diff --git a/src/api/telegram-subscription/controllers/telegram-subscription.ts b/src/api/telegram-subscription/controllers/telegram-subscription.ts index 45cfa34..b83a4c0 100644 --- a/src/api/telegram-subscription/controllers/telegram-subscription.ts +++ b/src/api/telegram-subscription/controllers/telegram-subscription.ts @@ -15,19 +15,39 @@ export default factories.createCoreController(MODULE_ID, ({strapi}) => { const service = strapi.service(MODULE_ID) - const existing = await strapi.entityService.findMany(MODULE_ID, { filters: { account, chatId: data.id } }) + const isAlreadySubscribed = await this.checkSubscription(context) + + if (isAlreadySubscribed) { + return true + } - if (existing.length > 0) return true + await service.addSubscription(account, data) + + return true + }, + async checkSubscription(context) { + const {account, data} : { account: string, data: TelegramData } = context.request.body + + const service = strapi.service(MODULE_ID) const result = await service.verifyTgAuthentication(data) + /** + * Verify if the Telegram authentication data is valid + * Which proves that the data belongs to the user + */ if (!result) { throw new errors.ValidationError('Invalid telegram authentication data') } - await service.addSubscription(account, data) + const existing = await strapi.entityService.findMany(MODULE_ID, { filters: { account, chatId: data.id } }) - return true + /** + * We will only return true if the subscription belongs to the Telegram owner + * And the account is already subscribed + * So, it's not possible to check another account's subscription without owning Telegram account + */ + return existing.length > 0 }, async getSubscriptions(context) { const { accounts } = context.query diff --git a/src/api/telegram-subscription/routes/telegram-subscription.ts b/src/api/telegram-subscription/routes/telegram-subscription.ts index f214d87..4045975 100644 --- a/src/api/telegram-subscription/routes/telegram-subscription.ts +++ b/src/api/telegram-subscription/routes/telegram-subscription.ts @@ -47,6 +47,15 @@ const myExtraRoutes = [ middlewares: [], }, }, + { + method: 'POST', + path: '/check-tg-subscription', + handler: 'telegram-subscription.checkSubscription', + config: { + policies: [], + middlewares: [], + }, + }, { method: 'GET', path: '/send-tg-notifications', diff --git a/src/extensions/documentation/documentation/1.0.0/full_documentation.json b/src/extensions/documentation/documentation/1.0.0/full_documentation.json index 1df0b44..bc90dde 100644 --- a/src/extensions/documentation/documentation/1.0.0/full_documentation.json +++ b/src/extensions/documentation/documentation/1.0.0/full_documentation.json @@ -14,7 +14,7 @@ "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, - "x-generation-date": "2025-03-13T18:32:30.099Z" + "x-generation-date": "2025-04-16T15:57:18.119Z" }, "x-strapi-config": { "path": "/documentation",