Menu
Validate Telegram WebApp initData (HMAC-SHA256 with key=HMAC_SHA256('WebAppData',bot_token)), mint JWT with chat_ids whitelist, reject auth_date > 24h.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Bump the patch version in server/Cargo.toml or website/package.json after completing a major change. Use when the user asks to bump/release a version, or when CLAUDE.md's rule about version bumps after major changes applies.
Before a non-trivial change, list affected systems — DB schema, API contract, Telegram handlers, jobs, TS types, docs. Catch ripple effects upfront, not after CI fails. Use when planning a feature, migration, refactor, or any cross-module touch.
Self-review before push — read the diff as a reader, scan for vixen footguns (token leaks, PII, idempotency, captcha asset overwrites), run validation pipeline, no surprise files. Use before "git push", before opening a PR, or when the user says "ready to commit".
Write a git commit message for vixen-rs following the project's Conventional Commits convention. Use when the user asks to commit, create a commit, or write a commit message.
Reproduce → bisect → root cause → fix → verify. Don't speculate, don't "add more error handling" as a guess. Use when something is broken, when a test fails intermittently, when the user says "this isn't working" or "investigate why".
Write small, fast, reproducible Dockerfiles for the vixen-rs server (Rust) and website (bun) using multi-stage builds, cache mounts, distroless/alpine runtime images, and non-root users. Use when editing server/Dockerfile, website/Dockerfile, docker-compose.yml, or when the user asks to shrink an image or speed up a Docker build.
| name | tg-webapp-auth |
| description | Validate Telegram WebApp initData (HMAC-SHA256 with key=HMAC_SHA256('WebAppData',bot_token)), mint JWT with chat_ids whitelist, reject auth_date > 24h. |
Read first:
initData; parse into key-value pairs; remove hash.key=value with \n → data-check-string.secret_key = HMAC_SHA256(key="WebAppData", message=BOT_TOKEN).expected_hash = hex(HMAC_SHA256(key=secret_key, message=data_check_string)).expected_hash vs hash (use subtle::ConstantTimeEq).auth_date < now_unix - 86400 (24h).user JSON (user.id is i64); look up chat_moderators; collect chat_ids.CONFIG_JWT_SECRET, not bot token) with {sub, exp: now+1h, chat_ids, tg: {username, first_name}}.server/src/services/auth_service.rs — validator + JWT mint.server/src/api/routes_auth.rs — POST /auth/telegram/webapp.HMAC_SHA256(key="WebAppData", message=bot_token). Login Widget uses SHA256(bot_token) — different algorithm. Don't confuse the two.i64. Always.auth_date > 24h old, per spec.initData above debug level. Carries user.first_name, user.username, possibly user.phone_number in some flows.RedactedToken from src/utils/redact.rs if you must log a token-shaped string for debugging.cargo test auth_service — known-good and known-bad fixtures./tg-init-debug slash command for ad-hoc validation in dev.telegram-login-widget — browser-mode counterpart (different secret).add-api-route — routes_auth.rs wiring.