From dc87bf802a5d31765487cca3c2e63fadfb38c375 Mon Sep 17 00:00:00 2001
From: Meleki <meleki@gott.local>
Date: Tue, 3 Mar 2026 09:12:13 +0100
Subject: [PATCH] =?UTF-8?q?fix:=20Telegram=20DELETE=20/webhook=20von=20Aut?=
 =?UTF-8?q?h=20nicht=20mehr=20ausschlie=C3=9Fen?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AuthMiddleware hat /api/telegram/webhook komplett von der Auth
ausgeschlossen – unabhängig von der HTTP-Methode. Dadurch hatte
DELETE /api/telegram/webhook kein IsAdmin gesetzt → 403.

Fix: Nur POST auf diesen Pfad (= eingehender Telegram-Webhook)
wird von der Auth ausgenommen.
---
 Middleware/AuthMiddleware.cs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Middleware/AuthMiddleware.cs b/Middleware/AuthMiddleware.cs
index 37ecb9f..aea8f89 100644
--- a/Middleware/AuthMiddleware.cs
+++ b/Middleware/AuthMiddleware.cs
@@ -18,7 +18,8 @@ public class AuthMiddleware
         var path = ctx.Request.Path.Value ?? "";
 
         // Static files, login and telegram webhook don't require auth
-        if (!path.StartsWith("/api/") || path == "/api/auth/login" || path == "/api/telegram/webhook")
+        var isTelegramWebhook = path == "/api/telegram/webhook" && ctx.Request.Method == "POST";
+        if (!path.StartsWith("/api/") || path == "/api/auth/login" || isTelegramWebhook)
         {
             await _next(ctx);
             return;