@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/slack-mcp-runtime.js

@@ -0,0 +1,156 @@
+/**
+ * Slackbot MCP Client packaging (opt-in). Auth freeze: manual_auth.
+ *
+ * @fileoverview Slack MCP manifest fields from discovery; HMAC path stays default
+ */
+
+'use strict';
+
+const SLACK_MCP_AUTH_TYPE = 'manual_auth';
+const SLACK_MCP_AUTH_PROVIDER_KEY = 'mcp_aifabrix';
+const SLACK_MCP_SERVER_KEY = 'runtime-orchestration';
+const SLACK_MCP_CALLBACK_URI = 'https://oauth2.slack.com/external/auth/callback';
+const SLACK_MCP_OAUTH_SCOPES = ['openid', 'profile', 'email', 'offline_access'];
+const SLACK_MCP_CAPABILITY = 'customerOAuth';
+const SLACK_MCP_MISSING_URL = 'Runtime MCP URL is missing.';
+
+/**
+ * @param {string} [controllerUrl]
+ * @param {string} [mcpUrl]
+ * @param {string} [dataplaneBaseUrl]
+ * @returns {string}
+ */
+function authorizationServerBase(controllerUrl, mcpUrl, dataplaneBaseUrl) {
+  const candidate = controllerUrl || mcpUrl || dataplaneBaseUrl;
+  try {
+    return `${new URL(candidate).origin}/auth/realms/aifabrix`;
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {string} asBase
+ * @returns {{ authorizationUrl: string, tokenUrl: string }}
+ */
+function keycloakEndpoints(asBase) {
+  if (!asBase) {
+    return { authorizationUrl: '', tokenUrl: '' };
+  }
+  return {
+    authorizationUrl: `${asBase}/protocol/openid-connect/auth`,
+    tokenUrl: `${asBase}/protocol/openid-connect/token`
+  };
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {void}
+ */
+function clearSlackMcpPackaging(resolved) {
+  resolved.slackMcpAuthType = '';
+  resolved.slackMcpAuthProviderKey = '';
+  resolved.slackMcpCallbackUri = '';
+  resolved.slackMcpCapability = '';
+  resolved.slackMcpServersJson = '';
+  resolved.slackExternalAuthJson = '';
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {boolean}
+ */
+function selectsCustomerOAuth(resolved) {
+  const caps = resolved.discoveryAuthenticationCapabilities;
+  if (!Array.isArray(caps) || caps.length === 0) {
+    return true;
+  }
+  return caps.includes(SLACK_MCP_CAPABILITY);
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ * @param {string} mcpUrl
+ * @returns {Object}
+ */
+function buildExternalAuthProviders(resolved, params, mcpUrl) {
+  const asBase = authorizationServerBase(
+    params && params.controllerUrl,
+    mcpUrl,
+    resolved.dataplaneBaseUrl
+  );
+  const endpoints = keycloakEndpoints(asBase);
+  const provider = {
+    authorization_url: endpoints.authorizationUrl,
+    token_url: endpoints.tokenUrl,
+    scope: SLACK_MCP_OAUTH_SCOPES,
+    use_pkce: true,
+    identity_config: null
+  };
+  const clientId =
+    typeof resolved.slackMcpClientId === 'string' ? resolved.slackMcpClientId.trim() : '';
+  if (clientId) {
+    provider.client_id = clientId;
+  }
+  return { oauth2: { [SLACK_MCP_AUTH_PROVIDER_KEY]: provider } };
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} [params]
+ * @returns {void}
+ */
+function applySlackMcpRuntimeValues(resolved, params) {
+  if (!resolved.enableMcpServer) {
+    clearSlackMcpPackaging(resolved);
+    return;
+  }
+  const mcpUrl = typeof resolved.mcpUrl === 'string' ? resolved.mcpUrl.trim() : '';
+  if (!mcpUrl) {
+    throw new Error(SLACK_MCP_MISSING_URL);
+  }
+  if (!selectsCustomerOAuth(resolved)) {
+    throw new Error('Slack MCP requires customerOAuth on Runtime discovery.');
+  }
+  resolved.slackMcpAuthType = SLACK_MCP_AUTH_TYPE;
+  resolved.slackMcpAuthProviderKey = SLACK_MCP_AUTH_PROVIDER_KEY;
+  resolved.slackMcpCallbackUri = SLACK_MCP_CALLBACK_URI;
+  resolved.slackMcpCapability = SLACK_MCP_CAPABILITY;
+  resolved.slackMcpServersJson = JSON.stringify({
+    [SLACK_MCP_SERVER_KEY]: {
+      url: mcpUrl,
+      auth_type: SLACK_MCP_AUTH_TYPE,
+      auth_provider_key: SLACK_MCP_AUTH_PROVIDER_KEY
+    }
+  });
+  resolved.slackExternalAuthJson = JSON.stringify(
+    buildExternalAuthProviders(resolved, params || {}, mcpUrl)
+  );
+}
+
+/**
+ * @param {Object} [runtimeValues]
+ * @returns {string[]}
+ */
+function slackMcpRemainingSteps(runtimeValues) {
+  if (!runtimeValues || !runtimeValues.enableMcpServer) {
+    return [];
+  }
+  return [
+    'Connect the AI Fabrix MCP server in Slack',
+    'Complete sign-in at AI Fabrix when Slack asks'
+  ];
+}
+
+module.exports = {
+  SLACK_MCP_AUTH_TYPE,
+  SLACK_MCP_AUTH_PROVIDER_KEY,
+  SLACK_MCP_SERVER_KEY,
+  SLACK_MCP_CALLBACK_URI,
+  SLACK_MCP_OAUTH_SCOPES,
+  SLACK_MCP_CAPABILITY,
+  SLACK_MCP_MISSING_URL,
+  applySlackMcpRuntimeValues,
+  slackMcpRemainingSteps
+};

package/lib/channels/slack-provisioning/apps.js

@@ -0,0 +1,181 @@
+/**
+ * Slack Manifest API via documented `slack api` methods.
+ *
+ * @fileoverview create / update / validate — signing_secret only on create
+ */
+
+'use strict';
+
+const { runSlackApi, runNativeAppInstall } = require('./cli');
+const { slackProvisioningError } = require('./errors');
+const { pickSlackClientId } = require('./remaining-urls');
+const {
+  developerInstallApp,
+  pickInstalledSlackTokens
+} = require('./developer-install');
+
+/**
+ * @param {Object} body
+ * @returns {Object}
+ */
+function requireOk(body) {
+  if (body && body.ok === true) {
+    return body;
+  }
+  const detail = body && body.error ? String(body.error) : 'unknown_error';
+  const notes = Array.isArray(body && body.errors)
+    ? body.errors.map((row) => row && row.message).filter(Boolean).join('; ')
+    : '';
+  const suffix = notes ? ` (${notes})` : '';
+  throw slackProvisioningError(`Slack Manifest API failed: ${detail}${suffix}`, 'SLACK_API');
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {Object}
+ */
+function manifestPayload(manifest) {
+  return { manifest: JSON.stringify(manifest) };
+}
+
+/**
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function validateManifestRemote(manifest, deps = {}) {
+  const payload = manifestPayload(manifest);
+  if (typeof deps.appId === 'string' && deps.appId.trim()) {
+    payload.app_id = deps.appId.trim();
+  }
+  const body = await runSlackApi('apps.manifest.validate', payload, deps);
+  return requireOk(body);
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<Object|null>}
+ */
+async function exportManifestApp(appId, deps = {}) {
+  const result = await exportManifestLookup(appId, deps);
+  return result.manifest;
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ missing: boolean, manifest: Object|null }>}
+ */
+async function exportManifestLookup(appId, deps = {}) {
+  if (!appId) {
+    return { missing: true, manifest: null };
+  }
+  const body = await runSlackApi('apps.manifest.export', { app_id: appId }, deps);
+  if (body && body.ok === false && body.error === 'app_not_found') {
+    return { missing: true, manifest: null };
+  }
+  if (!body || body.ok === false) {
+    return { missing: false, manifest: null };
+  }
+  return { missing: false, manifest: body.manifest || null };
+}
+
+/**
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function createManifestApp(manifest, deps = {}) {
+  const body = await runSlackApi('apps.manifest.create', manifestPayload(manifest), deps);
+  const created = requireOk(body);
+  const createdAppId = created.app_id || created.appId;
+  if (!createdAppId) {
+    throw slackProvisioningError('Slack create did not return an app id.', 'SLACK_API');
+  }
+  created.app_id = createdAppId;
+  return created;
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function updateManifestApp(appId, manifest, deps = {}) {
+  const body = await runSlackApi(
+    'apps.manifest.update',
+    { app_id: appId, ...manifestPayload(manifest) },
+    deps
+  );
+  return requireOk(body);
+}
+
+/**
+ * Recover public client id when create response omitted it.
+ * @param {Object} [captured]
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function resolveSlackClientId(captured, deps = {}) {
+  const existing = pickSlackClientId(captured);
+  if (existing) {
+    return existing;
+  }
+  const appId = captured && (captured.appId || captured.app_id);
+  if (!appId) {
+    return '';
+  }
+  const exported = await runSlackApi('apps.manifest.export', { app_id: appId }, deps);
+  const fromExport = pickSlackClientId(exported);
+  if (fromExport) {
+    return fromExport;
+  }
+  const info = await runSlackApi('apps.info', { app: appId }, deps);
+  return pickSlackClientId(info && (info.app || info));
+}
+
+/**
+ * Native Slack CLI `app install` (TTY). Portal quiet mode must not call this.
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ botToken?: string, teamId?: string, botId?: string }>}
+ */
+async function nativeInstallApp(appId, deps = {}) {
+  if (typeof deps.installApp === 'function') {
+    return deps.installApp(appId);
+  }
+  return pickInstalledSlackTokens(await runNativeAppInstall(appId, deps));
+}
+
+/**
+ * Workspace install. Prefer apps.developerInstall (HTTP, returns xoxb).
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ botToken?: string, teamId?: string, botId?: string }>}
+ */
+async function installManifestApp(appId, deps = {}) {
+  const fromApi = await developerInstallApp(appId, deps);
+  if (fromApi.botToken) {
+    return fromApi;
+  }
+  if (deps.quiet === true) {
+    return fromApi;
+  }
+  try {
+    return (await nativeInstallApp(appId, deps)) || {};
+  } catch {
+    return {};
+  }
+}
+
+module.exports = {
+  validateManifestRemote,
+  exportManifestApp,
+  exportManifestLookup,
+  createManifestApp,
+  updateManifestApp,
+  installManifestApp,
+  resolveSlackClientId
+};

package/lib/channels/slack-provisioning/auth-store.js

@@ -0,0 +1,110 @@
+/**
+ * Slack CLI login store (`~/.slack/credentials.json`) and `auth list` text.
+ *
+ * @fileoverview Never log or return tokens from public auth lists
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { slackCliHomeDir } = require('./install-cli');
+
+/**
+ * @param {Object} [deps]
+ * @returns {string}
+ */
+function slackCredentialsPath(deps = {}) {
+  return path.join(deps.homeDir || slackCliHomeDir(deps.env), '.slack', 'credentials.json');
+}
+
+/**
+ * @param {Object} data
+ * @returns {Object[]}
+ */
+function entriesFromCredentialsObject(data) {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) {
+    return [];
+  }
+  return Object.entries(data).map(([teamId, row]) => ({
+    team_id: String((row && (row.team_id || row.teamId)) || teamId),
+    team_domain: (row && (row.team_domain || row.teamDomain)) || undefined,
+    user_id: (row && (row.user_id || row.userId)) || undefined,
+    token: row && row.token ? String(row.token) : undefined
+  }));
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Object[]}
+ */
+function readSlackCredentialEntries(deps = {}) {
+  if (typeof deps.readCredentials === 'function') {
+    const listed = deps.readCredentials();
+    return Array.isArray(listed) ? listed : [];
+  }
+  const filePath = slackCredentialsPath(deps);
+  if (!fs.existsSync(filePath)) {
+    return [];
+  }
+  try {
+    return entriesFromCredentialsObject(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * @param {Object[]} entries
+ * @returns {Object[]}
+ */
+function publicSlackAuths(entries) {
+  return (Array.isArray(entries) ? entries : []).map((row) => ({
+    team_id: row.team_id,
+    team_domain: row.team_domain,
+    user_id: row.user_id
+  }));
+}
+
+/**
+ * @param {Object[]} entries
+ * @param {string} [teamId]
+ * @returns {string|null}
+ */
+function slackUserTokenForTeam(entries, teamId) {
+  const rows = Array.isArray(entries) ? entries : [];
+  const match = teamId
+    ? rows.find((row) => String(row.team_id || '') === String(teamId))
+    : (rows.length === 1 ? rows[0] : null);
+  const token = match && match.token;
+  return typeof token === 'string' && token.trim() ? token.trim() : null;
+}
+
+/**
+ * Slack CLI 4.x `auth list` is human text, not JSON.
+ * @param {string} text
+ * @returns {Object[]}
+ */
+function parseAuthListText(text) {
+  const source = String(text || '');
+  const auths = [];
+  const re = /([A-Za-z0-9._-]+)\s+\(Team ID:\s*(T[A-Z0-9]+)\)[\s\S]*?User ID:\s*(U[A-Z0-9]+)/gi;
+  let match = re.exec(source);
+  while (match) {
+    auths.push({
+      team_domain: match[1],
+      team_id: match[2],
+      user_id: match[3]
+    });
+    match = re.exec(source);
+  }
+  return auths;
+}
+
+module.exports = {
+  slackCredentialsPath,
+  readSlackCredentialEntries,
+  publicSlackAuths,
+  slackUserTokenForTeam,
+  parseAuthListText
+};

package/lib/channels/slack-provisioning/auth-ticket.js

@@ -0,0 +1,185 @@
+/**
+ * Slack CLI ticket handshake for portal channel install.
+ *
+ * @fileoverview Server runs `slack auth token --no-prompt`; user runs the slash command
+ */
+
+'use strict';
+
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { slackProvisioningError, wrapSlackCliError } = require('./errors');
+const { resolveSlackBinary, shouldSkipLiveSlackCli } = require('./cli');
+const { withSlackCliPath, installOfficialSlackCli } = require('./install-cli');
+
+const SLASH_RE = /\/slackauthticket\s+(\S+)/i;
+const ACCESS_TOKEN_RE = /\b(xox[peba]-[A-Za-z0-9-]+)\b/i;
+const TICKET_LINE_RE = /^[A-Za-z0-9._-]{16,}$/;
+const AUTH_DEAD_RE = /token_revoked|token_expired|invalid_auth|not_authed|account_inactive/i;
+
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+function looksLikeSlackAccessToken(value) {
+  return ACCESS_TOKEN_RE.test(String(value || '').trim());
+}
+
+/**
+ * @param {Error|Object|null} error
+ * @returns {boolean}
+ */
+function isSlackAuthDeadError(error) {
+  const message = String((error && error.message) || '');
+  return AUTH_DEAD_RE.test(message);
+}
+
+/**
+ * @param {string} ticket
+ * @returns {string}
+ */
+function slashCommandForTicket(ticket) {
+  const value = String(ticket || '').trim();
+  return value ? `/slackauthticket ${value}` : '';
+}
+
+/**
+ * @param {string} stdout
+ * @returns {{ ticket: string, slashCommand: string }}
+ */
+function parseAuthTicketStart(stdout) {
+  const text = String(stdout || '');
+  const slash = text.match(SLASH_RE);
+  if (slash) {
+    return { ticket: slash[1], slashCommand: slashCommandForTicket(slash[1]) };
+  }
+  const ticket = firstTicketLine(text);
+  if (!ticket) {
+    throw slackProvisioningError('Slack CLI did not return an auth ticket.', 'SLACK_CLI');
+  }
+  return { ticket, slashCommand: slashCommandForTicket(ticket) };
+}
+
+/**
+ * @param {string} text
+ * @returns {string}
+ */
+function firstTicketLine(text) {
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('/') || /challenge|enter|copy/i.test(trimmed)) {
+      continue;
+    }
+    if (TICKET_LINE_RE.test(trimmed) && !looksLikeSlackAccessToken(trimmed)) {
+      return trimmed;
+    }
+  }
+  return '';
+}
+
+/**
+ * @param {string} stdout
+ * @returns {string}
+ */
+function parseAuthTicketComplete(stdout) {
+  const match = String(stdout || '').match(ACCESS_TOKEN_RE);
+  if (!match) {
+    throw slackProvisioningError('Slack CLI did not return a session token.', 'SLACK_CLI');
+  }
+  return match[1];
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function ensureSlackCliForTicket(deps = {}) {
+  const existing = await resolveSlackBinary(deps);
+  if (existing) {
+    return existing;
+  }
+  if (shouldSkipLiveSlackCli(deps)) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  await installOfficialSlackCli(deps);
+  const installed = await resolveSlackBinary(deps);
+  if (!installed) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  return installed;
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<{ ticket: string, slashCommand: string }>}
+ */
+async function startSlackAuthTicket(deps = {}) {
+  if (typeof deps.startAuthTicket === 'function') {
+    return deps.startAuthTicket();
+  }
+  const bin = await ensureSlackCliForTicket(deps);
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(bin, ['auth', 'token', '--no-prompt', '--no-color', '-s'], {
+      timeout: deps.timeout || 30000,
+      killSignal: 'SIGKILL',
+      maxBuffer: 1024 * 1024,
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    return parseAuthTicketStart(result && result.stdout);
+  } catch (error) {
+    if (error && error.code === 'SLACK_CLI_MISSING') {
+      throw error;
+    }
+    throw wrapSlackCliError(error);
+  }
+}
+
+/**
+ * @param {{ ticket: string, challenge: string }} params
+ * @param {Object} [deps]
+ * @returns {Promise<string>}
+ */
+async function completeSlackAuthTicket(params, deps = {}) {
+  if (typeof deps.completeAuthTicket === 'function') {
+    return deps.completeAuthTicket(params);
+  }
+  const ticket = String(params && params.ticket ? params.ticket : '').trim();
+  const challenge = String(params && params.challenge ? params.challenge : '').trim();
+  if (!ticket || !challenge) {
+    throw slackProvisioningError('Challenge code and auth ticket are required.', 'SLACK_CLI');
+  }
+  const bin = await ensureSlackCliForTicket(deps);
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(
+      bin,
+      ['auth', 'token', '--no-prompt', '--challenge', challenge, '--ticket', ticket, '--no-color', '-s'],
+      {
+        timeout: deps.timeout || 45000,
+        killSignal: 'SIGKILL',
+        maxBuffer: 1024 * 1024,
+        env: withSlackCliPath(deps.env || process.env)
+      }
+    );
+    return parseAuthTicketComplete(result && result.stdout);
+  } catch (error) {
+    throw wrapSlackCliError(error);
+  }
+}
+
+module.exports = {
+  looksLikeSlackAccessToken,
+  isSlackAuthDeadError,
+  slashCommandForTicket,
+  parseAuthTicketStart,
+  parseAuthTicketComplete,
+  startSlackAuthTicket,
+  completeSlackAuthTicket
+};