kaffa/telegram-bot-workers
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
180 Commits 1 Branch 0 Tags
4e246aad22a4056864e13a6bf6e0ef96a79f880d
Commit Graph

6 Commits

Author SHA1 Message Date
kaffa
4e246aad22 chore: anvil.it.com → inouter.com
Some checks failed
TypeScript CI / build (push) Has been cancelled
Details
2026-03-27 16:16:18 +00:00
kappa
e32e3c6a44 refactor: improve OpenAI service and tools 
- Enhance OpenAI message types with tool_calls support
- Improve security validation and rate limiting
- Update utility tools and weather tool
- Minor fixes in deposit-agent and domain-register

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-28 20:26:31 +09:00
kappa
e4ccff9f87 feat: add Reddit search tool and security/performance improvements 
New Features:
- Add reddit-tool.ts with search_reddit function (unofficial JSON API)

Security Fixes:
- Add timingSafeEqual for BOT_TOKEN/WEBHOOK_SECRET comparisons
- Add Optimistic Locking to domain registration balance deduction
- Add callback domain regex validation
- Sanitize error messages to prevent information disclosure
- Add timing-safe Bearer token comparison in api.ts

Performance Improvements:
- Parallelize Function Calling tool execution with Promise.all
- Parallelize domain registration API calls (check + price + balance)
- Parallelize domain info + nameserver queries

Reliability:
- Add in-memory fallback for KV rate limiting failures
- Add 10s timeout to Reddit API calls
- Add MAX_DEPOSIT_AMOUNT limit (100M KRW)

Testing:
- Skip stale test mocks pending vitest infrastructure update

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-26 16:20:17 +09:00
kappa
45e0677ab0 refactor: code quality improvements (P3) 
## Type Safety
- Add zod runtime validation for external API responses
  * Namecheap API responses (domain-register.ts)
  * n8n webhook responses (n8n-service.ts)
  * User request bodies (routes/api.ts)
  * Replaced unsafe type assertions with safeParse()
  * Proper error handling and logging

## Dead Code Removal
- Remove unused callDepositAgent function (127 lines)
  * Legacy Assistants API code no longer needed
  * Now using direct code execution
  * File reduced from 469 → 345 lines (26.4% reduction)

## Configuration Management
- Extract hardcoded URLs to environment variables
  * Added 7 new vars in wrangler.toml:
    OPENAI_API_BASE, NAMECHEAP_API_URL, WHOIS_API_URL,
    CONTEXT7_API_BASE, BRAVE_API_BASE, WTTR_IN_URL, HOSTING_SITE_URL
  * Updated Env interface in types.ts
  * All URLs have fallback to current production values
  * Enables environment-specific configuration (dev/staging/prod)

## Dependencies
- Add zod 4.3.5 for runtime type validation

## Files Modified
- Configuration: wrangler.toml, types.ts, package.json
- Services: 11 TypeScript files with URL/validation updates
- Total: 15 files, +196/-189 lines

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-01-19 22:06:01 +09:00
kappa
4f68dd3ebb fix: critical security and data integrity improvements (P1/P2) 
## P1 Critical Issues
- Add D1 batch result verification to prevent partial transaction failures
  * deposit-agent.ts: deposit confirmation and admin approval
  * domain-register.ts: domain registration payment
  * deposit-matcher.ts: SMS auto-matching
  * summary-service.ts: profile system updates
  * routes/api.ts: external API deposit deduction

- Remove internal error details from API responses
  * All 500 errors now return generic "Internal server error"
  * Detailed errors logged internally via console.error

- Enforce WEBHOOK_SECRET validation
  * Reject requests when WEBHOOK_SECRET is not configured
  * Prevent accidental production deployment without security

## P2 High Priority Issues
- Add SQL LIMIT parameter validation (1-100 range)
- Enforce CORS Origin header validation for /api/contact
- Optimize domain suggestion API calls (parallel processing)
  * 80% performance improvement for TLD price fetching
  * Individual error handling per TLD
- Add sensitive data masking in logs (user IDs)
  * New maskUserId() helper function
  * GDPR compliance for user privacy

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-01-19 21:53:18 +09:00
kappa
db859efc56 feat: 도메인 인라인 버튼 등록 + cheapest TLD + Cron 자동취소 
- 도메인 등록 인라인 버튼 확인 플로우 (domain-register.ts)
- manage_domain에 cheapest action 추가 (가장 저렴한 TLD TOP 15)
- 24시간 경과 입금 대기 자동 취소 Cron (UTC 15:00)
- 거래 내역 한글 라벨 + description 표시
- CLAUDE.md 문서 업데이트

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-18 15:24:03 +09:00