diff --git a/src/app.js b/src/app.js
index 8bf807cb..c6ec676b 100644
--- a/src/app.js
+++ b/src/app.js
@@ -39,8 +39,13 @@ class MautrixTelegram {
 				onUserQuery(user) {
 					return {}
 				},
-				onEvent(request, context) {
-					self.handleMatrixEvent(request.getData())
+				async onEvent(request, context) {
+					try {
+						await self.handleMatrixEvent(request.getData())
+					} catch (err) {
+						console.error("Matrix event handling failed:", err)
+						console.error(err.stack)
+					}
 				},
 			},
 		})
@@ -123,7 +128,7 @@ class MautrixTelegram {
 		})
 
 		// Handle possible db query race conditions
-		let portal = this.portalsByRoomID.get(id)
+		portal = this.portalsByRoomID.get(id)
 		if (portal) {
 			return portal
 		}
@@ -226,9 +231,10 @@ class MautrixTelegram {
 			return;
 		}
 
+		const user = await this.getMatrixUser(evt.sender)
+
 		const cmdprefix = this.config.bridge.command_prefix
 		if (evt.content.body.startsWith(cmdprefix + " ")) {
-			const user = await this.getMatrixUser(evt.sender)
 			if (!user.whitelisted) {
 				this.botIntent.sendText(evt.room_id, "You are not authorized to use this bridge.")
 				return
@@ -245,9 +251,14 @@ class MautrixTelegram {
 			return
 		}
 
+		if (!user.whitelisted) {
+			// Non-management command from non-whitelisted user -> fail silently.
+			return
+		}
+
 		const portal = await this.getPortalByRoomID(evt.room_id)
 		if (portal) {
-			portal.handleMatrixEvent(evt)
+			portal.handleMatrixEvent(user, evt)
 			return
 		}
 	}
diff --git a/src/portal.js b/src/portal.js
index b2ae57b7..16402649 100644
--- a/src/portal.js
+++ b/src/portal.js
@@ -61,9 +61,25 @@ class Portal {
 		return this.peer.loadAccessHash(this.app, telegramPOV, {portal: this})
 	}
 
-	handleMatrixEvent(evt) {
-		console.log("Received message from Matrix to portal with room ID", this.roomID)
-		console.log(evt)
+	async handleTelegramEvent(sender, evt) {
+		// TODO handle other content types
+		sender.sendText(this.roomID, evt.text)
+	}
+
+	async handleMatrixEvent(sender, evt) {
+		switch(evt.content.msgtype) {
+			case "m.notice":
+			case "m.text":
+				await this.loadAccessHash(sender.telegramPuppet)
+				sender.telegramPuppet.sendMessage(this.peer, evt.content.body)
+				break
+			default:
+				console.log("Unhandled event:", evt)
+		}
+	}
+
+	isMatrixRoomCreated() {
+		return !!this.roomID
 	}
 
 	async createMatrixRoom(telegramPOV) {
diff --git a/src/telegram-puppet.js b/src/telegram-puppet.js
index bde9d63a..cfac94c9 100644
--- a/src/telegram-puppet.js
+++ b/src/telegram-puppet.js
@@ -202,9 +202,22 @@ class TelegramPuppet {
 		return result
 	}
 
+	async sendMedia(peer, media) {
+		const result = await this.client("messages.sendMedia", {
+			peer: peer.toInputPeer(),
+			media: media,
+			random_id: ~~(Math.random() * (1<<30)),
+		})
+		// TODO use result? (maybe the ID)
+		return result
+	}
+
 	async handleMessage(message) {
-		console.log(
-			`Received message from ${message.from.id} to ${message.to.type.replace("user", "1-1 chat")}${message.to.type === "user" ? "" : " " + message.to.id}: ${message.text}`)
+		const portal = await this.app.getPortalByPeer(message.to)
+		if (portal.isMatrixRoomCreated()) {
+			const sender = await this.app.getTelegramUser(message.from)
+			await portal.handleTelegramEvent(sender, message)
+		}
 	}
 
 	async onUpdate(update) {
@@ -234,19 +247,21 @@ class TelegramPuppet {
 				break
 			case "updateShortMessage":
 				await this.handleMessage({
-					from: this.app.getTelegramUser(update.user_id),
+					from: update.user_id,
 					to: new TelegramPeer("user", update.user_id),
 					text: update.message,
 				})
 				break
 			case "updateShortChatMessage":
 				await this.handleMessage({
-					from: this.app.getTelegramUser(update.user_id),
+					from: update.user_id,
 					to: new TelegramPeer("chat", update.chat_id),
 					text: update.message,
 				})
 				break
+			case "updateNewChannelMessage":
 			case "updateNewMessage":
+				// TODO handle other content types
 				update = update.message // Message defined at message#90dddc11 in layer 71
 				await this.handleMessage({
 					from: update.from_id,