Browse tests and open website forms through the Telegram bot #45

New issue

Open

opened 2026-11-01 20:12:04 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:12:04 +00:00

Owner

Outcome

Provide a basic aiogram bot integrated with FastAPI. The bot resolves the same verified account as the website and delegates business behavior to application ports.

Use structured messages with labeled details and action buttons. Website forms handle registration, profile editing, availability, ignores, and initial session or material creation.

Acceptance criteria

Bot entry resolves a stable, verified Telegram identity. A username alone cannot select an account. Incomplete registration opens the website flow without revealing protected test data.
Fully registered users can browse published tests and open their details through the same visibility and restriction rules as the website.
Messages use clear formatting, escaped dynamic text, and existing action buttons. Long content respects Telegram's message limit without broken markup or omitted access controls.
Personalized dates include absolute local timestamps, the saved named timezone, and the UTC offset for each instant. Cross-midnight intervals show both dates.
Links open ordinary responsive website forms. The bot does not introduce a separate Mini App or complex native form workflow.
Incoming callbacks identify the clicker. An action belonging to another recipient cannot be accepted by forwarding or sharing its message.
Authenticated update ingress and duplicate handling prevent replayed updates from creating repeated domain changes. Secret tokens and user message bodies stay out of operational logs.
A current whole-account restriction blocks ordinary bot use and shows the restriction notice. Bot access cannot bypass website registration requirements.
Restoring bot access exposes a link to current website notifications. It does not change the configured delivery mode or replay old notifications.
Website and bot actions share domain ports. Telegram-specific objects do not enter the application core.

Validation design

Send synthetic updates for two identities, incomplete registration, a blocked account, and a forged or duplicate update. Assert permitted message content and absence of private fields. Render hostile description text and long announcements to detect HTML injection and truncation defects. Use a test adapter rather than sending real Telegram messages.

Dependencies

#14: Authenticate Telegram users through protected Quorum sessions. Supplies verified account resolution and the registration-access contract.
#44: Create private test drafts and publish complete announcements. Supplies viewer-safe published details for browsing.
#20: Display dates and deadlines in each user's saved timezone. Supplies personalized timestamp formatting.
#6: Start the FastAPI runtime with owned database resources. Hosts the aiogram adapter and configured update ingress.
#28: Edit recurring availability with date overrides and overnight slots. Provides the availability website form opened from bot navigation.
#21: Let testers hide ignored organizers from ordinary discovery. Provides the organizer-ignore website form opened from bot navigation.

## Outcome Provide a basic aiogram bot integrated with FastAPI. The bot resolves the same verified account as the website and delegates business behavior to application ports. Use structured messages with labeled details and action buttons. Website forms handle registration, profile editing, availability, ignores, and initial session or material creation. ## Acceptance criteria - Bot entry resolves a stable, verified Telegram identity. A username alone cannot select an account. Incomplete registration opens the website flow without revealing protected test data. - Fully registered users can browse published tests and open their details through the same visibility and restriction rules as the website. - Messages use clear formatting, escaped dynamic text, and existing action buttons. Long content respects Telegram's message limit without broken markup or omitted access controls. - Personalized dates include absolute local timestamps, the saved named timezone, and the UTC offset for each instant. Cross-midnight intervals show both dates. - Links open ordinary responsive website forms. The bot does not introduce a separate Mini App or complex native form workflow. - Incoming callbacks identify the clicker. An action belonging to another recipient cannot be accepted by forwarding or sharing its message. - Authenticated update ingress and duplicate handling prevent replayed updates from creating repeated domain changes. Secret tokens and user message bodies stay out of operational logs. - A current whole-account restriction blocks ordinary bot use and shows the restriction notice. Bot access cannot bypass website registration requirements. - Restoring bot access exposes a link to current website notifications. It does not change the configured delivery mode or replay old notifications. - Website and bot actions share domain ports. Telegram-specific objects do not enter the application core. ## Validation design Send synthetic updates for two identities, incomplete registration, a blocked account, and a forged or duplicate update. Assert permitted message content and absence of private fields. Render hostile description text and long announcements to detect HTML injection and truncation defects. Use a test adapter rather than sending real Telegram messages. ## Dependencies - [#14: Authenticate Telegram users through protected Quorum sessions](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/14). Supplies verified account resolution and the registration-access contract. - [#44: Create private test drafts and publish complete announcements](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/44). Supplies viewer-safe published details for browsing. - [#20: Display dates and deadlines in each user's saved timezone](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/20). Supplies personalized timestamp formatting. - [#6: Start the FastAPI runtime with owned database resources](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/6). Hosts the aiogram adapter and configured update ingress. - [#28: Edit recurring availability with date overrides and overnight slots](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/28). Provides the availability website form opened from bot navigation. - [#21: Let testers hide ignored organizers from ordinary discovery](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/21). Provides the organizer-ignore website form opened from bot navigation. ## Related work - [#29: Deliver Telegram notifications with bounded retries and current permissions](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/29) - [#70: Let testers manage their participation through Telegram buttons](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/70) - [#66: Handle organizer decisions and simple session updates through Telegram](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/66)

viacheslavshuka referenced this issue

2026-11-01 20:12:31 +00:00

Handle organizer decisions and simple session updates through Telegram #66

viacheslavshuka referenced this issue

2026-11-01 20:12:37 +00:00

Let testers manage their participation through Telegram buttons #70

viacheslavshuka added the

labels