From 519832edd7aaeef1fd3e92d2ff7b800311e2d5bd Mon Sep 17 00:00:00 2001
From: John Preston <johnprestonmail@gmail.com>
Date: Sun, 18 May 2025 12:39:29 +0400
Subject: [PATCH] Show warnings for dangerous business bot rights.

---
 Telegram/Resources/langs/lang.strings         |  5 ++
 .../settings/business/settings_chatbots.cpp   | 54 ++++++++++++-------
 2 files changed, 40 insertions(+), 19 deletions(-)

diff --git a/Telegram/Resources/langs/lang.strings b/Telegram/Resources/langs/lang.strings
index ebc40fcd8e..f5fbafa589 100644
--- a/Telegram/Resources/langs/lang.strings
+++ b/Telegram/Resources/langs/lang.strings
@@ -2975,6 +2975,11 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 "lng_chatbots_include_button" = "Select Chats";
 "lng_chatbots_exclude_about" = "Select chats or entire chat categories which the bot will not have access to.";
 "lng_chatbots_permissions_title" = "Bot permissions";
+"lng_chatbots_warning_title" = "Warning";
+"lng_chatbots_warning_both_text" = "The bot {bot} will be able to **manage your gifts and stars**, including giving them away to other users.";
+"lng_chatbots_warning_gifts_text" = "The bot {bot} will be able to **manage your gifts**, including giving them away to other users.";
+"lng_chatbots_warning_stars_text" = "The bot {bot} will be able to **transfer your stars**.";
+"lng_chatbots_warning_username_text" = "The bot {bot} will be able to **set and remove usernames** for your account, which may result in the loss of your current username.";
 
 "lng_chatbots_manage_messages" = "Manage Messages";
 "lng_chatbots_read" = "Read Messages";
diff --git a/Telegram/SourceFiles/settings/business/settings_chatbots.cpp b/Telegram/SourceFiles/settings/business/settings_chatbots.cpp
index 39c01a64f2..d6cdf4b0f8 100644
--- a/Telegram/SourceFiles/settings/business/settings_chatbots.cpp
+++ b/Telegram/SourceFiles/settings/business/settings_chatbots.cpp
@@ -18,6 +18,7 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 #include "lang/lang_keys.h"
 #include "main/main_session.h"
 #include "settings/business/settings_recipients_helper.h"
+#include "ui/boxes/confirm_box.h"
 #include "ui/effects/ripple_animation.h"
 #include "ui/text/text_utilities.h"
 #include "ui/widgets/fields/input_field.h"
@@ -49,22 +50,7 @@ struct BotState {
 };
 
 [[nodiscard]] constexpr Data::ChatbotsPermissions Defaults() {
-	using Flag = Data::ChatbotsPermission;
-	return Flag::ViewMessages
-		| Flag::ReplyToMessages
-		| Flag::MarkAsRead
-		| Flag::DeleteSent
-		| Flag::DeleteReceived
-		| Flag::EditName
-		| Flag::EditBio
-		| Flag::EditUserpic
-		| Flag::EditUsername
-		| Flag::ViewGifts
-		| Flag::SellGifts
-		| Flag::GiftSettings
-		| Flag::TransferGifts
-		| Flag::TransferStars
-		| Flag::ManageStories;
+	return Data::ChatbotsPermission::ViewMessages;
 }
 
 class Chatbots final : public BusinessSection<Chatbots> {
@@ -471,7 +457,7 @@ void Chatbots::setupContent() {
 		username->setText(QString());
 		username->setFocus();
 
-		_permissions = Data::ChatbotsPermissions();
+		_permissions = Defaults();
 		refreshDetails();
 	};
 	content->add(object_ptr<Ui::SlideWrap<Ui::RpWidget>>(
@@ -488,7 +474,7 @@ void Chatbots::setupContent() {
 
 	refreshDetails();
 	_botValue.changes() | rpl::start_with_next([=](const BotState &value) {
-		_permissions = Data::ChatbotsPermissions();
+		_permissions = Defaults();
 		refreshDetails();
 	}, lifetime());
 
@@ -503,7 +489,8 @@ void Chatbots::refreshDetails() {
 		delete _detailsWrap->widgetAt(0);
 	}
 
-	if (!_botValue.current().bot) {
+	const auto bot = _botValue.current().bot;
+	if (!bot) {
 		return;
 	}
 
@@ -530,6 +517,35 @@ void Chatbots::refreshDetails() {
 	content->add(std::move(permissions.widget));
 	_resolvePermissions = permissions.value;
 
+
+	std::move(
+		permissions.changes
+	) | rpl::start_with_next([=](Data::ChatbotsPermissions now) {
+		const auto warn = [&](tr::phrase<lngtag_bot> text) {
+			controller()->show(Ui::MakeInformBox({
+				.text = text(tr::now, lt_bot, Ui::Text::Bold(bot->name()), Ui::Text::RichLangValue),
+				.title = tr::lng_chatbots_warning_title(),
+			}));
+		};
+
+		const auto was = _permissions.current();
+		const auto diff = now ^ was;
+		const auto enabled = diff & now;
+		using Flag = Data::ChatbotsPermission;
+		if (enabled & (Flag::TransferGifts | Flag::SellGifts)) {
+			if (enabled & Flag::TransferStars) {
+				warn(tr::lng_chatbots_warning_both_text);
+			} else {
+				warn(tr::lng_chatbots_warning_gifts_text);
+			}
+		} else if (enabled & Flag::TransferStars) {
+			warn(tr::lng_chatbots_warning_stars_text);
+		} else if (enabled & Flag::EditUsername) {
+			warn(tr::lng_chatbots_warning_username_text);
+		}
+		_permissions = now;
+	}, lifetime());
+
 	Ui::AddSkip(content);
 
 	_detailsWrap->resizeToWidth(width());