bots-go-framework / bots-fw / 29475483533

28%

push

github

fix(botsfw)!: scope bot settings lookup by platform

GetBotContext accepted a platformID parameter and never read it. It resolved purely
by bot ID or code, so the platform a webhook arrived on had no bearing on which
bot's settings came back.

With Telegram as the only framework-side platform this was invisible. bots-fw-whatsapp
now exists, which is exactly what makes it reachable: a WhatsApp webhook could
resolve a Telegram bot's settings - including its Token and WebhookSecretToken -
whenever the two shared an ID or code. Note bots-fw-telegram's handler passes
PlatformID and then verifies its secret against whatever settings came back.

Two bugs, one root cause: bot codes were treated as globally unique when they are
only unique per platform.

1. GetBotContext is now platform-scoped, via BotSettingsBy.findByPlatform. A bot on
   another platform returns ErrUnknownBot rather than being silently substituted. A
   blank platformID is rejected.

2. NewBotSettingsBy panicked on duplicate codes regardless of platform, so the same
   product could not be registered on two platforms - "debtus" on Telegram and
   "debtus" on WhatsApp are different bots with different tokens. It now panics only
   on a duplicate WITHIN a platform. This is what made a second platform registrable
   at all.

Added BotSettingsBy.ByPlatformAndCode / ByPlatformAndID. ByCode and ByID are kept
populated (first-wins) for compatibility but are now deprecated: they are ambiguous
across platforms by construction. The legacy fallback in findByPlatform still checks
Platform, so it cannot reintroduce the leak it exists to be compatible with.

The test suite had ENCODED the bug: three separate fixtures hand-built a BotSettings
with no Platform and passed only because platformID was ignored. All three are fixed
rather than worked around. NewBotSettings has always panicked on an empty platform,
so those fixtures were malformed - they bypassed the constructor.

BREAKING:
- A BotSettings with a... (continued)

46 of 51 new or added lines in 2 files covered. (90.2%)

1266 of 5332 relevant lines covered (23.74%)

0.28 hits per line