WIP

- Bump Rector version.
- Migrate PHPUnit XML.
- Revise webhook path in config docs.
- Refactor webhook system to use `secret_token` headers.
- Drop bot token from webhook url.
- Add facade single test

Author: irazasyed

composer.json

@@ -34,7 +34,7 @@
     "irazasyed/docgen": "^0.2",
     "pestphp/pest": "^2.0",
     "php-parallel-lint/php-parallel-lint": "^1.3",
-    "rector/rector": "^0.15.24"
+    "rector/rector": "^0.16"
   },
   "suggest": {
     "irazasyed/larasupport": "Allows you to use any Laravel Package in Lumem"

config/telegram.php

@@ -86,7 +86,7 @@
      * Controller: Responsible to listen to updates and acknowledge to Telegram.
      *
      * Default path: telegram
-     * Webhook path: /telegram/{token}/{bot}
+     * Webhook path: /telegram/{bot}/webhook
      */
     'webhook' => [
         'domain' => env('TELEGRAM_WEBHOOK_DOMAIN', null),

phpunit.xml.dist

@@ -1,13 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.0/phpunit.xsd" backupGlobals="false" bootstrap="vendor/autoload.php" colors="true" processIsolation="false" stopOnFailure="false" executionOrder="random" failOnWarning="true" failOnRisky="true" failOnEmptyTestSuite="true" beStrictAboutOutputDuringTests="true" cacheDirectory=".phpunit.cache" backupStaticProperties="false" requireCoverageMetadata="false" beStrictAboutCoverageMetadata="false">
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.1/phpunit.xsd" backupGlobals="false" bootstrap="vendor/autoload.php" colors="true" processIsolation="false" stopOnFailure="false" executionOrder="random" failOnWarning="true" failOnRisky="true" failOnEmptyTestSuite="true" beStrictAboutOutputDuringTests="true" cacheDirectory=".phpunit.cache" backupStaticProperties="false" requireCoverageMetadata="false" beStrictAboutCoverageMetadata="false">
   <testsuites>
     <testsuite name="Telegram Bot SDK Laravel Test Suite">
       <directory suffix=".php">tests</directory>
     </testsuite>
   </testsuites>
-  <coverage>
+  <coverage/>
+  <source>
     <include>
       <directory suffix=".php">src</directory>
     </include>
-  </coverage>
+  </source>
 </phpunit>

routes/telegram.php

@@ -6,7 +6,7 @@
 
 Route::group(['middleware' => ValidateWebhook::class], function (): void {
 
-    Route::post('/{token}/{bot}', config('telegram.webhook.controller'))->name('telegram.bot.webhook');
+    Route::post('/{bot}/webhook', config('telegram.webhook.controller'))->name('telegram.bot.webhook');
 
     //    # Longpolling method (manual).
     //    Route::get('/{token}/updates/{bot?}', function ($bot = 'default') {

src/Console/Webhook/WebhookSetupCommand.php

@@ -4,6 +4,8 @@
 
 use Illuminate\Support\Str;
 use Telegram\Bot\Bot;
+use Telegram\Bot\Helpers\Util;
+use Telegram\Bot\Laravel\Facades\Telegram;
 use Telegram\Bot\Exceptions\TelegramSDKException;
 use Telegram\Bot\Laravel\Console\ConsoleBaseCommand;
 use Throwable;
@@ -49,13 +51,19 @@ protected function setupWebhook(Bot $bot): void
         // Bot webhook config.
         $config = $bot->config('webhook', []);
 
+        $secretToken = env('TELEGRAM_WEBHOOK_SECRET_TOKEN', $bot->config('token', ''));
+
         // Global webhook config merged with bot config with the latter taking precedence.
-        $params = collect($bot->config('global.webhook'))->except(['domain', 'path', 'controller', 'url'])
+        $params = collect($bot->config('global.webhook'))
+            ->except(['domain', 'path', 'controller', 'url'])
             ->merge($config)
-            ->put('url', $this->webhookUrl($bot))
-            ->all();
+            ->put('url', $this->webhookUrl($bot));
+
+        if(filled($secretToken)) {
+            $params->put('secret_token', Util::secretToken($secretToken));
+        }
 
-        if ($bot->setWebhook($params)) {
+        if ($bot->setWebhook($params->all())) {
             $this->info('Success: Your webhook has been set!');
 
             return;
@@ -71,7 +79,6 @@ protected function webhookUrl(Bot $bot): string
         }
 
         return Str::replaceFirst('http:', 'https:', route('telegram.bot.webhook', [
-            'token' => $bot->config('token'),
             'bot' => $bot->config('bot'),
         ]));
     }

src/Http/Controllers/WebhookController.php

@@ -23,7 +23,7 @@ class WebhookController extends Controller
      *
      * @throws WebhookException|TelegramSDKException
      */
-    public function __invoke(BotManager $manager, string $token, string $bot)
+    public function __invoke(BotManager $manager, string $bot)
     {
         App::terminating(static function () use ($manager, $bot): void {
             try {

src/Http/Middleware/ValidateWebhook.php

@@ -4,6 +4,7 @@
 
 use Closure;
 use Illuminate\Http\Request;
+use Telegram\Bot\Helpers\Util;
 use Telegram\Bot\Exceptions\TelegramSDKException;
 use Telegram\Bot\Laravel\Facades\Telegram;
 
@@ -19,7 +20,7 @@ class ValidateWebhook
      */
     public function handle($request, Closure $next)
     {
-        abort_unless($this->isTokenValid($request), 403);
+        abort_unless($this->isSecretTokenValid($request), 403);
 
         return $next($request);
     }
@@ -31,8 +32,11 @@ public function handle($request, Closure $next)
      *
      * @throws TelegramSDKException
      */
-    public function isTokenValid($request): bool
+    public function isSecretTokenValid($request): bool
     {
-        return Telegram::bot($request->route('bot'))->config('token') === $request->route('token');
+        return Util::isSecretTokenValid(
+            env('TELEGRAM_WEBHOOK_SECRET_TOKEN', Telegram::bot($request->route('bot'))->config('token', '')),
+            $request->header('X-Telegram-Bot-Api-Secret-Token', '')
+        );
     }
 }

tests/Facades/Telegram.php

@@ -0,0 +1,21 @@
+<?php
+
+use Telegram\Bot\Objects\ResponseObject;
+use Telegram\Bot\Laravel\Facades\Telegram;
+
+test('fake returns the given response', function () {
+    Telegram::fake([
+        ResponseObject::make([
+            'id'         => 123456789,
+            'first_name' => 'Test',
+            'username'   => 'testbot',
+        ])
+    ]);
+
+    $response = Telegram::sendMessage([
+        'chat_id' => 987654321,
+        'text'    => 'Hello World',
+    ]);
+
+    expect($response['id'])->toBe(123456789);
+});

tests/Feature/Example.php

@@ -1,45 +1 @@
 <?php
-
-/*
-|--------------------------------------------------------------------------
-| Test Case
-|--------------------------------------------------------------------------
-|
-| The closure you provide to your test functions is always bound to a specific PHPUnit test
-| case class. By default, that class is "PHPUnit\Framework\TestCase". Of course, you may
-| need to change it using the "uses()" function to bind a different classes or traits.
-|
-*/
-
-// uses(Tests\TestCase::class)->in('Feature');
-
-/*
-|--------------------------------------------------------------------------
-| Expectations
-|--------------------------------------------------------------------------
-|
-| When you're writing tests, you often need to check that values meet certain conditions. The
-| "expect()" function gives you access to a set of "expectations" methods that you can use
-| to assert different things. Of course, you may extend the Expectation API at any time.
-|
-*/
-
-expect()->extend('toBeOne', function () {
-    return $this->toBe(1);
-});
-
-/*
-|--------------------------------------------------------------------------
-| Functions
-|--------------------------------------------------------------------------
-|
-| While Pest is very powerful out-of-the-box, you may have some testing code specific to your
-| project that you don't want to repeat in every file. Here you can also expose helpers as
-| global functions to help you to reduce the number of lines of code in your test files.
-|
-*/
-
-function something()
-{
-    // ..
-}