disabling marksbot when third-party verifications if turned off

cmd/telesrv-admin/filter_bots_test.go

@@ -0,0 +1,19 @@
+package main
+
+import "testing"
+
+func TestFilterOutBot(t *testing.T) {
+	rows := []BotRow{{ID: 1}, {ID: 2}, {ID: 3}}
+	out := filterOutBot(rows, 2)
+	if len(out) != 2 || out[0].ID != 1 || out[1].ID != 3 {
+		t.Fatalf("filterOutBot = %+v, want [1, 3]", out)
+	}
+}
+
+func TestFilterOutBotNoMatch(t *testing.T) {
+	rows := []BotRow{{ID: 1}, {ID: 3}}
+	out := filterOutBot(rows, 2)
+	if len(out) != 2 || out[0].ID != 1 || out[1].ID != 3 {
+		t.Fatalf("filterOutBot (no match) = %+v, want unchanged [1, 3]", out)
+	}
+}

cmd/telesrv-admin/server.go

@@ -858,6 +858,19 @@ func (s *server) handleSetChannelAvatarAPI(w http.ResponseWriter, r *http.Reques
 	writeCommandResultAPI(w, result, err)
 }
 
+// filterOutBot drops the given bot id from a row slice in place, preserving
+// order. Used to keep a hidden built-in bot out of admin listings without
+// touching the underlying SQL projection.
+func filterOutBot(rows []BotRow, excludeID int64) []BotRow {
+	out := rows[:0]
+	for _, row := range rows {
+		if row.ID != excludeID {
+			out = append(out, row)
+		}
+	}
+	return out
+}
+
 func (s *server) handleBotsAPI(w http.ResponseWriter, r *http.Request) {
 	if s.read == nil {
 		writeAPIError(w, http.StatusServiceUnavailable, "read store is not configured")
@@ -878,6 +891,12 @@ func (s *server) handleBotsAPI(w http.ResponseWriter, r *http.Request) {
 		writeAPIError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
+	// @marksbot is not fully finished (see requireThirdPartyVerificationVisible):
+	// while third-party verification is hidden, it must not be discoverable in
+	// the bot list either, not just unreachable at /api/botverification/*.
+	if s.cfg.HideThirdPartyVerification {
+		rows = filterOutBot(rows, domain.VerifierBotUserID)
+	}
 	nextBeforeID := int64(0)
 	if hasMore && len(rows) > 0 {
 		nextBeforeID = rows[len(rows)-1].ID
@@ -908,6 +927,10 @@ func (s *server) handleBotDetailAPI(w http.ResponseWriter, r *http.Request) {
 		writeAPIError(w, http.StatusBadRequest, "invalid id")
 		return
 	}
+	if s.cfg.HideThirdPartyVerification && botID == domain.VerifierBotUserID {
+		writeAPIError(w, http.StatusNotFound, "bot not found")
+		return
+	}
 	detail, err := s.read.BotDetail(r.Context(), botID)
 	if err != nil {
 		writeAPIError(w, http.StatusInternalServerError, err.Error())

cmd/telesrv/main.go

@@ -909,6 +909,7 @@ func run(logger *zap.Logger) error {
 		contacts.WithPrivacyEvaluator(privacyService),
 		contacts.WithAccountFreezeProvider(adminService),
 		contacts.WithReadModelVersions(readModelVersionStore),
+		contacts.WithHideThirdPartyVerification(cfg.HideThirdPartyVerification),
 	)
 	if seeded, err := langPackService.SeedDirectory(ctx, cfg.LangPackSeedDir); err != nil {
 		return fmt.Errorf("seed langpack: %w", err)
@@ -1128,7 +1129,7 @@ func run(logger *zap.Logger) error {
 		passkeyapp.WithAllowedOrigins(cfg.PasskeyAllowedOrigins))
 	// 自定义云主题(Create a New Theme):主题目录与每用户已安装列表均持久化到 postgres。
 	themeService := themesapp.NewService(postgres.NewThemeStore(pool))
-	usersService := users.NewService(userStore, users.WithBaseUserCache(userCache), users.WithContactStore(contactStore), users.WithPhotoProvider(cachedPhotos), users.WithPrivacyEvaluator(privacyService), users.WithAccountFreezeProvider(adminService))
+	usersService := users.NewService(userStore, users.WithBaseUserCache(userCache), users.WithContactStore(contactStore), users.WithPhotoProvider(cachedPhotos), users.WithPrivacyEvaluator(privacyService), users.WithAccountFreezeProvider(adminService), users.WithHideThirdPartyVerification(cfg.HideThirdPartyVerification))
 	privacyService.ConfigureReadModels(usersService, channelStore)
 	aiComposeService := aiapp.NewService(aiComposeStore, newAIComposeOptions(cfg, rateLimiter, usersService.PremiumActive, logger)...)
 	botsService.SetAIChatGenerator(aiComposeService)