You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: adminforth/documentation/docs/tutorial/03-Customization/12-security.md
+43Lines changed: 43 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -242,3 +242,46 @@ export const admin = new AdminForth({
242
242
```
243
243
244
244
Now, if a user’s field `status` is changed to "banned", they won’t be able to perform any actions and moreover will be automatically logged out upon accessing the page.
This means that a user is allowed to make up to 20 requests within one day, and once this limit is reached, any further requests will be blocked until the 24-hour period resets.
280
+
281
+
### Supported time units
282
+
- s → seconds (10s)
283
+
- m → minutes (5m)
284
+
- h → hours (1h)
285
+
- d → days (1d)
286
+
287
+
> ☝ Сonsume(key) is used to check whether a specific key such as a userId, IP address, or any other identifier has exceeded its allowed request limit. If the limit has not been reached, it returns true, meaning the request is allowed to proceed.
The webhook secret confirms that the request came through Telegram. Your app should still map the Telegram user id to a real AdminForth admin user before running the agent.
24
+
The webhook secret confirms that the request came through Telegram.
24
25
25
-
## Admin user field `telegramId`
26
+
## Admin user field `externalUserId`
26
27
27
-
To map Telegram users to AdminForth admin users, the adapter looks up an admin user record by Telegram user id.
28
-
By default it expects the admin user resource to have a field named `telegramId`.
28
+
External chat accounts are linked by the Agent plugin, not by the Telegram adapter directly. The plugin stores linked external user ids in a JSON field on the AdminForth auth user resource.
29
29
30
-
Add this field to your `adminuser` resource:
30
+
By default this field is named `externalUserId`. Add it to your `adminuser` resource:
31
31
32
32
```ts
33
33
{
34
-
name: 'telegramId',
35
-
type: AdminForthDataTypes.STRING,
36
-
showIn: ['show', 'edit', 'create'],
34
+
name: 'externalUserId',
35
+
type: AdminForthDataTypes.JSON,
37
36
},
38
37
```
39
38
40
-
Also add the matching column to your database schema and run a migration. For example, with Prisma:
39
+
Also add the matching column to your database schema and run a migration. For example, with Prisma and PostgreSQL:
41
40
42
41
```prisma title="schema.prisma"
43
42
model adminuser {
44
43
// existing fields
45
-
telegramId String?
44
+
externalUserId Json?
46
45
}
47
46
```
48
47
48
+
For Prisma SQLite, store the same field as text:
49
+
50
+
```prisma title="schema.prisma"
51
+
model adminuser {
52
+
// existing fields
53
+
externalUserId String?
54
+
}
55
+
```
56
+
57
+
AdminForth should still define this resource column as `AdminForthDataTypes.JSON`; the SQLite connector serializes it into the text column and parses it back.
58
+
49
59
Then create and apply the migration using your app's migration scripts:
When `botUsername` is configured, the Agent plugin adds **Chat Surfaces** to the user menu settings pages. A logged-in AdminForth user can open that page and click **Connect**. The Telegram adapter returns a URL like:
113
+
114
+
```txt
115
+
https://t.me/<botUsername>?start=<link-token>
116
+
```
117
+
118
+
After the user starts the bot with that token, AdminForth stores the Telegram user id in `externalUserId.telegram`. The same page also supports reconnecting and disconnecting the Telegram account.
119
+
120
+
You can also prefill the JSON field manually if you do not want to use the connect page.
121
+
93
122
## Adapter options
94
123
95
124
All options for `new TelegramChatSurfaceAdapter(options)`:
96
125
97
126
-`botToken` (string, required) — Telegram bot token from BotFather.
127
+
-`botUsername` (string, optional) — bot username used to build the account-link URL for the **Chat Surfaces** settings page.
98
128
-`webhookSecret` (string, optional) — secret token configured in Telegram `setWebhook`.
Next steps (Telegram bot setup, webhook URL, required `telegramId` field on the admin user resource, and all adapter options) are documented here:
308
+
When an adapter supports account linking, the Agent plugin adds a user menu settings page named **Chat Surfaces** where logged-in users can connect, reconnect, and disconnect external accounts.
309
+
310
+
For Telegram setup, including required user fields, webhook URL, environment variables, and adapter options, see:
message: `${t('Deleting')}${checkboxes.value.length}${checkboxes.value.length===1 ? t('item') : t('items')}. ${t('This process is irreversible.')}`,
64
+
message: t('Deleting {count} item. This process is irreversible. | Deleting {count} items. This process is irreversible.',{count: checkboxes.value.length}),
0 commit comments