telegram_auth_provider

Login by Telegram for RestoApp: the bot of the restaurant asks the customer to share the phone number, and the customer is logged in by it. A Sails hook, no models, one setting, no dependencies.

How a login goes

1. The login window of the storefront offers «Войти через Telegram» (the way in telegram of the core: identity, bot_dialog).
2. The window opens the bot by the link https://t.me/<bot>?start=<attempt> and waits; on a phone the link opens the Telegram app.
3. The bot answers with the button «📱 Поделиться номером» (a request_contact keyboard). The contact of the customer's own account is the number Telegram proves; a contact card of someone else is refused.
4. The bot hands the number to the core (AuthService.handleSignal, a profile signal of the attempt). The core logs in the account of that number — the same as by a code — or creates it with the name from Telegram; the window, which polls the attempt, logs in.

No code follows the contact: the row of the way in has requirePhoneVerification off, there being no SMS gateway to send one. The price — a link forwarded to someone else logs in whoever started it, if that someone presses the button: the bot says what the button does, and an attempt lives minutes. An operator who has an SMS gateway may switch requirePhoneVerification on (admin panel, the ways to log in).

Polling, not a webhook

The bot takes its messages itself (getUpdates, long polling): no public address, no webhook, no secret — the same on a stand and on a server. At the start the module removes a webhook set on the bot. One process polls, the primary worker: two processes polling one bot take the messages from each other (Telegram answers 409), so one bot — one installation; a stand and a server need two bots.

Setup

Setting
TELEGRAM_BOT_TOKEN	the token @BotFather gave for the bot

A secret setting of the module (settings/telegram_bot_token.json): kept in the database only, the admin panel and the API never show it. Set it in the admin panel («Настройки»), then restart the application — the bot starts with it. An environment variable of the same name wins over the setting: locally the token may stay in the git-ignored .env of the application. Without a token the module does nothing and the way in is not offered.

The way in telegram is created enabled outside production; in production an operator switches it on once (admin panel, the ways to log in), after the token is set.

A bot: @BotFather → /newbot → a name and a username ending in bot → the token. The texts of the bot are Russian.

Install

Copy the folder into modules/telegram_auth_provider of the application; no dependencies.

Changelog

2.0.0 (2026-10-23)

• Rewritten for the auth of the current core (AuthAdapter, AuthService.handleSignal); the module of 1.0.0 imported AuthProviderAdapter, which the core no longer has, and did not load.
• The way in telegram (identity, bot_dialog, canVerifyPhone): the login window opens the bot by t.me/<bot>?start=<attempt>, the bot asks to share the phone number, the customer's own contact logs in; a contact card of someone else is refused. No code after the contact (requirePhoneVerification off).
• The bot polls Telegram (getUpdates) in the primary worker: no webhook, no public address, no secret; a webhook set on the bot is removed at the start.
• The token is the secret setting TELEGRAM_BOT_TOKEN (an environment variable of that name wins), read at the start; the admin page and the other settings of 1.0.0 are gone.
• Plain JavaScript, no build, no dependencies.

1.0.1 (2026-09-05)

• requirePhoneVerification now defaults to true for the Telegram bot-dialog method (was false). The bot deep-link is the attempt's address and can be forwarded to a victim, who then finishes the attacker's attempt by sharing their contact (review2 §2.5). The SMS gate is the only thing that stops it, so it starts on, like MAX. The default applies to rows created on first registration — a row that already exists keeps the operator's value, so on installations where the module ran before this version flip the checkbox by hand in the admin.