Merge remote-tracking branch 'upstream/main' into merge-gramsrv-9106877

.env.example

@@ -22,6 +22,8 @@ TELESRV_ADVERTISE_IP=127.0.0.1
 # Which "data center" number this server presents itself as. There's only
 # ever one physical server, so this normally stays 2 -- no need to change it.
 TELESRV_DC=2
+# ISO 3166-1 alpha-2 code returned by help.getNearestDc. CN preselects +86.
+TELESRV_DEFAULT_COUNTRY_CODE=CN
 
 ## Phone Login Codes -- How a login code gets to a phone number when someone signs in.
 
@@ -117,6 +119,19 @@ TELESRV_ADMIN_SESSION_KEY=
 TELESRV_ADMIN_API_ADDR=
 # Address the admin panel's own web UI listens on.
 TELESRV_ADMIN_UI_ADDR=127.0.0.1:2600
+# Permissions granted to an Admin UI session that logged in with
+# TELESRV_ADMIN_UI_PASSWORD / _TOKEN. Comma-separated; "*" means every
+# permission and is the default, so enabling RBAC never locks an operator out of
+# a panel that worked before. Names are letters/digits/._:- and may end in
+# "namespace.*" to grant a whole namespace.
+TELESRV_ADMIN_UI_PERMISSIONS=*
+# Additional Admin API bearer tokens with a bounded permission set each, so an
+# integration gets exactly the rights it needs instead of the unrestricted
+# TELESRV_ADMIN_API_TOKEN. Format: "name:token:perm1,perm2" entries separated by
+# ';'. A token may not contain ':' or whitespace, names and tokens must be
+# unique, and reusing TELESRV_ADMIN_API_TOKEN here is refused; any malformed
+# entry fails startup rather than silently granting or dropping rights.
+TELESRV_ADMIN_SCOPED_TOKENS=
 
 ## Bot API Gateway -- Optional HTTP gateway for bot libraries (e.g. python-telegram-bot).
 
@@ -242,15 +257,12 @@ TELESRV_MTPROTO_RPC_TIMEOUT=30s
 TELESRV_MTPROTO_RPC_GLOBAL_WORKERS=256
 TELESRV_MTPROTO_RPC_GLOBAL_MAX_TASKS=8192
 TELESRV_MTPROTO_RPC_GLOBAL_MAX_BYTES=536870912
-# In-memory cache of recent RPC results, used to safely retry a request the
-# client resends. Keep the limits ordered global >= auth >= session.
-TELESRV_MTPROTO_RPC_RESULT_CACHE_MAX_ENTRIES=262144
-TELESRV_MTPROTO_RPC_RESULT_CACHE_MAX_BYTES=67108864
-TELESRV_MTPROTO_RPC_RESULT_CACHE_AUTH_MAX_ENTRIES=32768
-TELESRV_MTPROTO_RPC_RESULT_CACHE_AUTH_MAX_BYTES=33554432
-TELESRV_MTPROTO_RPC_RESULT_CACHE_SESSION_MAX_ENTRIES=16384
-TELESRV_MTPROTO_RPC_RESULT_CACHE_SESSION_MAX_BYTES=16777216
-TELESRV_MTPROTO_RPC_RESULT_PENDING_PER_AUTH=2048
+# Metadata-only rpc_result receipt budgets: global >= auth >= session. ACK deletes immediately;
+# 331s is only the no-ACK horizon. Payloads live solely in the logical-session outbound budget.
+TELESRV_MTPROTO_RPC_EXECUTION_MAX_ENTRIES=262144
+TELESRV_MTPROTO_RPC_EXECUTION_AUTH_MAX_ENTRIES=32768
+TELESRV_MTPROTO_RPC_EXECUTION_SESSION_MAX_ENTRIES=16384
+TELESRV_MTPROTO_RPC_EXECUTION_PENDING_PER_AUTH=2048
 # Process-wide in-flight transport wire + decrypted plaintext reservation.
 TELESRV_MTPROTO_INBOUND_FRAME_GLOBAL_MAX_BYTES=536870912
 # Per-connection outbound mailboxes (normal/control) and process-wide resend pending bodies.
@@ -365,6 +377,93 @@ TELESRV_STARGIFT_RESELL_DELAY=0s
 TELESRV_STARGIFT_CRAFT_DELAY=0s
 TELESRV_STARGIFT_CRAFT_CHANCE_PERMILLE=250
 
+# Local admin-only composite account rating. It is not projected into Telegram's
+# userFull.stars_rating fields. Disabling it refuses local rating writes.
+TELESRV_RATING_ENABLED=true
+# A local rating increase is parked for this long before it becomes the visible
+# admin level; a decrease always applies immediately. 0 applies every change at once.
+TELESRV_RATING_PENDING_DELAY=24h
+# Background recompute worker: the rating derives from signals owned by other
+# subsystems, so freshness is a worker property rather than a write-path one.
+TELESRV_RATING_RECOMPUTE_INTERVAL=15m
+TELESRV_RATING_RECOMPUTE_BATCH=500
+TELESRV_RATING_STALE_AFTER=6h
+# Integer composite weights; the defaults below are exactly the shipped domain
+# formula. Penalties are magnitudes that the formula subtracts, so every value is
+# non-negative and a negative one fails startup.
+TELESRV_RATING_WEIGHT_STARS_RECEIVED_PERMILLE=1000
+TELESRV_RATING_WEIGHT_STARS_SPENT_PERMILLE=250
+TELESRV_RATING_WEIGHT_MESSAGE_SENT=1
+TELESRV_RATING_WEIGHT_ACCOUNT_AGE_DAY=2
+TELESRV_RATING_WEIGHT_GIFT_RECEIVED=25
+TELESRV_RATING_WEIGHT_MODERATION_CASE=150
+TELESRV_RATING_WEIGHT_SCAM_PENALTY=5000
+TELESRV_RATING_WEIGHT_FAKE_PENALTY=5000
+# Upper bound of the activity component so activity alone cannot outweigh Stars
+# and moderation; 0 leaves it uncapped.
+TELESRV_RATING_ACTIVITY_CAP=5000
+
+# Landing URL recorded on a minted collectible (NFT) username when the mint
+# command carries no explicit URL. Empty derives
+# <TELESRV_PUBLIC_BASE_URL>/nft/username/<username>. A template may carry the
+# {username} placeholder; without it the name is appended as the last path
+# segment. No external marketplace is contacted.
+TELESRV_COLLECTIBLE_USERNAME_URL_TEMPLATE=
+
+# Official platform verification: applications filed through the built-in
+# @verifybot and decided in the admin panel. An approval flips the platform
+# verified flag on the target peer and nothing else; it is not the third-party
+# bot verification icon. Disabling refuses every verification use case, while
+# peers already carrying the badge keep it.
+TELESRV_VERIFICATION_ENABLED=true
+# Plain user accounts as verification subjects. Off by default: the official
+# process verifies a public presence (bot, public channel, public supergroup).
+TELESRV_VERIFICATION_ALLOW_USER_TARGETS=false
+# How long an applicant must wait before filing the same target again after a
+# rejection, measured from the decision so a slow review never shortens it.
+# 0 disables the cooldown; must be 0..8760h.
+TELESRV_VERIFICATION_REJECT_COOLDOWN=720h
+# Applications one applicant may create per window. Either value 0 disables the
+# budget; a positive limit requires a positive window.
+TELESRV_VERIFICATION_APPLY_RATE_LIMIT=3
+TELESRV_VERIFICATION_APPLY_RATE_WINDOW=24h
+# @verifybot dialog rate per applicant, independent of how many applications are
+# actually created. Either value 0 disables it.
+TELESRV_VERIFICATION_BOT_RATE_LIMIT=30
+TELESRV_VERIFICATION_BOT_RATE_WINDOW=1m
+# Applicant notification worker. A decision commits with its outbox row, never
+# with a message send, so delivery is a separate retrying cycle over durable
+# rows. Interval must be positive; batch must be 1..500.
+TELESRV_VERIFICATION_NOTIFY_INTERVAL=15s
+TELESRV_VERIFICATION_NOTIFY_BATCH=50
+# Applications one applicant may keep open at once; 0 disables the cap, maximum
+# is 50.
+TELESRV_VERIFICATION_MAX_ACTIVE_PER_USER=3
+
+# Third-party bot verification (core.telegram.org/api/bots/verification): a
+# verifier bot marks peers with its OWN icon and description, which clients render
+# before the name. This is NOT the platform checkmark above: the operator grants
+# verifier status to a bot, and the two mechanisms never read each other's state.
+# Disabling refuses every third-party mutation (grants, revocations, applications,
+# icon catalogue edits) while the marks already granted keep rendering -- blanking
+# one verifier's badges is what its per-verifier kill switch is for.
+TELESRV_BOT_VERIFICATION_ENABLED=true
+# Peers one verifier bot may mark. Verifier status is granted per deployment rather
+# than earned per peer, so an unbounded verifier would be an unbounded badge
+# printer. 0 disables the service bound and leaves only the storage bound, which is
+# also the maximum accepted here (10000).
+TELESRV_BOT_VERIFICATION_MAX_PER_VERIFIER=10000
+# Verification applications one applicant may file per window, across all verifier
+# bots. Either value 0 disables the budget; a positive limit requires a positive
+# window. Looser than the official budget on purpose: a deployment can run several
+# verifier companies, and filing with a second one is not a retry of the first.
+TELESRV_BOT_VERIFICATION_REQUEST_RATE_LIMIT=5
+TELESRV_BOT_VERIFICATION_REQUEST_RATE_WINDOW=24h
+
+# Optional Premium feature-preview media export. Missing directory keeps the
+# no-video fallback; an existing but incomplete/invalid directory fails startup.
+TELESRV_PREMIUM_PROMO_SEED_DIR=data/premium-promo
+
 # 1-to-1 call timing/limits.
 TELESRV_CALL_RING_TIMEOUT=90s
 TELESRV_CALL_TOMBSTONE_TTL=60s