Add /status Command and Fix security issue

[berkemutluu]

Summary

Adds a /status command for on-demand system status reporting, and fixes a security issue where the bot would accept commands (arm/disarm/status) from any Telegram user who messaged it, not just the intended owner.

Changes

1. New /status command

Added sendStatus(byte partition), which builds and sends a single status report for the currently selected partition.
Triggered by sending /status to the bot.

Response includes:

Partition state: ALARM, Exit delay in progress, Armed away/Armed stay (with night variants), Disarmed, ready, or Disarmed, not ready
Keybus connection: connected / DISCONNECTED
Trouble status: YES / none
AC power: OK / FAILURE
Panel battery: OK / trouble

Example output:

[Security system] Status - Partition 1: Disarmed, ready
Keybus: connected
Trouble: none
AC power: OK
Panel battery: OK

2. Chat ID authorization check (security fix)

Issue:

the bot processed incoming messages from any Telegram chat that messaged it — there was no check that the sender was the intended operator. Anyone who found the bot (e.g. by guessing/scanning bot usernames, or if the token/bot were ever discovered) could potentially send /armstay, /disarm, etc., since the access code is only required by the panel for certain actions, not by the bot itself before forwarding a command.

Fix:

handleTelegram() now checkstelegramBot.messages[i].chat_idagainst telegramUserID as the first step, before any other message handling. Messages from a mismatched chat_id are rejected outright: no partition selection, no arm/disarm, no status — and the bot replies directly to that sender with "Unauthorized: this chat is not permitted to control this security system.", then continues to the next message.

No other logic, wiring notes, or existing command behavior (/armstay, /armaway, /armnight, /disarm, partition selection) was modified.

[Copilot]

Pull request overview

Adds a new Telegram bot command for on-demand status reporting, and introduces an authorization guard intended to prevent unauthorized Telegram chats from issuing security-system control commands.

Changes:

• Added /status handling that sends a one-shot status report for the currently selected partition.
• Added an early authorization check in handleTelegram() that rejects messages whose chat_id does not match the configured telegramUserID.
• Updated the example header docs to include /status and clarify “user/chat ID”.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.