fix: remove bot token and admin IDs from parameters database #10

Merged

deco merged 1 commit from deco/remove-system-params into main

2026-10-04 02:35:19 +03:00

AGit

deco commented

2026-10-04 00:47:31 +03:00

Owner

Removes the system.bot_token and system.admin_ids parameter definitions so credentials are no longer readable via /getparam, /listparams or /exportparams, drops the unused system ParameterCategory, and adds a regression test. 157/157 tests pass, tsc clean. Deploy note: existing rows must be deleted from the live sessions.db, and the bot token should be rotated if it was ever echoed into chat.

deco added 1 commit

2026-10-04 00:47:31 +03:00

fix: remove bot token and admin IDs from parameters database

CI / test (pull_request) Successful in 15s

Details

bc07fcb439

seedParameters stored process.env.BOT_TOKEN as system.bot_token and
process.env.ADMIN_IDS as system.admin_ids. Both were readable through
/getparam, /listparams and /exportparams, and every change was mirrored into
parameter_history, so the bot token could be echoed into a Telegram chat.

Delete both definitions, drop the now-unused "system" ParameterCategory and its
post-seed log line, and remove the storage argument seedParameters no longer
needs.

Adds a regression test that seeds into an in-memory database and asserts no
system.* key and no credential value survives. Verified that the test fails
when either definition is restored.

deco merged commit 38951df8d8 into main

2026-10-04 02:35:19 +03:00

deco referenced this pull request from a commit

2026-10-04 02:35:20 +03:00

Merge pull request 'fix: remove bot token and admin IDs from parameters database' (#10) from deco/remove-system-params into main