != nil {
                        return "", fmt.Errorf("can't generate random password: %w", err)
                }
                hashSource = randomPassword
        } else {
                hashSource = password
        }

        // generate hash from the password or random password
        hash, err := rest.GenerateBcryptHash(hashSource)
        if err != nil {
                return "", fmt.Errorf("can't generate bcrypt hash: %w", err)
        }

        // log the appropriate message
        if password == "auto" {
                log.Printf("[WARN] generated basic auth password for user tg-spam: %q, bcrypt hash: %s", randomPassword, hash)
        } else {
                log.Printf("[INFO] generated bcrypt hash from provided password")
        }

        return hash, nil
}

// optToSettings converts CLI options to the domain settings model
func optToSettings(opts options) *config.Settings {
        // create settings model from options
        settings := &config.Settings{
                InstanceID: opts.InstanceID,

                Telegram: config.TelegramSettings{
                        Group:        opts.Telegram.Group,
                        IdleDuration: opts.Telegram.IdleDuration,
                        Timeout:      opts.Telegram.Timeout,
                },

                Admin: config.AdminSettings{
                        AdminGroup:              opts.AdminGroup,
                        DisableAdminSpamForward: opts.DisableAdminSpamForward,
                        TestingIDs:              opts.TestingIDs,
                        SuperUsers:              opts.SuperUsers,
                },

                History: config.HistorySettings{
                        Duration: opts.HistoryDuration,
                        MinSize:  opts.HistoryMinSize,
                        Size:     opts.HistorySize,
                },

                Logger: config.LoggerSettings{
                        Enabled:    opts.Logger.Enabled,
                        FileName:   opts.Logger.FileName,
                        MaxSize:    opts.Logger.MaxSize,
                        MaxBackups: opts.Logger.MaxBackups,
                },

                CAS: config.CASSettings{
                        API:       opts.CAS.API,
                        Timeout:   opts.CAS.Timeout,
                        UserAgent: opts.CAS.UserAgent,
                },

                Meta: config.MetaSettings{
                        LinksLimit:      opts.Meta.LinksLimit,
                        MentionsLimit:   opts.Meta.MentionsLimit,
                        ImageOnly:       opts.Meta.ImageOnly,
                        LinksOnly:       opts.Meta.LinksOnly,
                        VideosOnly:      opts.Meta.VideosOnly,
                        AudiosOnly:      opts.Meta.AudiosOnly,
                        Forward:         opts.Meta.Forward,
                        Keyboard:        opts.Meta.Keyboard,
                        UsernameSymbols: opts.Meta.UsernameSymbols,
                },

                OpenAI: config.OpenAISettings{
                        APIBase:           opts.OpenAI.APIBase,
                        Veto:              opts.OpenAI.Veto,
                        Prompt:            opts.OpenAI.Prompt,
                        CustomPrompts:     opts.OpenAI.CustomPrompts,
                        Model:             opts.OpenAI.Model,
                        MaxTokensResponse: opts.OpenAI.MaxTokensResponse,
                        MaxTokensRequest:  opts.OpenAI.MaxTokensRequest,
                        MaxSymbolsRequest: opts.OpenAI.MaxSymbolsRequest,
                        RetryCount:        opts.OpenAI.RetryCount,
                        HistorySize:       opts.OpenAI.HistorySize,
                        ReasoningEffort:   opts.OpenAI.ReasoningEffort,
                },

                LuaPlugins: config.LuaPluginsSettings{
                        Enabled:        opts.LuaPlugins.Enabled,
                        PluginsDir:     opts.LuaPlugins.PluginsDir,
                        EnabledPlugins: opts.LuaPlugins.EnabledPlugins,
                        DynamicReload:  opts.LuaPlugins.DynamicReload,
                },

                AbnormalSpace: config.AbnormalSpaceSettings{
                        Enabled:                 opts.AbnormalSpacing.Enabled,
                        SpaceRatioThreshold:     opts.AbnormalSpacing.SpaceRatioThreshold,
                        ShortWordRatioThreshold: opts.AbnormalSpacing.ShortWordRatioThreshold,
                        ShortWordLen:            opts.AbnormalSpacing.ShortWordLen,
                        MinWords:                opts.AbnormalSpacing.MinWords,
                },

                Files: config.FilesSettings{
                        SamplesDataPath: opts.Files.SamplesDataPath,
                        DynamicDataPath: opts.Files.DynamicDataPath,
                        WatchInterval:   int(opts.Files.WatchInterval.Seconds()),
                },

                Message: config.MessageSettings{
                        Startup: opts.Message.Startup,
                        Spam:    opts.Message.Spam,
                        Dry:     opts.Message.Dry,
                        Warn:    opts.Message.Warn,
                },

                Server: config.ServerSettings{
                        Enabled:    opts.Server.Enabled,
                        ListenAddr: opts.Server.ListenAddr,
                        AuthUser:   opts.Server.AuthUser,
                },

                SimilarityThreshold: opts.SimilarityThreshold,
                MinMsgLen:           opts.MinMsgLen,
                MaxEmoji:            opts.MaxEmoji,
                MinSpamProbability:  opts.MinSpamProbability,
                MultiLangWords:      opts.MultiLangWords,
                NoSpamReply:         opts.NoSpamReply,
                SuppressJoinMessage: opts.SuppressJoinMessage,
                ParanoidMode:        opts.ParanoidMode,
                FirstMessagesCount:  opts.FirstMessagesCount,
                Training:            opts.Training,
                SoftBan:             opts.SoftBan,
                Convert:             opts.Convert,
                MaxBackups:          opts.MaxBackups,
                Dry:                 opts.Dry,
        }

        // set transient settings (not persisted to database)
        settings.Transient = config.TransientSettings{
                DataBaseURL:        opts.DataBaseURL,
                StorageTimeout:     opts.StorageTimeout,
                ConfigDB:           opts.ConfigDB,
                Dbg:                opts.Dbg,
                TGDbg:              opts.TGDbg,
                WebAuthPasswd:      opts.Server.AuthPasswd,
                ConfigDBEncryptKey: opts.ConfigDBEncryptKey,
        }

        // set credentials in their respective domain structures
        settings.Telegram.Token = opts.Telegram.Token
        settings.OpenAI.Token = opts.OpenAI.Token
        settings.Server.AuthHash = opts.Server.AuthHash

        return settings
}

// applyCLIOverrides applies explicit CLI overrides to settings loaded from database
// Only overrides values that were explicitly set on the command line (not defaults)
//
// How to add new overrides:
// 1. Check if the CLI option was explicitly provided (not using default value)
// 2. Compare with the default value from the options struct definition
// 3. Apply the override only if the value differs from the default
//
// Example for adding telegram token override:
//
//        if opts.Telegram.Token != "" {  // "" is the default
//            settings.Telegram.Token = opts.Telegram.Token
//        }
func applyCLIOverrides(settings *config.Settings, opts options) {
        // override auth password if explicitly provided (not using default "auto")
        if opts.Server.AuthPasswd != "auto" {
                settings.Transient.WebAuthPasswd = opts.Server.AuthPasswd
                // clear auth hash since we have a new password
                settings.Server.AuthHash = ""
        }

        // override auth hash if explicitly provided
        if opts.Server.AuthHash != "" {
                settings.Server.AuthHash = opts.Server.AuthHash
                // clear password since hash takes precedence
                settings.Transient.WebAuthPasswd = ""
        }
}

// loadConfigFromDB loads configuration from the database
func loadConfigFromDB(ctx context.Context, settings *config.Settings) error {
        if !settings.Transient.ConfigDB {
                return nil // skip if not enabled
        }

        log.Print("[INFO] loading configuration from database")

        // create database connection using the same logic as main data DB
        db, err := makeDB(ctx, settings)
        if err != nil {
                return fmt.Errorf("failed to connect to database for config: %w", err)
        }

        // create settings store with encryption if key provided
        var storeOpts []config.StoreOption
        if settings.Transient.ConfigDBEncryptKey != "" {
                crypter, cryptErr := config.NewCrypter(settings.Transient.ConfigDBEncryptKey, settings.InstanceID)
                if cryptErr != nil {
                        log.Fatalf("[FATAL] invalid encryption key: %v", cryptErr)
                }
                storeOpts = append(storeOpts, config.WithCrypter(crypter))
                log.Print("[INFO] configuration encryption enabled for database access")
        }

        settingsStore, err := config.NewStore(ctx, db, storeOpts...)
        if err != nil {
                return fmt.Errorf("failed to create settings store: %w", err)
        }

        // load settings
        dbSettings, err := settingsStore.Load(ctx)
        if err != nil {
                return fmt.Errorf("failed to load settings from database: %w", err)
        }

        // save original transient values only (non-functional values)
        transient := settings.Transient

        // replace settings with loaded values including credentials
        *settings = *dbSettings

        // restore transient values
        settings.Transient = transient

        log.Printf("[INFO] configuration loaded from database successfully")
        return nil
}

// saveConfigToDB saves the current configuration to the database
func saveConfigToDB(ctx context.Context, settings *config.Settings) error {
        log.Print("[INFO] saving configuration to database")

        // create database connection
        db, err := makeDB(ctx, settings)
        if err != nil {
                return fmt.Errorf("failed to connect to database for config: %w", err)
        }

        // create settings store with encryption if key provided
        var storeOpts []config.StoreOption
        if settings.Transient.ConfigDBEncryptKey != "" {
                crypter, cryptErr := config.NewCrypter(settings.Transient.ConfigDBEncryptKey, settings.InstanceID)
                if cryptErr != nil {
                        log.Fatalf("[FATAL] invalid encryption key: %v", cryptErr)
                }
                storeOpts = append(storeOpts, config.WithCrypter(crypter))
                log.Print("[INFO] configuration encryption enabled for database storage")
        }

        settingsStore, err := config.NewStore(ctx, db, storeOpts...)
        if err != nil {
                return fmt.Errorf("failed to create settings store: %w", err)
        }

        // generate auth hash if password is provided but hash isn't
        if settings.Transient.WebAuthPasswd != "" && settings.Server.AuthHash == "" {
                // generate bcrypt hash from the password
                hash, hashErr := generateAuthHash(settings.Transient.WebAuthPasswd)
                if hashErr != nil {
                        return fmt.Errorf("failed to generate auth hash: %w", hashErr)
                }

                // update the hash directly in the Server settings domain
                settings.Server.AuthHash = hash
        }

        // save settings to database
        if err := settingsStore.Save(ctx, settings); err != nil {
                return fmt.Errorf("failed to save configuration to database: %w", err)
        }

        log.Printf("[INFO] configuration saved to database successfully")
        return nil
}

func setupLog(dbg bool, secrets ...string) {
        logOpts := []lgr.Option{lgr.Msec, lgr.LevelBraces, lgr.StackTraceOnError}
        if dbg {
                logOpts = []lgr.Option{lgr.Debug, lgr.CallerFile, lgr.CallerFunc, lgr.Msec, lgr.LevelBraces, lgr.StackTraceOnError}
        }

        colorizer := lgr.Mapper{
                ErrorFunc:  func(s string) string { return color.New(color.FgHiRed).Sprint(s) },
                WarnFunc:   func(s string) string { return color.New(color.FgRed).Sprint(s) },
                InfoFunc:   func(s string) string { return color.New(color.FgYellow).Sprint(s) },
                DebugFunc:  func(s string) string { return color.New(color.FgWhite).Sprint(s) },
                CallerFunc: func(s string) string { return color.New(color.FgBlue).Sprint(s) },
                TimeFunc:   func(s string) string { return color.New(color.FgCyan).Sprint(s) },
        }
        logOpts = append(logOpts, lgr.Map(colorizer))

        if len(secrets) > 0 {
                logOpts = append(logOpts, lgr.Secret(secrets...))
        }
        lgr.SetupStdLogger(logOpts...)
        lgr.Setup(logOpts...)
}

umputun / tg-spam / 15672803049

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous