Bedolaga Bot

repository·main·Indexed 21 days ago

https://github.com/bedolaga-dev/remnawave-bedolaga-telegram-bot

An automation platform for VPN businesses that integrates with the Remnawave backend. It enables the operation of a full-scale VPN subscription service via Telegram, featuring user management, a unified balance system supporting 24+ payment providers, flexible tariffs, referral programs, and an administrative panel. The system includes the Bedolaga Cabinet, a React + TypeScript web dashboard for analytics, RBAC, and OAuth authorization.

Tokens
47.7K
Snippets
94
Records
177
Agent score
76%

What's inside remnawave-bedolaga-telegram-bot

  1. Overview of Bedolaga Bot

    main

    Bedolaga Bot is a Telegram-based automation platform designed for VPN businesses. It integrates directly with the Remnawave backend to manage the entire subscription lifecycle, including user registration, payment processing, and subscription renewals.

    Key components include:

    • Telegram Bot: Handles payments, issues subscriptions, and manages users.
    • Bedolaga Cabinet: A separate web-based dashboard (built with React + TypeScript) that extends the bot's capabilities with features like OAuth authorization (Google, Yandex, Discord, VK, Telegram OIDC), sales analytics, RBAC, and landing pages.
  2. Explore Admin Handlers in app/handlers/admin

    main

    The app/handlers/admin directory contains the logic for all administrative functions of the bot. Each module typically exposes a register_handlers function to integrate its logic into the main application. Key administrative areas include:

    • Configuration & System: bot_configuration.py (settings), maintenance.py (maintenance mode), system_logs.py (log viewing), and updates.py (version info).
    • User & Subscription Management: users.py, subscriptions.py, referrals.py, and pricing.py.
    • Marketing & Promotions: campaigns.py, promocodes.py, promo_groups.py, and promo_offers.py.
    • Communication & Support: messages.py (broadcasts), user_messages.py (user-to-admin messages), tickets.py (support tickets), and support_settings.py.
    • Infrastructure: servers.py, remnawave.py, monitoring.py, and backup.py.
    • Content Management: faq.py, privacy_policy.py, rules.py, and welcome_text.py.
  3. Understand the Bedolaga Bot project structure

    main

    The project is organized into a core app directory containing the main logic, divided into functional modules:

    • app/bot.py: The main entry point for the Telegram bot.
    • app/config.py: Configuration management via the Settings class.
    • app/database/: Data persistence layer, including models, migrations, and CRUD operations.
    • app/external/: Integrations with third-party services (e.g., CryptoBot, RemnaWave API, YooKassa).
    • app/handlers/: Telegram message and callback handlers, organized by feature (e.g., admin, subscription, support).
    • app/keyboards/: UI components (buttons/menus).
    • app/localization/: Multi-language support.
    • app/middlewares/: Telegram middleware logic.
    • app/services/: Business logic services.
    • app/states.py: Finite State Machine (FSM) state definitions for user flows.
    • app/utils/: General utility functions.
    • app/webapi/: Web API implementation.
  4. Understand the project root structure

    main

    The project root contains configuration files, deployment assets, and the core application directory. Key files for setup and deployment include:

    • .env and .env.example: Environment variable configuration.
    • Dockerfile and docker-compose.yml: Containerization and orchestration.
    • install_bot.sh: Shell script for installation.
    • main.py: The primary entry point for the application.
    • requirements.txt: Python dependencies.
    • app/: The core application logic.
    • migrations/: Database migration files managed by Alembic.
    • app-config.json: Application-specific configuration.
    • assets/, data/, locales/, logs/: Directories for static assets, persistent data, localization, and logging.
  5. Core Features of Bedolaga Bot

    main

    Bedolaga provides a comprehensive suite of tools for running a VPN service via Telegram, categorized into four main areas:

    Subscriptions and Tariffs

    • Flexible plans (varying durations).
    • Traffic management: Unlimited, fixed limits, or add-on packages.
    • Device management: Limit the number of devices per subscription (1–20) or disable limits.
    • Server selection: Automatic selection or manual configuration.
    • Trial periods: Free or paid trials that can convert to full subscriptions.
    • Smart cart: Saves selections if the user has insufficient balance.
    • Auto-renewal: Triggered 3 days before expiration.
    • Gift subscriptions and configurable landing pages.

    Payments

    • Support for 24+ payment providers simultaneously.
    • Unified balance system: Users top up their balance via any method and then purchase using that balance.
    • Automatic subscription purchase after successful top-up.
    • Recurring payments (saved cards).
    • Fiscalization via НалоGo (for self-employed users).
    • Automatic payment status verification.
    • Guest purchases via landing pages.

    Marketing and Promotion

    • Promo codes (for money, subscription days, or trials).
    • Referral programs with fund withdrawals and partner systems.
    • Segmented user mailing lists.
    • Custom landing pages with analytics.
    • Contests and daily games with prizes.
    • Personal offers and discounts.
    • Marketing campaigns with tracking.
    • Mandatory multi-subscription to Telegram channels (with auto-cancellation if the user unsubscribes from the channel).

    Administration

    • In-Telegram management panel.
    • User, subscription, and payment management.
    • Topic notifications for purchases, renewals, and top-ups.
    • Automatic database backups with restoration via the bot.
    • Maintenance mode (auto-detects Remnawave panel unavailability).
    • Traffic and anomaly monitoring.
    • RBAC (Role-Based Access Control) with granular permissions.
    • Detailed reporting and referral network visualization.
    • Global user blacklist/blocking.
  6. Reference the project directory structure

    main

    The project is organized into several functional directories:

    • app/: Core application logic.
      • app/database/: Database-related code.
      • app/external/: Integrations with external services.
      • app/handlers/: Telegram bot event handlers.
    • migrations/alembic/: Database migration management.
    • docs/: Project documentation (e.g., miniapp-setup.md, web-admin-integration.md).
    • miniapp/: Files for the Telegram Mini App, including app-config.json and index.html.
    • locales/: Internationalization files (en.json, ru.json).
    • data/: Persistent data, including bot.db and backups/.
    • logs/: Application logs (e.g., bot.log).
    • assets/: Static assets like logos and SVGs.
  7. Use the WebSocket Envelope for Commands and Results

    main

    All communication follows a specific envelope structure. Commands sent by the client include a type, command, requestId, sentAt, and a payload. Results returned by the server use type: "command.result" and include an ok boolean, the original requestId, and either a payload (on success) or an error object (on failure).

    Error Object Schema: When ok is false, the error object contains:

    • code: Error identifier (e.g., VALIDATION_ERROR, NOT_FOUND, RATE_LIMITED, PAYLOAD_TOO_LARGE).
    • message: Human-readable string.
    • retryable: Boolean indicating if the client should attempt the command again.
    • details: An object containing additional context.
    • retryAfterMs: An integer (or null) specifying wait time before retrying.
    • backpressure: Populated only for BACKPRESSURE error types.
    // Client Command
    {
      "type": "command",
      "command": "ticket.list",
      "requestId": "string",
      "sentAt": "2026-07-09T00:00:00Z",
      "payload": {}
    }
    
    // Successful Result
    {
      "type": "command.result",
      "command": "ticket.list",
      "requestId": "string",
      "ok": true,
      "receivedAt": "2026-07-09T00:00:00Z",
      "payload": {}
    }
    
    // Failure Result
    {
      "type": "command.result",
      "command": "ticket.list",
      "requestId": "string",
      "ok": false,
      "receivedAt": "2026-07-09T00:00:00Z",
      "error": {
        "code": "VALIDATION_ERROR",
        "message": "string",
        "retryable": false,
        "resourceType": null,
        "resourceId": null,
        "details": {},
        "retryAfterMs": null,
        "backpressure": null
      }
    }
  8. Security Requirements for iOS IAP

    main

    To maintain a secure implementation, adhere to these constraints:

    Prohibited Actions:

    • Never hardcode App Store Connect API keys in the iOS app.
    • Never call the App Store Server API directly from the iOS app.
    • Never generate the backend appAccountToken locally.
    • Never trust client-side price or amount for crediting.
    • Never log sensitive data: auth tokens, raw transaction JWS, backend account tokens, full backend request/response bodies for purchase delivery, or personally identifiable account data.

    Required Actions:

    • All backend calls must use HTTPS.
    • Pending delivery storage must not expose auth tokens.

    Allowed Logging Fields:

    • product_id
    • transaction_id
    • High-level result
    • http_status code
    • retry_count
  9. Manage Account Switching and Logout Behavior

    main

    Account switching is a critical security boundary to prevent one user from receiving another user's purchases.

    Requirements:

    • Caching: Cache the account token per backend user.
    • Pending Deliveries: Every pending delivery must include the backend user ID.
    • Validation:
      • If the active user differs from the pending delivery user, do not deliver it.
      • If the StoreKit transaction contains an appAccountToken that differs from the active user's backend token, do not deliver it.
    • On Logout:
      • Stop the user-initiated purchase UI.
      • Keep the transaction observer running if the app architecture allows.
      • Do not deliver pending purchases until a matching user session exists.
    • On Login:
      • Fetch the account token.
      • Retry only the pending deliveries that belong to that specific backend user.
  10. Referral program behavior and UI impact

    main

    Setting REFERRAL_PROGRAM_ENABLED to false triggers the following behaviors:

    • UI Hiding: Buttons containing keywords like partner, referr, партнер, or реферал are removed from the main menu. This includes the "🤝 Партнерка" button and the "👥 Мои рефералы" button.
    • Admin Access: Administrative tools for the referral program are NOT hidden; they remain available in the admin panel for management.
    • API Integration: The setting is respected by the API and other connected services that consume referral program information.
  11. Manage runtime-editable settings via specialized services

    main

    Several services are designed to manage settings that can be edited at runtime and persisted to disk:

    • NotificationSettingsService: Manages notification settings (32 methods).
    • SupportSettingsService: Manages support settings with JSON persistence (23 methods).
    • BotConfigurationService (within system_settings_service.py): Provides a comprehensive interface for bot configuration (33 methods). Note that attempting to modify read-only settings will raise a ReadOnlySettingError.