28549389515
28%

Ran 01 Jul 2026 09:37PM UTC

Jobs 1

Files 75

Run time 1min

Badge

Embed ▾

Committed 01 Jul 2026 09:37PM UTC coverage: 23.153%. Remained the same

Build # 28549389515

Build Type

push

github

Committed by

web-flow

Commit Message

security(SEC-4): add per-bot WebhookSecretToken/RequireWebhookSecret to BotSettings (#79)

Part of the SEC-4 fix: Telegram (and other platform) webhooks currently have
no signature/secret verification, so anyone who knows a bot's webhook URL can
POST forged updates and impersonate any platform user. This adds the config
surface a webhook handler needs to verify the platform's secret-token header,
following the existing per-bot BotSettings pattern (Token, PaymentToken, etc.)
rather than inventing a parallel config mechanism.

- WebhookSecretToken: the secret expected back on every webhook call (e.g.
  Telegram's X-Telegram-Bot-Api-Secret-Token, set via secret_token when
  registering the webhook). Empty by default for backward compatibility.
- RequireWebhookSecret: opt-in flag (default false) so operators can make an
  unconfigured secret a hard failure instead of just a warning once they've
  rolled the secret out.

Actual verification lives in bots-fw-telegram (tg_webhook_handler.go), which
consumes these fields.


Claude-Session: https://claude.ai/code/session_01FV3pbooAc9UPpNdiaJuKve

Co-authored-by: Alexander Trakhimenok <alex@Alexanders-MacBook-Pro.local>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

1219 of 5265 relevant lines covered (23.15%)

0.27 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	28549389515.1	01 Jul 2026 09:37PM UTC	75	23.15	GitHub Action Run

bots-go-framework / bots-fw / 28549389515
28%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 28549389515

bots-go-framework / bots-fw / 28549389515 28%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 28549389515

bots-go-framework / bots-fw / 28549389515
28%

README BADGES
x