The bot-side half of TODO #4. Nothing federates yet; this establishes
what would be eligible to, and proves the boundary before there is a
hub that could leak across it.
- Schema v5 adds visibility, defaulting to private. Upgrading an
existing library therefore opts nothing into sharing, which a test
on the legacy upgrade path pins down.
- list_syncable() is the only function that will ever feed a hub, and
it requires both public and approved. Tests force rows into states
set_visibility refuses, so the filter is what protects the boundary
rather than the caller being careful.
- set_visibility refuses anything not approved: media still in the
moderation queue cannot be marked shared.
- /share lists memes with their current state and asks before making
one public, since un-sharing stops future copies but cannot recall
those already taken. The wording describes what sharing will mean
once a hub exists, because by then warning is too late.
- /list shows the same markers.
Vault posts have no path into the sync set at all; being in a separate
table is what guarantees it, and there is a test saying so.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Completes TODO #5. Forwarding a post now asks whether to save it whole
or extract its media; sending media directly is unchanged.
Built on forwarding rather than copying file_ids. The bot already has
the post in its private chat with the owner, so it stores message ids
and forwards them back. forwardMessages takes a list and keeps an album
intact, which is what made the caption-plus-album case tractable; ids
must be strictly ascending, so they are sorted on the way out.
- Vault rows live in their own table and every query is scoped to an
owner_id, so a guessed id cannot reach someone else's saved post.
Nothing in the vault is searchable inline, moderated or federated,
and the separate table makes that structural rather than a flag.
- Albums arrive as separate messages with no completion signal, so they
are buffered by media_group_id behind a 1s debounce and prompt once.
- The add path now takes a list of items, so extracting an album stores
every piece under one set of keywords instead of asking repeatedly.
- /vault searches keywords and the original caption, since the point of
a vault is finding something you never got round to tagging.
- Retrieval failures are reported: a message id is a pointer into the
chat, not a self-contained file_id, so clearing history breaks it.
Three near-identical keyword collectors are now one helper.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Completes TODO #2. PUBLIC_MODE swaps the ALLOWED_USERS allowlist for a
membership check against REQUIRED_CHATS, with REQUIRE_MODE choosing
between needing every chat or just one.
- Stop is_admin() falling back to "everyone is an admin" when
ADMIN_USERS is unset once PUBLIC_MODE is on. That fallback is the
original single-owner convenience, but under public mode it handed
moderation, /edit and /delete to anyone who found the bot. Public
mode now grants admin to nobody until ADMIN_USERS is set, and says
so at startup. Private deployments are unaffected.
- Cache membership answers: inline search queries on every keystroke,
so an uncached check meant several API calls per typed character.
Grants last five minutes, refusals thirty seconds, so a user who has
just joined is not locked out for the full window.
- Fail closed when the membership check errors, and validate
REQUIRED_CHATS at startup so a chat the bot cannot read is reported
rather than silently refusing every user.
- Refused users get a join prompt with real links instead of silence;
inline shows a tappable bar that opens the bot and explains why.
A private bot stays silent as before.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Completes TODO #3. Submissions are gated behind ACCEPT_SUBMISSIONS,
which defaults to off: is_allowed() treats everyone as allowed when
ALLOWED_USERS is empty, so opening submissions implicitly would have
accepted media from anyone who found the bot.
- Schema v3 adds status, reviewed_by and reviewed_at. Existing rows
default to approved, so upgrading changes nothing for a running bot.
- Search, /list and counts only return approved items; callers that
need everything pass status=None.
- /review shows the oldest pending item with approve, reject, fix
keywords and stop. No cursor is stored anywhere: each action just
asks for the next pending item, which is what lets a moderator stop
and resume later, and lets several moderators share one queue.
- set_status only updates rows still pending, so if two moderators open
the same item the first decision wins and the second is told so.
- A failed send no longer wedges the queue; the item's details are
shown anyway so it can still be rejected.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Completes TODO #6. The bot accepted photo, animation, video, voice and
sticker; music files, documents and round videos were silently dropped.
- Replace the five near-identical media handlers with one dispatch table.
Animations are matched before documents because Telegram populates
both fields for a GIF, so the old ordering would have filed every GIF
as a document once document support existed.
- Store video notes as "video". Telegram has no cached inline result for
video notes, so this is what keeps round videos searchable; it costs
the round presentation on playback.
- Build inline results from a table keyed by media_type, and cover audio
and document. A test asserts every storable type has a builder, so a
new media type cannot be added without a way to return it.
- Reuse one MEDIA_FILTER for both the idle and mid-keyword handlers;
the second list had already drifted from the first.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Step 0 of the roadmap: everything from the moderation queue onward adds
columns, and init_db could only ever run CREATE TABLE IF NOT EXISTS, so
it could not alter a live deployment.
- Track schema state in PRAGMA user_version and run ordered migrations.
Fresh installs create the v1 table and migrate forward, so the upgrade
path runs on every new deployment rather than only on old ones.
- Rebuild media with UNIQUE(owner_id, file_unique_id). The old global
unique constraint stopped two users from each saving the same file,
which blocks public mode.
- Replace INSERT OR REPLACE with an upsert. Replacing deleted and
reinserted the row, giving it a new id and silently invalidating any
id the user had noted from /list.
- Give search_media an optional owner_id scope, defaulting to the
current shared-library behaviour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Design-only document covering the moderation queue, public mode,
save-vs-extract vault, and federation. Records the four decisions
taken on the roadmap and the API claims verified against aiogram
3.15.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
VERSION had been left at 1.0.0 while the registry already carried 1.0.1, so
push.sh (which defaults to the VERSION file) would have rebuilt an existing
tag. This realigns the file with what is actually published.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Split docker-compose into build (docker-compose.build.yaml) and deploy (docker-compose.yaml pulls from registry)
- Add push.sh for building and pushing versioned images to git.goyban.com/goyban/bot_meme
- Add ADMIN_USERS env var; admins can add/edit/delete, users can search
- Add /edit command with inline keyboard to update meme keywords
- Add sticker support (save and serve via inline)
- Switch /delete to use numeric row ID instead of file_unique_id
- Search is now global (shared pool) instead of per-user
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
goyban
goyban
snail