feat: contact form backend for linux and freebsd servers

Assisted-by: GLM 5.3 Flash

internal/telegram/telegram.go

@@ -0,0 +1,109 @@
+// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
+// SPDX-License-Identifier: MIT
+
+//go:build linux || freebsd
+
+// Package telegram delivers form submission summaries to a Telegram chat
+// through the Bot API. One-way by design: nuntius posts a message and
+// never reads anything back, so there are no conversations, commands or
+// callbacks here, and no bot platform either.
+package telegram
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"sourcedock.dev/petrbalvin/nuntius/internal/contactform"
+)
+
+// Notifier posts submission summaries to one chat through one bot.
+type Notifier struct {
+	botToken string
+	chatID   string
+	timeout  time.Duration
+	// apiURL is the Bot API origin; tests point it at a fake server.
+	apiURL string
+}
+
+// New returns a Notifier posting as the bot into the chat.
+func New(botToken, chatID string, timeout time.Duration) *Notifier {
+	return &Notifier{
+		botToken: botToken,
+		chatID:   chatID,
+		timeout:  timeout,
+		apiURL:   "https://api.telegram.org",
+	}
+}
+
+// Notify posts one submission summary to the chat. Plain text on purpose:
+// a parse mode would turn submitted content into markup that has to be
+// escaped, and plain text cannot be injected.
+func (n *Notifier) Notify(formName string, req contactform.Request) error {
+	body, err := json.Marshal(map[string]any{
+		"chat_id":                  n.chatID,
+		"text":                     summary(formName, req),
+		"disable_web_page_preview": true,
+	})
+	if err != nil {
+		return fmt.Errorf("marshal telegram payload: %w", err)
+	}
+
+	httpReq, err := http.NewRequest(http.MethodPost,
+		n.apiURL+"/bot"+n.botToken+"/sendMessage", bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("build telegram request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: n.timeout}
+	resp, err := client.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("telegram call: %s", redact(err.Error(), n.botToken))
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("telegram sendMessage: HTTP %d", resp.StatusCode)
+	}
+
+	// The API answers {"ok":false,"description":...} on refusal, so the
+	// body decides, not the status code alone.
+	var payload struct {
+		OK          bool   `json:"ok"`
+		Description string `json:"description"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&payload); err != nil {
+		return fmt.Errorf("telegram response: %w", err)
+	}
+	if !payload.OK {
+		return fmt.Errorf("telegram sendMessage: %s", payload.Description)
+	}
+	return nil
+}
+
+// summary renders the plain-text message posted to the chat.
+func summary(formName string, req contactform.Request) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "New message on %s\n", formName)
+	fmt.Fprintf(&b, "From: %s <%s>\n", req.Name, req.Email)
+	if req.Service != "" {
+		fmt.Fprintf(&b, "Service interest: %s\n", req.Service)
+	}
+	b.WriteString("\n")
+	b.WriteString(req.Message)
+	b.WriteString("\n")
+	return b.String()
+}
+
+// redact keeps the bot token out of error text: an URL error carries the
+// full request URL, token included, and credentials never reach a log.
+func redact(s, secret string) string {
+	if secret == "" {
+		return s
+	}
+	return strings.ReplaceAll(s, secret, "[redacted]")
+}