How to Deploy a Discord Bot to AWS

// bot/encore.service.ts
import { Service } from "encore.dev/service";

export default new Service("bot");

// bot/interactions.ts
import { api } from "encore.dev/api";
import { secret } from "encore.dev/config";
import { Subscription, Topic } from "encore.dev/pubsub";
import { CacheCluster, CacheKeyExists, StringKeyspace, expireIn } from "encore.dev/storage/cache";
import { createPublicKey, verify } from "node:crypto";
import type { IncomingMessage } from "node:http";

// The public key from the Discord Developer Portal (General Information).
const discordPublicKey = secret("DiscordPublicKey");
const discordAppId = secret("DiscordApplicationId");

// Discord gives the key as 32 raw bytes in hex. Node needs it wrapped in
// an SPKI DER header to build an Ed25519 key object.
function ed25519Key(hex: string) {
  const der = Buffer.concat([
    Buffer.from("302a300506032b6570032100", "hex"),
    Buffer.from(hex, "hex"),
  ]);
  return createPublicKey({ key: der, format: "der", type: "spki" });
}

const maxSkewSeconds = 5 * 60;

// Shared across instances. A replay within the timestamp window hits this
// key on whichever worker receives it.
const interactionCache = new CacheCluster("interaction-ids", {
  evictionPolicy: "noeviction",
});
const seenReports = new StringKeyspace<{ id: string }>(interactionCache, {
  keyPattern: "interaction/:id",
  // Retain the claim through the full future-skew acceptance horizon.
  defaultExpiry: expireIn((maxSkewSeconds * 2 + 1) * 1000),
});

function timestampFresh(timestamp: string): boolean {
  const seconds = Number(timestamp);
  if (!Number.isFinite(seconds)) return false;
  return Math.abs(Date.now() / 1000 - seconds) <= maxSkewSeconds;
}

async function claimReport(id: string): Promise<"claimed" | "duplicate" | "unavailable"> {
  try {
    await seenReports.setIfNotExists({ id }, "1");
    return "claimed";
  } catch (err) {
    if (err instanceof CacheKeyExists) return "duplicate";
    // A full cache must not drop the interaction. Discord retries a 503.
    return "unavailable";
  }
}

function readBody(req: IncomingMessage): Promise<string> {
  return new Promise((resolve, reject) => {
    const chunks: Buffer[] = [];
    req.on("data", (c: Buffer) => chunks.push(c));
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
    req.on("error", reject);
  });
}

interface SlowCommand {
  token: string; // interaction token, valid for 15 minutes
  user: string;
  interactionId: string;
}

// Work that takes longer than Discord's 3 second window goes through a queue.
const slowCommands = new Topic<SlowCommand>("slow-commands", {
  deliveryGuarantee: "at-least-once",
});

const finishedReports = new Set<string>();

const _ = new Subscription(slowCommands, "finish-report", {
  handler: async (cmd) => {
    // A redelivery edits the same original message, so it does not post twice.
    if (finishedReports.has(cmd.interactionId)) return;
    const content = `Report for ${cmd.user} is ready.`;
    const res = await fetch(
      `https://discord.com/api/v10/webhooks/${discordAppId()}/${cmd.token}/messages/@original`,
      {
        method: "PATCH",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ content }),
      },
    );
    if (!res.ok) throw new Error(`discord returned ${res.status}`); // retried
    finishedReports.add(cmd.interactionId);
  },
  retryPolicy: { maxRetries: 3 },
});

// Set this URL as the Interactions Endpoint URL in the Developer Portal.
export const interactions = api.raw(
  { expose: true, method: "POST", path: "/discord/interactions" },
  async (req, resp) => {
    const body = await readBody(req);
    const signature = req.headers["x-signature-ed25519"];
    const timestamp = req.headers["x-signature-timestamp"];

    const valid =
      typeof signature === "string" &&
      typeof timestamp === "string" &&
      verify(
        null,
        Buffer.from(timestamp + body),
        ed25519Key(discordPublicKey()),
        Buffer.from(signature, "hex"),
      );
    if (!valid || !timestampFresh(timestamp)) {
      resp.writeHead(401).end("invalid request signature");
      return;
    }

    const interaction = JSON.parse(body);
    const reply = (payload: unknown) => {
      resp.writeHead(200, { "Content-Type": "application/json" });
      resp.end(JSON.stringify(payload));
    };

    if (interaction.type === 1) return reply({ type: 1 }); // PING -> PONG

    if (interaction.type === 2) {
      const user = interaction.member?.user?.username ?? interaction.user?.username;
      switch (interaction.data.name) {
        case "ping":
          return reply({ type: 4, data: { content: `Pong, ${user}!` } });
        case "report": {
          const id = typeof interaction.id === "string" ? interaction.id : "";
          if (id === "") {
            resp.writeHead(400).end("missing interaction id");
            return;
          }
          const claim = await claimReport(id);
          if (claim === "unavailable") {
            resp.writeHead(503).end("try again");
            return;
          }
          if (claim === "duplicate") return reply({ type: 5 });
          // Keep the claim if publish's result is lost. A retry must not enqueue again.
          await slowCommands.publish({ token: interaction.token, user, interactionId: id });
          return reply({ type: 5 }); // deferred: shows "thinking..."
        }
      }
    }
    resp.writeHead(400).end("unknown interaction");
  },
);