@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/slack-provisioning/auth.js

@@ -0,0 +1,115 @@
+/**
+ * Slack workspace identity from login store or `slack auth list`.
+ *
+ * @fileoverview Fail closed when multiple workspaces cannot be proven
+ */
+
+'use strict';
+
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { slackProvisioningError, wrapSlackCliError } = require('./errors');
+const { resolveSlackBinary, runSlackApi, shouldSkipLiveSlackCli } = require('./cli');
+const { withSlackCliPath } = require('./install-cli');
+const {
+  readSlackCredentialEntries,
+  publicSlackAuths,
+  parseAuthListText
+} = require('./auth-store');
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listSlackAuthsFromCli(deps = {}) {
+  const bin = await resolveSlackBinary(deps);
+  if (!bin) {
+    return [];
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(bin, ['auth', 'list', '--no-color', '-s'], {
+      timeout: 30000,
+      maxBuffer: 1024 * 1024,
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    return parseAuthListText(result && result.stdout);
+  } catch (error) {
+    throw wrapSlackCliError(error);
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listSlackAuths(deps = {}) {
+  if (typeof deps.listAuths === 'function') {
+    const listed = await deps.listAuths();
+    return Array.isArray(listed) ? listed : [];
+  }
+  const fromFile = publicSlackAuths(readSlackCredentialEntries(deps));
+  if (fromFile.length > 0) {
+    return fromFile;
+  }
+  if (shouldSkipLiveSlackCli(deps) && typeof deps.execFile !== 'function') {
+    return [];
+  }
+  return listSlackAuthsFromCli(deps);
+}
+
+/**
+ * Prove workspace identity from a short-lived session token for this run only.
+ * @param {Object} [deps]
+ * @returns {Promise<Object|null>}
+ */
+async function workspaceFromSessionToken(deps = {}) {
+  const token = typeof deps.slackUserToken === 'string' ? deps.slackUserToken.trim() : '';
+  if (!token) {
+    return null;
+  }
+  if (typeof deps.authTest === 'function') {
+    const listed = await deps.authTest();
+    if (!listed || !(listed.team_id || listed.teamId)) {
+      throw slackProvisioningError('Session token was not accepted.', 'UNPROVEN_IDENTITY');
+    }
+    return listed;
+  }
+  const body = await runSlackApi('auth.test', {}, deps);
+  if (!body || body.ok !== true || !(body.team_id || body.teamId)) {
+    throw slackProvisioningError('Session token was not accepted.', 'UNPROVEN_IDENTITY');
+  }
+  return { team_id: body.team_id || body.teamId, team: body.team };
+}
+
+/**
+ * @param {Object[]} auths
+ * @param {string} [expectedTeamId]
+ * @returns {Object}
+ */
+function pickSlackWorkspace(auths, expectedTeamId) {
+  const rows = Array.isArray(auths) ? auths : [];
+  if (expectedTeamId) {
+    const match = rows.find((row) => String(row.team_id || row.teamId || '') === expectedTeamId);
+    if (!match) {
+      throw slackProvisioningError(
+        `Signed-in Slack workspace does not match expected team "${expectedTeamId}".`,
+        'UNPROVEN_IDENTITY'
+      );
+    }
+    return match;
+  }
+  if (rows.length > 1) {
+    throw slackProvisioningError(
+      'Multiple Slack workspaces are signed in. Pass the expected team id rather than guessing.',
+      'UNPROVEN_IDENTITY'
+    );
+  }
+  return rows[0] || null;
+}
+
+module.exports = {
+  listSlackAuths,
+  pickSlackWorkspace,
+  workspaceFromSessionToken
+};

package/lib/channels/slack-provisioning/callbacks.js

@@ -0,0 +1,41 @@
+/**
+ * Fail before Slack create when callback URLs are missing or not public HTTPS.
+ *
+ * @fileoverview Events / interactivity / commands Request URLs
+ */
+
+'use strict';
+
+const { REQUIRED_CALLBACK_KEYS } = require('./constants');
+const { slackProvisioningError } = require('./errors');
+const { isPublicHttpsUrl } = require('../vendor-dataplane-url');
+
+/**
+ * @param {Object} runtimeValues
+ * @returns {void}
+ */
+function assertSlackCallbackUrls(runtimeValues) {
+  const missing = REQUIRED_CALLBACK_KEYS.filter((key) => {
+    const value = runtimeValues && runtimeValues[key];
+    return typeof value !== 'string' || !value.trim();
+  });
+  if (missing.length > 0) {
+    throw slackProvisioningError(
+      `Slack callback URLs are missing: ${missing.join(', ')}. ` +
+        'Generate the channel package against a public HTTPS dataplane before create.',
+      'CALLBACKS'
+    );
+  }
+  const unusable = REQUIRED_CALLBACK_KEYS.filter((key) => !isPublicHttpsUrl(runtimeValues[key]));
+  if (unusable.length > 0) {
+    throw slackProvisioningError(
+      `Slack callback URLs must be public HTTPS: ${unusable.join(', ')}.`,
+      'CALLBACKS'
+    );
+  }
+}
+
+module.exports = {
+  isPublicHttpsUrl,
+  assertSlackCallbackUrls
+};

package/lib/channels/slack-provisioning/cli.js

@@ -0,0 +1,226 @@
+/**
+ * Spawn Slack CLI (`slack api …`) without scattering argv.
+ *
+ * @fileoverview Documented CLI only; skipped under Jest unless deps allow it
+ */
+
+'use strict';
+
+const path = require('path');
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { SLACK_BINARIES } = require('./constants');
+const { slackProvisioningError, wrapSlackCliError } = require('./errors');
+const { withSlackCliPath, slackCliLocalBinDir } = require('./install-cli');
+const { readSlackCredentialEntries, slackUserTokenForTeam } = require('./auth-store');
+
+/**
+ * @returns {boolean}
+ */
+function isJestWorker() {
+  return Boolean(process.env.JEST_WORKER_ID);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipLiveSlackCli(deps = {}) {
+  if (deps.allowInTests === true) {
+    return false;
+  }
+  return isJestWorker();
+}
+
+/**
+ * @returns {string[]}
+ */
+function slackBinaryCandidates() {
+  const local = path.join(slackCliLocalBinDir(), 'slack');
+  return [local, ...SLACK_BINARIES];
+}
+
+/**
+ * @param {typeof execFileDefault} execFileImpl
+ * @param {string} bin
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function binaryResponds(execFileImpl, bin, deps = {}) {
+  try {
+    await execFileImpl(bin, ['--version'], {
+      timeout: 20000,
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function resolveSlackBinary(deps = {}) {
+  if (typeof deps.slackBinary === 'string' && deps.slackBinary.trim()) {
+    return deps.slackBinary.trim();
+  }
+  if (shouldSkipLiveSlackCli(deps)) {
+    return null;
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  for (const bin of slackBinaryCandidates()) {
+    if (await binaryResponds(execFileImpl, bin, deps)) {
+      return bin;
+    }
+  }
+  return null;
+}
+
+/**
+ * Slack CLI `api` does not load ~/.slack/credentials.json unless a token is set.
+ * @param {Object} [deps]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function slackApiChildEnv(deps = {}) {
+  const env = withSlackCliPath(deps.env || process.env);
+  if (env.SLACK_USER_TOKEN || env.SLACK_BOT_TOKEN) {
+    return env;
+  }
+  if (typeof deps.slackUserToken === 'string' && deps.slackUserToken.trim()) {
+    return { ...env, SLACK_USER_TOKEN: deps.slackUserToken.trim() };
+  }
+  const token = slackUserTokenForTeam(readSlackCredentialEntries(deps), deps.teamId);
+  return token ? { ...env, SLACK_USER_TOKEN: token } : env;
+}
+
+/**
+ * Slack CLI 4.x: `slack api <method> --json '{...}' [-w team]`.
+ * @param {string} method
+ * @param {Object} [payload]
+ * @param {Object} [deps]
+ * @returns {string[]}
+ */
+function buildSlackApiArgs(method, payload = {}, deps = {}) {
+  const args = ['api', method, '--json', JSON.stringify(payload || {}), '--no-color', '-s'];
+  if (typeof deps.teamId === 'string' && deps.teamId.trim()) {
+    args.push('-w', deps.teamId.trim());
+  }
+  return args;
+}
+
+/**
+ * @param {string} stdout
+ * @returns {Object}
+ */
+function parseJsonStdout(stdout) {
+  const text = String(stdout || '').trim();
+  if (!text) {
+    return {};
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    const start = text.indexOf('{');
+    const end = text.lastIndexOf('}');
+    if (start >= 0 && end > start) {
+      return JSON.parse(text.slice(start, end + 1));
+    }
+    throw wrapSlackCliError(new Error('Slack CLI returned non-JSON output'));
+  }
+}
+
+/**
+ * @param {unknown} error
+ * @returns {Object|null}
+ */
+function jsonBodyFromCliError(error) {
+  const stdout = error && error.stdout;
+  if (!stdout) {
+    return null;
+  }
+  try {
+    const body = parseJsonStdout(stdout);
+    return body && typeof body === 'object' ? body : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Documented `slack api <method>` with a JSON payload.
+ * @param {string} method
+ * @param {Object} [payload]
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function runSlackApi(method, payload = {}, deps = {}) {
+  if (typeof deps.slackApi === 'function') {
+    return deps.slackApi(method, payload);
+  }
+  const bin = await resolveSlackBinary(deps);
+  if (!bin) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  try {
+    const result = await execFileImpl(bin, buildSlackApiArgs(method, payload, deps), {
+      cwd: deps.cwd,
+      env: slackApiChildEnv(deps),
+      timeout: deps.timeout || 180000,
+      maxBuffer: 2 * 1024 * 1024
+    });
+    return parseJsonStdout(result && result.stdout);
+  } catch (error) {
+    const body = jsonBodyFromCliError(error);
+    if (body) {
+      return body;
+    }
+    throw wrapSlackCliError(error);
+  }
+}
+
+/**
+ * Native Slack CLI install (project-based; may no-op without a Slack app project).
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function runNativeAppInstall(appId, deps = {}) {
+  const bin = await resolveSlackBinary(deps);
+  if (!bin || !appId) {
+    return {};
+  }
+  const execFileImpl = deps.execFile || execFileDefault;
+  const args = ['app', 'install', '-a', String(appId), '--no-color', '-s', '-f'];
+  if (typeof deps.teamId === 'string' && deps.teamId.trim()) {
+    args.push('-w', deps.teamId.trim());
+  }
+  try {
+    const result = await execFileImpl(bin, args, {
+      cwd: deps.cwd,
+      env: slackApiChildEnv(deps),
+      timeout: deps.timeout || 180000,
+      killSignal: 'SIGKILL',
+      maxBuffer: 2 * 1024 * 1024
+    });
+    return parseJsonStdout(result && result.stdout);
+  } catch {
+    return {};
+  }
+}
+
+module.exports = {
+  isJestWorker,
+  shouldSkipLiveSlackCli,
+  resolveSlackBinary,
+  runSlackApi,
+  runNativeAppInstall,
+  parseJsonStdout,
+  buildSlackApiArgs,
+  slackApiChildEnv
+};

package/lib/channels/slack-provisioning/constants.js

@@ -0,0 +1,37 @@
+/**
+ * Slack channel provisioning constants.
+ *
+ * @fileoverview Shared keys — never persist Slack tokens
+ */
+
+'use strict';
+
+const STATE_KIND = 'slack-channel';
+const STATE_FILE = 'provisioning-state.json';
+const SLACK_BINARIES = ['slack'];
+const SECRET_KEY_RE =
+  /^(accessToken|refreshToken|botToken|bot_token|signingSecret|signing_secret|client_secret|clientSecret|password)$/i;
+const KV_SIGNING_SECRET = 'kv://slack/signingSecret';
+const KV_BOT_TOKEN = 'kv://slack/botToken';
+const KV_CLIENT_SECRET = 'kv://slack/clientSecret';
+/** Slack create/install writes these into integration .env, then dataplane push. */
+const SLACK_PROVISIONED_KV_KEYS = [KV_SIGNING_SECRET, KV_BOT_TOKEN, KV_CLIENT_SECRET];
+const SLACK_APPS_URL = 'https://api.slack.com/apps';
+const SLACK_CLI_DOCS_URL = 'https://docs.slack.dev/tools/slack-cli';
+const SLACK_CLI_INSTALL_SCRIPT_URL = 'https://downloads.slack-edge.com/slack-cli/install.sh';
+const REQUIRED_CALLBACK_KEYS = ['eventsUrl', 'interactionUrl', 'commandUrl'];
+
+module.exports = {
+  STATE_KIND,
+  STATE_FILE,
+  SLACK_BINARIES,
+  SECRET_KEY_RE,
+  KV_SIGNING_SECRET,
+  KV_BOT_TOKEN,
+  KV_CLIENT_SECRET,
+  SLACK_PROVISIONED_KV_KEYS,
+  SLACK_APPS_URL,
+  SLACK_CLI_DOCS_URL,
+  SLACK_CLI_INSTALL_SCRIPT_URL,
+  REQUIRED_CALLBACK_KEYS
+};

package/lib/channels/slack-provisioning/credentials.js

@@ -0,0 +1,169 @@
+/**
+ * Store Slack secrets locally (secret set) then publish to dataplane.
+ *
+ * @fileoverview Never log or persist secret values in dist /
+ */
+
+'use strict';
+
+const { storeCredentialSecrets } = require('../../api/credential.api');
+const { KV_BOT_TOKEN, KV_CLIENT_SECRET, KV_SIGNING_SECRET } = require('./constants');
+const { writeSlackSecretsEnvFiles } = require('./env-file');
+
+/**
+ * @param {string} [value]
+ * @returns {boolean}
+ */
+function hasSecretValue(value) {
+  return typeof value === 'string' && Boolean(value.trim());
+}
+
+/**
+ * @param {string} kvPath
+ * @returns {string}
+ */
+function kvPathToSecretSetKey(kvPath) {
+  return String(kvPath || '').replace(/^kv:\/\//, '');
+}
+
+/**
+ * @param {Object} captured
+ * @param {Object} credentials
+ * @param {string[]} names
+ * @returns {string|undefined}
+ */
+function pickNamedSecret(captured, credentials, names) {
+  for (const name of names) {
+    if (hasSecretValue(captured[name])) return captured[name];
+    if (hasSecretValue(credentials[name])) return credentials[name];
+  }
+  return undefined;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {Object}
+ */
+function asSecretMap(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return value;
+  }
+  if (typeof value === 'string' && value.trim().startsWith('{')) {
+    try {
+      const parsed = JSON.parse(value);
+      return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+
+/**
+ * @param {Object} captured
+ * @returns {{ signingSecret?: string, botToken?: string, clientSecret?: string }}
+ */
+function pickSlackSecrets(captured) {
+  const source = captured || {};
+  const nested = asSecretMap(source.body || source.data);
+  const credentials = asSecretMap(source.credentials || nested.credentials);
+  const fromSource = pickNamedSecret(source, credentials, ['signingSecret', 'signing_secret']);
+  const fromNested = pickNamedSecret(nested, credentials, ['signingSecret', 'signing_secret']);
+  return {
+    signingSecret: fromSource || fromNested,
+    botToken: pickNamedSecret(source, credentials, ['botToken', 'bot_token', 'access_token'])
+      || pickNamedSecret(nested, credentials, ['botToken', 'bot_token', 'access_token']),
+    clientSecret: pickNamedSecret(source, credentials, ['clientSecret', 'client_secret'])
+      || pickNamedSecret(nested, credentials, ['clientSecret', 'client_secret'])
+  };
+}
+
+/**
+ * @param {{ signingSecret?: string, botToken?: string, clientSecret?: string }} secrets
+ * @returns {Array<{ key: string, value: string }>}
+ */
+function slackSecretItems(secrets) {
+  const pairs = [
+    [KV_SIGNING_SECRET, secrets && secrets.signingSecret],
+    [KV_BOT_TOKEN, secrets && secrets.botToken],
+    [KV_CLIENT_SECRET, secrets && secrets.clientSecret]
+  ];
+  return pairs
+    .filter(([, value]) => hasSecretValue(value))
+    .map(([key, value]) => ({ key, value: String(value).trim() }));
+}
+
+/**
+ * @param {Array<{ key: string, value: string }>} items
+ * @param {Object} deps
+ * @returns {Promise<void>}
+ */
+async function writeSlackSecretsLocal(items, deps) {
+  const setSecret =
+    deps.setSecretInStore || require('../../core/secrets-ensure').setSecretInStore;
+  for (const item of items) {
+    await setSecret(kvPathToSecretSetKey(item.key), item.value);
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function localSlackSigningPresent(deps = {}) {
+  if (typeof deps.hasLocalSlackSigningSecret === 'function') {
+    return deps.hasLocalSlackSigningSecret();
+  }
+  try {
+    const { loadSecrets } = require('../../core/secrets');
+    const secrets = await loadSecrets();
+    return hasSecretValue(secrets && secrets['slack/signingSecret']);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {Array<{ key: string }>} items
+ * @returns {{ stored: boolean, storedSigningSecret: boolean, storedBotToken: boolean,
+ *   storedClientSecret: boolean }}
+ */
+function slackStoreFlags(items) {
+  const keys = new Set(items.map((item) => item.key));
+  return {
+    stored: items.length > 0,
+    storedSigningSecret: keys.has(KV_SIGNING_SECRET),
+    storedBotToken: keys.has(KV_BOT_TOKEN),
+    storedClientSecret: keys.has(KV_CLIENT_SECRET)
+  };
+}
+
+/**
+ * Write Slack create/install secrets to local store and integration .env, then push.
+ *
+ * @param {Object} ctx
+ * @param {{ signingSecret?: string, botToken?: string, clientSecret?: string }} secrets
+ * @returns {Promise<{ stored: boolean, storedSigningSecret: boolean, storedBotToken: boolean,
+ *   storedClientSecret: boolean }>}
+ */
+async function storeSlackChannelSecrets(ctx, secrets, deps = {}) {
+  const items = slackSecretItems(secrets);
+  const flags = slackStoreFlags(items);
+  if (!flags.stored) {
+    return flags;
+  }
+  await writeSlackSecretsLocal(items, deps);
+  writeSlackSecretsEnvFiles(ctx, items, deps);
+  const store = deps.storeCredentialSecrets || storeCredentialSecrets;
+  await store(ctx.dataplaneUrl, ctx.authConfig, items);
+  return flags;
+}
+
+module.exports = {
+  hasSecretValue,
+  kvPathToSecretSetKey,
+  pickSlackSecrets,
+  slackSecretItems,
+  localSlackSigningPresent,
+  storeSlackChannelSecrets
+};