Fail-Closed Multi-Tenant Security

The isolation model behind AutoTelegramForward: fail-closed access control and zero cross-tenant visibility across bot, web, mobile, REST and gRPC.

Verified against the checkout built for v2.2.4 · updated 20 Oct 2026

Overview

In multi-user or shared enterprise deployments, multiple operators manage separate channels and Telegram sessions through a single AutoTelegramForward backend instance. Maintaining impenetrable tenant isolation is non-negotiable.

The Fail-Closed Security Guarantee

AutoTelegramForward enforces the fundamental security principle: Missing or ambiguous identity information MUST fail closed.

Verified Core Implementation:

def _owns(task, owner_user_id: Optional[str]) -> bool:
    # Missing or empty owner_user_id must FAIL CLOSED
    if not owner_user_id or not str(owner_user_id).strip():
        return False
    # Cross-tenant mismatch must FAIL CLOSED
    return str(task.user_id).strip() == str(owner_user_id).strip()

If an unauthenticated request or unlinked session attempts to query, list, modify, or delete a task, access is strictly denied with zero information leakage.

Three-Tier Isolation Boundaries

1. Telegram Bot Tier (pro_bot_ui.py)

The Telegram Bot UI extracts event.sender_id and validates tenant identity before rendering any menu. Unlinked users cannot access administrative dashboards or see tasks belonging to other users.

2. REST & gRPC API Tier (atf-api & atf-core)

Every internal gRPC call between the Go API Gateway (8080) and Python Core (50051) carries cryptographically signed metadata containing owner_user_id. Servicers reject requests lacking identity headers.

3. Database Repository Tier

SQL queries strictly append WHERE user_id = :owner_user_id. There are no global unscoped listing endpoints accessible to standard tenants.

Zero Credential Exposure

Sensitive values—including Telegram api_hash, bot tokens, MTProto phone numbers, and session auth strings—are strictly masked in logs, API responses, and Telegram Bot dialogs with [REDACTED] tags.