Add Telegram moderator application mini app

tests/telegram-webapp.test.ts

@@ -0,0 +1,27 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import { verifyTelegramInitData } from "../lib/telegram-webapp";
+
+const token = "123:test-token";
+function signedData(authDate = Math.floor(Date.now() / 1000)) {
+  const params = new URLSearchParams({
+    auth_date: String(authDate),
+    query_id: "query",
+    user: JSON.stringify({ id: 12345, username: "applicant" }),
+  });
+  const check = [...params.entries()].sort(([a], [b]) => a.localeCompare(b))
+    .map(([key, value]) => key + "=" + value).join("\n");
+  const secret = createHmac("sha256", "WebAppData").update(token).digest();
+  params.set("hash", createHmac("sha256", secret).update(check).digest("hex"));
+  return params.toString();
+}
+
+test("Telegram init data verifies identity and rejects tampering, duplicates, and expired data", () => {
+  const data = signedData();
+  assert.deepEqual(verifyTelegramInitData(data, token), { id: "12345", username: "applicant" });
+  assert.equal(verifyTelegramInitData(data, "wrong-token"), null);
+  assert.equal(verifyTelegramInitData(data.replace("applicant", "impostor"), token), null);
+  assert.equal(verifyTelegramInitData(data + "&user=other", token), null);
+  assert.equal(verifyTelegramInitData(signedData(Math.floor(Date.now() / 1000) - 90000), token), null);
+});