I want to create bot only for certain users.
What I can use for user identification?
address field is a current sending relay (user will lose access to bot if change relay).
authName is easy to fake.
Is there any stable and secure user id?
Contact ID in the database is stable across restarts unless you delete the bot database. For a quick hack way you can figure out the contact ID, then hardcode it into the bot source.
To do it properly, one simple way is to create an admin group chat, then create a QR code to join this group and show it to admins. Store chat ID somewhere to remember it across bot restarts. To check if the user is allowed to interact with the bot, check if the user is in this group.
You can also export contact vCard (by sending the contact into Saved Messages, then exporting it) and put it somewhere into the bot, then import with import_vcard (import_vcard_contents RPC call internally) to get the contact ID associated with this contact, with the contact created if it does not exist yet. vCard has the contact OpenPGP fingerprint, so it uniquely identifies the contact even across profiles (called “accounts” internally for historical reasons). You can make a folder with allowed member vCards, import them all on start and check against returned contact IDs to see if the contact is allowed to interact with the bot.
Very clever ideas!
Thank you @link2xt !
Is it safe if I share qr/link of my bot only with certain people?
Is it sufficient to avoid strangers using my bot?
If you never share the key of the bot, then strangers will not be able to send encrypted messages to bot. With the recent versions if force_encryption config is set, messages that are not encrypted are ignored, so it should be sufficient to prevent strangers from using the bot.
I would not rely on this though, force_encryption is not meant for this kind of protection.
Creating a group that everyone who can use a bot must join is more straightforward, and you can remove members from this group later. Groups have an unique group ID that is never sent unencrypted (it also appears in the invite QR code, however), so knowledge of this group ID is acting as authenticationauthorization.