Panic (nil pointer) in discord.go:860 when confirming Telegram PIN verification with Discord disabled

[TheOnlyBibi]

Describe the bug

When a user confirms their PIN via the Telegram bot, the /invite/.../telegram/verified/... endpoint returns a 500 and the sign-up page hangs on “loading” indefinitely. Server logs show a panic (nil pointer dereference) originating in discord.go:860, called from api-messages.go:375, even though the verification was done via Telegram, not Discord. Discord integration is disabled in my config.

To Reproduce

1. Enable Telegram verification on sign-up ([telegram] enabled = true), Discord left disabled ([discord] enabled = false)
2. Create an invite, open the sign-up page, confirm the PIN via the Telegram bot
3. Bot confirms success, but the sign-up page keeps loading
4. Server logs show a 500 and a panic trace

Logs

Aug 31 17:19:15 server jfa-go[1998]: [GIN] GET(/invite/kL2fYZNpmwsFjxFEX6wT7B/telegram/verified/V9-5H-YE) => 200
Aug 31 17:19:17 server jfa-go[1998]: 2026/08/31 17:19:17 [Recovery] 2026/08/31 - 17:19:17 panic recovered:
Aug 31 17:19:17 server jfa-go[1998]: runtime error: invalid memory address or nil pointer dereference
Aug 31 17:19:17 server jfa-go[1998]: /usr/local/go/src/runtime/panic.go:262 (0x480bf8)
Aug 31 17:19:17 server jfa-go[1998]: /usr/local/go/src/runtime/signal_unix.go:925 (0x480bc8)
Aug 31 17:19:17 server jfa-go[1998]: /woodpecker/src/github.com/hrfee/jfa-go/discord.go:860 (0x13dd0ec)
Aug 31 17:19:17 server jfa-go[1998]: /woodpecker/src/github.com/hrfee/jfa-go/api-messages.go:375 (0x13dd0dd)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/context.go:192 (0xf4d40d)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/recovery.go:92 (0xf5c290)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/context.go:192 (0xf4d40d)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/logger.go:249 (0xf5b409)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/context.go:192 (0xf4d40d)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/gin.go:689 (0xf5a46f)
Aug 31 17:19:17 server jfa-go[1998]: /go/pkg/mod/github.com/gin-gonic/gin@v1.11.0/gin.go:643 (0xf59e09)
Aug 31 17:19:17 server jfa-go[1998]: /usr/local/go/src/net/http/server.go:3301 (0x74f00d)
Aug 31 17:19:17 server jfa-go[1998]: /usr/local/go/src/net/http/server.go:2102 (0x72dac4)
Aug 31 17:19:17 server jfa-go[1998]: /usr/local/go/src/runtime/asm_amd64.s:1700 (0x486b00)
Aug 31 17:19:17 server jfa-go[1998]:
Aug 31 17:19:17 server jfa-go[1998]: [GIN] GET(/invite/kL2fYZNpmwsFjxFEX6wT7B/telegram/verified/V9-5H-YE) => 500

Workaround found

Enabling Discord ([discord] enabled = true) with a dummy/invalid bot token avoids the crash — this suggests the post-verification notification code path unconditionally touches the Discord bot session (*dg.Session), which is nil when Discord is disabled.

Platform/Version

Platform : Linux - Ubuntu 26.04.1 LTS
Deployment : apt
Version : 0.6.0

PS: The linked Telegram account without public username are invisible in admin panel. And the panel just show it like no account have been set, propose to link one

[TheOnlyBibi]

I believe Chatgpt found the root cause of the issue.

Root cause

The problem comes from this path in api-users.go, inside NewUserFromInvite():

for _, cm := range app.contactMethods {
...
if err := cm.PostVerificationTasks(
completeContactMethods[i].PIN,
completeContactMethods[i].User,
); err != nil {
...
}
}

PostVerificationTasks() is called for each verified contact method, including Telegram.

Why Discord panics

In discord.go, DiscordDaemon.PostVerificationTasks() does:

func (d *DiscordDaemon) PostVerificationTasks(PIN string, u ContactMethodUser) error {
err := d.ApplyRole(u.MethodID().(string))
if err != nil {
return fmt.Errorf(lm.FailedSetDiscordMemberRole, err)
}
return err
}

ApplyRole() then uses the Discord bot:

return d.bot.GuildMemberRoleAdd(d.guildID, userID, d.roleID)

The problem is that app.discord / the Discord bot can be nil when Discord is disabled.

In the scenario described by this issue:

Discord disabled
Telegram enabled
↓
Telegram PIN verified
↓
NewUserFromInvite()
↓
app.contactMethods loop
↓
PostVerificationTasks()
↓
Discord PostVerificationTasks()
↓
Discord bot is nil
↓
nil pointer panic

This also matches the stack trace reported in this issue: Discord is disabled, but Telegram verification eventually reaches discord.go.

The architectural issue

The following call in NewUserFromInvite():

cm.PostVerificationTasks(...)

assumes that every ContactMethodLinker in app.contactMethods is actually available and initialized.

However, when Discord is disabled, the Discord daemon/bot can be unavailable (nil), while the verification flow can still reach the Discord implementation.

The comment in NewUserFromInvite() also explicitly indicates that the code handles:

Discord
Telegram
Matrix
Email

So the contact method list and/or the verification flow should ensure that only enabled and initialized contact methods are processed.

Another Telegram-related bug

There also appears to be a second, separate issue in TelegramVerifiedInvite() in api-messages.go:

if ok && app.config.Section("telegram").Key("require_unique").MustBool(false) && app.telegram.UserExists(token.Username) {
app.discord.DeleteVerifiedToken(pin)
respondBool(400, false, gc)
return
}

Here, Telegram verification calls:

app.discord.DeleteVerifiedToken(pin)

even though this is Telegram code.

This looks like it should be:

app.telegram.DeleteVerifiedToken(pin)

Otherwise Telegram verification with require_unique enabled can also depend on Discord being initialized.

Proposed fix

For issue #491, the main fix should be to prevent PostVerificationTasks() from being called for a contact method that is not enabled/initialized.

I would avoid simply adding:

if app.discord != nil

around the generic PostVerificationTasks() call, since the system is designed around the ContactMethodLinker interface.

A cleaner fix would be to ensure that app.contactMethods only contains enabled/initialized contact methods, or otherwise make the verification flow correctly select the verified contact method.

Separately, I would change:

app.discord.DeleteVerifiedToken(pin)

to:

app.telegram.DeleteVerifiedToken(pin)

in TelegramVerifiedInvite().