# Telegram Business Integration Refactor

This refactor separates Telegram transport, webhook processing, and conversation actions from controllers.

## Routes
- `POST /telegram/webhook` — Telegram only; verifies `X-Telegram-Bot-Api-Secret-Token`.
- `POST /api/v1/telegram/conversations/reply` — send via the mapped `business_connection_id`.
- `POST /api/v1/telegram/disconnect` — locally disables connections; the owner should also revoke the connection in Telegram Business settings.

## Database
Run `database/migrations/20260824_telegram_business.sql`.

## Webhook
Configure Telegram with `allowed_updates` including `business_connection`, `business_message`, `edited_business_message`, and `deleted_business_messages`. The `telegram_updates` unique key makes retries idempotent.

## SaaS security integration required
The reply/disconnect routes deliberately contain comments showing where this application's existing authentication middleware must derive the tenant/business ID. Do not accept `business_id` from an untrusted browser in a production deployment. Map the authenticated tenant server-side.
