Send /maskid @someone.
See who you’re talking to.

// Mask.ID Telegram bot — answers `/maskid @someone` with that member's
// profile card. Reads only PUBLIC data (the same card any visitor sees at
// Mask.ID); nothing is stored. Zero dependencies: Node 18+ and the Bot API.

const TOKEN = process.env.TELEGRAM_TOKEN;
if (!TOKEN) { console.error("Set TELEGRAM_TOKEN."); process.exit(1); }

const MASKID = "https://app.mask.id";
const API = `https://api.telegram.org/bot${TOKEN}`;

// Usernames are letters, digits, and underscores. Anything else is rejected
// before it can reach a URL.
const USERNAME = /^[A-Za-z0-9_]{1,32}$/;

async function tg(method, body) {
  const res = await fetch(`${API}/${method}`, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(body),
  });
  const data = await res.json();
  if (!data.ok) throw new Error(`${method}: ${data.description}`);
  return data.result;
}

const reply = (msg, text) =>
  tg("sendMessage", { chat_id: msg.chat.id, reply_to_message_id: msg.message_id, text });

async function handle(msg) {
  // In groups the command arrives as "/maskid@YourBot name"; strip the suffix.
  const m = /^\/maskid(?:@\w+)?(?:\s+(.*))?$/s.exec(msg.text ?? "");
  if (!m) return;

  const username = (m[1] ?? "").trim().replace(/^@/, "");
  if (!username) return reply(msg, "Usage: /maskid @username");
  if (!USERNAME.test(username)) return reply(msg, "That doesn't look like a Mask.ID username.");

  const cardUrl = `${MASKID}/card/${username}`;
  const profileUrl = `${MASKID}/u/${username}`;

  // The card is rendered on demand and cached server-side.
  let status;
  try {
    status = (await fetch(cardUrl, { method: "HEAD", redirect: "follow" })).status;
  } catch (err) {
    console.error("card fetch failed:", err);
    return reply(msg, "Couldn't reach Mask.ID just now. Try again in a minute.");
  }
  if (status === 404) return reply(msg, `No public Mask.ID profile for @${username}.`);
  if (status !== 200) return reply(msg, "Mask.ID is busy rendering cards — try again shortly.");

  // Telegram fetches the image itself from the URL.
  return tg("sendPhoto", {
    chat_id: msg.chat.id,
    reply_to_message_id: msg.message_id,
    photo: cardUrl,
    caption: `@${username} on Mask.ID\n${profileUrl}`,
  });
}

// Long polling: no public URL, no webhook, works from a laptop.
async function poll() {
  let offset = 0;
  const me = await tg("getMe", {});
  console.log(`Signed in as @${me.username}`);
  for (;;) {
    try {
      const updates = await tg("getUpdates", { offset, timeout: 30, allowed_updates: ["message"] });
      for (const u of updates) {
        offset = u.update_id + 1;
        if (u.message?.text) handle(u.message).catch((e) => console.error(e));
      }
    } catch (err) {
      console.error("poll error:", err.message);
      await new Promise((r) => setTimeout(r, 3000));
    }
  }
}

poll();

{
  "name": "maskid-telegram-bot",
  "version": "1.0.0",
  "private": true,
  "description": "Answers /maskid @username with the member's Mask.ID profile card.",
  "scripts": { "start": "node bot.js" },
  "engines": { "node": ">=18" }
}

# Copy to .env and fill in. Never commit .env.
TELEGRAM_TOKEN=paste-the-token-from-BotFather

# /etc/systemd/system/maskid-tg-bot.service — keeps the bot running.
[Unit]
Description=Mask.ID Telegram bot
After=network-online.target

[Service]
User=maskidbot
WorkingDirectory=/opt/maskid-tg-bot
EnvironmentFile=/opt/maskid-tg-bot/.env
ExecStart=/usr/bin/node bot.js
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target