@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/slack-provisioning/apps.js

@@ -0,0 +1,181 @@
+/**
+ * Slack Manifest API via documented `slack api` methods.
+ *
+ * @fileoverview create / update / validate — signing_secret only on create
+ */
+
+'use strict';
+
+const { runSlackApi, runNativeAppInstall } = require('./cli');
+const { slackProvisioningError } = require('./errors');
+const { pickSlackClientId } = require('./remaining-urls');
+const {
+  developerInstallApp,
+  pickInstalledSlackTokens
+} = require('./developer-install');
+
+/**
+ * @param {Object} body
+ * @returns {Object}
+ */
+function requireOk(body) {
+  if (body && body.ok === true) {
+    return body;
+  }
+  const detail = body && body.error ? String(body.error) : 'unknown_error';
+  const notes = Array.isArray(body && body.errors)
+    ? body.errors.map((row) => row && row.message).filter(Boolean).join('; ')
+    : '';
+  const suffix = notes ? ` (${notes})` : '';
+  throw slackProvisioningError(`Slack Manifest API failed: ${detail}${suffix}`, 'SLACK_API');
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {Object}
+ */
+function manifestPayload(manifest) {
+  return { manifest: JSON.stringify(manifest) };
+}
+
+/**
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function validateManifestRemote(manifest, deps = {}) {
+  const payload = manifestPayload(manifest);
+  if (typeof deps.appId === 'string' && deps.appId.trim()) {
+    payload.app_id = deps.appId.trim();
+  }
+  const body = await runSlackApi('apps.manifest.validate', payload, deps);
+  return requireOk(body);
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<Object|null>}
+ */
+async function exportManifestApp(appId, deps = {}) {
+  const result = await exportManifestLookup(appId, deps);
+  return result.manifest;
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ missing: boolean, manifest: Object|null }>}
+ */
+async function exportManifestLookup(appId, deps = {}) {
+  if (!appId) {
+    return { missing: true, manifest: null };
+  }
+  const body = await runSlackApi('apps.manifest.export', { app_id: appId }, deps);
+  if (body && body.ok === false && body.error === 'app_not_found') {
+    return { missing: true, manifest: null };
+  }
+  if (!body || body.ok === false) {
+    return { missing: false, manifest: null };
+  }
+  return { missing: false, manifest: body.manifest || null };
+}
+
+/**
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function createManifestApp(manifest, deps = {}) {
+  const body = await runSlackApi('apps.manifest.create', manifestPayload(manifest), deps);
+  const created = requireOk(body);
+  const createdAppId = created.app_id || created.appId;
+  if (!createdAppId) {
+    throw slackProvisioningError('Slack create did not return an app id.', 'SLACK_API');
+  }
+  created.app_id = createdAppId;
+  return created;
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function updateManifestApp(appId, manifest, deps = {}) {
+  const body = await runSlackApi(
+    'apps.manifest.update',
+    { app_id: appId, ...manifestPayload(manifest) },
+    deps
+  );
+  return requireOk(body);
+}
+
+/**
+ * Recover public client id when create response omitted it.
+ * @param {Object} [captured]
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function resolveSlackClientId(captured, deps = {}) {
+  const existing = pickSlackClientId(captured);
+  if (existing) {
+    return existing;
+  }
+  const appId = captured && (captured.appId || captured.app_id);
+  if (!appId) {
+    return '';
+  }
+  const exported = await runSlackApi('apps.manifest.export', { app_id: appId }, deps);
+  const fromExport = pickSlackClientId(exported);
+  if (fromExport) {
+    return fromExport;
+  }
+  const info = await runSlackApi('apps.info', { app: appId }, deps);
+  return pickSlackClientId(info && (info.app || info));
+}
+
+/**
+ * Native Slack CLI `app install` (TTY). Portal quiet mode must not call this.
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ botToken?: string, teamId?: string, botId?: string }>}
+ */
+async function nativeInstallApp(appId, deps = {}) {
+  if (typeof deps.installApp === 'function') {
+    return deps.installApp(appId);
+  }
+  return pickInstalledSlackTokens(await runNativeAppInstall(appId, deps));
+}
+
+/**
+ * Workspace install. Prefer apps.developerInstall (HTTP, returns xoxb).
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ botToken?: string, teamId?: string, botId?: string }>}
+ */
+async function installManifestApp(appId, deps = {}) {
+  const fromApi = await developerInstallApp(appId, deps);
+  if (fromApi.botToken) {
+    return fromApi;
+  }
+  if (deps.quiet === true) {
+    return fromApi;
+  }
+  try {
+    return (await nativeInstallApp(appId, deps)) || {};
+  } catch {
+    return {};
+  }
+}
+
+module.exports = {
+  validateManifestRemote,
+  exportManifestApp,
+  exportManifestLookup,
+  createManifestApp,
+  updateManifestApp,
+  installManifestApp,
+  resolveSlackClientId
+};

package/lib/channels/slack-provisioning/auth-store.js

@@ -0,0 +1,110 @@
+/**
+ * Slack CLI login store (`~/.slack/credentials.json`) and `auth list` text.
+ *
+ * @fileoverview Never log or return tokens from public auth lists
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { slackCliHomeDir } = require('./install-cli');
+
+/**
+ * @param {Object} [deps]
+ * @returns {string}
+ */
+function slackCredentialsPath(deps = {}) {
+  return path.join(deps.homeDir || slackCliHomeDir(deps.env), '.slack', 'credentials.json');
+}
+
+/**
+ * @param {Object} data
+ * @returns {Object[]}
+ */
+function entriesFromCredentialsObject(data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) {
+    return [];
+  }
+  return Object.entries(data).map(([teamId, row]) => ({
+    team_id: String((row && (row.team_id || row.teamId)) || teamId),
+    team_domain: (row && (row.team_domain || row.teamDomain)) || undefined,
+    user_id: (row && (row.user_id || row.userId)) || undefined,
+    token: row && row.token ? String(row.token) : undefined
+  }));
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Object[]}
+ */
+function readSlackCredentialEntries(deps = {}) {
+  if (typeof deps.readCredentials === 'function') {
+    const listed = deps.readCredentials();
+    return Array.isArray(listed) ? listed : [];
+  }
+  const filePath = slackCredentialsPath(deps);
+  if (!fs.existsSync(filePath)) {
+    return [];
+  }
+  try {
+    return entriesFromCredentialsObject(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * @param {Object[]} entries
+ * @returns {Object[]}
+ */
+function publicSlackAuths(entries) {
+  return (Array.isArray(entries) ? entries : []).map((row) => ({
+    team_id: row.team_id,
+    team_domain: row.team_domain,
+    user_id: row.user_id
+  }));
+}
+
+/**
+ * @param {Object[]} entries
+ * @param {string} [teamId]
+ * @returns {string|null}
+ */
+function slackUserTokenForTeam(entries, teamId) {
+  const rows = Array.isArray(entries) ? entries : [];
+  const match = teamId
+    ? rows.find((row) => String(row.team_id || '') === String(teamId))
+    : (rows.length === 1 ? rows[0] : null);
+  const token = match && match.token;
+  return typeof token === 'string' && token.trim() ? token.trim() : null;
+}
+
+/**
+ * Slack CLI 4.x `auth list` is human text, not JSON.
+ * @param {string} text
+ * @returns {Object[]}
+ */
+function parseAuthListText(text) {
+  const source = String(text || '');
+  const auths = [];
+  const re = /([A-Za-z0-9._-]+)\s+\(Team ID:\s*(T[A-Z0-9]+)\)[\s\S]*?User ID:\s*(U[A-Z0-9]+)/gi;
+  let match = re.exec(source);
+  while (match) {
+    auths.push({
+      team_domain: match[1],
+      team_id: match[2],
+      user_id: match[3]
+    });
+    match = re.exec(source);
+  }
+  return auths;
+}
+
+module.exports = {
+  slackCredentialsPath,
+  readSlackCredentialEntries,
+  publicSlackAuths,
+  slackUserTokenForTeam,
+  parseAuthListText
+};

package/lib/channels/slack-provisioning/auth-ticket.js

@@ -0,0 +1,185 @@
+/**
+ * Slack CLI ticket handshake for portal channel install.
+ *
+ * @fileoverview Server runs `slack auth token --no-prompt`; user runs the slash command
+ */
+
+'use strict';
+
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { slackProvisioningError, wrapSlackCliError } = require('./errors');
+const { resolveSlackBinary, shouldSkipLiveSlackCli } = require('./cli');
+const { withSlackCliPath, installOfficialSlackCli } = require('./install-cli');
+
+const SLASH_RE = /\/slackauthticket\s+(\S+)/i;
+const ACCESS_TOKEN_RE = /\b(xox[peba]-[A-Za-z0-9-]+)\b/i;
+const TICKET_LINE_RE = /^[A-Za-z0-9._-]{16,}$/;
+const AUTH_DEAD_RE = /token_revoked|token_expired|invalid_auth|not_authed|account_inactive/i;
+
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+function looksLikeSlackAccessToken(value) {
+  return ACCESS_TOKEN_RE.test(String(value || '').trim());
+}
+
+/**
+ * @param {Error|Object|null} error
+ * @returns {boolean}
+ */
+function isSlackAuthDeadError(error) {
+  const message = String((error && error.message) || '');
+  return AUTH_DEAD_RE.test(message);
+}
+
+/**
+ * @param {string} ticket
+ * @returns {string}
+ */
+function slashCommandForTicket(ticket) {
+  const value = String(ticket || '').trim();
+  return value ? `/slackauthticket ${value}` : '';
+}
+
+/**
+ * @param {string} stdout
+ * @returns {{ ticket: string, slashCommand: string }}
+ */
+function parseAuthTicketStart(stdout) {
+  const text = String(stdout || '');
+  const slash = text.match(SLASH_RE);
+  if (slash) {
+    return { ticket: slash[1], slashCommand: slashCommandForTicket(slash[1]) };
+  }
+  const ticket = firstTicketLine(text);
+  if (!ticket) {
+    throw slackProvisioningError('Slack CLI did not return an auth ticket.', 'SLACK_CLI');
+  }
+  return { ticket, slashCommand: slashCommandForTicket(ticket) };
+}
+
+/**
+ * @param {string} text
+ * @returns {string}
+ */
+function firstTicketLine(text) {
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('/') || /challenge|enter|copy/i.test(trimmed)) {
+      continue;
+    }
+    if (TICKET_LINE_RE.test(trimmed) && !looksLikeSlackAccessToken(trimmed)) {
+      return trimmed;
+    }
+  }
+  return '';
+}
+
+/**
+ * @param {string} stdout
+ * @returns {string}
+ */
+function parseAuthTicketComplete(stdout) {
+  const match = String(stdout || '').match(ACCESS_TOKEN_RE);
+  if (!match) {
+    throw slackProvisioningError('Slack CLI did not return a session token.', 'SLACK_CLI');
+  }
+  return match[1];
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function ensureSlackCliForTicket(deps = {}) {
+  const existing = await resolveSlackBinary(deps);
+  if (existing) {
+    return existing;
+  }
+  if (shouldSkipLiveSlackCli(deps)) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  await installOfficialSlackCli(deps);
+  const installed = await resolveSlackBinary(deps);
+  if (!installed) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  return installed;
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<{ ticket: string, slashCommand: string }>}
+ */
+async function startSlackAuthTicket(deps = {}) {
+  if (typeof deps.startAuthTicket === 'function') {
+    return deps.startAuthTicket();
+  }
+  const bin = await ensureSlackCliForTicket(deps);
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(bin, ['auth', 'token', '--no-prompt', '--no-color', '-s'], {
+      timeout: deps.timeout || 30000,
+      killSignal: 'SIGKILL',
+      maxBuffer: 1024 * 1024,
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    return parseAuthTicketStart(result && result.stdout);
+  } catch (error) {
+    if (error && error.code === 'SLACK_CLI_MISSING') {
+      throw error;
+    }
+    throw wrapSlackCliError(error);
+  }
+}
+
+/**
+ * @param {{ ticket: string, challenge: string }} params
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function completeSlackAuthTicket(params, deps = {}) {
+  if (typeof deps.completeAuthTicket === 'function') {
+    return deps.completeAuthTicket(params);
+  }
+  const ticket = String(params && params.ticket ? params.ticket : '').trim();
+  const challenge = String(params && params.challenge ? params.challenge : '').trim();
+  if (!ticket || !challenge) {
+    throw slackProvisioningError('Challenge code and auth ticket are required.', 'SLACK_CLI');
+  }
+  const bin = await ensureSlackCliForTicket(deps);
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(
+      bin,
+      ['auth', 'token', '--no-prompt', '--challenge', challenge, '--ticket', ticket, '--no-color', '-s'],
+      {
+        timeout: deps.timeout || 45000,
+        killSignal: 'SIGKILL',
+        maxBuffer: 1024 * 1024,
+        env: withSlackCliPath(deps.env || process.env)
+      }
+    );
+    return parseAuthTicketComplete(result && result.stdout);
+  } catch (error) {
+    throw wrapSlackCliError(error);
+  }
+}
+
+module.exports = {
+  looksLikeSlackAccessToken,
+  isSlackAuthDeadError,
+  slashCommandForTicket,
+  parseAuthTicketStart,
+  parseAuthTicketComplete,
+  startSlackAuthTicket,
+  completeSlackAuthTicket
+};

package/lib/channels/slack-provisioning/auth.js

@@ -0,0 +1,115 @@
+/**
+ * Slack workspace identity from login store or `slack auth list`.
+ *
+ * @fileoverview Fail closed when multiple workspaces cannot be proven
+ */
+
+'use strict';
+
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { slackProvisioningError, wrapSlackCliError } = require('./errors');
+const { resolveSlackBinary, runSlackApi, shouldSkipLiveSlackCli } = require('./cli');
+const { withSlackCliPath } = require('./install-cli');
+const {
+  readSlackCredentialEntries,
+  publicSlackAuths,
+  parseAuthListText
+} = require('./auth-store');
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listSlackAuthsFromCli(deps = {}) {
+  const bin = await resolveSlackBinary(deps);
+  if (!bin) {
+    return [];
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(bin, ['auth', 'list', '--no-color', '-s'], {
+      timeout: 30000,
+      maxBuffer: 1024 * 1024,
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    return parseAuthListText(result && result.stdout);
+  } catch (error) {
+    throw wrapSlackCliError(error);
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listSlackAuths(deps = {}) {
+  if (typeof deps.listAuths === 'function') {
+    const listed = await deps.listAuths();
+    return Array.isArray(listed) ? listed : [];
+  }
+  const fromFile = publicSlackAuths(readSlackCredentialEntries(deps));
+  if (fromFile.length > 0) {
+    return fromFile;
+  }
+  if (shouldSkipLiveSlackCli(deps) && typeof deps.execFile !== 'function') {
+    return [];
+  }
+  return listSlackAuthsFromCli(deps);
+}
+
+/**
+ * Prove workspace identity from a short-lived session token for this run only.
+ * @param {Object} [deps]
+ * @returns {Promise<Object|null>}
+ */
+async function workspaceFromSessionToken(deps = {}) {
+  const token = typeof deps.slackUserToken === 'string' ? deps.slackUserToken.trim() : '';
+  if (!token) {
+    return null;
+  }
+  if (typeof deps.authTest === 'function') {
+    const listed = await deps.authTest();
+    if (!listed || !(listed.team_id || listed.teamId)) {
+      throw slackProvisioningError('Session token was not accepted.', 'UNPROVEN_IDENTITY');
+    }
+    return listed;
+  }
+  const body = await runSlackApi('auth.test', {}, deps);
+  if (!body || body.ok !== true || !(body.team_id || body.teamId)) {
+    throw slackProvisioningError('Session token was not accepted.', 'UNPROVEN_IDENTITY');
+  }
+  return { team_id: body.team_id || body.teamId, team: body.team };
+}
+
+/**
+ * @param {Object[]} auths
+ * @param {string} [expectedTeamId]
+ * @returns {Object}
+ */
+function pickSlackWorkspace(auths, expectedTeamId) {
+  const rows = Array.isArray(auths) ? auths : [];
+  if (expectedTeamId) {
+    const match = rows.find((row) => String(row.team_id || row.teamId || '') === expectedTeamId);
+    if (!match) {
+      throw slackProvisioningError(
+        `Signed-in Slack workspace does not match expected team "${expectedTeamId}".`,
+        'UNPROVEN_IDENTITY'
+      );
+    }
+    return match;
+  }
+  if (rows.length > 1) {
+    throw slackProvisioningError(
+      'Multiple Slack workspaces are signed in. Pass the expected team id rather than guessing.',
+      'UNPROVEN_IDENTITY'
+    );
+  }
+  return rows[0] || null;
+}
+
+module.exports = {
+  listSlackAuths,
+  pickSlackWorkspace,
+  workspaceFromSessionToken
+};

package/lib/channels/slack-provisioning/callbacks.js

@@ -0,0 +1,41 @@
+/**
+ * Fail before Slack create when callback URLs are missing or not public HTTPS.
+ *
+ * @fileoverview Events / interactivity / commands Request URLs
+ */
+
+'use strict';
+
+const { REQUIRED_CALLBACK_KEYS } = require('./constants');
+const { slackProvisioningError } = require('./errors');
+const { isPublicHttpsUrl } = require('../vendor-dataplane-url');
+
+/**
+ * @param {Object} runtimeValues
+ * @returns {void}
+ */
+function assertSlackCallbackUrls(runtimeValues) {
+  const missing = REQUIRED_CALLBACK_KEYS.filter((key) => {
+    const value = runtimeValues && runtimeValues[key];
+    return typeof value !== 'string' || !value.trim();
+  });
+  if (missing.length > 0) {
+    throw slackProvisioningError(
+      `Slack callback URLs are missing: ${missing.join(', ')}. ` +
+        'Generate the channel package against a public HTTPS dataplane before create.',
+      'CALLBACKS'
+    );
+  }
+  const unusable = REQUIRED_CALLBACK_KEYS.filter((key) => !isPublicHttpsUrl(runtimeValues[key]));
+  if (unusable.length > 0) {
+    throw slackProvisioningError(
+      `Slack callback URLs must be public HTTPS: ${unusable.join(', ')}.`,
+      'CALLBACKS'
+    );
+  }
+}
+
+module.exports = {
+  isPublicHttpsUrl,
+  assertSlackCallbackUrls
+};