feat: sync Telegram Login OIDC provider

cmd/telesrv/main.go

@@ -49,6 +49,7 @@ import (
 	"telesrv/internal/app/stargifts"
 	"telesrv/internal/app/stars"
 	storiesapp "telesrv/internal/app/stories"
+	telegramloginapp "telesrv/internal/app/telegramlogin"
 	themesapp "telesrv/internal/app/themes"
 	translationapp "telesrv/internal/app/translation"
 	"telesrv/internal/app/updates"
@@ -69,6 +70,7 @@ import (
 	"telesrv/internal/store/memory"
 	"telesrv/internal/store/postgres"
 	"telesrv/internal/store/redisstore"
+	"telesrv/internal/telegramloginhttp"
 	"telesrv/internal/turnsrv"
 	"telesrv/internal/web"
 )
@@ -346,12 +348,60 @@ func run(logger *zap.Logger) error {
 	}
 	defer pool.Close()
 
+	var telegramLoginService *telegramloginapp.Service
+	var telegramLoginIDTokens *telegramloginapp.IDTokenIssuer
+	var telegramLoginHTTPHandler http.Handler
+	if cfg.TelegramLoginEnabled {
+		codeSealer, err := telegramloginapp.LoadCodeSealer(cfg.TelegramLoginCodeKeysFile)
+		if err != nil {
+			return fmt.Errorf("load telegram login code keys: %w", err)
+		}
+		clientSecretPepper, err := telegramloginapp.LoadClientSecretPepper(cfg.TelegramLoginSecretPepperFile)
+		if err != nil {
+			return fmt.Errorf("load telegram login client-secret pepper: %w", err)
+		}
+		signingKeys, err := telegramloginapp.LoadSigningKeyRing(cfg.TelegramLoginSigningKeysFile, time.Now)
+		if err != nil {
+			return fmt.Errorf("load telegram login signing keys: %w", err)
+		}
+		telegramLoginService, err = telegramloginapp.NewService(postgres.NewTelegramLoginStore(pool), codeSealer, telegramloginapp.Config{
+			Issuer: cfg.TelegramLoginIssuer, AppScheme: cfg.PublicAppScheme,
+			AllowLoopbackHTTP:          cfg.TelegramLoginAllowLoopbackHTTP,
+			ClientSecretPepper:         clientSecretPepper,
+			SupportedSigningAlgorithms: signingKeys.ActiveAlgorithms(),
+			RequestTTL:                 cfg.TelegramLoginRequestTTL, CodeTTL: cfg.TelegramLoginCodeTTL,
+		})
+		if err != nil {
+			return fmt.Errorf("initialize telegram login service: %w", err)
+		}
+		telegramLoginIDTokens, err = telegramloginapp.NewIDTokenIssuer(signingKeys, telegramloginapp.IDTokenIssuerConfig{
+			Issuer: cfg.TelegramLoginIssuer, TTL: cfg.TelegramLoginIDTokenTTL,
+		})
+		if err != nil {
+			return fmt.Errorf("initialize telegram login ID-token issuer: %w", err)
+		}
+	}
+
 	rdb, err := redisstore.Open(ctx, cfg.RedisAddr, cfg.RedisPassword, cfg.RedisDB)
 	if err != nil {
 		return fmt.Errorf("connect redis: %w", err)
 	}
 	defer func() { _ = rdb.Close() }()
 	logger.Info("持久化依赖就绪", zap.String("redis", cfg.RedisAddr))
+	if cfg.TelegramLoginEnabled {
+		telegramLoginHTTPHandler, err = telegramloginhttp.NewHandler(telegramloginhttp.Config{
+			Service: telegramLoginService, Tokens: telegramLoginIDTokens,
+			Limiter: redisstore.NewRateLimiter(rdb), AppName: cfg.PublicAppName,
+			Logger: logger.Named("telegram-login-http"), TrustedProxyCIDRs: cfg.TelegramLoginTrustedProxyCIDRs,
+			AllowLoopbackHTTP: cfg.TelegramLoginAllowLoopbackHTTP,
+		})
+		if err != nil {
+			return fmt.Errorf("initialize telegram login HTTP provider: %w", err)
+		}
+		logger.Info("Telegram Login/OIDC provider enabled",
+			zap.String("issuer", telegramLoginIDTokens.Issuer()),
+			zap.Strings("signing_algorithms", telegramLoginIDTokens.SupportedAlgorithms()))
+	}
 
 	authKeyStore := postgres.NewAuthKeyStore(pool)
 	userStore := postgres.NewUserStore(pool)
@@ -585,6 +635,7 @@ func run(logger *zap.Logger) error {
 		botsapp.WithUserCache(userCache),
 		botsapp.WithStickerSetCreator(filesService),
 		botsapp.WithUserStickerSets(accountService),
+		botsapp.WithTelegramLogin(telegramLoginService),
 		botsapp.WithPublicBaseURL(cfg.PublicBaseURL))
 	groupCallStore := postgres.NewGroupCallStore(pool)
 	groupCallsService := groupcallsapp.NewService(groupCallStore, groupcallsapp.WithPublicBaseURL(cfg.PublicBaseURL))
@@ -800,6 +851,7 @@ func run(logger *zap.Logger) error {
 		EphemeralPush:        ephemeralStore,
 		EphemeralReports:     ephemeralReportStore,
 		Users:                usersService,
+		TelegramLogin:        telegramLoginService,
 		Updates:              updatesService,
 		BootstrapUpdates:     bootstrapUpdateStore,
 		BotAPIUpdates:        botAPIUpdateStore,
@@ -886,6 +938,9 @@ func run(logger *zap.Logger) error {
 	go activeSessions.RunPendingSweeper(ctx, time.Minute)
 	go router.RunPremiumSweeper(ctx, cfg.PremiumSweepInterval, cfg.PremiumSweepBatch)
 	go router.RunAccountLifecycle(ctx, time.Minute, 500)
+	if telegramLoginService != nil {
+		go runTelegramLoginRetention(ctx, telegramLoginService, cfg.TelegramLoginRetention, cfg.TelegramLoginSweepInterval, cfg.TelegramLoginSweepBatch, logger.Named("telegram-login-retention"))
+	}
 	go func() {
 		interval := cfg.StarGiftSweepInterval
 		if interval <= 0 {
@@ -934,6 +989,7 @@ func run(logger *zap.Logger) error {
 		Photos:          filesService,
 		UniqueGifts:     giftsService,
 		GiftWithdrawals: giftsService,
+		TelegramLogin:   telegramLoginHTTPHandler,
 	}, logger.Named("public-web")); err != nil {
 		return fmt.Errorf("start public Web: %w", err)
 	}
@@ -984,3 +1040,38 @@ func run(logger *zap.Logger) error {
 	// public listener so no seed/prewarm work can run after port 2398 is exposed.
 	return srv.ListenAndServe(ctx, cfg.ListenAddr)
 }
+
+func runTelegramLoginRetention(ctx context.Context, service *telegramloginapp.Service, retention, interval time.Duration, batch int, logger *zap.Logger) {
+	run := func() {
+		var total int64
+		// Bound one tick even when a deployment accumulated years of stale data;
+		// subsequent ticks continue without monopolizing the database pool.
+		for range 10 {
+			deleted, err := service.DeleteExpiredArtifacts(ctx, time.Now().UTC().Add(-retention), batch)
+			if err != nil {
+				if ctx.Err() == nil {
+					logger.Warn("telegram_login_retention_failed", zap.Error(err))
+				}
+				return
+			}
+			total += deleted
+			if deleted < int64(batch) {
+				break
+			}
+		}
+		if total > 0 {
+			logger.Info("telegram_login_retention_completed", zap.Int64("deleted", total))
+		}
+	}
+	run()
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			run()
+		}
+	}
+}