GoldenBite Bot

Production-oriented Telegram bot for GoldenBite fast-food ordering: catalog browsing (inline query), cart/checkout, and admin product/category management.

Stack

• Node.js 18+
• node-telegram-bot-api (long polling)
• MongoDB + Mongoose
• Cloudinary (product images)
• Joi (input validation)

Setup

1. Copy env template and fill values:

cp .env.example .env

2. Install dependencies:

npm install

3. Start MongoDB, then run:

npm start
# or for local development with auto-reload:
npm run dev

Required env vars are validated at boot — the process exits if any are missing.

Variable	Description
BOT_TOKEN	Telegram bot token from @BotFather
ADMIN_ID	Telegram user id of the admin
BOT_USERNAME	Bot username without @ (used in UI mentions)
DB_URI / dbUri	MongoDB connection string
DB_NAME	Database name
CLOUD_NAME, API_KEY, API_SECRET_KEY	Cloudinary credentials

Enable Inline Mode for the bot in BotFather so category/product search works.

Features

Clients

• Registration (name + Telegram contact share)
• Browse products via inline query
• Cart, confirm order, choose cash/card-on-delivery
• Profile view / name edit

Admin

• Category CRUD wizard (scoped to admin chat)
• Product CRUD with Cloudinary photos
• Client list with recent orders
• New-order notifications + mark as delivered

Security notes

• Admin-only callbacks are authorized against ADMIN_ID
• Order totals are recomputed from the database (not trusted from callback payloads)
• Contact registration verifies contact.user_id matches the sender
• Inline search regex input is escaped
• FSM wizards are scoped by admin/client chatId (no global shared draft state)

Payment model

Online PayMe/Click integrations are not included. Checkout uses cash or card to courier. Wire a real payment provider before advertising online payments.

Project layout

src/
  index.js              # boot, graceful shutdown
  config.js             # env validation + FSM constants
  bot/                  # Telegram listeners + handlers
  model/                # Mongoose models
  lib/                  # DB, Cloudinary, logger
  utils/                # auth, async wrapper, validation
  other/text.service.js # UI copy

Docker

# Set DB_URI=mongodb://mongo:27017 in .env when using compose
docker compose up -d --build

Operations

• Logs are JSON lines to stdout (LOG_LEVEL=info|warn|error|debug)
• SIGINT / SIGTERM stop polling and close MongoDB
• Run a single bot instance with polling (use webhooks for multi-instance)
• Transitive npm audit findings come from node-telegram-bot-api → deprecated request; monitor upstream or migrate to grammY/Telegraf when ready