fix(gateway): constantize Telegram API URL + reject empty LINE source IDs

[masami-agent]

Discord Discussion URL: https://discord.com/channels/1488041051187974246/1497258664090931280

Description

Two hardening fixes from the deferred review items (#676).

Changes

#10 — Telegram API URL constant

Extract TELEGRAM_API_BASE constant, replacing 3 hardcoded https://api.telegram.org URLs. Matches LINE's LINE_API_BASE pattern. Enables future mock testing for Telegram adapter.

Before	After
format!("https://api.telegram.org/bot{bot_token}/sendMessage")	format!("{TELEGRAM_API_BASE}/bot{bot_token}/sendMessage")

#11 — LINE empty source ID rejection

Replace unwrap_or_default() with explicit empty-check + reject for LINE source IDs (groupId, roomId, userId).

Per LINE API contract, these IDs are guaranteed present for their respective source types:

• source.type == "group" → groupId always present
• source.type == "room" → roomId always present
• source.type == "user" → userId always present

Empty ID = anomalous payload → reject with warning log (fail-closed).

Before	After
s.group_id.clone().unwrap_or_default() (empty string enters session pool)	match s.group_id { Some(id) if !id.is_empty() => ..., _ => { warn!(...); continue; } }

Risk Assessment

• Telegram: Zero risk — pure string extraction, URL values unchanged
• LINE: Low risk — LINE API guarantees IDs are present. Only rejects anomalous payloads that would cause worse problems downstream (all broken events sharing one session)

Tests

Existing 6 LINE dispatch tests unaffected (test reply/push routing, not source parsing).

Partial fix for #676

[masami-agent]

PR Review: #678

Summary

• Problem: Telegram API URLs hardcoded (no mock testing), LINE empty source IDs silently accepted
• Approach: Extract constant + fail-closed validation
• Risk level: #10 zero, #11 low (LINE API guarantees IDs present)

Core Assessment

1. Problem clearly stated: ✅ — partial fix for #676
2. Approach appropriate: ✅
3. Best approach for now: ✅

#10 — Telegram URL constant ✅

• TELEGRAM_API_BASE defined as pub const — matches LINE's LINE_API_BASE pattern
• All 3 URLs replaced: createForumTopic, setMessageReaction, sendMessage
• URL values unchanged — pure refactor, zero behavior change
• pub visibility enables future test files to reference it

Verdict: No issues.

#11 — LINE empty source ID rejection ✅

• All 3 unwrap_or_default() replaced with match + empty check + continue
• Warning log includes source type and missing field name — good for debugging
• continue skips only the affected event, not the entire webhook batch — correct

Security review (fail-closed check):

• groupId missing → reject ✅
• roomId missing → reject ✅
• userId missing → reject ✅
• source: None → continue (already existed) ✅
• No if let / silent pass patterns — all paths either produce a valid ID or reject ✅

LINE API contract verification:
Per LINE docs, source object schema guarantees:

• type: group → groupId present
• type: room → roomId present
• type: user → userId present

Empty ID would indicate anomalous payload. Rejecting is correct.

Existing tests: 6 LINE dispatch tests test reply/push routing with pre-constructed GatewayReply objects — they don't go through source parsing. Unaffected. ✅

Verdict

APPROVE — both changes are clean and correct.

Note: Cannot submit binding approval on own PR.

[obrutjack]

Clean small fixes — Telegram API URL constant + LINE empty source ID rejection. LGTM.

[chaodu-agent]

四法師 Triage Review — PR #678 (2026-05-01)

LGTM ✅ — Clean hardening fixes. Ready to merge.

Review Details

🟢 INFO

• Telegram TELEGRAM_API_BASE constant: Pure refactor, zero behavior change. Matches LINE's LINE_API_BASE pattern. Enables future mock testing.
• LINE empty source ID rejection: Fail-closed is correct. LINE API guarantees IDs are present for their respective source types — empty ID = anomalous payload that would cause session pool corruption downstream.
• Both changes are minimal, well-scoped, and low-risk.
• Already has 1 APPROVE (obrutjack) + detailed COMMENT review (masami-agent).
• MERGEABLE status — no conflicts.

🟡 NIT

• (none)

🔴 SUGGESTED CHANGES

• (none)

Reviewed by 超渡法師 on behalf of the 四法師 triage team.

<@1493128125402320996> <@1496097857940361326> <@1496553369442189472> — 小 PR，hardening fixes，LGTM。有異議請補充。

[masami-agent]

All review feedback addressed — added warning log for LINE None source arm (commit d349b52). Ready for code owner review.