fix(telegram): allow trusted explicit proxy media fetches

extensions/telegram/src/fetch.ts

@@ -206,11 +206,13 @@ function resolveTelegramDispatcherPolicy(params: {
         ? {
             mode: "explicit-proxy",
             proxyUrl: explicitProxyUrl,
+            allowPrivateProxy: true,
             proxyTls: { ...connect },
           }
         : {
             mode: "explicit-proxy",
             proxyUrl: explicitProxyUrl,
+            allowPrivateProxy: true,
           },
       mode: "explicit-proxy",
     };

src/infra/net/fetch-guard.ts

@@ -112,7 +112,13 @@ async function assertExplicitProxyAllowed(
   }
   await resolvePinnedHostnameWithPolicy(parsedProxyUrl.hostname, {
     lookupFn,
-    policy,
+    policy:
+      dispatcherPolicy.allowPrivateProxy === true
+        ? {
+            ...policy,
+            allowPrivateNetwork: true,
+          }
+        : policy,
   });
 }
 

src/infra/net/ssrf.ts

@@ -286,6 +286,7 @@ export type PinnedDispatcherPolicy =
   | {
       mode: "explicit-proxy";
       proxyUrl: string;
+      allowPrivateProxy?: boolean;
       proxyTls?: Record<string, unknown>;
       pinnedHostname?: PinnedHostnameOverride;
     };