Telegram login

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","Goldworkspace","name","gold-signal-bot","path","telegram_login.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/Goldworkspace/gold-signal-bot/code/telegram_login.ts","extension","id","7670fca0-66b3-4026-96c6-08ed4e49986f","fileId","134a1454-a9ed-11f1-9c33-1607ee4eb77e","parentId","branchId","052f6539-63b6-428e-bd86-f7c5cd7e6c65","branchVersion",106,"latest",true,"createdAt",["D",1788697386784],"version",5,"fileType","script","content","/* ============================================================\n TELEGRAM MTProto LOGIN — log into YOUR account (web login style).\n Since Val Town is serverless (no persistent in-memory client), the\n login state is snapshotted into SQLite between steps.\n\n Flow:\n 1. POST /tg-login { phone: \"+123...\" } -> sends a code to the account\n 2. user reads the 5-digit code in Telegram, then:\n POST /tg-login { phone, code } -> saves the session\n 3. The session is stored (TG_MT_PROTO_SESSION) and used by /tg-scan.\n ============================================================ */\n\nimport { TelegramClient } from \"npm:telegram\";\nimport { StringSession } from \"npm:telegram/sessions/index.js\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { apiCredentials } from \"./telegram_mtproto.ts\";\n\n/** Persist login state (snapshot of the client session + code hash) so the\n next HTTP invocation can resume it. */\nasync function saveState(phone: string, phoneCodeHash: string, session: string) {\n await sqlite.execute(\n `INSERT INTO tg_login(phone, phone_code_hash, session, updated_at)\n VALUES (?,?,?,?) ON CONFLICT(phone) DO UPDATE SET\n phone_code_hash=excluded.phone_code_hash, session=excluded.session, updated_at=excluded.updated_at`,\n [phone, phoneCodeHash, session, new Date().toISOString()]\n );\n}\nasync function loadState(phone: string): Promise<{ phoneCodeHash: string; session: string } | null> {\n const r = await sqlite.execute({ sql: \"SELECT phone_code_hash, session FROM tg_login WHERE phone=?\", args: [phone] });\n const row = (r as any).rows?.[0];\n return row ? { phoneCodeHash: String(row.phone_code_hash), session: String(row.session) } : null;\n}\n\nexport async function initLoginTables() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS tg_login (\n phone TEXT PRIMARY KEY, phone_code_hash TEXT NOT NULL, session TEXT NOT NULL, updated_at TEXT)`\n );\n}\n\n/** Step 1: send the login code to `phone`. Returns a state snapshot so the\n code can be confirmed later. */\nexport async function startPhoneLogin(phone: string): Promise<{ sent: boolean; hint?: string; next?: string }> {\n const creds = await apiCredentials();\n if (!creds) return { sent: false, hint: \"config\", next: \"Set TG_API_ID / TG_API_HASH in the bot Settings (my.telegram.org) first.\" };\n const client = new TelegramClient(new StringSession(\"\"), creds.apiId, creds.apiHash, { connectionRetries: 2 });\n const closedSession = new StringSession(\"\");\n await client.connect();\n try {\n const res = await client.sendCode({ apiId: creds.apiId, apiHash: creds.apiHash, phoneNumber: phone });\n const snap = await client.session.save();\n await saveState(phone, res.phoneCodeHash, snap);\n // clob the module-level session so nothing lingers in memory\n closedSession.load(snap as never);\n return { sent: true, hint: res.type ?? \"telegram\", next: \"POST /tg-login with phone + code\" };\n } finally {\n await client.disconnect().catch(() => {});\n }\n}\n\n/** Step 2: confirm the code and save the authenticated session string. */\nexport async function confirmPhoneLogin(phone: string, code: string): Promise<{ ok: boolean; session?: string; error?: string }> {\n const creds = await apiCredentials();\n if (!creds) return { ok: false, error: \"Set TG_API_ID / TG_API_HASH in the bot Settings first.\" };\n const { apiId, apiHash } = creds;\n const st = await loadState(phone);\n if (!st) return { ok: false, error: \"No pending login for this phone. Call POST /tg-login {phone} first.\" };\n\n const client = new TelegramClient(new StringSession(st.session), apiId, apiHash, { connectionRetries: 2 });\n await client.connect();\n try {\n // If the account uses 2FA, sign-in may require password. We surface it.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n const signIn = await (client as any).invoke(\n // eslint-disable-next-line @typescript-eslint/no-var-requires\n new (await import(\"npm:telegram/tl/index.js\")).Api.auth.SignIn({\n phoneNumber: phone,\n phoneCodeHash: st.phoneCodeHash,\n phoneCode: code,\n })\n );\n await client.start({ phoneNumber: () => Promise.resolve(phone), password: () => Promise.resolve(\"\"), phoneCode: () => Promise.resolve(code), onError: () => {} }).catch(() => {});\n const session = await client.session.save();\n return { ok: true, session };\n } catch (e: unknown) {\n const msg = e instanceof Error ? e.message : String(e);\n if (/SESSION_PASSWORD_NEEDED|Two-steps|2FA|password/i.test(msg)) {\n return { ok: false, error: \"This account has two-step verification. Enter your password as the 'code' (or send it separately) and retry.\" };\n }\n return { ok: false, error: msg };\n } finally {\n await client.disconnect().catch(() => {});\n }\n}\n\nexport function htmlLogin(origin: string): string {\n return `Telegram login\n\n

🔐 Login to your Telegram account

This logs the bot in as you so it can read the Savanna channel directly.
\nRisk: running a \"userbot\" on a personal account can get it banned. Consider a spare account.

\n`;\n}\n\nexport function splitSession(s: string): string {\n return s;\n}\n","deleted",false,"label",[14],"8caac29c-f32e-4f26-ab69-b12a18b3597b",["D",1788687592224],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Telegram XAUUSD signal parse, risk-size and journal on Val Town","imageUrl","userId","5405944a-128b-47c4-af73-76e267e46fec","pinnedFileId","f53e80aa-a9d6-11f1-bbcc-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07610-2b05-75c8-9aa5-3b4cbaeb8839","tursoName","8caac29cf32e4f26ab69b12a18b3597b","tursoHostname","8caac29cf32e4f26ab69b12a18b3597b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789472446807],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_55":56,"_103":104,"_105":42},"branch",{"_35":89,"_11":90,"_22":28,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",111,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Muiruri Muiruri Ngugi","avatar","https://lh3.googleusercontent.com/a/ACg8ocIL2QlMIcfe6TlJejp2TWNHfbtZXNrBQnQytRRElr7jGsxE1g=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":32,"_150":-5,"_151":-7,"_152":-7,"_153":63,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":90,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]