docs: simplify deployment docs and restrict telegram group commands

internal/service/telegram_bot_user_test.go

@@ -134,6 +134,74 @@ func TestTelegramRegisterRespectsAdminToggle(t *testing.T) {
 	}
 }
 
+func TestTelegramGroupHidesAdminPanelFromRegularUsers(t *testing.T) {
+	ctx := t.Context()
+	_, bot := newBotTestService(t)
+	channel := &model.NotifyChannel{Name: "Telegram", Type: "telegram", Enabled: true, Config: `{"group_chat_id":"-100123","admin_user_ids":"9001"}`}
+	msg := &TelegramMessage{
+		From: TelegramUser{ID: 9002, Username: "viewer", FirstName: "Viewer"},
+		Chat: TelegramChat{ID: -100123, Type: "supergroup"},
+	}
+
+	menu := bot.mainMenu(ctx, channel, msg)
+	if strings.Contains(menu.Text, "管理员") || telegramReplyHasButtonPrefix(menu, "adm_") {
+		t.Fatalf("regular group user must not see admin panel: text=%q buttons=%#v", menu.Text, menu.Buttons)
+	}
+
+	reply, err := bot.executeCommand(ctx, channel, msg, "/users")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reply.Text != "" || len(reply.Buttons) != 0 {
+		t.Fatalf("regular group user admin command should be ignored, got %#v", reply)
+	}
+
+	reply, err = bot.executeCommand(ctx, channel, msg, "/start viewer secret-pass")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(reply.Text, "请私聊 Bot") {
+		t.Fatalf("group credential command should point to private chat, got %q", reply.Text)
+	}
+}
+
+func TestTelegramGroupAdminMenuDoesNotExposeButtonsInGroup(t *testing.T) {
+	ctx := t.Context()
+	_, bot := newBotTestService(t)
+	channel := &model.NotifyChannel{Name: "Telegram", Type: "telegram", Enabled: true, Config: `{"group_chat_id":"-100123","admin_user_ids":"9001"}`}
+	msg := &TelegramMessage{
+		From: TelegramUser{ID: 9001, Username: "admin", FirstName: "Admin"},
+		Chat: TelegramChat{ID: -100123, Type: "group"},
+	}
+
+	menu := bot.mainMenu(ctx, channel, msg)
+	if telegramReplyHasButtonPrefix(menu, "adm_") {
+		t.Fatalf("admin group menu must not expose admin buttons publicly: %#v", menu.Buttons)
+	}
+	if !strings.Contains(menu.Text, "请私聊 Bot") {
+		t.Fatalf("admin group menu should tell admins to use private chat, got %q", menu.Text)
+	}
+
+	reply, handled := bot.handleMenuCallback(ctx, channel, msg, "adm_users")
+	if !handled {
+		t.Fatal("admin callback should be handled")
+	}
+	if !strings.Contains(reply.Text, "请私聊 Bot") || telegramReplyHasButtonPrefix(reply, "adm_") {
+		t.Fatalf("group admin callback should not render admin panel publicly: %#v", reply)
+	}
+}
+
+func telegramReplyHasButtonPrefix(reply telegramCommandReply, prefix string) bool {
+	for _, row := range reply.Buttons {
+		for _, button := range row {
+			if strings.HasPrefix(button.Data, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func TestTelegramStartClearsStaleUserBinding(t *testing.T) {
 	repos, auth, _, _ := newAuthTestServices(t)
 	if err := repos.DB.Create(&model.TelegramBinding{