grape-slack-bot 2.0.0 → 2.1.0

data/lib/slack_bot/grape_extension.rb

@@ -2,8 +2,14 @@ require "active_support"
 require "active_support/core_ext/object"
 require "active_support/security_utils"
 
+require_relative "grape_helpers/dispatch"
+require_relative "grape_helpers/interactions"
+
 module SlackBot
   module GrapeHelpers
+    include Dispatch
+    include Interactions
+
     # Slack recommends rejecting requests older than 5 minutes
     TIMESTAMP_TOLERANCE_SECONDS = 300
     # Minimum length for Slack signing secret (Slack's requirement)
@@ -19,60 +25,28 @@ module SlackBot
 
     def verify_slack_signature!
       slack_signing_secret = ENV["SLACK_SIGNING_SECRET"]
-      timestamp = request.headers["x-slack-request-timestamp"] || request.headers["X-Slack-Request-Timestamp"]
-      slack_signature = request.headers["x-slack-signature"] || request.headers["X-Slack-Signature"]
-      if slack_signing_secret.blank? || timestamp.blank? || slack_signature.blank?
-        raise SlackBot::Errors::SignatureAuthenticationError.new("Missing signature headers")
-      end
-
-      # Validate signing secret format (allow test secrets for testing)
-      unless slack_signing_secret.start_with?("test_") || slack_signing_secret.length >= MIN_SIGNING_SECRET_LENGTH
-        raise SlackBot::Errors::SignatureAuthenticationError.new("Invalid signing secret format")
-      end
-
-      # Validate timestamp to prevent replay attacks (Slack recommends 5 minutes)
-      request_timestamp = timestamp.to_i
-      current_timestamp = Time.now.to_i
-      if (current_timestamp - request_timestamp).abs > TIMESTAMP_TOLERANCE_SECONDS
-        raise SlackBot::Errors::SignatureAuthenticationError.new("Request timestamp too old")
-      end
+      timestamp = slack_request_header("x-slack-request-timestamp", "X-Slack-Request-Timestamp")
+      slack_signature = slack_request_header("x-slack-signature", "X-Slack-Signature")
 
-      request_body = if request.body
-        request.body.rewind if request.body.respond_to?(:rewind)
-        body_content = request.body.read
-        request.body.rewind if request.body.respond_to?(:rewind)
-        body_content
-      else
-        ""
-      end
-
-      sig_basestring = "v0:#{timestamp}:#{request_body}"
-      my_signature =
-        "v0=" +
-        OpenSSL::HMAC.hexdigest(
-          OpenSSL::Digest.new("sha256"),
-          slack_signing_secret,
-          sig_basestring
-        )
-      if ActiveSupport::SecurityUtils.secure_compare(
-        my_signature,
-        slack_signature
-      )
-        true
-      else
-        raise SlackBot::Errors::SignatureAuthenticationError.new("Signature mismatch")
-      end
+      validate_signature_headers!(slack_signing_secret, timestamp, slack_signature)
+      validate_request_timestamp!(timestamp)
+      verify_signature_match!(slack_signing_secret, timestamp, slack_signature)
     end
 
-    def verify_slack_team!
-      slack_team_id = ENV.fetch("SLACK_TEAM_ID")
-      if slack_team_id == fetch_team_id
+    def verify_slack_team!(team_id = nil)
+      slack_team_id = ENV["SLACK_TEAM_ID"]
+      requested_team_id = team_id || fetch_team_id
+      if slack_team_id.present? && slack_team_id == requested_team_id
         true
       else
         raise SlackBot::Errors::TeamAuthenticationError.new("Team is not authorized")
       end
     end
 
+    def interaction_team_id(payload)
+      payload.dig("team", "id") || payload["team_id"] || payload.dig("user", "team_id")
+    end
+
     def verify_direct_message_channel!
       if params[:channel_name] == "directmessage"
         true
@@ -89,15 +63,8 @@ module SlackBot
       raise SlackBot::Errors::UserAuthenticationError.new("User is not authorized")
     end
 
-    def events_callback(params)
-      verify_slack_team!
-
-      SlackBot::DevConsole.log_input "SlackApi::Events#events_callback: #{params.inspect}"
-      handler = config.find_event_handler(params[:event][:type].to_sym)
-      return false if handler.blank?
-
-      event = handler.new(params: params, current_user: current_user)
-      event.call
+    def slack_request_retry?
+      slack_request_header("x-slack-retry-num", "X-Slack-Retry-Num").present?
     end
 
     def url_verification(params)
@@ -105,48 +72,91 @@ module SlackBot
       {challenge: params[:challenge]}
     end
 
-    def validate_callback_user!(callback, user)
-      if callback.user_id != user.id
-        raise SlackBot::Errors::CallbackUserMismatchError.new("Callback user is not equal to action user")
+    private
+
+    def slack_request_header(*names)
+      names.each do |name|
+        header = request.headers[name]
+        return header if header
       end
+
+      nil
+    end
+
+    def validate_signature_headers!(slack_signing_secret, timestamp, slack_signature)
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Missing signature headers") if slack_signing_secret.blank? || timestamp.blank? || slack_signature.blank?
+      return if slack_signing_secret.start_with?("test_") || slack_signing_secret.length >= MIN_SIGNING_SECRET_LENGTH
+
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Invalid signing secret format")
+    end
+
+    def validate_request_timestamp!(timestamp)
+      request_timestamp = timestamp.to_i
+      current_timestamp = Time.now.to_i
+      return if (current_timestamp - request_timestamp).abs <= TIMESTAMP_TOLERANCE_SECONDS
+
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Request timestamp too old")
     end
 
-    def handle_block_actions_view(view:, user:, params:)
-      callback_id = view&.dig("callback_id")
+    def verify_signature_match!(slack_signing_secret, timestamp, slack_signature)
+      return true if ActiveSupport::SecurityUtils.secure_compare(computed_signature(slack_signing_secret, timestamp), slack_signature)
+
+      raise SlackBot::Errors::SignatureAuthenticationError.new("Signature mismatch")
+    end
+
+    def computed_signature(slack_signing_secret, timestamp)
+      sig_basestring = "v0:#{timestamp}:#{request_body_content}"
+      "v0=" + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), slack_signing_secret, sig_basestring)
+    end
 
-      callback = SlackBot::Callback.find(callback_id, user: user, config: config)
-      raise SlackBot::Errors::CallbackNotFound.new if callback.blank?
+    def request_body_content
+      return "" unless request.body
 
-      SlackBot::DevConsole.log_check "SlackApi::Interactions##{__method__}: #{callback.id} #{callback.payload} #{callback.user_id} #{user&.id}"
+      request.body.rewind if request.body.respond_to?(:rewind)
+      body_content = request.body.read
+      request.body.rewind if request.body.respond_to?(:rewind)
+      body_content
+    end
 
-      validate_callback_user!(callback, user)
+    def parse_interaction_payload!(raw_payload)
+      JSON.parse(raw_payload)
+    rescue JSON::ParserError => e
+      raise SlackBot::Errors::InvalidPayloadError.new("Invalid JSON payload: #{e.message}")
+    end
 
-      handler_class_obj = callback.handler_class
-      interaction_klass = handler_class_obj&.interaction_klass if handler_class_obj&.respond_to?(:interaction_klass)
-      return false if interaction_klass.blank?
+    def resolve_action_user(payload)
+      resolve_user_session(payload.dig("user", "team_id"), payload.dig("user", "id"))
+    end
 
-      interaction_klass.new(current_user: user, params: params, callback: callback, config: config).call
+    def blank_slack_response!
+      body false
+      status 200
     end
   end
 
   module GrapeExtension
     def self.included(base)
+      configure_base!(base)
+      add_commands_resource!(base)
+      add_interactions_resource!(base)
+      add_events_resource!(base)
+      add_menu_options_resource!(base)
+    end
+
+    def self.configure_base!(base)
       base.format :json
       base.content_type :json, "application/json"
       base.use ActionDispatch::RemoteIp if defined?(ActionDispatch::RemoteIp)
       base.helpers SlackBot::GrapeHelpers
-
-      # Handle custom errors
-      # Slack API requires 200 OK responses to avoid retries
-      # Errors should be returned as 200 OK with error information in the response body
       base.rescue_from SlackBot::Error do |e|
         error!({error: e.message}, 200)
       end
-
       base.before do
         verify_slack_signature!
       end
+    end
 
+    def self.add_commands_resource!(base)
       base.resource :commands do
         post ":url_token" do
           command_config = config.find_slash_command_config(params[:url_token], params[:command], params[:text])
@@ -156,101 +166,67 @@ module SlackBot
           args = params[:text].gsub(/^#{command_config.full_token}\s?/, "")
           SlackBot::DevConsole.log_input "SlackApi::SlashCommands#post: #{command_config.url_token} | #{command_config.full_token} | #{args}"
 
-          action =
-            command_klass.new(
-              current_user: current_user,
-              params: params,
-              args: args,
-              config: config
-            )
+          action = command_klass.new(current_user: current_user, params: params, args: args, config: config)
           verify_slack_team! if action.only_slack_team?
           verify_direct_message_channel! if action.only_direct_message?
           verify_current_user! if action.only_user?
 
           result = action.call
-          if !result
-            body false
-            status 200
-            return
-          end
+          return blank_slack_response! unless result
 
           result
         end
       end
+    end
 
+    def self.add_interactions_resource!(base)
       base.resource :interactions do
         post do
-          begin
-            payload = JSON.parse(params[:payload])
-          rescue JSON::ParserError => e
-            raise SlackBot::Errors::InvalidPayloadError.new("Invalid JSON payload: #{e.message}")
-          end
+          payload = parse_interaction_payload!(params[:payload])
+          verify_slack_team!(interaction_team_id(payload))
+          action_user = resolve_action_user(payload)&.user
 
-          action_user_session =
-            resolve_user_session(
-              payload.dig("user", "team_id"),
-              payload.dig("user", "id")
-            )
-          action_user = action_user_session&.user
-
-          action_type = payload["type"]
-          result = case action_type
-          when "block_actions", "view_submission"
-            handle_block_actions_view(
-              view: payload["view"],
-              user: action_user,
-              params: params
-            )
-          else
-            raise SlackBot::Errors::UnknownActionTypeError.new(action_type)
-          end
+          result = route_interaction(payload: payload, user: action_user, params: params)
 
-          if result.blank? || result == false
-            body false
-            status 200
-            return
-          end
+          return blank_slack_response! if result.blank? || result == false
 
           result
         end
       end
+    end
 
+    def self.add_events_resource!(base)
       base.resource :events do
         post do
-          result =
-            case params[:type]
-            when "url_verification"
-              url_verification(params)
-            when "event_callback"
-              events_callback(params)
-            else
-              raise SlackBot::Errors::UnknownActionTypeError.new(params[:type])
-            end
-
-          if result.blank? || result == false
-            body false
-            status 200
-            return
+          return blank_slack_response! if slack_request_retry?
+
+          result = case params[:type]
+          when "url_verification"
+            url_verification(params)
+          when "event_callback"
+            events_callback(params)
+          else
+            raise SlackBot::Errors::UnknownActionTypeError.new(params[:type])
           end
 
+          return blank_slack_response! if result.blank? || result == false
+
           result
         end
       end
+    end
 
+    def self.add_menu_options_resource!(base)
       base.resource :menu_options do
         get do
           SlackBot::DevConsole.log_input "SlackApi::MenuOptions#get: #{params.inspect}"
 
-          action_id = params[:action_id]
-          menu_options_klass = config.find_menu_options(action_id)
+          verify_slack_team!
+          menu_options_klass = config.find_menu_options(params[:action_id])
           raise SlackBot::Errors::MenuOptionsNotImplemented.new if menu_options_klass.blank?
 
           menu_options = menu_options_klass.new(current_user: current_user, params: params, config: config).call
-          if menu_options.blank?
-            body false
-            status 200
-            return
-          end
+          return blank_slack_response! if menu_options.blank?
 
           menu_options
         end

data/lib/slack_bot/grape_helpers/dispatch.rb

@@ -0,0 +1,54 @@
+module SlackBot
+  module GrapeHelpers
+    module Dispatch
+      def events_callback(params)
+        verify_slack_team!
+
+        event = params[:event]
+        return false if event.blank?
+        return false if bot_message_event?(event)
+
+        SlackBot::DevConsole.log_input "SlackApi::Events#events_callback: #{params.inspect}"
+        handler = event_handler_for(params)
+        return false if handler.blank?
+
+        run_event_handler(handler, params)
+      end
+
+      def resolve_user_session(team_id, user_id)
+        return if team_id.blank? || user_id.blank?
+
+        config.user_session_resolver!.call(team_id, user_id)
+      rescue SlackBot::Errors::ConfigurationError
+        nil
+      end
+
+      def resolve_event_user(params)
+        resolve_user_session(params[:team_id] || params["team_id"], fetch_user_id)&.user
+      end
+
+      def dispatch_event(handler:, params:, current_user:)
+        config.event_dispatcher_method.call(handler: handler, params: params, current_user: current_user)
+        false
+      end
+
+      private
+
+      def bot_message_event?(event)
+        (event[:subtype] || event["subtype"]) == "bot_message"
+      end
+
+      def event_handler_for(params)
+        event_type = params[:event][:type] || params[:event]["type"]
+        config.find_event_handler(event_type.to_sym)
+      end
+
+      def run_event_handler(handler, params)
+        current_user = resolve_event_user(params)
+        return dispatch_event(handler: handler, params: params, current_user: current_user) if config.event_dispatcher_method
+
+        handler.new(params: params, current_user: current_user).call
+      end
+    end
+  end
+end

data/lib/slack_bot/grape_helpers/interactions.rb

@@ -0,0 +1,65 @@
+module SlackBot
+  module GrapeHelpers
+    module Interactions
+      def route_interaction(payload:, user:, params:)
+        case payload["type"]
+        when "view_submission"
+          handle_block_actions_view(view: payload["view"], user: user, params: params)
+        when "block_actions"
+          if payload["view"].present?
+            handle_block_actions_view(view: payload["view"], user: user, params: params)
+          else
+            handle_block_actions_message(payload: payload, user: user, params: params)
+          end
+        else
+          raise SlackBot::Errors::UnknownActionTypeError.new(payload["type"])
+        end
+      end
+
+      def handle_block_actions_message(payload:, user:, params:)
+        action_id = payload.dig("actions", 0, "action_id")
+        return false if action_id.blank?
+
+        interaction_klass = config.find_block_action(action_id)
+        raise SlackBot::Errors::BlockActionNotImplemented.new if interaction_klass.blank?
+
+        interaction_klass.new(current_user: user, params: params, config: config).call
+      end
+
+      def validate_callback_user!(callback, user)
+        if callback.user_id != user.id
+          raise SlackBot::Errors::CallbackUserMismatchError.new("Callback user is not equal to action user")
+        end
+      end
+
+      def handle_block_actions_view(view:, user:, params:)
+        callback = find_callback!(view: view, user: user)
+        log_callback_check(callback, user)
+        validate_callback_user!(callback, user)
+
+        interaction_klass = callback_interaction_klass(callback)
+        return false if interaction_klass.blank?
+
+        interaction_klass.new(current_user: user, params: params, callback: callback, config: config).call
+      end
+
+      private
+
+      def find_callback!(view:, user:)
+        callback = SlackBot::Callback.find(view&.dig("callback_id"), user: user, config: config)
+        raise SlackBot::Errors::CallbackNotFound.new if callback.blank?
+
+        callback
+      end
+
+      def log_callback_check(callback, user)
+        SlackBot::DevConsole.log_check "SlackApi::Interactions##{__method__}: #{callback.id} #{callback.payload} #{callback.user_id} #{user&.id}"
+      end
+
+      def callback_interaction_klass(callback)
+        handler_class_obj = callback.handler_class
+        handler_class_obj&.interaction_klass if handler_class_obj&.respond_to?(:interaction_klass)
+      end
+    end
+  end
+end

data/lib/slack_bot/interaction.rb

@@ -9,56 +9,29 @@ module SlackBot
 
     include SlackBot::Concerns::ViewKlass
 
-    def self.open_modal(callback:, trigger_id:, view:)
-      view = view.merge({type: "modal", callback_id: callback&.id})
-      response =
-        SlackBot::ApiClient.new.views_open(trigger_id: trigger_id, view: view)
+    def self.api_client
+      @api_client ||= SlackBot::ApiClient.new
+    end
 
-      if !response.ok?
-        raise SlackBot::Errors::OpenModalError.new(response.error, data: response.data, payload: view)
-      end
+    def self.api_client=(client)
+      @api_client = client
+    end
 
-      view_id = response.data.dig("view", "id")
-      if callback.present? && view_id.present?
-        callback.view_id = view_id
-        callback.save
-      end
-      SlackViewsReply.new(callback&.id, view_id)
+    def self.open_modal(callback:, trigger_id:, view:)
+      view = modal_payload(callback, view)
+      response = api_client.views_open(trigger_id: trigger_id, view: view)
+      build_view_reply(response: response, callback: callback, payload: view, error_class: SlackBot::Errors::OpenModalError)
     end
 
     def self.update_modal(callback:, view_id:, view:)
-      view = view.merge({type: "modal", callback_id: callback&.id})
-      response =
-        SlackBot::ApiClient.new.views_update(view_id: view_id, view: view)
-
-      if !response.ok?
-        raise SlackBot::Errors::UpdateModalError.new(response.error, data: response.data, payload: view)
-      end
-
-      view_id = response.data.dig("view", "id")
-      if callback.present? && view_id.present?
-        callback.view_id = view_id
-        callback.save
-      end
-      SlackViewsReply.new(callback&.id, view_id)
+      view = modal_payload(callback, view)
+      response = api_client.views_update(view_id: view_id, view: view)
+      build_view_reply(response: response, callback: callback, payload: view, error_class: SlackBot::Errors::UpdateModalError)
     end
 
     def self.publish_view(user_id:, view:, callback: nil, metadata: nil)
-      view = view.merge(callback_id: callback.id) if callback.present?
-      view = view.merge(private_metadata: metadata) if metadata.present?
-      response =
-        SlackBot::ApiClient.new.views_publish(user_id: user_id, view: view)
-
-      if !response.ok?
-        raise SlackBot::Errors::PublishViewError.new(response.error, data: response.data, payload: view)
-      end
-
-      view_id = response.data.dig("view", "id")
-      if callback.present? && view_id.present?
-        callback.view_id = view_id
-        callback.save
-      end
-      SlackViewsReply.new(callback&.id, view_id)
+      response = api_client.views_publish(user_id: user_id, view: publish_payload(callback, metadata, view))
+      build_view_reply(response: response, callback: callback, payload: view, error_class: SlackBot::Errors::PublishViewError)
     end
 
     attr_reader :current_user, :params, :callback, :config
@@ -73,6 +46,31 @@ module SlackBot
       nil
     end
 
+    def self.modal_payload(callback, view)
+      view.merge(type: "modal", callback_id: callback&.id)
+    end
+
+    def self.publish_payload(callback, metadata, view)
+      view = view.merge(callback_id: callback.id) if callback.present?
+      view = view.merge(private_metadata: metadata) if metadata.present?
+      view
+    end
+
+    def self.build_view_reply(response:, callback:, payload:, error_class:)
+      raise error_class.new(response.error, data: response.data, payload: payload) unless response.ok?
+
+      view_id = response.data.dig("view", "id")
+      persist_view_id(callback, view_id)
+      SlackViewsReply.new(callback&.id, view_id)
+    end
+
+    def self.persist_view_id(callback, view_id)
+      return unless callback.present? && view_id.present?
+
+      callback.view_id = view_id
+      callback.save
+    end
+
     private
 
     def interaction_type

data/lib/slack_bot/logger.rb

@@ -1,5 +1,33 @@
 module SlackBot
   class Logger
+    class << self
+      def info(...)
+        logger_backend.info(...)
+      end
+
+      def error(...)
+        logger_backend.error(...)
+      end
+
+      def warn(...)
+        logger_backend.warn(...)
+      end
+
+      def debug(...)
+        logger_backend.debug(...)
+      end
+
+      private
+
+      def logger_backend
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        else
+          @logger_backend ||= new
+        end
+      end
+    end
+
     def info(*args, **kwargs)
       puts args.inspect if args.any?
       puts kwargs.inspect if kwargs.any?

data/lib/slack_bot/pager.rb

@@ -12,11 +12,11 @@ module SlackBot
     end
 
     def total_count
-      source_cursor.count
+      @total_count ||= source_cursor.count
     end
 
     def pages_count
-      (source_cursor.count.to_f / limit).ceil
+      (total_count.to_f / limit).ceil
     end
 
     def offset

data/lib/slack_bot.rb

@@ -25,5 +25,5 @@ require "slack_bot/pager"
 require "slack_bot/grape_extension"
 
 module SlackBot
-  VERSION = "2.0.0".freeze
+  VERSION = "2.1.0".freeze
 end