Repository navigation
feat: improve Telegram integration plugin - #111
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
Greptile SummaryThis PR improves the Telegram plugin in three ways: adds package-level README documentation, wires the previously declared
Confidence Score: 4/5Requires one targeted fix to the webhook matcher before merging; the auth-config wiring and README are safe. The authConfig fix and README are clean improvements with no issues. The pluginWebhookMatcher change has a real P1 defect: it removes the Telegram-specific header check entirely, making it the least-specific matcher in the codebase. Any webhook body containing update_id will now route to this plugin, violating the uniqueness rule enforced across all other plugins. The fix is straightforward and localized. packages/telegram/index.ts — specifically the pluginWebhookMatcher logic at lines 237–251 Important Files Changed
Sequence DiagramsequenceDiagram
participant TG as Telegram Server
participant FW as Corsair Framework
participant PM as pluginWebhookMatcher
participant KB as keyBuilder
participant WH as Webhook Handler
TG->>FW: POST /webhook
Note over TG,FW: body contains update_id<br/>optionally: X-Telegram-Bot-Api-Secret-Token header
FW->>PM: pluginWebhookMatcher(request)
Note over PM: NEW: checks only 'update_id' in body<br/>OLD: also required secret-token header presence
alt update_id found in body
PM-->>FW: true
FW->>KB: keyBuilder(ctx, 'webhook')
KB-->>FW: webhookSecret or key-manager value
FW->>WH: dispatch to typed webhook handler
WH-->>FW: response
FW-->>TG: 200 OK
else body missing update_id or parse error
PM-->>FW: false
FW-->>TG: skip plugin
end
Reviews (1): Last reviewed commit: "feat: improve Telegram integration plugi..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| pluginWebhookMatcher: (request) => { | ||
| const body = typeof request.body === 'string' | ||
| ? JSON.parse(request.body) | ||
| : request.body; | ||
|
|
||
| if (!body || typeof body !== 'object') { | ||
| try { | ||
| const body = typeof request.body === 'string' | ||
| ? JSON.parse(request.body) | ||
| : request.body; | ||
|
|
||
| if (!body || typeof body !== 'object') { | ||
| return false; | ||
| } | ||
|
|
||
| return 'update_id' in body; | ||
| } catch { | ||
| return false; | ||
| } | ||
|
|
||
| const hasSignature = 'x-telegram-bot-api-secret-token' in request.headers; | ||
|
|
||
| return hasSignature && 'update_id' in body | ||
| }, |
There was a problem hiding this comment.
After this change, pluginWebhookMatcher accepts any request whose body contains update_id, with no header check at all. Every other plugin in this repository uses a service-specific HTTP header to uniquely identify incoming webhooks:
- Zoom →
x-zm-signature - Stripe →
stripe-signature - GitHub →
x-github-event+x-hub-signature-256 - Slack →
x-slack-signature+x-slack-request-timestamp - Discord →
x-signature-ed25519+x-signature-timestamp - Sentry →
sentry-hook-signature+sentry-hook-resource
Telegram is now the only plugin that matches purely on body content. Any third-party or internal webhook whose JSON body happens to include an update_id field will incorrectly match and be routed to the Telegram plugin.
The original bug was real: hasSignature required the X-Telegram-Bot-Api-Secret-Token header to exist, but Telegram only sends this header when a secret is registered on the webhook — deployments without a secret never matched. Removing the header check entirely is an over-correction.
A precise fix keeps uniqueness when a secret is configured and falls back gracefully when it is not:
pluginWebhookMatcher: (request) => {
try {
const body = typeof request.body === 'string'
? JSON.parse(request.body)
: request.body;
if (!body || typeof body !== 'object' || !('update_id' in body)) {
return false;
}
// When a secret is configured, Telegram always sends the
// X-Telegram-Bot-Api-Secret-Token header — require it so the
// matcher stays uniquely Telegram-specific.
if (options.webhookSecret) {
return 'x-telegram-bot-api-secret-token' in request.headers;
}
// No secret configured: Telegram won't send the header,
// so fall back to body-only matching.
return true;
} catch {
return false;
}
},Rule Used: What: pluginWebhookMatcher in each plugin must b... (source)
|
Hi, @theRizwan! Thanks for this PR. Please remove the Readme file that was generated. That shouldn't go into the main package. Also, I believe Greptile has pointed out an issue in the plugin webhook matcher. Please resolve that as well. Thank you! We'll get this merged once those fixes are made. |
Summary
This pull request improves the existing Telegram integration package so it remains consistent with the repository's plugin conventions and deployment expectations.
What changed
Validation
pnpm exec tsc -p packages/telegram/tsconfig.json --noEmitChecklist