Rework telegram authorization to use a plug

config/notifications_config.exs

@@ -42,6 +42,6 @@ config :sanbase, Sanbase.Notifications.Discord.ExchangeInflow,
   cooldown_days: {:system, "EXCHANGE_INFLOW_COOLDOWN_DAYS", "1"}
 
 config :sanbase, Sanbase.Telegram,
-  bot_username: {:system, "TELEGRAM_NOTIFICATAIONS_BOT_USERNAME", ""},
-  telegram_endpoint: "${TELEGRAM_ENDPOINT_RANDOM_STRING}",
-  token: "${TELEGRAM_SIGNALS_BOT_TOKEN}"
+  bot_username: {:system, "TELEGRAM_NOTIFICATAIONS_BOT_USERNAME", "SanbaseSignalsStageBot"},
+  telegram_endpoint: {:system, "TELEGRAM_ENDPOINT_RANDOM_STRING", "some_random_string"},
+  token: {:system, "TELEGRAM_SIGNALS_BOT_TOKEN"}

lib/sanbase_web/plug/telegram_match_plug.ex

@@ -0,0 +1,34 @@
+defmodule SanbaseWeb.Plug.TelegramMatchPlug do
+  @moduledoc ~s"""
+  Checks the path if it is really comming from telegram. The endpoint is a secret
+  and is only known by telegram.
+  """
+
+  @behaviour Plug
+
+  import Plug.Conn
+
+  require Sanbase.Utils.Config, as: Config
+
+  def init(opts), do: opts
+
+  def call(%{params: %{"path" => path}} = conn, _) do
+    case path === telegram_endpoint() do
+      true ->
+        conn
+
+      false ->
+        conn
+        |> send_resp(403, "Unauthorized")
+        |> halt()
+    end
+  end
+
+  def call(conn, _) do
+    conn
+    |> send_resp(403, "Unauthorized")
+    |> halt()
+  end
+
+  defp telegram_endpoint(), do: Config.module_get(Sanbase.Telegram, :telegram_endpoint)
+end

lib/sanbase_web/router.ex

@@ -20,6 +20,10 @@ defmodule SanbaseWeb.Router do
     plug(SanbaseWeb.Graphql.ContextPlug)
   end
 
+  pipeline :telegram do
+    plug(SanbaseWeb.Plug.TelegramMatchPlug)
+  end
+
   use ExAdmin.Router
 
   scope "/admin", ExAdmin do
@@ -52,15 +56,17 @@ defmodule SanbaseWeb.Router do
   end
 
   scope "/", SanbaseWeb do
-    pipe_through(:browser)
+    pipe_through([:browser, :telegram])
 
-    # Only us and telegram know the token. This makes sure that no malicious party
-    # could counterfeit a request
     post(
-      "/telegram/#{System.get_env("TELEGRAM_ENDPOINT_RANDOM_STRING")}",
+      "/telegram/:path",
       TelegramController,
       :index
     )
+  end
+
+  scope "/", SanbaseWeb do
+    pipe_through(:browser)
 
     get("/consent", RootController, :consent)
     get("/apiexamples", ApiExamplesController, :api_examples)