Ilia Denisov
6aeb529f13
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 10s
CI / integration (pull_request) Successful in 15s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 1s
CI / deploy (pull_request) Failing after 2m6s
Move all Telegram egress off the main host. The single connector held the bot token, long-polled Telegram and answered the gateway/backend over the trusted internal network, so the whole component (including login validation) shared fate with its VPN sidecar. Split it into two binaries that share the token: - cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only, never calls the Bot API. The gateway dials it for Telegram auth, so game login is now independent of Telegram reachability. - cmd/bot (remote): Bot API long-poll + sendMessage, the only component reaching Telegram. It holds no inbound port — it dials the gateway over a new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send commands the gateway pushes. The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget (at-most-once, dropped if no bot is connected); the backend admin broadcasts reach a gateway-served relay that forwards them and awaits the bot's ack (SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one inter-service link that leaves the trusted segment; validator<->gateway and the relay stay plaintext internal. The bot is Telegram-rate-limited. One bot now; the gateway bot registry, an owns_updates flag and per-command ids leave seams for N later. Webhook rejected (one URL per token, adds inbound + a static address). The unified test contour runs the split (the bot keeps its VPN sidecar and dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh, generated in CI). The prod wiring — the bot on a separate host (no VPN), the gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX, Stage 18). Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway + backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.
88 lines
2.3 KiB
Go
88 lines
2.3 KiB
Go
package botlink
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"testing"
|
|
"time"
|
|
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials/insecure"
|
|
|
|
botlinkv1 "scrabble/pkg/proto/botlink/v1"
|
|
telegramv1 "scrabble/pkg/proto/telegram/v1"
|
|
)
|
|
|
|
// testLinkServer registers one bot, pushes a single Notify command, and records the
|
|
// Ack the client returns.
|
|
type testLinkServer struct {
|
|
botlinkv1.UnimplementedBotLinkServer
|
|
acks chan *botlinkv1.Ack
|
|
}
|
|
|
|
func (s *testLinkServer) Link(stream grpc.BidiStreamingServer[botlinkv1.FromBot, botlinkv1.ToBot]) error {
|
|
hello, err := stream.Recv()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if hello.GetHello() == nil {
|
|
return fmt.Errorf("first message was not Hello")
|
|
}
|
|
if err := stream.Send(&botlinkv1.ToBot{Command: &botlinkv1.Command{
|
|
CommandId: "c1",
|
|
Payload: &botlinkv1.Command_Notify{Notify: &telegramv1.NotifyRequest{
|
|
ExternalId: "12345", Kind: "your_turn",
|
|
Payload: yourTurnPayload("7c9e6679-7425-40de-944b-e07fc1f90ae7"), Language: "en",
|
|
}},
|
|
}}); err != nil {
|
|
return err
|
|
}
|
|
for {
|
|
msg, err := stream.Recv()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if ack := msg.GetAck(); ack != nil {
|
|
s.acks <- ack
|
|
return nil
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestClientServesCommands verifies the bot client dials, registers, executes a
|
|
// pushed command through the executor, and acks it.
|
|
func TestClientServesCommands(t *testing.T) {
|
|
lis, err := net.Listen("tcp", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatalf("listen: %v", err)
|
|
}
|
|
ts := &testLinkServer{acks: make(chan *botlinkv1.Ack, 1)}
|
|
srv := grpc.NewServer()
|
|
botlinkv1.RegisterBotLinkServer(srv, ts)
|
|
go func() { _ = srv.Serve(lis) }()
|
|
t.Cleanup(srv.Stop)
|
|
|
|
sender := &fakeSender{}
|
|
client := NewClient(ClientConfig{
|
|
GatewayAddr: lis.Addr().String(),
|
|
InstanceID: "test",
|
|
Creds: insecure.NewCredentials(),
|
|
ReconnectDelay: 50 * time.Millisecond,
|
|
}, NewExecutor(sender, 0, nil), nil)
|
|
|
|
go func() { _ = client.Run(t.Context()) }()
|
|
|
|
select {
|
|
case ack := <-ts.acks:
|
|
if ack.GetCommandId() != "c1" || !ack.GetDelivered() {
|
|
t.Errorf("ack = %+v, want command_id c1 delivered=true", ack)
|
|
}
|
|
case <-time.After(2 * time.Second):
|
|
t.Fatal("server received no ack")
|
|
}
|
|
// The channel receive above happens-after the client wrote the sender call.
|
|
if len(sender.notify) != 1 || sender.notify[0].chatID != 12345 {
|
|
t.Errorf("sender notify calls = %+v, want one call to chat 12345", sender.notify)
|
|
}
|
|
}
|