grape-slack-bot 2.1.2 → 2.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45d672bb2de61c8d0d1335a0ddf37c9242dc97dd6db90ba630a1d70d7330436c
-  data.tar.gz: a42ebdc015514c1e66a38511d54ce21e718be36161d14ead247859e09bffbe87
+  metadata.gz: c3e52396043a337cfa348d788ca11ea7d6b76c8486d080a2a0d43c69cf73ad4e
+  data.tar.gz: a20fd5e43a9695978b06250cd66a9c13bc2732b9246c9a1a8685e1986b9302f1
 SHA512:
-  metadata.gz: 1e41c14e09be9c8687b6653ea29a102586e3fb2750f68533dc63aef9a914f8d4aa818e2af8d8a850f9b9ecaeefff1268d5315fa3f5b42405b9df7c0311f19968
-  data.tar.gz: c1e26e64aa95b0ff1ceef088a171888e508348e3afca8fb865eca5071841c052178daa015ce19f6ffee7a70850597fdf276f843ca78b4698c8cd7640afeff766
+  metadata.gz: 4a25326a96fafe69c94ff3a2490bc9b674e5f8ee40e3c7dc481a5fef4f7ccb3a19cbc1fe471f6fb155b605e4c544c68785bf817a1a4f1a8686351e672201cd59
+  data.tar.gz: bb3fd2179189e08f5795a4a6cccbbb82f96d4157e455fbd0f28b955a7ca5ae7112b9da548326d1523aacfd2fb5640972aecaa05677ce9ff2b7bad760106f3822

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # CHANGELOG
 
+## 2.1.3 (2026-11-07)
+
+- Memoize parsed JSON in `SlackBot::ApiResponse#data` so repeated reads do not re-parse the response body
+- Encode Slack API request bodies with `JSON.generate` instead of ActiveSupport `Hash#to_json`
+- Verify Slack signatures with `HMAC.digest` and binary `secure_compare`; cache the request body for the verify pass
+- Keep `ApiResponse` hot-path shortcuts always on; drop `SlackBot::PressureOpts` / `SLACK_PRESSURE_*` feature flags
+- Return HTTP 401 when Slack request signature verification fails
+- Clamp a negative `Retry-After` value to zero before the bounded retry
+- Fail closed when release confirmation input reaches EOF
+- Require a matching `CHANGELOG.md` version heading before publish
+- Give the test workflow read-only `contents` permission
+
 ## 2.1.2 (2026-09-15)
 
 - Allow grape 4.x by expanding the runtime dependency to `< 5.0`

data/grape-slack-bot.gemspec

@@ -35,7 +35,7 @@ Gem::Specification.new do |gem|
   gem.add_runtime_dependency "ostruct", ">= 0.6"
 
   gem.add_development_dependency "rspec", "~> 3"
-  gem.add_development_dependency "polyrun", ">= 2.2.0"
+  gem.add_development_dependency "polyrun", ">= 2.2.9"
   gem.add_development_dependency "webmock", "~> 3"
   gem.add_development_dependency "rake", "~> 13"
   gem.add_development_dependency "standard", "~> 1.52"

data/lib/slack_bot/api_client.rb

@@ -1,4 +1,5 @@
 require "faraday"
+require "json"
 
 module SlackBot
   class ApiResponse
@@ -16,43 +17,78 @@ module SlackBot
     end
 
     def self.rate_limit_retry_sleep_seconds(retry_after)
-      [retry_after.to_i, RATE_LIMIT_RETRY_SLEEP_SECONDS].min
+      retry_after.to_i.clamp(0, RATE_LIMIT_RETRY_SLEEP_SECONDS)
     end
 
     def initialize(&block)
       @response = block.call
-      SlackBot::DevConsole.log_output "#{self.class.name}: #{response.body}"
+      if response.respond_to?(:headers)
+        @retry_after_header = response.headers["Retry-After"]&.to_i
+      end
     end
 
     def ok?
-      response.status == 200 && data["ok"]
+      return false unless response.status == 200
+
+      b = response.body
+      return true if b.is_a?(String) && b.start_with?('{"ok":true')
+
+      data["ok"]
     end
 
     def error
+      b = response.body
+      return nil if b.is_a?(String) && !b.include?('"error"')
+
       data["error"]
     end
 
     def rate_limited?
-      response.status == 429 || (data["ok"] == false && data["error"] == "rate_limited")
+      return true if response.status == 429
+
+      b = response.body
+      return false if b.is_a?(String) && b.start_with?('{"ok":true')
+
+      data_rate_limited_payload
+    end
+
+    def data_rate_limited_payload
+      data["ok"] == false && data["error"] == "rate_limited"
     end
 
     def retry_after
+      if @retry_after_header.is_a?(Integer) && !@retry_after_header.zero?
+        return @retry_after_header
+      end
+
+      return 60 unless response.respond_to?(:headers)
+
       response.headers["Retry-After"]&.to_i || 60
     end
 
     def slack_error?
-      !ok? && error.present?
+      return false if ok?
+
+      e = error
+      e.present? || response.status != 200
     end
 
     def authentication_error?
-      slack_error? && %w[invalid_auth account_inactive].include?(error)
+      return false unless slack_error?
+
+      e = error
+      return false if e.blank?
+
+      %w[invalid_auth account_inactive].include?(e)
     end
 
     def data
-      JSON.parse(response.body)
+      return @data if instance_variable_defined?(:@data)
+
+      @data = JSON.parse(response.body)
     rescue JSON::ParserError => e
       SlackBot::Logger.error("Failed to parse Slack API response: #{e.message}")
-      {"ok" => false, "error" => "invalid_json_response"}
+      @data = {"ok" => false, "error" => "invalid_json_response"}
     end
   end
 
@@ -73,69 +109,72 @@ module SlackBot
     end
 
     def views_open(trigger_id:, view:)
-      perform_request { client.post("views.open", {trigger_id: trigger_id, view: view}.to_json) }
+      perform_request { client.post("views.open", JSON.generate(trigger_id: trigger_id, view: view)) }
     end
 
     def views_update(view_id:, view:)
-      perform_request { client.post("views.update", {view_id: view_id, view: view}.to_json) }
+      perform_request { client.post("views.update", JSON.generate(view_id: view_id, view: view)) }
     end
 
     def chat_post_message(channel:, text:, blocks:)
-      perform_request { client.post("chat.postMessage", {channel: channel, text: text, blocks: blocks}.to_json) }
+      perform_request { client.post("chat.postMessage", JSON.generate(channel: channel, text: text, blocks: blocks)) }
     end
 
     def chat_update(channel:, ts:, text:, blocks:)
-      perform_request { client.post("chat.update", {channel: channel, ts: ts, text: text, blocks: blocks}.to_json) }
+      perform_request { client.post("chat.update", JSON.generate(channel: channel, ts: ts, text: text, blocks: blocks)) }
     end
 
     def chat_delete(channel:, ts:)
-      perform_request { client.post("chat.delete", {channel: channel, ts: ts}.to_json) }
+      perform_request { client.post("chat.delete", JSON.generate(channel: channel, ts: ts)) }
     end
 
     def chat_unfurl(channel:, ts:, unfurls:, source: nil, unfurl_id: nil, user_auth_blocks: nil, user_auth_message: nil, user_auth_required: nil, user_auth_url: nil)
       perform_request do
-        client.post("chat.unfurl", {
-          channel: channel,
-          ts: ts,
-          unfurls: unfurls,
-          source: source,
-          unfurl_id: unfurl_id,
-          user_auth_blocks: user_auth_blocks,
-          user_auth_message: user_auth_message,
-          user_auth_required: user_auth_required,
-          user_auth_url: user_auth_url
-        }.to_json)
+        client.post(
+          "chat.unfurl",
+          JSON.generate(
+            channel: channel,
+            ts: ts,
+            unfurls: unfurls,
+            source: source,
+            unfurl_id: unfurl_id,
+            user_auth_blocks: user_auth_blocks,
+            user_auth_message: user_auth_message,
+            user_auth_required: user_auth_required,
+            user_auth_url: user_auth_url
+          )
+        )
       end
     end
 
     def chat_schedule_message(channel:, text:, post_at:, blocks: nil)
-      perform_request { client.post("chat.scheduleMessage", {channel: channel, text: text, post_at: post_at, blocks: blocks}.to_json) }
+      perform_request { client.post("chat.scheduleMessage", JSON.generate(channel: channel, text: text, post_at: post_at, blocks: blocks)) }
     end
 
     def scheduled_messages_list(channel: nil, cursor: nil, latest: nil, limit: nil, oldest: nil, team_id: nil)
       args = compact_payload(channel: channel, cursor: cursor, limit: limit, latest: latest, oldest: oldest, team_id: team_id)
-      perform_request { client.post("scheduled_messages.list", args.to_json) }
+      perform_request { client.post("scheduled_messages.list", JSON.generate(args)) }
     end
 
     def chat_delete_scheduled_message(channel:, scheduled_message_id:)
-      perform_request { client.post("chat.deleteScheduledMessage", {channel: channel, scheduled_message_id: scheduled_message_id}.to_json) }
+      perform_request { client.post("chat.deleteScheduledMessage", JSON.generate(channel: channel, scheduled_message_id: scheduled_message_id)) }
     end
 
     def chat_get_permalink(channel:, message_ts:)
-      perform_request { client.post("chat.getPermalink", {channel: channel, message_ts: message_ts}.to_json) }
+      perform_request { client.post("chat.getPermalink", JSON.generate(channel: channel, message_ts: message_ts)) }
     end
 
     def users_info(user_id:)
-      perform_request { client.post("users.info", {user: user_id}.to_json) }
+      perform_request { client.post("users.info", JSON.generate(user: user_id)) }
     end
 
     def views_publish(user_id:, view:)
-      perform_request { client.post("views.publish", {user_id: user_id, view: view}.to_json) }
+      perform_request { client.post("views.publish", JSON.generate(user_id: user_id, view: view)) }
     end
 
     def users_list(cursor: nil, limit: 200, include_locale: nil, team_id: nil)
       args = compact_payload(cursor: cursor, limit: limit, include_locale: include_locale, team_id: team_id)
-      perform_request { client.post("users.list", args.to_json) }
+      perform_request { client.post("users.list", JSON.generate(args)) }
     end
 
     def chat_post_ephemeral(channel:, user:, text:, as_user: nil, attachments: nil, blocks: nil, icon_emoji: nil, icon_url: nil, link_names: nil, parse: nil, thread_ts: nil, username: nil)
@@ -153,7 +192,7 @@ module SlackBot
         thread_ts: thread_ts,
         username: username
       )
-      perform_request { client.post("chat.postEphemeral", args.to_json) }
+      perform_request { client.post("chat.postEphemeral", JSON.generate(args)) }
     end
 
     private

data/lib/slack_bot/grape_extension.rb

@@ -24,6 +24,8 @@ module SlackBot
     end
 
     def verify_slack_signature!
+      remove_instance_variable(:@request_body_content) if instance_variable_defined?(:@request_body_content)
+
       slack_signing_secret = ENV["SLACK_SIGNING_SECRET"]
       timestamp = slack_request_header("x-slack-request-timestamp", "X-Slack-Request-Timestamp")
       slack_signature = slack_request_header("x-slack-signature", "X-Slack-Signature")
@@ -95,7 +97,7 @@ module SlackBot
     end
 
     def validate_request_timestamp!(timestamp)
-      request_timestamp = timestamp.to_i
+      request_timestamp = Integer(timestamp, 10)
       current_timestamp = Time.now.to_i
       return if (current_timestamp - request_timestamp).abs <= TIMESTAMP_TOLERANCE_SECONDS
 
@@ -103,23 +105,25 @@ module SlackBot
     end
 
     def verify_signature_match!(slack_signing_secret, timestamp, slack_signature)
-      return true if ActiveSupport::SecurityUtils.secure_compare(computed_signature(slack_signing_secret, timestamp), slack_signature)
+      body = request_body_content
+      sig_basestring = "v0:#{timestamp}:#{body}"
+      expected_digest_bin = OpenSSL::HMAC.digest("SHA256", slack_signing_secret, sig_basestring)
+      actual_hex = slack_signature.delete_prefix("v0=")
+      return true if ActiveSupport::SecurityUtils.secure_compare(expected_digest_bin, [actual_hex].pack("H*"))
 
       raise SlackBot::Errors::SignatureAuthenticationError.new("Signature mismatch")
     end
 
-    def computed_signature(slack_signing_secret, timestamp)
-      sig_basestring = "v0:#{timestamp}:#{request_body_content}"
-      "v0=" + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), slack_signing_secret, sig_basestring)
-    end
-
     def request_body_content
-      return "" unless request.body
+      return @request_body_content if instance_variable_defined?(:@request_body_content)
+
+      return @request_body_content = "" unless request.body
 
       request.body.rewind if request.body.respond_to?(:rewind)
       body_content = request.body.read
       request.body.rewind if request.body.respond_to?(:rewind)
-      body_content
+
+      @request_body_content = body_content
     end
 
     def parse_interaction_payload!(raw_payload)
@@ -152,6 +156,9 @@ module SlackBot
       base.content_type :json, "application/json"
       base.use ActionDispatch::RemoteIp if defined?(ActionDispatch::RemoteIp)
       base.helpers SlackBot::GrapeHelpers
+      base.rescue_from SlackBot::Errors::SignatureAuthenticationError do |e|
+        error!({error: e.message}, 401)
+      end
       base.rescue_from SlackBot::Error do |e|
         error!({error: e.message}, 200)
       end

data/lib/slack_bot.rb

@@ -25,5 +25,5 @@ require "slack_bot/pager"
 require "slack_bot/grape_extension"
 
 module SlackBot
-  VERSION = "2.1.2".freeze
+  VERSION = "2.1.3".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: grape-slack-bot
 version: !ruby/object:Gem::Version
-  version: 2.1.2
+  version: 2.1.3
 platform: ruby
 authors:
 - Andrei Makarov
@@ -117,14 +117,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: 2.2.9
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: 2.2.9
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement