BJS Security

// admin can add 100$ to users's balance by it telegramid

tgID = params

let res = Libs.ResourcesLib.anotherUserRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for user");

// create any temporary command with this code
// run it for admin

// destroy command after for security
// also you can protect this command with password

User.addToGroup("admin")

Bot.sendMessage(user.telegramid)

if(user.telegramid!=ADMIN_TELEGRAM_ID){
  return // exit from BJS
}

// ONLY admin can add 100$ to users's balance by it telegramid

tgID = params

let res = Libs.ResourcesLib.anotherUserRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for user");

// command /payment

// user provide oneTime password. If password is valid - add bonus 100$

var oneTimePassword = User.getProperty("oneTimePassword");

if(!oneTimePassword){
  return // we have not oneTime password now
}

if(oneTimePassword=="already taked"){
  // if taked already - exit
  return
}

if(oneTimePassword!=message){
  // user do not know oneTime password
  Bot.sendMessager("Error. Password is wrong")
}

if(oneTimePassword==message){
  // user know oneTime password!
  // make it "already taked"
  User.setProperty("oneTimePassword", "already taked", "string")
  // run "secret" command
  Bot.runCommand("/setBalance");
  Bot.sendMessage("Thank you for payment!");
}

let res = Libs.ResourcesLib.userRes("money", tgID);
res.add(100)
Bot.sendMessage("Added 100$ for you");

...
// part of code for /payment

if(oneTimePassword==message){
  ...
  var secret = "GJHURFVJLHF" // use own secret. You can store it in property
  Bot.runCommand("/setBalance");
  Bot.sendMessage("Thank you for payment!");
}

if(params=="GJHURFVJLHF"){
   let res = Libs.ResourcesLib.userRes("money", tgID);
   res.add(100)
   Bot.sendMessage("Added 100$ for you");
}else{
   Bot.sendMessage("You are hacker!")
}

// send this link only in PM - secure reason
if(chat.chat_type!="private"){
  return
}

// make admin access here
// ...

Bot.runCommand("/secure")

// this command can not be runned by user
if(completed_commands_count==0){ return }

// only via Bot.runCommand, Bot.run or as "on_result"
// your secure code here
// ...

let admin = "Jon Smith";

if (user.first_name==admin){
  // do admin action here
  ...
}

// with Wait for Answer

// message from user is: 2+2
// eval - it js execution from string
let result = eval(message);

// 2+2 = 4. So we have 4 in result now
Bot.sendMessage(result)