Разработка Telegram-бота под ключ

export TG_BOT_TOKEN="123456:ABC..."
export TG_WEBHOOK_SECRET="latin_and_dash_only"

const token = process.env.TG_BOT_TOKEN;

async function tg(method, payload = {}, timeoutMs = 15000) {
  const res = await fetch("https://api.telegram.org/bot" + token + "/" + method, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload),
    signal: AbortSignal.timeout(timeoutMs),
  });
  const data = await res.json();
  if (!data.ok) throw new Error(method + " " + JSON.stringify(data));
  return data.result;
}

const me = await tg("getMe", {});
console.log(me.username, me.id);

let offset = 0;

async function poll() {
  while (true) {
    try {
      const updates = await tg(
        "getUpdates",
        {
          offset,
          timeout: 30,
          allowed_updates: ["message", "callback_query"],
        },
        50000
      );
      for (const update of updates) {
        offset = update.update_id + 1;
        await handleUpdate(update);
      }
    } catch (err) {
      console.error("poll", err.message);
      await new Promise((r) => setTimeout(r, 3000));
    }
  }
}

const info = await tg("getWebhookInfo", {});
console.log(info.url, info.pending_update_count, info.last_error_message);

await tg("deleteWebhook", { drop_pending_updates: false });

await tg("setWebhook", {
  url: "https://night-sniper.ru/api/telegram/webhook",
  secret_token: process.env.TG_WEBHOOK_SECRET,
  allowed_updates: ["message", "callback_query"],
  drop_pending_updates: false,
  max_connections: 40,
});

await tg("deleteWebhook", { drop_pending_updates: false });

const info = await tg("getWebhookInfo", {});
if (info.last_error_message) {
  console.error("webhook last error", info.last_error_date, info.last_error_message);
}

import { timingSafeEqual } from "node:crypto";

export async function POST(req) {
  const secret = process.env.TG_WEBHOOK_SECRET || "";
  const got = req.headers.get("x-telegram-bot-api-secret-token") || "";
  if (!secret || got.length !== secret.length || !timingSafeEqual(Buffer.from(got), Buffer.from(secret))) {
    return new Response("forbidden", { status: 401 });
  }
  const update = await req.json();
  enqueue(update); // таблица, не массив в памяти
  return Response.json({ ok: true });
}

import Database from "better-sqlite3";

const db = new Database("data/tg-updates.db");
db.exec(`
  CREATE TABLE IF NOT EXISTS tg_updates (
    update_id INTEGER PRIMARY KEY,
    payload TEXT NOT NULL,
    done INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL
  )
`);

function enqueue(update) {
  db.prepare(
    `INSERT OR IGNORE INTO tg_updates(update_id, payload, created_at) VALUES(?,?,?)`
  ).run(update.update_id, JSON.stringify(update), Date.now());
}

function takeBatch(limit = 20) {
  return db.prepare(`SELECT update_id, payload FROM tg_updates WHERE done=0 ORDER BY update_id LIMIT ?`).all(limit);
}

function markDone(id) {
  db.prepare(`UPDATE tg_updates SET done=1 WHERE update_id=?`).run(id);
}

location /api/telegram/webhook {
  proxy_pass http://127.0.0.1:3004;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-Proto https;
  proxy_set_header X-Telegram-Bot-Api-Secret-Token $http_x_telegram_bot_api_secret_token;
}

async function sendLeadPrompt(chatId) {
  return tg("sendMessage", {
    chat_id: chatId,
    text: "Что нужно сделать?",
    reply_markup: {
      inline_keyboard: [
        [{ text: "Сайт", callback_data: "need:site" }],
        [{ text: "Бот", callback_data: "need:bot" }],
        [{ text: "CRM", callback_data: "need:crm" }],
      ],
    },
  });
}

async function onCallback(q) {
  await tg("answerCallbackQuery", { callback_query_id: q.id });
  const chatId = q.message.chat.id;
  const need = String(q.data || "").replace("need:", "");
  sessions.set(String(chatId), { stage: "contact", need });
  await tg("sendMessage", {
    chat_id: chatId,
    text: "Оставьте телефон или @username.",
  });
}

const sessions = new Map();

async function handleUpdate(update) {
  if (update.callback_query) {
    await onCallback(update.callback_query);
    return;
  }
  const msg = update.message;
  if (!msg || !msg.chat) return;
  const chatId = msg.chat.id;
  const text = String(msg.text || "").trim();

  if (msg.contact && msg.contact.phone_number) {
    const s = sessions.get(String(chatId)) || {};
    await saveLead({
      chatId,
      need: s.need || "contact-button",
      contact: msg.contact.phone_number,
      name: msg.contact.first_name || null,
    });
    sessions.delete(String(chatId));
    await tg("sendMessage", { chat_id: chatId, text: "Заявку получил. Пароли сюда не присылайте." });
    return;
  }

  if (text === "/start") {
    sessions.set(String(chatId), { stage: "start" });
    await sendLeadPrompt(chatId);
    return;
  }
  const s = sessions.get(String(chatId));
  if (s && s.stage === "contact" && text) {
    await saveLead({ chatId, need: s.need, contact: text });
    sessions.delete(String(chatId));
    await tg("sendMessage", {
      chat_id: chatId,
      text: "Заявку получил. Напишите, если уточните задачу — не присылайте пароли.",
    });
  }
}

function startPayload(text) {
  const m = String(text || "").match(/^\/start(?:@\w+)?(?:\s+(.+))?$/);
  return m && m[1] ? m[1].trim().slice(0, 64) : "";
}

import { createHmac } from "node:crypto";

async function saveLead({ chatId, need, contact, name = null }) {
  const body = JSON.stringify({
    source: "bot_tg",
    source_detail: "tg-bot:lead",
    name,
    phone: /^\+?\d[\d\s()-]+$/.test(contact) ? contact : null,
    tg: contact.startsWith("@") ? contact.slice(1) : String(chatId),
    message: "Нужно: " + (need || ""),
    meta: { tg_chat_id: String(chatId) },
  });
  const headers = { "Content-Type": "application/json" };
  const secret = process.env.LEADS_HUB_SECRET;
  if (secret) {
    headers["x-lead-signature"] = createHmac("sha256", secret).update(body).digest("hex");
  }
  const res = await fetch("https://night-sniper.ru/api/leads/ingest", {
    method: "POST",
    headers,
    body,
  });
  if (!res.ok) throw new Error("ingest " + res.status + " " + (await res.text()));
  return res.json();
}

await tg("sendMessage", {
  chat_id: process.env.TG_ADMIN_CHAT_ID,
  text: "Лид из бота: " + String(chatId),
  disable_web_page_preview: true,
});

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyTelegramInitData(initData, botToken, maxAgeSec = 86400) {
  const params = new URLSearchParams(initData);
  const hash = params.get("hash") || "";
  params.delete("hash");
  const pairs = [...params.entries()].map(([k, v]) => k + "=" + v).sort();
  const dataCheckString = pairs.join("\n");
  const secretKey = createHmac("sha256", "WebAppData").update(botToken).digest();
  const digest = createHmac("sha256", secretKey).update(dataCheckString).digest("hex");
  const a = Buffer.from(digest, "hex");
  const b = Buffer.from(hash, "hex");
  if (a.length !== b.length || !timingSafeEqual(a, b)) return null;
  const authDate = Number(params.get("auth_date") || 0);
  if (!authDate || Date.now() / 1000 - authDate > maxAgeSec) return null;
  const userRaw = params.get("user");
  return userRaw ? JSON.parse(userRaw) : {};
}

await tg("sendMessage", {
  chat_id: chatId,
  text: "Открыть каталог",
  reply_markup: {
    inline_keyboard: [[{ text: "Каталог", web_app: { url: "https://example.com/mini" } }]],
  },
});

export async function notifyUser(channel, id, text) {
  if (channel === "max") return sendMax(id, text);
  if (channel === "tg") return tg("sendMessage", { chat_id: id, text });
  throw new Error("unknown channel");
}

pm2 start tg-lead-bot.js --name tg-lead-bot
pm2 save

import os, time, json, urllib.request

TOKEN = os.environ["TG_BOT_TOKEN"]
API = "https://api.telegram.org/bot" + TOKEN + "/"
offset = 0

def tg(method, payload):
    req = urllib.request.Request(
        API + method,
        data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=50) as res:
        data = json.loads(res.read().decode())
    if not data.get("ok"):
        raise RuntimeError(method + " " + json.dumps(data))
    return data["result"]

while True:
    try:
        updates = tg("getUpdates", {"offset": offset, "timeout": 30, "allowed_updates": ["message", "callback_query"]})
        for u in updates:
            offset = u["update_id"] + 1
            print(u.get("message", {}).get("text") or u.get("callback_query"))
    except Exception as e:
        print("poll", e)
        time.sleep(3)

const token = process.env.TG_BOT_TOKEN;
if (!token) throw new Error("TG_BOT_TOKEN required");

async function tg(method, payload = {}, timeoutMs = 15000) {
  const res = await fetch("https://api.telegram.org/bot" + token + "/" + method, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload),
    signal: AbortSignal.timeout(timeoutMs),
  });
  const data = await res.json();
  if (!data.ok) throw new Error(method + " " + JSON.stringify(data));
  return data.result;
}

const sessions = new Map();
let offset = 0;

async function handleUpdate(update) {
  if (update.callback_query) {
    const q = update.callback_query;
    await tg("answerCallbackQuery", { callback_query_id: q.id });
    const chatId = q.message.chat.id;
    sessions.set(String(chatId), { stage: "contact", need: String(q.data || "") });
    await tg("sendMessage", { chat_id: chatId, text: "Оставьте телефон или @username." });
    return;
  }
  const msg = update.message;
  if (!msg) return;
  const chatId = msg.chat.id;
  const text = String(msg.text || "").trim();
  if (text.startsWith("/start")) {
    await tg("sendMessage", {
      chat_id: chatId,
      text: "Что нужно?",
      reply_markup: {
        inline_keyboard: [
          [{ text: "Сайт", callback_data: "need:site" }],
          [{ text: "Бот", callback_data: "need:bot" }],
        ],
      },
    });
    return;
  }
  const s = sessions.get(String(chatId));
  if (s && s.stage === "contact" && text) {
    await saveLead({ chatId, need: s.need, contact: text });
    sessions.delete(String(chatId));
    await tg("sendMessage", { chat_id: chatId, text: "Заявку получил." });
  }
}

async function main() {
  await tg("deleteWebhook", { drop_pending_updates: false }).catch(() => {});
  const me = await tg("getMe");
  console.log(me.username, me.id);
  while (true) {
    try {
      const updates = await tg("getUpdates", { offset, timeout: 30, allowed_updates: ["message", "callback_query"] }, 50000);
      for (const u of updates) {
        offset = u.update_id + 1;
        await handleUpdate(u);
      }
    } catch (e) {
      console.error(e.message);
      await new Promise((r) => setTimeout(r, 3000));
    }
  }
}

main();

await tg("editMessageText", {
  chat_id: chatId,
  message_id: q.message.message_id,
  text: "Выбрали: бот. Оставьте телефон.",
});

async function tgRetry(method, payload) {
  for (let i = 0; i < 4; i++) {
    const res = await fetch("https://api.telegram.org/bot" + token + "/" + method, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(payload),
    });
    const data = await res.json();
    if (data.ok) return data.result;
    const wait = Number(data.parameters?.retry_after || 0);
    if (res.status === 429 && wait) {
      await new Promise((r) => setTimeout(r, (wait + 1) * 1000));
      continue;
    }
    throw new Error(method + " " + JSON.stringify(data));
  }
}

const info = await tg("getWebhookInfo");
console.log({
  url: info.url,
  pending: info.pending_update_count,
  lastError: info.last_error_message,
  lastErrorAt: info.last_error_date,
  allowed: info.allowed_updates,
});

const lastLeadAt = new Map();

function allowLead(chatId) {
  const now = Date.now();
  const prev = lastLeadAt.get(String(chatId)) || 0;
  if (now - prev < 10 * 60 * 1000) return false;
  lastLeadAt.set(String(chatId), now);
  return true;
}