feat: check telegram subscriptions

src/api/telegram-subscription/controllers/telegram-subscription.ts

@@ -15,19 +15,39 @@ export default factories.createCoreController(MODULE_ID, ({strapi}) => {
 
       const service = strapi.service(MODULE_ID)
 
-      const existing = await strapi.entityService.findMany(MODULE_ID, { filters: { account, chatId: data.id } })
+      const isAlreadySubscribed = await this.checkSubscription(context)
+
+      if (isAlreadySubscribed) {
+        return true
+      }
 
-      if (existing.length > 0) return true
+      await service.addSubscription(account, data)
+
+      return true
+    },
+    async checkSubscription(context) {
+      const {account, data} : { account: string, data: TelegramData } = context.request.body
+
+      const service = strapi.service(MODULE_ID)
 
       const result = await service.verifyTgAuthentication(data)
 
+      /**
+       * Verify if the Telegram authentication data is valid
+       * Which proves that the data belongs to the user
+       */
       if (!result) {
         throw new errors.ValidationError('Invalid telegram authentication data')
       }
 
-      await service.addSubscription(account, data)
+      const existing = await strapi.entityService.findMany(MODULE_ID, { filters: { account, chatId: data.id } })
 
-      return true
+      /**
+       * We will only return true if the subscription belongs to the Telegram owner
+       * And the account is already subscribed
+       * So, it's not possible to check another account's subscription without owning Telegram account
+       */
+      return existing.length > 0
     },
     async getSubscriptions(context) {
       const { accounts } = context.query

src/api/telegram-subscription/routes/telegram-subscription.ts

@@ -47,6 +47,15 @@ const myExtraRoutes = [
       middlewares: [],
     },
   },
+  {
+    method: 'POST',
+    path: '/check-tg-subscription',
+    handler: 'telegram-subscription.checkSubscription',
+    config: {
+      policies: [],
+      middlewares: [],
+    },
+  },
   {
     method: 'GET',
     path: '/send-tg-notifications',

src/extensions/documentation/documentation/1.0.0/full_documentation.json

@@ -14,7 +14,7 @@
       "name": "Apache 2.0",
       "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
     },
-    "x-generation-date": "2025-03-13T18:32:30.099Z"
+    "x-generation-date": "2025-04-16T15:57:18.119Z"
   },
   "x-strapi-config": {
     "path": "/documentation",