Main by harshbhx · Pull Request #5 · dualmindlabs/DualMind_Back

harshbhx · 2026-08-09T16:35:37Z

No description provided.

…ploy workflow and Program.cs

gitguardian · 2026-08-09T16:35:46Z

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
28226697	Triggered	Supabase Service Role JWT	`023d42f`	.tmp-build/api-secure/appsettings.json	View secret
28226699	Triggered	JSON Web Token	`023d42f`	.tmp-build/api/appsettings.json	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

Copilot

Pull request overview

This PR extends the DualMind.API backend with Telegram webhook delivery support (including richer bot state handling for battles), introduces role-based authorization via claims transformation for admin endpoints, and adds deployment-related updates for Cloudflare Containers (health endpoint, Docker/workflow changes, and a Worker wrapper).

Changes:

Add Telegram webhook infrastructure (delivery mode options, webhook controller, transport updates, pending/active battle state handling) and expand automated test coverage for these flows.
Introduce admin role enforcement via IClaimsTransformation + AdminOnly authorization policy, plus a user-sync adjustment to preserve existing roles.
Add Cloudflare Containers deployment scaffolding (Worker entrypoint + wrangler config), health endpoint, and container build/healthcheck updates.

Reviewed changes

Copilot reviewed 121 out of 290 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
tests/DualMind.API.Tests/TelegramWebhookControllerTests.cs	Adds coverage for webhook payload handling and secret-token rejection.
tests/DualMind.API.Tests/TelegramUpdateHandlerTests.cs	Updates bot handler tests and adds coverage for pending/active battle text replies.
tests/DualMind.API.Tests/TelegramStateCacheTests.cs	Adds tests for pending-battle lifecycle and clearing active battles.
tests/DualMind.API.Tests/TelegramBotServiceCollectionExtensionsTests.cs	Adds tests for resolving Telegram API base URL from WEBSITE_HOSTNAME.
tests/DualMind.API.Tests/TelegramBotOptionsTests.cs	Adds tests for delivery mode selection and webhook URL construction.
tests/DualMind.API.Tests/StatsCommandHandlerTests.cs	Updates stats handler tests to reflect new text and auth-aware keyboards.
tests/DualMind.API.Tests/BotTestDoubles.cs	Extends Telegram transport doubles for webhook + typing + polling metrics.
src/DualMind.API/Program.cs	Adds admin auth policy + claims transformation; gates Swagger in prod; adds `/health`.
src/DualMind.API/Infrastructure/Auth/RoleClaimsTransformation.cs	Adds Supabase-backed role enrichment for authenticated principals.
src/DualMind.API/DualMind.API.csproj	Enables ReadyToRun publishing for faster cold starts.
src/DualMind.API/Dockerfile	Switches to Alpine + musl publish; adds healthcheck and CF-focused optimizations.
src/DualMind.API/Core/Services/UserSyncService.cs	Prevents overwriting existing user roles during upsert.
src/DualMind.API/Core/Models/VoteModels.cs	Adds multiple JSON field aliases (snake_case + legacy names) for model stats.
src/DualMind.API/Core/Models/ProviderModels.cs	Adds a derived `status` field for providers.
src/DualMind.API/Core/Models/AdminModels.cs	Adds admin DTO aliases and typed patch request DTOs + validation helpers.
src/DualMind.API/Controllers/VotesController.cs	Updates model-stats response envelope to include `success`.
src/DualMind.API/Controllers/Api/TelegramWebhookController.cs	Adds webhook endpoint that validates Telegram secret token and dispatches updates.
src/DualMind.API/Bot/Transport/TelegramBotTransport.cs	Adds webhook get/set, typing action, and consolidates update mapping.
src/DualMind.API/Bot/Transport/ITelegramBotTransport.cs	Extends transport contract for webhook + typing operations.
src/DualMind.API/Bot/TelegramUpdateHandler.cs	Improves bot UX: pending/active battle reminders, standardized messages, cancel flow tweaks.
src/DualMind.API/Bot/TelegramUpdateDeliveryMode.cs	Introduces delivery mode enum (Auto/LongPolling/Webhook).
src/DualMind.API/Bot/TelegramStateCache.cs	Adds pending-battle tracking, cancel/complete semantics, and active-battle clearing.
src/DualMind.API/Bot/TelegramIncomingUpdateMapper.cs	Adds shared mapping from Telegram Update + raw JSON webhook payloads.
src/DualMind.API/Bot/TelegramBotServiceCollectionExtensions.cs	Resolves bot options (base URL, webhook token), registers bot services and clients.
src/DualMind.API/Bot/TelegramBotService.cs	Adds webhook-mode initialization and safer long-poll startup behavior.
src/DualMind.API/Bot/TelegramBotOptions.cs	Adds webhook options, delivery-mode resolution, webhook URL generation.
src/DualMind.API/Bot/Models/UserState.cs	Adds `PendingBattle` to per-chat state.
src/DualMind.API/Bot/Models/PendingBattleOperation.cs	Adds disposable pending-battle operation + cancellation token source.
src/DualMind.API/Bot/Models/BattleSession.cs	Adds `StatusMessageId` to battle session state.
src/DualMind.API/Bot/Models/ApiResponseModels.cs	Adds `TelegramWebhookInfo` and retains envelopes for bot API parsing.
src/DualMind.API/Bot/Commands/StatsCommandHandler.cs	Makes stats UI auth-aware (signed-in vs not) and standardizes errors.
src/DualMind.API/Bot/Commands/StartCommandHandler.cs	Adjusts /start to reflect signed-in state and keyboard choice.
src/DualMind.API/Bot/Commands/HelpCommandHandler.cs	Makes /help keyboard auth-aware.
src/DualMind.API/Bot/Commands/CancelCommandHandler.cs	Expands cancel behavior to stop pending/active battles and update status messages.
src/.dockerignore	Adds Docker ignore rules for smaller build context.
scripts/commit_and_push.sh	Adds a convenience script to add/commit/push (with cache-clearing step).
docker-compose.yml	Updates port mapping, env vars, and adds a healthcheck.
cf-worker/wrangler.jsonc	Adds Wrangler config for Cloudflare Containers + cron keep-alive + custom domain routing.
cf-worker/src/index.js	Adds Worker entrypoint: proxy to container, cron keep-alive, Telegram webhook auto-setup.
cf-worker/scripts/setup-github-secrets.ps1	Adds helper script to upload `.env` values into GitHub Actions secrets.
cf-worker/scripts/deploy.ps1	Adds a PowerShell-based deploy workflow for Cloudflare Containers.
cf-worker/package.json	Adds Worker dependencies (`wrangler`, `@cloudflare/containers`).
.gitignore	Expands ignore list to include build artifacts, env/secrets, and various tooling outputs.
.github/workflows/deploy-dualmind-arena.yml	Moves CI to Ubuntu, adds restore/test steps, and supports `main` + `master`.
simple_schema_dump.sql	Removes schema dump helper SQL from repo.
recommended_indexes.sql	Removes index recommendations SQL from repo.
packages/Newtonsoft.Json.13.0.3/README.md	Removes vendored package documentation from repo.
packages/Newtonsoft.Json.13.0.3/LICENSE.md	Removes vendored package license file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/vbc.rsp	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/Microsoft.VisualBasic.Core.targets	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/Microsoft.Managed.Core.targets	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/Microsoft.CSharp.Core.targets	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/csi.rsp	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/RoslynLatest/csc.rsp	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/VBCSCompiler.exe.config	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/vbc.rsp	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/vbc.exe.config	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/Microsoft.VisualBasic.Core.targets	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/Microsoft.CSharp.Core.targets	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/csi.rsp	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/csc.rsp	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/tools/Roslyn45/csc.exe.config	Removes vendored package/tooling file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/lib/net45/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.xml	Removes vendored package doc file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net46/web.config.uninstall.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net46/web.config.install.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net46/app.config.uninstall.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net46/app.config.install.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net45/web.config.uninstall.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net45/web.config.install.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net45/app.config.uninstall.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/content/net45/app.config.install.xdt	Removes vendored package content file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/build/net46/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.props	Removes vendored package build file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/build/net46/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.Extensions.props	Removes vendored package build file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/build/net45/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.props	Removes vendored package build file from repo.
packages/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.2.0.1/build/net45/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.Extensions.props	Removes vendored package build file from repo.
packages/Microsoft.AspNet.WebApi.Core.5.2.9/Content/web.config.transform	Removes vendored package content file from repo.
obj/Debug/DualMind_Back.csproj.FileListAbsolute.txt	Removes generated build output list from repo.
obj/Debug/DualMind_Back.csproj.CoreCompileInputs.cache	Removes generated build cache file from repo.
obj/Debug/.NETFramework,Version=v4.8.AssemblyAttributes.cs	Removes generated build attributes file from repo.
bin/roslyn/vbc.rsp	Removes generated tooling file from repo.
bin/roslyn/Microsoft.VisualBasic.Core.targets	Removes generated tooling file from repo.
bin/roslyn/Microsoft.Managed.Core.targets	Removes generated tooling file from repo.
bin/roslyn/Microsoft.CSharp.Core.targets	Removes generated tooling file from repo.
bin/roslyn/csi.rsp	Removes generated tooling file from repo.
bin/roslyn/csc.rsp	Removes generated tooling file from repo.
bin/Microsoft.CodeDom.Providers.DotNetCompilerPlatform.xml	Removes generated doc file from repo.
desktop.ini	Removes OS metadata file from repo.
Backup/schema_v1_original.sql	Removes archived schema dump from repo.
ANTIGRAVITY_PROMPT.txt	Removes prompt artifact from repo.
ANTIGRAVITY_PROMPT_SHORT.txt	Removes prompt artifact from repo.
.vscode/launch.json	Removes editor launch configuration from repo.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+# Health check for CF Containers keep-alive
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD wget --spider -q http://localhost:8080/health || exit 1


+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080/health"]
+      interval: 30s


+  const webhookUrl = `${workerUrl}/api/telegram/webhook`;
+
+  try {
+    // Check current webhook
+    const infoRes = await fetch(
+      `https://api.telegram.org/bot${botToken}/getWebhookInfo`
+    );
+    const info = await infoRes.json();
+
+    if (info.result?.url === webhookUrl) {
+      console.log(`Telegram webhook already set to ${webhookUrl}`);
+      return;
+    }
+
+    // Set new webhook
+    const setRes = await fetch(
+      `https://api.telegram.org/bot${botToken}/setWebhook`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          url: webhookUrl,
+          allowed_updates: ["message", "callback_query"],
+          drop_pending_updates: false,
+        }),
+      }
+    );


+                // Fetch role from public.users table
+                System.Console.WriteLine($"[AuthTransform] Fetching role for user: {userIdClaim.Value}");
+                var userData = await _supabase.SelectSingleAsync<JObject>("users", "role", $"user_id=eq.{userIdClaim.Value}");
+                var role = userData?["role"]?.ToString();
+                System.Console.WriteLine($"[AuthTransform] Role found: {role ?? "NULL"}");
+
+                if (!string.IsNullOrEmpty(role))
+                {
+                    // Add role claim
+                    identity.AddClaim(new Claim(ClaimTypes.Role, role));
+                    identity.AddClaim(new Claim("role", role)); // Support both standard and custom role claim names
+                }
+            }
+            catch (System.Exception ex)
+            {
+                // If fetch fails, don't block authentication, just don't add the role
+                System.Console.WriteLine($"[AuthTransform] ERROR fetching role: {ex.Message}");
+            }


+            return aspNetCoreUrls
+                .Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+                .FirstOrDefault(url => Uri.TryCreate(url, UriKind.Absolute, out _));
+        }


+      "env_vars": {
+        "ASPNETCORE_ENVIRONMENT": "Production",
+        "ASPNETCORE_URLS": "http://+:8080",
+        "ENABLE_SWAGGER": "true",
+        "CLOUDFLARE_AI_GATEWAY_USE_BYOK": "true"
+      }


+      "env_vars": {
+        "ASPNETCORE_ENVIRONMENT": "Production",
+        "ASPNETCORE_URLS": "http://+:8080",
+        "ENABLE_SWAGGER": "true",
+        "CLOUDFLARE_AI_GATEWAY_USE_BYOK": "true"
+      }


+echo "==> remove cached files so .gitignore will apply (may show warnings)"
+git rm -r --cached . || true
+


+echo "==> pushing to origin/$branch"
+git push origin "$branch"


+        [Newtonsoft.Json.JsonProperty("model_id")]
+        public Guid ModelIdSnake => ModelId;
+
+        [Newtonsoft.Json.JsonProperty("model_name")]
+        public string ModelNameSnake => ModelName;
+
+        [Newtonsoft.Json.JsonProperty("display_name")]
+        public string DisplayNameSnake => DisplayName;
+
+        [Newtonsoft.Json.JsonProperty("provider_name")]
+        public string ProviderNameSnake => ProviderName;
+
+        [Newtonsoft.Json.JsonProperty("elo_rating")]
+        public double EloRating => EloScore;
+
+        [Newtonsoft.Json.JsonProperty("elo")]
+        public double Elo => EloScore;
+
+        [Newtonsoft.Json.JsonProperty("total_matches")]
+        public int TotalMatches => TotalResponses;
+
+        [Newtonsoft.Json.JsonProperty("matches")]
+        public int Matches => TotalResponses;
+
+        [Newtonsoft.Json.JsonProperty("wins")]
+        public int Wins => TotalWins;
+
+        [Newtonsoft.Json.JsonProperty("win_rate")]
+        public double WinRateSnake => WinRate;


…aints)

harshbhx added 4 commits March 28, 2026 01:24

feat: add telegram webhook flow and admin key management

0c45769

Telegram Bot issue solved

023d42f

add .gitignore to ignore build/temp/IDE noise; recent work touched de…

24c6852

…ploy workflow and Program.cs

feat: setup cloudflare containers and deployment pipeline

dbb7b41

Copilot AI lite review requested due to automatic review settings August 9, 2026 16:35

Copilot started reviewing on behalf of harshbhx August 9, 2026 16:36 View session

harshbhx added 2 commits August 9, 2026 22:07

chore: remove old Azure pipeline

4db720b

fix: remove duplicate health route

5b12291

harshbhx had a problem deploying to production August 9, 2026 16:43 — with GitHub Actions Failure

Copilot AI reviewed Aug 9, 2026

View reviewed changes

fix: remove node cache from pipeline

7e8d6db

harshbhx had a problem deploying to production August 9, 2026 16:50 — with GitHub Actions Failure

fix: update Node.js to v22 for wrangler

7c42b2a

harshbhx had a problem deploying to production August 9, 2026 16:57 — with GitHub Actions Failure

fix: update wrangler schema and move Dockerfile

3574b5a

harshbhx had a problem deploying to production August 9, 2026 17:05 — with GitHub Actions Failure

fix: remove wildcard from custom domain route

876f307

harshbhx had a problem deploying to production August 9, 2026 17:08 — with GitHub Actions Failure

fix: update custom domain to dualmindlab.tech

6e0be8f

harshbhx had a problem deploying to production August 9, 2026 17:13 — with GitHub Actions Failure

harshbhx had a problem deploying to production August 9, 2026 17:43 — with GitHub Actions Failure

harshbhx temporarily deployed to production August 9, 2026 17:52 — with GitHub Actions Inactive

feat: complete cloudflare deployment (reverted security bypass constr…

6e1f6bc

…aints)

harshbhx temporarily deployed to production August 9, 2026 18:11 — with GitHub Actions Inactive

harshbhx merged commit 166e62b into master Aug 9, 2026
4 of 5 checks passed

Navigation Menu

Uh oh!

Main - #5

Main#5
harshbhx merged 12 commits into
masterfrom
main

harshbhx commented Aug 9, 2026

Uh oh!

gitguardian Bot commented Aug 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		echo "==> remove cached files so .gitignore will apply (may show warnings)"
		git rm -r --cached . \|\| true

		echo "==> pushing to origin/$branch"
		git push origin "$branch"

Uh oh!

Conversation

harshbhx commented Aug 9, 2026

Uh oh!

gitguardian Bot commented Aug 9, 2026

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants