collavre_slack 0.2.7 → 0.2.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c3b4139e84c2e9f97e305dda87c4c54982b111c1e7eaa72538b586e3d36b57b
-  data.tar.gz: d9fd80c81173f332e5af67a07d0d51dfcff8264bc3a3d202ac4b253fa8cab182
+  metadata.gz: d5f9dfe6379fdea85a145479729b2fa87d0d6c731476ba9899a9f3f015d86a2e
+  data.tar.gz: 4fff38911333b72c7da5f6ade9f3b898e83e45bef388754d918960aac8f14135
 SHA512:
-  metadata.gz: 7762c23a74cb167f65ee346a820bd6b6267f5aad64a7093e853a73d0241b3e78e05721889e1d4ee9e1f00f890f167bf4bde7129e7d9cf563e75a213bd07df9b1
-  data.tar.gz: fa1e173ca870efe960aab55abb6e03c9451a4cc0860345c470dfd41922ad38195f1d2f4abd78bb5f9a5dc04ed61207e62e9675e29a6a1ddb079558095dcf6fe2
+  metadata.gz: cb8a7c91ce37da68f9b20b1478a14c002f5f864f69cb37c98cd35877c179274aa251e39a69cb3233ed8600449eb2d88cbf7d7c695ea9febbbcbcc84157150fc4
+  data.tar.gz: 315a01087854304bcbde759d9374ed5c9cd6bdede2f7f3040bfaa5fe5a7328de4bc6c5a14a8cf1905cbf55e6a3d1b740a6baf313498eb4757c017d268df79933

data/app/controllers/collavre_slack/slack_events_controller.rb

@@ -49,7 +49,7 @@ module CollavreSlack
       signature = request.headers["X-Slack-Signature"].to_s
       return false if timestamp.blank? || signature.blank?
 
-      return false if (Time.now.to_i - timestamp.to_i).abs > 300
+      return false if (Time.current.to_i - timestamp.to_i).abs > 300
 
       base = "v0:#{timestamp}:#{body}"
       expected = "v0=" + OpenSSL::HMAC.hexdigest("SHA256", signing_secret, base)

data/app/javascript/collavre_slack.js

@@ -1,5 +1,6 @@
 import { filterChannels, reconcileSelection, buildChannelViewModels } from './slack_channel_list.js';
 import { csrfToken, showError, clearError, updateStepVisibility, openOAuthPopup, fetchWithCsrf, setupModalClose } from 'collavre/modules/integration_wizard';
+import { alertDialog, confirmDialog } from 'collavre/lib/utils/dialog';
 
 let slackIntegrationInitialized = false;
 
@@ -152,7 +153,7 @@ if (!slackIntegrationInitialized) {
         deleteBtn.textContent = modal.dataset.deleteButtonLabel || 'Remove';
         deleteBtn.style.cssText = 'padding:0.25em 0.5em;font-size:0.8em;';
         deleteBtn.addEventListener('click', function () {
-          performDeleteLink(link);
+          performDeleteLink(link, deleteBtn);
         });
 
         li.appendChild(channelInfo);
@@ -189,10 +190,9 @@ if (!slackIntegrationInitialized) {
       }
     }
 
-    function performDeleteLink(link) {
-      if (!confirm(modal.dataset.deleteConfirm)) return;
+    async function performDeleteLink(link, btn) {
+      if (!(await confirmDialog(modal.dataset.deleteConfirm, { danger: true }))) return;
 
-      const btn = event.target;
       btn.disabled = true;
       btn.textContent = '...';
       clearError(errorEl);
@@ -334,7 +334,7 @@ if (!slackIntegrationInitialized) {
     openBtn.addEventListener('click', function () {
       creativeId = this.dataset.creativeId;
       if (!creativeId) {
-        alert(modal.dataset.noCreative);
+        alertDialog(modal.dataset.noCreative);
         return;
       }
       modal.style.display = 'flex';

data/app/jobs/collavre_slack/slack_inbound_message_delete_job.rb

@@ -4,8 +4,24 @@ module CollavreSlack
 
     queue_as :default
 
+    # SlackEventsController acks Slack with 200 the instant it enqueues this job
+    # (ack-before-apply), so Slack never re-delivers the event once accepted.
+    # Without a retry, a transient DB contention error would park the job and the
+    # inbound deletion would be lost permanently. Only transient contention
+    # retries.
+    retry_on ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout,
+             wait: 2.seconds, attempts: 5
+
+    # Permanent/unprocessable failures: retrying cannot help. Discard so the
+    # queue self-heals rather than looping forever.
+    discard_on ActiveJob::DeserializationError
+    discard_on ActiveRecord::RecordNotFound
+    discard_on ActiveRecord::RecordInvalid
+
     def perform(payload)
-      with_slack_error_handling("SlackInboundMessageDeleteJob") do
+      # reraise so transient errors reach retry_on and permanent ones reach
+      # discard_on; the concern still logs before re-raising.
+      with_slack_error_handling("SlackInboundMessageDeleteJob", reraise: true) do
         data = payload.with_indifferent_access
         comment = Collavre::Comment.find_by(id: data[:comment_id])
 

data/app/jobs/collavre_slack/slack_inbound_message_job.rb

@@ -2,72 +2,171 @@ module CollavreSlack
   class SlackInboundMessageJob < ApplicationJob
     queue_as :default
 
+    # Slack is acked (200) the instant this job is enqueued, so a lost job means a
+    # lost message. We can't use a job-level `retry_on`: re-running `perform` would
+    # re-run CommandProcessor's non-idempotent commands (/calendar, /work, MCP). So
+    # CommandProcessor runs exactly once and each DB write around it is retried in
+    # place via #with_transient_retry.
+
+    # Retrying can't help these — the record was deleted, the payload can't
+    # deserialize, or it's structurally invalid — so discard to let the queue self-heal.
+    discard_on ActiveJob::DeserializationError
+    discard_on ActiveRecord::RecordNotFound
+    discard_on ActiveRecord::RecordInvalid
+
     def perform(payload)
       data = payload.with_indifferent_access
+
       creative = Collavre::Creative.find(data[:creative_id])
       user = Collavre.user_class.find_by(id: data[:user_id])
       channel_link = SlackChannelLink.find_by(id: data[:slack_channel_link_id])
 
       return unless creative && channel_link
 
-      comment_user = user
-      slack_email = data[:slack_email]
-      slack_display_name = data[:slack_display_name]
-
-      # Case 1: User exists in Collavre but lacks permission
-      if user && !creative.has_permission?(user, :feedback)
-        grant_feedback_permission(creative: creative, user: user, granter: channel_link.created_by)
-        Rails.logger.info("[CollavreSlack] Granted feedback permission to user #{user.id} on creative #{creative.id}")
-      end
+      comment_user = user.presence || channel_link.created_by
+
+      # Idempotent permission grant / invite writes. Run BEFORE the exactly-once claim so
+      # a transient failure here (e.g. a Solid Queue enqueue deadlock that exhausts the
+      # in-place retries) commits no reservation — a failed-job retry can still reprocess
+      # the message. Each re-checks the existing share/invitation, so a sequential re-run
+      # is a no-op. Retried in place on transient contention — otherwise a Deadlocked here
+      # loses the acked message.
+      with_transient_retry do
+        # Case 1: User exists in Collavre but lacks permission
+        if user && !creative.has_permission?(user, :feedback)
+          grant_feedback_permission(creative: creative, user: user, granter: channel_link.created_by)
+          Rails.logger.info("[CollavreSlack] Granted feedback permission to user #{user.id} on creative #{creative.id}")
+        end
 
-      # Case 2: User not in Collavre - invite by email
-      unless user
-        if slack_email.present?
+        # Case 2: User not in Collavre - invite by email
+        if user.nil? && data[:slack_email].present?
           invite_user_by_email(
             creative: creative,
-            email: slack_email,
+            email: data[:slack_email],
             inviter: channel_link.created_by
           )
-          Rails.logger.info("[CollavreSlack] Sent invitation to #{slack_email} for creative #{creative.id}")
+          Rails.logger.info("[CollavreSlack] Sent invitation to #{data[:slack_email]} for creative #{creative.id}")
         end
-
-        # Use channel creator as fallback for comment
-        comment_user = channel_link.created_by
       end
 
+      # Exactly-once guard, claimed here: after the idempotent writes above, immediately
+      # before the non-idempotent CommandProcessor (/calendar, /work, MCP). Slack is acked
+      # before this job runs, so a message can arrive twice (sequentially or concurrently);
+      # a read-only "already applied?" check can't cover concurrency — both jobs read "not
+      # applied" and both run the commands. We atomically claim (channel_link, message_ts)
+      # via a unique index, so only the winner runs CommandProcessor and persists.
+      #
+      # Placed after the reads and the idempotent writes so no recoverable failure leaves a
+      # reservation behind: every pre-claim error is either a deterministic RecordNotFound
+      # (deleted creative) or a transient grant/invite failure a retry can redo. Only past
+      # the claim do we reach the non-idempotent commands, so the sole loss window is a
+      # discard/crash between the claim and the comment persisting — intentional, since a
+      # retry there would duplicate the commands. No time-lease (expiry reclaim is fragile).
+      # channel_link is verified present, so a RecordInvalid can only mean "already claimed".
+      return unless claim_inbound_message(data)
+
       # Create comment with appropriate user
       comment = Collavre::Comment.new(
         creative: creative,
         user: comment_user,
-        content: format_comment_content(data[:content], user, slack_display_name)
+        content: format_comment_content(data[:content], user, data[:slack_display_name])
       )
 
       # Mark this comment as coming from Slack to prevent loop
       comment.instance_variable_set(:@from_slack, true)
 
+      # Non-idempotent side effects: run once, outside the retryable write below.
       response = Collavre::Comments::CommandProcessor.new(comment: comment, user: user).call
       if response.present?
         comment.content = "#{comment.content}\n\n#{response}"
         comment.skip_dispatch = true  # slash command responses should not trigger AI
       end
-      comment.save!
-
-      # Create link between Slack message and comment for reaction sync
-      if data[:slack_channel_link_id].present? && data[:slack_message_ts].present?
-        SlackCommentLink.create!(
-          comment: comment,
-          slack_channel_link_id: data[:slack_channel_link_id],
-          message_ts: data[:slack_message_ts]
-        )
-      end
+
+      persist_comment_with_link!(comment, data)
     end
 
     private
 
+    # Persist comment + Slack link atomically, retrying only this write (not the whole
+    # job) so CommandProcessor isn't re-applied. `comment` is a fresh unsaved record,
+    # so a rolled-back retry re-saves the same instance — exactly one comment and link.
+    def persist_comment_with_link!(comment, data)
+      with_transient_retry do
+        ActiveRecord::Base.transaction do
+          comment.save!
+
+          # Create link between Slack message and comment for reaction sync
+          if data[:slack_channel_link_id].present? && data[:slack_message_ts].present?
+            SlackCommentLink.create!(
+              comment: comment,
+              slack_channel_link_id: data[:slack_channel_link_id],
+              message_ts: data[:slack_message_ts]
+            )
+          end
+        end
+      end
+    end
+
+    # Retry an idempotent block on transient DB contention. Only wrap idempotent work
+    # — the deliberate substitute for a job-level `retry_on`, which would also re-run
+    # the non-idempotent CommandProcessor.
+    def with_transient_retry(max_attempts: 5)
+      attempts = 0
+      begin
+        yield
+      rescue => e
+        raise unless transient_contention?(e)
+
+        attempts += 1
+        raise if attempts >= max_attempts
+
+        sleep(0.1 * (2**(attempts - 1)))
+        retry
+      end
+    end
+
+    # Whether an error is retryable transient contention, raised directly or wrapped.
+    # Solid Queue re-raises a failed `deliver_later` enqueue INSERT as its own
+    # EnqueueError with the original as #cause, so we match the cause chain — retrying
+    # a wrapped Deadlocked/LockWaitTimeout while re-raising a wrapped permanent failure.
+    def transient_contention?(error)
+      seen = []
+      while error && !seen.include?(error)
+        return true if error.is_a?(ActiveRecord::Deadlocked) || error.is_a?(ActiveRecord::LockWaitTimeout)
+
+        seen << error
+        error = error.cause
+      end
+      false
+    end
+
+    # Atomically claim this message before the non-idempotent commands. True if we won the claim
+    # (or there's no dedup key — same as prior behaviour), false if another job owns it.
+    # Transient contention on the INSERT is retried in place, not a "claimed" signal.
+    # Only uniqueness means already-claimed: RecordNotUnique is the authoritative gate
+    # under concurrency, RecordInvalid covers the committed sequential case. channel_link
+    # and message_ts are verified present, so uniqueness is the only validation that can
+    # fail — RecordInvalid here unambiguously means "already claimed".
+    def claim_inbound_message(data)
+      channel_link_id = data[:slack_channel_link_id]
+      message_ts = data[:slack_message_ts]
+      return true unless channel_link_id.present? && message_ts.present?
+
+      with_transient_retry do
+        SlackInboundReservation.create!(
+          slack_channel_link_id: channel_link_id,
+          message_ts: message_ts
+        )
+      end
+      true
+    rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid
+      false
+    end
+
     def grant_feedback_permission(creative:, user:, granter:)
       # Check if share already exists
       existing_share = Collavre::CreativeShare.find_by(creative: creative, user: user)
-      return if existing_share && existing_share.permission_level >= Collavre::CreativeShare.permissions[:feedback]
+      return if feedback_or_higher?(existing_share)
 
       if existing_share
         existing_share.update!(permission: :feedback)
@@ -79,20 +178,48 @@ module CollavreSlack
           shared_by: granter
         )
       end
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+      # A concurrent message for the same user can create the share between the find_by
+      # above and this write, tripping the (creative_id, user_id) uniqueness. The grant
+      # is already satisfied, so re-check and treat as success — otherwise RecordInvalid
+      # would hit the job's `discard_on` and drop this still-unposted message.
+      raise unless feedback_or_higher?(Collavre::CreativeShare.find_by(creative: creative, user: user))
+    end
+
+    # Whether a CreativeShare grants feedback access or higher. `permission` is an enum
+    # returning the string label, so rank it via the enum mapping like Permissible does.
+    def feedback_or_higher?(share)
+      return false unless share
+
+      Collavre::CreativeShare.permissions.fetch(share.permission) >=
+        Collavre::CreativeShare.permissions.fetch("feedback")
     end
 
     def invite_user_by_email(creative:, email:, inviter:)
-      # Check if invitation already exists
+      # A pre-existing invitation was created AND had its email enqueued in the same
+      # transaction below, so there's nothing left to do. This dedups sequential
+      # redelivery; a true concurrent double-delivery can still create two invitations
+      # (no unique index on (creative_id, email)) — accepted, since a duplicate invite
+      # email is far less harmful than a lost message. If such an index is ever added,
+      # rescue RecordNotUnique + re-check here like #grant_feedback_permission does,
+      # otherwise the concurrent loser's create! would escape as a hard job failure.
       existing_invitation = Collavre::Invitation.find_by(creative: creative, email: email)
       return if existing_invitation
 
-      invitation = Collavre::Invitation.create!(
-        email: email,
-        inviter: inviter,
-        creative: creative,
-        permission: :feedback
-      )
-      Collavre::InvitationMailer.with(invitation: invitation).invite.deliver_later
+      # Create invitation + enqueue email atomically. `deliver_later` enqueues
+      # synchronously, so its INSERT joins this transaction; a transient EnqueueError
+      # rolls both back and #with_transient_retry redoes them together. Without the
+      # transaction, a committed invitation with a failed enqueue would, on retry, hit
+      # the guard above and silently never send the email.
+      ActiveRecord::Base.transaction do
+        invitation = Collavre::Invitation.create!(
+          email: email,
+          inviter: inviter,
+          creative: creative,
+          permission: :feedback
+        )
+        Collavre::InvitationMailer.with(invitation: invitation).invite.deliver_later
+      end
     end
 
     def format_comment_content(content, user, slack_display_name)

data/app/jobs/collavre_slack/slack_inbound_message_update_job.rb

@@ -4,8 +4,23 @@ module CollavreSlack
 
     queue_as :default
 
+    # SlackEventsController acks Slack with 200 the instant it enqueues this job
+    # (ack-before-apply), so Slack never re-delivers the event once accepted.
+    # Without a retry, a transient DB contention error would park the job and the
+    # inbound edit would be lost permanently. Only transient contention retries.
+    retry_on ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout,
+             wait: 2.seconds, attempts: 5
+
+    # Permanent/unprocessable failures: retrying cannot help. Discard so the
+    # queue self-heals rather than looping forever.
+    discard_on ActiveJob::DeserializationError
+    discard_on ActiveRecord::RecordNotFound
+    discard_on ActiveRecord::RecordInvalid
+
     def perform(payload)
-      with_slack_error_handling("SlackInboundMessageUpdateJob") do
+      # reraise so transient errors reach retry_on and permanent ones reach
+      # discard_on; the concern still logs before re-raising.
+      with_slack_error_handling("SlackInboundMessageUpdateJob", reraise: true) do
         data = payload.with_indifferent_access
         comment = Collavre::Comment.find_by(id: data[:comment_id])
         return unless comment

data/app/jobs/collavre_slack/slack_inbound_reaction_job.rb

@@ -2,6 +2,20 @@ module CollavreSlack
   class SlackInboundReactionJob < ApplicationJob
     queue_as :default
 
+    # SlackEventsController acks Slack with 200 the instant it enqueues this job
+    # (ack-before-apply), so Slack never re-delivers the event once accepted.
+    # Without a retry, a transient DB contention error would park the job and the
+    # inbound reaction would be lost permanently. Only transient contention
+    # retries; a real bug still raises and parks.
+    retry_on ActiveRecord::Deadlocked, ActiveRecord::LockWaitTimeout,
+             wait: 2.seconds, attempts: 5
+
+    # Permanent/unprocessable failures: retrying cannot help. Discard so the
+    # queue self-heals rather than looping forever.
+    discard_on ActiveJob::DeserializationError
+    discard_on ActiveRecord::RecordNotFound
+    discard_on ActiveRecord::RecordInvalid
+
     def perform(payload)
       data = payload.with_indifferent_access
       comment = Collavre::Comment.find_by(id: data[:comment_id])

data/app/models/collavre_slack/slack_channel_link.rb

@@ -8,6 +8,7 @@ module CollavreSlack
 
     has_many :slack_message_logs, class_name: "CollavreSlack::SlackMessageLog", dependent: :destroy
     has_many :slack_comment_links, class_name: "CollavreSlack::SlackCommentLink", dependent: :destroy
+    has_many :slack_inbound_reservations, class_name: "CollavreSlack::SlackInboundReservation", dependent: :destroy
 
     validates :channel_id, :channel_name, presence: true
     # 1:1 relationship: one creative can only be linked to one Slack channel

data/app/models/collavre_slack/slack_inbound_reservation.rb

@@ -0,0 +1,14 @@
+module CollavreSlack
+  # Pre-flight claim on an inbound Slack message so its non-idempotent side effects
+  # run once. The unique (slack_channel_link_id, message_ts) index makes the claim
+  # atomic: of two concurrent jobs, only one inserts and proceeds. See the job for
+  # the crash-window trade-off.
+  class SlackInboundReservation < ApplicationRecord
+    self.table_name = "slack_inbound_reservations"
+
+    belongs_to :slack_channel_link, class_name: "CollavreSlack::SlackChannelLink"
+
+    validates :message_ts, presence: true
+    validates :message_ts, uniqueness: { scope: :slack_channel_link_id }
+  end
+end

data/db/migrate/20260712000000_create_slack_inbound_reservations.rb

@@ -0,0 +1,17 @@
+class CreateSlackInboundReservations < ActiveRecord::Migration[8.0]
+  def change
+    # Pre-flight claim so an inbound Slack message's non-idempotent side effects run
+    # once under concurrent/redelivered delivery. The unique (slack_channel_link_id,
+    # message_ts) index is the atomic gate, claimed up front rather than after the
+    # side effects.
+    create_table :slack_inbound_reservations do |t|
+      t.references :slack_channel_link, null: false, foreign_key: { on_delete: :cascade }
+      t.string :message_ts, null: false
+
+      t.timestamps
+    end
+
+    add_index :slack_inbound_reservations, [ :slack_channel_link_id, :message_ts ],
+      unique: true, name: "idx_slack_inbound_reservations_on_channel_and_ts"
+  end
+end

data/lib/collavre_slack/version.rb

@@ -1,3 +1,3 @@
 module CollavreSlack
-  VERSION = "0.2.7"
+  VERSION = "0.2.9"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: collavre_slack
 version: !ruby/object:Gem::Version
-  version: 0.2.7
+  version: 0.2.9
 platform: ruby
 authors:
 - Collavre
@@ -98,6 +98,7 @@ files:
 - app/models/collavre_slack/slack_account.rb
 - app/models/collavre_slack/slack_channel_link.rb
 - app/models/collavre_slack/slack_comment_link.rb
+- app/models/collavre_slack/slack_inbound_reservation.rb
 - app/models/collavre_slack/slack_message_log.rb
 - app/models/collavre_slack/slack_user_mapping.rb
 - app/models/concerns/collavre_slack/error_loggable.rb
@@ -125,6 +126,7 @@ files:
 - db/migrate/20260130010001_add_comment_id_to_slack_message_logs.rb
 - db/migrate/20260130020000_add_cascade_delete_to_slack_comment_foreign_keys.rb
 - db/migrate/20260131000000_remove_is_active_from_slack_channel_links.rb
+- db/migrate/20260712000000_create_slack_inbound_reservations.rb
 - lib/collavre_slack.rb
 - lib/collavre_slack/configuration.rb
 - lib/collavre_slack/engine.rb