Astra c39011e542 admin: allow shorter operator-assigned usernames, add reference docs

Lower the username floor to 3 characters on the admin-only write path
(account/channel set-username), separate from the 5-character self-service
minimum, since a deliberately short operator handle isn't the squatting the
higher floor guards against. Channel admin username assignment previously
had no length/format validation at all; this adds it.

Also adds three reference docs: the client's deep-link (tg://, owpg://)
surface, an OpenAPI 3.1 spec for both admin HTTP APIs (built from source,
not the stale docs/admin-panel-api.en.md), and a starter reserved-username
blocklist.

2026-09-17 15:24:31 +01:00

4.2 KiB

Raw Blame History

Suggested reserved usernames

A starter blocklist for TELESRV_RESERVED_USERNAMES (see internal/config/config.go, ReservedUsernames), beyond the shipped default (owpengram, admin, administrator, support, staff, moderator, official, root, owner). The mechanism blocks these, case-insensitively, from self-service account.updateUsername / channels.updateUsername — an operator can still assign one deliberately from the admin panel, since that's not the squatting this exists to stop.

Organized by why each entry is worth blocking. Trim or extend per your own deployment — none of this is enforced by the server itself, it's just a starting list to feed into the env var.

Official-sounding / staff-impersonation

Names that would read as "this account speaks for the operator" if a random user grabbed them.

telegram, telegramofficial, telegramsupport, telegramteam, telegramstaff,
telegramhq, telegramnews, telegramnotifications, telegramverify, telegrambot,
telegramservice, security, securityteam, verify, verification, verified,
helpdesk, helpcenter, customerservice, customersupport, servicedesk, service,
system, systemmessage, systembot, notifications, notification, alerts,
announcements, announcement, newsroom, press, pressoffice, spambot, antispam,
abuse, abusereport, reports, legal, compliance, billing, payments, finance,
accounts, accountservices, recovery, unlock, restore, backup, headquarters,
staffteam, modteam, moderation, moderators, founder, cofounder, management

Founders / executives (real people this server is not affiliated with)

Blocks an account from presenting as Telegram's actual leadership.

durov, pavel, paveldurov, pdurov, nikolai, nikolaidurov, ndurov, durovpavel,
telegramceo, telegramfounder

Crypto / scam-bait

The classic "free crypto giveaway" impersonation targets — official-sounding project/exchange names, plus generic scam-pattern handles.

bitcoin, ethereum, toncoin, tonwallet, tonfoundation, crypto, cryptowallet,
wallet, airdrop, giveaway, bonus, freecoins, claim, claimnow, binance,
coinbase, kraken, metamask, trustwallet, ledger, opensea, uniswap, elonmusk,
tesla, spacex, cryptosupport, walletsupport, tonsupport, binancesupport,
investment, investmentteam, forextrading, tradingbot, signals, cryptosignals

Suggested env var

Comma-separated, matching envListOr's parsing:

TELESRV_RESERVED_USERNAMES=owpengram,admin,administrator,support,staff,moderator,official,root,owner,telegram,telegramofficial,telegramsupport,telegramteam,telegramstaff,telegramhq,telegramnews,telegramnotifications,telegramverify,telegrambot,telegramservice,security,securityteam,verify,verification,verified,helpdesk,helpcenter,customerservice,customersupport,servicedesk,service,system,systemmessage,systembot,notifications,notification,alerts,announcements,announcement,newsroom,press,pressoffice,spambot,antispam,abuse,abusereport,reports,legal,compliance,billing,payments,finance,accounts,accountservices,recovery,unlock,restore,backup,headquarters,staffteam,modteam,moderation,moderators,founder,cofounder,management,durov,paveldurov,pdurov,nikolai,nikolaidurov,ndurov,durovpavel,telegramceo,telegramfounder,bitcoin,ethereum,toncoin,tonwallet,tonfoundation,crypto,cryptowallet,wallet,airdrop,giveaway,bonus,freecoins,claim,claimnow,binance,coinbase,kraken,metamask,trustwallet,ledger,opensea,uniswap,elonmusk,tesla,spacex,cryptosupport,walletsupport,tonsupport,binancesupport,investment,investmentteam,forextrading,tradingbot,signals,cryptosignals

What this doesn't cover

Collectible usernames (internal/admin/service.go collectible-username actions) go through the admin panel/Admin API directly and aren't gated by this list at all — an operator minting one bypasses it on purpose.
Prefix/substring squatting (telegram_real, xtelegram, te1egram) — the blocklist is an exact-match (case-insensitive) list, not a pattern matcher, so lookalike spellings need their own entries if you want them blocked too.
This is a username blocklist only — it says nothing about display names, bios, or profile photos, which can impersonate just as easily and aren't restricted by TELESRV_RESERVED_USERNAMES at all.

4.2 KiB Raw Blame History