refactor: extract env vars

.env.example

@@ -1,2 +1,2 @@
+TOKEN=2tZZ9rnH # random string
 BOT_TOKEN=xxxxxx:xxxxxx
-SECRET_HASH=2tZZ9rnH # random string

README.md

@@ -9,15 +9,15 @@ Built top of [Nitro](https://nitro.unjs.io/) and [Telegraf](https://telegraf.js.
 1. Create a bot with [@BotFather](https://t.me/BotFather), and get the bot token.
 2. Clone this repo.
 3. Run `pnpm install` to install dependencies.
-4. Copy `.env.example` to `.env`, and fill in the `BOT_TOKEN` and `SECRET_HASH` in `.env`.
+4. Copy `.env.example` to `.env`, and fill in the `BOT_TOKEN` and `TOKEN` in `.env`.
 5. Run `pnpm dev` to start the development server.
 6. Expose your local server to the internet with [Local Port Forwarding of VSCode](https://code.visualstudio.com/docs/editor/port-forwarding) (**set Port Visibility to Public**) or [ngrok](https://ngrok.com/).
 7. Visit https://your-domain.com/telegram-hook?setWebhook=true
 8. Send `/start` to your bot.
 
 ## Deployment
 
-1. Deploy on [Vercel](https://vercel.com), [Netlify](https://netlify.com) or [others](https://nitro.unjs.io/deploy), with `BOT_TOKEN` and `SECRET_HASH` environment variables.
+1. Deploy on [Vercel](https://vercel.com), [Netlify](https://netlify.com) or [others](https://nitro.unjs.io/deploy), with `BOT_TOKEN` and `TOKEN` environment variables.
 2. Visit https://your-domain.com/telegram-hook?setWebhook=true
 3. Send `/start` to your bot.
 

middleware/auth.ts

@@ -0,0 +1,12 @@
+import { TOKEN } from '~/src/env'
+
+export default defineEventHandler((event) => {
+  const query = getQuery(event)
+  if (query.token !== TOKEN) {
+    throw createError({
+      status: 401,
+      statusMessage: 'Unauthorized',
+      message: 'Invalid token',
+    })
+  }
+})

routes/set-webhook.ts

@@ -1,20 +1,15 @@
 import process from 'node:process'
 import { bot } from '../src'
 
-const SECRET_HASH = process.env.SECRET_HASH!
+const TOKEN = process.env.TOKEN!
 
 export default eventHandler(async (evt) => {
-  const query = getQuery(evt)
-  if (!process.dev && query.secret_hash !== SECRET_HASH) {
-    return 'Forbidden'
-  }
-
   const host = getRequestHeader(evt, 'x-forwarded-host') || getRequestHost(evt)
-  const webhookUrl = `https://${host}/telegram-hook?secret_hash=${SECRET_HASH}`
+  const webhookUrl = `https://${host}/telegram-hook?token=${TOKEN}`
   const isSet = await bot.telegram.setWebhook(webhookUrl)
   const info = await bot.telegram.getWebhookInfo()
   return `Set webhook to ${webhookUrl.replaceAll(
-    SECRET_HASH,
+    TOKEN,
     '*',
-  )}: ${isSet}<br/>${JSON.stringify(info).replaceAll(SECRET_HASH, '*')}`
+  )}: ${isSet}<br/>${JSON.stringify(info).replaceAll(TOKEN, '*')}`
 })

routes/telegram-hook.ts

@@ -1,14 +1,6 @@
-import process from 'node:process'
 import { bot } from '../src'
 
-const SECRET_HASH = process.env.SECRET_HASH!
-
 export default eventHandler(async (evt) => {
-  const query = getQuery(evt)
-  if (query.secret_hash !== SECRET_HASH) {
-    return 'Forbidden'
-  }
-
   const body = await readBody(evt)
   await bot.handleUpdate(body)
   return 'OK'

src/env.ts

@@ -0,0 +1,8 @@
+import process from 'node:process'
+
+export const TOKEN = process.env.TOKEN!
+export const BOT_TOKEN = process.env.BOT_TOKEN!
+
+if (!TOKEN || !BOT_TOKEN) {
+  throw new Error('missing env')
+}

src/index.ts

@@ -1,7 +1,6 @@
-import process from 'node:process'
 import { Telegraf } from 'telegraf'
+import { BOT_TOKEN } from './env'
 
-const BOT_TOKEN = process.env.BOT_TOKEN!
 export const bot = new Telegraf(BOT_TOKEN)
 
 bot.start((ctx) => ctx.reply('Welcome!'))