@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/slack-provisioning/env-file.js

@@ -0,0 +1,120 @@
+/**
+ * Write Slack provisioned secrets into integration .env (plain KV_* values).
+ *
+ * @fileoverview .env is the local SSOT; dataplane push reads these keys
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { getIntegrationPath } = require('../../utils/paths');
+const {
+  systemKeyToKvPrefix,
+  securityKeyToVar
+} = require('../../utils/credential-secrets-env-kv');
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function trimmed(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+/**
+ * kv://slack/signingSecret → KV_SLACK_SIGNINGSECRET
+ * @param {string} kvPath
+ * @returns {string}
+ */
+function kvPathToEnvVar(kvPath) {
+  const pathKey = String(kvPath || '').replace(/^kv:\/\//, '');
+  const slash = pathKey.indexOf('/');
+  if (slash <= 0) {
+    return '';
+  }
+  const systemKey = pathKey.slice(0, slash);
+  const securityKey = pathKey.slice(slash + 1);
+  if (!systemKey || !securityKey) {
+    return '';
+  }
+  return `KV_${systemKeyToKvPrefix(systemKey)}_${securityKeyToVar(securityKey)}`;
+}
+
+/**
+ * @param {Array<{ key: string, value: string }>} items
+ * @returns {Object.<string, string>}
+ */
+function slackEnvMapFromItems(items) {
+  const map = {};
+  for (const item of items || []) {
+    const envKey = kvPathToEnvVar(item && item.key);
+    if (envKey && trimmed(item.value)) {
+      map[envKey] = String(item.value).trim();
+    }
+  }
+  return map;
+}
+
+/**
+ * Catalog HMAC uses kv://slack/…; instance packages still use those KV_SLACK_* names.
+ * @param {Object} [ctx]
+ * @param {Object} [deps]
+ * @returns {string[]}
+ */
+function resolveSlackEnvPaths(ctx, deps = {}) {
+  const root = trimmed(deps.projectRoot);
+  const instanceKey = trimmed(deps.instanceSystemKey || (ctx && ctx.instanceSystemKey));
+  const folders = ['slack'];
+  if (instanceKey && instanceKey !== 'slack') {
+    folders.push(instanceKey);
+  }
+  return folders.map((folder) => (
+    root
+      ? path.join(path.resolve(root), 'integration', folder, '.env')
+      : path.join(getIntegrationPath(folder), '.env')
+  ));
+}
+
+/**
+ * @param {string} envPath
+ * @param {Object.<string, string>} envMap
+ * @returns {void}
+ */
+function mergeSlackEnvFile(envPath, envMap) {
+  const { mergeEnvMapIntoContent } = require('../../core/secrets-env-content');
+  fs.mkdirSync(path.dirname(envPath), { recursive: true });
+  const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : '';
+  const merged = mergeEnvMapIntoContent(existing, envMap);
+  const withNl = merged.endsWith('\n') ? merged : `${merged}\n`;
+  fs.writeFileSync(envPath, withNl, 'utf8');
+}
+
+/**
+ * @param {Object} [ctx]
+ * @param {Array<{ key: string, value: string }>} items
+ * @param {Object} [deps]
+ * @returns {string[]}
+ */
+function writeSlackSecretsEnvFiles(ctx, items, deps = {}) {
+  const envMap = slackEnvMapFromItems(items);
+  if (Object.keys(envMap).length === 0) {
+    return [];
+  }
+  if (typeof deps.writeSlackEnvFiles === 'function') {
+    return deps.writeSlackEnvFiles(envMap) || [];
+  }
+  const written = [];
+  for (const envPath of resolveSlackEnvPaths(ctx, deps)) {
+    mergeSlackEnvFile(envPath, envMap);
+    written.push(envPath);
+  }
+  return written;
+}
+
+module.exports = {
+  kvPathToEnvVar,
+  slackEnvMapFromItems,
+  resolveSlackEnvPaths,
+  writeSlackSecretsEnvFiles
+};

package/lib/channels/slack-provisioning/errors.js

@@ -0,0 +1,47 @@
+/**
+ * Normalize Slack provisioning failures without leaking tokens.
+ *
+ * @fileoverview User-facing Slack adapter errors
+ */
+
+'use strict';
+
+/**
+ * @param {string} message
+ * @param {string} [code]
+ * @returns {Error}
+ */
+function slackProvisioningError(message, code) {
+  const error = new Error(message);
+  error.code = code || 'SLACK_PROVISIONING';
+  return error;
+}
+
+/**
+ * @param {string} text
+ * @returns {string}
+ */
+function redactSlackSecrets(text) {
+  return String(text)
+    .replace(/xox[baprs]-[A-Za-z0-9-]+/g, '[redacted]')
+    .replace(/signing[_-]?secret["']?\s*[:=]\s*["']?[^"'\s]+/gi, 'signing_secret=[redacted]');
+}
+
+/**
+ * @param {unknown} error
+ * @returns {Error}
+ */
+function wrapSlackCliError(error) {
+  const raw = error && error.message ? String(error.message) : String(error);
+  const compact = redactSlackSecrets(raw.replace(/\s+/g, ' ').trim()).slice(0, 400);
+  return slackProvisioningError(
+    `Slack CLI could not complete app provisioning. ${compact}`,
+    'SLACK_CLI'
+  );
+}
+
+module.exports = {
+  slackProvisioningError,
+  redactSlackSecrets,
+  wrapSlackCliError
+};

package/lib/channels/slack-provisioning/go-ca-bundle.js

@@ -0,0 +1,137 @@
+/**
+ * Trust store for the Go Slack CLI (SSL_CERT_FILE is the whole bundle).
+ *
+ * @fileoverview Do not set SSL_CERT_FILE to NODE_EXTRA_CA_CERTS alone
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const tls = require('tls');
+
+const SYSTEM_CA_CANDIDATES = [
+  '/etc/ssl/certs/ca-certificates.crt',
+  '/etc/pki/tls/certs/ca-bundle.crt',
+  '/etc/ssl/cert.pem'
+];
+
+/**
+ * @param {string[]} filePaths
+ * @returns {string}
+ */
+function firstExistingFile(filePaths) {
+  return filePaths.find((filePath) => filePath && fs.existsSync(filePath)) || '';
+}
+
+/**
+ * @returns {string}
+ */
+function systemCaBundlePath() {
+  return firstExistingFile(SYSTEM_CA_CANDIDATES);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {string}
+ */
+function extraCaPath(env) {
+  const fromNode = typeof env.NODE_EXTRA_CA_CERTS === 'string' ? env.NODE_EXTRA_CA_CERTS.trim() : '';
+  if (fromNode && fs.existsSync(fromNode)) {
+    return fromNode;
+  }
+  return '';
+}
+
+/**
+ * @returns {string}
+ */
+function nodeRootCaPem() {
+  const certs = tls.rootCertificates;
+  if (!Array.isArray(certs) || certs.length === 0) {
+    return '';
+  }
+  return `${certs.join('\n')}\n`;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {string}
+ */
+function readPem(filePath) {
+  if (!filePath) {
+    return '';
+  }
+  try {
+    return fs.readFileSync(filePath, 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {string[]} parts
+ * @returns {string}
+ */
+function joinPemParts(parts) {
+  const body = parts
+    .map((part) => String(part || '').trim())
+    .filter(Boolean)
+    .join('\n');
+  return body ? `${body}\n` : '';
+}
+
+/**
+ * @param {string} destDir
+ * @param {string} pem
+ * @returns {string}
+ */
+function writeBundle(destDir, pem) {
+  fs.mkdirSync(destDir, { recursive: true });
+  const dest = path.join(destDir, 'ca-bundle.pem');
+  if (readPem(dest) === pem.trim()) {
+    return dest;
+  }
+  fs.writeFileSync(dest, pem, { mode: 0o600 });
+  return dest;
+}
+
+/**
+ * @param {string} extra
+ * @param {string} systemPath
+ * @param {string} [nodePem]
+ * @returns {string}
+ */
+function resolveTrustPem(extra, systemPath, nodePem) {
+  const rootsPem = readPem(systemPath) || nodePem || nodeRootCaPem();
+  const extraPem = extra && extra !== systemPath ? readPem(extra) : '';
+  return joinPemParts([rootsPem, extraPem]);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} env
+ * @param {string} slackHome
+ * @param {Object} [deps]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function withGoTrustedCa(env, slackHome, deps = {}) {
+  if (env.SSL_CERT_FILE || env.SSL_CERT_DIR) {
+    return env;
+  }
+  const extra = deps.extraCaPath !== undefined ? deps.extraCaPath : extraCaPath(env);
+  const systemPath = deps.systemCaPath !== undefined ? deps.systemCaPath : systemCaBundlePath();
+  if (systemPath && !extra) {
+    return { ...env, SSL_CERT_FILE: systemPath };
+  }
+  const pem = resolveTrustPem(extra, systemPath, deps.nodeRootPem);
+  if (!pem) {
+    return extra ? { ...env, SSL_CERT_FILE: extra } : env;
+  }
+  const bundlePath = writeBundle(path.join(slackHome, '.ssl'), pem);
+  return { ...env, SSL_CERT_FILE: bundlePath };
+}
+
+module.exports = {
+  withGoTrustedCa,
+  systemCaBundlePath
+};

package/lib/channels/slack-provisioning/index.js

@@ -0,0 +1,250 @@
+/**
+ * Slack channel provisioning adapter (CLI + Manifest API).
+ *
+ * @fileoverview Create/reuse Slack app from generated manifest; store secrets via dataplane
+ */
+
+'use strict';
+
+const { assertSlackCallbackUrls } = require('./callbacks');
+const { parseGeneratedManifest, assertLocalManifest } = require('./manifest');
+const {
+  validateManifestRemote,
+  createManifestApp,
+  updateManifestApp,
+  installManifestApp,
+  exportManifestApp,
+  exportManifestLookup,
+  resolveSlackClientId
+} = require('./apps');
+const { preserveSlackOAuthLocks } = require('./oauth-lock');
+const {
+  pickSlackSecrets,
+  storeSlackChannelSecrets,
+  localSlackSigningPresent
+} = require('./credentials');
+const {
+  readProvisioningState,
+  writeProvisioningState,
+  hasProvenAppIdentity
+} = require('./persist');
+const { listSlackAuths, pickSlackWorkspace, workspaceFromSessionToken } = require('./auth');
+const { slackProvisioningError } = require('./errors');
+const { pickSlackClientId, slackConsentRemaining, slackConsentUrls } = require('./remaining-urls');
+const { botScopesFromManifest } = require('./developer-install');
+
+/**
+ * @param {Object} params
+ * @returns {Object}
+ */
+function loadProvenState(params) {
+  const state = readProvisioningState(params.projectRoot);
+  if (state && !hasProvenAppIdentity(state)) {
+    throw slackProvisioningError(
+      'Slack provisioning state exists but app id is missing. Fix or delete dist/channels/slack/provisioning-state.json.',
+      'UNPROVEN_IDENTITY'
+    );
+  }
+  return state;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function resolveWorkspace(params, deps) {
+  const fromToken = await workspaceFromSessionToken(deps);
+  const auths = fromToken ? [fromToken] : await listSlackAuths(deps);
+  const workspace = pickSlackWorkspace(auths, params.expectedTeamId);
+  if (!workspace) {
+    throw slackProvisioningError(
+      'No Slack workspace is signed in.',
+      'UNPROVEN_IDENTITY'
+    );
+  }
+  return workspace;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} payload
+ * @returns {void}
+ */
+function persistIds(params, payload) {
+  writeProvisioningState(params.projectRoot, {
+    environment: params.environment,
+    appId: payload.appId,
+    clientId: payload.clientId || null,
+    teamId: payload.teamId || null,
+    botId: payload.botId || null,
+    secretsStored: payload.secretsStored === true
+  });
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} captured
+ * @param {Object} [deps]
+ * @returns {Promise<{ connected: boolean, remaining: string[], appId: string }>}
+ */
+async function storeAndFinish(params, captured, deps) {
+  const secrets = pickSlackSecrets(captured);
+  const stored = await storeSlackChannelSecrets(params.ctx, secrets, {
+    ...deps,
+    projectRoot: params.projectRoot,
+    instanceSystemKey: params.ctx && params.ctx.instanceSystemKey
+  });
+  const signingReady = stored.storedSigningSecret || params.priorSecretsStored === true;
+  const botReady = stored.storedBotToken || params.priorSecretsStored === true;
+  const secretsStored = signingReady && botReady;
+  let clientId = pickSlackClientId(captured);
+  if (!clientId && !secretsStored) {
+    clientId = await resolveSlackClientId(captured, deps);
+  }
+  persistIds(params, {
+    appId: captured.appId,
+    clientId,
+    teamId: captured.teamId || params.workspaceTeamId,
+    botId: captured.botId,
+    secretsStored
+  });
+  const urls = slackConsentUrls({
+    ...captured,
+    clientId,
+    teamId: captured.teamId || params.workspaceTeamId
+  });
+  return {
+    connected: secretsStored,
+    remaining: slackConsentRemaining(
+      secretsStored ? { storedSigningSecret: true } : stored
+    ),
+    appId: captured.appId,
+    signingSecretFallback: stored.storedSigningSecret !== true,
+    storedSigningSecret: stored.storedSigningSecret === true,
+    storedBotToken: stored.storedBotToken === true,
+    ...urls
+  };
+}
+
+/**
+ * Install deps: HTTP developerInstall always; native CLI `app install` only when not quiet.
+ * @param {Object} params
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Object}
+ */
+function slackInstallDeps(params, manifest, deps) {
+  return {
+    ...deps,
+    quiet: params && params.quiet === true,
+    botScopes: botScopesFromManifest(manifest)
+  };
+}
+
+/**
+ * Capture bot token from Slack. Portal skips native CLI hang (CIP 120s).
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function maybeInstallSlackApp(appId, deps) {
+  try {
+    return (await installManifestApp(appId, deps)) || {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function createNewSlackApp(params, manifest, deps) {
+  await validateManifestRemote(manifest, deps);
+  const created = await createManifestApp(manifest, deps);
+  persistIds(params, {
+    appId: created.app_id,
+    clientId: pickSlackClientId(created),
+    teamId: params.workspaceTeamId,
+    secretsStored: false
+  });
+  const installed = await maybeInstallSlackApp(
+    created.app_id,
+    slackInstallDeps(params, manifest, deps)
+  );
+  return storeAndFinish(params, {
+    appId: created.app_id,
+    clientId: pickSlackClientId(created),
+    teamId: installed.teamId || params.workspaceTeamId,
+    botId: installed.botId,
+    credentials: created.credentials,
+    oauth_authorize_url: created.oauth_authorize_url,
+    botToken: installed.botToken
+  }, deps);
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} manifest
+ * @param {Object} state
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function reuseSlackApp(params, manifest, state, deps, remote) {
+  const exported = remote === undefined ? await exportManifestApp(state.appId, deps) : remote;
+  const merged = preserveSlackOAuthLocks(manifest, exported);
+  await validateManifestRemote(merged, { ...deps, appId: state.appId });
+  await updateManifestApp(state.appId, merged, deps);
+  const installed = await maybeInstallSlackApp(
+    state.appId,
+    slackInstallDeps(params, manifest, deps)
+  );
+  return storeAndFinish(
+    { ...params, priorSecretsStored: state.secretsStored === true },
+    {
+      appId: state.appId,
+      clientId: state.clientId,
+      teamId: installed.teamId || state.teamId || params.workspaceTeamId,
+      botId: installed.botId || state.botId,
+      botToken: installed.botToken
+    },
+    deps
+  );
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ connected: boolean, remaining: string[], appId?: string }>}
+ */
+async function provisionSlackChannel(params, deps = {}) {
+  assertSlackCallbackUrls(params.runtimeValues);
+  const manifest = parseGeneratedManifest(params.artifact && params.artifact.content);
+  assertLocalManifest(manifest);
+  const workspace = await resolveWorkspace(params, deps);
+  const workspaceTeamId = workspace.team_id || workspace.teamId;
+  const apiDeps = {
+    ...deps,
+    teamId: workspaceTeamId
+  };
+  const state = loadProvenState(params);
+  const withTeam = { ...params, workspaceTeamId };
+  const reuseKnownApp =
+    hasProvenAppIdentity(state) && (await localSlackSigningPresent(apiDeps));
+  if (reuseKnownApp) {
+    const lookup = await exportManifestLookup(state.appId, apiDeps);
+    if (!lookup.missing) {
+      return reuseSlackApp(withTeam, manifest, state, apiDeps, lookup.manifest);
+    }
+  }
+  return createNewSlackApp(withTeam, manifest, apiDeps);
+}
+
+module.exports = {
+  provisionSlackChannel,
+  loadProvenState,
+  persistIds
+};