Add QR login to telegram-mcp - #2
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds QR-based authentication to telegram-mcp, enabling users to authorize via Telegram’s QR login flow while keeping the underlying Telegram protocol logic reusable for other frontends (e.g., the TUI).
Changes:
- Add a reusable QR login implementation in
internal/telegramwith optional 2FA password prompting and secret wiping. - Extend
telegram-mcp loginwith a--qrmode that renders a scannable terminal QR and prompts for hidden 2FA if needed. - Update documentation and add regression tests for the QR/auth command behavior.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents telegram-mcp login --qr and explains QR refresh + 2FA behavior. |
| internal/telegram/qr.go | Introduces reusable QR login flow and 2FA completion helper. |
| internal/telegram/qr_test.go | Adds unit tests for QR fallback-to-2FA behavior and secret wiping on retry. |
| go.mod | Promotes golang.org/x/term to a direct dependency for hidden password input. |
| cmd/telegram-mcp/main.go | Adds --qr parsing and an interactive QR login mode in the CLI. |
| cmd/telegram-mcp/main_test.go | Adds tests covering command parsing and --qr validation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| secret, err := prompt(ctx, retry) | ||
| if err != nil { | ||
| return fmt.Errorf("read 2FA password: %w", err) | ||
| } |
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "telegram-mcp: %v\n", err) | ||
| printUsage(os.Stderr) | ||
| os.Exit(2) | ||
| } |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Suppressed comments (1)
internal/telegram/qr.go:156
- When the password prompt returns an empty slice (user hit enter), the buffer is discarded without being wiped. This breaks the function's own contract that the returned byte slice is "consumed and wiped" and could leave sensitive bytes in memory for prompt implementations that reuse buffers (e.g. returning buf[:0]).
if len(secret) == 0 {
retry = true
continue
}
|
Reviewed the QR implementation — solid work: correct use of gotd's But it needs a rebase first: the repo was transferred |
Wipe partial 2FA password buffers returned alongside prompt errors. Treat flag.ErrHelp as successful usage output instead of an invalid command.
done |
Summary
telegram-mcp login --qralongside the existing phone/code loginSESSION_PASSWORD_NEEDEDafter QR acceptance with hidden 2FA input, retry invalid passwords, and wipe each plaintext password buffer after SRPWhy
The README currently lists QR login as not implemented. Telegram supports QR authorization through
auth.exportLoginToken/auth.importLoginToken, and gotd already provides the token refresh and migration flow: https://core.telegram.org/api/qr-loginThis is especially useful when a login code is delivered to a channel that a third-party client cannot surface clearly. The existing
telegram-mcp loginphone flow remains the default and is unchanged.Security
term.ReadPassword, so it is not echoedValidation
go test -count=1 -timeout=5m ./...go vet ./...go build ./...git diff --check