Bridge a channel to Landbot

   Telegram user
       │ ▲
   (1) │ │ (4)  bot reply
 user msg │
       ▼ │
 ┌─────────────────────────────────────────────┐
 │              Your bridge server               │
 │   POST /telegram/webhook   POST /landbot/webhook
 └─────────────────────────────────────────────┘
       │ ▲
   (2) │ │ (3)  APIchat webhook (bot reply)
 send  │ │
       ▼ │
   Landbot bot  (APIchat channel @ chat.landbot.io)

mkdir landbot-telegram-bridge && cd $_
npm init -y
npm install express

LANDBOT_CHANNEL_TOKEN=your-apichat-channel-token
TELEGRAM_BOT_TOKEN=123456:ABC-your-bot-token
TELEGRAM_WEBHOOK_SECRET=a-long-random-string
LANDBOT_WEBHOOK_SECRET=another-long-random-string
PUBLIC_URL=https://your-subdomain.ngrok-free.app
PORT=3000

const express = require("express");
const app = express();
app.use(express.json());

const LANDBOT_BASE = "https://chat.landbot.io/v1";

// Talk to Landbot APIchat (always authenticated with the channel token).
async function landbot(path, body) {
  return fetch(`${LANDBOT_BASE}${path}`, {
    method: "POST",
    headers: {
      Authorization: `Token ${process.env.LANDBOT_CHANNEL_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(body),
  });
}

// Talk to Telegram.
async function telegram(method, body) {
  const res = await fetch(
    `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/${method}`,
    { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }
  );
  return res.json();
}

// Deterministic, reversible mapping — this is why we need no database.
const tokenForChat = (chatId) => `tg-${chatId}`;
const chatIdFromToken = (token) =>
  token && token.startsWith("tg-") ? token.slice(3) : null;

const known = new Set(); // in-memory cache; swap for Redis/DB in prod

async function ensureCustomer(chatId, name) {
  const token = tokenForChat(chatId);
  if (known.has(token)) return token;
  const res = await landbot("/customers/", { token, name }); // CustomerCreateRequest
  if (res.status === 201 || res.status === 409) known.add(token);
  else throw new Error(`createCustomer failed: ${res.status}`);
  return token;
}

app.post("/telegram/webhook", (req, res) => {
  // 1. Verify the request really came from Telegram.
  if (req.get("X-Telegram-Bot-Api-Secret-Token") !== process.env.TELEGRAM_WEBHOOK_SECRET) {
    return res.sendStatus(403);
  }
  // 2. Acknowledge immediately, then work — Telegram retries on slow/non-200 responses.
  res.sendStatus(200);
  handleTelegramUpdate(req.body).catch((e) => console.error("telegram→landbot", e));
});

async function handleTelegramUpdate(update) {
  if (update.update_id && seen(update.update_id)) return; // de-dupe retries

  if (update.message && update.message.text) {
    const { id: chatId, first_name } = update.message.chat;
    const token = await ensureCustomer(chatId, first_name);
    // Send body shape: { message: { type: "text", message } }
    await landbot(`/send/${token}/`, {
      message: { type: "text", message: update.message.text },
    });
  } else if (update.callback_query) {
    // The user tapped an inline button we sent from a Landbot "dialog".
    const cq = update.callback_query;
    const chatId = cq.message.chat.id;
    const token = await ensureCustomer(chatId, cq.from.first_name);
    await telegram("answerCallbackQuery", { callback_query_id: cq.id });
    // `payload` is what Landbot matches on to route the flow (see the dialog mapping in Step 4).
    // `message` is the text recorded in the transcript — here it's the payload value (e.g. "$0");
    // if you want the button's label there instead, encode it into `callback_data` too (64-byte cap).
    await landbot(`/send/${token}/`, {
      message: { type: "text", message: cq.data, payload: cq.data },
    });
  }
}

app.post("/landbot/webhook", (req, res) => {
  // APIchat outbound webhooks carry NO Authorization header and no signature — there is
  // no per-hook secret field in the dashboard. So you authenticate with what you control:
  // a secret in the webhook URL (used here), an IP allowlist, or a reverse proxy. The
  // request body is never proof of origin — don't treat its contents as authorization.
  if (req.query.secret !== process.env.LANDBOT_WEBHOOK_SECRET) return res.sendStatus(403);
  res.sendStatus(200); // ack fast; Landbot also retries
  handleLandbotWebhook(req.body).catch((e) => console.error("landbot→telegram", e));
});

async function handleLandbotWebhook(payload) {
  const chatId = chatIdFromToken(payload.customer && payload.customer.token);
  if (!chatId) return; // not one of our Telegram customers — ignore

  for (const msg of payload.messages || []) {
    await deliverToTelegram(chatId, msg); // preserve order
  }
}

async function deliverToTelegram(chatId, msg) {
  switch (msg.type) {
    case "text":
      await telegram("sendMessage", { chat_id: chatId, text: msg.message });
      break;

    case "image":
      await telegram("sendPhoto", { chat_id: chatId, photo: msg.url, caption: msg.message || undefined });
      break;

    case "dialog": {
      // buttons[i] = label shown; payloads[i] = value sent back when tapped.
      const inline_keyboard = msg.buttons.map((label, i) => [
        { text: label, callback_data: msg.payloads[i] },
      ]);
      await telegram("sendMessage", {
        chat_id: chatId,
        text: msg.title,
        reply_markup: { inline_keyboard },
      });
      break;
    }

    default:
      console.warn("Unhandled Landbot message type:", msg.type); // log, never drop silently
  }
}

// Naive de-dupe — replace with an LRU/TTL store in production.
const seenIds = new Set();
function seen(id) {
  if (seenIds.has(id)) return true;
  seenIds.add(id);
  if (seenIds.size > 5000) seenIds.clear();
  return false;
}

app.listen(process.env.PORT || 3000, () => console.log("Bridge listening"));

# Tell Telegram to deliver updates to your server (with the secret we verify in Step 3).
curl "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/setWebhook" \
  -H "Content-Type: application/json" \
  -d "{\"url\":\"${PUBLIC_URL}/telegram/webhook\",\"secret_token\":\"${TELEGRAM_WEBHOOK_SECRET}\"}"

${PUBLIC_URL}/landbot/webhook?secret=${LANDBOT_WEBHOOK_SECRET}