@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/slack-provisioning/onboard.js

@@ -0,0 +1,89 @@
+/**
+ * Optional Slack user onboard after channel add (email join).
+ *
+ * @fileoverview One yes/no question; no member dump on default TTY
+ */
+
+'use strict';
+
+const { isChannelAddInteractive } = require('../channel-add-wizard');
+const { upsertChannelIdentityMappings } = require('../../api/channel-identity.api');
+const { confirmYesNo } = require('./offer-cli');
+const { listSlackWorkspaceMembers, matchSlackMembersToUsers } = require('./onboard-members');
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldSkipOnboard(options = {}) {
+  if (options.dryRun === true) {
+    return true;
+  }
+  if (options.onboardUsers === false) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * @param {Object} [options]
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function shouldOnboardUsers(options = {}, deps = {}) {
+  if (shouldSkipOnboard(options)) {
+    return false;
+  }
+  if (options.onboardUsers === true) {
+    return true;
+  }
+  if (!isChannelAddInteractive(options)) {
+    return false;
+  }
+  return confirmYesNo('Onboard users?', deps);
+}
+
+/**
+ * @param {number} unmatched
+ * @returns {string|null}
+ */
+function unmatchedRemainingStep(unmatched) {
+  const count = Number(unmatched) || 0;
+  if (count <= 0) {
+    return null;
+  }
+  return `${count} Slack users still use Link account (no email match)`;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ ran: boolean, linked: number, unmatched: number }>}
+ */
+async function maybeOnboardSlackUsers(params = {}, deps = {}) {
+  const options = params.options || {};
+  const ctx = params.ctx || {};
+  if (ctx.slackConnected !== true && options.onboardUsers !== true) {
+    return { ran: false, linked: 0, unmatched: 0 };
+  }
+  if (!(await shouldOnboardUsers(options, deps))) {
+    return { ran: false, linked: 0, unmatched: 0 };
+  }
+  const members = await listSlackWorkspaceMembers(deps);
+  const matched = await matchSlackMembersToUsers(members, ctx, deps);
+  if (matched.items.length > 0) {
+    const upsert = deps.upsertChannelIdentityMappings || upsertChannelIdentityMappings;
+    await upsert(ctx.dataplaneUrl, ctx.authConfig, {
+      sourceChannel: 'slack',
+      items: matched.items
+    });
+  }
+  return { ran: true, linked: matched.items.length, unmatched: matched.unmatched };
+}
+
+module.exports = {
+  shouldSkipOnboard,
+  shouldOnboardUsers,
+  unmatchedRemainingStep,
+  maybeOnboardSlackUsers
+};

package/lib/channels/slack-provisioning/persist.js

@@ -0,0 +1,95 @@
+/**
+ * Persist non-secret Slack app / workspace IDs only.
+ *
+ * @fileoverview Never store bot tokens or signing secrets
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../../internal/fs-real-sync');
+const { STATE_FILE, STATE_KIND, SECRET_KEY_RE } = require('./constants');
+const { slackProvisioningError } = require('./errors');
+
+/**
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+function provisioningStatePath(projectRoot) {
+  const root = projectRoot || process.cwd();
+  return path.join(root, 'dist', 'channels', 'slack', STATE_FILE);
+}
+
+/**
+ * @param {Object} record
+ * @returns {void}
+ */
+function assertNoSecrets(record) {
+  const keys = record && typeof record === 'object' ? Object.keys(record) : [];
+  const hit = keys.find((key) => SECRET_KEY_RE.test(key));
+  if (hit) {
+    throw slackProvisioningError(`Refusing to persist Slack secret field "${hit}".`, 'SECRET');
+  }
+  const blob = JSON.stringify(record || {});
+  if (/xox[baprs]-/i.test(blob)) {
+    throw slackProvisioningError('Refusing to persist a Slack token value.', 'SECRET');
+  }
+}
+
+/**
+ * @param {string} projectRoot
+ * @returns {Object|null}
+ */
+function readProvisioningState(projectRoot) {
+  const filePath = provisioningStatePath(projectRoot);
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!parsed || parsed.kind !== STATE_KIND) {
+      return null;
+    }
+    assertNoSecrets(parsed);
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object|null} state
+ * @returns {boolean}
+ */
+function hasProvenAppIdentity(state) {
+  return Boolean(state && typeof state.appId === 'string' && state.appId.trim());
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {Object} state
+ * @returns {void}
+ */
+function writeProvisioningState(projectRoot, state) {
+  const record = {
+    kind: STATE_KIND,
+    environment: state.environment,
+    appId: state.appId,
+    clientId: state.clientId || null,
+    teamId: state.teamId || null,
+    botId: state.botId || null,
+    secretsStored: state.secretsStored === true
+  };
+  assertNoSecrets(record);
+  const filePath = provisioningStatePath(projectRoot);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+}
+
+module.exports = {
+  provisioningStatePath,
+  readProvisioningState,
+  writeProvisioningState,
+  hasProvenAppIdentity,
+  assertNoSecrets
+};

package/lib/channels/slack-provisioning/remaining-urls.js

@@ -0,0 +1,158 @@
+/**
+ * Slack post-create consent URLs (app, Install App, workspace approve).
+ *
+ * @fileoverview App id and team id are public; never include client_secret
+ */
+
+'use strict';
+
+/**
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function slackAppRootUrl(appId) {
+  if (typeof appId !== 'string' || !appId.trim()) {
+    return '';
+  }
+  return `https://api.slack.com/apps/${encodeURIComponent(appId.trim())}`;
+}
+
+/**
+ * @param {string} [appId]
+ * @param {string} page
+ * @returns {string}
+ */
+function slackAppPageUrl(appId, page) {
+  const root = slackAppRootUrl(appId);
+  if (!root || typeof page !== 'string' || !page.trim()) {
+    return root;
+  }
+  return `${root}/${page}`;
+}
+
+/**
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function slackAppGeneralUrl(appId) {
+  return slackAppPageUrl(appId, 'general');
+}
+
+/**
+ * Workspace install URL that actually adds the app (`/install-on-team`).
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function slackAppInstallOnTeamUrl(appId) {
+  return slackAppPageUrl(appId, 'install-on-team');
+}
+
+/**
+ * Slack workspace admin approval for this app.
+ * @param {string} [teamId]
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function buildSlackWorkspaceApproveUrl(teamId, appId) {
+  if (typeof teamId !== 'string' || !teamId.trim()) {
+    return '';
+  }
+  if (typeof appId !== 'string' || !appId.trim()) {
+    return '';
+  }
+  const team = encodeURIComponent(teamId.trim());
+  const app = encodeURIComponent(appId.trim());
+  return `https://app.slack.com/apps-manage/${team}/integrations/profile/${app}/permissions`;
+}
+
+/**
+ * @param {string} [url]
+ * @returns {string}
+ */
+function clientIdFromAuthorizeUrl(url) {
+  if (typeof url !== 'string' || !url.includes('client_id=')) {
+    return '';
+  }
+  try {
+    return String(new URL(url).searchParams.get('client_id') || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {Object} [captured]
+ * @returns {string}
+ */
+function pickSlackClientId(captured) {
+  const credentials = (captured && captured.credentials) || {};
+  const nested = captured && captured.data && typeof captured.data === 'object' ? captured.data : {};
+  const candidates = [
+    captured && captured.clientId,
+    captured && captured.client_id,
+    credentials.clientId,
+    credentials.client_id,
+    nested.clientId,
+    nested.client_id
+  ];
+  const direct = candidates.find((value) => typeof value === 'string' && value.trim());
+  if (direct) {
+    return String(direct).trim();
+  }
+  return clientIdFromAuthorizeUrl(
+    (captured && captured.oauth_authorize_url) || credentials.oauth_authorize_url
+  );
+}
+
+/**
+ * @param {Object} [captured]
+ * @returns {string}
+ */
+function pickSlackTeamId(captured) {
+  const credentials = (captured && captured.credentials) || {};
+  const candidates = [
+    captured && captured.teamId,
+    captured && captured.team_id,
+    credentials.teamId,
+    credentials.team_id
+  ];
+  const hit = candidates.find((value) => typeof value === 'string' && value.trim());
+  return hit ? String(hit).trim() : '';
+}
+
+/**
+ * @param {Object} [captured]
+ * @returns {{ slackAppSettingsUrl: string, slackInstallAppUrl: string,
+ *   slackWorkspaceApproveUrl: string }}
+ */
+function slackConsentUrls(captured) {
+  const appId = captured && captured.appId;
+  return {
+    slackAppSettingsUrl: slackAppRootUrl(appId),
+    slackInstallAppUrl: slackAppInstallOnTeamUrl(appId),
+    slackWorkspaceApproveUrl: buildSlackWorkspaceApproveUrl(pickSlackTeamId(captured), appId)
+  };
+}
+
+/**
+ * @param {{ storedSigningSecret?: boolean }} [stored]
+ * @returns {string[]}
+ */
+function slackConsentRemaining(stored) {
+  const steps = ['Upload your logo (Basic Information)', 'Activate the application'];
+  if (!stored || stored.storedSigningSecret !== true) {
+    steps.push('Store the signing secret in Authentication (Slack cannot re-read it after create)');
+  }
+  return steps;
+}
+
+module.exports = {
+  slackAppRootUrl,
+  slackAppGeneralUrl,
+  slackAppInstallOnTeamUrl,
+  buildSlackWorkspaceApproveUrl,
+  pickSlackClientId,
+  pickSlackTeamId,
+  slackConsentUrls,
+  slackConsentRemaining
+};

package/lib/channels/slack-provisioning/with-curl-on-path.js

@@ -0,0 +1,48 @@
+/**
+ * Ensure `curl` is on PATH for Slack CLI install.sh (Node shim when missing).
+ */
+
+'use strict';
+
+const { execFile } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { promisify } = require('util');
+
+const execFileAsync = promisify(execFile);
+
+async function curlExists(env) {
+  try {
+    await execFileAsync('curl', ['--version'], { env, timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function writeCurlShim(dir) {
+  const runtime = path.join(__dirname, 'curl-shim.js');
+  const wrapper = `#!/bin/sh\nexec "${process.execPath}" "${runtime}" "$@"\n`;
+  fs.writeFileSync(path.join(dir, 'curl'), wrapper, { mode: 0o755 });
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @param {{ curlExists?: Function }} [deps]
+ * @returns {Promise<NodeJS.ProcessEnv>}
+ */
+async function withCurlOnPath(env = process.env, deps = {}) {
+  const exists = deps.curlExists || curlExists;
+  if (await exists(env)) {
+    return env;
+  }
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'aifabrix-curl-'));
+  writeCurlShim(dir);
+  return {
+    ...env,
+    PATH: `${dir}${path.delimiter}${env.PATH || ''}`
+  };
+}
+
+module.exports = { curlExists, withCurlOnPath };

package/lib/channels/teams-bot-channel-add.js

@@ -0,0 +1,94 @@
+/**
+ * Teams Bot channel-add provisioning hook.
+ *
+ * @fileoverview Keep add-channel.js free of Teams Developer CLI argv
+ */
+
+'use strict';
+
+const { provisionTeamsBot, TEAMS_CLI_MISSING_REMAINING } = require('./microsoft-provisioning/teams-bot-provision');
+const { redactTeamsSecrets } = require('./microsoft-provisioning/errors');
+
+const FAIL_CLOSED_CODES = new Set(['WRONG_TENANT', 'TEAMS_MANAGED', 'SECRET', 'SCAFFOLD']);
+
+/**
+ * @param {Error} error
+ * @returns {string[]}
+ */
+function remainingFromError(error) {
+  const code = error && error.code;
+  if (code === 'TEAMS_CLI_MISSING') {
+    return TEAMS_CLI_MISSING_REMAINING;
+  }
+  if (code === 'MISSING_AZURE') {
+    return [
+      'Azure subscription and resource group were not found on the controller environment',
+      'Deploy the environment, then re-run aifabrix channel add teams-bot'
+    ];
+  }
+  if (code === 'ENDPOINT') {
+    return ['Use a public HTTPS dataplane URL for the Teams Bot messaging endpoint'];
+  }
+  const detail = redactTeamsSecrets(
+    (error && error.message) || 'Teams Bot provisioning failed'
+  );
+  return [detail];
+}
+
+/**
+ * @param {Error} error
+ * @returns {boolean}
+ */
+function shouldFailClosed(error) {
+  return FAIL_CLOSED_CODES.has(error && error.code);
+}
+
+/**
+ * @param {Error} error
+ * @returns {Object}
+ */
+function recoveryFromError(error) {
+  return {
+    connected: false,
+    skipped: true,
+    remaining: remainingFromError(error)
+  };
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object|null>}
+ */
+async function maybeProvisionTeamsBotChannel(params) {
+  if (!params || params.channelTarget !== 'teams-bot') {
+    return null;
+  }
+  if (params.options && params.options.dryRun === true) {
+    return null;
+  }
+  const ctx = params.ctx || {};
+  const options = params.options || {};
+  const deps = options.teamsBotProvisioningDeps || {};
+  try {
+    return await provisionTeamsBot(
+      {
+        projectRoot: options.projectRoot || process.cwd(),
+        runtimeValues: params.runtimeValues,
+        ctx,
+        environment: ctx.environment,
+        options
+      },
+      deps
+    );
+  } catch (error) {
+    if (shouldFailClosed(error)) {
+      throw error;
+    }
+    return recoveryFromError(error);
+  }
+}
+
+module.exports = {
+  maybeProvisionTeamsBotChannel,
+  remainingFromError
+};