railway.toml - #43

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@railway.toml`:
- Around line 182-195: The task callback task_check currently awards $0.02 every
time it's pressed because it only re-checks membership (check_join) and calls
add_money unconditionally; make it idempotent by persisting per-user claim state
(e.g., add or use functions like has_claimed_task(uid) and
mark_task_claimed(uid)) and only call add_money(uid, 0.02) when the user has not
already claimed the task; update task_check to check has_claimed_task before
awarding, call mark_task_claimed immediately after awarding (or store a
timestamp for cooldown), and return a friendly message if the user already
claimed the reward to prevent repeated credits.
- Around line 7-11: The committed bot token and related settings (TOKEN,
CHANNEL, BOT_USERNAME, ADMIN_ID, ADMIN_GROUP_ID) are hardcoded and must be
rotated and removed; immediately rotate the exposed bot token, then change the
code/config to stop committing secrets by loading TOKEN, CHANNEL, BOT_USERNAME,
ADMIN_ID and ADMIN_GROUP_ID from environment variables at runtime (e.g., via
process.env or your config loader used in the project) and remove these literal
values from the repo; update any config-loading functions or constants that
reference those symbols to read from env, ensure local dev secrets are supplied
via a secure .env or secret manager (and not committed), and purge or invalidate
the leaked token from version history as appropriate.
- Around line 76-89: The require_join decorator currently checks is_banned and
check_join but doesn't ensure the user's DB row exists, which can cause
c.fetchone()[0] to fail when handlers read per-user fields; modify require_join
to call a get_or_create_user(uid) (or equivalent create_user_if_missing) before
any handlers run so the user's SQLite row is present, and similarly add the same
get_or_create_user step in the other handler(s) that read c.fetchone()[0] (the
section mentioned at 168-173) to avoid None results.
- Around line 209-227: get_qr and get_amount currently accept photos/numbers
from anyone and mutate withdraw_requests; restrict them to an active withdraw
flow by adding `@require_join` above both handlers and adding runtime checks that
the user initiated wd_start (e.g., ensure withdraw_requests contains uid and a
"started" flag or that wd_start populates withdraw_requests[uid] before
accepting input). In get_qr (function get_qr) only accept and store the photo if
withdraw_requests[uid] exists and is in the withdraw state, and in get_amount
(function get_amount) first verify withdraw_requests[uid] exists and
(optionally) contains the "qr" key before parsing amount; if checks fail, ignore
the message or send an error. Keep the callback_data logic and admin notify
unchanged but ensure both handlers are protected by `@require_join` and
state-validated to prevent unsolicited overrides.
- Around line 1-254: railway.toml currently contains the entire Python bot
source (starting with imports and TOKEN) which breaks Railway parsing; move all
Python code into a new file (e.g., main.py) and leave railway.toml as a valid
TOML config. Specifically, create main.py and copy the full bot logic (imports,
TOKEN, CHANNEL, BOT_USERNAME, ADMIN_ID, DB setup and functions like add_user,
get_balance, check_join, require_join, start, check_cb, acc, inv, daily,
task_btn, task_check, wd_start, get_qr, get_amount, wd_cb, admin_panel, and
bot.infinity_polling) into it, then replace railway.toml contents with only the
required TOML deployment keys for your project (no Python code).
- Around line 16-18: The module-level SQLite objects db and c (db =
sqlite3.connect(...), c = db.cursor()) are unsafe for concurrent pyTeleBot
handlers; either create a fresh sqlite3.connect(...) and connection.cursor()
inside each handler function that interacts with the DB (e.g., in your message
handler functions) and close them after use, or wrap all usages of the shared
db/c in a threading.Lock/queue to serialize access; update references to db and
c in functions like your handler callbacks to use the new per-handler
connection/cursor (or acquire/release the lock) so queries don't interleave and
return mismatched results.