Refactor configuration and enhance Telegram initData validation

- Improved formatting and readability in config.py and other files by adding line breaks.
- Introduced INIT_DATA_MAX_AGE_SECONDS to enforce replay protection for Telegram initData.
- Updated validate_init_data function to include max_age_seconds parameter for validation.
- Enhanced API to reject old initData based on the new max_age_seconds setting.
- Added tests for auth_date expiry and validation of initData in test_telegram_auth.py.
- Updated README with details on the new INIT_DATA_MAX_AGE_SECONDS configuration.

config.py

@@ -1,4 +1,5 @@
 """Load configuration from environment. Fail fast if BOT_TOKEN is missing."""
+
 import os
 from pathlib import Path
 
@@ -8,7 +9,9 @@ load_dotenv()
 
 BOT_TOKEN = os.getenv("BOT_TOKEN")
 if not BOT_TOKEN:
-    raise SystemExit("BOT_TOKEN is not set. Copy .env.example to .env and set your token from @BotFather.")
+    raise SystemExit(
+        "BOT_TOKEN is not set. Copy .env.example to .env and set your token from @BotFather."
+    )
 
 DATABASE_URL = os.getenv("DATABASE_URL", "sqlite:///data/duty_teller.db")
 MINI_APP_BASE_URL = os.getenv("MINI_APP_BASE_URL", "").rstrip("/")
@@ -17,17 +20,28 @@ DATA_DIR = Path(__file__).resolve().parent / "data"
 
 # Miniapp access: comma-separated Telegram usernames (no @). Empty = no one allowed.
 _raw_allowed = os.getenv("ALLOWED_USERNAMES", "").strip()
-ALLOWED_USERNAMES = {s.strip().lstrip("@").lower() for s in _raw_allowed.split(",") if s.strip()}
+ALLOWED_USERNAMES = {
+    s.strip().lstrip("@").lower() for s in _raw_allowed.split(",") if s.strip()
+}
 
 _raw_admin = os.getenv("ADMIN_USERNAMES", "").strip()
-ADMIN_USERNAMES = {s.strip().lstrip("@").lower() for s in _raw_admin.split(",") if s.strip()}
+ADMIN_USERNAMES = {
+    s.strip().lstrip("@").lower() for s in _raw_admin.split(",") if s.strip()
+}
 
 # Dev only: set to 1 to allow /api/duties without Telegram initData (insecure, no user check).
 MINI_APP_SKIP_AUTH = os.getenv("MINI_APP_SKIP_AUTH", "").strip() in ("1", "true", "yes")
 
+# Optional replay protection: reject initData older than this many seconds. 0 = disabled (default).
+INIT_DATA_MAX_AGE_SECONDS = int(os.getenv("INIT_DATA_MAX_AGE_SECONDS", "0"))
+
 # CORS: comma-separated origins, or empty/"*" for allow all. For production, set to MINI_APP_BASE_URL or specific origins.
 _raw_cors = os.getenv("CORS_ORIGINS", "").strip()
-CORS_ORIGINS = [_o.strip() for _o in _raw_cors.split(",") if _o.strip()] if _raw_cors and _raw_cors != "*" else ["*"]
+CORS_ORIGINS = (
+    [_o.strip() for _o in _raw_cors.split(",") if _o.strip()]
+    if _raw_cors and _raw_cors != "*"
+    else ["*"]
+)
 
 
 def is_admin(username: str) -> bool: