Your Telegram AI Assistant Can Email Anyone as You: 6 Checks to Run Before the Model Does

Описание и применение

Бот Telegram, отправляющий письма от имени пользователя, защищён от несанкционированного доступа, дублирования, старых сообщений, дорогостоящих транскрипций, неоднозначных контактов и ошибок часового пояса.

Задача

A Telegram bot that can send emails on behalf of a user must guard against unauthorized use, duplicate processing, stale messages, costly operations, ambiguous contacts, and time zone errors before invoking the AI model.

Результат

The workflow prevents unauthorized email sending, duplicate processing, costly transcription, ambiguous contact resolution, and time zone misinterpretation, enabling a safe Telegram AI assistant.

Рабочий процесс

• Receive Telegram update via webhook
• Guard API checks chat ID allowlist
• Atomic deduplication of update_id
• Reject messages older than 10 minutes
• Reject voice notes longer than 120 seconds
• If voice, download and transcribe with Whisper
• Send prompt to AI Agent with tools: contacts, calendar, email
• Agent replies on Telegram

Доказательства

The first node after the trigger asks the API one question: may this update run at all?

Источник

Atomic dedup on update_id

Источник

I also ran the whole n8n workflow locally (n8n 2.43.8) against the real API, with a fake Telegram, OpenAI and Google.

Источник