Automated sync from GitHub

.gitattributes

@@ -1,8 +1,8 @@
+*.webp filter=lfs diff=lfs merge=lfs -text
+*.mp4 filter=lfs diff=lfs merge=lfs -text
 *.mp3 filter=lfs diff=lfs merge=lfs -text
 *.jpg filter=lfs diff=lfs merge=lfs -text
 *.jpeg filter=lfs diff=lfs merge=lfs -text
 *.png filter=lfs diff=lfs merge=lfs -text
 *.ttf filter=lfs diff=lfs merge=lfs -text
 *.otf filter=lfs diff=lfs merge=lfs -text
-*.webp filter=lfs diff=lfs merge=lfs -text
-*.mp4 filter=lfs diff=lfs merge=lfs -text

app/buttons_sync.py

@@ -0,0 +1,186 @@
+"""Make sure the buttons shown in a channel are the ones we saved - and fix them when they are not.
+
+Used by /repost (every new post is read back right after it is created) and by "Check buttons" in My posts,
+which repairs posts whose buttons are saved in the bot but are missing in the channel.
+"""
+from __future__ import annotations
+
+import asyncio
+import logging
+from dataclasses import dataclass, field
+from typing import Awaitable, Callable, Optional
+
+from telethon import errors, types
+
+from .replace_engine import CHUNK, fetch_messages, is_skippable
+from .tgutil import build_markup, button_url, edit_raw, flood_retry, peer_of
+
+log = logging.getLogger(__name__)
+
+ABORT_AFTER = 5  # stop repairing after this many failures in a row
+# A throw-away keyboard. If Telegram answers "message not modified" to the real keyboard (it believes the post
+# already has it), we first show this one, then the real one: two real changes.
+NUDGE_ROWS = [[{"t": "…", "u": "https://t.me/telegram"}]]
+
+
+class ButtonsNotShown(RuntimeError):
+    """Telegram accepted the edit, but the post still does not show the buttons it should."""
+
+
+def link_buttons(markup) -> list:
+    """[(text, url)] of the link buttons of a keyboard, in reading order."""
+    out: list = []
+    if isinstance(markup, types.ReplyInlineMarkup):
+        for row in markup.rows:
+            for b in row.buttons:
+                u = button_url(b)
+                if u is not None:
+                    out.append((getattr(b, "text", ""), u))
+    return out
+
+
+def link_urls(markup) -> list:
+    return [u for _, u in link_buttons(markup)]
+
+
+async def live_urls(client, peer, message_id: int) -> Optional[list]:
+    """The link-button URLs the channel shows on a post right now; None if the post is gone."""
+    msgs = await fetch_messages(client, peer, [message_id])
+    m = msgs[0] if msgs else None
+    if is_skippable(m):
+        return None
+    return link_urls(m.reply_markup)
+
+
+async def ensure_markup(client, peer, message_id: int, markup, *, pause: float = 0.7) -> str:
+    """Make post `message_id` show the link buttons of `markup`, and check it by reading the post back.
+
+    Returns "fine" (it already did), "set" (one edit was enough) or "nudged" (needed the two-step edit).
+    Raises ButtonsNotShown if the buttons still are not there, LookupError if the post no longer exists.
+    """
+    want = link_urls(markup)
+    if not want:
+        return "fine"
+    live = await live_urls(client, peer, message_id)
+    if live is None:
+        raise LookupError(f"post {message_id} no longer exists")
+    if live == want:
+        return "fine"
+
+    try:
+        await flood_retry(lambda: edit_raw(client, peer, message_id, markup=markup))
+    except errors.MessageNotModifiedError:
+        pass  # Telegram thinks the keyboard is already there - checked below
+    if pause:
+        await asyncio.sleep(pause)
+    if await live_urls(client, peer, message_id) == want:
+        return "set"
+
+    log.info("post %s: the edit did not make the buttons show - trying the two-step edit", message_id)
+    for step in (build_markup(NUDGE_ROWS), markup):
+        try:
+            await flood_retry(lambda step=step: edit_raw(client, peer, message_id, markup=step))
+        except errors.MessageNotModifiedError:
+            pass
+        if pause:
+            await asyncio.sleep(pause)
+    if await live_urls(client, peer, message_id) == want:
+        return "nudged"
+    raise ButtonsNotShown(f"post {message_id} still does not show its buttons")
+
+
+# ------------------------------------------------------------------------------------ checking
+@dataclass
+class ButtonScan:
+    channel: object
+    total: int = 0  # saved posts that have link buttons
+    fine: int = 0
+    bad: list = field(default_factory=list)  # [(post, live urls, wanted urls)]
+    gone: list = field(default_factory=list)  # posts that no longer exist in the channel
+
+
+async def scan_buttons(
+    client, ch, posts: list, *, progress: Optional[Callable[[ButtonScan], Awaitable[None]]] = None
+) -> ButtonScan:
+    """Compare the saved link buttons of `posts` with what the channel shows."""
+    scan = ButtonScan(channel=ch)
+    peer = peer_of(ch)
+    wanted = []
+    for p in posts:
+        if not p.message_id:
+            continue
+        urls = link_urls(build_markup(p.buttons))
+        if urls:
+            wanted.append((p, urls))
+    scan.total = len(wanted)
+    for i in range(0, len(wanted), CHUNK):
+        part = wanted[i : i + CHUNK]
+        msgs = await fetch_messages(client, peer, [p.message_id for p, _ in part])
+        for (p, urls), m in zip(part, msgs):
+            if is_skippable(m):
+                scan.gone.append(p)
+            elif link_urls(m.reply_markup) == urls:
+                scan.fine += 1
+            else:
+                scan.bad.append((p, link_urls(m.reply_markup), urls))
+        if progress:
+            await progress(scan)
+    return scan
+
+
+@dataclass
+class FixResult:
+    fixed: int = 0
+    nudged: int = 0  # of those, how many needed the two-step edit
+    already: int = 0  # turned out to be fine when looked at again
+    gone: int = 0
+    failed: list = field(default_factory=list)  # [(message id, error name)]
+    aborted: Optional[str] = None
+    stopped: bool = False
+
+
+async def fix_buttons(
+    client,
+    ch,
+    bad: list,
+    *,
+    delay: float = 1.2,
+    pause: float = 0.7,
+    progress: Optional[Callable[[FixResult], Awaitable[None]]] = None,
+    should_stop: Optional[Callable[[], bool]] = None,
+) -> FixResult:
+    """Put the saved buttons back on the posts in `bad` (the first item of each entry is the saved post)."""
+    res = FixResult()
+    peer = peer_of(ch)
+    streak = 0
+    for entry in bad:
+        post = entry[0]
+        if should_stop and should_stop():
+            res.stopped = True
+            break
+        try:
+            how = await ensure_markup(client, peer, post.message_id, build_markup(post.buttons), pause=pause)
+        except LookupError:
+            res.gone += 1
+            continue
+        except Exception as e:  # one bad post must not stop the others
+            name = type(e).__name__
+            log.warning("could not fix the buttons of %s: %s %s", post.message_id, name, e)
+            res.failed.append((post.message_id, name))
+            streak += 1
+            if streak >= ABORT_AFTER:
+                res.aborted = name
+                break
+            await asyncio.sleep(delay)
+            continue
+        streak = 0
+        if how == "fine":
+            res.already += 1
+        else:
+            res.fixed += 1
+            if how == "nudged":
+                res.nudged += 1
+        if progress:
+            await progress(res)
+        await asyncio.sleep(delay)
+    return res

app/common.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import asyncio
 import functools
 import logging
+import time
 from dataclasses import dataclass, field
 from types import SimpleNamespace
 from typing import Any, Callable, Optional
@@ -27,11 +28,13 @@ class Ctx:
     db: Database
     client: TelegramClient
     state: dict = field(default_factory=dict)  # user id -> {"mode": ..., ...}
-    pending: dict = field(default_factory=dict)  # tokens for confirm dialogs (replace, test edit)
+    pending: dict = field(default_factory=dict)  # tokens for confirm dialogs (replace, repost)
     seen_channels: dict = field(default_factory=dict)  # channel id -> Channel entity seen in updates
     text_handlers: dict = field(default_factory=dict)  # mode -> async fn(event, state)
     callbacks: dict = field(default_factory=dict)  # prefix -> async fn(event, parts)
     lock: asyncio.Lock = field(default_factory=asyncio.Lock)  # one long job (replace / repost) at a time
+    userbot: Any = None  # app.userbot.Userbot or None
+    reporter: Any = None  # app.errorlog.ErrorReporter or None
 
 
 def is_cb(event) -> bool:
@@ -68,9 +71,10 @@ def guard(ctx: Ctx, owner: bool = False) -> Callable:
             except UserError as e:
                 await notify_error(event, str(e))
             except errors.RPCError as e:
+                log.error("Telegram refused a request in handler %s (user %s)", fn.__name__, uid, exc_info=True)
                 await notify_error(event, "❌ " + explain_rpc(e))
             except Exception as e:
-                log.exception("handler %s failed", fn.__name__)
+                log.exception("Unhandled exception in handler %s (user %s)", fn.__name__, uid)
                 await notify_error(event, f"⚠️ Something went wrong: {type(e).__name__}: {str(e)[:200]}")
 
         return wrapper
@@ -176,6 +180,18 @@ async def apply_edit(ctx: Ctx, post, ch, *, replace_media: bool = False, **chang
     return await ctx.db.update_post(post.id, **changes)
 
 
+def purge_pending(ctx: Ctx, ttl: float = 3600.0) -> None:
+    """Forget confirm dialogs (replace plans, repost choices...) nobody answered for a while."""
+    now = time.monotonic()
+    stale = [
+        k
+        for k, v in ctx.pending.items()
+        if not getattr(v, "running", False) and now - getattr(v, "created", now) > ttl
+    ]
+    for k in stale:
+        ctx.pending.pop(k, None)
+
+
 def on_cb(ctx: Ctx, prefix: str):
     def deco(fn):
         ctx.callbacks[prefix] = fn

app/config.py

@@ -2,7 +2,9 @@
 from __future__ import annotations
 
 import os
+import tempfile
 from dataclasses import dataclass
+from typing import Optional
 
 try:  # python-dotenv is optional; real env vars always win
     from dotenv import load_dotenv
@@ -29,6 +31,23 @@ def _bool(name: str, default: bool) -> bool:
     return raw.strip().lower() in {"1", "true", "yes", "on"}
 
 
+DEFAULT_ERROR_LOG_CHAT_ID = -1002525172451
+_OFF = {"0", "off", "none", "false", "no", "disabled", "disable"}
+
+
+def _chat_id(name: str, default: Optional[int]) -> Optional[int]:
+    """A chat id from the environment: unset or empty -> default, "0" / "off" -> None (switched off)."""
+    raw = (os.getenv(name) or "").strip()
+    if raw == "":
+        return default
+    if raw.lower() in _OFF:
+        return None
+    try:
+        return int(raw)
+    except ValueError:
+        raise SystemExit(f"{name} must be a chat id such as -1001234567890 (or 0 / off to switch it off), not {raw!r}")
+
+
 def _float(name: str, default: float) -> float:
     try:
         return float(os.getenv(name, "") or default)
@@ -51,6 +70,9 @@ class Config:
     replace_typed_links: bool
     port: int
     log_level: str
+    error_log_chat_id: Optional[int] = None  # errors are sent to this chat; None = off
+    userbot_session: str = ""  # session text of the helper account that deletes old posts
+    userbot_keep_admin: bool = False  # keep the userbot an admin after a clean-up (default: take the right away)
 
     def is_owner(self, uid) -> bool:
         return uid in self.owners
@@ -59,6 +81,12 @@ class Config:
         return uid in self.owners or uid in self.admins
 
 
+def default_session_path() -> str:
+    """Outside the app folder on purpose: a host that publishes that folder (python -m http.server) must not
+    publish the login session. A bot can always log in again with its token, so losing it is harmless."""
+    return os.path.join(tempfile.gettempdir(), "channel-post-bot", "bot")
+
+
 def load_config() -> Config:
     missing = [k for k in ("API_ID", "API_HASH", "BOT_TOKEN") if not os.getenv(k)]
     owners = _ints("OWNER_IDS")
@@ -78,10 +106,13 @@ def load_config() -> Config:
         admins=_ints("ADMIN_IDS"),
         database_url=(os.getenv("DATABASE_URL") or "sqlite+aiosqlite:///data/bot.db").strip(),
         db_pool=(os.getenv("DB_POOL") or "null").strip().lower(),
-        session_path=(os.getenv("SESSION_PATH") or "data/bot").strip(),
+        session_path=(os.getenv("SESSION_PATH") or default_session_path()).strip(),
         session_string=(os.getenv("SESSION_STRING") or "").strip(),
         edit_delay=max(0.3, _float("EDIT_DELAY", 1.2)),
         replace_typed_links=_bool("REPLACE_TYPED_LINKS", True),
         port=int(os.getenv("PORT") or 0),
         log_level=(os.getenv("LOG_LEVEL") or "INFO").upper(),
+        error_log_chat_id=_chat_id("ERROR_LOG_CHAT_ID", DEFAULT_ERROR_LOG_CHAT_ID),
+        userbot_session=(os.getenv("USERBOT_SESSION") or "").strip(),
+        userbot_keep_admin=_bool("USERBOT_KEEP_ADMIN", False),
     )

app/db.py

@@ -293,6 +293,16 @@ class Database:
             )
             return list((await s.execute(q)).scalars())
 
+    async def sent_posts(self, channel_id: int) -> list:
+        """Every published post of a channel, oldest first."""
+        async with self.Session() as s:
+            q = (
+                select(Post)
+                .where(Post.channel_id == channel_id, Post.status == "sent", Post.message_id.is_not(None))
+                .order_by(Post.message_id)
+            )
+            return list((await s.execute(q)).scalars())
+
     async def mine_message_ids(self, channel_id: int) -> set:
         async with self.Session() as s:
             q = select(Post.message_id).where(

app/errorlog.py

@@ -0,0 +1,300 @@
+"""Send errors to a Telegram chat (ERROR_LOG_CHAT_ID) as a `python` code block.
+
+What is reported:
+  * every log record of level ERROR or higher that carries a message / traceback (handler failures included),
+  * exceptions nobody caught in background tasks ("Unhandled exception in background task <unnamed>:"),
+  * a crash of the whole bot (sent right before it exits).
+Long tracebacks are cut into several messages, never shortened. Secrets (bot token, API hash, session texts,
+database password) are replaced by *** before anything leaves the bot. The reporter never raises, never blocks the
+bot, and protects the chat from floods (identical reports are merged, at most a few per minute).
+"""
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import logging
+import re
+import time
+import traceback
+from collections import deque
+from typing import Optional
+
+from telethon import types
+
+from .tgutil import utf16_len
+
+log = logging.getLogger(__name__)
+
+PART_LIMIT = 3800  # characters per message (Telegram allows 4096; the rest is head-room for the part label)
+PIECE = 1500  # a single line longer than a message is cut into pieces of this size
+MUTE_SECONDS = 600  # after "can't write to the log chat" stay quiet this long
+MIN_SECRET = 6  # shorter secrets are not redacted (they would mangle ordinary text)
+
+
+# ----------------------------------------------------------------------------- text helpers
+def split_report(text: str, limit: int = PART_LIMIT) -> list:
+    """Cut a report into messages of at most `limit` characters at line breaks. Nothing is dropped."""
+    if len(text) <= limit:
+        return [text]
+    room = limit - 40  # space for the "(part 3/12)" label
+    pieces: list = []
+    for line in text.split("\n"):
+        while len(line) > room:  # a single huge line: cut it
+            size = min(PIECE, room)
+            pieces.append(line[:size])
+            line = line[size:]
+        pieces.append(line)
+    parts: list = []
+    cur: list = []  # the lines of the part being built
+    used = 0
+    for piece in pieces:
+        add = len(piece) + (1 if cur else 0)
+        if cur and used + add > room:
+            parts.append("\n".join(cur))
+            cur, used = [piece], len(piece)
+        else:
+            cur.append(piece)
+            used += add
+    if cur:
+        parts.append("\n".join(cur))
+    n = len(parts)
+    return [f"(part {i}/{n})\n{p}" for i, p in enumerate(parts, 1)]
+
+
+def redact(text: str, secrets) -> str:
+    for s in sorted({s for s in secrets if s and len(s) >= MIN_SECRET}, key=len, reverse=True):
+        text = text.replace(s, "***")
+    return text
+
+
+def format_exception(exc: BaseException) -> str:
+    return "".join(traceback.format_exception(type(exc), exc, exc.__traceback__))
+
+
+def _task_label(task) -> str:
+    name = getattr(task, "get_name", lambda: "")() if task is not None else ""
+    if not name or re.fullmatch(r"Task-\d+", name):
+        return "<unnamed>"
+    return name
+
+
+# ---------------------------------------------------------------------------------- reporter
+class ErrorReporter:
+    def __init__(
+        self,
+        client,
+        chat_id: Optional[int],
+        *,
+        bot_token: str = "",
+        secrets=(),
+        per_minute: int = 12,
+        dedupe_seconds: float = 60.0,
+        gap: float = 1.0,
+        part_gap: float = 0.6,
+    ):
+        self.client = client
+        self.chat_id = chat_id
+        self.bot_token = bot_token
+        self.secrets = [s for s in (*secrets, bot_token) if s]  # the login token is always hidden too
+        self.per_minute = per_minute
+        self.dedupe_seconds = dedupe_seconds
+        self.gap = gap
+        self.part_gap = part_gap
+        self._loop: Optional[asyncio.AbstractEventLoop] = None
+        self._queue: Optional[asyncio.Queue] = None
+        self._task: Optional[asyncio.Task] = None
+        self._peer = None
+        self._muted_until = 0.0
+        self._recent: dict = {}  # report key -> [time of the first, number suppressed since]
+        self._times: deque = deque()  # when reports were accepted (for the per-minute limit)
+        self._skipped = 0  # reports dropped by the limit since the last one that went out
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self.chat_id)
+
+    # ------------------------------------------------------------------ life cycle
+    def start(self) -> None:
+        if not self.enabled or self._task is not None:
+            return
+        self._loop = asyncio.get_running_loop()
+        self._queue = asyncio.Queue(maxsize=100)
+        self._task = self._loop.create_task(self._worker(), name="error-reporter")
+
+    async def stop(self, wait: float = 5.0) -> None:
+        """Let queued reports go out (for a few seconds at most), then stop."""
+        task, self._task = self._task, None
+        if task is None:
+            return
+        try:
+            await asyncio.wait_for(self._queue.join(), wait)
+        except Exception:
+            pass
+        task.cancel()
+        try:
+            await task
+        except BaseException:
+            pass
+
+    # ---------------------------------------------------------------------- input
+    def submit(self, title: str, tb: str = "") -> None:
+        """Queue a report. Safe to call from any thread; never raises."""
+        try:
+            loop = self._loop
+            if not self.enabled or loop is None or loop.is_closed():
+                return
+            try:
+                here = asyncio.get_running_loop()
+            except RuntimeError:
+                here = None
+            if here is loop:
+                self._enqueue(title, tb)
+            else:
+                loop.call_soon_threadsafe(self._enqueue, title, tb)
+        except Exception:
+            pass
+
+    def _enqueue(self, title: str, tb: str) -> None:
+        try:
+            now = time.monotonic()
+            if now < self._muted_until or self._queue is None:
+                return
+            last_line = next((ln for ln in reversed(tb.splitlines()) if ln.strip()), "")
+            key = hashlib.sha1(f"{title}|{last_line}".encode("utf-8", "replace")).hexdigest()
+            prev = self._recent.get(key)
+            merged = 0
+            if prev is not None:
+                if now - prev[0] < self.dedupe_seconds:
+                    prev[1] += 1  # same error again: counted, reported with the next one
+                    return
+                merged = prev[1]
+            self._recent[key] = [now, 0]
+            if len(self._recent) > 200:
+                for k in sorted(self._recent, key=lambda k: self._recent[k][0])[:100]:
+                    self._recent.pop(k, None)
+            while self._times and now - self._times[0] > 60:
+                self._times.popleft()
+            if len(self._times) >= self.per_minute:
+                self._skipped += 1
+                return
+            self._times.append(now)
+            skipped, self._skipped = self._skipped, 0
+            try:
+                self._queue.put_nowait((title, tb, merged, skipped))
+            except asyncio.QueueFull:
+                self._skipped += 1 + skipped
+        except Exception:
+            pass
+
+    def loop_exception_handler(self, loop, context) -> None:
+        """asyncio calls this for exceptions nobody retrieved (set it with loop.set_exception_handler)."""
+        try:
+            exc = context.get("exception")
+            task = context.get("task") or context.get("future")
+            if task is not None and exc is not None:
+                title = f"Unhandled exception in background task {_task_label(task)}:"
+            else:
+                title = (context.get("message") or "Unhandled error in the event loop") + ":"
+            tb = format_exception(exc) if exc is not None else ""
+            self.submit(title, tb)
+        except Exception:
+            pass
+        finally:
+            loop.default_exception_handler(context)  # keep the normal log line too
+
+    # --------------------------------------------------------------------- output
+    async def _worker(self) -> None:
+        assert self._queue is not None
+        while True:
+            item = await self._queue.get()
+            try:
+                await self._deliver(*item)
+            except asyncio.CancelledError:
+                raise
+            except Exception as e:
+                name = type(e).__name__
+                log.warning("could not write to the error log chat: %s %s", name, str(e)[:150])
+                if isinstance(e, (ValueError, PermissionError)) or "Forbidden" in name or "Private" in name:
+                    # the bot is not a member of that chat (or may not write there): stop trying for a while
+                    self._muted_until = time.monotonic() + MUTE_SECONDS
+                    self._peer = None
+            finally:
+                self._queue.task_done()
+            await asyncio.sleep(self.gap)
+
+    async def _deliver(self, title: str, tb: str, merged: int = 0, skipped: int = 0) -> None:
+        if self._peer is None:
+            self._peer = await self.client.get_input_entity(self.chat_id)
+        text = title + (("\n\n" + tb.rstrip("\n")) if tb else "")
+        notes = []
+        if merged:
+            notes.append(f"(+{merged} identical report(s) suppressed)")
+        if skipped:
+            notes.append(f"({skipped} report(s) were skipped because too many errors came in)")
+        if notes:
+            text += "\n\n" + "\n".join(notes)
+        text = redact(text, self.secrets)
+        parts = split_report(text)
+        for i, part in enumerate(parts):
+            await self.client.send_message(
+                self._peer,
+                part,
+                formatting_entities=[types.MessageEntityPre(0, utf16_len(part), "python")],
+                link_preview=False,
+            )
+            if i < len(parts) - 1:
+                await asyncio.sleep(self.part_gap)
+
+    async def check(self) -> Optional[str]:
+        """None when the log chat can be reached, otherwise a short reason (used once at start-up)."""
+        if not self.enabled:
+            return None
+        try:
+            self._peer = await self.client.get_input_entity(self.chat_id)
+            return None
+        except Exception as e:
+            return (
+                f"{type(e).__name__}: {str(e)[:120]} - add the bot to that chat "
+                "(as a member, or as an admin who may post)"
+            )
+
+    async def report_fatal(self, title: str, exc: BaseException) -> None:
+        """The bot is going down: send the crash straight away (the queue may not get the time)."""
+        if not self.enabled:
+            return
+        try:
+
+            async def go() -> None:
+                if not self.client.is_connected():
+                    await self.client.connect()
+                if self.bot_token and not await self.client.is_user_authorized():
+                    await self.client.sign_in(bot_token=self.bot_token)
+                await self._deliver(title + ":", format_exception(exc))
+
+            await asyncio.wait_for(go(), 20)
+        except Exception as e:
+            log.warning("could not send the crash report: %s %s", type(e).__name__, str(e)[:150])
+
+
+# ------------------------------------------------------------------------------ logging
+class TelegramLogHandler(logging.Handler):
+    """Forwards log records (ERROR and up) to the reporter."""
+
+    def __init__(self, reporter: ErrorReporter, level: int = logging.ERROR):
+        super().__init__(level)
+        self.reporter = reporter
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            if record.name.startswith("app.errorlog") or record.name == "asyncio":
+                return  # our own messages would loop; asyncio's go through loop_exception_handler
+            title = record.getMessage()
+            tb = ""
+            if record.exc_info and record.exc_info[0] is not None:
+                tb = "".join(traceback.format_exception(*record.exc_info))
+                title += ":"
+            if not record.name.startswith(("app", "bot", "__main__")):
+                title = f"[{record.name}] {title}"
+            self.reporter.submit(title, tb)
+        except Exception:
+            pass

app/handlers/basic.py

@@ -1,6 +1,7 @@
-"""/start /help /cancel /export, plus the routers for free text and inline-button presses."""
+"""/start /help /cancel /export /userbot /testerror, plus the routers for free text and inline-button presses."""
 from __future__ import annotations
 
+import asyncio
 import io
 import json
 import logging
@@ -8,6 +9,7 @@ import logging
 from telethon import events
 
 from ..common import Ctx, cmd, clear_state, discard_temp, guard, say, show
+from ..tgutil import esc
 
 log = logging.getLogger(__name__)
 
@@ -24,8 +26,8 @@ HELP = (
     "/replace @old @new - swap the username inside t.me links (button links and hyperlinks) in all channels\n"
     "/undo - undo the last /replace\n"
     "/repost @old @new - copy every post of a channel in order (links swapped), then delete the old posts\n"
-    "/testedit <post link> - check that the bot can edit the buttons of one specific post\n"
-    "/selftest - check that editing buttons works on a post made by this bot\n"
+    "/userbot - status of the helper account that deletes posts the bot is not allowed to delete\n"
+    "/testerror - send a test error to the error log chat\n"
     "/export - download a JSON backup of your posts"
 )
 
@@ -54,6 +56,49 @@ def register(ctx: Ctx) -> None:
         buf.name = "channel-posts-export.json"
         await event.respond(f"📦 Backup: {len(data['channels'])} channel(s), {len(data['posts'])} post(s).", file=buf)
 
+    @client.on(cmd("userbot"))
+    @guard(ctx, owner=True)
+    async def h_userbot(event):
+        ub = ctx.userbot
+        if ub is None or not ub.enabled:
+            await say(
+                event,
+                "🤖 <b>Userbot: not set up.</b>\n"
+                "The bot deletes old posts itself first. If Telegram refuses (posts older than 48 hours), a helper "
+                "account - the userbot - can do it: it joins the channel through an invite link the bot makes, the bot "
+                "gives it the “Delete messages” right if it has the “Add new admins” right, and takes it away again "
+                "afterwards.\n\n"
+                "To set it up: on your own computer run <code>python make_userbot_session.py</code> with a "
+                "<b>separate</b> Telegram account, and put the printed text into the bot's secrets as "
+                "<code>USERBOT_SESSION</code>. See the README.",
+            )
+            return
+        if not ub.ready:
+            await ub.connect()
+        kept = "stays an admin" if ub.keep_admin else "is made admin only while deleting"
+        await say(event, f"🤖 <b>Userbot:</b> {esc(ub.describe())}\nIt {kept} (USERBOT_KEEP_ADMIN).")
+
+    @client.on(cmd("testerror", args=True))
+    @guard(ctx, owner=True)
+    async def h_testerror(event):
+        rep = getattr(ctx, "reporter", None)
+        if rep is None or not rep.enabled:
+            await say(event, "The error log is switched off (ERROR_LOG_CHAT_ID is 0 / off).")
+            return
+        mode = (event.pattern_match.group(1) or "").strip().lower()
+        if mode == "task":
+            async def boom():
+                raise RuntimeError("Test error from /testerror task")
+
+            asyncio.get_running_loop().create_task(boom())  # nobody awaits it, like a forgotten background task
+            await say(event, "A background task will fail in a moment - look in the error log chat.")
+            return
+        await say(event, "Raising a test error now - look in the error log chat. (Use <code>/testerror task</code> to test a background task.)")
+        try:
+            raise KeyError("test")
+        except KeyError as e:
+            raise RuntimeError("Test error from /testerror") from e
+
     @client.on(
         events.NewMessage(incoming=True, func=lambda e: e.is_private and not (e.raw_text or "").startswith("/"))
     )

app/handlers/checkbtn.py

@@ -0,0 +1,115 @@
+"""Check buttons (owner only): compare the buttons saved in the bot with what a channel really shows, and repair."""
+from __future__ import annotations
+
+import logging
+import time
+
+from telethon import Button, errors
+
+from ..buttons_sync import fix_buttons, scan_buttons
+from ..common import Ctx, UserError, on_cb, require_owner, show
+from ..tgutil import esc
+
+log = logging.getLogger(__name__)
+SAMPLE = 12
+
+
+def register(ctx: Ctx) -> None:
+    client, db, cfg = ctx.client, ctx.db, ctx.cfg
+
+    async def load(parts):
+        ch = await db.get_channel(int(parts[0]))
+        if ch is None:
+            raise UserError("That channel is not registered.")
+        if ctx.lock.locked():
+            raise UserError("Another long job (replace / repost) is still running.")
+        return ch
+
+    def throttled(event, make_text, every: float = 3.0):
+        last = [0.0]
+
+        async def upd(obj, force: bool = False) -> None:
+            now = time.monotonic()
+            if not force and now - last[0] < every:
+                return
+            last[0] = now
+            try:
+                await show(event, make_text(obj))
+            except errors.MessageNotModifiedError:
+                pass
+            except Exception:
+                log.debug("progress update failed", exc_info=True)
+
+        return upd
+
+    @on_cb(ctx, "pk")
+    async def cb_check(event, parts):
+        require_owner(ctx, event)
+        ch = await load(parts)
+        title = esc(ch.title)
+        async with ctx.lock:
+            await show(event, f"🔧 Checking the buttons of <b>{title}</b>…")
+            posts = await db.sent_posts(ch.id)
+            scan = await scan_buttons(
+                client, ch, posts, progress=throttled(event, lambda s: f"🔧 Checking <b>{title}</b>: {s.fine + len(s.bad) + len(s.gone)}/{s.total}…")
+            )
+        lines = [f"🔧 <b>{title}</b> - checked {scan.total} post(s) that have link buttons."]
+        kb = []
+        if not scan.total:
+            lines.append("None of the saved posts has link buttons, so there is nothing to check.")
+        else:
+            lines.append(f"✅ {scan.fine} show their buttons correctly.")
+        if scan.bad:
+            ids = ", ".join(f"#{p.message_id}" for p, _, _ in scan.bad[:SAMPLE])
+            more = "…" if len(scan.bad) > SAMPLE else ""
+            lines.append(
+                f"⚠️ <b>{len(scan.bad)}</b> are saved with buttons here, but the channel shows them without those buttons "
+                f"(or with different links): {ids}{more}"
+            )
+            kb.append([Button.inline(f"🔧 Fix {len(scan.bad)} post(s)", f"pkf:{ch.id}")])
+        elif scan.total:
+            lines.append("Everything matches.")
+        if scan.gone:
+            ids = ", ".join(f"#{p.message_id}" for p in scan.gone[:SAMPLE])
+            lines.append(
+                f"ℹ️ {len(scan.gone)} saved post(s) no longer exist in the channel ({ids}{'…' if len(scan.gone) > SAMPLE else ''})."
+            )
+        kb.append([Button.inline("🔙 Back", f"pc:{ch.id}:0")])
+        await show(event, "\n".join(lines), kb)
+
+    @on_cb(ctx, "pkf")
+    async def cb_fix(event, parts):
+        require_owner(ctx, event)
+        ch = await load(parts)
+        title = esc(ch.title)
+        async with ctx.lock:
+            await show(event, f"🔧 Looking again at <b>{title}</b>…")
+            scan = await scan_buttons(client, ch, await db.sent_posts(ch.id))
+            if not scan.bad:
+                res = None
+            else:
+                total = len(scan.bad)
+                res = await fix_buttons(
+                    client,
+                    ch,
+                    scan.bad,
+                    delay=cfg.edit_delay,
+                    progress=throttled(event, lambda r: f"🔧 Fixing <b>{title}</b>: {r.fixed + r.already}/{total}…"),
+                )
+        if res is None:
+            text = f"✅ <b>{title}</b>: all buttons match now - nothing to fix."
+        else:
+            lines = [f"🔧 <b>{title}</b> - put the saved buttons back on <b>{res.fixed}</b> post(s)."]
+            if res.nudged:
+                lines.append(f"{res.nudged} of them needed a second edit before Telegram showed the buttons.")
+            if res.already:
+                lines.append(f"{res.already} were already fine when I got to them.")
+            if res.gone:
+                lines.append(f"{res.gone} no longer exist in the channel.")
+            if res.failed:
+                sample = ", ".join(f"#{m} {esc(n)}" for m, n in res.failed[:8])
+                lines.append(f"⚠️ <b>{len(res.failed)} failed</b> ({sample}{'…' if len(res.failed) > 8 else ''}).")
+            if res.aborted:
+                lines.append(f"Stopped early: Telegram refused {esc(res.aborted)} several times in a row.")
+            text = "\n".join(lines)
+        await show(event, text, [[Button.inline("🔧 Check again", f"pk:{ch.id}"), Button.inline("🔙 Back", f"pc:{ch.id}:0")]])

app/handlers/posts.py

@@ -32,8 +32,10 @@ from ..common import (
     show,
 )
 from ..db import utcnow
+from ..repost_engine import delete_batch
 from ..tgutil import classify_media, esc, explain_rpc, pack_file_id, peer_of, post_link, ser_entities, short
 from ..ui import CANCEL, post_label
+from ..userbot import delete_problem_text
 from .panel import (
     check_lengths,
     load_post,
@@ -84,13 +86,13 @@ def register(ctx: Ctx) -> None:
             rows, total = await db.list_posts(cid, status, page * PAGE, PAGE)
         kb = [[Button.inline(post_label(p), f"po:{p.id}")] for p in rows]
         if pages > 1:
-            nav = []
-            if page > 0:
-                nav.append(Button.inline("⬅️ Prev", f"pc:{key}:{page - 1}"))
-            nav.append(Button.inline(f"{page + 1}/{pages}", "noop"))
+            # "Prev" is always there: on the first page it jumps to the last one
+            nav = [Button.inline("⬅️ Prev", f"pc:{key}:{(page - 1) % pages}"), Button.inline(f"{page + 1}/{pages}", "noop")]
             if page < pages - 1:
                 nav.append(Button.inline("Next ➡️", f"pc:{key}:{page + 1}"))
             kb.append(nav)
+        if cid is not None and ctx.cfg.is_owner(event.sender_id):
+            kb.append([Button.inline("🔧 Check buttons", f"pk:{cid}")])
         kb.append([Button.inline("🔙 Channels", "pl")])
         head = f"📚 <b>{esc(title)}</b> - {total} post(s)"
         if not rows:
@@ -387,7 +389,8 @@ def register(ctx: Ctx) -> None:
             event,
             f"Delete this post from <b>{esc(ch.title)}</b>?\n\n"
             "Telegram's documentation says bots can only delete posts younger than 48 hours; in channels that limit may "
-            "not apply. If Telegram refuses, delete the post by hand and then use “Only forget it in the bot”.",
+            "not apply. If the bot can't, the userbot (if you set one up, see /userbot) tries next. If both fail, delete "
+            "the post by hand and then use “Only forget it in the bot”.",
             [
                 [Button.inline("🗑 Delete from channel", f"dly:{post.id}:a")],
                 [Button.inline("🧹 Only forget it in the bot", f"dly:{post.id}:b")],
@@ -399,12 +402,16 @@ def register(ctx: Ctx) -> None:
     async def cb_delete_yes(event, parts):
         post, ch = await load_post(ctx, parts[0])
         if post.status == "sent" and parts[1] == "a":
-            res = await client.delete_messages(peer_of(ch), [post.message_id])
-            if not sum(getattr(r, "pts_count", 0) or 0 for r in res):
-                raise UserError(
-                    "Telegram did not delete that message (the bot may lack the Delete right, or the post is older than "
-                    "the 48 hours Telegram's documentation mentions). Delete it by hand in the channel, then use "
-                    "“Only forget it in the bot”."
+            fallback, deleter = await ctx.userbot.fallback_for(ch) if ctx.userbot is not None else (None, None)
+            try:
+                out = await delete_batch(client, peer_of(ch), [post.message_id], fallback)
+            finally:
+                if deleter is not None:
+                    await deleter.close()
+            if post.message_id not in out.gone:
+                why = delete_problem_text(
+                    ctx.userbot, bot_error=out.bot_error, fallback_error=out.fallback_error, tried=out.tried_userbot
                 )
+                raise UserError(f"Telegram did not delete that message. {why}\nDelete it by hand in the channel, then use “Only forget it in the bot”.")
         await db.delete_post(post.id)
         await show(event, "🗑 Done.", [[Button.inline("📚 My posts", "pl")]])

app/handlers/replace.py

@@ -1,20 +1,18 @@
-"""/replace, /undo and /testedit (owner only)."""
+"""/replace and /undo (owner only)."""
 from __future__ import annotations
 
-import asyncio
 import logging
 import re
 import secrets
 import time
 from dataclasses import dataclass, field
 
-from telethon import Button, errors, types
+from telethon import Button, errors
 
-from ..common import Ctx, UserError, cmd, edit_callback_message, guard, on_cb, require_owner, say, show
+from ..common import Ctx, UserError, cmd, edit_callback_message, guard, on_cb, purge_pending, require_owner, say, show
 from ..linkswap import normalize_username
 from ..replace_engine import ApplyResult, ChannelScan, ScanOptions, apply_channel, scan_channel, undo_batch
-from ..tgutil import build_markup, button_url, edit_raw, esc, explain_rpc, get_rights, peer_of, short, with_url
-from ..ui import CANCEL
+from ..tgutil import esc, explain_rpc, get_rights
 from .channels import parse_channel_ref
 
 log = logging.getLogger(__name__)
@@ -25,7 +23,6 @@ USAGE = (
     "post ids), <code>--posts</code> (also change t.me/old/123 post links), <code>--no-typed</code> (don't touch "
     "links typed in the text)."
 )
-TOKEN_TTL = 3600
 
 
 @dataclass
@@ -104,7 +101,7 @@ def summary_text(job: Job) -> str:
                 block += f"\n• {s.foreign} of them were not posted by this bot"
             fb = sum(1 for i in s.infos.values() if not i.mine and i.buttons)
             if fb:
-                block += f"\n• {fb} are button posts made by someone else - Telegram may refuse to edit those (check with /testedit)"
+                block += f"\n• {fb} are button posts made by someone else - Telegram may refuse to edit those; /repost can re-post them with the new links instead"
             cb = sum(1 for i in s.infos.values() if i.callbacks)
             if cb:
                 block += f"\n• {cb} carry other bots' buttons (e.g. reactions) - those stay as they are"
@@ -124,11 +121,6 @@ def register(ctx: Ctx) -> None:
     client, db, cfg = ctx.client, ctx.db, ctx.cfg
     lock = ctx.lock
 
-    def purge_tokens() -> None:
-        now = time.monotonic()
-        for k in [k for k, v in ctx.pending.items() if not getattr(v, "running", False) and now - getattr(v, "created", now) > TOKEN_TTL]:
-            ctx.pending.pop(k, None)
-
     def make_updater(event):
         last = [0.0]
 
@@ -150,7 +142,7 @@ def register(ctx: Ctx) -> None:
     @client.on(cmd("replace", args=True))
     @guard(ctx, owner=True)
     async def h_replace(event):
-        purge_tokens()
+        purge_pending(ctx)
         raw = (event.pattern_match.group(1) or "").strip()
         if not raw:
             await say(event, USAGE)
@@ -275,7 +267,7 @@ def register(ctx: Ctx) -> None:
             lines.append(f"• <b>failed: {len(totals.failed)}</b> ({sample}{'…' if len(totals.failed) > 8 else ''})")
             names = {n for _, n in totals.failed}
             if names & {"MessageAuthorRequiredError", "InlineBotRequiredError", "ChatAdminRequiredError", "MessageIdInvalidError"}:
-                lines.append("  Telegram doesn't let this bot edit those posts (see /testedit and /selftest).")
+                lines.append("  Telegram doesn't let this bot edit those posts. Use /repost to post them again with the new links.")
         for title, name in stopped:
             lines.append(f"⚠️ Stopped early in <b>{esc(title)}</b>: Telegram refused 5 edits in a row ({esc(name)}).")
         kb = [[Button.inline("↩️ Undo this replace", f"ruc:{batch_id}")]] if totals.edited else None
@@ -330,213 +322,3 @@ def register(ctx: Ctx) -> None:
         if res.failed:
             text += f"\n⚠️ {len(res.failed)} could not be restored (" + ", ".join(f"#{m} {esc(n)}" for m, n in res.failed[:6]) + ")."
         await upd(text, force=True)
-
-
-    # ---------------------------------------------------------------- /selftest
-    async def ask_selftest(event, ch) -> None:
-        await say(
-            event,
-            f"🧪 <b>Self-test in {esc(ch.title)}</b>\n"
-            "The bot posts a short test message with one button (silently), changes the button link, reads it back "
-            "and deletes the message again. It takes a few seconds and shows whether editing buttons works "
-            "for posts made by this bot.",
-            [[Button.inline("🧪 Run the test", f"st:{ch.id}"), Button.inline("✖️ Cancel", "cx")]],
-        )
-
-    @client.on(cmd("selftest", args=True))
-    @guard(ctx, owner=True)
-    async def h_selftest(event):
-        ref = (event.pattern_match.group(1) or "").strip() or None
-        try:
-            chans = pick_channels(await db.list_channels(), ref)
-        except ValueError as e:
-            raise UserError(str(e))
-        if not chans:
-            raise UserError("No channels registered yet. Use /addchannel.")
-        if len(chans) == 1:
-            await ask_selftest(event, chans[0])
-            return
-        kb = [[Button.inline(f"📢 {short(c.title, 40)}", f"stc:{c.id}")] for c in chans] + CANCEL
-        await say(event, "Run the self-test in which channel?", kb)
-
-    @on_cb(ctx, "stc")
-    async def cb_selftest_pick(event, parts):
-        require_owner(ctx, event)
-        ch = await db.get_channel(int(parts[0]))
-        if ch is None:
-            raise UserError("That channel is not registered.")
-        await ask_selftest(event, ch)
-
-    @on_cb(ctx, "st")
-    async def cb_selftest(event, parts):
-        require_owner(ctx, event)
-        ch = await db.get_channel(int(parts[0]))
-        if ch is None:
-            raise UserError("That channel is not registered.")
-        peer = peer_of(ch)
-        first = build_markup([[{"t": "Test button", "u": "https://example.com/a"}]])
-        second = build_markup([[{"t": "Test button", "u": "https://example.com/b"}]])
-        lines = [f"🧪 <b>Self-test in {esc(ch.title)}</b>"]
-        edit_ok = False
-        sent = None
-        try:
-            sent = await client.send_message(
-                peer, "🧪 Edit test - this message deletes itself in a moment.", buttons=first, link_preview=False, silent=True
-            )
-            lines.append("✅ posted a test message")
-        except errors.RPCError as e:
-            lines.append(f"❌ could not post: {esc(explain_rpc(e))}")
-        if sent is not None:
-            try:
-                await edit_raw(client, peer, sent.id, markup=second)
-                got = (await client.get_messages(peer, ids=[sent.id]))[0]
-                urls = []
-                if got is not None and isinstance(got.reply_markup, types.ReplyInlineMarkup):
-                    urls = [button_url(b) for row in got.reply_markup.rows for b in row.buttons if button_url(b)]
-                edit_ok = urls == ["https://example.com/b"]
-                lines.append(
-                    "✅ changed the button link and read it back"
-                    if edit_ok
-                    else "⚠️ Telegram accepted the edit but the link did not change"
-                )
-            except errors.RPCError as e:
-                lines.append(f"❌ could not edit the button: {esc(explain_rpc(e))}")
-            try:
-                res = await client.delete_messages(peer, [sent.id])
-                gone = sum(getattr(r, "pts_count", 0) or 0 for r in res)
-                lines.append("✅ deleted the test message" if gone else "⚠️ could not delete it - please delete it by hand")
-            except errors.RPCError as e:
-                lines.append(f"⚠️ could not delete it ({esc(type(e).__name__)}) - please delete it by hand")
-        if edit_ok:
-            lines.append(
-                "\n<b>Editing buttons works for posts made by this bot.</b> If /testedit still fails on Channel Help "
-                "posts, Telegram doesn't let this bot change buttons that another bot added."
-            )
-        else:
-            lines.append(
-                "\n<b>Editing failed even for this bot's own post</b>, so check the bot's admin rights in the channel "
-                "(Post messages, Edit messages of others, Delete messages)."
-            )
-        await show(event, "\n".join(lines))
-
-    # ---------------------------------------------------------------- /testedit
-    link_rx = re.compile(
-        r"(?i)(?:https?://)?(?:t\.me|telegram\.me)/(?:c/(?P<cid>\d+)|(?P<user>[A-Za-z0-9_]{3,32}))/(?P<mid>\d+)"
-    )
-
-    @client.on(cmd("testedit", args=True))
-    @guard(ctx, owner=True)
-    async def h_testedit(event):
-        purge_tokens()
-        m = link_rx.search(event.pattern_match.group(1) or "")
-        if not m:
-            raise UserError("Usage: /testedit https://t.me/yourchannel/123  (a link to one post that has a link button)")
-        chans = await db.list_channels()
-        ch = None
-        for c in chans:
-            if (m.group("cid") and c.id == int(m.group("cid"))) or (
-                m.group("user") and (c.username or "").lower() == m.group("user").lower()
-            ):
-                ch = c
-        if ch is None:
-            raise UserError("That channel isn't registered. Use /addchannel first.")
-        mid = int(m.group("mid"))
-        msgs = await client.get_messages(peer_of(ch), ids=[mid])
-        msg = msgs[0] if msgs else None
-        if msg is None or isinstance(msg, (types.MessageEmpty, types.MessageService)):
-            raise UserError("I can't read that message - was it deleted?")
-        urls = []
-        if isinstance(msg.reply_markup, types.ReplyInlineMarkup):
-            urls = [button_url(b) for row in msg.reply_markup.rows for b in row.buttons if button_url(b)]
-        if not urls:
-            raise UserError("That post has no link buttons. Pick one that has a button with a link.")
-        rights = await get_rights(client, ch)
-        rtxt = "unknown" if rights is None else ("can edit others' posts" if rights.edit else "⚠️ NO “edit messages of others” right")
-        token = secrets.token_hex(4)
-        ctx.pending[token] = _TestJob(user=event.sender_id, ch=ch, mid=mid)
-        await say(
-            event,
-            f"🧪 <b>Edit test</b> for post {mid} in <b>{esc(ch.title)}</b>\n"
-            f"Posted by this bot: {'yes' if msg.out else 'no (someone else / another bot)'}\n"
-            f"Bot rights: {rtxt}\n"
-            f"First button link: <code>{esc(urls[0][:80])}</code>\n\n"
-            "The test adds <code>x=1</code> to that first link and immediately changes it back. "
-            "Visitors won't notice.",
-            [[Button.inline("🧪 Run the test", f"te:{token}"), Button.inline("✖️ Cancel", "cx")]],
-        )
-
-    @on_cb(ctx, "te")
-    async def cb_testedit(event, parts):
-        require_owner(ctx, event)
-        job = ctx.pending.pop(parts[0], None)
-        if not isinstance(job, _TestJob) or job.user != event.sender_id:
-            raise UserError("That test has expired. Run /testedit again.")
-        peer = peer_of(job.ch)
-        msgs = await client.get_messages(peer, ids=[job.mid])
-        msg = msgs[0]
-        if msg is None or not isinstance(msg.reply_markup, types.ReplyInlineMarkup):
-            raise UserError("The post changed or was deleted. Run /testedit again.")
-        original = msg.reply_markup
-        changed = False
-        rows = []
-        for row in original.rows:
-            btns = []
-            for b in row.buttons:
-                u = button_url(b)
-                if u and not changed:
-                    btns.append(with_url(b, u + ("&" if "?" in u else "?") + "x=1"))
-                    changed = True
-                else:
-                    btns.append(b)
-            rows.append(types.KeyboardButtonRow(btns))
-        try:
-            await edit_raw(client, peer, job.mid, markup=types.ReplyInlineMarkup(rows))
-        except errors.RPCError as e:
-            extra = ""
-            if type(e).__name__ == "MessageIdInvalidError":
-                extra = (
-                    "\n\nThe post does exist - I read it a moment ago - so this is not about a missing message. "
-                    "For edits Telegram uses this error when the bot isn't allowed to change the message, typically "
-                    "because the buttons were added by another bot.\n"
-                    "Run /selftest: it tries the same edit on a post made by this bot. If that works, your setup is fine "
-                    "and Telegram simply doesn't let this bot change those buttons."
-                )
-            await show(
-                event,
-                f"❌ <b>Telegram refused the edit</b> ({esc(type(e).__name__)})\n{esc(explain_rpc(e))}{extra}\n\n"
-                "So /replace can NOT change the buttons of this post with this bot.",
-            )
-            return
-        restored, last_err = False, None
-        for _ in range(3):
-            try:
-                await edit_raw(client, peer, job.mid, markup=original)
-                restored = True
-                break
-            except errors.MessageNotModifiedError:
-                restored = True
-                break
-            except errors.RPCError as e:
-                last_err = e
-                await asyncio.sleep(1.5)
-        if restored:
-            await show(
-                event,
-                "✅ <b>Test passed.</b> The bot can edit the buttons of that post, and the link was put back.\n"
-                "/replace will work on posts like this one.",
-            )
-        else:
-            orig_urls = "\n".join(esc(button_url(b)) for row in original.rows for b in row.buttons if button_url(b))
-            await show(
-                event,
-                f"⚠️ The edit worked, but putting the link back failed ({esc(type(last_err).__name__)}).\n"
-                "The first link still ends in x=1 - please fix it by hand. Original links:\n" + orig_urls,
-            )
-
-
-@dataclass
-class _TestJob:
-    user: int
-    ch: object
-    mid: int
-    created: float = field(default_factory=time.monotonic)

app/handlers/repost.py

@@ -9,24 +9,34 @@ from dataclasses import dataclass, field
 
 from telethon import Button, errors
 
-from ..common import Ctx, UserError, cmd, edit_callback_message, guard, on_cb, require_owner, say
+from ..common import Ctx, UserError, cmd, edit_callback_message, guard, on_cb, purge_pending, require_owner, say
 from ..linkswap import normalize_username
 from ..repost_engine import RepostOptions, RepostPlan, delete_copies, plan_repost, run_repost
-from ..tgutil import esc, get_rights, post_link
-from .replace import pick_channels
+from ..tgutil import esc, get_rights, post_link, short
+from ..userbot import delete_problem_text
 
 log = logging.getLogger(__name__)
 
 USAGE = (
     "Usage: <code>/repost @old @new</code>\n"
-    "Copies every post of the channel, in order, to the end of the channel and swaps the username inside "
-    "t.me links on the way. Leave out the usernames to copy without changing links.\n"
-    "Options: <code>--channel @name</code>, <code>--last 5</code> (trial: only the newest 5 post ids), "
+    "Copies every post of a channel, in order, to the end of the channel and swaps the username inside "
+    "t.me links on the way. Leave out the usernames to copy without changing links. "
+    "You pick the channel with buttons afterwards.\n"
+    "Options: <code>--last 5</code> (trial: only the newest 5 post ids), "
     "<code>--posts</code> (also change t.me/old/123 post links), <code>--no-typed</code>.\n\n"
     "Nothing is deleted by /repost itself: you decide about the old posts after checking the copies."
 )
 
 
+@dataclass
+class RepostChoice:
+    """/repost was typed; the owner still has to pick the channel."""
+
+    user: int
+    opts: RepostOptions
+    created: float = field(default_factory=time.monotonic)
+
+
 @dataclass
 class RepostJob:
     user: int
@@ -41,14 +51,13 @@ class RepostJob:
 
 def parse_repost_args(raw: str) -> tuple:
     toks = (raw or "").split()
-    flags = {"channel": None, "last": None, "posts": False, "typed": None}
+    flags = {"last": None, "posts": False, "typed": None}
     pos: list = []
     i = 0
     while i < len(toks):
         t = toks[i]
-        if t == "--channel" and i + 1 < len(toks):
-            flags["channel"] = toks[i + 1]
-            i += 2
+        if t == "--channel":
+            raise ValueError("/repost no longer takes --channel: send the command without it and pick the channel with the buttons.")
         elif t == "--last" and i + 1 < len(toks):
             if not toks[i + 1].isdigit() or int(toks[i + 1]) < 1:
                 raise ValueError("--last needs a number, for example --last 5")
@@ -101,9 +110,10 @@ def plan_text(p: RepostPlan, o: RepostOptions, title: str, delay: float) -> str:
     minutes = max(1, round(p.eta_seconds(delay) / 60))
     lines += [
         "",
-        "<b>How:</b> Telegram copies each post itself, so bold, links, quotes, expandable quotes, spoilers, media and "
-        "albums stay exactly as they are (if the channel blocks copying, posts are rebuilt from their parts). Copies go "
-        "to the end of the channel silently, in the original order, and are registered in My posts.",
+        "<b>How:</b> posts without buttons or links to change are copied by Telegram itself, so they stay exactly as "
+        "they are. Posts with buttons (or links to swap) are posted again with their text, formatting, media and "
+        "buttons in one go, and each one is read back to make sure its buttons are really there. Copies go to the end "
+        "of the channel silently, in the original order, and are registered in My posts.",
         "",
         "<b>Not kept:</b> original dates, view counts, reactions, comments, poll votes, pinned state and links to the "
         "old posts.",
@@ -162,6 +172,7 @@ def register(ctx: Ctx) -> None:
     @client.on(cmd("repost", args=True))
     @guard(ctx, owner=True)
     async def h_repost(event):
+        purge_pending(ctx)
         raw = (event.pattern_match.group(1) or "").strip()
         if not raw:
             mig = await db.open_migration()
@@ -173,55 +184,77 @@ def register(ctx: Ctx) -> None:
             return
         try:
             old, new, flags = parse_repost_args(raw)
-            chans = await db.list_channels()
-            if flags["channel"]:
-                chans = pick_channels(chans, flags["channel"])
-            elif len(chans) > 1:
-                raise ValueError("You have several channels - add --channel @name.")
         except ValueError as e:
             raise UserError(f"{e}\n\n" + re.sub(r"<[^>]+>", "", USAGE))
+        chans = await db.list_channels()
         if not chans:
             raise UserError("No channels registered yet. Use /addchannel.")
-        ch = chans[0]
+        opts = RepostOptions(
+            old=old,
+            new=new,
+            include_typed=cfg.replace_typed_links if flags["typed"] is None else flags["typed"],
+            include_posts=flags["posts"],
+            last=flags["last"],
+        )
+        token = secrets.token_hex(4)
+        ctx.pending[token] = RepostChoice(user=event.sender_id, opts=opts)
+        what = (
+            f"swap <code>@{esc(old)}</code> → <code>@{esc(new)}</code> in the links"
+            if opts.swaps
+            else "copy without changing any link"
+        )
+        if opts.last:
+            what += f", trial: only the newest {opts.last} post ids"
+        kb = [[Button.inline(f"📢 {short(c.title, 40)}", f"rpch:{token}:{c.id}")] for c in chans]
+        kb.append([Button.inline("✖️ Cancel", f"rpn:{token}")])
+        await say(event, f"📢 <b>Which channel should I repost?</b>\nPlan: {what}.", kb)
+
+    @on_cb(ctx, "rpch")
+    async def cb_pick(event, parts):
+        require_owner(ctx, event)
+        token, cid = parts[0], int(parts[1])
+        choice = ctx.pending.get(token)
+        if not isinstance(choice, RepostChoice) or choice.user != event.sender_id:
+            raise UserError("That list has expired. Run /repost again.")
+        ch = await db.get_channel(cid)
+        if ch is None or not ch.active:
+            raise UserError("That channel is not registered any more. Run /repost again.")
         mig = await db.open_migration(ch.id)
         if mig is not None:
+            ctx.pending.pop(token, None)
             text, kb = await view_for(mig)
-            await say(event, "There is an unfinished repost for this channel. Finish or undo it first.\n\n" + text, kb)
+            await edit_callback_message(
+                event, "There is an unfinished repost for this channel. Finish or undo it first.\n\n" + text, kb
+            )
             return
         rights = await get_rights(client, ch)
         if rights is not None and not (rights.admin and rights.post):
             raise UserError("The bot needs the “Post messages” admin right in that channel.")
         if ctx.lock.locked():
             raise UserError("Another long job (replace / repost) is still running.")
-        opts = RepostOptions(
-            old=old,
-            new=new,
-            include_typed=cfg.replace_typed_links if flags["typed"] is None else flags["typed"],
-            include_posts=flags["posts"],
-            last=flags["last"],
-        )
-        async with ctx.lock:
-            status = await say(event, f"🔍 Reading <b>{esc(ch.title)}</b>…")
-            last = [0.0]
-
-            async def prog(p):
-                if time.monotonic() - last[0] < 3:
-                    return
-                last[0] = time.monotonic()
-                try:
-                    await status.edit(f"🔍 Reading <b>{esc(ch.title)}</b>: post id {p.scanned}…")
-                except Exception:
-                    pass
+        ctx.pending.pop(token, None)  # a second press on the list can't start a second plan
+        opts = choice.opts
+        last = [0.0]
+
+        async def prog(p):
+            if time.monotonic() - last[0] < 3:
+                return
+            last[0] = time.monotonic()
+            try:
+                await edit_callback_message(event, f"🔍 Reading <b>{esc(ch.title)}</b>: post id {p.scanned}…")
+            except Exception:
+                pass
 
+        async with ctx.lock:
+            await edit_callback_message(event, f"🔍 Reading <b>{esc(ch.title)}</b>…")
             plan = await plan_repost(client, ch, opts, progress=prog)
         if plan.error:
-            await status.edit(f"⚠️ {esc(plan.error)}")
+            await edit_callback_message(event, f"⚠️ {esc(plan.error)}")
             return
         job = RepostJob(user=event.sender_id, ch=ch, opts=opts, plan=plan)
-        token = secrets.token_hex(4)
         ctx.pending[token] = job
         kb = [[Button.inline("▶️ Start copying", f"rpa:{token}"), Button.inline("✖️ Cancel", f"rpn:{token}")]]
-        await status.edit(plan_text(plan, opts, ch.title, cfg.edit_delay), buttons=kb, link_preview=False)
+        await edit_callback_message(event, plan_text(plan, opts, ch.title, cfg.edit_delay), kb)
 
     @on_cb(ctx, "rpn")
     async def cb_cancel(event, parts):
@@ -268,11 +301,20 @@ def register(ctx: Ctx) -> None:
         mig = await db.get_migration(mig.id)
         text, kb = await view_for(mig)
         notes = []
-        if res.rebuilt:
-            notes.append(f"{res.rebuilt} post(s) had to be rebuilt from their parts instead of copied by Telegram.")
+        if res.copied_units:
+            notes.append(
+                f"{res.forwarded} post(s) were copied by Telegram, {res.rebuilt} were posted again with their buttons."
+            )
+        if res.repaired:
+            notes.append(f"{res.repaired} post(s) needed their buttons set again after posting - they show them now.")
         if res.failed:
             sample = ", ".join(f"#{i} {esc(n)}" for i, n in res.failed[:6])
             notes.append(f"<b>{len(res.failed)} post(s) failed</b> ({sample}{'…' if len(res.failed) > 6 else ''}).")
+            if any(n == "ButtonsNotShown" for _, n in res.failed):
+                notes.append(
+                    "ButtonsNotShown: Telegram did not show the buttons on the new post, so that copy was removed again. "
+                    "The original is untouched - use “Try the rest again”."
+                )
         if res.aborted:
             notes.append(f"Stopped early because of {esc(res.aborted)}.")
         await edit_callback_message(event, text + ("\n\n" + "\n".join(notes) if notes else ""), kb)
@@ -347,10 +389,15 @@ def register(ctx: Ctx) -> None:
             event,
             f"🗑 <b>Delete {c['old_left']} old message(s) from {esc(ch.title)}?</b>\n"
             "Only originals that have a copy are deleted. This can't be undone. The copies stay and become the channel.\n"
-            "If Telegram refuses (rights, or an age limit), nothing is lost: the copies are already there.",
+            "If Telegram refuses (rights, or an age limit), the userbot - if you set one up - deletes what the bot can't. "
+            "Nothing is lost either way: the copies are already there.",
             [[Button.inline(f"🗑 Yes, delete {c['old_left']}", f"rpdy:{mig.id}"), Button.inline("↩️ Back", f"rpb:{mig.id}")]],
         )
 
+    def userbot_lines(deleter) -> str:
+        notes = getattr(deleter, "notes", None) or []
+        return ("\n" + "\n".join(f"• {esc(n)}" for n in notes)) if notes else ""
+
     @on_cb(ctx, "rpdy")
     async def cb_delete_old(event, parts):
         require_owner(ctx, event)
@@ -370,23 +417,32 @@ def register(ctx: Ctx) -> None:
             except Exception:
                 pass
 
-        async with ctx.lock:
-            res = await delete_copies(client, db, ch, mig, "old", delay=0.5, progress=prog)
+        fallback, deleter = await ctx.userbot.fallback_for(ch) if ctx.userbot is not None else (None, None)
+        try:
+            async with ctx.lock:
+                res = await delete_copies(client, db, ch, mig, "old", delay=0.5, progress=prog, fallback=fallback)
+        finally:
+            if deleter is not None:
+                await deleter.close()
         c = await db.migration_counts(mig.id)
+        extra = userbot_lines(deleter)
+        by = f" ({res.by_userbot} of them by the userbot)" if res.by_userbot else ""
         if res.remaining == 0 and not res.error:
             await db.set_migration_status(mig.id, "old_deleted")
             await edit_callback_message(
                 event,
-                f"✅ <b>Done.</b> {res.deleted} old message(s) deleted. The channel now consists of the copies "
-                f"(from <a href=\"{post_link(ch, c['first_new'])}\">here</a>), and they are all in My posts.",
+                f"✅ <b>Done.</b> {res.deleted} old message(s) deleted{by}. The channel now consists of the copies "
+                f"(from <a href=\"{post_link(ch, c['first_new'])}\">here</a>), and they are all in My posts.{extra}",
             )
             return
-        why = f"Telegram error: {esc(res.error)}." if res.error else (
-            "Telegram refused to delete the next batch (the bot's “Delete messages” right, or an age limit on old posts)."
+        why = esc(
+            delete_problem_text(
+                ctx.userbot, bot_error=res.error, fallback_error=res.fallback_error, tried=res.tried_userbot
+            )
         )
         await edit_callback_message(
             event,
-            f"⚠️ Deleted {res.deleted}, {res.remaining} old message(s) are still there. {why}\n"
+            f"⚠️ Deleted {res.deleted}{by}, {res.remaining} old message(s) are still there. {why}{extra}\n"
             f"The copies are complete. You can delete the rest by hand: they are the messages with an id below "
             f"{c['first_new']}. Then close this repost.",
             [[Button.inline("🔁 Try again", f"rpdy:{mig.id}")], [Button.inline("✅ Close this repost", f"rpk:{mig.id}")]],
@@ -414,15 +470,27 @@ def register(ctx: Ctx) -> None:
             raise UserError("Undo is not possible any more.")
         if ctx.lock.locked():
             raise UserError("A long job is already running.")
-        async with ctx.lock:
-            res = await delete_copies(client, db, ch, mig, "new", delay=0.5)
+        fallback, deleter = await ctx.userbot.fallback_for(ch) if ctx.userbot is not None else (None, None)
+        try:
+            async with ctx.lock:
+                res = await delete_copies(client, db, ch, mig, "new", delay=0.5, fallback=fallback)
+        finally:
+            if deleter is not None:
+                await deleter.close()
         if res.remaining == 0 and not res.error:
             await db.set_migration_status(mig.id, "copies_deleted")
-            await edit_callback_message(event, f"↩️ Done. {res.deleted} copied message(s) removed; the original posts were not touched.")
+            await edit_callback_message(
+                event, f"↩️ Done. {res.deleted} copied message(s) removed; the original posts were not touched.{userbot_lines(deleter)}"
+            )
         else:
+            why = esc(
+                delete_problem_text(
+                    ctx.userbot, bot_error=res.error, fallback_error=res.fallback_error, tried=res.tried_userbot
+                )
+            )
             await edit_callback_message(
                 event,
-                f"⚠️ Removed {res.deleted}, {res.remaining} copy/copies are still there ({esc(res.error or 'Telegram refused')}).",
+                f"⚠️ Removed {res.deleted}, {res.remaining} copy/copies are still there. {why}",
                 [[Button.inline("🔁 Try again", f"rpuy:{mig.id}")]],
             )
 

app/health.py

@@ -17,6 +17,10 @@ async def start_health_server(port: int):
         finally:
             writer.close()
 
-    server = await asyncio.start_server(handle, "0.0.0.0", port)
+    try:
+        server = await asyncio.start_server(handle, "0.0.0.0", port)
+    except OSError as e:  # e.g. something else (python -m http.server) already uses the port
+        log.warning("could not open the health endpoint on :%s (%s) - continuing without it", port, e)
+        return None
     log.info("health endpoint listening on :%s", port)
     return server

app/repost_engine.py

@@ -1,9 +1,12 @@
 """Repost a whole channel in order.
 
 Every post is copied to the end of the channel (silently), in the same order as the original:
-  1. server-side copy (messages.forwardMessages with drop_author): text, formatting, quotes, media and
-     albums are copied exactly by Telegram itself;
-  2. if the channel forbids forwarding, or a copy can't be fixed up, the post is rebuilt from its parts.
+  1. a post that needs no change (no buttons, no link to swap) is copied by Telegram itself
+     (messages.forwardMessages with drop_author): text, formatting, quotes, media and albums stay exact;
+  2. a post with buttons, or with links to swap, is created again in ONE request that carries its final
+     text, formatting and buttons - exactly how the bot publishes a post of its own - and is then read back
+     to make sure the buttons really are there (a copy that is edited afterwards can end up without them);
+  3. if the channel forbids forwarding, every post is created like in 2.
 Links can be swapped on the way, the new posts are registered in the database, and the old posts are removed
 later in a separate step. Nothing here deletes anything unless asked to (delete_copies).
 """
@@ -16,9 +19,19 @@ from typing import Any, AsyncIterator, Awaitable, Callable, Optional
 
 from telethon import errors, functions, types, utils
 
+from .buttons_sync import ButtonsNotShown, ensure_markup, link_urls
 from .linkswap import compute_message_changes, url_only_markup
 from .replace_engine import CHUNK, FALLBACK_EMPTY_BATCHES, fetch_messages, get_top_id, is_skippable, preview_flag
-from .tgutil import classify_media, edit_raw, flood_retry, media_ref, peer_of, ser_entities, ser_markup
+from .tgutil import (
+    build_markup,
+    classify_media,
+    de_entities,
+    flood_retry,
+    media_ref,
+    peer_of,
+    ser_entities,
+    ser_markup,
+)
 
 log = logging.getLogger(__name__)
 
@@ -74,6 +87,9 @@ def final_state(src, opts: RepostOptions) -> Final:
     markup, dropped = url_only_markup(
         src.reply_markup, opts.old if opts.swaps else None, opts.new if opts.swaps else None, opts.include_posts
     )
+    # Send exactly what is saved: go through the stored form that "My posts" also uses to build its edits.
+    markup = build_markup(ser_markup(markup)) if markup is not None else None
+    entities = de_entities(ser_entities(entities))
     return Final(
         text=text,
         entities=entities,
@@ -250,18 +266,6 @@ async def forward_unit(client, peer, unit: list) -> list:
     return new_messages_from(result)
 
 
-async def edit_copies(client, peer, unit: list, finals: list, news: list) -> None:
-    """A copy may carry the old keyboard / old links: set the final text and buttons."""
-    for src, f, new in zip(unit, finals, news):
-        if f.text_changed or src.reply_markup is not None:
-            try:
-                await flood_retry(
-                    lambda: edit_raw(client, peer, new.id, text=f.text, entities=f.entities, markup=f.markup, preview=f.preview)
-                )
-            except errors.MessageNotModifiedError:
-                pass
-
-
 def _inverted(m) -> Optional[bool]:
     return True if getattr(m, "invert_media", False) else None
 
@@ -318,26 +322,26 @@ async def resend_unit(client, peer, unit: list, finals: list) -> list:
 
 @dataclass
 class _State:
-    mode: str = "forward"
+    mode: str = "forward"  # becomes "resend" when the channel forbids forwarding
     forwarded: int = 0
     rebuilt: int = 0
+    repaired: int = 0  # new posts whose buttons had to be set again after posting
+
+
+def is_pure(src, f: Final) -> bool:
+    """True when a server-side copy is already the final post: nothing to swap and no keyboard to rebuild."""
+    return not f.text_changed and src.reply_markup is None
 
 
 async def copy_unit(client, peer, unit: list, finals: list, st: _State) -> list:
-    if st.mode == "forward":
-        news = None
+    pure = all(is_pure(m, f) for m, f in zip(unit, finals))
+    if st.mode == "forward" and pure:
         try:
             news = await forward_unit(client, peer, unit)
-            if len(news) != len(unit):
-                await delete_ids(client, peer, [n.id for n in news])
-                news = None
-            else:
-                try:
-                    await edit_copies(client, peer, unit, finals, news)
-                except errors.RPCError as e:
-                    log.info("could not fix up a copy (%s) - rebuilding the post", type(e).__name__)
-                    await delete_ids(client, peer, [n.id for n in news])
-                    news = None
+            if len(news) == len(unit):
+                st.forwarded += 1
+                return news
+            await delete_ids(client, peer, [n.id for n in news])
         except errors.ChatForwardsRestrictedError:
             st.mode = "resend"
             log.info("this channel restricts forwarding - rebuilding posts from their parts instead")
@@ -345,14 +349,30 @@ async def copy_unit(client, peer, unit: list, finals: list, st: _State) -> list:
             if type(e).__name__ in FATAL:
                 raise
             log.info("copy failed (%s) - rebuilding the post", type(e).__name__)
-        if news is not None:
-            st.forwarded += 1
-            return news
     news = await resend_unit(client, peer, unit, finals)
     st.rebuilt += 1
     return news
 
 
+async def settle_buttons(client, peer, finals: list, news: list, st: _State, *, pause: float) -> None:
+    """Read the new posts back: each must show the link buttons it should. Repairs it, or removes the copies."""
+    for f, new in zip(finals, news):
+        if not link_urls(f.markup):
+            continue
+        try:
+            how = await ensure_markup(client, peer, new.id, f.markup, pause=pause)
+        except errors.RPCError as e:
+            await delete_ids(client, peer, [n.id for n in news])
+            if type(e).__name__ in FATAL:
+                raise
+            raise ButtonsNotShown(f"could not set the buttons ({type(e).__name__})") from e
+        except (ButtonsNotShown, LookupError) as e:
+            await delete_ids(client, peer, [n.id for n in news])
+            raise ButtonsNotShown(str(e)) from e
+        if how != "fine":
+            st.repaired += 1
+
+
 @dataclass
 class RepostResult:
     copied_units: int = 0
@@ -361,6 +381,7 @@ class RepostResult:
     failed: list = field(default_factory=list)  # [(first old id, error name)]
     forwarded: int = 0
     rebuilt: int = 0
+    repaired: int = 0
     aborted: Optional[str] = None
     stopped: bool = False
     first_new: Optional[int] = None
@@ -399,6 +420,7 @@ async def run_repost(
     delay: float = 1.2,
     progress: Optional[Callable[[RepostResult], Awaitable[None]]] = None,
     should_stop: Optional[Callable[[], bool]] = None,
+    settle_pause: float = 0.7,
 ) -> RepostResult:
     """Copy the posts of migration `mig` (ids first_id..last_id) in order; safe to run again to continue."""
     opts = RepostOptions(
@@ -418,6 +440,7 @@ async def run_repost(
         finals = [final_state(m, opts) for m in unit]
         try:
             news = await copy_unit(client, peer, unit, finals, st)
+            await settle_buttons(client, peer, finals, news, st, pause=settle_pause)
         except Exception as e:  # one bad post must not stop the others
             name = type(e).__name__
             log.warning("copying %s failed: %s %s", ids, name, e)
@@ -445,7 +468,7 @@ async def run_repost(
         if progress:
             await progress(res)
         await asyncio.sleep(delay)
-    res.forwarded, res.rebuilt = st.forwarded, st.rebuilt
+    res.forwarded, res.rebuilt, res.repaired = st.forwarded, st.rebuilt, st.repaired
     return res
 
 
@@ -453,36 +476,93 @@ async def run_repost(
 @dataclass
 class DeleteResult:
     deleted: int = 0
+    by_userbot: int = 0  # of those, how many only the userbot could delete
     remaining: int = 0
-    blocked: bool = False  # Telegram removed nothing from a whole batch
-    error: Optional[str] = None
+    blocked: bool = False  # some messages are still there although Telegram did not report an error
+    error: Optional[str] = None  # the bot's Telegram error that stopped the run
+    fallback_error: Optional[str] = None  # why the userbot could not help
+    tried_userbot: bool = False
+
+
+async def gone_ids(client, peer, ids: list) -> set:
+    """Which of `ids` no longer exist in the channel."""
+    msgs = await fetch_messages(client, peer, ids)
+    return {i for i, m in zip(ids, msgs) if m is None or isinstance(m, types.MessageEmpty)}
+
+
+@dataclass
+class BatchOutcome:
+    gone: set = field(default_factory=set)  # message ids that no longer exist afterwards
+    bot_error: Optional[str] = None
+    by_userbot: int = 0
+    fallback_error: Optional[str] = None
+    tried_userbot: bool = False
+
+
+async def delete_batch(client, peer, ids: list, fallback: Optional[Callable[[list], Awaitable[Any]]] = None) -> BatchOutcome:
+    """Delete up to 100 messages: the bot tries first, the result is checked by reading the messages back, and
+    whatever is still there goes to `fallback(ids)` (the userbot), followed by a second check."""
+    out = BatchOutcome()
+    try:
+        await flood_retry(lambda: client(functions.channels.DeleteMessagesRequest(channel=peer, id=list(ids))))
+    except errors.RPCError as e:
+        out.bot_error = type(e).__name__
+    out.gone = await gone_ids(client, peer, ids)
+    left = [x for x in ids if x not in out.gone]
+    if left and fallback is not None:
+        out.tried_userbot = True
+        try:
+            await fallback(left)
+        except Exception as e:  # a userbot problem must not hide what the bot already did
+            log.warning("the userbot could not delete %s message(s): %s", len(left), e)
+            out.fallback_error = str(e) or type(e).__name__
+        again = await gone_ids(client, peer, left)
+        out.by_userbot = len(again)
+        out.gone |= again
+    return out
 
 
 async def delete_copies(
-    client, db, ch, mig, which: str, *, delay: float = 0.5, progress: Optional[Callable[[DeleteResult], Awaitable[None]]] = None
+    client,
+    db,
+    ch,
+    mig,
+    which: str,
+    *,
+    delay: float = 0.5,
+    progress: Optional[Callable[[DeleteResult], Awaitable[None]]] = None,
+    fallback: Optional[Callable[[list], Awaitable[Any]]] = None,
 ) -> DeleteResult:
-    """which='old': remove the original posts; which='new': remove the copies (undo). Oldest first, 100 per request."""
+    """which='old': remove the original posts; which='new': remove the copies (undo). Oldest first, 100 per request.
+
+    The bot tries first and the result is always checked by reading the messages back. Whatever the bot could not
+    delete (Telegram may refuse old posts) goes to `fallback(ids)` - the userbot - if there is one, and is checked
+    again. A batch the bot cannot delete does not stop the run: newer posts may still be deletable.
+    """
     peer = peer_of(ch)
     res = DeleteResult()
-    while True:
-        ids = await db.migration_pending_ids(mig.id, which, 100)
-        if not ids:
-            break
-        try:
-            await flood_retry(lambda: client(functions.channels.DeleteMessagesRequest(channel=peer, id=ids)))
-        except errors.RPCError as e:
-            res.error = type(e).__name__
-            break
-        still = await fetch_messages(client, peer, ids)
-        gone = [i for i, m in zip(ids, still) if m is None or isinstance(m, types.MessageEmpty)]
-        if not gone:
-            res.blocked = True
-            break
-        await db.mark_migration_deleted(mig.id, ch.id, which, gone)
-        res.deleted += len(gone)
+    todo = await db.migration_pending_ids(mig.id, which, 1_000_000)
+    use_fallback = fallback
+    for i in range(0, len(todo), 100):
+        ids = todo[i : i + 100]
+        out = await delete_batch(client, peer, ids, use_fallback)
+        res.tried_userbot = res.tried_userbot or out.tried_userbot
+        res.by_userbot += out.by_userbot
+        if out.fallback_error:
+            res.fallback_error = out.fallback_error
+            use_fallback = None  # it will not work for the next batches either
+        left = [x for x in ids if x not in out.gone]
+        if out.gone:
+            await db.mark_migration_deleted(mig.id, ch.id, which, sorted(out.gone))
+            res.deleted += len(out.gone)
+        if left and out.bot_error:
+            res.error = res.error or out.bot_error  # remembered for the report
+            if out.bot_error in FATAL and use_fallback is None:
+                break  # e.g. no "Delete messages" right: the next batch would fail the same way
         if progress:
             await progress(res)
         await asyncio.sleep(delay)
     counts = await db.migration_counts(mig.id)
     res.remaining = counts["old_left"] if which == "old" else counts["new_left"]
+    res.blocked = res.remaining > 0 and not res.error
     return res

app/tgutil.py

@@ -343,9 +343,14 @@ async def get_rights(client, ch):
             return True if (creator and r is None) else bool(getattr(r, name, False))
 
         return SimpleNamespace(
-            admin=True, post=has("post_messages"), edit=has("edit_messages"), delete=has("delete_messages")
+            admin=True,
+            post=has("post_messages"),
+            edit=has("edit_messages"),
+            delete=has("delete_messages"),
+            invite=has("invite_users"),
+            add_admins=has("add_admins"),
         )
-    return SimpleNamespace(admin=False, post=False, edit=False, delete=False)
+    return SimpleNamespace(admin=False, post=False, edit=False, delete=False, invite=False, add_admins=False)
 
 
 _HINTS = {
@@ -353,7 +358,10 @@ _HINTS = {
     "MessageAuthorRequiredError": "Telegram wants the message author. Give the bot the 'Edit messages of others' right.",
     "InlineBotRequiredError": "That post was sent through another bot's inline mode, so only that bot can edit it.",
     "MessageEditTimeExpiredError": "Telegram no longer allows editing that message.",
-    "MessageIdInvalidError": "That message no longer exists in the channel.",
+    "MessageIdInvalidError": (
+        "Telegram won't let the bot change that message (or it was deleted). If the post is still there, "
+        "the usual reason is that its buttons were added by another bot: only that bot may change them."
+    ),
     "ButtonUrlInvalidError": "Telegram rejected one of the button links.",
     "ReplyMarkupInvalidError": "Telegram rejected the buttons.",
     "ChatWriteForbiddenError": "The bot can't post in that channel - check its admin rights.",

app/userbot.py

@@ -0,0 +1,414 @@
+"""A userbot - a normal Telegram account - that deletes the posts the bot is not allowed to delete.
+
+Telegram's documentation says bots can only delete messages younger than 48 hours. The bot always tries first;
+whatever is left goes to the userbot:
+  1. the bot makes a one-time invite link (or reads the channel's own link) and the userbot joins with it
+     (public channels without a usable link: the userbot joins by name);
+  2. if the userbot is not allowed to delete there yet and the bot has the "Add new admins" right, the bot makes
+     the userbot an admin with only "Delete messages";
+  3. the userbot deletes, and afterwards the bot takes the admin right away again (USERBOT_KEEP_ADMIN=true keeps it).
+The session lives in USERBOT_SESSION (made on your own computer with make_userbot_session.py).
+"""
+from __future__ import annotations
+
+import asyncio
+import datetime
+import logging
+import re
+from typing import Optional
+
+from telethon import TelegramClient, errors, functions, types, utils
+from telethon.sessions import StringSession
+
+from .tgutil import flood_retry, get_rights, peer_of
+
+log = logging.getLogger(__name__)
+
+_INVITE_RX = re.compile(
+    r"(?i)(?:https?://)?(?:t\.me|telegram\.me|telegram\.dog)/(?:\+|joinchat/)([A-Za-z0-9_-]{8,})"
+    r"|tg://join\?invite=([A-Za-z0-9_-]{8,})"
+)
+
+
+class UserbotError(Exception):
+    """Something the owner can fix; the text is meant to be shown."""
+
+
+def parse_invite_hash(link: str) -> Optional[str]:
+    m = _INVITE_RX.search(link or "")
+    return (m.group(1) or m.group(2)) if m else None
+
+
+def _default_factory(cfg) -> TelegramClient:
+    return TelegramClient(StringSession(cfg.userbot_session), cfg.api_id, cfg.api_hash, receive_updates=False)
+
+
+class Userbot:
+    def __init__(self, bot_client, cfg, client_factory=None):
+        self.bot = bot_client
+        self.cfg = cfg
+        self._factory = client_factory or _default_factory
+        self.client = None
+        self.me = None
+        self.last_error: Optional[str] = None
+        self.lock = asyncio.Lock()  # one channel clean-up at a time (join / promote / delete / demote)
+
+    @property
+    def enabled(self) -> bool:
+        return bool(getattr(self.cfg, "userbot_session", ""))
+
+    @property
+    def ready(self) -> bool:
+        return self.client is not None
+
+    @property
+    def keep_admin(self) -> bool:
+        return bool(getattr(self.cfg, "userbot_keep_admin", False))
+
+    async def connect(self) -> bool:
+        """Log the userbot in. True when it is usable; otherwise the reason is in `last_error`."""
+        if not self.enabled:
+            self.last_error = "USERBOT_SESSION is not set."
+            return False
+        if self.client is not None:
+            return True
+        client = None
+        try:
+            client = self._factory(self.cfg)
+            await client.connect()
+            if not await client.is_user_authorized():
+                raise UserbotError(
+                    "The userbot session is not logged in any more (or it was revoked). "
+                    "Make a new one with make_userbot_session.py."
+                )
+            me = await client.get_me()
+            if getattr(me, "bot", False):
+                raise UserbotError("USERBOT_SESSION belongs to a bot. The userbot has to be a normal user account.")
+        except Exception as e:
+            self.last_error = str(e) if isinstance(e, UserbotError) else f"{type(e).__name__}: {str(e)[:200]}"
+            log.warning("the userbot is not available: %s", self.last_error)
+            if client is not None:
+                try:
+                    await client.disconnect()
+                except Exception:
+                    pass
+            return False
+        self.client, self.me, self.last_error = client, me, None
+        log.info("userbot logged in as %s (id %s)", getattr(me, "username", None) or getattr(me, "first_name", ""), me.id)
+        return True
+
+    async def close(self) -> None:
+        client, self.client = self.client, None
+        if client is not None:
+            try:
+                await client.disconnect()
+            except Exception:
+                pass
+
+    def describe(self) -> str:
+        if not self.enabled:
+            return "not set up (USERBOT_SESSION is empty)"
+        if self.ready:
+            name = getattr(self.me, "username", None)
+            who = f"@{name}" if name else (getattr(self.me, "first_name", "") or "the account")
+            return f"connected as {who} (id {self.me.id})"
+        return f"set up, but not connected: {self.last_error or 'unknown reason'}"
+
+    def deleter(self, ch) -> "UserbotDeleter":
+        return UserbotDeleter(self, ch)
+
+    async def fallback_for(self, ch):
+        """(delete function, deleter) to hand to the delete step, or (None, None) when no userbot is usable.
+
+        Nothing happens in the channel until the bot has failed to delete something and the function is called;
+        the caller must always `await deleter.close()` afterwards.
+        """
+        if not self.enabled:
+            return None, None
+        if not self.ready:
+            await self.connect()
+        if not self.ready:
+            return None, None
+        d = self.deleter(ch)
+        return d.delete, d
+
+
+class UserbotDeleter:
+    """Everything needed to delete in ONE channel with the userbot. Call close() when done, whatever happened."""
+
+    def __init__(self, ub: Userbot, ch):
+        self.ub = ub
+        self.ch = ch
+        self.peer = None  # the channel as the userbot sees it
+        self.notes: list = []
+        self._ready = False
+        self._holds_lock = False
+        self._promoted = False
+        self._bot_user = None  # the userbot account as the bot sees it (InputUser)
+        self._link: Optional[str] = None  # the temporary invite link we made
+
+    # ------------------------------------------------------------------ public
+    async def delete(self, ids: list) -> None:
+        if not self.ub.ready:
+            raise UserbotError(f"The userbot is not connected: {self.ub.last_error or 'unknown reason'}")
+        if not self._ready:
+            if not self._holds_lock:  # released again in close()
+                await self.ub.lock.acquire()
+                self._holds_lock = True
+            await self._prepare()
+            self._ready = True
+        client = self.ub.client
+        for i in range(0, len(ids), 100):
+            part = list(ids[i : i + 100])
+            await flood_retry(
+                lambda part=part: client(functions.channels.DeleteMessagesRequest(channel=self.peer, id=part))
+            )
+
+    async def close(self) -> None:
+        """Undo what this clean-up changed: take the admin right away again, revoke the temporary link."""
+        bot, ch = self.ub.bot, self.ch
+        try:
+            if self._promoted and self._bot_user is not None and not self.ub.keep_admin:
+                try:
+                    await bot(
+                        functions.channels.EditAdminRequest(
+                            channel=peer_of(ch), user_id=self._bot_user, admin_rights=types.ChatAdminRights(), rank=""
+                        )
+                    )
+                    self.notes.append("took the admin right away from the userbot again")
+                except Exception as e:
+                    log.warning("could not demote the userbot in %s: %s", ch.id, type(e).__name__)
+                    self.notes.append("could not take the admin right away from the userbot - please do it by hand")
+            if self._link:
+                try:
+                    await bot(
+                        functions.messages.EditExportedChatInviteRequest(peer=peer_of(ch), link=self._link, revoked=True)
+                    )
+                except Exception as e:
+                    log.info("could not revoke the temporary invite link: %s", type(e).__name__)
+        finally:
+            self._promoted, self._link = False, None
+            if self._holds_lock:
+                self._holds_lock = False
+                self.ub.lock.release()
+
+    # ----------------------------------------------------------------- prepare
+    async def _prepare(self) -> None:
+        peer = await self._member_peer()
+        if peer is None:
+            peer = await self._join()
+        self.peer = peer
+        await self._ensure_delete_right()
+
+    async def _member_peer(self):
+        """The channel as the userbot sees it, if the userbot is in it already."""
+        ub = self.ub.client
+        try:
+            peer = await ub.get_input_entity(types.PeerChannel(self.ch.id))
+            if not isinstance(peer, types.InputPeerChannel):
+                return None
+            await ub(functions.channels.GetParticipantRequest(peer, types.InputPeerSelf()))
+        except (errors.RPCError, ValueError, TypeError):
+            return None
+        return peer
+
+    async def _invite_link(self) -> Optional[str]:
+        bot, peer = self.ub.bot, peer_of(self.ch)
+        try:
+            expires = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(hours=1)
+            res = await bot(
+                functions.messages.ExportChatInviteRequest(peer=peer, expire_date=expires, usage_limit=1, title="Cleanup helper")
+            )
+            link = getattr(res, "link", None)
+            if link:
+                self._link = link
+                self.notes.append("made a one-time invite link for the userbot")
+                return link
+        except errors.RPCError as e:
+            log.info("could not create an invite link in %s: %s", self.ch.id, type(e).__name__)
+        try:
+            full = await bot(functions.channels.GetFullChannelRequest(peer))
+            link = getattr(getattr(full.full_chat, "exported_invite", None), "link", None)
+            if link:
+                self.notes.append("used the channel's own invite link")
+                return link
+        except errors.RPCError as e:
+            log.info("could not read the invite link of %s: %s", self.ch.id, type(e).__name__)
+        return None
+
+    async def _join(self):
+        link = await self._invite_link()
+        h = parse_invite_hash(link) if link else None
+        if h:
+            peer = await self._import_invite(h)
+            if peer is not None:
+                self.notes.append("the userbot joined the channel")
+                return peer
+        if self.ch.username:
+            peer = await self._join_public(self.ch.username)
+            self.notes.append("the userbot joined the channel by its public name")
+            return peer
+        raise UserbotError(
+            "I could not get the userbot into this private channel: Telegram gave me no invite link. "
+            "Give the bot the “Invite users via link” admin right, or add the userbot to the channel yourself "
+            "(with the “Delete messages” admin right)."
+        )
+
+    async def _import_invite(self, h: str):
+        ub = self.ub.client
+        try:
+            res = await flood_retry(lambda: ub(functions.messages.ImportChatInviteRequest(h)))
+        except errors.UserAlreadyParticipantError:
+            return await self._peer_when_already_in(h)
+        except errors.InviteRequestSentError:
+            raise UserbotError(
+                "This channel's invite link needs an admin to approve new members. Approve the userbot's join request "
+                "(or add the userbot yourself) and try again."
+            )
+        except (errors.InviteHashExpiredError, errors.InviteHashInvalidError, errors.InviteHashEmptyError):
+            return None
+        except (errors.ChannelsTooMuchError, errors.UserChannelsTooMuchError):
+            raise UserbotError("The userbot account is in too many channels. Leave a few with that account and try again.")
+        except errors.UserBannedInChannelError:
+            raise UserbotError("The userbot account is banned in this channel. Unban it first.")
+        return self._peer_from_updates(res)
+
+    def _peer_from_updates(self, res):
+        chats = [c for c in (getattr(res, "chats", None) or []) if isinstance(c, types.Channel)]
+        for c in chats:
+            if c.id == self.ch.id:
+                return utils.get_input_peer(c)
+        if len(chats) == 1:
+            return utils.get_input_peer(chats[0])
+        raise UserbotError("The userbot joined, but Telegram did not tell me which channel it is. Try again.")
+
+    async def _peer_when_already_in(self, h: str):
+        ub = self.ub.client
+        try:
+            info = await ub(functions.messages.CheckChatInviteRequest(h))
+            if isinstance(info, types.ChatInviteAlready):
+                return utils.get_input_peer(info.chat)
+        except errors.RPCError:
+            pass
+        async for d in ub.iter_dialogs():
+            if getattr(d.entity, "id", None) == self.ch.id and isinstance(d.entity, types.Channel):
+                return utils.get_input_peer(d.entity)
+        raise UserbotError("The userbot is in the channel, but I could not find it in its chat list.")
+
+    async def _join_public(self, username: str):
+        ub = self.ub.client
+        try:
+            peer = await ub.get_input_entity(username)
+            try:
+                await flood_retry(lambda: ub(functions.channels.JoinChannelRequest(peer)))
+            except errors.UserAlreadyParticipantError:
+                pass
+        except (errors.ChannelsTooMuchError, errors.UserChannelsTooMuchError):
+            raise UserbotError("The userbot account is in too many channels. Leave a few with that account and try again.")
+        except errors.UserBannedInChannelError:
+            raise UserbotError("The userbot account is banned in this channel. Unban it first.")
+        except (errors.UsernameNotOccupiedError, errors.UsernameInvalidError, errors.ChannelPrivateError):
+            raise UserbotError(f"The userbot could not open @{username}. Has the channel's name changed?")
+        return peer
+
+    # ------------------------------------------------------------------ rights
+    async def _userbot_can_delete(self) -> bool:
+        try:
+            res = await self.ub.client(functions.channels.GetParticipantRequest(self.peer, types.InputPeerSelf()))
+        except errors.RPCError:
+            return False
+        p = res.participant
+        if isinstance(p, types.ChannelParticipantCreator):
+            return True
+        if isinstance(p, types.ChannelParticipantAdmin):
+            return bool(getattr(p.admin_rights, "delete_messages", False))
+        return False
+
+    async def _ensure_delete_right(self) -> None:
+        if await self._userbot_can_delete():
+            return
+        rights = await get_rights(self.ub.bot, self.ch)
+        if rights is None or not (rights.admin and rights.add_admins):
+            raise UserbotError(
+                "The userbot is in the channel but may not delete messages there, and the bot may not add admins. "
+                "Give the bot the “Add new admins” right (it then promotes the userbot by itself), or make the userbot "
+                "an admin with “Delete messages” yourself."
+            )
+        user = await self._bot_view_of_userbot()
+        try:
+            await self.ub.bot(
+                functions.channels.EditAdminRequest(
+                    channel=peer_of(self.ch),
+                    user_id=user,
+                    admin_rights=types.ChatAdminRights(delete_messages=True),
+                    rank="",
+                )
+            )
+        except errors.RPCError as e:
+            name = type(e).__name__
+            hint = {
+                "RightForbiddenError": "The bot may not give that right.",
+                "UserAdminInvalidError": "The bot may not change that user's admin status.",
+                "AdminsTooMuchError": "The channel already has the maximum number of admins.",
+                "ChatAdminRequiredError": "The bot needs the “Add new admins” right.",
+            }.get(name, str(e)[:150])
+            raise UserbotError(f"I could not make the userbot an admin ({name}). {hint}")
+        self._promoted, self._bot_user = True, user
+        self.notes.append("made the userbot an admin with only “Delete messages”")
+        for _ in range(12):  # the new right can take a moment to show up for the other account
+            if await self._userbot_can_delete():
+                return
+            await asyncio.sleep(0.5)
+        raise UserbotError("I made the userbot an admin, but Telegram still does not let it delete there. Check its rights.")
+
+    async def _bot_view_of_userbot(self):
+        """The userbot account as an InputUser the BOT can use (needs the bot's own access hash for that user)."""
+        bot, me = self.ub.bot, self.ub.me
+        uid = me.id
+        try:
+            ent = await bot.get_input_entity(uid)
+            if isinstance(ent, types.InputPeerUser):
+                return types.InputUser(ent.user_id, ent.access_hash)
+        except Exception:
+            pass
+        queries = [types.ChannelParticipantsRecent()]
+        for q in (getattr(me, "username", None), getattr(me, "first_name", None)):
+            if q:
+                queries.append(types.ChannelParticipantsSearch(q))
+        for flt in queries:
+            try:
+                res = await bot(
+                    functions.channels.GetParticipantsRequest(channel=peer_of(self.ch), filter=flt, offset=0, limit=200, hash=0)
+                )
+            except errors.RPCError:
+                continue
+            for u in getattr(res, "users", None) or []:
+                if getattr(u, "id", None) == uid and getattr(u, "access_hash", None) is not None:
+                    return types.InputUser(u.id, u.access_hash)
+        if getattr(me, "username", None):
+            try:
+                ent = await bot.get_input_entity(me.username)
+                if isinstance(ent, types.InputPeerUser):
+                    return types.InputUser(ent.user_id, ent.access_hash)
+            except Exception:
+                pass
+        raise UserbotError(
+            "The userbot joined, but the bot cannot find that account in the channel's member list, so it cannot "
+            "promote it. Make the userbot an admin with “Delete messages” yourself."
+        )
+
+
+def delete_problem_text(ub, *, bot_error: Optional[str] = None, fallback_error: Optional[str] = None, tried: bool = False) -> str:
+    """Why some messages could not be deleted, in words for the owner."""
+    parts = []
+    if bot_error:
+        parts.append(f"Telegram refused the bot ({bot_error}).")
+    if fallback_error:
+        parts.append(f"The userbot could not help: {fallback_error}")
+    elif tried:
+        parts.append("The userbot tried as well, but the posts are still there.")
+    elif ub is None or not getattr(ub, "enabled", False):
+        parts.append("Posts older than 48 hours may need a userbot - see /userbot.")
+    elif not ub.ready:
+        parts.append(f"The userbot is not connected: {ub.last_error or 'unknown reason'}")
+    return " ".join(parts) or "Telegram did not delete them (the bot's “Delete messages” right, or an age limit on old posts)."

bot.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import asyncio
 import logging
 import os
+from urllib.parse import unquote, urlsplit
 
 from telethon import TelegramClient, functions, types
 from telethon.sessions import StringSession
@@ -11,8 +12,10 @@ from telethon.sessions import StringSession
 from app.common import Ctx
 from app.config import Config, load_config
 from app.db import Database
-from app.handlers import basic, channels, create, posts, replace, repost
+from app.errorlog import ErrorReporter, TelegramLogHandler
+from app.handlers import basic, channels, checkbtn, create, posts, replace, repost
 from app.health import start_health_server
+from app.userbot import Userbot
 
 log = logging.getLogger("bot")
 
@@ -24,8 +27,8 @@ COMMANDS = [
     ("replace", "Swap a username in links (owner)"),
     ("repost", "Copy a whole channel in order (owner)"),
     ("undo", "Undo the last replace (owner)"),
-    ("testedit", "Test editing one post (owner)"),
-    ("selftest", "Test editing the bot's own post (owner)"),
+    ("userbot", "Status of the helper account that deletes old posts (owner)"),
+    ("testerror", "Send a test error to the log chat (owner)"),
     ("export", "Backup as JSON (owner)"),
     ("cancel", "Cancel what I'm doing"),
     ("help", "Show help"),
@@ -44,7 +47,7 @@ def build_client(cfg: Config) -> TelegramClient:
 
 
 def register_all(ctx: Ctx) -> None:
-    for module in (basic, channels, create, posts, replace, repost):
+    for module in (basic, channels, create, posts, checkbtn, replace, repost):
         module.register(ctx)
 
 
@@ -61,26 +64,61 @@ async def set_commands(client: TelegramClient) -> None:
         log.warning("could not set the command menu: %s", e)
 
 
+def secrets_of(cfg: Config) -> list:
+    """Texts that must never appear in the error log."""
+    out = [cfg.bot_token, cfg.api_hash, cfg.session_string, cfg.userbot_session]
+    try:
+        parts = urlsplit(cfg.database_url)
+        if parts.password:
+            out += [parts.password, unquote(parts.password)]
+    except Exception:
+        pass
+    return [s for s in out if s]
+
+
 async def main() -> None:
     cfg = load_config()
     logging.basicConfig(level=cfg.log_level, format="%(asctime)s %(levelname)s %(name)s: %(message)s")
     logging.getLogger("telethon").setLevel(logging.WARNING)
 
-    db = Database(cfg.database_url, cfg.db_pool)
-    await db.init()
     client = build_client(cfg)
-    ctx = Ctx(cfg=cfg, db=db, client=client)
-    register_all(ctx)
+    reporter = ErrorReporter(client, cfg.error_log_chat_id, bot_token=cfg.bot_token, secrets=secrets_of(cfg))
+    reporter.start()
+    logging.getLogger().addHandler(TelegramLogHandler(reporter))
+    asyncio.get_running_loop().set_exception_handler(reporter.loop_exception_handler)
+
+    db = None
+    userbot = Userbot(client, cfg)
     try:
+        db = Database(cfg.database_url, cfg.db_pool)
+        await db.init()
+        ctx = Ctx(cfg=cfg, db=db, client=client, userbot=userbot, reporter=reporter)
+        register_all(ctx)
         await client.start(bot_token=cfg.bot_token)
         me = await client.get_me()
         log.info("Logged in as @%s (owners: %s)", me.username, ", ".join(map(str, sorted(cfg.owners))))
         await set_commands(client)
         if cfg.port:
             await start_health_server(cfg.port)
+        problem = await reporter.check()
+        if reporter.enabled:
+            if problem:
+                log.warning("errors cannot be sent to chat %s yet: %s", cfg.error_log_chat_id, problem)
+            else:
+                log.info("errors are sent to chat %s", cfg.error_log_chat_id)
+        else:
+            log.info("error log chat: off")
+        if userbot.enabled:
+            await userbot.connect()  # never fatal: the userbot is only needed for old posts
         await client.run_until_disconnected()
+    except Exception as e:
+        await reporter.report_fatal("The bot stopped because of an unhandled exception", e)
+        raise
     finally:
-        await db.close()
+        await userbot.close()
+        if db is not None:
+            await db.close()
+        await reporter.stop()
 
 
 if __name__ == "__main__":

make_userbot_session.py

@@ -0,0 +1,28 @@
+"""Makes the USERBOT_SESSION text. Run it on YOUR OWN computer, never on the server:
+
+    pip install telethon
+    python make_userbot_session.py
+
+It asks for the phone number of the account, the login code Telegram sends to that account and, if the account has
+one, its two-step password. Then it prints  USERBOT_SESSION=...  - put that line into the bot's secrets.
+
+Use a separate Telegram account for this, not your main one: whoever has the session text can act as that account.
+"""
+import asyncio
+import os
+
+from telethon import TelegramClient
+from telethon.sessions import StringSession
+
+
+async def main() -> None:
+    api_id = int(os.getenv("API_ID") or input("API_ID (from my.telegram.org): ").strip())
+    api_hash = os.getenv("API_HASH") or input("API_HASH: ").strip()
+    async with TelegramClient(StringSession(), api_id, api_hash) as client:  # prompts for phone, code, password
+        me = await client.get_me()
+        print(f"\nLogged in as {me.first_name} (id {me.id}).")
+        print("\nUSERBOT_SESSION=" + client.session.save())
+        print("\nKeep this text secret. Telegram > Settings > Devices shows the session; end it there to cancel it.")
+
+
+asyncio.run(main())

requirements-dev.txt

@@ -1,3 +1,4 @@
 -r requirements.txt
 pytest>=8
 pyflakes
+pyyaml

tests/fakes.py

@@ -8,7 +8,7 @@ from telethon.tl.custom import Message
 from app.tgutil import make_url_button
 
 
-def make_msg(i, text="", entities=None, markup=None, out=False, media=None):
+def make_msg(i, text="", entities=None, markup=None, out=False, media=None, grouped_id=None):
     return Message(
         id=i,
         peer_id=types.PeerChannel(1),
@@ -18,6 +18,7 @@ def make_msg(i, text="", entities=None, markup=None, out=False, media=None):
         entities=entities,
         reply_markup=markup,
         media=media,
+        grouped_id=grouped_id,
     )
 
 
@@ -63,3 +64,398 @@ class FakeClient:
 
 def rpc(name):
     return getattr(errors, name)(request=None)
+
+
+# ======================================================================================================
+# A fake Telegram "channel": enough of the API for the repost / delete / buttons / userbot code, offline.
+# ======================================================================================================
+NOW = datetime.datetime.now(datetime.timezone.utc)
+USER_HASH = 424242  # the channel's access hash as the userbot account sees it (differs from the bot's)
+
+
+def photo_media(pid=11):
+    photo = types.Photo(pid, pid * 7, b"ref%d" % pid, NOW, [types.PhotoSize("x", 100, 100, 999)], 2)
+    return types.MessageMediaPhoto(photo=photo)
+
+
+def video_media(did=21):
+    doc = types.Document(did, did * 7, b"fr%d" % did, NOW, "video/mp4", 1000, 2, [types.DocumentAttributeVideo(5.0, 320, 240)])
+    return types.MessageMediaDocument(document=doc)
+
+
+def service_msg(i):
+    return types.MessageService(id=i, peer_id=types.PeerChannel(1), date=NOW, action=types.MessageActionPinMessage())
+
+
+def quote(offset, length, collapsed=None):
+    return types.MessageEntityBlockquote(offset, length, collapsed)
+
+
+def _bytes(obj):
+    return bytes(obj) if obj is not None else None
+
+
+def _empty_rights(r):
+    return not any(v for k, v in r.to_dict().items() if k != "_")
+
+
+class FakeChannelClient:
+    """Telegram's side of ONE channel (peer id 1) as seen by the bot, with switches for the odd things Telegram does."""
+
+    def __init__(self, msgs=None, *, username=None):
+        self.msgs = dict(msgs or {})
+        self.username = username
+        self.requests = []  # every request received, in order
+        self.edits = []  # EditMessageRequests Telegram accepted
+        self.delete_requests = []  # the id lists of channels.deleteMessages calls
+        self._top = max(self.msgs, default=0)
+        self._gid = 7000
+        self._media = {}
+        for m in self.msgs.values():
+            self._remember_media(m)
+        # --- switches
+        self.restrict_forwards = False  # "Restrict saving content" is on
+        self.hide_keyboard_on_create = 0  # the next N created posts show no keyboard until a real change (suspected bug)
+        self.forward_hides_keyboard = False  # a forwarded copy keeps its keyboard "hidden": edits to the same keyboard are no-ops
+        self.drop_all_markup = False  # Telegram never shows a keyboard (to test giving up)
+        self.undeletable = set()  # ids the BOT may not delete (like posts older than 48 hours)
+        self.delete_error = None  # raised by every delete request of the bot
+        self.fail = {}  # request class name -> exception to raise
+        self.rights = dict(admin=True, post=True, edit=True, delete=True, invite=False, add_admins=False)
+        self.participants_visible = True
+        self.known_users = {}  # user id -> types.User the bot has "met"
+        self.members = set()  # user ids (other than the bot) that are in the channel
+        self.admins = {}  # user id -> ChatAdminRights
+        self.invites = {}  # hash -> dict(limit, uses, revoked)
+        self.primary_invite = None  # the channel's own invite link
+        self.require_approval = False
+        self.users = {}  # user id -> types.User, for participant lists
+        self.cant_delete_at_all = set()  # ids nobody can delete (userbot included)
+        self._n_invites = 0
+
+    # ----------------------------------------------------------------------------------- helpers
+    def _remember_media(self, m):
+        md = getattr(m, "media", None)
+        if isinstance(md, types.MessageMediaPhoto) and md.photo:
+            self._media[("photo", md.photo.id)] = md
+        elif isinstance(md, types.MessageMediaDocument) and md.document:
+            self._media[("doc", md.document.id)] = md
+
+    def _media_for(self, inp):
+        if isinstance(inp, types.InputMediaPhoto):
+            key = ("photo", inp.id.id)
+        elif isinstance(inp, types.InputMediaDocument):
+            key = ("doc", inp.id.id)
+        else:
+            raise rpc("MediaInvalidError")
+        if key not in self._media:
+            raise rpc("MediaEmptyError")
+        return self._media[key]
+
+    def _effective(self, m):
+        hidden = getattr(m, "_hidden", None)
+        return hidden if hidden is not None else m.reply_markup
+
+    def _set_markup(self, m, markup, *, hide=False):
+        if markup is not None and (hide or self.drop_all_markup):
+            m._hidden, m.reply_markup = markup, None
+        else:
+            m._hidden, m.reply_markup = None, markup
+
+    def _new(self, text, entities, markup, media=None, gid=None, invert=None, hide=False):
+        self._top += 1
+        m = Message(
+            id=self._top,
+            peer_id=types.PeerChannel(1),
+            date=NOW,
+            message=text,
+            out=True,
+            entities=list(entities) if entities else None,
+            media=media,
+            grouped_id=gid,
+            invert_media=invert,
+        )
+        if self.hide_keyboard_on_create > 0 and markup is not None:
+            hide = True
+            self.hide_keyboard_on_create -= 1
+        self._set_markup(m, markup, hide=hide)
+        self.msgs[m.id] = m
+        self._remember_media(m)
+        return m
+
+    def _updates(self, msgs):
+        return types.Updates(
+            updates=[types.UpdateNewChannelMessage(message=m, pts=m.id, pts_count=1) for m in msgs],
+            users=[],
+            chats=[],
+            date=NOW,
+            seq=0,
+        )
+
+    def _channel_obj(self):
+        return types.Channel(
+            id=1, title="Test", photo=types.ChatPhotoEmpty(), date=NOW, access_hash=USER_HASH, username=self.username, broadcast=True
+        )
+
+    # --------------------------------------------------------------------------------- dispatcher
+    async def __call__(self, req):
+        bytes(req)  # every request the bot builds must serialise
+        self.requests.append(req)
+        name = type(req).__name__
+        err = self.fail.get(name)
+        if err is not None:
+            raise err
+        handler = getattr(self, "_do_" + name, None)
+        if handler is None:
+            raise NotImplementedError(name)
+        return handler(req)
+
+    async def get_messages(self, peer, ids=None):
+        return [self.msgs.get(i) for i in ids]
+
+    async def get_input_entity(self, peer):
+        if isinstance(peer, int) and peer in self.known_users:
+            u = self.known_users[peer]
+            return types.InputPeerUser(u.id, u.access_hash)
+        raise ValueError(f"Could not find the input entity for {peer!r}")
+
+    # ------------------------------------------------------------------------- message requests
+    def _do_GetMessagesRequest(self, req):
+        """channels.getMessages as Telegram answers it: the posts as they are now, MessageEmpty for missing ones.
+        (Used when a real Telethon client sits in front of this simulation; get_messages() above serves the plain fakes.)"""
+        out = []
+        for ref in req.id:
+            m = self.msgs.get(ref.id)
+            if m is None:
+                out.append(types.MessageEmpty(id=ref.id, peer_id=types.PeerChannel(1)))
+            elif isinstance(m, (types.MessageService, types.MessageEmpty)):
+                out.append(m)
+            else:
+                out.append(
+                    types.Message(
+                        id=m.id, peer_id=m.peer_id, date=m.date, message=m.message, out=m.out, entities=m.entities,
+                        reply_markup=m.reply_markup, media=m.media, grouped_id=m.grouped_id,
+                        invert_media=getattr(m, "invert_media", None),
+                    )
+                )
+        return types.messages.ChannelMessages(
+            pts=self._top, count=len(out), messages=out, topics=[], chats=[self._channel_obj()], users=[]
+        )
+
+    def _do_ForwardMessagesRequest(self, req):
+        if self.restrict_forwards:
+            raise rpc("ChatForwardsRestrictedError")
+        out, gids = [], {}
+        for i in req.id:
+            src = self.msgs.get(i)
+            if src is None:
+                continue
+            gid = gids.setdefault(src.grouped_id, self._next_gid()) if src.grouped_id else None
+            out.append(
+                self._new(
+                    src.message, src.entities, src.reply_markup, src.media, gid, getattr(src, "invert_media", None),
+                    hide=self.forward_hides_keyboard,
+                )
+            )
+        if not out:
+            raise rpc("MessageIdInvalidError")
+        return self._updates(out)
+
+    def _next_gid(self):
+        self._gid += 1
+        return self._gid
+
+    def _do_SendMessageRequest(self, req):
+        return self._updates([self._new(req.message, req.entities, req.reply_markup, None, None, req.invert_media)])
+
+    def _do_SendMediaRequest(self, req):
+        media = self._media_for(req.media)
+        return self._updates([self._new(req.message, req.entities, req.reply_markup, media, None, req.invert_media)])
+
+    def _do_SendMultiMediaRequest(self, req):
+        gid = self._next_gid()
+        out = [self._new(s.message, s.entities, None, self._media_for(s.media), gid, req.invert_media) for s in req.multi_media]
+        return self._updates(out)
+
+    def _do_EditMessageRequest(self, req):
+        m = self.msgs.get(req.id)
+        if m is None:
+            raise rpc("MessageIdInvalidError")
+        if req.message is None:  # markup-only edit
+            text, ents = m.message, list(m.entities or [])
+            markup = req.reply_markup if req.reply_markup is not None else self._effective(m)
+        else:
+            text, ents, markup = req.message, list(req.entities or []), req.reply_markup  # None = keyboard removed
+        if (
+            text == m.message
+            and [_bytes(e) for e in ents] == [_bytes(e) for e in (m.entities or [])]
+            and _bytes(markup) == _bytes(self._effective(m))
+        ):
+            raise rpc("MessageNotModifiedError")
+        m.message, m.entities = text, (ents or None)
+        self._set_markup(m, markup)
+        self.edits.append(req)
+        return self._updates([])
+
+    def _do_DeleteMessagesRequest(self, req):
+        ids = list(req.id)
+        self.delete_requests.append(ids)
+        if self.delete_error is not None:
+            raise self.delete_error
+        n = 0
+        for i in ids:
+            if i in self.undeletable or i in self.cant_delete_at_all or i not in self.msgs:
+                continue
+            del self.msgs[i]
+            n += 1
+        return types.messages.AffectedMessages(pts=self._top, pts_count=n)
+
+    # ------------------------------------------------------------------------ channel / rights
+    def _do_GetFullChannelRequest(self, req):
+        inv = types.ChatInviteExported(link=self.primary_invite, admin_id=1, date=NOW) if self.primary_invite else None
+        return SimpleNamespace(full_chat=SimpleNamespace(pts=self._top, exported_invite=inv))
+
+    def _do_GetParticipantRequest(self, req):
+        r = self.rights
+        if r is None:
+            raise rpc("UserNotParticipantError")
+        if not r.get("admin", True):
+            return SimpleNamespace(participant=types.ChannelParticipant(user_id=1, date=NOW))
+        rights = types.ChatAdminRights(
+            post_messages=r.get("post"), edit_messages=r.get("edit"), delete_messages=r.get("delete"),
+            invite_users=r.get("invite"), add_admins=r.get("add_admins"),
+        )
+        return SimpleNamespace(participant=types.ChannelParticipantAdmin(user_id=1, promoted_by=1, date=NOW, admin_rights=rights))
+
+    def _do_ExportChatInviteRequest(self, req):
+        if not self.rights.get("invite"):
+            raise rpc("ChatAdminRequiredError")
+        self._n_invites += 1
+        h = f"AbCdEfGh{self._n_invites:04d}"
+        self.invites[h] = dict(limit=req.usage_limit, uses=0, revoked=False, title=req.title, expire=req.expire_date)
+        return types.ChatInviteExported(
+            link=f"https://t.me/+{h}", admin_id=1, date=NOW, usage_limit=req.usage_limit, expire_date=req.expire_date, title=req.title
+        )
+
+    def _do_EditExportedChatInviteRequest(self, req):
+        h = req.link.rsplit("+", 1)[-1]
+        if h in self.invites and req.revoked:
+            self.invites[h]["revoked"] = True
+        return SimpleNamespace(invite=None)
+
+    def _do_EditAdminRequest(self, req):
+        if not self.rights.get("add_admins"):
+            raise rpc("ChatAdminRequiredError")
+        uid = req.user_id.user_id
+        known = self.users.get(uid)
+        if known is None or req.user_id.access_hash != known.access_hash:
+            raise rpc("UserIdInvalidError")
+        if _empty_rights(req.admin_rights):
+            self.admins.pop(uid, None)
+        else:
+            self.admins[uid] = req.admin_rights
+        return self._updates([])
+
+    def _do_GetParticipantsRequest(self, req):
+        if not self.participants_visible:
+            raise rpc("ChatAdminRequiredError")
+        users = [self.users[u] for u in sorted(self.members) if u in self.users]
+        if isinstance(req.filter, types.ChannelParticipantsSearch):
+            q = req.filter.q.lower()
+            users = [u for u in users if q in (u.username or "").lower() or q in (u.first_name or "").lower()]
+        return types.channels.ChannelParticipants(count=len(users), participants=[], chats=[], users=users)
+
+
+class FakeUserClient:
+    """The userbot account's own Telegram connection, sharing one FakeChannelClient with the bot."""
+
+    def __init__(self, chan, *, user_id=777, authorized=True, bot=False, username="helper_acct", first_name="Helper"):
+        self.chan = chan
+        self.me = types.User(id=user_id, access_hash=555, first_name=first_name, username=username, bot=bot or None)
+        chan.users[user_id] = self.me
+        self.authorized = authorized
+        self.connected = False
+        self.known_channel = False
+        self.requests = []
+        self.deleted = []
+
+    async def connect(self):
+        self.connected = True
+
+    async def disconnect(self):
+        self.connected = False
+
+    async def is_user_authorized(self):
+        return self.authorized
+
+    async def get_me(self):
+        return self.me
+
+    async def get_input_entity(self, peer):
+        if isinstance(peer, types.PeerChannel) and self.known_channel:
+            return types.InputPeerChannel(peer.channel_id, USER_HASH)
+        if isinstance(peer, str) and self.chan.username and peer.lstrip("@").lower() == self.chan.username.lower():
+            return types.InputPeerChannel(1, USER_HASH)
+        raise ValueError(f"Could not find the input entity for {peer!r}")
+
+    async def iter_dialogs(self):
+        if self.known_channel and self.me.id in self.chan.members:
+            yield SimpleNamespace(entity=self.chan._channel_obj())
+
+    def _join(self):
+        self.chan.members.add(self.me.id)
+        self.known_channel = True
+
+    async def __call__(self, req):
+        bytes(req)
+        self.requests.append(req)
+        name = type(req).__name__
+        chan = self.chan
+        err = chan.fail.get("user:" + name)
+        if err is not None:
+            raise err
+        uid = self.me.id
+        if name == "ImportChatInviteRequest":
+            inv = chan.invites.get(req.hash)
+            if inv is None:
+                raise rpc("InviteHashInvalidError")
+            if inv["revoked"] or (inv["limit"] and inv["uses"] >= inv["limit"]):
+                raise rpc("InviteHashExpiredError")
+            if uid in chan.members:
+                raise rpc("UserAlreadyParticipantError")
+            if chan.require_approval:
+                raise rpc("InviteRequestSentError")
+            inv["uses"] += 1
+            self._join()
+            return types.Updates(updates=[], users=[], chats=[chan._channel_obj()], date=NOW, seq=0)
+        if name == "CheckChatInviteRequest":
+            if uid in chan.members:
+                return types.ChatInviteAlready(chat=chan._channel_obj())
+            return types.ChatInvite(title="Test", photo=types.PhotoEmpty(0), participants_count=1, color=0)
+        if name == "JoinChannelRequest":
+            if uid in chan.members:
+                raise rpc("UserAlreadyParticipantError")
+            self._join()
+            return types.Updates(updates=[], users=[], chats=[chan._channel_obj()], date=NOW, seq=0)
+        if name == "GetParticipantRequest":
+            if uid not in chan.members:
+                raise rpc("UserNotParticipantError")
+            if uid in chan.admins:
+                return SimpleNamespace(
+                    participant=types.ChannelParticipantAdmin(user_id=uid, promoted_by=1, date=NOW, admin_rights=chan.admins[uid])
+                )
+            return SimpleNamespace(participant=types.ChannelParticipant(user_id=uid, date=NOW))
+        if name == "DeleteMessagesRequest":
+            ids = list(req.id)
+            self.deleted.append(ids)
+            adm = chan.admins.get(uid)
+            if adm is None or not adm.delete_messages:
+                raise rpc("ChatAdminRequiredError")
+            n = 0
+            for i in ids:
+                if i in chan.msgs and i not in chan.cant_delete_at_all:
+                    del chan.msgs[i]
+                    n += 1
+            return types.messages.AffectedMessages(pts=chan._top, pts_count=n)
+        raise NotImplementedError(name)
+

tests/harness.py

@@ -1,5 +1,4 @@
 """Drive the real handlers with fake events and a fake Telegram client (no network)."""
-import datetime
 import itertools
 import re
 from types import SimpleNamespace
@@ -13,6 +12,7 @@ from app.db import Database
 from bot import register_all
 
 from .dbutil import db_url_for
+from .fakes import FakeChannelClient
 
 
 class FakeSent:
@@ -80,14 +80,18 @@ class Outbox:
         raise AssertionError(f"no button {label_part!r} in {self.last_buttons()}")
 
 
-class FakeTG:
+class FakeTG(FakeChannelClient):
+    """The bot's Telegram connection: a simulated channel plus a log of what the bot sent to the user."""
+
     def __init__(self):
+        super().__init__()
         self.handlers = []
         self.sent = []
         self.edits = []
         self.deleted = []
         self.ids = itertools.count(100)
         self.parse_mode = "html"
+        self.rights = dict(admin=True, post=True, edit=True, delete=True, invite=False, add_admins=False)
 
     def on(self, builder):
         def deco(fn):
@@ -116,19 +120,20 @@ class FakeTG:
     async def __call__(self, req):
         if isinstance(req, functions.messages.EditMessageRequest):
             self.edits.append(("raw", req.id, req))
-            return None
-        if isinstance(req, functions.channels.GetParticipantRequest):
-            rights = types.ChatAdminRights(post_messages=True, edit_messages=True, delete_messages=True)
-            return SimpleNamespace(participant=types.ChannelParticipantAdmin(
-                user_id=1, promoted_by=1, date=datetime.datetime.now(datetime.timezone.utc), admin_rights=rights))
-        raise NotImplementedError(type(req))
+            if req.id not in self.msgs:  # a post the simulation doesn't hold: just note the edit
+                return None
+        if isinstance(req, functions.channels.DeleteMessagesRequest):
+            self.deleted.append(list(req.id))
+        return await super().__call__(req)
 
 
 class App:
-    def __init__(self, tmp_path, owner=1):
-        cfg = Config(api_id=1, api_hash="x", bot_token="1:x", owners=frozenset({owner}), admins=frozenset(),
-                     database_url=db_url_for(tmp_path, "h.db"), db_pool="null", session_path="x", session_string="",
-                     edit_delay=0.3, replace_typed_links=True, port=0, log_level="INFO")
+    def __init__(self, tmp_path, owner=1, **cfg_overrides):
+        base = dict(api_id=1, api_hash="x", bot_token="1:x", owners=frozenset({owner}), admins=frozenset(),
+                    database_url=db_url_for(tmp_path, "h.db"), db_pool="null", session_path="x", session_string="",
+                    edit_delay=0.3, replace_typed_links=True, port=0, log_level="INFO")
+        base.update(cfg_overrides)
+        cfg = Config(**base)
         self.tg = FakeTG()
         self.db = Database(cfg.database_url)
         self.ctx = Ctx(cfg=cfg, db=self.db, client=self.tg)

tests/test_buttons_sync.py

@@ -0,0 +1,196 @@
+"""Checking and repairing the buttons a channel really shows."""
+import asyncio
+
+import pytest
+
+from app.buttons_sync import ButtonsNotShown, ensure_markup, fix_buttons, link_urls, scan_buttons
+from app.tgutil import build_markup, button_url, peer_of
+
+from .dbutil import db_url_for, fresh_db
+from .fakes import FakeChannelClient, make_msg, markup, rpc, url_btn
+from .harness import App, norm
+
+A = "https://t.me/goku?start=A"
+B = "https://t.me/goku?start=B"
+ROWS = [[{"t": "Get", "u": A}], [{"t": "More", "u": B}]]
+
+
+def shown(chan, i):
+    m = chan.msgs[i]
+    return [button_url(b) for r in (m.reply_markup.rows if m.reply_markup else []) for b in r.buttons]
+
+
+class Peer:
+    id, access_hash = 1, 5
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def test_link_urls():
+    assert link_urls(None) == []
+    assert link_urls(markup([url_btn("x", A), url_btn("y", B)])) == [A, B]
+
+
+def test_ensure_markup_in_every_situation():
+    async def go():
+        want = build_markup(ROWS)
+        peer = peer_of(Peer)
+
+        chan = FakeChannelClient({1: make_msg(1, "ok", markup=want)})
+        assert await ensure_markup(chan, peer, 1, want, pause=0) == "fine"
+        assert chan.edits == []
+
+        chan = FakeChannelClient({1: make_msg(1, "no keyboard")})  # simply missing: one edit is enough
+        assert await ensure_markup(chan, peer, 1, want, pause=0) == "set"
+        assert shown(chan, 1) == [A, B] and len(chan.edits) == 1 and chan.msgs[1].message == "no keyboard"
+
+        chan = FakeChannelClient({1: make_msg(1, "hidden")})  # Telegram believes the keyboard is there already
+        chan.msgs[1]._hidden = want
+        assert await ensure_markup(chan, peer, 1, want, pause=0) == "nudged"
+        assert shown(chan, 1) == [A, B] and len(chan.edits) == 2
+
+        chan = FakeChannelClient({})
+        with pytest.raises(LookupError):
+            await ensure_markup(chan, peer, 1, want, pause=0)
+
+        chan = FakeChannelClient({1: make_msg(1, "x")})
+        chan.drop_all_markup = True  # edits are accepted but the keyboard never appears
+        with pytest.raises(ButtonsNotShown):
+            await ensure_markup(chan, peer, 1, want, pause=0)
+
+        chan = FakeChannelClient({1: make_msg(1, "x")})  # nothing to show -> nothing to do
+        assert await ensure_markup(chan, peer, 1, None, pause=0) == "fine" and chan.requests == []
+
+    run(go())
+
+
+async def seeded(tmp_path):
+    """Channel + database as /repost used to leave them: the database knows the buttons, the channel may not show them."""
+    db = await fresh_db(db_url_for(tmp_path))
+    await db.save_channel(1, 5, "Test", "testch", 99)
+    ch = await db.get_channel(1)
+    want = build_markup(ROWS)
+    msgs = {
+        10: make_msg(10, "fine", markup=want),
+        11: make_msg(11, "missing"),
+        12: make_msg(12, "hidden"),
+        13: make_msg(13, "other link", markup=markup([url_btn("Get", "https://t.me/other?start=Z")])),
+        15: make_msg(15, "no buttons saved"),
+    }
+    chan = FakeChannelClient(msgs)
+    chan.msgs[12]._hidden = want
+    for i in (10, 11, 12, 13, 14):  # 14 was deleted by hand
+        await db.create_post(channel_id=1, message_id=i, status="sent", source="bot", text="t", entities=[], buttons=ROWS)
+    await db.create_post(channel_id=1, message_id=15, status="sent", source="bot", text="t", entities=[], buttons=[])
+    await db.create_post(channel_id=1, message_id=None, status="draft", source="bot", text="draft", entities=[], buttons=ROWS)
+    return db, ch, chan
+
+
+def test_scan_finds_exactly_the_posts_with_wrong_buttons(tmp_path):
+    async def go():
+        db, ch, chan = await seeded(tmp_path)
+        scan = await scan_buttons(chan, ch, await db.sent_posts(1))
+        assert scan.total == 5  # 10..14 have saved link buttons; 15 and the draft do not count
+        assert scan.fine == 1
+        assert sorted(p.message_id for p, _, _ in scan.bad) == [11, 12, 13]
+        assert [p.message_id for p in scan.gone] == [14]
+        live13 = next(live for p, live, _ in scan.bad if p.message_id == 13)
+        assert live13 == ["https://t.me/other?start=Z"]
+        await db.close()
+
+    run(go())
+
+
+def test_fix_puts_the_saved_buttons_back(tmp_path):
+    async def go():
+        db, ch, chan = await seeded(tmp_path)
+        scan = await scan_buttons(chan, ch, await db.sent_posts(1))
+        res = await fix_buttons(chan, ch, scan.bad, delay=0, pause=0)
+        assert (res.fixed, res.nudged, res.already, res.gone, res.failed, res.aborted) == (3, 1, 0, 0, [], None)
+        for i in (10, 11, 12, 13):
+            assert shown(chan, i) == [A, B]
+        assert chan.msgs[11].message == "missing"  # texts untouched
+        again = await scan_buttons(chan, ch, await db.sent_posts(1))
+        assert again.bad == [] and again.fine == 4 and len(again.gone) == 1
+        await db.close()
+
+    run(go())
+
+
+def test_fix_gives_up_after_several_identical_refusals(tmp_path):
+    async def go():
+        db = await fresh_db(db_url_for(tmp_path))
+        await db.save_channel(1, 5, "Test", "testch", 99)
+        ch = await db.get_channel(1)
+        chan = FakeChannelClient({i: make_msg(i, "x") for i in range(1, 9)})
+        chan.fail["EditMessageRequest"] = rpc("MessageIdInvalidError")
+        for i in range(1, 9):
+            await db.create_post(channel_id=1, message_id=i, status="sent", source="bot", text="x", entities=[], buttons=ROWS)
+        scan = await scan_buttons(chan, ch, await db.sent_posts(1))
+        res = await fix_buttons(chan, ch, scan.bad, delay=0, pause=0)
+        assert res.fixed == 0 and len(res.failed) == 5 and res.aborted == "MessageIdInvalidError"
+        await db.close()
+
+    run(go())
+
+
+# ------------------------------------------------------------------------------------------ the button in My posts
+def test_check_buttons_in_my_posts(tmp_path):
+    async def go():
+        app = App(tmp_path)
+        await app.start()
+        db, ch, chan = await seeded_app(app)
+        await app.press("pc:1:0")
+        assert "Check buttons" in str(app.out.last_buttons())
+        await app.press("pk:1")
+        t = norm(app.out.last_text)
+        assert "checked 5 post(s)" in t and "1 show their buttons correctly" in t and "3 are saved with buttons" in t
+        assert "#11" in t and "#12" in t and "#13" in t and "1 saved post(s) no longer exist" in t
+        assert "Fix 3 post(s)" in str(app.out.last_buttons())
+        await app.press(app.out.callback_data("Fix 3"))
+        t = norm(app.out.last_text)
+        assert "put the saved buttons back on 3 post(s)" in t and "1 of them needed a second edit" in t
+        for i in (10, 11, 12, 13):
+            assert shown(app.tg, i) == [A, B]
+        await app.press("pk:1")
+        assert "Everything matches" in norm(app.out.last_text) and "Fix" not in str(app.out.last_buttons())
+        await app.db.close()
+
+    run(go())
+
+
+async def seeded_app(app):
+    await app.db.save_channel(1, 5, "Anime Channel", "animech", 1)
+    want = build_markup(ROWS)
+    app.tg.msgs.update(
+        {
+            10: make_msg(10, "fine", markup=want),
+            11: make_msg(11, "missing"),
+            12: make_msg(12, "hidden"),
+            13: make_msg(13, "other link", markup=markup([url_btn("Get", "https://t.me/other?start=Z")])),
+            15: make_msg(15, "no buttons saved"),
+        }
+    )
+    app.tg.msgs[12]._hidden = want
+    for i in (10, 11, 12, 13, 14):
+        await app.db.create_post(channel_id=1, message_id=i, status="sent", source="bot", text="t", entities=[], buttons=ROWS)
+    return app.db, None, app.tg
+
+
+def test_check_buttons_is_for_the_owner_only(tmp_path):
+    async def go():
+        app = App(tmp_path, owner=1, admins=frozenset({2}))
+        await app.start()
+        await seeded_app(app)
+        app.uid = 2  # an admin who may make posts but is not the owner
+        await app.press("pc:1:0")
+        assert "Check buttons" not in str(app.out.last_buttons())
+        await app.press("pk:1")
+        assert "Only the bot owner" in app.out.last_text
+        await app.press("pkf:1")
+        assert "Only the bot owner" in app.out.last_text
+        await app.db.close()
+
+    run(go())

tests/test_config.py

@@ -0,0 +1,268 @@
+"""Settings from the environment, the deployment files, and that nothing the owner needs is left undocumented."""
+import asyncio
+import py_compile
+import re
+import socket
+import tempfile
+from pathlib import Path
+
+import pytest
+
+from app.config import DEFAULT_ERROR_LOG_CHAT_ID, Config, default_session_path, load_config
+from app.health import start_health_server
+from bot import COMMANDS, secrets_of
+
+from .harness import App
+
+ROOT = Path(__file__).resolve().parent.parent
+REQUIRED = {"API_ID": "12345", "API_HASH": "abcdef0123456789", "BOT_TOKEN": "123456:ABCdefGHIjklMNOpqrSTUvwxYZ", "OWNER_IDS": "1001484109"}
+
+
+def env_names() -> list:
+    """Every environment variable app/config.py reads."""
+    src = (ROOT / "app" / "config.py").read_text()
+    names = set(re.findall(r'(?:getenv|_ints|_bool|_chat_id|_float)\(\s*"([A-Z][A-Z0-9_]+)"', src))
+    names |= set(re.findall(r'environ\[\s*"([A-Z][A-Z0-9_]+)"', src))
+    return sorted(names)
+
+
+@pytest.fixture
+def env(monkeypatch):
+    for k in env_names():
+        monkeypatch.delenv(k, raising=False)
+    for k, v in REQUIRED.items():
+        monkeypatch.setenv(k, v)
+    return monkeypatch
+
+
+# ----------------------------------------------------------------------------------------- defaults
+def test_the_names_the_test_looks_for_are_all_found():
+    names = env_names()
+    for expected in ("API_ID", "BOT_TOKEN", "OWNER_IDS", "ERROR_LOG_CHAT_ID", "USERBOT_SESSION", "USERBOT_KEEP_ADMIN", "SESSION_PATH", "PORT"):
+        assert expected in names, names
+
+
+def test_defaults(env):
+    cfg = load_config()
+    assert cfg.error_log_chat_id == DEFAULT_ERROR_LOG_CHAT_ID == -1002525172451
+    assert cfg.userbot_session == "" and cfg.userbot_keep_admin is False
+    assert cfg.owners == frozenset({1001484109}) and cfg.admins == frozenset()
+    assert cfg.edit_delay == 1.2 and cfg.replace_typed_links is True and cfg.port == 0
+    assert cfg.database_url.startswith("sqlite")
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        (None, -1002525172451),  # not set at all -> the default chat
+        ("", -1002525172451),
+        ("   ", -1002525172451),
+        ("-1001234567890", -1001234567890),
+        (" -1001234567890 ", -1001234567890),
+        ("123456789", 123456789),  # a private chat with a person
+        ("0", None),
+        ("off", None),
+        ("OFF", None),
+        ("None", None),
+        ("false", None),
+        ("no", None),
+        ("disabled", None),
+    ],
+)
+def test_error_log_chat_id(env, raw, expected):
+    if raw is not None:
+        env.setenv("ERROR_LOG_CHAT_ID", raw)
+    assert load_config().error_log_chat_id == expected
+
+
+@pytest.mark.parametrize("raw", ["abc", "-100 123", "@mychannel", "1.5"])
+def test_a_bad_error_log_chat_id_is_refused_with_its_name(env, raw):
+    env.setenv("ERROR_LOG_CHAT_ID", raw)
+    with pytest.raises(SystemExit) as e:
+        load_config()
+    assert "ERROR_LOG_CHAT_ID" in str(e.value) and repr(raw) in str(e.value)
+
+
+def test_userbot_settings(env):
+    env.setenv("USERBOT_SESSION", "  1BVtsOKwBu7abc  ")
+    env.setenv("USERBOT_KEEP_ADMIN", "true")
+    cfg = load_config()
+    assert cfg.userbot_session == "1BVtsOKwBu7abc" and cfg.userbot_keep_admin is True
+    for v, want in [("1", True), ("yes", True), ("ON", True), ("false", False), ("0", False), ("", False), ("nonsense", False)]:
+        env.setenv("USERBOT_KEEP_ADMIN", v)
+        assert load_config().userbot_keep_admin is want, v
+
+
+def test_missing_settings_are_listed(env):
+    env.delenv("API_HASH")
+    env.delenv("OWNER_IDS")
+    with pytest.raises(SystemExit) as e:
+        load_config()
+    assert "API_HASH" in str(e.value) and "OWNER_IDS" in str(e.value) and "API_ID" not in str(e.value)
+    env.setenv("OWNER_IDS", "not a number")
+    env.setenv("API_HASH", "x")
+    with pytest.raises(SystemExit) as e:
+        load_config()
+    assert "OWNER_IDS" in str(e.value)
+
+
+def test_api_id_must_be_a_number(env):
+    env.setenv("API_ID", "twelve")
+    with pytest.raises(SystemExit) as e:
+        load_config()
+    assert "API_ID must be a number" in str(e.value)
+
+
+def test_edit_delay_has_a_floor(env):
+    env.setenv("EDIT_DELAY", "0.1")
+    assert load_config().edit_delay == 0.3
+    env.setenv("EDIT_DELAY", "banana")
+    assert load_config().edit_delay == 1.2
+    env.setenv("EDIT_DELAY", "2.5")
+    assert load_config().edit_delay == 2.5
+
+
+def test_the_session_is_not_kept_in_the_app_folder_by_default(env):
+    path = Path(load_config().session_path).resolve()
+    assert str(path).startswith(str(Path(tempfile.gettempdir()).resolve()))
+    assert ROOT not in path.parents  # an app folder that a web server publishes must not contain the login
+    assert Path(default_session_path()).name == "bot"
+    env.setenv("SESSION_PATH", "data/bot")
+    assert load_config().session_path == "data/bot"  # still possible when somebody wants it
+
+
+# ------------------------------------------------------------------------------ secrets of the bot
+def test_every_secret_is_collected_for_redaction():
+    cfg = Config(
+        api_id=1, api_hash="HASHHASHHASH", bot_token="123:TOKEN-TOKEN", owners=frozenset({1}), admins=frozenset(),
+        database_url="postgresql://user:p%40ss%2Fword@host.example/db?sslmode=require", db_pool="null", session_path="x",
+        session_string="SESSIONSTRINGTEXT", edit_delay=1.0, replace_typed_links=True, port=0, log_level="INFO",
+        userbot_session="USERBOTSESSIONTEXT",
+    )
+    found = secrets_of(cfg)
+    for s in ("HASHHASHHASH", "123:TOKEN-TOKEN", "SESSIONSTRINGTEXT", "USERBOTSESSIONTEXT", "p%40ss%2Fword", "p@ss/word"):
+        assert s in found, (s, found)
+    assert "" not in found
+    plain = Config(**{**cfg.__dict__, "database_url": "sqlite+aiosqlite:///data/bot.db", "session_string": "", "userbot_session": ""})
+    assert set(secrets_of(plain)) == {"123:TOKEN-TOKEN", "HASHHASHHASH"}  # nothing else to hide, and no crash on SQLite
+
+
+# ------------------------------------------------------------------------------------- deployment files
+def test_dockerfile_is_exactly_the_one_that_was_asked_for():
+    lines = [ln.rstrip() for ln in (ROOT / "Dockerfile").read_text().splitlines() if ln.strip()]
+    assert lines == [
+        "FROM python:3.12-slim",
+        "WORKDIR /app",
+        "ENV PYTHONUNBUFFERED=1",
+        "COPY requirements.txt .",
+        "RUN pip install --no-cache-dir -r requirements.txt",
+        "COPY . .",
+        "CMD python -m http.server 7860 & python bot.py",
+    ]
+
+
+def test_github_workflow_syncs_to_the_space_without_a_hard_coded_token():
+    text = (ROOT / ".github" / "workflows" / "hf-sync.yml").read_text()
+    assert "huggingface.co/spaces/Mega-Evolutions/ButtonBot" in text
+    assert "${{ secrets.HF_TOKEN }}" in text and "branches: [main]" in text and "workflow_dispatch" in text
+    assert "--exclude='README.md'" in text and "--exclude='.github'" in text  # the Space keeps its own README
+    assert not re.search(r"hf_[A-Za-z0-9]{20,}", text)  # no real token pasted in
+    yaml = pytest.importorskip("yaml")
+    doc = yaml.safe_load(text)
+    assert doc["jobs"]["sync-to-hub"]["steps"][1]["env"]["HF_TOKEN"] == "${{ secrets.HF_TOKEN }}"
+
+
+def test_nothing_secret_can_end_up_in_the_image_or_the_repository():
+    docker = (ROOT / ".dockerignore").read_text().split()
+    for entry in (".env", "*.session", "data/*", "tests"):
+        assert entry in docker, entry
+    git = (ROOT / ".gitignore").read_text().split()
+    for entry in (".env", "*.session"):
+        assert entry in git, entry
+
+
+def test_env_example_documents_every_setting():
+    text = (ROOT / ".env.example").read_text()
+    listed = set(re.findall(r"^#?\s*([A-Z][A-Z0-9_]+)=", text, re.M))
+    missing = [n for n in env_names() if n not in listed]
+    assert not missing, f".env.example does not mention: {missing}"
+    unknown = sorted(listed - set(env_names()))
+    assert not unknown, f".env.example mentions settings the bot does not read: {unknown}"
+    assert re.search(r"^ERROR_LOG_CHAT_ID=-1002525172451$", text, re.M)
+
+
+def test_helper_scripts_compile_and_the_userbot_one_stands_alone():
+    for name in ("make_userbot_session.py", "make_session.py", "bot.py"):
+        py_compile.compile(str(ROOT / name), doraise=True)
+    src = (ROOT / "make_userbot_session.py").read_text()
+    assert "from app" not in src and "import app" not in src  # runs on its own computer with only telethon installed
+    assert "StringSession" in src and "USERBOT_SESSION=" in src
+
+
+def test_the_testing_commands_are_gone_everywhere():
+    names = [c for c, _ in COMMANDS]
+    assert "testedit" not in names and "selftest" not in names
+    assert {"new", "posts", "repost", "replace", "undo", "userbot", "testerror", "help"} <= set(names)
+    for path in list((ROOT / "app").rglob("*.py")) + [ROOT / "bot.py"]:
+        text = path.read_text().lower()
+        assert "testedit" not in text and "selftest" not in text, path
+
+
+def test_every_menu_command_has_a_handler(tmp_path):
+    async def go():
+        app = App(tmp_path)
+        await app.start()
+        patterns = [b.pattern for b, _ in app.tg.handlers if getattr(b, "pattern", None)]
+        for name, _ in COMMANDS:
+            assert any(p(f"/{name}") for p in patterns), f"/{name} is in the menu but nothing answers it"
+        await app.db.close()
+
+    asyncio.run(go())
+
+
+def test_the_help_text_lists_the_commands_that_exist():
+    from app.handlers.basic import HELP
+
+    for name in ("new", "posts", "repost", "replace", "undo", "userbot", "testerror", "export", "addchannel", "channels"):
+        assert f"/{name}" in HELP, name
+    assert "--channel" not in HELP
+
+
+# ------------------------------------------------------------------------------------------ health port
+def free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def test_health_endpoint_answers_ok():
+    async def go():
+        port = free_port()
+        server = await start_health_server(port)
+        assert server is not None
+        reader, writer = await asyncio.open_connection("127.0.0.1", port)
+        writer.write(b"GET / HTTP/1.1\r\nHost: x\r\n\r\n")
+        await writer.drain()
+        data = await asyncio.wait_for(reader.read(), 5)
+        assert data.startswith(b"HTTP/1.1 200 OK") and data.endswith(b"ok")
+        writer.close()
+        server.close()
+        await server.wait_closed()
+
+    asyncio.run(go())
+
+
+def test_a_port_that_is_already_taken_does_not_stop_the_bot():
+    """The Dockerfile starts `python -m http.server 7860` first; if PORT=7860 is set too, the bot must carry on."""
+
+    async def go():
+        busy = socket.socket()
+        busy.bind(("0.0.0.0", 0))
+        busy.listen()
+        try:
+            assert await start_health_server(busy.getsockname()[1]) is None
+        finally:
+            busy.close()
+
+    asyncio.run(go())
+

tests/test_delete_post.py

@@ -0,0 +1,88 @@
+"""Deleting one published post from My posts: the bot first, the userbot when Telegram refuses, honest messages."""
+import asyncio
+
+from .fakes import make_msg
+from .harness import App, norm
+from .test_repost_flow import fill, userbot_setup
+
+
+async def make_app(tmp_path, **cfg):
+    app = App(tmp_path, **cfg)
+    await app.start()
+    await app.db.save_channel(1, 5, "Anime Channel", "animech", 1)
+    fill(app.tg, {5: make_msg(5, "old post"), 6: make_msg(6, "newer post")})
+    post = await app.db.create_post(channel_id=1, message_id=5, status="sent", source="bot", text="old post", entities=[], buttons=[])
+    return app, post.id
+
+
+def test_the_bot_deletes_a_post_it_is_allowed_to(tmp_path):
+    async def run():
+        app, pid = await make_app(tmp_path)
+        await app.press(f"dl:{pid}")
+        assert "Delete this post" in norm(app.out.last_text) and "userbot" in norm(app.out.last_text)
+        await app.press(f"dly:{pid}:a")
+        assert "Done" in norm(app.out.last_text)
+        assert 5 not in app.tg.msgs and 6 in app.tg.msgs
+        assert await app.db.get_post(pid) is None
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_a_post_too_old_for_the_bot_stays_registered_and_the_owner_is_told_why(tmp_path):
+    async def run():
+        app, pid = await make_app(tmp_path)
+        app.tg.undeletable = {5}
+        await app.press(f"dly:{pid}:a")
+        text = norm(app.out.last_text)
+        assert "Telegram did not delete that message" in text and "/userbot" in text and "Only forget it in the bot" in text
+        assert 5 in app.tg.msgs and await app.db.get_post(pid) is not None  # nothing is forgotten while it still exists
+        # after deleting by hand, "only forget it" removes just the bot's record
+        await app.press(f"dly:{pid}:b")
+        assert await app.db.get_post(pid) is None and 5 in app.tg.msgs
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_the_userbot_deletes_what_the_bot_may_not(tmp_path):
+    async def run():
+        app, pid = await make_app(tmp_path)
+        ub, holder = userbot_setup(app)
+        app.tg.undeletable = {5}
+        await app.press(f"dly:{pid}:a")
+        assert "Done" in norm(app.out.last_text)
+        assert 5 not in app.tg.msgs and 6 in app.tg.msgs and await app.db.get_post(pid) is None
+        assert holder["client"].deleted == [[5]]
+        assert app.tg.admins == {} and all(v["revoked"] for v in app.tg.invites.values())  # cleaned up again
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_a_userbot_that_cannot_get_the_right_is_explained(tmp_path):
+    async def run():
+        app, pid = await make_app(tmp_path)
+        userbot_setup(app, bot_rights=dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=False))
+        app.tg.undeletable = {5}
+        await app.press(f"dly:{pid}:a")
+        text = norm(app.out.last_text)
+        assert "Telegram did not delete that message" in text and "Add new admins" in text
+        assert 5 in app.tg.msgs and await app.db.get_post(pid) is not None
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_discarding_a_draft_touches_nothing_in_telegram(tmp_path):
+    async def run():
+        app, _ = await make_app(tmp_path)
+        d = await app.db.create_post(channel_id=1, status="draft", source="bot", text="a draft", entities=[], buttons=[])
+        await app.press(f"dl:{d.id}")
+        assert "Discard this draft" in norm(app.out.last_text)
+        await app.press(f"dly:{d.id}:b")
+        assert await app.db.get_post(d.id) is None
+        assert app.tg.requests == [] and app.tg.deleted == []
+        await app.db.close()
+
+    asyncio.run(run())

tests/test_errorlog.py

@@ -0,0 +1,547 @@
+"""Errors go to the log chat as a `python` code block: full tracebacks, split not shortened, secrets removed, no floods."""
+import asyncio
+import gc
+import logging
+import threading
+from types import SimpleNamespace
+
+import pytest
+from telethon import errors, types
+
+from app import errorlog
+from app.errorlog import ErrorReporter, TelegramLogHandler, format_exception, redact, split_report
+from app.tgutil import utf16_len
+
+from .harness import App, norm
+
+CHAT = -1002525172451
+TOKEN = "123456:ABCdefGHIjklMNOpqrSTUvwxYZ"
+
+
+class FakeSender:
+    """The bot's Telegram connection, as far as the reporter uses it."""
+
+    def __init__(self, *, member=True, connected=True, authorized=True):
+        self.member, self.connected, self.authorized = member, connected, authorized
+        self.sent = []  # (peer, text, entities, link_preview)
+        self.lookups = []
+        self.signed_in = []
+        self.fail_send = None
+
+    async def get_input_entity(self, chat_id):
+        self.lookups.append(chat_id)
+        if not self.member:
+            raise ValueError(f"Could not find the input entity for {chat_id}")
+        return types.InputPeerChannel(2525172451, 1)
+
+    async def send_message(self, peer, text, *, formatting_entities=None, link_preview=None):
+        if self.fail_send is not None:
+            raise self.fail_send
+        self.sent.append((peer, text, formatting_entities, link_preview))
+
+    def is_connected(self):
+        return self.connected
+
+    async def connect(self):
+        self.connected = True
+
+    async def is_user_authorized(self):
+        return self.authorized
+
+    async def sign_in(self, bot_token=None):
+        self.signed_in.append(bot_token)
+        self.authorized = True
+
+    @property
+    def texts(self):
+        return [s[1] for s in self.sent]
+
+
+def reporter(client, **kw):
+    kw.setdefault("gap", 0)
+    kw.setdefault("part_gap", 0)
+    kw.setdefault("bot_token", TOKEN)
+    return ErrorReporter(client, kw.pop("chat_id", CHAT), **kw)
+
+
+async def drain(rep, timeout=5):
+    await asyncio.wait_for(rep._queue.join(), timeout)
+
+
+def boom(depth=0):
+    """An exception chain like the one in the screenshot: a cause, then the error it led to."""
+    try:
+        try:
+            raise KeyError("inner")
+        except KeyError as e:
+            raise RuntimeError("outer") from e
+    except RuntimeError as e:
+        return e
+
+
+# ------------------------------------------------------------------------------------ text helpers
+def test_short_reports_stay_in_one_piece():
+    assert split_report("hello") == ["hello"]
+    text = "x" * 3800
+    assert split_report(text) == [text]
+
+
+def test_long_reports_are_split_at_line_breaks_and_nothing_is_lost():
+    lines = [f"  File \"/app/module_{i}.py\", line {i}, in function_{i}" for i in range(300)]
+    text = "Unhandled exception:\n" + "\n".join(lines)
+    parts = split_report(text)
+    assert len(parts) > 1
+    assert all(len(p) <= 4096 for p in parts)
+    n = len(parts)
+    assert [p.split("\n", 1)[0] for p in parts] == [f"(part {i}/{n})" for i in range(1, n + 1)]
+    body = "\n".join(p.split("\n", 1)[1] for p in parts)
+    assert body == text  # the same lines in the same order, none dropped, none cut in half
+
+
+def test_one_enormous_line_is_cut_into_pieces_not_dropped():
+    text = "Error: " + "y" * 10000
+    parts = split_report(text)
+    assert len(parts) > 1 and all(len(p) <= 4096 for p in parts)
+    body = "".join(p.split("\n", 1)[1] for p in parts)
+    assert body.replace("\n", "") == text  # every character is there; the only addition is a line break at each cut
+
+
+def test_redact_removes_secrets_longest_first():
+    out = redact(f"token {TOKEN} and hunter2hunter2 and ab", [TOKEN, "hunter2hunter2", "ab", "", None])
+    assert out == "token *** and *** and ab"  # a 2-letter "secret" would mangle ordinary words, so it is left alone
+    assert redact("keep me", [TOKEN]) == "keep me"
+    assert redact("p@ssw0rd-long p@ssw0rd", ["p@ssw0rd", "p@ssw0rd-long"]) == "*** ***"
+
+
+def test_traceback_text_contains_the_whole_chain():
+    text = format_exception(boom())
+    assert text.startswith("Traceback (most recent call last):")
+    assert "KeyError: 'inner'" in text and "RuntimeError: outer" in text
+    assert "The above exception was the direct cause of the following exception:" in text
+
+
+# ---------------------------------------------------------------------------------------- delivery
+def test_a_report_is_sent_as_a_python_code_block():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        rep.submit("Unhandled exception in background task <unnamed>:", format_exception(boom()))
+        await drain(rep)
+        (peer, text, ents, preview), = client.sent
+        assert text.startswith("Unhandled exception in background task <unnamed>:\n\nTraceback (most recent call last):")
+        assert "The above exception was the direct cause of the following exception:" in text
+        assert text.rstrip().endswith("RuntimeError: outer")
+        # one code block over the whole message, language "python"
+        (ent,) = ents
+        assert isinstance(ent, types.MessageEntityPre) and ent.language == "python"
+        assert (ent.offset, ent.length) == (0, utf16_len(text)) and preview is False
+        assert client.lookups == [CHAT]
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_the_code_block_length_counts_utf16_units():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        rep.submit("Fehler 😀 in Aufgabe:", "Traceback:\n  ValueError: Größe ≠ 😀😀")
+        await drain(rep)
+        _, text, ents, _ = client.sent[0]
+        assert ents[0].length == utf16_len(text) and utf16_len(text) > len(text)  # emoji take two units
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_a_long_traceback_is_sent_in_several_messages_and_every_line_arrives():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        tb = "Traceback (most recent call last):\n" + "\n".join(f'  File "/app/m{i}.py", line {i}, in f{i}' for i in range(400)) + "\nValueError: deep"
+        rep.submit("Unhandled exception in handler h_x (user 1):", tb)
+        await drain(rep)
+        assert len(client.sent) > 1
+        for _, text, ents, _ in client.sent:
+            assert len(text) <= 4096 and ents[0].length == utf16_len(text) and ents[0].language == "python"
+        joined = "\n".join(t.split("\n", 1)[1] for t in client.texts)
+        assert "ValueError: deep" in joined and joined.count("File \"/app/m") == 400
+        assert client.texts[0].startswith(f"(part 1/{len(client.sent)})")
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_secrets_never_leave_the_bot():
+    async def go():
+        client = FakeSender()
+        # the bot token is hidden even though it is only given as the login token, not in the list of secrets
+        rep = reporter(client, secrets=["hunter2hunter2", "SESSIONTEXT123456"])
+        rep.start()
+        rep.submit(f"login with {TOKEN} failed:", "OperationalError: password hunter2hunter2 wrong, session SESSIONTEXT123456")
+        await drain(rep)
+        text = client.texts[0]
+        assert TOKEN not in text and "hunter2hunter2" not in text and "SESSIONTEXT123456" not in text
+        assert text.count("***") == 3
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_secrets_are_removed_even_when_a_text_is_split_across_parts():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client, secrets=["hunter2hunter2"])
+        rep.start()
+        lines = ["line %d hunter2hunter2" % i for i in range(500)]
+        rep.submit("Many lines:", "\n".join(lines))
+        await drain(rep)
+        assert len(client.sent) > 1 and not any("hunter2" in t for t in client.texts)
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+# --------------------------------------------------------------------------------------- the sources
+def test_a_forgotten_background_task_is_reported_like_in_the_screenshot():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        loop = asyncio.get_running_loop()
+        loop.set_exception_handler(rep.loop_exception_handler)
+
+        async def boom_task():
+            raise boom()
+
+        t = loop.create_task(boom_task())
+        await asyncio.sleep(0.05)  # it ran and failed; nobody looked at the result
+        del t
+        gc.collect()
+        await asyncio.sleep(0.05)
+        await drain(rep)
+        text = client.texts[0]
+        assert text.startswith("Unhandled exception in background task <unnamed>:\n\nTraceback")
+        assert "RuntimeError: outer" in text and "The above exception was the direct cause" in text
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_named_tasks_keep_their_name_and_other_loop_errors_their_message():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        loop = asyncio.get_running_loop()
+
+        async def noop():
+            raise ValueError("x")
+
+        task = loop.create_task(noop(), name="cleanup-job")
+        await asyncio.sleep(0)
+        await asyncio.sleep(0)
+        calls = []
+        loop.default_exception_handler = lambda ctx: calls.append(ctx)  # the normal log line still happens
+        rep.loop_exception_handler(loop, {"message": "Task exception was never retrieved", "exception": task.exception(), "future": task})
+        rep.loop_exception_handler(loop, {"message": "Fatal error on transport", "exception": OSError("pipe closed")})
+        rep.loop_exception_handler(loop, {"message": "Something odd without an exception"})
+        await drain(rep)
+        assert client.texts[0].startswith("Unhandled exception in background task cleanup-job:")
+        assert client.texts[1] == "Fatal error on transport:\n\nOSError: pipe closed"
+        assert client.texts[2].startswith("Something odd without an exception:")
+        assert len(calls) == 3
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_the_logging_handler_forwards_errors_with_their_traceback():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        handler = TelegramLogHandler(rep)
+        root = logging.getLogger()
+        root.addHandler(handler)
+        try:
+            try:
+                raise boom()
+            except RuntimeError:
+                logging.getLogger("app.common").exception("Unhandled exception in handler h_posts (user 1)")
+            logging.getLogger("app.common").error("Telegram refused a request")  # no traceback
+            logging.getLogger("app.common").warning("only a warning")  # below ERROR: not sent
+            logging.getLogger("telethon.network").error("Connection lost")  # other libraries get a tag
+            logging.getLogger("app.errorlog").error("our own message must not loop")
+            logging.getLogger("asyncio").error("asyncio has its own path")
+            await asyncio.sleep(0.05)
+            await drain(rep)
+        finally:
+            root.removeHandler(handler)
+        assert len(client.sent) == 3, client.texts
+        assert client.texts[0].startswith("Unhandled exception in handler h_posts (user 1):\n\nTraceback")
+        assert "The above exception was the direct cause of the following exception:" in client.texts[0]
+        assert client.texts[1] == "Telegram refused a request"
+        assert client.texts[2] == "[telethon.network] Connection lost"
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_a_failing_handler_in_the_bot_reaches_the_log_chat_end_to_end(tmp_path):
+    """/testerror raises on purpose inside a real handler; guard() logs it; the log handler sends it."""
+
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        handler = TelegramLogHandler(rep)
+        logging.getLogger().addHandler(handler)
+        app = App(tmp_path)
+        await app.start()
+        app.ctx.reporter = rep
+        try:
+            await app.text("/testerror")
+            await asyncio.sleep(0.05)
+            await drain(rep)
+        finally:
+            logging.getLogger().removeHandler(handler)
+        assert "Raising a test error now" in norm(app.out.log[0][1])
+        assert "Something went wrong: RuntimeError" in norm(app.out.last_text)  # the owner is told too
+        text = client.texts[0]
+        assert text.startswith("Unhandled exception in handler h_testerror (user 1):\n\nTraceback")
+        assert "KeyError: 'test'" in text and "RuntimeError: Test error from /testerror" in text
+        assert "The above exception was the direct cause of the following exception:" in text
+        await app.db.close()
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_testerror_task_makes_a_background_task_fail(tmp_path):
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        asyncio.get_running_loop().set_exception_handler(rep.loop_exception_handler)
+        app = App(tmp_path)
+        await app.start()
+        app.ctx.reporter = rep
+        await app.text("/testerror task")
+        assert "background task will fail" in norm(app.out.last_text)
+        await asyncio.sleep(0.1)
+        gc.collect()
+        await asyncio.sleep(0.05)
+        await drain(rep)
+        assert client.texts[0].startswith("Unhandled exception in background task <unnamed>:")
+        assert "RuntimeError: Test error from /testerror task" in client.texts[0]
+        await app.db.close()
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_testerror_is_for_the_owner_and_says_when_the_log_is_off(tmp_path):
+    async def go():
+        app = App(tmp_path, admins=frozenset({7}))
+        await app.start()
+        await app.text("/testerror")  # no reporter at all
+        assert "switched off" in norm(app.out.last_text)
+        app.ctx.reporter = reporter(FakeSender(), chat_id=None)
+        await app.text("/testerror")
+        assert "switched off" in norm(app.out.last_text)
+        app.uid = 7
+        await app.text("/testerror")
+        assert "private" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(go())
+
+
+def test_a_crash_of_the_whole_bot_is_sent_directly_even_when_disconnected():
+    async def go():
+        client = FakeSender(connected=False, authorized=False)
+        rep = reporter(client)  # never started: the crash path does not depend on the worker
+        await rep.report_fatal("The bot stopped because of an unhandled exception", boom())
+        assert client.connected and client.signed_in == [TOKEN]
+        (peer, text, ents, _), = client.sent
+        assert text.startswith("The bot stopped because of an unhandled exception:\n\nTraceback")
+        assert "RuntimeError: outer" in text and ents[0].language == "python"
+
+    asyncio.run(go())
+
+
+def test_a_failing_crash_report_never_raises():
+    async def go():
+        client = FakeSender()
+        client.fail_send = errors.ChatWriteForbiddenError(request=None)
+        rep = reporter(client)
+        await rep.report_fatal("The bot stopped", boom())  # must not raise (the bot is going down anyway)
+        await reporter(FakeSender(), chat_id=None).report_fatal("x", boom())
+
+    asyncio.run(go())
+
+
+# ------------------------------------------------------------------------------- flood protection
+def test_identical_errors_are_merged_and_counted(monkeypatch):
+    async def go():
+        now = [1000.0]
+        monkeypatch.setattr(errorlog, "time", SimpleNamespace(monotonic=lambda: now[0]))
+        client = FakeSender()
+        rep = reporter(client, dedupe_seconds=60)
+        rep.start()
+        for _ in range(5):
+            rep.submit("Unhandled exception in handler h:", "Traceback:\nValueError: same")
+            now[0] += 1
+        rep.submit("Unhandled exception in handler h:", "Traceback:\nValueError: different")  # another error: not merged
+        await drain(rep)
+        assert len(client.sent) == 2
+        now[0] += 100  # a minute and a half later the same error is news again, and says how often it came meanwhile
+        rep.submit("Unhandled exception in handler h:", "Traceback:\nValueError: same")
+        await drain(rep)
+        assert len(client.sent) == 3 and "(+4 identical report(s) suppressed)" in client.texts[2]
+        assert "suppressed" not in client.texts[0]
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_a_storm_of_different_errors_is_limited_per_minute(monkeypatch):
+    async def go():
+        now = [5000.0]
+        monkeypatch.setattr(errorlog, "time", SimpleNamespace(monotonic=lambda: now[0]))
+        client = FakeSender()
+        rep = reporter(client, per_minute=3)
+        rep.start()
+        for i in range(10):
+            rep.submit(f"error number {i}:", f"ValueError: {i}")
+        await drain(rep)
+        assert len(client.sent) == 3  # the first three, the other seven are counted
+        now[0] += 61
+        rep.submit("error after the storm:", "ValueError: later")
+        await drain(rep)
+        assert len(client.sent) == 4 and "(7 report(s) were skipped because too many errors came in)" in client.texts[3]
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_not_being_allowed_to_write_to_the_chat_silences_the_reporter(monkeypatch):
+    async def go():
+        now = [10.0]
+        monkeypatch.setattr(errorlog, "time", SimpleNamespace(monotonic=lambda: now[0]))
+        client = FakeSender()
+        client.fail_send = errors.ChatWriteForbiddenError(request=None)
+        rep = reporter(client)
+        rep.start()
+        rep.submit("first:", "ValueError: 1")
+        await drain(rep)
+        assert client.sent == [] and client.lookups == [CHAT]
+        rep.submit("second:", "ValueError: 2")  # muted: not even tried
+        await asyncio.sleep(0.05)
+        assert client.lookups == [CHAT] and rep._queue.qsize() == 0
+        now[0] += errorlog.MUTE_SECONDS + 1  # after the pause it tries again (the owner may have added the bot meanwhile)
+        client.fail_send = None
+        rep.submit("third:", "ValueError: 3")
+        await drain(rep)
+        assert client.texts == ["third:\n\nValueError: 3"]
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_other_sending_problems_do_not_silence_it():
+    async def go():
+        client = FakeSender()
+        client.fail_send = RuntimeError("temporary network trouble")
+        rep = reporter(client)
+        rep.start()
+        rep.submit("first:", "ValueError: 1")
+        await drain(rep)
+        client.fail_send = None
+        rep.submit("second:", "ValueError: 2")
+        await drain(rep)
+        assert client.texts == ["second:\n\nValueError: 2"]
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+def test_a_chat_the_bot_is_not_in_is_noticed_at_start_up():
+    async def go():
+        rep = reporter(FakeSender(member=False))
+        problem = await rep.check()
+        assert "ValueError" in problem and "add the bot to that chat" in problem
+        good = reporter(FakeSender())
+        assert await good.check() is None
+        assert await reporter(FakeSender(), chat_id=None).check() is None
+
+    asyncio.run(go())
+
+
+def test_switched_off():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client, chat_id=None)
+        assert not rep.enabled
+        rep.start()
+        rep.submit("x:", "y")
+        await rep.stop()
+        assert client.sent == [] and client.lookups == [] and rep._task is None
+
+    asyncio.run(go())
+
+
+def test_submitting_from_another_thread_is_safe():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        t = threading.Thread(target=lambda: rep.submit("from a thread:", "ValueError: threaded"))
+        t.start()
+        t.join()
+        await asyncio.sleep(0.05)
+        await drain(rep)
+        assert client.texts == ["from a thread:\n\nValueError: threaded"]
+        # and before the reporter runs, or after it has stopped, nothing breaks
+        await rep.stop()
+        rep.submit("late:", "x")
+        reporter(FakeSender()).submit("never started:", "x")
+
+    asyncio.run(go())
+
+
+def test_stop_lets_queued_reports_go_out():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        rep.submit("last words:", "ValueError: bye")
+        await rep.stop()
+        assert client.texts == ["last words:\n\nValueError: bye"]
+
+    asyncio.run(go())
+
+
+def test_the_peer_is_looked_up_once():
+    async def go():
+        client = FakeSender()
+        rep = reporter(client)
+        rep.start()
+        for i in range(3):
+            rep.submit(f"e{i}:", f"ValueError: {i}")
+        await drain(rep)
+        assert len(client.sent) == 3 and client.lookups == [CHAT]
+        await rep.stop()
+
+    asyncio.run(go())
+
+
+@pytest.mark.parametrize("raw,label", [("Task-12", "<unnamed>"), ("", "<unnamed>"), ("sender", "sender")])
+def test_task_labels(raw, label):
+    task = SimpleNamespace(get_name=lambda: raw)
+    assert errorlog._task_label(task) == label
+    assert errorlog._task_label(None) == "<unnamed>"

tests/test_paging.py

@@ -0,0 +1,116 @@
+"""My posts: "Prev" is always there, and on the first page it goes to the last page."""
+import asyncio
+
+from .harness import App
+
+
+async def make_app(tmp_path, n_posts, uid_owner=1):
+    app = App(tmp_path, owner=uid_owner)
+    await app.start()
+    await app.db.save_channel(1, 5, "Anime Channel", "animech", 1)
+    for i in range(n_posts):
+        await app.db.create_post(
+            channel_id=1, message_id=100 + i, status="sent", source="bot", text=f"Post number {i}", entities=[], buttons=[]
+        )
+    return app
+
+
+def nav_row(app):
+    """Labels of the navigation row (the one with the page counter), or None."""
+    for row in app.out.log[-1][2] or []:
+        labels = [b.text for b in row]
+        if any("/" in t and t.replace("/", "").isdigit() for t in labels):
+            return labels
+    return None
+
+
+def data_of(app, label_part):
+    return app.out.callback_data(label_part)
+
+
+def test_prev_on_the_first_page_goes_to_the_last_page(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, 83)  # 8 per page -> 11 pages, like "1/11" in the screenshot
+        await app.text("/posts")
+        await app.press(app.out.callback_data("Anime Channel"))
+        assert nav_row(app) == ["⬅️ Prev", "1/11", "Next ➡️"]  # Prev is shown on page 1 as well
+
+        await app.press(app.out.callback_data("Prev"))
+        assert nav_row(app) == ["⬅️ Prev", "11/11"]  # the last page has no Next
+        assert "83 post(s)" in app.out.last_text
+        # the last page holds the 3 remaining posts
+        posts = [r for r in app.out.log[-1][2] if r and r[0].text.startswith("✅")]
+        assert len(posts) == 3
+
+        await app.press(app.out.callback_data("Prev"))
+        assert nav_row(app) == ["⬅️ Prev", "10/11", "Next ➡️"]
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_next_walks_forward_and_stops_at_the_end(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, 20)  # 3 pages
+        await app.text("/posts")
+        await app.press(app.out.callback_data("Anime Channel"))
+        assert nav_row(app) == ["⬅️ Prev", "1/3", "Next ➡️"]
+        await app.press(app.out.callback_data("Next"))
+        assert nav_row(app) == ["⬅️ Prev", "2/3", "Next ➡️"]
+        await app.press(app.out.callback_data("Next"))
+        assert nav_row(app) == ["⬅️ Prev", "3/3"]
+        await app.press(app.out.callback_data("Prev"))
+        await app.press(app.out.callback_data("Prev"))
+        assert nav_row(app) == ["⬅️ Prev", "1/3", "Next ➡️"]
+        await app.press(app.out.callback_data("Prev"))  # and around again
+        assert nav_row(app) == ["⬅️ Prev", "3/3"]
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_a_single_page_has_nothing_to_turn(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, 5)
+        await app.text("/posts")
+        await app.press(app.out.callback_data("Anime Channel"))
+        assert nav_row(app) is None
+        assert "5 post(s)" in app.out.last_text
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_drafts_list_wraps_too(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, 0)
+        for i in range(10):
+            await app.db.create_post(channel_id=1, status="draft", source="bot", text=f"draft {i}", entities=[], buttons=[])
+        await app.press("pc:d:0")
+        assert nav_row(app) == ["⬅️ Prev", "1/2", "Next ➡️"]
+        await app.press(app.out.callback_data("Prev"))
+        assert nav_row(app) == ["⬅️ Prev", "2/2"]
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_check_buttons_row_is_for_the_owner_and_for_channel_lists_only(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, 3)
+        await app.press("pc:1:0")
+        assert "Check buttons" in str(app.out.last_buttons())
+        await app.press("pc:d:0")  # drafts belong to no channel: nothing to check
+        assert "Check buttons" not in str(app.out.last_buttons())
+        await app.db.close()
+
+        # an allowed non-owner does not get the repair tool
+        app2 = App(tmp_path, owner=1, admins=frozenset({7}))
+        await app2.start()
+        await app2.db.save_channel(1, 5, "Anime Channel", "animech", 1)
+        app2.uid = 7
+        await app2.press("pc:1:0")
+        assert "Check buttons" not in str(app2.out.last_buttons())
+        await app2.db.close()
+
+    asyncio.run(run())

tests/test_repost.py

@@ -0,0 +1,344 @@
+"""The repost engine against a simulated channel: what is copied how, buttons verified, deletes with a userbot."""
+import asyncio
+
+from telethon import functions, types
+
+from app.repost_engine import RepostOptions, delete_copies, plan_repost, run_repost
+from app.tgutil import button_url, is_callback_button, utf16_len
+
+from .dbutil import db_url_for, fresh_db
+from .fakes import (
+    FakeChannelClient,
+    cb_btn,
+    make_msg,
+    markup,
+    photo_media,
+    quote,
+    rpc,
+    service_msg,
+    url_btn,
+    video_media,
+)
+
+OLD, NEW = "oldbot", "goku"
+Q_TEXT = "Click the button below 👇"
+CAP = "Caption 😀 with link"
+TYPED = "see https://t.me/oldbot?start=Q done"
+
+
+def build():
+    """A little channel: pure posts, button posts, hyperlinks, an album, a typed link, a service message."""
+    typed_bold = types.MessageEntityBold(TYPED.index("done"), 4)
+    return {
+        1: make_msg(1, "Welcome", [types.MessageEntityBold(0, 7)]),
+        2: make_msg(
+            2,
+            Q_TEXT,
+            [quote(0, utf16_len(Q_TEXT), True)],
+            markup(
+                [url_btn("Download Episode 1", f"https://t.me/{OLD}?start=AAA")],
+                [url_btn("Other", "https://example.com/x"), cb_btn("👍 3", b"r1")],
+            ),
+        ),
+        3: make_msg(
+            3, CAP, [types.MessageEntityBold(0, 7), types.MessageEntityTextUrl(16, 4, "https://t.me/OldBot?start=ZZZ")],
+            media=photo_media(31),
+        ),
+        4: make_msg(4, "", media=photo_media(41), grouped_id=50),
+        5: make_msg(5, "album caption", [types.MessageEntityItalic(0, 5)], media=photo_media(42), grouped_id=50),
+        6: service_msg(6),
+        8: make_msg(8, "Movie", markup=markup([url_btn("Get", f"https://t.me/{OLD}?start=VVV")]), media=video_media(81)),
+        9: make_msg(9, TYPED, [typed_bold]),
+        10: make_msg(10, "Bye", [types.MessageEntityItalic(0, 3)]),
+    }
+
+
+async def setup(tmp_path, chan=None, **mig_kw):
+    db = await fresh_db(db_url_for(tmp_path))
+    await db.save_channel(1, 5, "Test", "testch", 99)
+    ch = await db.get_channel(1)
+    chan = chan or FakeChannelClient(build())
+    kw = dict(old=OLD, new=NEW, include_typed=True, include_posts=False, first_id=1, last_id=max(chan.msgs), partial=False, user_id=99)
+    kw.update(mig_kw)
+    await db.create_migration("m1", 1, **kw)
+    return db, ch, chan, await db.get_migration("m1")
+
+
+def edit_requests(chan):
+    return [r for r in chan.requests if isinstance(r, functions.messages.EditMessageRequest)]
+
+
+def forwarded_ids(chan):
+    return [list(r.id) for r in chan.requests if isinstance(r, functions.messages.ForwardMessagesRequest)]
+
+
+def test_plan_counts(tmp_path):
+    async def run():
+        db, ch, chan, _ = await setup(tmp_path)
+        plan = await plan_repost(chan, ch, RepostOptions(OLD, NEW))
+        assert (plan.first, plan.last, plan.error) == (1, 10, None)
+        assert (plan.units, plan.messages, plan.albums, plan.service) == (7, 8, 1, 1)
+        assert (plan.text, plan.media) == (4, 4)
+        assert plan.link_posts == 4 and (plan.n_buttons, plan.n_links, plan.n_typed) == (2, 1, 1)
+        assert plan.dropped_posts == 1  # post 2 carries somebody else's 👍 button
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_pure_posts_are_forwarded_and_button_posts_are_created_with_their_buttons(tmp_path):
+    async def run():
+        db, ch, chan, mig = await setup(tmp_path)
+        res = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert (res.copied_units, res.copied_messages, res.failed, res.aborted) == (7, 8, [], None)
+        assert (res.forwarded, res.rebuilt, res.repaired) == (3, 4, 0)
+        # only posts that need no change are copied by Telegram ...
+        assert forwarded_ids(chan) == [[1], [4, 5], [10]]
+        # ... and nothing was ever edited afterwards: buttons are part of the request that creates the post
+        assert edit_requests(chan) == []
+
+        new = {i: m for i, m in chan.msgs.items() if i > 10}
+        assert list(new) == list(range(11, 19))  # same order as the originals
+        # 11 = Welcome (forwarded, untouched)
+        assert new[11].message == "Welcome" and isinstance(new[11].entities[0], types.MessageEntityBold)
+        # 12 = the button post: final text, expandable quote kept, link button swapped, foreign button dropped
+        m = new[12]
+        assert m.message == Q_TEXT
+        assert isinstance(m.entities[0], types.MessageEntityBlockquote) and m.entities[0].collapsed
+        rows = m.reply_markup.rows
+        assert len(rows) == 2 and len(rows[0].buttons) == 1 and len(rows[1].buttons) == 1
+        assert button_url(rows[0].buttons[0]) == f"https://t.me/{NEW}?start=AAA"
+        assert rows[0].buttons[0].text == "Download Episode 1"
+        assert button_url(rows[1].buttons[0]) == "https://example.com/x"
+        assert not any(is_callback_button(b) for r in rows for b in r.buttons)
+        # 13 = photo with a hyperlink to the old name: media re-sent by reference, link swapped, bold kept
+        m = new[13]
+        assert m.message == CAP and m.media.photo.id == 31
+        ents = {type(e).__name__: e for e in m.entities}
+        assert ents["MessageEntityTextUrl"].url == f"https://t.me/{NEW}?start=ZZZ" and ents["MessageEntityTextUrl"].offset == 16
+        assert ents["MessageEntityBold"].length == 7
+        # 14, 15 = the album, forwarded as one unit with a new shared group id
+        assert new[14].grouped_id and new[14].grouped_id == new[15].grouped_id != 50
+        assert new[15].message == "album caption"
+        # 16 = video with a button; 17 = typed link swapped and the bold span moved with the text
+        assert new[16].media.document.id == 81 and button_url(new[16].reply_markup.rows[0].buttons[0]) == f"https://t.me/{NEW}?start=VVV"
+        assert new[17].message == TYPED.replace(OLD, NEW)
+        b = new[17].entities[0]
+        assert new[17].message.encode("utf-16-le")[b.offset * 2 : (b.offset + b.length) * 2].decode("utf-16-le") == "done"
+        assert new[18].message == "Bye"
+
+        # everything is registered in My posts exactly as it looks in the channel
+        done = await db.migration_done_old_ids("m1")
+        assert done == {1, 2, 3, 4, 5, 8, 9, 10}
+        p12 = await db.find_by_message(1, 12)
+        assert p12.source == "bot" and p12.status == "sent" and p12.text == Q_TEXT
+        assert p12.buttons == [
+            [{"t": "Download Episode 1", "u": f"https://t.me/{NEW}?start=AAA"}],
+            [{"t": "Other", "u": "https://example.com/x"}],
+        ]
+        p13 = await db.find_by_message(1, 13)
+        assert p13.media_kind == "photo" and p13.media_file_id.startswith("tl:")
+        assert (await db.migration_counts("m1"))["copied"] == 8
+        # the originals are untouched
+        assert all(i in chan.msgs for i in (1, 2, 3, 4, 5, 8, 9, 10))
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_channel_that_forbids_forwarding_gets_everything_rebuilt(tmp_path):
+    async def run():
+        chan = FakeChannelClient(build())
+        chan.restrict_forwards = True
+        db, ch, chan, mig = await setup(tmp_path, chan)
+        res = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert (res.copied_units, res.failed, res.forwarded, res.rebuilt) == (7, [], 0, 7)
+        assert len(forwarded_ids(chan)) == 1  # tried once, then remembered that it is not allowed
+        new = {i: m for i, m in chan.msgs.items() if i > 10}
+        assert [new[i].message for i in sorted(new)] == [
+            "Welcome", Q_TEXT, CAP, "", "album caption", "Movie", TYPED.replace(OLD, NEW), "Bye",
+        ]
+        a, b = new[14], new[15]
+        assert a.grouped_id == b.grouped_id and a.media.photo.id == 41 and b.media.photo.id == 42
+        assert isinstance(b.entities[0], types.MessageEntityItalic)
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_a_keyboard_that_is_not_shown_is_noticed_and_repaired(tmp_path):
+    async def run():
+        chan = FakeChannelClient(build())
+        chan.hide_keyboard_on_create = 1  # Telegram "forgets" the keyboard of the next button post
+        db, ch, chan, mig = await setup(tmp_path, chan)
+        res = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert res.failed == [] and res.copied_units == 7 and res.repaired == 1
+        live = chan.msgs[12].reply_markup
+        assert live is not None and button_url(live.rows[0].buttons[0]) == f"https://t.me/{NEW}?start=AAA"
+        # Telegram said "not modified" to the plain edit, so the two-step edit was needed (a stand-in, then the real one)
+        assert len(chan.edits) == 2
+        assert button_url(chan.edits[0].reply_markup.rows[0].buttons[0]) == "https://t.me/telegram"
+        assert chan.edits[1].reply_markup is not None
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_a_copy_that_never_shows_its_buttons_is_removed_and_the_original_kept(tmp_path):
+    async def run():
+        chan = FakeChannelClient(build())
+        chan.drop_all_markup = True
+        db, ch, chan, mig = await setup(tmp_path, chan)
+        res = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert res.failed == [(2, "ButtonsNotShown"), (8, "ButtonsNotShown")] and res.aborted is None
+        assert res.copied_units == 5
+        # no copy of the failed posts is left, and they are not registered
+        assert sorted(i for i in chan.msgs if i > 10 and chan.msgs[i].message in (Q_TEXT, "Movie")) == []
+        done = await db.migration_done_old_ids("m1")
+        assert 2 not in done and 8 not in done and {1, 3, 4, 5, 9, 10} <= done
+        assert 2 in chan.msgs and 8 in chan.msgs and chan.msgs[2].reply_markup is not None
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_stop_then_continue_copies_nothing_twice(tmp_path):
+    async def run():
+        db, ch, chan, mig = await setup(tmp_path)
+        seen = []
+
+        async def progress(r):
+            seen.append(r.copied_units)
+
+        res = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0, progress=progress, should_stop=lambda: len(seen) >= 3)
+        assert res.stopped and res.copied_units == 3
+        res2 = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert not res2.stopped and res2.skipped_done == 3 and res2.copied_units == 4
+        texts = [m.message for i, m in sorted(chan.msgs.items()) if i > 10]
+        assert texts.count("Welcome") == 1 and texts.count("Bye") == 1 and len(texts) == 8
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_a_fatal_telegram_error_stops_the_run(tmp_path):
+    async def run():
+        chan = FakeChannelClient(build())
+        chan.fail["SendMessageRequest"] = rpc("ChatWriteForbiddenError")
+        db, ch, chan, mig = await setup(tmp_path, chan)
+        res = await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert res.aborted == "ChatWriteForbiddenError" and res.copied_units == 1  # only the forwarded first post
+        await db.close()
+
+    asyncio.run(run())
+
+
+# ------------------------------------------------------------------------------------------ deleting
+async def copied(tmp_path, chan=None):
+    db, ch, chan, mig = await setup(tmp_path, chan)
+    await run_repost(chan, db, ch, mig, 99, delay=0, settle_pause=0)
+    return db, ch, chan, await db.get_migration("m1")
+
+
+def test_delete_old_posts_with_the_bot_alone(tmp_path):
+    async def run():
+        db, ch, chan, mig = await copied(tmp_path)
+        res = await delete_copies(chan, db, ch, mig, "old", delay=0)
+        assert (res.deleted, res.remaining, res.error, res.by_userbot, res.blocked) == (8, 0, None, 0, False)
+        assert sorted(chan.msgs) == [6] + list(range(11, 19))
+        assert await db.find_by_message(1, 2) is None  # nothing left of the old posts in the database
+        assert await db.find_by_message(1, 12) is not None  # the copies stay
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_old_posts_the_bot_cannot_delete_go_to_the_userbot(tmp_path):
+    async def run():
+        db, ch, chan, mig = await copied(tmp_path)
+        chan.undeletable = {1, 2, 3, 4, 5}  # "older than 48 hours" for the bot
+        calls = []
+
+        async def userbot(ids):
+            calls.append(list(ids))
+            for i in ids:
+                chan.msgs.pop(i, None)
+
+        res = await delete_copies(chan, db, ch, mig, "old", delay=0, fallback=userbot)
+        assert calls == [[1, 2, 3, 4, 5]]
+        assert (res.deleted, res.by_userbot, res.remaining, res.error, res.tried_userbot) == (8, 5, 0, None, True)
+        assert sorted(chan.msgs) == [6] + list(range(11, 19))
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_a_failing_userbot_is_reported_and_what_the_bot_could_delete_still_counts(tmp_path):
+    async def run():
+        db, ch, chan, mig = await copied(tmp_path)
+        chan.undeletable = {1, 2, 3, 4, 5}
+        calls = []
+
+        async def userbot(ids):
+            calls.append(ids)
+            raise RuntimeError("the userbot is banned here")
+
+        res = await delete_copies(chan, db, ch, mig, "old", delay=0, fallback=userbot)
+        assert res.deleted == 3 and res.remaining == 5 and res.by_userbot == 0
+        assert res.fallback_error == "the userbot is banned here" and res.blocked and res.error is None
+        assert len(calls) == 1
+        await db.close()
+
+    asyncio.run(run())
+
+
+def many_messages(n):
+    return {i: make_msg(i, f"post {i}") for i in range(1, n + 1)}
+
+
+def test_an_undeletable_batch_does_not_stop_the_newer_ones(tmp_path):
+    async def run():
+        chan = FakeChannelClient(many_messages(250))
+        db, ch, chan, mig = await setup(tmp_path, chan, old=None, new=None)
+        rows = [{"old_id": i, "new_id": 1000 + i, "post": {"text": "x", "entities": [], "buttons": [], "media_kind": None, "media_file_id": None, "link_preview": False}} for i in range(1, 251)]
+        await db.record_repost("m1", 1, rows, 99)
+        chan.undeletable = set(range(1, 101))
+        res = await delete_copies(chan, db, ch, mig, "old", delay=0)
+        assert len(chan.delete_requests) == 3  # all three batches were tried
+        assert (res.deleted, res.remaining, res.blocked, res.error) == (150, 100, True, None)
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_missing_delete_right_stops_after_the_first_batch(tmp_path):
+    async def run():
+        chan = FakeChannelClient(many_messages(250))
+        db, ch, chan, mig = await setup(tmp_path, chan, old=None, new=None)
+        rows = [{"old_id": i, "new_id": 1000 + i, "post": {"text": "x", "entities": [], "buttons": [], "media_kind": None, "media_file_id": None, "link_preview": False}} for i in range(1, 251)]
+        await db.record_repost("m1", 1, rows, 99)
+        chan.delete_error = rpc("ChatAdminRequiredError")
+        res = await delete_copies(chan, db, ch, mig, "old", delay=0)
+        assert res.error == "ChatAdminRequiredError" and res.deleted == 0 and len(chan.delete_requests) == 1
+
+        # with a userbot that can do it, the bot's missing right is no problem
+        async def userbot(ids):
+            for i in ids:
+                chan.msgs.pop(i, None)
+
+        res = await delete_copies(chan, db, ch, mig, "old", delay=0, fallback=userbot)
+        assert (res.deleted, res.by_userbot, res.remaining, res.error) == (250, 250, 0, None)
+        await db.close()
+
+    asyncio.run(run())
+
+
+def test_undo_removes_only_the_copies(tmp_path):
+    async def run():
+        db, ch, chan, mig = await copied(tmp_path)
+        res = await delete_copies(chan, db, ch, mig, "new", delay=0)
+        assert res.deleted == 8 and res.remaining == 0
+        assert sorted(chan.msgs) == [1, 2, 3, 4, 5, 6, 8, 9, 10]
+        await db.close()
+
+    asyncio.run(run())

tests/test_repost_flow.py

@@ -0,0 +1,585 @@
+"""/repost as the owner experiences it: pick the channel with buttons, check the plan, copy, then delete the old
+posts (by the bot, or by the userbot when the bot is not allowed to)."""
+import asyncio
+from types import SimpleNamespace
+
+from app.tgutil import button_url
+from app.userbot import Userbot
+
+from .fakes import FakeUserClient, make_msg
+from .harness import App, norm
+from .test_repost import NEW, OLD, build
+
+OLD_IDS = {1, 2, 3, 4, 5, 8, 9, 10}  # the posts of build() that /repost copies (6 is a service message)
+
+
+def fill(tg, msgs):
+    tg.msgs = dict(msgs)
+    tg._top = max(msgs, default=0)
+    for m in msgs.values():
+        tg._remember_media(m)
+
+
+async def make_app(tmp_path, msgs=None, **cfg):
+    cfg.setdefault("edit_delay", 0.0)
+    app = App(tmp_path, **cfg)
+    await app.start()
+    await app.db.save_channel(1, 5, "Test", "testch", 1)
+    fill(app.tg, build() if msgs is None else msgs)
+    return app
+
+
+def buttons_text(app):
+    return " | ".join(t for row in app.out.last_buttons() for t in row)
+
+
+async def pick(app, args=f"@{OLD} @{NEW}"):
+    await app.text(f"/repost {args}".strip())
+    await app.press(app.out.callback_data("Test"))
+
+
+async def copy_all(app):
+    await pick(app)
+    await app.press(app.out.callback_data("Start copying"))
+
+
+def migration_id(app):
+    return app.out.callback_data("Undo").split(":")[1]
+
+
+# ---------------------------------------------------------------------------------------- choosing
+def test_usage_does_not_mention_the_channel_option_any_more(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.text("/repost")
+        text = norm(app.out.last_text)
+        assert "Usage" in text and "--channel" not in text and "buttons" in text
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_the_old_channel_option_is_explained_not_obeyed(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.text(f"/repost @{OLD} @{NEW} --channel @testch")
+        assert "no longer takes --channel" in norm(app.out.last_text)
+        assert app.tg.requests == []  # nothing was read or posted
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_connected_channels_are_offered_as_buttons(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.db.save_channel(2, 6, "Second channel", None, 1)
+        await app.text(f"/repost @{OLD} @{NEW}")
+        text = norm(app.out.last_text)
+        assert "Which channel" in text and f"@{OLD}" in text and f"@{NEW}" in text
+        labels = [row[0] for row in app.out.last_buttons()]
+        assert labels == ["📢 Second channel", "📢 Test", "✖️ Cancel"]  # by title, like /channels
+        assert app.out.callback_data("Second").startswith("rpch:")
+        assert app.tg.requests == []  # choosing is free: nothing is read before a button is pressed
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_without_usernames_the_posts_are_copied_without_changing_links(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.text("/repost")
+        assert "Usage" in norm(app.out.last_text)
+        await app.text("/repost --last 4")
+        assert "copy without changing any link" in norm(app.out.last_text) and "newest 4" in norm(app.out.last_text)
+        await app.press(app.out.callback_data("Test"))
+        assert "Repost plan" in norm(app.out.last_text) and "Trial run" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_no_registered_channel_is_explained(tmp_path):
+    async def run():
+        app = App(tmp_path)
+        await app.start()
+        await app.text(f"/repost @{OLD} @{NEW}")
+        assert "No channels registered" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_bad_arguments(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        for bad, part in [
+            (f"@{OLD}", "both usernames"),
+            (f"@{OLD} @{OLD}", "are the same"),
+            ("@a-b @c", "Usernames look like"),
+            ("--last x", "--last needs a number"),
+            ("--wat", "Unknown option"),
+        ]:
+            await app.text(f"/repost {bad}")
+            assert part in norm(app.out.last_text), (bad, norm(app.out.last_text))
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_the_list_can_be_cancelled_and_then_no_longer_works(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.text(f"/repost @{OLD} @{NEW}")
+        pick_data = app.out.callback_data("Test")
+        await app.press(app.out.callback_data("Cancel"))
+        assert "Cancelled" in norm(app.out.last_text)
+        await app.press(pick_data)
+        assert "expired" in norm(app.out.last_text)
+        assert app.tg.requests == []
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_a_forged_or_old_button_is_refused(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.press("rpch:deadbeef:1")
+        assert "expired" in norm(app.out.last_text)
+        await app.press("rpa:deadbeef")
+        assert "expired" in norm(app.out.last_text)
+        await app.press("rpdy:nosuch")
+        assert "don't know that repost" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_only_the_owner_can_use_it(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, admins=frozenset({7}))
+        app.uid = 7  # an allowed helper account, but not an owner
+        await app.text(f"/repost @{OLD} @{NEW}")
+        assert "private" in norm(app.out.last_text)
+        # a list made by the owner can't be used by somebody else, even by pressing the same button
+        app.uid = 1
+        await app.text(f"/repost @{OLD} @{NEW}")
+        data = app.out.callback_data("Test")
+        app.uid = 7
+        await app.press(data)
+        assert "Only the bot owner" in norm(app.out.last_text)
+        await app.press("rpdy:whatever")
+        assert "Only the bot owner" in norm(app.out.last_text)
+        assert app.tg.requests == []
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_the_bot_needs_the_post_right(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        app.tg.rights = dict(admin=True, post=False, edit=True, delete=True, invite=False, add_admins=False)
+        await pick(app)
+        assert "Post messages" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_another_long_job_blocks_a_new_plan(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.text(f"/repost @{OLD} @{NEW}")
+        data = app.out.callback_data("Test")
+        await app.ctx.lock.acquire()
+        await app.press(data)
+        assert "still running" in norm(app.out.last_text)
+        app.ctx.lock.release()
+        await app.press(data)  # the list is still valid afterwards
+        assert "Repost plan" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+# ------------------------------------------------------------------------------------------ plan
+def test_the_plan_describes_what_will_happen(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await pick(app)
+        text = norm(app.out.last_text)
+        assert "Repost plan - Test" in text
+        assert "7 posts to copy (8 messages, 1 album(s))" in text
+        assert f"@{OLD} → @{NEW} in 4 post(s): 2 button link(s), 1 hyperlink(s), 1 typed link(s)" in text
+        assert "1 service message(s)" in text
+        assert "1 post(s) carry other bots' buttons" in text
+        assert "read back" in text and "Nothing is deleted in this step" in text
+        assert app.out.last_buttons() == [["▶️ Start copying", "✖️ Cancel"]]
+        # planning only reads: nothing was copied, posted or deleted
+        assert app.tg.requests and not any(
+            type(r).__name__ in ("ForwardMessagesRequest", "SendMessageRequest", "SendMediaRequest", "DeleteMessagesRequest")
+            for r in app.tg.requests
+        )
+        assert sorted(app.tg.msgs) == sorted(build())  # reading changed nothing
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_plan_of_an_empty_channel(tmp_path):
+    async def run():
+        app = await make_app(tmp_path, msgs={})
+        await pick(app)
+        assert "⚠️" in norm(app.out.last_text) and "Start copying" not in buttons_text(app)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+# ---------------------------------------------------------------------------------- copy and result
+def test_copy_everything_and_look_at_the_result(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        text = norm(app.out.last_text)
+        assert "Test: all posts copied in order" in text and f"@{OLD} → @{NEW}" in text
+        assert "8 messages are now at the end of the channel" in text
+        assert "3 post(s) were copied by Telegram, 4 were posted again with their buttons" in text
+        assert "Delete the old posts" in buttons_text(app) and "Undo" in buttons_text(app)
+        # the channel: the originals are untouched and the 8 copies follow in order
+        assert OLD_IDS <= set(app.tg.msgs)
+        new = [app.tg.msgs[i] for i in sorted(app.tg.msgs) if i > 10]
+        assert [m.message for m in new][0] == "Welcome" and [m.message for m in new][-1] == "Bye"
+        with_buttons = [m for m in new if m.reply_markup is not None]
+        assert len(with_buttons) == 2
+        assert button_url(with_buttons[0].reply_markup.rows[0].buttons[0]) == f"https://t.me/{NEW}?start=AAA"
+        mig = await app.db.get_migration(migration_id(app))
+        assert mig.status == "copied" and not mig.partial
+        # every copy is in My posts
+        assert (await app.db.migration_counts(mig.id))["copied"] == 8
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_a_second_press_on_start_does_not_copy_twice(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await pick(app)
+        start = app.out.callback_data("Start copying")
+        await app.press(start)
+        n = len(app.tg.msgs)
+        await app.press(start)
+        assert "expired" in norm(app.out.last_text)
+        assert len(app.tg.msgs) == n
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_an_unfinished_repost_is_offered_again_and_blocks_a_second_one(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await pick(app)
+        await app.press(app.out.callback_data("Start copying"))
+        mid = migration_id(app)
+        # the copy is finished but the old posts are not decided yet: /repost shows where things stand
+        await app.db.set_migration_status(mid, "stopped")
+        await app.text("/repost")
+        text = norm(app.out.last_text)
+        assert "Unfinished repost" in text and "stopped" in text and "Continue" in buttons_text(app)
+        await app.text(f"/repost @{OLD} @{NEW}")
+        await app.press(app.out.callback_data("Test"))
+        assert "unfinished repost for this channel" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_continue_after_a_stop_finishes_the_job_without_copying_twice(tmp_path):
+    async def run():
+        from app.repost_engine import run_repost
+
+        app = await make_app(tmp_path)
+        ch = await app.db.get_channel(1)
+        await app.db.create_migration(
+            "mig1", 1, old=OLD, new=NEW, include_typed=True, include_posts=False, first_id=1, last_id=10, partial=False, user_id=1
+        )
+        mig = await app.db.get_migration("mig1")
+        seen = []
+
+        async def progress(r):
+            seen.append(r.copied_units)
+
+        res = await run_repost(app.tg, app.db, ch, mig, 1, delay=0, settle_pause=0, progress=progress, should_stop=lambda: len(seen) >= 3)
+        assert res.stopped and res.copied_units == 3
+        await app.db.set_migration_status("mig1", "stopped")
+        await app.text("/repost")
+        assert "Continue" in buttons_text(app)
+        await app.press(app.out.callback_data("Continue"))
+        assert "all posts copied in order" in norm(app.out.last_text)
+        texts = [m.message for i, m in sorted(app.tg.msgs.items()) if i > 10]
+        assert len(texts) == 8 and texts.count("Welcome") == 1
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_stop_button_without_a_running_job(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.press("rps:nothing")
+        assert "Nothing is running" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_a_failed_copy_is_reported_and_can_be_retried(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        app.tg.drop_all_markup = True  # Telegram never shows the keyboards
+        await copy_all(app)
+        text = norm(app.out.last_text)
+        assert "not everything was copied" in text
+        assert "2 post(s) failed" in text and "ButtonsNotShown" in text
+        assert "Try the rest again" in buttons_text(app) and "Delete the old posts" not in buttons_text(app)
+        # the failed posts left no copy behind
+        assert not [m for i, m in app.tg.msgs.items() if i > 10 and m.message in ("Movie",)]
+        # once Telegram behaves, "try the rest again" completes the job
+        app.tg.drop_all_markup = False
+        await app.press(app.out.callback_data("Try the rest again"))
+        assert "all posts copied in order" in norm(app.out.last_text)
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+# ----------------------------------------------------------------------------- deleting old posts
+def test_delete_old_posts_with_the_bot_alone(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        mid = migration_id(app)
+        await app.press(app.out.callback_data("Delete the old posts"))
+        text = norm(app.out.last_text)
+        assert "Delete 8 old message(s)" in text and "can't be undone" in text
+        await app.press(app.out.callback_data("Yes, delete 8"))
+        text = norm(app.out.last_text)
+        assert "Done. 8 old message(s) deleted" in text and "by the userbot" not in text
+        assert sorted(app.tg.msgs) == [6] + list(range(11, 19))
+        assert (await app.db.get_migration(mid)).status == "old_deleted"
+        assert await app.db.open_migration() is None
+        # the copies are the channel now: still registered in My posts, the originals are not
+        assert await app.db.find_by_message(1, 12) is not None and await app.db.find_by_message(1, 2) is None
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_old_posts_the_bot_cannot_delete_are_explained_when_there_is_no_userbot(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        app.tg.undeletable = {1, 2, 3, 4, 5}  # "older than 48 hours" for the bot
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        text = norm(app.out.last_text)
+        assert "Deleted 3, 5 old message(s) are still there" in text
+        assert "userbot" in text and "/userbot" in text
+        assert "Try again" in buttons_text(app) and "Close this repost" in buttons_text(app)
+        assert sorted(i for i in app.tg.msgs if i <= 10) == [1, 2, 3, 4, 5, 6]
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def userbot_setup(app, *, bot_rights=None, username="helper_acct"):
+    """A real Userbot object wired to a simulated second account, plus the channel rights of the bot."""
+    app.tg.rights = bot_rights or dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=True)
+    app.tg.username = None  # a private channel: the only way in is an invite link
+    holder = {}
+
+    def factory(cfg):
+        holder["client"] = FakeUserClient(app.tg, username=username)
+        return holder["client"]
+
+    cfg = SimpleNamespace(userbot_session="SESSION", userbot_keep_admin=False, api_id=1, api_hash="x")
+    ub = Userbot(app.tg, cfg, client_factory=factory)
+    app.ctx.userbot = ub
+    return ub, holder
+
+
+def test_the_userbot_joins_promotes_deletes_and_then_steps_back(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        ub, holder = userbot_setup(app)
+        app.tg.undeletable = {1, 2, 3, 4, 5}
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        text = norm(app.out.last_text)
+        assert "Done. 8 old message(s) deleted (5 of them by the userbot)" in text
+        assert "made a one-time invite link" in text and "the userbot joined the channel" in text
+        assert "made the userbot an admin with only “Delete messages”" in text
+        assert "took the admin right away from the userbot again" in text
+        assert sorted(app.tg.msgs) == [6] + list(range(11, 19))
+        # the userbot only did what the bot could not
+        assert holder["client"].deleted == [[1, 2, 3, 4, 5]]
+        # nothing is left behind: no admin right, and the temporary link is revoked
+        assert app.tg.admins == {}
+        assert all(v["revoked"] for v in app.tg.invites.values()) and len(app.tg.invites) == 1
+        # the user's account stays a member (it was never asked to leave)
+        assert 777 in app.tg.members
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_the_userbot_is_not_touched_when_the_bot_can_delete_everything(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        ub, holder = userbot_setup(app)
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        assert "Done. 8 old message(s) deleted" in norm(app.out.last_text)
+        assert "by the userbot" not in norm(app.out.last_text)
+        # the helper account is only logged in; it joined nothing and did nothing
+        assert holder["client"].requests == [] and holder["client"].deleted == []
+        assert app.tg.invites == {} and app.tg.members == set() and app.tg.admins == {}
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_without_the_add_admins_right_the_owner_is_told_what_to_do(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        userbot_setup(app, bot_rights=dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=False))
+        app.tg.undeletable = {1, 2, 3, 4, 5}
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        text = norm(app.out.last_text)
+        assert "Deleted 3, 5 old message(s) are still there" in text
+        assert "Add new admins" in text
+        assert "Try again" in buttons_text(app)
+        assert app.tg.admins == {}
+        assert all(v["revoked"] for v in app.tg.invites.values())  # the link made for the userbot does not stay open
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_try_again_after_fixing_the_rights_finishes_the_job(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        userbot_setup(app, bot_rights=dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=False))
+        app.tg.undeletable = {1, 2, 3, 4, 5}
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        assert "Try again" in buttons_text(app)
+        app.tg.rights = dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=True)  # the owner fixed it
+        await app.press(app.out.callback_data("Try again"))
+        text = norm(app.out.last_text)
+        assert "Done. 5 old message(s) deleted (5 of them by the userbot)" in text
+        assert sorted(app.tg.msgs) == [6] + list(range(11, 19))
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_close_this_repost_after_deleting_by_hand(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        mid = migration_id(app)
+        app.tg.undeletable = {1, 2, 3, 4, 5}
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        await app.press(app.out.callback_data("Close this repost"))
+        assert "Closed" in norm(app.out.last_text)
+        assert (await app.db.get_migration(mid)).status == "closed"
+        assert await app.db.open_migration() is None
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+# ----------------------------------------------------------------------------------------- undo
+def test_undo_removes_the_copies_and_keeps_the_originals(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        await app.press(app.out.callback_data("Undo"))
+        assert "Remove the 8 copied message(s)" in norm(app.out.last_text)
+        await app.press(app.out.callback_data("Yes, remove the copies"))
+        assert "8 copied message(s) removed" in norm(app.out.last_text)
+        assert sorted(app.tg.msgs) == sorted(build())
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_undo_is_not_offered_once_originals_are_gone(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await copy_all(app)
+        mid = migration_id(app)
+        await app.press(app.out.callback_data("Delete the old posts"))
+        await app.press(app.out.callback_data("Yes, delete"))
+        await app.press(f"rpu:{mid}")
+        assert "Undo is not possible" in norm(app.out.last_text) or "already deleted" in norm(app.out.last_text)
+        await app.press(f"rpuy:{mid}")
+        assert "Undo is not possible" in norm(app.out.last_text)
+        assert [i for i in app.tg.msgs if i > 10] == list(range(11, 19))  # the copies are safe
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+
+def test_trial_run_can_be_removed_or_kept(tmp_path):
+    async def run():
+        app = await make_app(tmp_path)
+        await app.text(f"/repost @{OLD} @{NEW} --last 3")
+        await app.press(app.out.callback_data("Test"))
+        assert "Trial run" in norm(app.out.last_text)
+        await app.press(app.out.callback_data("Start copying"))
+        text = norm(app.out.last_text)
+        assert "trial finished" in text and "Delete the old posts" not in buttons_text(app)
+        mid = migration_id(app)
+        close = app.out.callback_data("Close, keep the copies")
+        # a trial never offers to delete the old posts, even by a hand-made button press
+        await app.press(f"rpd:{mid}")
+        assert "complete, successful copy" in norm(app.out.last_text)
+        await app.press(f"rpdy:{mid}")
+        assert "complete, successful copy" in norm(app.out.last_text)
+        assert OLD_IDS <= set(app.tg.msgs)  # nothing was deleted
+        await app.press(close)
+        assert "Closed" in norm(app.out.last_text)
+        assert await app.db.open_migration() is None
+        await app.db.close()
+
+    asyncio.run(run())
+
+
+def test_messages_posted_during_the_plan_are_not_part_of_it(tmp_path):
+    async def run():
+        msgs = {i: make_msg(i, f"post {i}") for i in range(1, 6)}
+        app = await make_app(tmp_path, msgs=msgs)
+        await pick(app)
+        start = app.out.callback_data("Start copying")
+        app.tg.msgs[6] = make_msg(6, "posted while the plan was open")  # a new post appears
+        app.tg._top = 6
+        await app.press(start)
+        copies = [m.message for i, m in sorted(app.tg.msgs.items()) if i > 6]
+        assert copies == [f"post {i}" for i in range(1, 6)]  # exactly what the plan showed
+        await app.db.close()
+
+    asyncio.run(run())

tests/test_startup.py

@@ -0,0 +1,163 @@
+"""bot.main(): start-up order, the command menu, the error log chat, the optional userbot, and what happens on a crash."""
+import asyncio
+import logging
+from types import SimpleNamespace
+
+import pytest
+from telethon import functions, types
+
+import bot
+from app.config import Config
+from app.errorlog import TelegramLogHandler
+
+from .harness import FakeTG
+
+CHAT = -1002525172451
+TOKEN = "123456:ABCdefGHIjklMNOpqrSTUvwxYZ"
+
+
+class StartupTG(FakeTG):
+    """The bot's connection with the few extra methods main() uses."""
+
+    def __init__(self, *, start_error=None, log_chat_known=True):
+        super().__init__()
+        self.start_error = start_error
+        self.connected = True
+        self.authorized = True
+        self.calls = []
+        self.menu = None
+        if log_chat_known:
+            self.known_users[CHAT] = SimpleNamespace(id=2525172451, access_hash=7)
+
+    async def start(self, bot_token=None):
+        self.calls.append(("start", bot_token))
+        if self.start_error:
+            raise self.start_error
+
+    async def get_me(self):
+        return SimpleNamespace(username="personalbuttonbot", id=42)
+
+    async def run_until_disconnected(self):
+        self.calls.append(("run", None))
+
+    def is_connected(self):
+        return self.connected
+
+    async def connect(self):
+        self.connected = True
+        self.calls.append(("connect", None))
+
+    async def is_user_authorized(self):
+        return self.authorized
+
+    async def sign_in(self, bot_token=None):
+        self.authorized = True
+        self.calls.append(("sign_in", bot_token))
+
+    async def __call__(self, req):
+        if isinstance(req, functions.bots.SetBotCommandsRequest):
+            self.menu = [(c.command, c.description) for c in req.commands]
+            return True
+        return await super().__call__(req)
+
+    async def get_input_entity(self, peer):
+        if isinstance(peer, int) and peer in self.known_users:
+            return types.InputPeerChannel(2525172451, 7)
+        return await super().get_input_entity(peer)
+
+
+def make_cfg(tmp_path, **kw):
+    base = dict(
+        api_id=1, api_hash="hashhashhash", bot_token=TOKEN, owners=frozenset({1}), admins=frozenset(),
+        database_url=f"sqlite+aiosqlite:///{tmp_path}/main.db", db_pool="null", session_path=str(tmp_path / "s"),
+        session_string="", edit_delay=0.3, replace_typed_links=True, port=0, log_level="INFO", error_log_chat_id=CHAT,
+    )
+    base.update(kw)
+    return Config(**base)
+
+
+@pytest.fixture
+def run_main(monkeypatch):
+    """Runs bot.main() with the given config and connection; always removes the log handler main() installs."""
+
+    def go(cfg, tg):
+        monkeypatch.setattr(bot, "load_config", lambda: cfg)
+        monkeypatch.setattr(bot, "build_client", lambda c: tg)
+        root = logging.getLogger()
+        before = list(root.handlers)
+        try:
+            asyncio.run(bot.main())
+        finally:
+            for h in list(root.handlers):
+                if h not in before and isinstance(h, TelegramLogHandler):
+                    root.removeHandler(h)
+
+    return go
+
+
+def test_normal_start_up(tmp_path, run_main):
+    tg = StartupTG()
+    run_main(make_cfg(tmp_path), tg)
+    assert tg.calls == [("start", TOKEN), ("run", None)]
+    assert tg.menu == [(c, d) for c, d in bot.COMMANDS]
+    names = [c for c, _ in tg.menu]
+    assert "repost" in names and "userbot" in names and "testerror" in names
+    assert "testedit" not in names and "selftest" not in names
+    assert tg.handlers  # every module registered its handlers
+    assert tg.sent == []  # nothing needed reporting
+
+
+def test_a_log_chat_the_bot_is_not_in_does_not_stop_it(tmp_path, run_main, caplog):
+    tg = StartupTG(log_chat_known=False)
+    with caplog.at_level(logging.INFO):
+        run_main(make_cfg(tmp_path), tg)
+    assert ("run", None) in tg.calls
+    assert any("errors cannot be sent to chat" in r.getMessage() and "add the bot to that chat" in r.getMessage() for r in caplog.records)
+
+
+def test_log_chat_can_be_switched_off(tmp_path, run_main, caplog):
+    tg = StartupTG(log_chat_known=False)
+    with caplog.at_level(logging.INFO):
+        run_main(make_cfg(tmp_path, error_log_chat_id=None), tg)
+    assert ("run", None) in tg.calls and any("error log chat: off" in r.getMessage() for r in caplog.records)
+
+
+def test_a_broken_userbot_session_does_not_stop_the_bot(tmp_path, run_main, caplog):
+    tg = StartupTG()
+    with caplog.at_level(logging.INFO):
+        run_main(make_cfg(tmp_path, userbot_session="this is not a session"), tg)
+    assert ("run", None) in tg.calls
+    assert any("the userbot is not available" in r.getMessage() for r in caplog.records)
+
+
+def test_the_health_endpoint_is_started_when_a_port_is_set(tmp_path, run_main, caplog):
+    import socket
+
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        port = s.getsockname()[1]
+    tg = StartupTG()
+    with caplog.at_level(logging.INFO):
+        run_main(make_cfg(tmp_path, port=port), tg)
+    assert any(f"health endpoint listening on :{port}" in r.getMessage() for r in caplog.records)
+
+
+def test_a_crash_is_reported_to_the_log_chat_and_still_raised(tmp_path, run_main):
+    tg = StartupTG(start_error=RuntimeError("login failed for 123456:ABCdefGHIjklMNOpqrSTUvwxYZ"))
+    tg.connected = False  # the connection is gone when the crash happens
+    tg.authorized = False
+    with pytest.raises(RuntimeError, match="login failed"):
+        run_main(make_cfg(tmp_path), tg)
+    (kind, peer, text, kw), = tg.sent
+    assert text.startswith("The bot stopped because of an unhandled exception:\n\nTraceback (most recent call last):")
+    assert "RuntimeError: login failed for ***" in text and TOKEN not in text  # the token is never sent
+    ent, = kw["formatting_entities"]
+    assert isinstance(ent, types.MessageEntityPre) and ent.language == "python"
+    assert ("connect", None) in tg.calls and ("sign_in", TOKEN) in tg.calls  # it reconnected just to say this
+
+
+def test_a_crash_without_a_log_chat_is_just_raised(tmp_path, run_main):
+    tg = StartupTG(start_error=RuntimeError("boom"))
+    with pytest.raises(RuntimeError, match="boom"):
+        run_main(make_cfg(tmp_path, error_log_chat_id=None), tg)
+    assert tg.sent == []

tests/test_userbot.py

@@ -0,0 +1,459 @@
+"""The userbot: logging in, joining a channel by invite link, getting the "Delete messages" right, deleting, cleaning up."""
+import asyncio
+from types import SimpleNamespace
+
+import pytest
+from telethon import functions, types
+
+from app.userbot import Userbot, UserbotError, delete_problem_text, parse_invite_hash
+
+from .fakes import FakeChannelClient, FakeUserClient, make_msg, rpc
+
+FULL = dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=True)
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def channel(n=30, **kw):
+    bot = FakeChannelClient({i: make_msg(i, f"post {i}") for i in range(1, n + 1)}, username=kw.pop("username", None))
+    bot.rights = dict(kw.pop("rights", FULL))
+    return bot
+
+
+def ch_row(bot):
+    return SimpleNamespace(id=1, access_hash=5, title="Test", username=bot.username)
+
+
+def make_userbot(bot, *, keep_admin=False, session="SESSION", user=None, **user_kw):
+    made = {}
+
+    def factory(cfg):
+        made["client"] = user or FakeUserClient(bot, **user_kw)
+        return made["client"]
+
+    cfg = SimpleNamespace(userbot_session=session, userbot_keep_admin=keep_admin, api_id=1, api_hash="x")
+    return Userbot(bot, cfg, client_factory=factory), made
+
+
+# ------------------------------------------------------------------------------------------ helpers
+def test_parse_invite_hash():
+    assert parse_invite_hash("https://t.me/+AbCdEfGh0001") == "AbCdEfGh0001"
+    assert parse_invite_hash("t.me/+AbCdEfGh0001") == "AbCdEfGh0001"
+    assert parse_invite_hash("https://t.me/joinchat/AbCdEfGh-_01") == "AbCdEfGh-_01"
+    assert parse_invite_hash("tg://join?invite=AbCdEfGh0001") == "AbCdEfGh0001"
+    assert parse_invite_hash("https://telegram.me/+AbCdEfGh0001?x=1") == "AbCdEfGh0001"
+    assert parse_invite_hash("https://t.me/somechannel") is None
+    assert parse_invite_hash("") is None and parse_invite_hash(None) is None
+
+
+# --------------------------------------------------------------------------------------- logging in
+def test_not_set_up():
+    async def go():
+        bot = channel()
+        ub, made = make_userbot(bot, session="")
+        assert not ub.enabled and not ub.ready
+        assert await ub.connect() is False and "USERBOT_SESSION is not set" in ub.last_error
+        assert "not set up" in ub.describe()
+        assert await ub.fallback_for(ch_row(bot)) == (None, None)
+        assert made == {}  # nothing was even created
+
+    run(go())
+
+
+def test_connect_ok_and_describe():
+    async def go():
+        bot = channel()
+        ub, made = make_userbot(bot, username="helper_acct")
+        assert await ub.connect() is True and ub.ready and made["client"].connected
+        assert ub.describe() == "connected as @helper_acct (id 777)"
+        assert await ub.connect() is True  # a second call does nothing
+        fb, deleter = await ub.fallback_for(ch_row(bot))
+        assert fb == deleter.delete and bot.requests == []  # nothing happens in the channel until it is needed
+        await ub.close()
+        assert not ub.ready and not made["client"].connected
+
+    run(go())
+
+
+def test_connect_without_a_username_describes_the_name():
+    async def go():
+        bot = channel()
+        ub, _ = make_userbot(bot, username=None, first_name="Helper")
+        await ub.connect()
+        assert ub.describe() == "connected as Helper (id 777)"
+
+    run(go())
+
+
+def test_a_revoked_session_is_reported():
+    async def go():
+        bot = channel()
+        ub, made = make_userbot(bot, authorized=False)
+        assert await ub.connect() is False and not ub.ready
+        assert "not logged in any more" in ub.last_error and "make_userbot_session.py" in ub.last_error
+        assert not made["client"].connected  # it hangs up again
+        assert "not connected" in ub.describe() and "not logged in" in ub.describe()
+        assert await ub.fallback_for(ch_row(bot)) == (None, None)
+
+    run(go())
+
+
+def test_a_bot_session_is_refused():
+    async def go():
+        bot = channel()
+        ub, _ = make_userbot(bot, user=FakeUserClient(bot, bot=True))
+        assert await ub.connect() is False and "belongs to a bot" in ub.last_error
+
+    run(go())
+
+
+def test_a_connection_error_is_not_fatal():
+    async def go():
+        bot = channel()
+
+        class Broken(FakeUserClient):
+            async def connect(self):
+                raise ConnectionError("no route to host")
+
+        ub, _ = make_userbot(bot, user=Broken(bot))
+        assert await ub.connect() is False and "ConnectionError: no route to host" in ub.last_error
+
+    run(go())
+
+
+# ------------------------------------------------------------------------------------------ deleting
+async def ready_deleter(bot, **kw):
+    ub, made = make_userbot(bot, **kw)
+    assert await ub.connect()
+    return ub, made, ub.deleter(ch_row(bot))
+
+
+def test_private_channel_one_time_link_then_admin_then_clean_up():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot)
+        await d.delete([1, 2, 3])
+        user = made["client"]
+        assert sorted(bot.msgs)[:3] == [4, 5, 6] and user.deleted == [[1, 2, 3]]
+        # the link was made by the bot with a limit of one use and an expiry, and the userbot joined with it
+        (h, inv), = bot.invites.items()
+        assert inv["limit"] == 1 and inv["title"] == "Cleanup helper" and inv["expire"] is not None
+        assert inv["uses"] == 1 and 777 in bot.members
+        # promoted with exactly one right
+        rights = bot.admins[777]
+        assert rights.delete_messages and not any(
+            v for k, v in rights.to_dict().items() if k not in ("_", "delete_messages")
+        )
+        assert d.notes == [
+            "made a one-time invite link for the userbot",
+            "the userbot joined the channel",
+            "made the userbot an admin with only “Delete messages”",
+        ]
+        await d.close()
+        assert bot.admins == {} and inv["revoked"] is True
+        assert d.notes[-1] == "took the admin right away from the userbot again"
+        assert not ub.lock.locked()
+
+    run(go())
+
+
+def test_the_second_delete_reuses_the_prepared_channel():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot)
+        await d.delete([1, 2])
+        n = len(made["client"].requests)
+        await d.delete([3, 4])
+        # only the delete request was added: no second join, no second promotion
+        assert [type(r).__name__ for r in made["client"].requests[n:]] == ["DeleteMessagesRequest"]
+        assert len(bot.invites) == 1
+        await d.close()
+
+    run(go())
+
+
+def test_more_than_100_ids_are_sent_in_chunks_of_100():
+    async def go():
+        bot = channel(250)
+        ub, made, d = await ready_deleter(bot)
+        await d.delete(list(range(1, 251)))
+        await d.close()
+        assert [len(x) for x in made["client"].deleted] == [100, 100, 50] and bot.msgs == {}
+
+    run(go())
+
+
+def test_channels_own_invite_link_is_used_and_never_revoked():
+    async def go():
+        bot = channel(rights=dict(FULL, invite=False))  # the bot may not make links itself
+        bot.primary_invite = "https://t.me/+PrimaryLink01"
+        bot.invites["PrimaryLink01"] = dict(limit=0, uses=0, revoked=False, title=None, expire=None)
+        ub, made, d = await ready_deleter(bot)
+        await d.delete([1])
+        await d.close()
+        assert "used the channel's own invite link" in d.notes
+        assert bot.invites["PrimaryLink01"]["revoked"] is False  # it is not ours to revoke
+        assert 1 not in bot.msgs
+
+    run(go())
+
+
+def test_public_channel_is_joined_by_its_name_when_there_is_no_link():
+    async def go():
+        bot = channel(username="testch", rights=dict(FULL, invite=False))
+        ub, made, d = await ready_deleter(bot)
+        await d.delete([1, 2])
+        await d.close()
+        assert "the userbot joined the channel by its public name" in d.notes
+        assert any(isinstance(r, functions.channels.JoinChannelRequest) for r in made["client"].requests)
+        assert 1 not in bot.msgs and 2 not in bot.msgs
+
+    run(go())
+
+
+def test_private_channel_without_any_link_explains_what_to_do():
+    async def go():
+        bot = channel(rights=dict(FULL, invite=False))
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert "Invite users via link" in str(e.value) and "add the userbot to the channel yourself" in str(e.value)
+        await d.close()
+        assert not ub.lock.locked()
+
+    run(go())
+
+
+def test_an_expired_link_falls_back_to_the_public_name():
+    async def go():
+        bot = channel(username="testch")
+        ub, made, d = await ready_deleter(bot)
+        bot.fail["ExportChatInviteRequest"] = rpc("ChatAdminRequiredError")
+        bot.primary_invite = "https://t.me/+GoneGone0001"  # not in bot.invites: Telegram says the hash is invalid
+        await d.delete([1])
+        await d.close()
+        assert "the userbot joined the channel by its public name" in d.notes
+
+    run(go())
+
+
+def test_a_channel_that_wants_to_approve_new_members():
+    async def go():
+        bot = channel()
+        bot.require_approval = True
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert "approve" in str(e.value)
+        await d.close()
+        assert all(v["revoked"] for v in bot.invites.values())  # the link made for it does not stay around
+
+    run(go())
+
+
+@pytest.mark.parametrize(
+    "error,text",
+    [
+        ("ChannelsTooMuchError", "too many channels"),
+        ("UserChannelsTooMuchError", "too many channels"),
+        ("UserBannedInChannelError", "banned in this channel"),
+    ],
+)
+def test_join_problems_are_explained(error, text):
+    async def go():
+        bot = channel()
+        bot.fail["user:ImportChatInviteRequest"] = rpc(error)
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert text in str(e.value)
+        await d.close()
+
+    run(go())
+
+
+def test_userbot_already_in_the_channel_as_a_plain_member():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot)
+        made["client"]._join()  # a member from an earlier clean-up
+        await d.delete([1])
+        await d.close()
+        assert not any(isinstance(r, functions.messages.ImportChatInviteRequest) for r in made["client"].requests)
+        assert "the userbot joined the channel" not in d.notes and bot.invites == {}
+        assert 1 not in bot.msgs
+
+    run(go())
+
+
+def test_userbot_that_may_already_delete_is_left_alone():
+    async def go():
+        bot = channel(rights=dict(FULL, invite=False, add_admins=False))
+        ub, made, d = await ready_deleter(bot)
+        made["client"]._join()
+        bot.admins[777] = types.ChatAdminRights(delete_messages=True)  # the owner made it an admin by hand
+        await d.delete([1, 2])
+        await d.close()
+        assert bot.admins[777].delete_messages  # still an admin: we did not make it one, so we do not take it away
+        assert d.notes == [] and bot.msgs.get(1) is None
+
+    run(go())
+
+
+def test_userbot_may_not_delete_and_the_bot_cannot_promote_it():
+    async def go():
+        bot = channel(rights=dict(FULL, add_admins=False))
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert "Add new admins" in str(e.value)
+        await d.close()
+        assert bot.admins == {} and 1 in bot.msgs
+
+    run(go())
+
+
+def test_promotion_refused_by_telegram():
+    async def go():
+        bot = channel()
+        bot.fail["EditAdminRequest"] = rpc("RightForbiddenError")
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert "RightForbiddenError" in str(e.value) and "may not give that right" in str(e.value)
+        await d.close()
+        assert bot.admins == {}
+
+    run(go())
+
+
+def test_the_bot_cannot_find_the_account_to_promote():
+    async def go():
+        bot = channel()
+        bot.participants_visible = False
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert "cannot find that account" in str(e.value)
+        await d.close()
+
+    run(go())
+
+
+def test_the_bot_knows_the_account_already():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot)
+        bot.known_users[777] = made["client"].me  # the bot has met this user before
+        bot.participants_visible = False
+        await d.delete([1])
+        await d.close()
+        assert 1 not in bot.msgs and bot.admins == {}
+
+    run(go())
+
+
+def test_keep_admin_keeps_the_right():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot, keep_admin=True)
+        await d.delete([1])
+        await d.close()
+        assert bot.admins[777].delete_messages  # USERBOT_KEEP_ADMIN=true
+        assert not any("took the admin right away" in n for n in d.notes)
+        assert next(iter(bot.invites.values()))["revoked"] is True  # the link is revoked either way
+
+    run(go())
+
+
+def test_failing_demotion_is_reported_not_fatal():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot)
+        await d.delete([1])
+        bot.fail["EditAdminRequest"] = rpc("ChatAdminRequiredError")
+        await d.close()
+        assert d.notes[-1] == "could not take the admin right away from the userbot - please do it by hand"
+        assert not ub.lock.locked()
+
+    run(go())
+
+
+def test_not_connected_userbot_cannot_delete():
+    async def go():
+        bot = channel()
+        ub, made = make_userbot(bot, authorized=False)
+        await ub.connect()
+        d = ub.deleter(ch_row(bot))
+        with pytest.raises(UserbotError) as e:
+            await d.delete([1])
+        assert "not connected" in str(e.value)
+
+    run(go())
+
+
+def test_clean_ups_of_two_channels_do_not_overlap():
+    async def go():
+        bot = channel()
+        ub, made = make_userbot(bot)
+        await ub.connect()
+        first, second = ub.deleter(ch_row(bot)), ub.deleter(ch_row(bot))
+        await first.delete([1])
+        order = []
+
+        async def other():
+            await second.delete([2])  # waits until the first clean-up is closed
+            order.append("second")
+            await second.close()
+
+        t = asyncio.create_task(other())
+        await asyncio.sleep(0.1)
+        assert order == [] and ub.lock.locked()
+        order.append("first closes")
+        await first.close()
+        await asyncio.wait_for(t, 5)
+        assert order == ["first closes", "second"] and not ub.lock.locked()
+
+    run(go())
+
+
+def test_a_failed_prepare_can_be_retried_without_a_deadlock():
+    async def go():
+        bot = channel(rights=dict(FULL, invite=False))
+        ub, made, d = await ready_deleter(bot)
+        with pytest.raises(UserbotError):
+            await d.delete([1])  # no way into the channel
+        bot.rights = dict(FULL)  # the owner fixed the rights
+        await asyncio.wait_for(d.delete([1]), 5)  # the same deleter tries again; it must not wait for its own lock
+        await d.close()
+        assert 1 not in bot.msgs and not ub.lock.locked()
+
+    run(go())
+
+
+def test_close_without_anything_done_is_harmless():
+    async def go():
+        bot = channel()
+        ub, made, d = await ready_deleter(bot)
+        await d.close()
+        await d.close()
+        assert bot.requests == [] and not ub.lock.locked()
+
+    run(go())
+
+
+# -------------------------------------------------------------------------------- words for the owner
+def test_delete_problem_text():
+    off = SimpleNamespace(enabled=False)
+    ready = SimpleNamespace(enabled=True, ready=True, last_error=None)
+    down = SimpleNamespace(enabled=True, ready=False, last_error="the session was revoked")
+    assert "see /userbot" in delete_problem_text(None)
+    assert "see /userbot" in delete_problem_text(off)
+    assert "the session was revoked" in delete_problem_text(down)
+    assert "tried as well" in delete_problem_text(ready, tried=True)
+    assert "The userbot could not help: boom" in delete_problem_text(ready, fallback_error="boom", tried=True)
+    t = delete_problem_text(ready, bot_error="ChatAdminRequiredError", tried=True)
+    assert t.startswith("Telegram refused the bot (ChatAdminRequiredError).")
+    assert "age limit" in delete_problem_text(ready)  # nothing else to say: a generic hint

tests/test_wire2.py

@@ -0,0 +1,199 @@
+"""The repost / delete / buttons / userbot flows through a REAL Telethon client object.
+
+Telethon resolves and serialises every request exactly as it does before sending it to Telegram; only the network at
+the very end is replaced by the simulated channel. A request that would not build or serialise in production fails here.
+"""
+import asyncio
+import datetime
+
+import pytest
+from telethon import TelegramClient, functions, types, utils
+from telethon.sessions import MemorySession
+
+from app.buttons_sync import ensure_markup, fix_buttons, scan_buttons
+from app.repost_engine import RepostOptions, delete_copies, plan_repost, run_repost
+from app.tgutil import build_markup, button_url, get_rights, peer_of
+from app.userbot import Userbot
+
+from .dbutil import db_url_for, fresh_db
+from .fakes import FakeChannelClient, FakeUserClient, make_msg, markup, url_btn
+from .test_repost import NEW, OLD, build
+
+
+@pytest.fixture()
+def wired(monkeypatch):
+    chan = FakeChannelClient(build())
+    chan.rights = dict(admin=True, post=True, edit=True, delete=True, invite=True, add_admins=True)
+    seen = []
+
+    async def fake_call(self, request, ordered=False, flood_sleep_threshold=None):
+        assert not isinstance(request, (list, tuple))
+        await request.resolve(self, utils)  # what Telethon does just before sending
+        seen.append(type(request).__name__)
+        return await chan(request)  # serialises again and answers like Telegram
+
+    monkeypatch.setattr(TelegramClient, "__call__", fake_call)
+    return TelegramClient(MemorySession(), 1, "h"), chan, seen
+
+
+async def setup(tmp_path, client):
+    db = await fresh_db(db_url_for(tmp_path))
+    await db.save_channel(1, 5, "Test", "testch", 99)
+    ch = await db.get_channel(1)
+    plan = await plan_repost(client, ch, RepostOptions(OLD, NEW))
+    assert plan.error is None
+    await db.create_migration(
+        "m1", 1, old=OLD, new=NEW, include_typed=True, include_posts=False, first_id=plan.first, last_id=plan.last, partial=False, user_id=99
+    )
+    return db, ch, await db.get_migration("m1")
+
+
+def test_repost_then_delete_through_a_real_client(wired, tmp_path):
+    client, chan, seen = wired
+
+    async def go():
+        db, ch, mig = await setup(tmp_path, client)
+        res = await run_repost(client, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert (res.copied_units, res.copied_messages, res.failed, res.aborted) == (7, 8, [], None)
+        assert (res.forwarded, res.rebuilt) == (3, 4)
+        new = [chan.msgs[i] for i in sorted(chan.msgs) if i > 10]
+        assert len(new) == 8 and new[0].message == "Welcome"
+        assert button_url(new[1].reply_markup.rows[0].buttons[0]) == f"https://t.me/{NEW}?start=AAA"
+        out = await delete_copies(client, db, ch, mig, "old", delay=0)
+        assert (out.deleted, out.remaining, out.error) == (8, 0, None)
+        assert sorted(chan.msgs) == [6] + list(range(11, 19))
+        await db.close()
+
+    asyncio.run(go())
+    assert {"GetFullChannelRequest", "GetMessagesRequest", "ForwardMessagesRequest", "SendMessageRequest", "SendMediaRequest", "DeleteMessagesRequest"} <= set(seen)
+
+
+def test_a_channel_that_forbids_forwarding_rebuilds_albums_through_a_real_client(wired, tmp_path):
+    client, chan, seen = wired
+    chan.restrict_forwards = True
+
+    async def go():
+        db, ch, mig = await setup(tmp_path, client)
+        res = await run_repost(client, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert (res.copied_units, res.failed, res.forwarded, res.rebuilt) == (7, [], 0, 7)
+        new = {i: m for i, m in chan.msgs.items() if i > 10}
+        assert new[14].grouped_id == new[15].grouped_id and new[14].media.photo.id == 41
+        await db.close()
+
+    asyncio.run(go())
+    assert "SendMultiMediaRequest" in seen
+
+
+def test_the_repair_edits_go_through_a_real_client(wired, tmp_path):
+    client, chan, seen = wired
+    chan.hide_keyboard_on_create = 1
+
+    async def go():
+        db, ch, mig = await setup(tmp_path, client)
+        res = await run_repost(client, db, ch, mig, 99, delay=0, settle_pause=0)
+        assert res.failed == [] and res.repaired == 1
+        await db.close()
+
+    asyncio.run(go())
+    # the plain edit (Telegram answers "not modified"), then the stand-in keyboard, then the real one
+    assert seen.count("EditMessageRequest") == 3 and len(chan.edits) == 2
+
+
+def test_checking_and_fixing_buttons_through_a_real_client(wired, tmp_path):
+    client, chan, seen = wired
+    A, B = "https://t.me/goku?start=A", "https://t.me/goku?start=B"
+    chan.msgs = {
+        1: make_msg(1, "fine", markup=markup([url_btn("Get", A)]), out=True),
+        2: make_msg(2, "lost its buttons", out=True),
+        3: make_msg(3, "wrong link", markup=markup([url_btn("Get", B)]), out=True),
+    }
+    chan._top = 3
+
+    async def go():
+        db = await fresh_db(db_url_for(tmp_path))
+        await db.save_channel(1, 5, "Test", "testch", 99)
+        ch = await db.get_channel(1)
+        posts = [
+            await db.create_post(channel_id=1, message_id=i, status="sent", source="bot", text=f"p{i}", entities=[], buttons=[[{"t": "Get", "u": A}]])
+            for i in (1, 2, 3)
+        ]
+        scan = await scan_buttons(client, ch, posts)
+        assert (scan.total, scan.fine, [p.message_id for p, _, _ in scan.bad], scan.gone) == (3, 1, [2, 3], [])
+        res = await fix_buttons(client, ch, scan.bad, delay=0, pause=0)
+        assert (res.fixed, res.failed) == (2, [])
+        assert [button_url(chan.msgs[i].reply_markup.rows[0].buttons[0]) for i in (1, 2, 3)] == [A, A, A]
+        assert await ensure_markup(client, peer_of(ch), 2, build_markup([[{"t": "Get", "u": A}]]), pause=0) == "fine"
+        await db.close()
+
+    asyncio.run(go())
+    assert "EditMessageRequest" in seen
+
+
+def test_the_bots_own_rights_are_read_through_a_real_client(wired):
+    client, chan, seen = wired
+
+    async def go():
+        ch = type("Ch", (), {"id": 1, "access_hash": 5})()
+        r = await get_rights(client, ch)
+        assert (r.admin, r.post, r.delete, r.invite, r.add_admins) == (True, True, True, True, True)
+        chan.rights = dict(admin=True, post=True, edit=False, delete=False, invite=False, add_admins=False)
+        r = await get_rights(client, ch)
+        assert (r.post, r.delete, r.invite, r.add_admins) == (True, False, False, False)
+
+    asyncio.run(go())
+    assert seen == ["GetParticipantRequest", "GetParticipantRequest"]
+
+
+def test_userbot_clean_up_with_a_real_bot_client(wired, tmp_path):
+    """Bot side (invite link, promotion, demotion, revoking) runs through the real client; the helper account is simulated."""
+    client, chan, seen = wired
+    chan.undeletable = {1, 2, 3, 4, 5}
+
+    class Cfg:
+        userbot_session, userbot_keep_admin, api_id, api_hash = "S", False, 1, "h"
+
+    async def go():
+        db, ch, mig = await setup(tmp_path, client)
+        await run_repost(client, db, ch, mig, 99, delay=0, settle_pause=0)
+        ub = Userbot(client, Cfg(), client_factory=lambda cfg: FakeUserClient(chan))
+        fallback, deleter = await ub.fallback_for(ch)
+        try:
+            out = await delete_copies(client, db, ch, mig, "old", delay=0, fallback=fallback)
+        finally:
+            await deleter.close()
+        assert (out.deleted, out.by_userbot, out.remaining, out.error, out.fallback_error) == (8, 5, 0, None, None)
+        assert chan.admins == {} and all(v["revoked"] for v in chan.invites.values())
+        await db.close()
+
+    asyncio.run(go())
+    for name in ("ExportChatInviteRequest", "EditAdminRequest", "GetParticipantsRequest", "EditExportedChatInviteRequest"):
+        assert name in seen, (name, seen)
+    assert seen.count("EditAdminRequest") == 2  # promote, then demote
+
+
+def test_invite_and_admin_requests_build_with_the_values_the_userbot_code_uses(wired):
+    client, chan, seen = wired
+    peer = types.InputPeerChannel(1, 5)
+    expires = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(hours=1)
+
+    async def go():
+        inv = await client(functions.messages.ExportChatInviteRequest(peer=peer, expire_date=expires, usage_limit=1, title="Cleanup helper"))
+        assert inv.link.startswith("https://t.me/+") and inv.usage_limit == 1
+        await client(functions.messages.EditExportedChatInviteRequest(peer=peer, link=inv.link, revoked=True))
+        chan.users[777] = types.User(id=777, access_hash=555, first_name="H")
+        await client(
+            functions.channels.EditAdminRequest(
+                channel=peer, user_id=types.InputUser(777, 555), admin_rights=types.ChatAdminRights(delete_messages=True), rank=""
+            )
+        )
+        assert chan.admins[777].delete_messages
+        await client(
+            functions.channels.EditAdminRequest(channel=peer, user_id=types.InputUser(777, 555), admin_rights=types.ChatAdminRights(), rank="")
+        )
+        assert chan.admins == {}
+        res = await client(
+            functions.channels.GetParticipantsRequest(channel=peer, filter=types.ChannelParticipantsSearch("h"), offset=0, limit=200, hash=0)
+        )
+        assert res.users == []
+
+    asyncio.run(go())