Restrict /auth to private chats

README.md

@@ -305,14 +305,13 @@ Available in any chat; no authentication required.
 These commands require signing in as a Federation operator first, and run with that operator's own permissions
 rather than the bot's.
 
-| Command                                               | Description                                                                                                                                                                                                                                                 |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `/auth <access_token>`                                | Sign in as a Federation operator with an access token                                                                                                                                                                                                       |
-| `/authinfo`                                           | Show your current operator identity and permissions                                                                                                                                                                                                         |
-| `/deauth`                                             | Sign out                                                                                                                                                                                                                                                    |
-| `/blacklist <identifier> <type> <expires>` (no reply) | Blacklist an entity without creating a supporting report                                                                                                                                                                                                    |
-| `/blacklist <type> <expires>` (reply)                 | Create a supporting report for the replied-to message's author, then blacklist them. Give an existing `<report_uuid>` before the type to blacklist against it instead, or the full `<identifier> <report_uuid> <type> <expires>` to skip the reply entirely |
-| `/link <entity> <target> <type>`                      | Record a relationship (`alternative`, `proxy`, or `child`) between two Federation entities                                                                                                                                                                  |
+| Command                               | Description                                                                                                                                                                                                                                                 |
+|---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `/auth <access_token>`                | Sign in as a Federation operator with an access token, in a private chat with the bot                                                                                                                                                                       |
+| `/authinfo`                           | Show your current operator identity and permissions                                                                                                                                                                                                         |
+| `/deauth`                             | Sign out                                                                                                                                                                                                                                                    |
+| `/blacklist <type> <expires>` (reply) | Create a supporting report for the replied-to message's author, then blacklist them. Give an existing `<report_uuid>` before the type to blacklist against it instead, or the full `<identifier> <report_uuid> <type> <expires>` to skip the reply entirely |
+| `/link <entity> <target> <type>`      | Record a relationship (`alternative`, `proxy`, or `child`) between two Federation entities                                                                                                                                                                  |
 
 ## Adding a Language
 

src/main/java/net/nosial/spb/handlers/operators/AuthenticationHandler.java

@@ -14,6 +14,7 @@
 import net.nosial.spb.objects.context.HandlerContext;
 import net.nosial.spb.objects.database.OperatorIdentity;
 import net.nosial.spb.utilities.HtmlEscape;
+import net.nosial.spb.utilities.ModerationActions;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.telegram.telegrambots.meta.api.objects.message.Message;
@@ -24,8 +25,9 @@
 /**
  * Handles an individual Telegram user's Federation operator credentials.
  *
- * <p>{@code /auth <access-token>} validates a token with the Federation server before
- * atomically persisting it against the caller's Telegram user id. {@code /deauth} removes that
+ * <p>{@code /auth <access-token>} validates a token with the Federation server before atomically
+ * persisting it against the caller's Telegram user id. It is only accepted in a private chat, since
+ * anywhere else the token would be visible to the whole chat. {@code /deauth} removes that
  * persisted credential. {@code /authinfo} creates a short-lived client with the caller's stored
  * credential and returns the current operator record from {@code getSelf()}. The process-wide
  * Federation client is never mutated, so one user's command cannot authenticate another user's
@@ -73,6 +75,23 @@ else if (isCommand(context.update(), "deauth"))
      */
     private static void authenticate(HandlerContext context, Message message, Language lang) throws TelegramApiException
     {
+        if (!isPrivateChat(message))
+        {
+            if (getMessagePayload(message) == null)
+            {
+                sendReply(context, message, context.languages().get(lang, "authentication", "private_only"));
+            }
+            else if (ModerationActions.deleteMessage(context, message))
+            {
+                sendReply(context, message, context.languages().get(lang, "authentication", "token_deleted"));
+            }
+            else
+            {
+                sendReply(context, message, context.languages().get(lang, "authentication", "token_not_deleted"));
+            }
+            return;
+        }
+
         if (!context.federation().isAvailable())
         {
             sendReply(context, message, context.languages().get(lang, "authentication", "unavailable"));

src/main/resources/languages/en.yml

@@ -402,6 +402,9 @@ blacklist:
 authentication:
   unavailable: "<b>Authentication Unavailable</b>\n\nFederation is not configured."
   usage: "Usage: <code>/auth &lt;access_token&gt;</code>"
+  private_only: "<b>Private Chat Only</b>\n\nSend <code>/auth</code> in a private chat with me, so your access token stays secret."
+  token_deleted: "<b>Access Token Exposed</b>\n\nYour access token was visible to this chat, so I deleted your message and did not use the token. Generate a new token on the Federation server, then send <code>/auth</code> in a private chat with me."
+  token_not_deleted: "<b>Access Token Exposed</b>\n\nYour access token is visible to this chat and I could not delete your message, so I did not use the token. Delete the message, generate a new token on the Federation server, then send <code>/auth</code> in a private chat with me."
   authenticated: "<b>Authenticated</b>\n\nSigned in as <b>{0}</b> (<code>{1}</code>).\n\nUse <code>/authinfo</code> to view your current operator permissions."
   rejected: "<b>Authentication Failed</b>\n\nThe access token was rejected by the Federation server."
   credential_store_failed: "<b>Authentication Failed</b>\n\nCould not store your credential. Please try again."

src/main/resources/languages/es.yml

@@ -402,6 +402,9 @@ blacklist:
 authentication:
   unavailable: "<b>Autenticación no disponible</b>\n\nLa Federación no está configurada."
   usage: "Uso: <code>/auth &lt;access_token&gt;</code>"
+  private_only: "<b>Solo en chat privado</b>\n\nEnvíe <code>/auth</code> en un chat privado conmigo para que su token de acceso siga siendo secreto."
+  token_deleted: "<b>Token de acceso expuesto</b>\n\nSu token de acceso era visible en este chat, por lo que eliminé su mensaje y no usé el token. Genere un token nuevo en el servidor de la Federación y luego envíe <code>/auth</code> en un chat privado conmigo."
+  token_not_deleted: "<b>Token de acceso expuesto</b>\n\nSu token de acceso es visible en este chat y no pude eliminar su mensaje, por lo que no usé el token. Elimine el mensaje, genere un token nuevo en el servidor de la Federación y luego envíe <code>/auth</code> en un chat privado conmigo."
   authenticated: "<b>Autenticado</b>\n\nInició sesión como <b>{0}</b> (<code>{1}</code>).\n\nUse <code>/authinfo</code> para ver sus permisos de operador actuales."
   rejected: "<b>Error de autenticación</b>\n\nEl token de acceso fue rechazado por el servidor de la Federación."
   credential_store_failed: "<b>Error de autenticación</b>\n\nNo se pudo guardar su credencial. Por favor, inténtelo de nuevo."

src/main/resources/languages/ru.yml

@@ -402,6 +402,9 @@ blacklist:
 authentication:
   unavailable: "<b>Авторизация недоступна</b>\n\nФедерация не настроена."
   usage: "Использование: <code>/auth &lt;access_token&gt;</code>"
+  private_only: "<b>Только в личном чате</b>\n\nОтправляйте <code>/auth</code> в личном чате со мной, чтобы ваш токен доступа оставался секретным."
+  token_deleted: "<b>Токен доступа раскрыт</b>\n\nВаш токен доступа был виден в этом чате, поэтому я удалил ваше сообщение и не использовал токен. Создайте новый токен на сервере Федерации, затем отправьте <code>/auth</code> в личном чате со мной."
+  token_not_deleted: "<b>Токен доступа раскрыт</b>\n\nВаш токен доступа виден в этом чате, а удалить ваше сообщение не удалось, поэтому токен не использован. Удалите сообщение, создайте новый токен на сервере Федерации, затем отправьте <code>/auth</code> в личном чате со мной."
   authenticated: "<b>Авторизация успешна</b>\n\nВы вошли как <b>{0}</b> (<code>{1}</code>).\n\nИспользуйте <code>/authinfo</code> для просмотра текущих прав оператора."
   rejected: "<b>Ошибка авторизации</b>\n\nТокен доступа отклонен сервером Федерации."
   credential_store_failed: "<b>Ошибка авторизации</b>\n\nНе удалось сохранить учетные данные. Попробуйте еще раз."

src/main/resources/languages/zh.yml

@@ -402,6 +402,9 @@ blacklist:
 authentication:
   unavailable: "<b>身份验证不可用</b>\n\n未配置联邦。"
   usage: "用法：<code>/auth &lt;access_token&gt;</code>"
+  private_only: "<b>仅限私聊</b>\n\n请在与我的私聊中发送 <code>/auth</code>，以确保您的访问令牌保密。"
+  token_deleted: "<b>访问令牌已泄露</b>\n\n您的访问令牌在此聊天中可见，因此我已删除您的消息，并且没有使用该令牌。请在联邦服务器上生成新令牌，然后在与我的私聊中发送 <code>/auth</code>。"
+  token_not_deleted: "<b>访问令牌已泄露</b>\n\n您的访问令牌在此聊天中可见，而我无法删除您的消息，因此没有使用该令牌。请删除该消息，在联邦服务器上生成新令牌，然后在与我的私聊中发送 <code>/auth</code>。"
   authenticated: "<b>已身份验证</b>\n\n已作为 <b>{0}</b> (<code>{1}</code>) 登录。\n\n使用 <code>/authinfo</code> 查看您当前的操作员权限。"
   rejected: "<b>身份验证失败</b>\n\n访问令牌被联邦服务器拒绝。"
   credential_store_failed: "<b>身份验证失败</b>\n\n无法存储您的凭据。请再试一次。"