No silent edits
Writing requires an explicit preview and confirmation.
Selected work
Geoekoproekt case study
The website owner can now message the website like a colleague
Find a page, change a field, attach a photo or create a draft from Telegram. Every write is previewed, confirmed and reversible.
A small website change should not require a trip through the CMS
Routine edits still meant opening Drupal, finding the right content type and field, and remembering how the page was assembled. We built a private operator for the owner and editors, not another public chatbot.
“Create a page from this photo, publish it and send me the link.”
01
Conversation outside. Normal Drupal rules inside.
The language model interprets the request, but it never receives Drupal credentials and cannot make an arbitrary request. Ordinary code selects an allowed action, reads the current revision, prepares a preview and waits for the user to confirm.
REAL CHAT
The interface is the chat the owner already knows
This real conversation shows the operator reading the homepage, finding the vacancies page and accepting a photo with a plain-language instruction. The original Russian messages were translated for this case study; IDs, URLs, timestamps and product states are unchanged.
What happens after one message
- 01
Understand
Text, a voice note or a photo becomes one structured request.
- 02
Preview
Telegram shows the target page and exactly what will change.
- 03
Confirm
Only the person who started the request can approve it, within ten minutes.
- 04
Apply
Drupal validates the content and stores a new revision. The bot returns the live link.
02
The bot is deliberately less powerful than an administrator
No deletion
The connector exposes no destructive content operation.
No stale overwrite
If somebody edited the page after preview, Drupal rejects the request.
Undo stays auditable
Rollback creates another revision instead of erasing history.
03
Built against a real site, including the failures
Live tests exposed Russian title-search edge cases, ambiguous “latest” requests, duplicate unpublished pages, old HTML-format permissions and image validation. Each failure became a narrower rule or a deterministic operation.
Technical notes
A Node.js 22 Telegram service runs in Docker on a private VPS with no public inbound port. One deployment controls one website and uses one configured AI provider.
Requests to the Drupal connector use HMAC SHA-256 with a timestamp, one-time nonce, method, full request target and raw body. Write routes also require an idempotency key and the exact source revision.
Gemini plans only from an allowed action schema. Drupal enforces the final field allowlist, entity validation, file-byte checks and revision creation.
Do routine website changes still wait for someone to open the CMS?