@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/slack-provisioning/cli.js

@@ -0,0 +1,226 @@
+/**
+ * Spawn Slack CLI (`slack api …`) without scattering argv.
+ *
+ * @fileoverview Documented CLI only; skipped under Jest unless deps allow it
+ */
+
+'use strict';
+
+const path = require('path');
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { SLACK_BINARIES } = require('./constants');
+const { slackProvisioningError, wrapSlackCliError } = require('./errors');
+const { withSlackCliPath, slackCliLocalBinDir } = require('./install-cli');
+const { readSlackCredentialEntries, slackUserTokenForTeam } = require('./auth-store');
+
+/**
+ * @returns {boolean}
+ */
+function isJestWorker() {
+  return Boolean(process.env.JEST_WORKER_ID);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipLiveSlackCli(deps = {}) {
+  if (deps.allowInTests === true) {
+    return false;
+  }
+  return isJestWorker();
+}
+
+/**
+ * @returns {string[]}
+ */
+function slackBinaryCandidates() {
+  const local = path.join(slackCliLocalBinDir(), 'slack');
+  return [local, ...SLACK_BINARIES];
+}
+
+/**
+ * @param {typeof execFileDefault} execFileImpl
+ * @param {string} bin
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function binaryResponds(execFileImpl, bin, deps = {}) {
+  try {
+    await execFileImpl(bin, ['--version'], {
+      timeout: 20000,
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function resolveSlackBinary(deps = {}) {
+  if (typeof deps.slackBinary === 'string' && deps.slackBinary.trim()) {
+    return deps.slackBinary.trim();
+  }
+  if (shouldSkipLiveSlackCli(deps)) {
+    return null;
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  for (const bin of slackBinaryCandidates()) {
+    if (await binaryResponds(execFileImpl, bin, deps)) {
+      return bin;
+    }
+  }
+  return null;
+}
+
+/**
+ * Slack CLI `api` does not load ~/.slack/credentials.json unless a token is set.
+ * @param {Object} [deps]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function slackApiChildEnv(deps = {}) {
+  const env = withSlackCliPath(deps.env || process.env);
+  if (env.SLACK_USER_TOKEN || env.SLACK_BOT_TOKEN) {
+    return env;
+  }
+  if (typeof deps.slackUserToken === 'string' && deps.slackUserToken.trim()) {
+    return { ...env, SLACK_USER_TOKEN: deps.slackUserToken.trim() };
+  }
+  const token = slackUserTokenForTeam(readSlackCredentialEntries(deps), deps.teamId);
+  return token ? { ...env, SLACK_USER_TOKEN: token } : env;
+}
+
+/**
+ * Slack CLI 4.x: `slack api <method> --json '{...}' [-w team]`.
+ * @param {string} method
+ * @param {Object} [payload]
+ * @param {Object} [deps]
+ * @returns {string[]}
+ */
+function buildSlackApiArgs(method, payload = {}, deps = {}) {
+  const args = ['api', method, '--json', JSON.stringify(payload || {}), '--no-color', '-s'];
+  if (typeof deps.teamId === 'string' && deps.teamId.trim()) {
+    args.push('-w', deps.teamId.trim());
+  }
+  return args;
+}
+
+/**
+ * @param {string} stdout
+ * @returns {Object}
+ */
+function parseJsonStdout(stdout) {
+  const text = String(stdout || '').trim();
+  if (!text) {
+    return {};
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    const start = text.indexOf('{');
+    const end = text.lastIndexOf('}');
+    if (start >= 0 && end > start) {
+      return JSON.parse(text.slice(start, end + 1));
+    }
+    throw wrapSlackCliError(new Error('Slack CLI returned non-JSON output'));
+  }
+}
+
+/**
+ * @param {unknown} error
+ * @returns {Object|null}
+ */
+function jsonBodyFromCliError(error) {
+  const stdout = error && error.stdout;
+  if (!stdout) {
+    return null;
+  }
+  try {
+    const body = parseJsonStdout(stdout);
+    return body && typeof body === 'object' ? body : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Documented `slack api <method>` with a JSON payload.
+ * @param {string} method
+ * @param {Object} [payload]
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function runSlackApi(method, payload = {}, deps = {}) {
+  if (typeof deps.slackApi === 'function') {
+    return deps.slackApi(method, payload);
+  }
+  const bin = await resolveSlackBinary(deps);
+  if (!bin) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(bin, buildSlackApiArgs(method, payload, deps), {
+      cwd: deps.cwd,
+      env: slackApiChildEnv(deps),
+      timeout: deps.timeout || 180000,
+      maxBuffer: 2 * 1024 * 1024
+    });
+    return parseJsonStdout(result && result.stdout);
+  } catch (error) {
+    const body = jsonBodyFromCliError(error);
+    if (body) {
+      return body;
+    }
+    throw wrapSlackCliError(error);
+  }
+}
+
+/**
+ * Native Slack CLI install (project-based; may no-op without a Slack app project).
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function runNativeAppInstall(appId, deps = {}) {
+  const bin = await resolveSlackBinary(deps);
+  if (!bin || !appId) {
+    return {};
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  const args = ['app', 'install', '-a', String(appId), '--no-color', '-s', '-f'];
+  if (typeof deps.teamId === 'string' && deps.teamId.trim()) {
+    args.push('-w', deps.teamId.trim());
+  }
+  try {
+    const result = await execFileImpl(bin, args, {
+      cwd: deps.cwd,
+      env: slackApiChildEnv(deps),
+      timeout: deps.timeout || 180000,
+      killSignal: 'SIGKILL',
+      maxBuffer: 2 * 1024 * 1024
+    });
+    return parseJsonStdout(result && result.stdout);
+  } catch {
+    return {};
+  }
+}
+
+module.exports = {
+  isJestWorker,
+  shouldSkipLiveSlackCli,
+  resolveSlackBinary,
+  runSlackApi,
+  runNativeAppInstall,
+  parseJsonStdout,
+  buildSlackApiArgs,
+  slackApiChildEnv
+};

package/lib/channels/slack-provisioning/constants.js

@@ -0,0 +1,37 @@
+/**
+ * Slack channel provisioning constants.
+ *
+ * @fileoverview Shared keys — never persist Slack tokens
+ */
+
+'use strict';
+
+const STATE_KIND = 'slack-channel';
+const STATE_FILE = 'provisioning-state.json';
+const SLACK_BINARIES = ['slack'];
+const SECRET_KEY_RE =
+  /^(accessToken|refreshToken|botToken|bot_token|signingSecret|signing_secret|client_secret|clientSecret|password)$/i;
+const KV_SIGNING_SECRET = 'kv://slack/signingSecret';
+const KV_BOT_TOKEN = 'kv://slack/botToken';
+const KV_CLIENT_SECRET = 'kv://slack/clientSecret';
+/** Slack create/install writes these into integration .env, then dataplane push. */
+const SLACK_PROVISIONED_KV_KEYS = [KV_SIGNING_SECRET, KV_BOT_TOKEN, KV_CLIENT_SECRET];
+const SLACK_APPS_URL = 'https://api.slack.com/apps';
+const SLACK_CLI_DOCS_URL = 'https://docs.slack.dev/tools/slack-cli';
+const SLACK_CLI_INSTALL_SCRIPT_URL = 'https://downloads.slack-edge.com/slack-cli/install.sh';
+const REQUIRED_CALLBACK_KEYS = ['eventsUrl', 'interactionUrl', 'commandUrl'];
+
+module.exports = {
+  STATE_KIND,
+  STATE_FILE,
+  SLACK_BINARIES,
+  SECRET_KEY_RE,
+  KV_SIGNING_SECRET,
+  KV_BOT_TOKEN,
+  KV_CLIENT_SECRET,
+  SLACK_PROVISIONED_KV_KEYS,
+  SLACK_APPS_URL,
+  SLACK_CLI_DOCS_URL,
+  SLACK_CLI_INSTALL_SCRIPT_URL,
+  REQUIRED_CALLBACK_KEYS
+};

package/lib/channels/slack-provisioning/credentials.js

@@ -0,0 +1,169 @@
+/**
+ * Store Slack secrets locally (secret set) then publish to dataplane.
+ *
+ * @fileoverview Never log or persist secret values in dist /
+ */
+
+'use strict';
+
+const { storeCredentialSecrets } = require('../../api/credential.api');
+const { KV_BOT_TOKEN, KV_CLIENT_SECRET, KV_SIGNING_SECRET } = require('./constants');
+const { writeSlackSecretsEnvFiles } = require('./env-file');
+
+/**
+ * @param {string} [value]
+ * @returns {boolean}
+ */
+function hasSecretValue(value) {
+  return typeof value === 'string' && Boolean(value.trim());
+}
+
+/**
+ * @param {string} kvPath
+ * @returns {string}
+ */
+function kvPathToSecretSetKey(kvPath) {
+  return String(kvPath || '').replace(/^kv:\/\//, '');
+}
+
+/**
+ * @param {Object} captured
+ * @param {Object} credentials
+ * @param {string[]} names
+ * @returns {string|undefined}
+ */
+function pickNamedSecret(captured, credentials, names) {
+  for (const name of names) {
+    if (hasSecretValue(captured[name])) return captured[name];
+    if (hasSecretValue(credentials[name])) return credentials[name];
+  }
+  return undefined;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {Object}
+ */
+function asSecretMap(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return value;
+  }
+  if (typeof value === 'string' && value.trim().startsWith('{')) {
+    try {
+      const parsed = JSON.parse(value);
+      return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+
+/**
+ * @param {Object} captured
+ * @returns {{ signingSecret?: string, botToken?: string, clientSecret?: string }}
+ */
+function pickSlackSecrets(captured) {
+  const source = captured || {};
+  const nested = asSecretMap(source.body || source.data);
+  const credentials = asSecretMap(source.credentials || nested.credentials);
+  const fromSource = pickNamedSecret(source, credentials, ['signingSecret', 'signing_secret']);
+  const fromNested = pickNamedSecret(nested, credentials, ['signingSecret', 'signing_secret']);
+  return {
+    signingSecret: fromSource || fromNested,
+    botToken: pickNamedSecret(source, credentials, ['botToken', 'bot_token', 'access_token'])
+      || pickNamedSecret(nested, credentials, ['botToken', 'bot_token', 'access_token']),
+    clientSecret: pickNamedSecret(source, credentials, ['clientSecret', 'client_secret'])
+      || pickNamedSecret(nested, credentials, ['clientSecret', 'client_secret'])
+  };
+}
+
+/**
+ * @param {{ signingSecret?: string, botToken?: string, clientSecret?: string }} secrets
+ * @returns {Array<{ key: string, value: string }>}
+ */
+function slackSecretItems(secrets) {
+  const pairs = [
+    [KV_SIGNING_SECRET, secrets && secrets.signingSecret],
+    [KV_BOT_TOKEN, secrets && secrets.botToken],
+    [KV_CLIENT_SECRET, secrets && secrets.clientSecret]
+  ];
+  return pairs
+    .filter(([, value]) => hasSecretValue(value))
+    .map(([key, value]) => ({ key, value: String(value).trim() }));
+}
+
+/**
+ * @param {Array<{ key: string, value: string }>} items
+ * @param {Object} deps
+ * @returns {Promise<void>}
+ */
+async function writeSlackSecretsLocal(items, deps) {
+  const setSecret =
+    deps.setSecretInStore || require('../../core/secrets-ensure').setSecretInStore;
+  for (const item of items) {
+    await setSecret(kvPathToSecretSetKey(item.key), item.value);
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function localSlackSigningPresent(deps = {}) {
+  if (typeof deps.hasLocalSlackSigningSecret === 'function') {
+    return deps.hasLocalSlackSigningSecret();
+  }
+  try {
+    const { loadSecrets } = require('../../core/secrets');
+    const secrets = await loadSecrets();
+    return hasSecretValue(secrets && secrets['slack/signingSecret']);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {Array<{ key: string }>} items
+ * @returns {{ stored: boolean, storedSigningSecret: boolean, storedBotToken: boolean,
+ *   storedClientSecret: boolean }}
+ */
+function slackStoreFlags(items) {
+  const keys = new Set(items.map((item) => item.key));
+  return {
+    stored: items.length > 0,
+    storedSigningSecret: keys.has(KV_SIGNING_SECRET),
+    storedBotToken: keys.has(KV_BOT_TOKEN),
+    storedClientSecret: keys.has(KV_CLIENT_SECRET)
+  };
+}
+
+/**
+ * Write Slack create/install secrets to local store and integration .env, then push.
+ *
+ * @param {Object} ctx
+ * @param {{ signingSecret?: string, botToken?: string, clientSecret?: string }} secrets
+ * @returns {Promise<{ stored: boolean, storedSigningSecret: boolean, storedBotToken: boolean,
+ *   storedClientSecret: boolean }>}
+ */
+async function storeSlackChannelSecrets(ctx, secrets, deps = {}) {
+  const items = slackSecretItems(secrets);
+  const flags = slackStoreFlags(items);
+  if (!flags.stored) {
+    return flags;
+  }
+  await writeSlackSecretsLocal(items, deps);
+  writeSlackSecretsEnvFiles(ctx, items, deps);
+  const store = deps.storeCredentialSecrets || storeCredentialSecrets;
+  await store(ctx.dataplaneUrl, ctx.authConfig, items);
+  return flags;
+}
+
+module.exports = {
+  hasSecretValue,
+  kvPathToSecretSetKey,
+  pickSlackSecrets,
+  slackSecretItems,
+  localSlackSigningPresent,
+  storeSlackChannelSecrets
+};

package/lib/channels/slack-provisioning/curl-shim.js

@@ -0,0 +1,132 @@
+/**
+ * Minimal curl stand-in for hosts where `curl` is not installed.
+ * Supports URL download to stdout or `-o` / `--output` (including clustered `-fLo`).
+ */
+
+'use strict';
+
+const fs = require('fs');
+const https = require('https');
+const http = require('http');
+
+const MAX_REDIRECTS = 5;
+
+function isHttpUrl(value) {
+  return /^https?:\/\//i.test(String(value || ''));
+}
+
+/**
+ * Consume `-o FILE`, `--output FILE`, `-fLo FILE`, or `-oFILE`.
+ * @returns {number} last consumed argv index
+ */
+function applyOutputFlag(arg, argv, index, state) {
+  if (arg === '-o' || arg === '--output') {
+    state.output = argv[index + 1] || '';
+    return index + 1;
+  }
+  if (!arg.startsWith('-') || arg.startsWith('--') || arg === '-') {
+    return index;
+  }
+  const body = arg.slice(1);
+  const outputAt = body.indexOf('o');
+  if (outputAt < 0) {
+    return index;
+  }
+  const inline = body.slice(outputAt + 1);
+  if (inline) {
+    state.output = inline;
+    return index;
+  }
+  state.output = argv[index + 1] || '';
+  return index + 1;
+}
+
+function parseCurlArgs(argv) {
+  const state = { output: '', positionals: [] };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--url') {
+      state.positionals.push(argv[i + 1] || '');
+      i += 1;
+      continue;
+    }
+    if (typeof arg === 'string' && arg.startsWith('--url=')) {
+      state.positionals.push(arg.slice('--url='.length));
+      continue;
+    }
+    const next = applyOutputFlag(arg, argv, i, state);
+    if (next !== i) {
+      i = next;
+      continue;
+    }
+    if (typeof arg === 'string' && arg.startsWith('-')) {
+      continue;
+    }
+    state.positionals.push(arg);
+  }
+  const url = state.positionals.find(isHttpUrl) || state.positionals[0] || '';
+  return { output: state.output, url };
+}
+
+function followRedirect(url, res, redirects, output, resolve, reject) {
+  const status = res.statusCode || 0;
+  if (!(status >= 300 && status < 400 && res.headers.location)) {
+    return false;
+  }
+  res.resume();
+  if (redirects >= MAX_REDIRECTS) {
+    reject(new Error('Too many redirects.'));
+    return true;
+  }
+  const nextUrl = new URL(res.headers.location, url).toString();
+  download(nextUrl, output, redirects + 1).then(resolve, reject);
+  return true;
+}
+
+function download(url, output, redirects) {
+  return new Promise((resolve, reject) => {
+    if (!isHttpUrl(url)) {
+      reject(new Error('URL is required.'));
+      return;
+    }
+    const client = url.startsWith('https:') ? https : http;
+    const req = client.get(url, { timeout: 60000 }, (res) => {
+      if (followRedirect(url, res, redirects, output, resolve, reject)) {
+        return;
+      }
+      if ((res.statusCode || 0) !== 200) {
+        res.resume();
+        reject(new Error(`Download failed (${res.statusCode || 0}).`));
+        return;
+      }
+      const dest = output ? fs.createWriteStream(output) : process.stdout;
+      res.pipe(dest);
+      dest.on('finish', () => {
+        if (output && typeof dest.close === 'function') {
+          dest.close(() => resolve());
+          return;
+        }
+        resolve();
+      });
+      dest.on('error', reject);
+    });
+    req.on('error', reject);
+  });
+}
+
+async function main(argv) {
+  const { output, url } = parseCurlArgs(argv);
+  if (!url) {
+    throw new Error('URL is required.');
+  }
+  await download(url, output, 0);
+}
+
+module.exports = { parseCurlArgs, download, main, isHttpUrl };
+
+if (require.main === module) {
+  main(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+  });
+}

package/lib/channels/slack-provisioning/developer-install.js

@@ -0,0 +1,118 @@
+/**
+ * Slack workspace install via apps.developerInstall (bot token).
+ *
+ * @fileoverview HTTP install for portal; signing secret still comes from create only
+ */
+
+'use strict';
+
+const { runSlackApi } = require('./cli');
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function trimmedString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+/**
+ * @param {...unknown} values
+ * @returns {string}
+ */
+function firstTrimmed(...values) {
+  for (const value of values) {
+    const text = trimmedString(value);
+    if (text) {
+      return text;
+    }
+  }
+  return '';
+}
+
+/**
+ * @param {Object} [manifest]
+ * @returns {string[]}
+ */
+function botScopesFromManifest(manifest) {
+  const scopes = manifest && manifest.oauth_config && manifest.oauth_config.scopes;
+  const bot = scopes && scopes.bot;
+  if (!Array.isArray(bot)) {
+    return [];
+  }
+  return bot.map((scope) => trimmedString(scope)).filter(Boolean);
+}
+
+/**
+ * @param {unknown} value
+ * @returns {Object}
+ */
+function asObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+/**
+ * @param {Object} [body]
+ * @returns {{ botToken?: string, teamId?: string, botId?: string }}
+ */
+function pickInstalledSlackTokens(body) {
+  if (!body || body.ok === false) {
+    return {};
+  }
+  const tokens = asObject(body.api_access_tokens);
+  const botToken = firstTrimmed(tokens.bot, body.bot_token, body.access_token, body.botToken);
+  if (!botToken) {
+    return {};
+  }
+  const teamId = firstTrimmed(body.team_id, asObject(body.team).id);
+  const botId = firstTrimmed(body.bot_id, asObject(body.bot).id);
+  return {
+    botToken,
+    ...(teamId ? { teamId } : {}),
+    ...(botId ? { botId } : {})
+  };
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Object}
+ */
+function developerInstallPayload(appId, deps = {}) {
+  const payload = { app_id: appId };
+  const scopes = Array.isArray(deps.botScopes)
+    ? deps.botScopes.map((scope) => trimmedString(scope)).filter(Boolean)
+    : [];
+  if (scopes.length) {
+    payload.bot_scopes = scopes;
+  }
+  return payload;
+}
+
+/**
+ * Same method Slack CLI uses. Returns bot token without hanging on `app install`.
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ botToken?: string, teamId?: string, botId?: string }>}
+ */
+async function developerInstallApp(appId, deps = {}) {
+  if (!appId) {
+    return {};
+  }
+  try {
+    const body = await runSlackApi(
+      'apps.developerInstall',
+      developerInstallPayload(appId, deps),
+      deps
+    );
+    return pickInstalledSlackTokens(body);
+  } catch {
+    return {};
+  }
+}
+
+module.exports = {
+  botScopesFromManifest,
+  pickInstalledSlackTokens,
+  developerInstallApp
+};