القائمة
Validate Telegram WebApp initData (HMAC-SHA256 with key=HMAC_SHA256('WebAppData',bot_token)), mint JWT with chat_ids whitelist, reject auth_date > 24h.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Bump the patch version in server/Cargo.toml or website/package.json after completing a major change. Use when the user asks to bump/release a version, or when CLAUDE.md's rule about version bumps after major changes applies.
Before a non-trivial change, list affected systems — DB schema, API contract, Telegram handlers, jobs, TS types, docs. Catch ripple effects upfront, not after CI fails. Use when planning a feature, migration, refactor, or any cross-module touch.
Self-review before push — read the diff as a reader, scan for vixen footguns (token leaks, PII, idempotency, captcha asset overwrites), run validation pipeline, no surprise files. Use before "git push", before opening a PR, or when the user says "ready to commit".
Write a git commit message for vixen-rs following the project's Conventional Commits convention. Use when the user asks to commit, create a commit, or write a commit message.
Reproduce → bisect → root cause → fix → verify. Don't speculate, don't "add more error handling" as a guess. Use when something is broken, when a test fails intermittently, when the user says "this isn't working" or "investigate why".
Write small, fast, reproducible Dockerfiles for the vixen-rs server (Rust) and website (bun) using multi-stage builds, cache mounts, distroless/alpine runtime images, and non-root users. Use when editing server/Dockerfile, website/Dockerfile, docker-compose.yml, or when the user asks to shrink an image or speed up a Docker build.
| name | tg-webapp-auth |
| description | Validate Telegram WebApp initData (HMAC-SHA256 with key=HMAC_SHA256('WebAppData',bot_token)), mint JWT with chat_ids whitelist, reject auth_date > 24h. |
Read first:
initData; parse into key-value pairs; remove hash.key=value with \n → data-check-string.secret_key = HMAC_SHA256(key="WebAppData", message=BOT_TOKEN).expected_hash = hex(HMAC_SHA256(key=secret_key, message=data_check_string)).expected_hash vs hash (use subtle::ConstantTimeEq).auth_date < now_unix - 86400 (24h).user JSON (user.id is i64); look up chat_moderators; collect chat_ids.CONFIG_JWT_SECRET, not bot token) with {sub, exp: now+1h, chat_ids, tg: {username, first_name}}.server/src/services/auth_service.rs — validator + JWT mint.server/src/api/routes_auth.rs — POST /auth/telegram/webapp.HMAC_SHA256(key="WebAppData", message=bot_token). Login Widget uses SHA256(bot_token) — different algorithm. Don't confuse the two.i64. Always.auth_date > 24h old, per spec.initData above debug level. Carries user.first_name, user.username, possibly user.phone_number in some flows.RedactedToken from src/utils/redact.rs if you must log a token-shaped string for debugging.cargo test auth_service — known-good and known-bad fixtures./tg-init-debug slash command for ad-hoc validation in dev.telegram-login-widget — browser-mode counterpart (different secret).add-api-route — routes_auth.rs wiring.