@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/slack-provisioning/curl-shim.js

@@ -0,0 +1,132 @@
+/**
+ * Minimal curl stand-in for hosts where `curl` is not installed.
+ * Supports URL download to stdout or `-o` / `--output` (including clustered `-fLo`).
+ */
+
+'use strict';
+
+const fs = require('fs');
+const https = require('https');
+const http = require('http');
+
+const MAX_REDIRECTS = 5;
+
+function isHttpUrl(value) {
+  return /^https?:\/\//i.test(String(value || ''));
+}
+
+/**
+ * Consume `-o FILE`, `--output FILE`, `-fLo FILE`, or `-oFILE`.
+ * @returns {number} last consumed argv index
+ */
+function applyOutputFlag(arg, argv, index, state) {
+  if (arg === '-o' || arg === '--output') {
+    state.output = argv[index + 1] || '';
+    return index + 1;
+  }
+  if (!arg.startsWith('-') || arg.startsWith('--') || arg === '-') {
+    return index;
+  }
+  const body = arg.slice(1);
+  const outputAt = body.indexOf('o');
+  if (outputAt < 0) {
+    return index;
+  }
+  const inline = body.slice(outputAt + 1);
+  if (inline) {
+    state.output = inline;
+    return index;
+  }
+  state.output = argv[index + 1] || '';
+  return index + 1;
+}
+
+function parseCurlArgs(argv) {
+  const state = { output: '', positionals: [] };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--url') {
+      state.positionals.push(argv[i + 1] || '');
+      i += 1;
+      continue;
+    }
+    if (typeof arg === 'string' && arg.startsWith('--url=')) {
+      state.positionals.push(arg.slice('--url='.length));
+      continue;
+    }
+    const next = applyOutputFlag(arg, argv, i, state);
+    if (next !== i) {
+      i = next;
+      continue;
+    }
+    if (typeof arg === 'string' && arg.startsWith('-')) {
+      continue;
+    }
+    state.positionals.push(arg);
+  }
+  const url = state.positionals.find(isHttpUrl) || state.positionals[0] || '';
+  return { output: state.output, url };
+}
+
+function followRedirect(url, res, redirects, output, resolve, reject) {
+  const status = res.statusCode || 0;
+  if (!(status >= 300 && status < 400 && res.headers.location)) {
+    return false;
+  }
+  res.resume();
+  if (redirects >= MAX_REDIRECTS) {
+    reject(new Error('Too many redirects.'));
+    return true;
+  }
+  const nextUrl = new URL(res.headers.location, url).toString();
+  download(nextUrl, output, redirects + 1).then(resolve, reject);
+  return true;
+}
+
+function download(url, output, redirects) {
+  return new Promise((resolve, reject) => {
+    if (!isHttpUrl(url)) {
+      reject(new Error('URL is required.'));
+      return;
+    }
+    const client = url.startsWith('https:') ? https : http;
+    const req = client.get(url, { timeout: 60000 }, (res) => {
+      if (followRedirect(url, res, redirects, output, resolve, reject)) {
+        return;
+      }
+      if ((res.statusCode || 0) !== 200) {
+        res.resume();
+        reject(new Error(`Download failed (${res.statusCode || 0}).`));
+        return;
+      }
+      const dest = output ? fs.createWriteStream(output) : process.stdout;
+      res.pipe(dest);
+      dest.on('finish', () => {
+        if (output && typeof dest.close === 'function') {
+          dest.close(() => resolve());
+          return;
+        }
+        resolve();
+      });
+      dest.on('error', reject);
+    });
+    req.on('error', reject);
+  });
+}
+
+async function main(argv) {
+  const { output, url } = parseCurlArgs(argv);
+  if (!url) {
+    throw new Error('URL is required.');
+  }
+  await download(url, output, 0);
+}
+
+module.exports = { parseCurlArgs, download, main, isHttpUrl };
+
+if (require.main === module) {
+  main(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exit(1);
+  });
+}

package/lib/channels/slack-provisioning/developer-install.js

@@ -0,0 +1,118 @@
+/**
+ * Slack workspace install via apps.developerInstall (bot token).
+ *
+ * @fileoverview HTTP install for portal; signing secret still comes from create only
+ */
+
+'use strict';
+
+const { runSlackApi } = require('./cli');
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function trimmedString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+/**
+ * @param {...unknown} values
+ * @returns {string}
+ */
+function firstTrimmed(...values) {
+  for (const value of values) {
+    const text = trimmedString(value);
+    if (text) {
+      return text;
+    }
+  }
+  return '';
+}
+
+/**
+ * @param {Object} [manifest]
+ * @returns {string[]}
+ */
+function botScopesFromManifest(manifest) {
+  const scopes = manifest && manifest.oauth_config && manifest.oauth_config.scopes;
+  const bot = scopes && scopes.bot;
+  if (!Array.isArray(bot)) {
+    return [];
+  }
+  return bot.map((scope) => trimmedString(scope)).filter(Boolean);
+}
+
+/**
+ * @param {unknown} value
+ * @returns {Object}
+ */
+function asObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+/**
+ * @param {Object} [body]
+ * @returns {{ botToken?: string, teamId?: string, botId?: string }}
+ */
+function pickInstalledSlackTokens(body) {
+  if (!body || body.ok === false) {
+    return {};
+  }
+  const tokens = asObject(body.api_access_tokens);
+  const botToken = firstTrimmed(tokens.bot, body.bot_token, body.access_token, body.botToken);
+  if (!botToken) {
+    return {};
+  }
+  const teamId = firstTrimmed(body.team_id, asObject(body.team).id);
+  const botId = firstTrimmed(body.bot_id, asObject(body.bot).id);
+  return {
+    botToken,
+    ...(teamId ? { teamId } : {}),
+    ...(botId ? { botId } : {})
+  };
+}
+
+/**
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Object}
+ */
+function developerInstallPayload(appId, deps = {}) {
+  const payload = { app_id: appId };
+  const scopes = Array.isArray(deps.botScopes)
+    ? deps.botScopes.map((scope) => trimmedString(scope)).filter(Boolean)
+    : [];
+  if (scopes.length) {
+    payload.bot_scopes = scopes;
+  }
+  return payload;
+}
+
+/**
+ * Same method Slack CLI uses. Returns bot token without hanging on `app install`.
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<{ botToken?: string, teamId?: string, botId?: string }>}
+ */
+async function developerInstallApp(appId, deps = {}) {
+  if (!appId) {
+    return {};
+  }
+  try {
+    const body = await runSlackApi(
+      'apps.developerInstall',
+      developerInstallPayload(appId, deps),
+      deps
+    );
+    return pickInstalledSlackTokens(body);
+  } catch {
+    return {};
+  }
+}
+
+module.exports = {
+  botScopesFromManifest,
+  pickInstalledSlackTokens,
+  developerInstallApp
+};

package/lib/channels/slack-provisioning/env-file.js

@@ -0,0 +1,120 @@
+/**
+ * Write Slack provisioned secrets into integration .env (plain KV_* values).
+ *
+ * @fileoverview .env is the local SSOT; dataplane push reads these keys
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { getIntegrationPath } = require('../../utils/paths');
+const {
+  systemKeyToKvPrefix,
+  securityKeyToVar
+} = require('../../utils/credential-secrets-env-kv');
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function trimmed(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+/**
+ * kv://slack/signingSecret → KV_SLACK_SIGNINGSECRET
+ * @param {string} kvPath
+ * @returns {string}
+ */
+function kvPathToEnvVar(kvPath) {
+  const pathKey = String(kvPath || '').replace(/^kv:\/\//, '');
+  const slash = pathKey.indexOf('/');
+  if (slash <= 0) {
+    return '';
+  }
+  const systemKey = pathKey.slice(0, slash);
+  const securityKey = pathKey.slice(slash + 1);
+  if (!systemKey || !securityKey) {
+    return '';
+  }
+  return `KV_${systemKeyToKvPrefix(systemKey)}_${securityKeyToVar(securityKey)}`;
+}
+
+/**
+ * @param {Array<{ key: string, value: string }>} items
+ * @returns {Object.<string, string>}
+ */
+function slackEnvMapFromItems(items) {
+  const map = {};
+  for (const item of items || []) {
+    const envKey = kvPathToEnvVar(item && item.key);
+    if (envKey && trimmed(item.value)) {
+      map[envKey] = String(item.value).trim();
+    }
+  }
+  return map;
+}
+
+/**
+ * Catalog HMAC uses kv://slack/…; instance packages still use those KV_SLACK_* names.
+ * @param {Object} [ctx]
+ * @param {Object} [deps]
+ * @returns {string[]}
+ */
+function resolveSlackEnvPaths(ctx, deps = {}) {
+  const root = trimmed(deps.projectRoot);
+  const instanceKey = trimmed(deps.instanceSystemKey || (ctx && ctx.instanceSystemKey));
+  const folders = ['slack'];
+  if (instanceKey && instanceKey !== 'slack') {
+    folders.push(instanceKey);
+  }
+  return folders.map((folder) => (
+    root
+      ? path.join(path.resolve(root), 'integration', folder, '.env')
+      : path.join(getIntegrationPath(folder), '.env')
+  ));
+}
+
+/**
+ * @param {string} envPath
+ * @param {Object.<string, string>} envMap
+ * @returns {void}
+ */
+function mergeSlackEnvFile(envPath, envMap) {
+  const { mergeEnvMapIntoContent } = require('../../core/secrets-env-content');
+  fs.mkdirSync(path.dirname(envPath), { recursive: true });
+  const existing = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : '';
+  const merged = mergeEnvMapIntoContent(existing, envMap);
+  const withNl = merged.endsWith('\n') ? merged : `${merged}\n`;
+  fs.writeFileSync(envPath, withNl, 'utf8');
+}
+
+/**
+ * @param {Object} [ctx]
+ * @param {Array<{ key: string, value: string }>} items
+ * @param {Object} [deps]
+ * @returns {string[]}
+ */
+function writeSlackSecretsEnvFiles(ctx, items, deps = {}) {
+  const envMap = slackEnvMapFromItems(items);
+  if (Object.keys(envMap).length === 0) {
+    return [];
+  }
+  if (typeof deps.writeSlackEnvFiles === 'function') {
+    return deps.writeSlackEnvFiles(envMap) || [];
+  }
+  const written = [];
+  for (const envPath of resolveSlackEnvPaths(ctx, deps)) {
+    mergeSlackEnvFile(envPath, envMap);
+    written.push(envPath);
+  }
+  return written;
+}
+
+module.exports = {
+  kvPathToEnvVar,
+  slackEnvMapFromItems,
+  resolveSlackEnvPaths,
+  writeSlackSecretsEnvFiles
+};

package/lib/channels/slack-provisioning/errors.js

@@ -0,0 +1,47 @@
+/**
+ * Normalize Slack provisioning failures without leaking tokens.
+ *
+ * @fileoverview User-facing Slack adapter errors
+ */
+
+'use strict';
+
+/**
+ * @param {string} message
+ * @param {string} [code]
+ * @returns {Error}
+ */
+function slackProvisioningError(message, code) {
+  const error = new Error(message);
+  error.code = code || 'SLACK_PROVISIONING';
+  return error;
+}
+
+/**
+ * @param {string} text
+ * @returns {string}
+ */
+function redactSlackSecrets(text) {
+  return String(text)
+    .replace(/xox[baprs]-[A-Za-z0-9-]+/g, '[redacted]')
+    .replace(/signing[_-]?secret["']?\s*[:=]\s*["']?[^"'\s]+/gi, 'signing_secret=[redacted]');
+}
+
+/**
+ * @param {unknown} error
+ * @returns {Error}
+ */
+function wrapSlackCliError(error) {
+  const raw = error && error.message ? String(error.message) : String(error);
+  const compact = redactSlackSecrets(raw.replace(/\s+/g, ' ').trim()).slice(0, 400);
+  return slackProvisioningError(
+    `Slack CLI could not complete app provisioning. ${compact}`,
+    'SLACK_CLI'
+  );
+}
+
+module.exports = {
+  slackProvisioningError,
+  redactSlackSecrets,
+  wrapSlackCliError
+};

package/lib/channels/slack-provisioning/go-ca-bundle.js

@@ -0,0 +1,137 @@
+/**
+ * Trust store for the Go Slack CLI (SSL_CERT_FILE is the whole bundle).
+ *
+ * @fileoverview Do not set SSL_CERT_FILE to NODE_EXTRA_CA_CERTS alone
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const tls = require('tls');
+
+const SYSTEM_CA_CANDIDATES = [
+  '/etc/ssl/certs/ca-certificates.crt',
+  '/etc/pki/tls/certs/ca-bundle.crt',
+  '/etc/ssl/cert.pem'
+];
+
+/**
+ * @param {string[]} filePaths
+ * @returns {string}
+ */
+function firstExistingFile(filePaths) {
+  return filePaths.find((filePath) => filePath && fs.existsSync(filePath)) || '';
+}
+
+/**
+ * @returns {string}
+ */
+function systemCaBundlePath() {
+  return firstExistingFile(SYSTEM_CA_CANDIDATES);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {string}
+ */
+function extraCaPath(env) {
+  const fromNode = typeof env.NODE_EXTRA_CA_CERTS === 'string' ? env.NODE_EXTRA_CA_CERTS.trim() : '';
+  if (fromNode && fs.existsSync(fromNode)) {
+    return fromNode;
+  }
+  return '';
+}
+
+/**
+ * @returns {string}
+ */
+function nodeRootCaPem() {
+  const certs = tls.rootCertificates;
+  if (!Array.isArray(certs) || certs.length === 0) {
+    return '';
+  }
+  return `${certs.join('\n')}\n`;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {string}
+ */
+function readPem(filePath) {
+  if (!filePath) {
+    return '';
+  }
+  try {
+    return fs.readFileSync(filePath, 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {string[]} parts
+ * @returns {string}
+ */
+function joinPemParts(parts) {
+  const body = parts
+    .map((part) => String(part || '').trim())
+    .filter(Boolean)
+    .join('\n');
+  return body ? `${body}\n` : '';
+}
+
+/**
+ * @param {string} destDir
+ * @param {string} pem
+ * @returns {string}
+ */
+function writeBundle(destDir, pem) {
+  fs.mkdirSync(destDir, { recursive: true });
+  const dest = path.join(destDir, 'ca-bundle.pem');
+  if (readPem(dest) === pem.trim()) {
+    return dest;
+  }
+  fs.writeFileSync(dest, pem, { mode: 0o600 });
+  return dest;
+}
+
+/**
+ * @param {string} extra
+ * @param {string} systemPath
+ * @param {string} [nodePem]
+ * @returns {string}
+ */
+function resolveTrustPem(extra, systemPath, nodePem) {
+  const rootsPem = readPem(systemPath) || nodePem || nodeRootCaPem();
+  const extraPem = extra && extra !== systemPath ? readPem(extra) : '';
+  return joinPemParts([rootsPem, extraPem]);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} env
+ * @param {string} slackHome
+ * @param {Object} [deps]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function withGoTrustedCa(env, slackHome, deps = {}) {
+  if (env.SSL_CERT_FILE || env.SSL_CERT_DIR) {
+    return env;
+  }
+  const extra = deps.extraCaPath !== undefined ? deps.extraCaPath : extraCaPath(env);
+  const systemPath = deps.systemCaPath !== undefined ? deps.systemCaPath : systemCaBundlePath();
+  if (systemPath && !extra) {
+    return { ...env, SSL_CERT_FILE: systemPath };
+  }
+  const pem = resolveTrustPem(extra, systemPath, deps.nodeRootPem);
+  if (!pem) {
+    return extra ? { ...env, SSL_CERT_FILE: extra } : env;
+  }
+  const bundlePath = writeBundle(path.join(slackHome, '.ssl'), pem);
+  return { ...env, SSL_CERT_FILE: bundlePath };
+}
+
+module.exports = {
+  withGoTrustedCa,
+  systemCaBundlePath
+};