[RELEASE] Alpha Web v0.1.0: Implement Web client with QR auth#136
Open
[RELEASE] Alpha Web v0.1.0: Implement Web client with QR auth#136
Conversation
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #135
konard
changed the title
Collaborator
Author
Solution summaryImplemented and pushed the alpha web client. PR 136 is ready for review and CI is passing: #136 What changed:
Verified:
Local preview is running at Notes:
This summary was automatically extracted from the AI working session output. |
Collaborator
Author
🤖 Solution Draft LogThis log file contains the complete execution trace of the AI solution draft process. 💰 Cost estimation:
📊 Context and tokens usage:
Total: (657.5K + 22.3M cached) input tokens, 62.7K output tokens, $31.674899 cost 🤖 Models used:
📎 Log file uploaded as Repository (2 chunks) (102494KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
Collaborator
Author
✅ Ready to mergeThis pull request is now ready to be merged:
Monitored by hive-mind with --auto-restart-until-mergeable flag |
This reverts commit 087ea6f.
Owner
🔄 Предложение: Добавить альтернативную авторизацию через Telegram QR-код@konard Отличная работа над текущей реализацией авторизации! 🎉 Предложение: Добавить альтернативный метод входа через QR-код Telegram как опцию к существующей авторизации. 🎯 Зачем это нужно
🏗️ Предлагаемая реализация1. Новый эндпоинт для генерации QR-кода// POST /api/auth/qr/initiate
interface QRInitiateRequest {
clientId?: string; // опционально, для привязки сессии
}
interface QRInitiateResponse {
qrCodeData: string; // строка для генерации QR (t.me/login?token=...)
sessionId: string; // уникальный ID сессии для опроса статуса
expiresAt: Date; // время жизни кода (рекомендуется 5 минут)
}2. Эндпоинт для проверки статуса авторизации// GET /api/auth/qr/status/:sessionId
interface QRStatusResponse {
status: 'pending' | 'authorized' | 'expired' | 'cancelled';
authData?: {
token: string; // JWT или сессионный токен
user: {
id: number;
username?: string;
first_name?: string;
is_premium?: boolean;
};
};
}3. WebUI-компонент🔧 Техническая интеграцияВариант A: Через Telegram Login Widget (официальный)// Использовать https://core.telegram.org/widgets/login
// После успешного входа получать auth_date, hash, user data
// Верифицировать hash через bot token (HMAC-SHA256)
function verifyTelegramLogin(data: TelegramLoginData, botToken: string): boolean {
const { auth_date, hash, ...userData } = data;
const dataCheckString = Object.entries(userData)
.sort(([a], [b]) => a.localeCompare(b))
.map(([k, v]) => `${k}=${v}`)
.join('\n');
const secret = crypto.createHash('sha256').update(botToken).digest();
const expectedHash = crypto.createHmac('sha256', secret)
.update(dataCheckString + '\n' + auth_date)
.digest('hex');
return hash === expectedHash && (Date.now() / 1000 - auth_date) < 86400;
}Вариант B: Через Telegram Bot API + Deep Linking// 1. Генерируем unique token и сохраняем в Redis с TTL 5 мин
// 2. Формируем deep link: t.me/YourBot?start=auth_{token}
// 3. Пользователь нажимает на ссылку → бот получает /start auth_{token}
// 4. Бот связывает telegram_user_id с token → обновляет статус в Redis
// 5. WebUI опрашивает статус → получает подтверждение → выдаёт сессию📋 Чеклист для реализации
|
Collaborator
Author
|
🤖 AI Work Session Started Starting automated work session at 2026-04-28T00:23:06.199Z The PR has been converted to draft mode while work is in progress. This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback. |
konard
changed the title
Collaborator
Author
Solution summaryImplemented and pushed the PR follow-up for Telegram QR login. PR: #136 What changed:
Verification:
CI is passing on the pushed SHA and the PR merge state is clean. Local preview is running at Live Telegram QR auth still requires valid This summary was automatically extracted from the AI working session output. |
Collaborator
Author
🤖 Solution Draft LogThis log file contains the complete execution trace of the AI solution draft process. 💰 Cost estimation:
📊 Context and tokens usage:
Total: (315.2K + 8.5M cached) input tokens, 30.1K output tokens, $12.978883 cost 🤖 Models used:
📎 Log file uploaded as Gist (23239KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
Collaborator
Author
✅ Ready to mergeThis pull request is now ready to be merged:
Monitored by hive-mind with --auto-restart-until-mergeable flag |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #135
Summary
web/React 18 + Vite + TypeScript alpha client with TailwindCSS styling and PWA assets.teleton-agentHTTPS API.localStorageby default.QR Auth Follow-Up
requestQrCodeAuthenticationand rendersauthorizationStateWaitOtherDeviceConfirmation.linklocally as a QR image.docs/AUTH.md.Reproduction And Verification
Before this PR, the new
test/web-alpha-release.test.mjsfailed becauseweb/package.jsonand the alpha web project did not exist. The test now verifies the web release structure and critical service contracts, including the QR auth path added after review feedback.Screenshots
Desktop auth/error state:
Mobile settings state:
Desktop QR auth state:
Mobile QR auth state:
Tests
cd web && npm run testcd web && npm run buildnode --test test/web-alpha-release.test.mjsnpm testnpm run validate:secretsnpm run audit:securitynpm run validate:foundationnpm run validate:releasenpm run build:debug-artifactsnpm run decompose:dry-runhttp://localhost:5173/app/with a mocked TDWeb client for desktop and mobile screenshotsRisk / Follow-Up
VITE_TELEGRAM_API_IDandVITE_TELEGRAM_API_HASHplus TDWeb runtime assets copied bynpm install.npm audit --omit=devinweb/reports two moderate findings inherited fromtdweb@1.8.0 -> uuid, with no upstream fix available fromtdwebtoday. This is documented inweb/README.mdfor release review.localhost:7778.