SDU Assistant

Telegram bot for SDU course registration and quota notifications.

Warning

This project is unofficial and not affiliated with SDU. Automated registration may violate university rules or overload university systems. Operators must obtain authorization, apply conservative rate limits, and comply with applicable policy and law.

Features

• SDU login with OTP support
• Encrypted persisted SDU sessions; university passwords are not stored
• Validated course registration preferences
• Background quota checks with Celery and Redis
• SQLite schema migrations with Alembic

Requirements

• Docker with Compose, or Python 3.13 plus Redis
• Telegram bot token
• Fernet encryption key

Setup

cp .env.example .env
uv run python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'
# Add generated key and Telegram token to .env

docker compose up --build

For local development:

uv sync
uv run alembic upgrade head
uv run pytest
uv run pyright src tests
uv run ruff check src tests migrations

Redis hostnames default to Docker Compose values. Override REDIS_URL, FSM_REDIS_URL, CELERY_BROKER_URL, and CELERY_RESULT_BACKEND for local services.

Security and privacy

• Password and OTP messages are deleted after processing when Telegram permits deletion.
• Passwords are never persisted. Session cookies are encrypted with SESSION_ENCRYPTION_KEY.
• Changing encryption key invalidates stored sessions and requires users to log in again.
• Telegram bots do not provide end-to-end encrypted chats. Users should understand this before submitting credentials.
• SDU TLS verification is disabled in src/http_client.py because deployment currently cannot validate upstream certificate chain. This weakens transport security and should be removed once upstream TLS works correctly.
• Redis must remain private. Compose does not expose it on host network.

Do not commit .env, databases, logs, captured pages, or real student data. See SECURITY.md for vulnerability reporting.

License

MIT