Merge remote-tracking branch 'upstream/main' into merge-gramsrv-9106877

internal/domain/system.go

@@ -38,6 +38,28 @@ const (
 	// 与 files.Service.SeedChatBotAvatar 种子写入的行保持一致。
 	ChatBotUserPhotoID         int64 = 12500000070001
 	ChatBotUserPhotoAccessHash int64 = 8748578814399338333
+
+	// VerifyBotUserID is the built-in @verifybot: it collects official platform
+	// verification applications and reports decisions back to the applicant. The
+	// id is reserved and stable, so a restart never re-creates the account under a
+	// different identity.
+	VerifyBotUserID int64 = 1250000011
+	// VerifyBotAccessHash is fixed and double-written with the seed row in
+	// migration 0153; the two must never drift.
+	VerifyBotAccessHash int64 = 7802113947355620887
+
+	// VerifierBotUserID is the built-in @verifierbot: the first THIRD-PARTY
+	// verifier of a deployment (core.telegram.org/api/bots/verification). It
+	// collects applications for its own icon+description mark and reports the
+	// operator's decision back to the applicant. The id is reserved and stable, so
+	// a restart never re-creates the account under a different identity.
+	//
+	// It is not a second route to the platform checkmark: that badge is granted by
+	// the operator alone and collected by VerifyBotUserID above.
+	VerifierBotUserID int64 = 1250000013
+	// VerifierBotAccessHash is fixed and double-written with the seed row in
+	// migration 0156; the two must never drift.
+	VerifierBotAccessHash int64 = 6913402578811563729
 )
 
 // officialSystemUserPhotoDCID/Stripped 由 files.Service.SeedOfficialSystemAvatar
@@ -173,6 +195,38 @@ func ChatBotUser() User {
 	return u
 }
 
+// VerifyBotUser returns the built-in @verifybot account. It is verified itself,
+// so the applicant sees the same badge on the account that grants it.
+func VerifyBotUser() User {
+	return User{
+		ID:             VerifyBotUserID,
+		AccessHash:     VerifyBotAccessHash,
+		FirstName:      "Verify Bot",
+		Username:       "verifybot",
+		Verified:       true,
+		Bot:            true,
+		BotInfoVersion: 1,
+	}
+}
+
+// VerifierBotUser returns the built-in @verifierbot account.
+//
+// Verified is false on purpose: the official checkmark is the platform's own
+// mechanism, and a third-party verifier wearing it would blur exactly the
+// distinction this bot has to explain to every applicant. What makes the account a
+// verifier is the operator-granted BotVerifierSettings row, not this seed.
+func VerifierBotUser() User {
+	return User{
+		ID:             VerifierBotUserID,
+		AccessHash:     VerifierBotAccessHash,
+		FirstName:      "Verifier Bot",
+		Username:       "verifierbot",
+		Verified:       false,
+		Bot:            true,
+		BotInfoVersion: 1,
+	}
+}
+
 // SystemUserByID 返回内置系统账号；非系统账号返回 ok=false。
 // 所有对 777000 的硬编码注入点统一经此函数，新增内置账号只改这里。
 func SystemUserByID(id int64) (User, bool) {
@@ -185,6 +239,10 @@ func SystemUserByID(id int64) (User, bool) {
 		return StickersBotUser(), true
 	case ChatBotUserID:
 		return ChatBotUser(), true
+	case VerifyBotUserID:
+		return VerifyBotUser(), true
+	case VerifierBotUserID:
+		return VerifierBotUser(), true
 	}
 	return User{}, false
 }
@@ -194,9 +252,25 @@ func IsSystemUserID(id int64) bool {
 	return ok
 }
 
+// SystemUserIDs returns every built-in account id, in a stable order.
+//
+// It is the one list to extend when a service account is added, so a caller that
+// has to enumerate them -- a SQL predicate excluding infrastructure, say -- cannot
+// silently miss one the way an inline literal would.
+func SystemUserIDs() []int64 {
+	return []int64{
+		OfficialSystemUserID,
+		BotFatherUserID,
+		StickersBotUserID,
+		ChatBotUserID,
+		VerifyBotUserID,
+		VerifierBotUserID,
+	}
+}
+
 func SystemUserByPhone(phone string) (User, bool) {
 	phone = NormalizePhone(phone)
-	for _, id := range []int64{OfficialSystemUserID, BotFatherUserID, StickersBotUserID, ChatBotUserID} {
+	for _, id := range SystemUserIDs() {
 		u, ok := SystemUserByID(id)
 		if !ok || u.Phone == "" {
 			continue