feature

server/app/Providers/AppServiceProvider.php

@@ -6,6 +6,8 @@ use App\Services\CorunaArchive;
 use App\Services\CorunaCrypto;
 use App\Services\SettingsService;
 use Illuminate\Support\ServiceProvider;
+use Nutgram\Laravel\RunningMode\LaravelWebhook;
+use SergiX44\Nutgram\Nutgram;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -32,5 +34,23 @@ class AppServiceProvider extends ServiceProvider
         } catch (\Throwable) {
             // settings table may not exist yet during migrate
         }
+
+        // Override Nutgram's production safe_mode (md5 APP_KEY) so webhook updates
+        // are not silently dropped when Telegram secret_token is unset/mismatched.
+        $this->app->afterResolving(Nutgram::class, function (Nutgram $bot): void {
+            if ($this->app->runningUnitTests() || $this->app->runningInConsole()) {
+                return;
+            }
+
+            $secret = (string) config('coruna.telegram.webhook_secret', '');
+            $webhook = $secret !== ''
+                ? new LaravelWebhook(
+                    getToken: static fn () => request()?->header('X-Telegram-Bot-Api-Secret-Token'),
+                    secretToken: $secret,
+                )
+                : new LaravelWebhook;
+            $webhook->setSafeMode($secret !== '');
+            $bot->setRunningMode($webhook);
+        });
     }
 }