pavel444-byte
e5a07755e7
Some checks failed
Deploy MineGeo to Dokploy / deploy (push) Failing after 4m46s
30 lines
1.5 KiB
TypeScript
30 lines
1.5 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { createHmac } from "node:crypto";
|
|
import { verifyTelegramInitData } from "../lib/telegram-webapp";
|
|
|
|
const token = "123:test-token";
|
|
function signedData(authDate = Math.floor(Date.now() / 1000)) {
|
|
const params = new URLSearchParams({
|
|
auth_date: String(authDate),
|
|
query_id: "query",
|
|
user: JSON.stringify({ id: 12345, username: "applicant" }),
|
|
});
|
|
const check = [...params.entries()].sort(([a], [b]) => a.localeCompare(b))
|
|
.map(([key, value]) => key + "=" + value).join("\n");
|
|
const secret = createHmac("sha256", "WebAppData").update(token).digest();
|
|
params.set("hash", createHmac("sha256", secret).update(check).digest("hex"));
|
|
return params.toString();
|
|
}
|
|
|
|
test("Telegram init data verifies identity and rejects tampering, duplicates, and expired data", () => {
|
|
const data = signedData();
|
|
assert.deepEqual(verifyTelegramInitData(data, token), { id: "12345", username: "applicant" });
|
|
assert.equal(verifyTelegramInitData(data, "wrong-token"), null);
|
|
assert.equal(verifyTelegramInitData(data.replace("applicant", "impostor"), token), null);
|
|
assert.equal(verifyTelegramInitData(data + "&user=other", token), null);
|
|
assert.equal(verifyTelegramInitData(data + "&auth_date=1", token), null);
|
|
assert.equal(verifyTelegramInitData(data.replace(/hash=[a-f0-9]+/, "hash=not-a-hash"), token), null);
|
|
assert.equal(verifyTelegramInitData(signedData(Math.floor(Date.now() / 1000) - 90000), token), null);
|
|
});
|