Verify Cloudflare runtime compatibility and add read-only relay diagnostics

README.md

@@ -63,6 +63,10 @@ Telegram as before. The Worker holds its own bot token and allows only this
 monitor's five Bot API methods for one numeric chat ID. Both normal delivery and
 authenticated diagnostics use the configured transport.
 
+When the relay is configured, read-only `/diagnostics` and `/status` also accept
+`Authorization: Bearer TELEGRAM_RELAY_SECRET`. The existing webhook-secret
+routes continue to work. This does not authorize incoming publication webhooks.
+
 See `telegram-relay/README.md` for deployment and secret configuration. Verify
 the relay's read-only getMe, getChat and getChatMember checks before rebuilding
 the Space, then verify an actual publication arrives after deployment. Neither

receiver.py

@@ -28,7 +28,7 @@ from urllib.parse import urlsplit
 from zoneinfo import ZoneInfo
 
 LOG = logging.getLogger("monitor")
-VERSION = "1.2-delivery-health"
+VERSION = "1.3-telegram-relay"
 MAX_BYTES = 1024 * 1024
 AI_CHUNK = 12000
 DEFAULT_PROMPT = """Ты классификатор публикаций для мониторинга нового внешнего вида
@@ -331,7 +331,9 @@ def network_error_category(exc):
 
 def request_json(url, payload, headers=None, service="api", timeout=45):
     request = urllib.request.Request(url, data=json.dumps(payload, ensure_ascii=False).encode(),
-                                     headers={"Content-Type": "application/json", **(headers or {})}, method="POST")
+                                     headers={"Content-Type": "application/json", "Accept": "application/json",
+                                              "User-Agent": "MedialogiaMonitor/" + VERSION,
+                                              **(headers or {})}, method="POST")
     try:
         with urllib.request.urlopen(request, timeout=timeout) as response:
             result = json.loads(response.read(2 * MAX_BYTES))
@@ -596,15 +598,21 @@ def make_server(monitor, host="0.0.0.0", port=7860):
         def authorized(self, prefix):
             return secrets.compare_digest(urlsplit(self.path).path.encode(), (prefix + monitor.config.secret).encode())
 
+        def relay_authorized(self):
+            secret = monitor.config.telegram_relay_secret
+            return bool(secret) and secrets.compare_digest(
+                self.headers.get("Authorization", "").encode(), ("Bearer " + secret).encode())
+
         def do_GET(self):
             if urlsplit(self.path).path == "/live":
                 return self.reply(200, {"status": "alive", "version": VERSION})
             if urlsplit(self.path).path in ("/", "/health"):
                 health = monitor.health()
                 return self.reply(503 if health["status"] in ("storage_unavailable", "worker_unavailable") else 200, health)
-            if self.authorized("/diagnostics/"):
+            if self.authorized("/diagnostics/") or (urlsplit(self.path).path == "/diagnostics" and self.relay_authorized()):
                 return self.reply(200, monitor.clients.diagnose_telegram())
-            if self.authorized("/status/") or self.authorized("/samples/"):
+            if (self.authorized("/status/") or self.authorized("/samples/")
+                    or (urlsplit(self.path).path == "/status" and self.relay_authorized())):
                 try:
                     return self.reply(200, monitor.status())
                 except Exception:

telegram-relay/worker.mjs

@@ -83,19 +83,29 @@ export default {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify(input.payload),
-          redirect: "error",
+          redirect: "manual",
           signal: AbortSignal.timeout(8000),
         },
       );
+      if (response.status >= 300 && response.status < 400) return reply(502, "telegram_unexpected_redirect");
       const body = await response.text();
-      const data = JSON.parse(body);
+      let data;
+      try {
+        data = JSON.parse(body);
+      } catch {
+        return reply(502, "telegram_upstream_non_json_http_" + response.status);
+      }
       if (!data || typeof data.ok !== "boolean") return reply(502, "telegram_invalid_response");
       return new Response(body, {
         status: response.status,
         headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
       });
-    } catch {
-      return reply(502, "telegram_upstream_unavailable");
+    } catch (error) {
+      if (typeof AbortSignal.timeout !== "function") return reply(502, "telegram_timeout_api_unavailable");
+      if (String(error.message).includes("Network connection lost")) return reply(502, "telegram_network_connection_lost");
+      if (String(error.message).includes("resolve")) return reply(502, "telegram_dns_error");
+      const category = ["TimeoutError", "AbortError", "TypeError"].includes(error.name) ? error.name : "unknown";
+      return reply(502, "telegram_upstream_" + category);
     }
   },
 };