ticketfrei / ticketfrei

a micro-messaging bot to organize using public transport without having to pay.

ISC License

21 stars 5 forks source link

telegram mechanism to create a bot. #26

Open b3yond opened 6 years ago

b3yond commented 6 years ago

stage 1:

[x] the mod needs a telegram account. they need to write to the botfather to create a telegram bot. botfather responds with 1 API key. Mod enters API key into settings.tpl and is a happy mod.

stage 2:

[ ] ticketfrei needs a telegram account to register a new bot. this account writes to botfather and creates a bot. Botfather responds with API key, needs to be written into db.

git-sid commented 5 years ago

Stage 1 may be better for our goal: In stage 2, Telegram might ban the ticketfrei account which creates the necessary bots. A takedown of the account would lead to offtime for all created bots. Stage 1 however mitigates this attack vector through decentralization. Banning an account would only impair the functionality of its bot, while keeping the rest unaffected.

My suggestion would be to let the user choose between both options: Use stage 2 as standard and offer stage 1 as an advanced (and recommended) option.

b3yond commented 5 years ago

There is this telegram cli client which we could use for stage 2 - but it hasn't been developed since 2016 and I'm not deep enough into telegram to judge if it fits our requirements: https://github.com/vysheng/tg

git-sid commented 5 years ago

We could use Telethon instead of tg. Looks like it's active. We would still need an account to get access to the telegram api.

I'd look like this (step 0-2 are only necessary once per project deploy. Step 4 to end is repeated once per new bot).

create a telegram account if you don't have one.
Log in https://my.telegram.org with the ticketfrei telegram account that should create the bots.
Get the api id and api hash from the API Development section in https://my.telegram.org
Use them in Telethon to a create bot.
Get the necessary bot api token with Telethon to be able to control our recently created bot.

b3yond commented 5 years ago

step 3 & 4 can be automated, so you don't have to do that for every city manually.

I registered API keys, which we can now use for testing. Ask me for it, I'll only give them around internally.

b3yond commented 5 years ago

We should introduce an option to choose between stage1 and stage2. If an admin does not have telegram, they could not administer the platform. This should not be a hard requirement for running Ticketfrei.

The settings page can then either show moderators the option to add an API key (as it's needed for stage1) or just tell them that they now have a Telegram bot (including the options for setting name, description, profile pic. #63).

b3yond commented 5 years ago

Note: stage2 is less resilient against censorship by Telegram. If Telegram blocks the account of the admin, all cities lose their Telegram bots. Not that likely though, and if that happens, the admin can still switch back to stage1. But all the bots will lose their Telegram followers. Admins have to consider if they really want to enable this.

git-sid commented 5 years ago

A choice in the frontend like "We'll setup a telegram bot. Alternatively you can use your own by inserting its API key here: __. See [link to some helppage where they explain how to get the api key in telegram] for help." would be nice.