메뉴
Validate Telegram WebApp initData (HMAC-SHA256 with key=HMAC_SHA256('WebAppData',bot_token)), mint JWT with chat_ids whitelist, reject auth_date > 24h.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Bump the patch version in server/Cargo.toml or website/package.json after completing a major change. Use when the user asks to bump/release a version, or when CLAUDE.md's rule about version bumps after major changes applies.
Before a non-trivial change, list affected systems — DB schema, API contract, Telegram handlers, jobs, TS types, docs. Catch ripple effects upfront, not after CI fails. Use when planning a feature, migration, refactor, or any cross-module touch.
Self-review before push — read the diff as a reader, scan for vixen footguns (token leaks, PII, idempotency, captcha asset overwrites), run validation pipeline, no surprise files. Use before "git push", before opening a PR, or when the user says "ready to commit".
Write a git commit message for vixen-rs following the project's Conventional Commits convention. Use when the user asks to commit, create a commit, or write a commit message.
Reproduce → bisect → root cause → fix → verify. Don't speculate, don't "add more error handling" as a guess. Use when something is broken, when a test fails intermittently, when the user says "this isn't working" or "investigate why".
Write small, fast, reproducible Dockerfiles for the vixen-rs server (Rust) and website (bun) using multi-stage builds, cache mounts, distroless/alpine runtime images, and non-root users. Use when editing server/Dockerfile, website/Dockerfile, docker-compose.yml, or when the user asks to shrink an image or speed up a Docker build.
| name | tg-webapp-auth |
| description | Validate Telegram WebApp initData (HMAC-SHA256 with key=HMAC_SHA256('WebAppData',bot_token)), mint JWT with chat_ids whitelist, reject auth_date > 24h. |
Read first:
initData; parse into key-value pairs; remove hash.key=value with \n → data-check-string.secret_key = HMAC_SHA256(key="WebAppData", message=BOT_TOKEN).expected_hash = hex(HMAC_SHA256(key=secret_key, message=data_check_string)).expected_hash vs hash (use subtle::ConstantTimeEq).auth_date < now_unix - 86400 (24h).user JSON (user.id is i64); look up chat_moderators; collect chat_ids.CONFIG_JWT_SECRET, not bot token) with {sub, exp: now+1h, chat_ids, tg: {username, first_name}}.server/src/services/auth_service.rs — validator + JWT mint.server/src/api/routes_auth.rs — POST /auth/telegram/webapp.HMAC_SHA256(key="WebAppData", message=bot_token). Login Widget uses SHA256(bot_token) — different algorithm. Don't confuse the two.i64. Always.auth_date > 24h old, per spec.initData above debug level. Carries user.first_name, user.username, possibly user.phone_number in some flows.RedactedToken from src/utils/redact.rs if you must log a token-shaped string for debugging.cargo test auth_service — known-good and known-bad fixtures./tg-init-debug slash command for ad-hoc validation in dev.telegram-login-widget — browser-mode counterpart (different secret).add-api-route — routes_auth.rs wiring.