fix: bind Telegram pairing to expiring single-use account challenges

2026-09-06 14:50:11 +03:00
parent aca1f5c3d1
commit 283bfe5990
9 changed files with 137 additions and 23 deletions
@@ -287,3 +287,10 @@ test('weekly brief review is admin-only and persists evidence without sending me
 assert.equal(saved.review.actor,'weekly-admin@example.test');assert.equal(saved.providerId,input.providerId);
 assert.equal(saved.state,'sent_manual');
 });
+
+test('Telegram cannot be linked through generic data writes or legacy client codes',async()=>{
+ assert.equal((await request('/api/me/data','PUT',{anahtar:'telegram',deger:{chatId:'123'}})).status,403);
+ assert.equal((await request('/api/me/telegram','POST',{kod:'123456'})).status,400);
+ assert.equal((await request('/api/me/telegram','PATCH',{})).status,405);
+ assert.equal((await request('/api/me/telegram','POST',{islem:'kod'},null)).status,401);
+});