73 lines
2.3 KiB
Dart
73 lines
2.3 KiB
Dart
|
import 'dart:convert';
|
||
|
|
import 'dart:developer';
|
||
|
|
import 'package:crypto/crypto.dart' as crypto;
|
||
|
|
|
||
|
|
class TelegramUtils {
|
||
|
|
static const _botToken = '7057032753:AAFP-BCpdry-YuBUOqx1W8dGxiFQdSOJlpI';
|
||
|
|
|
||
|
|
/// Validates the data received from the Telegram web app
|
||
|
|
/// Following the Python implementation exactly
|
||
|
|
bool checkValidateInitData(String hashStr, String initData, String token,
|
||
|
|
{String cStr = "WebAppData"}) {
|
||
|
|
try {
|
||
|
|
// Decode URL-encoded string
|
||
|
|
final decodedData = Uri.decodeComponent(initData);
|
||
|
|
|
||
|
|
// Split into chunks and filter out hash parameter
|
||
|
|
final chunks = decodedData
|
||
|
|
.split('&')
|
||
|
|
.where((chunk) => !chunk.startsWith('hash='))
|
||
|
|
.map((chunk) => chunk.split('='))
|
||
|
|
.toList();
|
||
|
|
|
||
|
|
// Sort by first element (key)
|
||
|
|
chunks.sort((a, b) => a[0].compareTo(b[0]));
|
||
|
|
|
||
|
|
// Create data string with newline separator
|
||
|
|
final dataString = chunks.map((rec) => '${rec[0]}=${rec[1]}').join('\n');
|
||
|
|
|
||
|
|
// Create secret key: HMAC_SHA256(cStr, token)
|
||
|
|
final secretKey = crypto.Hmac(crypto.sha256, utf8.encode(cStr))
|
||
|
|
.convert(utf8.encode(token));
|
||
|
|
|
||
|
|
// Create data check hash: HMAC_SHA256(secretKey, dataString)
|
||
|
|
final dataCheck = crypto.Hmac(crypto.sha256, secretKey.bytes)
|
||
|
|
.convert(utf8.encode(dataString));
|
||
|
|
|
||
|
|
// Compare hex digests
|
||
|
|
return dataCheck.toString() == hashStr;
|
||
|
|
} catch (e) {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
Future<String?> getUserId(String initialData) async {
|
||
|
|
try {
|
||
|
|
final tgWebAppData = Uri.decodeComponent(initialData);
|
||
|
|
// Extract hash from the data
|
||
|
|
final hashMatch = RegExp(r'hash=([^&]+)').firstMatch(tgWebAppData);
|
||
|
|
if (hashMatch == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
final hash = hashMatch.group(1)!;
|
||
|
|
// Validate using the new method
|
||
|
|
if (!checkValidateInitData(hash, tgWebAppData, _botToken)) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Extract user ID from user parameter
|
||
|
|
final userMatch = RegExp(r'user=([^&]+)').firstMatch(tgWebAppData);
|
||
|
|
if (userMatch == null) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
|
||
|
|
final userJson = Uri.decodeComponent(userMatch.group(1)!);
|
||
|
|
final userData = jsonDecode(userJson) as Map<String, dynamic>;
|
||
|
|
final userId = userData['id']?.toString();
|
||
|
|
return userId;
|
||
|
|
} catch (e) {
|
||
|
|
return null;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|