fix: gate /rawappleapp + /rawgoogleapp on authorizeGroup

Match the auth check used by every other command. Without it,
any chat that knows the bot username could dump arbitrary
App Store / Play Store JSON.

src/bot/bot.js

@@ -67,8 +67,8 @@ export function createBot(config, store, appleScraper, googleScraper) {
     listapp: createListAppCommand(store),
     checkapp: createCheckAppCommand(config, store, appleScraper, googleScraper),
     checkappscore: createCheckAppScoresCommand(store, appleScraper, googleScraper),
-    rawappleapp: createRawAppleAppCommand(appleScraper),
+    rawappleapp: createRawAppleAppCommand(store, appleScraper),
-    rawgoogleapp: createRawGoogleAppCommand(googleScraper),
+    rawgoogleapp: createRawGoogleAppCommand(store, googleScraper),
   };
 
   return { sender, commands, api };

src/bot/commands/raw-apple-app.js

@@ -1,8 +1,10 @@
 import { buildAppleRequestByBundleId, buildAppleRequestByTrackId } from '../../api/apple-scraper.js';
+import { authorizeGroup } from './command-utils.js';
 
 // /rawappleapp <id|appId> [country=vn] — sends raw upstream JSON as a document.
-export function createRawAppleAppCommand(appleScraper) {
+export function createRawAppleAppCommand(store, appleScraper) {
   return async (msg, sender, args) => {
+    if (!(await authorizeGroup(msg.chat.id, store, sender))) return;
     if (args.length < 1 || args.length > 2) {
       await sender.sendMessage(msg.chat.id, 'Invalid arguments');
       return;

src/bot/commands/raw-google-app.js

@@ -1,8 +1,10 @@
 import { buildGoogleRequest } from '../../api/google-scraper.js';
+import { authorizeGroup } from './command-utils.js';
 
 // /rawgoogleapp <appId> [country=vn]
-export function createRawGoogleAppCommand(googleScraper) {
+export function createRawGoogleAppCommand(store, googleScraper) {
   return async (msg, sender, args) => {
+    if (!(await authorizeGroup(msg.chat.id, store, sender))) return;
     if (args.length < 1 || args.length > 2) {
       await sender.sendMessage(msg.chat.id, 'Invalid arguments');
       return;