From 72b6e93c94c0c92ba731074143f8dc6354ba128c Mon Sep 17 00:00:00 2001
From: 3252a8 <3252a8@proton.me>
Date: Sun, 26 Apr 2026 20:33:57 +0300
Subject: [PATCH] docs: add Telegram clock-skew note for auth_date

---
 bot/app/web/webapp_auth.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bot/app/web/webapp_auth.py b/bot/app/web/webapp_auth.py
index a64f582..9eb3dd4 100644
--- a/bot/app/web/webapp_auth.py
+++ b/bot/app/web/webapp_auth.py
@@ -11,6 +11,9 @@ from config.settings import Settings
 
 logger = logging.getLogger(__name__)
 
+# 5 minutes clock skew tolerance for Telegram clients
+TELEGRAM_CLOCK_SKEW_SECONDS = 300
+
 
 def _urlsafe_b64encode(raw: bytes) -> str:
     return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
@@ -107,7 +110,7 @@ def validate_telegram_webapp_init_data(
             auth_date = int(auth_date_raw)
             now = int(time.time())
             max_age = max(60, int(max_age_seconds))
-            if auth_date > now + 300 or now - auth_date > max_age:
+            if auth_date > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - auth_date > max_age:
                 logger.warning("Telegram WebApp initData auth_date is stale.")
                 return None
 
@@ -167,7 +170,7 @@ def validate_telegram_login_widget_data(
             auth_date = int(auth_date_raw)
             now = int(time.time())
             max_age = max(60, int(max_age_seconds))
-            if auth_date > now + 300 or now - auth_date > max_age:
+            if auth_date > now + TELEGRAM_CLOCK_SKEW_SECONDS or now - auth_date > max_age:
                 logger.warning("Telegram Login Widget auth_date is stale.")
                 return None