From 38a9cf45c4585fec54eaa62d6410e95a52d740b1 Mon Sep 17 00:00:00 2001
From: Yago <5002453+yagop@users.noreply.github.com>
Date: Tue, 25 Aug 2026 14:19:01 +0000
Subject: [PATCH] Add --allowed-bot-ids option to whitelist bots

When specified, requests for bot user identifiers outside the
comma-separated list are rejected with 401 before a client is created,
so unknown bots can't consume server resources. By default all bots
are allowed.
---
 telegram-bot-api/ClientManager.cpp    |  5 +++++
 telegram-bot-api/ClientParameters.h   |  2 ++
 telegram-bot-api/telegram-bot-api.cpp | 13 +++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/telegram-bot-api/ClientManager.cpp b/telegram-bot-api/ClientManager.cpp
index 9b6bb4860..1c4d25f1d 100644
--- a/telegram-bot-api/ClientManager.cpp
+++ b/telegram-bot-api/ClientManager.cpp
@@ -83,6 +83,11 @@ void ClientManager::send(PromisedQueryPtr query) {
   if (user_id <= 0 || user_id >= (static_cast<td::int64>(1) << 54)) {
     return fail_query(401, "Unauthorized: invalid token specified", std::move(query));
   }
+  const auto &allowed_bot_user_ids = parameters_->allowed_bot_user_ids_;
+  if (!allowed_bot_user_ids.empty() &&
+      std::find(allowed_bot_user_ids.begin(), allowed_bot_user_ids.end(), user_id) == allowed_bot_user_ids.end()) {
+    return fail_query(401, "Unauthorized: bot is not allowed to use the server", std::move(query));
+  }
 
   if (query->is_test_dc()) {
     token += "/test";
diff --git a/telegram-bot-api/ClientParameters.h b/telegram-bot-api/ClientParameters.h
index 150cfaffb..c2e64bf20 100644
--- a/telegram-bot-api/ClientParameters.h
+++ b/telegram-bot-api/ClientParameters.h
@@ -115,6 +115,8 @@ struct ClientParameters {
 
   td::string version_;
 
+  td::vector<td::int64> allowed_bot_user_ids_;  // empty means that all bots are allowed
+
   td::int32 default_max_webhook_connections_ = 0;
   td::IPAddress webhook_proxy_ip_address_;
 
diff --git a/telegram-bot-api/telegram-bot-api.cpp b/telegram-bot-api/telegram-bot-api.cpp
index 76b1a8f90..c02f86373 100644
--- a/telegram-bot-api/telegram-bot-api.cpp
+++ b/telegram-bot-api/telegram-bot-api.cpp
@@ -243,6 +243,19 @@ int main(int argc, char *argv[]) {
                                token_range = {rem_i, mod_i};
                                return td::Status::OK();
                              });
+  options.add_checked_option('\0', "allowed-bot-ids",
+                             "comma-separated list of bot user identifiers that are allowed to use the server. By "
+                             "default, all bots are allowed",
+                             [&](td::Slice ids) -> td::Status {
+                               for (auto id_str : td::full_split(ids, ',')) {
+                                 TRY_RESULT(user_id, td::to_integer_safe<td::int64>(id_str));
+                                 if (user_id <= 0) {
+                                   return td::Status::Error("Invalid bot user identifier specified");
+                                 }
+                                 parameters->allowed_bot_user_ids_.push_back(user_id);
+                               }
+                               return td::Status::OK();
+                             });
   options.add_checked_option('\0', "max-webhook-connections",
                              "default value of the maximum webhook connections per bot",
                              td::OptionParser::parse_integer(parameters->default_max_webhook_connections_));