grape-slack-bot 1.8.2 → 2.0.1

data/lib/slack_bot/grape_extension.rb

@@ -1,8 +1,14 @@
 require "active_support"
 require "active_support/core_ext/object"
+require "active_support/security_utils"
 
 module SlackBot
   module GrapeHelpers
+    # Slack recommends rejecting requests older than 5 minutes
+    TIMESTAMP_TOLERANCE_SECONDS = 300
+    # Minimum length for Slack signing secret (Slack's requirement)
+    MIN_SIGNING_SECRET_LENGTH = 32
+
     def fetch_team_id
       params.dig("team_id") || params.dig("team", "id")
     end
@@ -13,32 +19,12 @@ module SlackBot
 
     def verify_slack_signature!
       slack_signing_secret = ENV["SLACK_SIGNING_SECRET"]
-      timestamp = request.headers["x-slack-request-timestamp"] || request.headers["X-Slack-Request-Timestamp"]
-      slack_signature = request.headers["x-slack-signature"] || request.headers["X-Slack-Signature"]
-      if slack_signing_secret.blank? || timestamp.blank? || slack_signature.blank?
-        raise SlackBot::Errors::SignatureAuthenticationError.new("Missing signature headers")
-      end
+      timestamp = slack_request_header("x-slack-request-timestamp", "X-Slack-Request-Timestamp")
+      slack_signature = slack_request_header("x-slack-signature", "X-Slack-Signature")
 
-      request.body.rewind
-      request_body = request.body.read
-      request.body.rewind
-
-      sig_basestring = "v0:#{timestamp}:#{request_body}"
-      my_signature =
-        "v0=" +
-        OpenSSL::HMAC.hexdigest(
-          OpenSSL::Digest.new("sha256"),
-          slack_signing_secret,
-          sig_basestring
-        )
-      if ActiveSupport::SecurityUtils.secure_compare(
-        my_signature,
-        slack_signature
-      )
-        true
-      else
-        raise SlackBot::Errors::SignatureAuthenticationError.new("Signature mismatch")
-      end
+      validate_signature_headers!(slack_signing_secret, timestamp, slack_signature)
+      validate_request_timestamp!(timestamp)
+      verify_signature_match!(slack_signing_secret, timestamp, slack_signature)
     end
 
     def verify_slack_team!
@@ -61,11 +47,9 @@ module SlackBot
     end
 
     def verify_current_user!
-      if current_user
-        true
-      else
-        raise SlackBot::Errors::UserAuthenticationError.new("User is not authorized")
-      end
+      return true if current_user
+
+      raise SlackBot::Errors::UserAuthenticationError.new("User is not authorized")
     end
 
     def events_callback(params)
@@ -73,7 +57,7 @@ module SlackBot
 
       SlackBot::DevConsole.log_input "SlackApi::Events#events_callback: #{params.inspect}"
       handler = config.find_event_handler(params[:event][:type].to_sym)
-      return if handler.blank?
+      return false if handler.blank?
 
       event = handler.new(params: params, current_user: current_user)
       event.call
@@ -84,36 +68,124 @@ module SlackBot
       {challenge: params[:challenge]}
     end
 
+    def validate_callback_user!(callback, user)
+      if callback.user_id != user.id
+        raise SlackBot::Errors::CallbackUserMismatchError.new("Callback user is not equal to action user")
+      end
+    end
+
     def handle_block_actions_view(view:, user:, params:)
-      callback_id = view&.dig("callback_id")
+      callback = find_callback!(view: view, user: user)
+      log_callback_check(callback, user)
+      validate_callback_user!(callback, user)
+
+      interaction_klass = callback_interaction_klass(callback)
+      return false if interaction_klass.blank?
+
+      interaction_klass.new(current_user: user, params: params, callback: callback, config: config).call
+    end
+
+    private
+
+    def slack_request_header(*names)
+      names.each do |name|
+        header = request.headers[name]
+        return header if header
+      end
+
+      nil
+    end
+
+    def validate_signature_headers!(slack_signing_secret, timestamp, slack_signature)
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Missing signature headers") if slack_signing_secret.blank? || timestamp.blank? || slack_signature.blank?
+      return if slack_signing_secret.start_with?("test_") || slack_signing_secret.length >= MIN_SIGNING_SECRET_LENGTH
+
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Invalid signing secret format")
+    end
+
+    def validate_request_timestamp!(timestamp)
+      request_timestamp = timestamp.to_i
+      current_timestamp = Time.now.to_i
+      return if (current_timestamp - request_timestamp).abs <= TIMESTAMP_TOLERANCE_SECONDS
+
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Request timestamp too old")
+    end
 
-      callback = SlackBot::Callback.find(callback_id, user: user, config: config)
+    def verify_signature_match!(slack_signing_secret, timestamp, slack_signature)
+      return true if ActiveSupport::SecurityUtils.secure_compare(computed_signature(slack_signing_secret, timestamp), slack_signature)
+
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Signature mismatch")
+    end
+
+    def computed_signature(slack_signing_secret, timestamp)
+      sig_basestring = "v0:#{timestamp}:#{request_body_content}"
+      "v0=" + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), slack_signing_secret, sig_basestring)
+    end
+
+    def request_body_content
+      return "" unless request.body
+
+      request.body.rewind if request.body.respond_to?(:rewind)
+      body_content = request.body.read
+      request.body.rewind if request.body.respond_to?(:rewind)
+      body_content
+    end
+
+    def find_callback!(view:, user:)
+      callback = SlackBot::Callback.find(view&.dig("callback_id"), user: user, config: config)
       raise SlackBot::Errors::CallbackNotFound.new if callback.blank?
 
+      callback
+    end
+
+    def log_callback_check(callback, user)
       SlackBot::DevConsole.log_check "SlackApi::Interactions##{__method__}: #{callback.id} #{callback.payload} #{callback.user_id} #{user&.id}"
+    end
 
-      if callback.user_id != user.id
-        raise "Callback user is not equal to action user"
-      end
+    def callback_interaction_klass(callback)
+      handler_class_obj = callback.handler_class
+      handler_class_obj&.interaction_klass if handler_class_obj&.respond_to?(:interaction_klass)
+    end
 
-      interaction_klass = callback.handler_class&.interaction_klass
-      return if interaction_klass.blank?
+    def parse_interaction_payload!(raw_payload)
+      JSON.parse(raw_payload)
+    rescue JSON::ParserError => e
+      raise SlackBot::Errors::InvalidPayloadError.new("Invalid JSON payload: #{e.message}")
+    end
 
-      interaction_klass.new(current_user: user, params: params, callback: callback, config: config).call
+    def resolve_action_user(payload)
+      resolve_user_session(payload.dig("user", "team_id"), payload.dig("user", "id"))
+    end
+
+    def blank_slack_response!
+      body false
+      status 200
     end
   end
 
   module GrapeExtension
     def self.included(base)
+      configure_base!(base)
+      add_commands_resource!(base)
+      add_interactions_resource!(base)
+      add_events_resource!(base)
+      add_menu_options_resource!(base)
+    end
+
+    def self.configure_base!(base)
       base.format :json
       base.content_type :json, "application/json"
-      base.use ActionDispatch::RemoteIp
+      base.use ActionDispatch::RemoteIp if defined?(ActionDispatch::RemoteIp)
       base.helpers SlackBot::GrapeHelpers
-
+      base.rescue_from SlackBot::Error do |e|
+        error!({error: e.message}, 200)
+      end
       base.before do
         verify_slack_signature!
       end
+    end
 
+    def self.add_commands_resource!(base)
       base.resource :commands do
         post ":url_token" do
           command_config = config.find_slash_command_config(params[:url_token], params[:command], params[:text])
@@ -123,79 +195,68 @@ module SlackBot
           args = params[:text].gsub(/^#{command_config.full_token}\s?/, "")
           SlackBot::DevConsole.log_input "SlackApi::SlashCommands#post: #{command_config.url_token} | #{command_config.full_token} | #{args}"
 
-          action =
-            command_klass.new(
-              current_user: current_user,
-              params: params,
-              args: args,
-              config: config
-            )
+          action = command_klass.new(current_user: current_user, params: params, args: args, config: config)
           verify_slack_team! if action.only_slack_team?
           verify_direct_message_channel! if action.only_direct_message?
           verify_current_user! if action.only_user?
 
           result = action.call
-          return body false if !result
+          return blank_slack_response! unless result
 
           result
         end
       end
+    end
 
+    def self.add_interactions_resource!(base)
       base.resource :interactions do
         post do
-          payload = JSON.parse(params[:payload])
+          payload = parse_interaction_payload!(params[:payload])
+          action_user = resolve_action_user(payload)&.user
 
-          action_user_session =
-            resolve_user_session(
-              payload.dig("user", "team_id"),
-              payload.dig("user", "id")
-            )
-          action_user = action_user_session&.user
-
-          action_type = payload["type"]
-          result = case action_type
+          result = case payload["type"]
           when "block_actions", "view_submission"
-            handle_block_actions_view(
-              view: payload["view"],
-              user: action_user,
-              params: params
-            )
+            handle_block_actions_view(view: payload["view"], user: action_user, params: params)
           else
-            raise "Unknown action type: #{action_type}"
+            raise SlackBot::Errors::UnknownActionTypeError.new(payload["type"])
           end
 
-          return body false if result.blank?
+          return blank_slack_response! if result.blank? || result == false
 
           result
         end
       end
+    end
 
+    def self.add_events_resource!(base)
       base.resource :events do
         post do
-          result =
-            case params[:type]
-            when "url_verification"
-              url_verification(params)
-            when "event_callback"
-              events_callback(params)
-            end
+          result = case params[:type]
+          when "url_verification"
+            url_verification(params)
+          when "event_callback"
+            events_callback(params)
+          else
+            raise SlackBot::Errors::UnknownActionTypeError.new(params[:type])
+          end
 
-          return body false if result.blank?
+          return blank_slack_response! if result.blank? || result == false
 
           result
         end
       end
+    end
 
+    def self.add_menu_options_resource!(base)
       base.resource :menu_options do
         get do
           SlackBot::DevConsole.log_input "SlackApi::MenuOptions#get: #{params.inspect}"
 
-          action_id = params[:action_id]
-          menu_options_klass = config.find_menu_options(action_id)
+          menu_options_klass = config.find_menu_options(params[:action_id])
           raise SlackBot::Errors::MenuOptionsNotImplemented.new if menu_options_klass.blank?
 
           menu_options = menu_options_klass.new(current_user: current_user, params: params, config: config).call
-          return body false if menu_options.blank?
+          return blank_slack_response! if menu_options.blank?
 
           menu_options
         end

data/lib/slack_bot/interaction.rb

@@ -10,55 +10,20 @@ module SlackBot
     include SlackBot::Concerns::ViewKlass
 
     def self.open_modal(callback:, trigger_id:, view:)
-      view = view.merge({type: "modal", callback_id: callback&.id})
-      response =
-        SlackBot::ApiClient.new.views_open(trigger_id: trigger_id, view: view)
-
-      if !response.ok?
-        raise SlackBot::Errors::OpenModalError.new(response.error, data: response.data, payload: view)
-      end
-
-      view_id = response.data.dig("view", "id")
-      if callback.present? && view_id.present?
-        callback.view_id = view_id
-        callback.save
-      end
-      SlackViewsReply.new(callback&.id, view_id)
+      view = modal_payload(callback, view)
+      response = SlackBot::ApiClient.new.views_open(trigger_id: trigger_id, view: view)
+      build_view_reply(response: response, callback: callback, payload: view, error_class: SlackBot::Errors::OpenModalError)
     end
 
     def self.update_modal(callback:, view_id:, view:)
-      view = view.merge({type: "modal", callback_id: callback&.id})
-      response =
-        SlackBot::ApiClient.new.views_update(view_id: view_id, view: view)
-
-      if !response.ok?
-        raise SlackBot::Errors::UpdateModalError.new(response.error, data: response.data, payload: view)
-      end
-
-      view_id = response.data.dig("view", "id")
-      if callback.present? && view_id.present?
-        callback.view_id = view_id
-        callback.save
-      end
-      SlackViewsReply.new(callback&.id, view_id)
+      view = modal_payload(callback, view)
+      response = SlackBot::ApiClient.new.views_update(view_id: view_id, view: view)
+      build_view_reply(response: response, callback: callback, payload: view, error_class: SlackBot::Errors::UpdateModalError)
     end
 
     def self.publish_view(user_id:, view:, callback: nil, metadata: nil)
-      view = view.merge(callback_id: callback.id) if callback.present?
-      view = view.merge(private_metadata: metadata) if metadata.present?
-      response =
-        SlackBot::ApiClient.new.views_publish(user_id: user_id, view: view)
-
-      if !response.ok?
-        raise SlackBot::Errors::PublishViewError.new(response.error, data: response.data, payload: view)
-      end
-
-      view_id = response.data.dig("view", "id")
-      if callback.present? && view_id.present?
-        callback.view_id = view_id
-        callback.save
-      end
-      SlackViewsReply.new(callback&.id, view_id)
+      response = SlackBot::ApiClient.new.views_publish(user_id: user_id, view: publish_payload(callback, metadata, view))
+      build_view_reply(response: response, callback: callback, payload: view, error_class: SlackBot::Errors::PublishViewError)
     end
 
     attr_reader :current_user, :params, :callback, :config
@@ -73,6 +38,31 @@ module SlackBot
       nil
     end
 
+    def self.modal_payload(callback, view)
+      view.merge(type: "modal", callback_id: callback&.id)
+    end
+
+    def self.publish_payload(callback, metadata, view)
+      view = view.merge(callback_id: callback.id) if callback.present?
+      view = view.merge(private_metadata: metadata) if metadata.present?
+      view
+    end
+
+    def self.build_view_reply(response:, callback:, payload:, error_class:)
+      raise error_class.new(response.error, data: response.data, payload: payload) unless response.ok?
+
+      view_id = response.data.dig("view", "id")
+      persist_view_id(callback, view_id)
+      SlackViewsReply.new(callback&.id, view_id)
+    end
+
+    def self.persist_view_id(callback, view_id)
+      return unless callback.present? && view_id.present?
+
+      callback.view_id = view_id
+      callback.save
+    end
+
     private
 
     def interaction_type
@@ -149,7 +139,11 @@ module SlackBot
     end
 
     def payload
-      @payload ||= JSON.parse(params[:payload])
+      @payload ||= begin
+        JSON.parse(params[:payload])
+      rescue JSON::ParserError => e
+        raise SlackBot::Errors::InvalidPayloadError.new("Invalid JSON payload: #{e.message}")
+      end
     end
   end
 end

data/lib/slack_bot/logger.rb

@@ -4,5 +4,20 @@ module SlackBot
       puts args.inspect if args.any?
       puts kwargs.inspect if kwargs.any?
     end
+
+    def error(*args, **kwargs)
+      puts args.inspect if args.any?
+      puts kwargs.inspect if kwargs.any?
+    end
+
+    def warn(*args, **kwargs)
+      puts args.inspect if args.any?
+      puts kwargs.inspect if kwargs.any?
+    end
+
+    def debug(*args, **kwargs)
+      puts args.inspect if args.any?
+      puts kwargs.inspect if kwargs.any?
+    end
   end
 end

data/lib/slack_bot/menu_options.rb

@@ -6,5 +6,9 @@ module SlackBot
       @params = params
       @config = config || SlackBot::Config.current_instance
     end
+
+    def call
+      nil
+    end
   end
 end

data/lib/slack_bot/view.rb

@@ -22,14 +22,18 @@ module SlackBot
       super
     end
 
+    def respond_to_missing?(method_name, include_private = false)
+      (@context.is_a?(Hash) && @context.key?(method_name.to_sym)) || super
+    end
+
     def text_modal
       {
         title: {
           type: "plain_text",
-          text: context[:title]
+          text: context&.dig(:title) || ""
         },
         blocks: [
-          {type: "section", text: {type: "mrkdwn", text: context[:text]}}
+          {type: "section", text: {type: "mrkdwn", text: context&.dig(:text) || ""}}
         ]
       }
     end

data/lib/slack_bot.rb

@@ -1,3 +1,6 @@
+require "json"
+require "openssl"
+
 require "slack_bot/logger"
 require "slack_bot/dev_console"
 
@@ -22,5 +25,5 @@ require "slack_bot/pager"
 require "slack_bot/grape_extension"
 
 module SlackBot
-  VERSION = "1.8.2".freeze
+  VERSION = "2.0.1".freeze
 end