6aeb529f13
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 10s
CI / integration (pull_request) Successful in 15s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 1s
CI / deploy (pull_request) Failing after 2m6s
Move all Telegram egress off the main host. The single connector held the bot token, long-polled Telegram and answered the gateway/backend over the trusted internal network, so the whole component (including login validation) shared fate with its VPN sidecar. Split it into two binaries that share the token: - cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only, never calls the Bot API. The gateway dials it for Telegram auth, so game login is now independent of Telegram reachability. - cmd/bot (remote): Bot API long-poll + sendMessage, the only component reaching Telegram. It holds no inbound port — it dials the gateway over a new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send commands the gateway pushes. The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget (at-most-once, dropped if no bot is connected); the backend admin broadcasts reach a gateway-served relay that forwards them and awaits the bot's ack (SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one inter-service link that leaves the trusted segment; validator<->gateway and the relay stay plaintext internal. The bot is Telegram-rate-limited. One bot now; the gateway bot registry, an owns_updates flag and per-command ids leave seams for N later. Webhook rejected (one URL per token, adds inbound + a static address). The unified test contour runs the split (the bot keeps its VPN sidecar and dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh, generated in CI). The prod wiring — the bot on a separate host (no VPN), the gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX, Stage 18). Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway + backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.
137 lines
5.6 KiB
Go
137 lines
5.6 KiB
Go
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
|
|
// versions:
|
|
// - protoc-gen-go-grpc v1.5.1
|
|
// - protoc (unknown)
|
|
// source: botlink/v1/botlink.proto
|
|
|
|
// Package scrabble.botlink.v1 is the reverse control channel between a remote
|
|
// Telegram bot and the gateway. The bot dials the gateway and opens a single
|
|
// long-lived Link stream (mTLS); once the stream is open the gateway pushes send
|
|
// Commands down it and the bot returns one Ack per command. This keeps the bot
|
|
// egress (the Bot API token, getUpdates long-poll and sendMessage) off the main
|
|
// host with no inbound port on the bot. See docs/ARCHITECTURE.md.
|
|
|
|
package botlinkv1
|
|
|
|
import (
|
|
context "context"
|
|
grpc "google.golang.org/grpc"
|
|
codes "google.golang.org/grpc/codes"
|
|
status "google.golang.org/grpc/status"
|
|
)
|
|
|
|
// This is a compile-time assertion to ensure that this generated file
|
|
// is compatible with the grpc package it is being compiled against.
|
|
// Requires gRPC-Go v1.64.0 or later.
|
|
const _ = grpc.SupportPackageIsVersion9
|
|
|
|
const (
|
|
BotLink_Link_FullMethodName = "/scrabble.botlink.v1.BotLink/Link"
|
|
)
|
|
|
|
// BotLinkClient is the client API for BotLink service.
|
|
//
|
|
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
|
|
//
|
|
// BotLink is the reverse (bot-dials-gateway) control channel. The bot is the gRPC
|
|
// client; once the stream is open the gateway (server) sends Commands at will and
|
|
// the bot returns one Ack per command. Delivery is best-effort, at-most-once: a
|
|
// command lost across a reconnect is not replayed.
|
|
type BotLinkClient interface {
|
|
// Link opens the single bot <-> gateway stream. The first client message is
|
|
// Hello; thereafter the client sends one Ack per received Command.
|
|
Link(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FromBot, ToBot], error)
|
|
}
|
|
|
|
type botLinkClient struct {
|
|
cc grpc.ClientConnInterface
|
|
}
|
|
|
|
func NewBotLinkClient(cc grpc.ClientConnInterface) BotLinkClient {
|
|
return &botLinkClient{cc}
|
|
}
|
|
|
|
func (c *botLinkClient) Link(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FromBot, ToBot], error) {
|
|
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
|
|
stream, err := c.cc.NewStream(ctx, &BotLink_ServiceDesc.Streams[0], BotLink_Link_FullMethodName, cOpts...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
x := &grpc.GenericClientStream[FromBot, ToBot]{ClientStream: stream}
|
|
return x, nil
|
|
}
|
|
|
|
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
|
|
type BotLink_LinkClient = grpc.BidiStreamingClient[FromBot, ToBot]
|
|
|
|
// BotLinkServer is the server API for BotLink service.
|
|
// All implementations must embed UnimplementedBotLinkServer
|
|
// for forward compatibility.
|
|
//
|
|
// BotLink is the reverse (bot-dials-gateway) control channel. The bot is the gRPC
|
|
// client; once the stream is open the gateway (server) sends Commands at will and
|
|
// the bot returns one Ack per command. Delivery is best-effort, at-most-once: a
|
|
// command lost across a reconnect is not replayed.
|
|
type BotLinkServer interface {
|
|
// Link opens the single bot <-> gateway stream. The first client message is
|
|
// Hello; thereafter the client sends one Ack per received Command.
|
|
Link(grpc.BidiStreamingServer[FromBot, ToBot]) error
|
|
mustEmbedUnimplementedBotLinkServer()
|
|
}
|
|
|
|
// UnimplementedBotLinkServer must be embedded to have
|
|
// forward compatible implementations.
|
|
//
|
|
// NOTE: this should be embedded by value instead of pointer to avoid a nil
|
|
// pointer dereference when methods are called.
|
|
type UnimplementedBotLinkServer struct{}
|
|
|
|
func (UnimplementedBotLinkServer) Link(grpc.BidiStreamingServer[FromBot, ToBot]) error {
|
|
return status.Errorf(codes.Unimplemented, "method Link not implemented")
|
|
}
|
|
func (UnimplementedBotLinkServer) mustEmbedUnimplementedBotLinkServer() {}
|
|
func (UnimplementedBotLinkServer) testEmbeddedByValue() {}
|
|
|
|
// UnsafeBotLinkServer may be embedded to opt out of forward compatibility for this service.
|
|
// Use of this interface is not recommended, as added methods to BotLinkServer will
|
|
// result in compilation errors.
|
|
type UnsafeBotLinkServer interface {
|
|
mustEmbedUnimplementedBotLinkServer()
|
|
}
|
|
|
|
func RegisterBotLinkServer(s grpc.ServiceRegistrar, srv BotLinkServer) {
|
|
// If the following call pancis, it indicates UnimplementedBotLinkServer was
|
|
// embedded by pointer and is nil. This will cause panics if an
|
|
// unimplemented method is ever invoked, so we test this at initialization
|
|
// time to prevent it from happening at runtime later due to I/O.
|
|
if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
|
|
t.testEmbeddedByValue()
|
|
}
|
|
s.RegisterService(&BotLink_ServiceDesc, srv)
|
|
}
|
|
|
|
func _BotLink_Link_Handler(srv interface{}, stream grpc.ServerStream) error {
|
|
return srv.(BotLinkServer).Link(&grpc.GenericServerStream[FromBot, ToBot]{ServerStream: stream})
|
|
}
|
|
|
|
// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
|
|
type BotLink_LinkServer = grpc.BidiStreamingServer[FromBot, ToBot]
|
|
|
|
// BotLink_ServiceDesc is the grpc.ServiceDesc for BotLink service.
|
|
// It's only intended for direct use with grpc.RegisterService,
|
|
// and not to be introspected or modified (even as a copy)
|
|
var BotLink_ServiceDesc = grpc.ServiceDesc{
|
|
ServiceName: "scrabble.botlink.v1.BotLink",
|
|
HandlerType: (*BotLinkServer)(nil),
|
|
Methods: []grpc.MethodDesc{},
|
|
Streams: []grpc.StreamDesc{
|
|
{
|
|
StreamName: "Link",
|
|
Handler: _BotLink_Link_Handler,
|
|
ServerStreams: true,
|
|
ClientStreams: true,
|
|
},
|
|
},
|
|
Metadata: "botlink/v1/botlink.proto",
|
|
}
|