Merge pull request #590 from InsanusMokrassar/1.1.1

1.1.1

CHANGELOG.md

@@ -1,5 +1,15 @@
 # TelegramBotAPI changelog
 
+## 1.1.1
+
+* `Versions`:
+    * `MicroUtils.Crypto` will not be provided with that library anymore. Instead, it is recommended to use `Korlibs.Krypto`. You still can add crypto from microutils using next groovy dependency: `dev.inmo:micro_utils.crypto:$micro_utils_version`
+* `Core`:
+    * Improvements in `TelegramAPIUrlsKeeper#checkWebAppLink`
+    * New field in `TelegramAPIUrlsKeeper#webAppDataSecretKeyHash`
+* `Behaviour Builder`:
+    * Extension `TelegramBot#buildBehaviour` now returns `BehaviourContext`
+
 ## 1.1.0
 
 * `Utils`:

gradle.properties

@@ -8,7 +8,7 @@ kotlin.incremental.js=true
 kotlin_version=1.6.21
 kotlin_coroutines_version=1.6.1
 kotlin_serialisation_runtime_version=1.3.3
-klock_version=2.7.0
+korlibs_version=2.7.0
 uuid_version=0.4.0
 ktor_version=2.0.1
 
@@ -20,6 +20,6 @@ javax_activation_version=1.1.1
 dokka_version=1.6.21
 
 library_group=dev.inmo
-library_version=1.1.0
+library_version=1.1.1
 
 github_release_plugin_version=2.3.7

tgbotapi.behaviour_builder/src/commonMain/kotlin/dev/inmo/tgbotapi/extensions/behaviour_builder/BehaviourBuilders.kt

@@ -7,8 +7,7 @@ import dev.inmo.tgbotapi.extensions.utils.updates.retrieving.longPolling
 import dev.inmo.tgbotapi.extensions.utils.updates.retrieving.startGettingOfUpdatesByLongPolling
 import dev.inmo.tgbotapi.updateshandlers.FlowsUpdatesFilter
 import dev.inmo.tgbotapi.utils.PreviewFeature
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.plus
+import kotlinx.coroutines.*
 
 /**
  * This function is used in [buildBehaviour] extensions to provide default [CoroutineScope] and allow to avoid all
@@ -30,18 +29,18 @@ suspend fun TelegramBot.buildBehaviour(
     scope: CoroutineScope = defaultCoroutineScopeProvider(),
     defaultExceptionsHandler: ExceptionHandler<Unit>? = null,
     block: BehaviourContextReceiver<Unit>
-) {
-    BehaviourContext(
-        this,
-        scope.let {
-              if (defaultExceptionsHandler == null) {
-                  it
-              } else {
-                  it + ContextSafelyExceptionHandler(defaultExceptionsHandler)
-              }
-        },
-        flowUpdatesFilter
-    ).block()
+): BehaviourContext = BehaviourContext(
+    this,
+    scope.let {
+          if (defaultExceptionsHandler == null) {
+              it
+          } else {
+              it + ContextSafelyExceptionHandler(defaultExceptionsHandler)
+          }
+    },
+    flowUpdatesFilter
+).apply {
+    block()
 }
 
 /**
@@ -56,15 +55,14 @@ suspend fun TelegramBot.buildBehaviourWithLongPolling(
     scope: CoroutineScope = defaultCoroutineScopeProvider(),
     defaultExceptionsHandler: ExceptionHandler<Unit>? = null,
     block: BehaviourContextReceiver<Unit>
-) = FlowsUpdatesFilter().let {
-    buildBehaviour(
-        it,
-        scope,
-        defaultExceptionsHandler,
-        block
+): Job {
+    val behaviourContext = buildBehaviour(
+        scope = scope,
+        defaultExceptionsHandler = defaultExceptionsHandler,
+        block = block
     )
-    longPolling(
-        it,
-        scope = scope
+    return longPolling(
+        behaviourContext,
+        scope = behaviourContext
     )
 }

tgbotapi.core/build.gradle

@@ -47,10 +47,10 @@ kotlin {
                 api "org.jetbrains.kotlinx:kotlinx-serialization-json:$kotlin_serialisation_runtime_version"
                 api "org.jetbrains.kotlinx:kotlinx-serialization-properties:$kotlin_serialisation_runtime_version"
 
-                api "com.soywiz.korlibs.klock:klock:$klock_version"
+                api "com.soywiz.korlibs.klock:klock:$korlibs_version"
+                api "com.soywiz.korlibs.krypto:krypto:$korlibs_version"
                 api "com.benasher44:uuid:$uuid_version"
 
-                api "dev.inmo:micro_utils.crypto:$micro_utils_version"
                 api "dev.inmo:micro_utils.coroutines:$micro_utils_version"
                 api "dev.inmo:micro_utils.serialization.base64:$micro_utils_version"
                 api "dev.inmo:micro_utils.serialization.encapsulator:$micro_utils_version"

tgbotapi.core/src/commonMain/kotlin/dev/inmo/tgbotapi/utils/TelegramAPIUrlsKeeper.kt

@@ -1,7 +1,8 @@
 package dev.inmo.tgbotapi.utils
 
-import dev.inmo.micro_utils.crypto.hex
-import dev.inmo.micro_utils.crypto.hmacSha256
+import com.soywiz.krypto.*
+import io.ktor.http.decodeURLQueryComponent
+import io.ktor.utils.io.core.toByteArray
 
 const val telegramBotAPIDefaultUrl = "https://api.telegram.org"
 
@@ -22,9 +23,11 @@ class TelegramAPIUrlsKeeper(
     hostUrl: String = telegramBotAPIDefaultUrl,
     urlsSuffixes: String = ""
 ) {
-    val webAppDataSecretKey by lazy {
-        token.hmacSha256("WebAppData")
+    val webAppDataSecretKeyHash by lazy {
+        HMAC.hmacSHA256("WebAppData".toByteArray(), token.toByteArray())
     }
+    val webAppDataSecretKey
+        get() = webAppDataSecretKeyHash.hexLower
 
     val commonAPIUrl: String
     val fileBaseUrl: String
@@ -47,5 +50,14 @@ class TelegramAPIUrlsKeeper(
      * @param rawData Data from [dev.inmo.tgbotapi.webapps.WebApp.initData]
      * @param hash Data from [dev.inmo.tgbotapi.webapps.WebApp.initDataUnsafe] from the field [dev.inmo.tgbotapi.webapps.WebAppInitData.hash]
      */
-    fun checkWebAppLink(rawData: String, hash: String) = rawData.hmacSha256(webAppDataSecretKey).hex() == hash
+    fun checkWebAppLink(rawData: String, hash: String): Boolean {
+        val preparedData = rawData
+            .decodeURLQueryComponent()
+            .split("&")
+            .filterNot { it.startsWith("hash=") }
+            .sorted()
+            .joinToString("\n")
+
+        return HMAC.hmacSHA256(webAppDataSecretKeyHash.bytes, preparedData.toByteArray()).hexLower == hash.lowercase()
+    }
 }

tgbotapi.webapps/src/jsMain/kotlin/dev/inmo/tgbotapi/webapps/CryptoJSExtensions.kt

@@ -2,6 +2,8 @@ package dev.inmo.tgbotapi.webapps
 
 import dev.inmo.micro_utils.crypto.CryptoJs
 
+@Deprecated("Useless")
 fun CryptoJs.HmacSHA256(text: String, key: String) = this.asDynamic().HmacSHA256(text, key).unsafeCast<String>()
 
+@Deprecated("Useless")
 fun CryptoJs.hex(text: String) = this.asDynamic().format.Hex(text).unsafeCast<String>()