tegwick
5ddfee8250
Completes the provisioner's write path. internal/tg drives BotFather as a conversation rather than pretending it is an endpoint, creates channels, claims usernames with fallbacks, and grants post_messages. internal/apply sequences it: bot before administrator, test channel before public, and state saved after every step that changed the world -- a channel that exists but is unrecorded is worse than one that does not exist, because the next run creates a second. The operator session lives in OpenBao, not on disk. gotd's FileStorage would leave a full-account credential in the working directory, where it outlives the run and can be committed by accident. The bot token goes straight from BotFather's reply to OpenBao and is cleared from memory; if that write fails the error says how to recover by hand and warns against re-running, since a retry creates a second bot. Closes T05: the redaction salt is create-if-absent with no overwrite path, and the test asserts it, because rotating it invalidates every longitudinal comparison with no visible failure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa Assistant: claude-code Assistant-Model: opus Assistant-Process: 1361245@bnt-lap001 Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a
50 lines
1.5 KiB
Go
50 lines
1.5 KiB
Go
package secrets
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"fmt"
|
|
)
|
|
|
|
// SessionStorage keeps the MTProto session in OpenBao and never on disk.
|
|
//
|
|
// gotd's own FileStorage would put a full-account credential in the working
|
|
// directory, where it outlives the run, gets committed by accident, and is
|
|
// readable by anything on the box. The session can do everything the operator
|
|
// account can do, so it is held exactly where the bot token is.
|
|
type SessionStorage struct {
|
|
Store *Store
|
|
}
|
|
|
|
const sessionField = "session_b64"
|
|
|
|
func (s SessionStorage) LoadSession(ctx context.Context) ([]byte, error) {
|
|
fields, found, err := s.Store.Get(ctx, KeyOperatorSession)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !found || fields[sessionField] == "" {
|
|
// gotd treats a nil session as "not authenticated yet", which is the
|
|
// correct reading of an empty path.
|
|
return nil, nil
|
|
}
|
|
raw, err := base64.StdEncoding.DecodeString(fields[sessionField])
|
|
if err != nil {
|
|
return nil, fmt.Errorf("stored session at %s is not decodable; re-run "+
|
|
"`provision session bootstrap`", s.Store.Ref(KeyOperatorSession))
|
|
}
|
|
return raw, nil
|
|
}
|
|
|
|
func (s SessionStorage) StoreSession(ctx context.Context, data []byte) error {
|
|
return s.Store.Put(ctx, KeyOperatorSession, map[string]string{
|
|
sessionField: base64.StdEncoding.EncodeToString(data),
|
|
})
|
|
}
|
|
|
|
// AppCredentials are issued by my.telegram.org and cannot be provisioned; see
|
|
// docs/seeding-runbook.md step 2.
|
|
type AppCredentials struct {
|
|
AppID int
|
|
AppHash string
|
|
}
|