@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/slack-provisioning/index.js

@@ -0,0 +1,250 @@
+/**
+ * Slack channel provisioning adapter (CLI + Manifest API).
+ *
+ * @fileoverview Create/reuse Slack app from generated manifest; store secrets via dataplane
+ */
+
+'use strict';
+
+const { assertSlackCallbackUrls } = require('./callbacks');
+const { parseGeneratedManifest, assertLocalManifest } = require('./manifest');
+const {
+  validateManifestRemote,
+  createManifestApp,
+  updateManifestApp,
+  installManifestApp,
+  exportManifestApp,
+  exportManifestLookup,
+  resolveSlackClientId
+} = require('./apps');
+const { preserveSlackOAuthLocks } = require('./oauth-lock');
+const {
+  pickSlackSecrets,
+  storeSlackChannelSecrets,
+  localSlackSigningPresent
+} = require('./credentials');
+const {
+  readProvisioningState,
+  writeProvisioningState,
+  hasProvenAppIdentity
+} = require('./persist');
+const { listSlackAuths, pickSlackWorkspace, workspaceFromSessionToken } = require('./auth');
+const { slackProvisioningError } = require('./errors');
+const { pickSlackClientId, slackConsentRemaining, slackConsentUrls } = require('./remaining-urls');
+const { botScopesFromManifest } = require('./developer-install');
+
+/**
+ * @param {Object} params
+ * @returns {Object}
+ */
+function loadProvenState(params) {
+  const state = readProvisioningState(params.projectRoot);
+  if (state && !hasProvenAppIdentity(state)) {
+    throw slackProvisioningError(
+      'Slack provisioning state exists but app id is missing. Fix or delete dist/channels/slack/provisioning-state.json.',
+      'UNPROVEN_IDENTITY'
+    );
+  }
+  return state;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function resolveWorkspace(params, deps) {
+  const fromToken = await workspaceFromSessionToken(deps);
+  const auths = fromToken ? [fromToken] : await listSlackAuths(deps);
+  const workspace = pickSlackWorkspace(auths, params.expectedTeamId);
+  if (!workspace) {
+    throw slackProvisioningError(
+      'No Slack workspace is signed in.',
+      'UNPROVEN_IDENTITY'
+    );
+  }
+  return workspace;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} payload
+ * @returns {void}
+ */
+function persistIds(params, payload) {
+  writeProvisioningState(params.projectRoot, {
+    environment: params.environment,
+    appId: payload.appId,
+    clientId: payload.clientId || null,
+    teamId: payload.teamId || null,
+    botId: payload.botId || null,
+    secretsStored: payload.secretsStored === true
+  });
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} captured
+ * @param {Object} [deps]
+ * @returns {Promise<{ connected: boolean, remaining: string[], appId: string }>}
+ */
+async function storeAndFinish(params, captured, deps) {
+  const secrets = pickSlackSecrets(captured);
+  const stored = await storeSlackChannelSecrets(params.ctx, secrets, {
+    ...deps,
+    projectRoot: params.projectRoot,
+    instanceSystemKey: params.ctx && params.ctx.instanceSystemKey
+  });
+  const signingReady = stored.storedSigningSecret || params.priorSecretsStored === true;
+  const botReady = stored.storedBotToken || params.priorSecretsStored === true;
+  const secretsStored = signingReady && botReady;
+  let clientId = pickSlackClientId(captured);
+  if (!clientId && !secretsStored) {
+    clientId = await resolveSlackClientId(captured, deps);
+  }
+  persistIds(params, {
+    appId: captured.appId,
+    clientId,
+    teamId: captured.teamId || params.workspaceTeamId,
+    botId: captured.botId,
+    secretsStored
+  });
+  const urls = slackConsentUrls({
+    ...captured,
+    clientId,
+    teamId: captured.teamId || params.workspaceTeamId
+  });
+  return {
+    connected: secretsStored,
+    remaining: slackConsentRemaining(
+      secretsStored ? { storedSigningSecret: true } : stored
+    ),
+    appId: captured.appId,
+    signingSecretFallback: stored.storedSigningSecret !== true,
+    storedSigningSecret: stored.storedSigningSecret === true,
+    storedBotToken: stored.storedBotToken === true,
+    ...urls
+  };
+}
+
+/**
+ * Install deps: HTTP developerInstall always; native CLI `app install` only when not quiet.
+ * @param {Object} params
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Object}
+ */
+function slackInstallDeps(params, manifest, deps) {
+  return {
+    ...deps,
+    quiet: params && params.quiet === true,
+    botScopes: botScopesFromManifest(manifest)
+  };
+}
+
+/**
+ * Capture bot token from Slack. Portal skips native CLI hang (CIP 120s).
+ * @param {string} appId
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function maybeInstallSlackApp(appId, deps) {
+  try {
+    return (await installManifestApp(appId, deps)) || {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} manifest
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function createNewSlackApp(params, manifest, deps) {
+  await validateManifestRemote(manifest, deps);
+  const created = await createManifestApp(manifest, deps);
+  persistIds(params, {
+    appId: created.app_id,
+    clientId: pickSlackClientId(created),
+    teamId: params.workspaceTeamId,
+    secretsStored: false
+  });
+  const installed = await maybeInstallSlackApp(
+    created.app_id,
+    slackInstallDeps(params, manifest, deps)
+  );
+  return storeAndFinish(params, {
+    appId: created.app_id,
+    clientId: pickSlackClientId(created),
+    teamId: installed.teamId || params.workspaceTeamId,
+    botId: installed.botId,
+    credentials: created.credentials,
+    oauth_authorize_url: created.oauth_authorize_url,
+    botToken: installed.botToken
+  }, deps);
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} manifest
+ * @param {Object} state
+ * @param {Object} [deps]
+ * @returns {Promise<Object>}
+ */
+async function reuseSlackApp(params, manifest, state, deps, remote) {
+  const exported = remote === undefined ? await exportManifestApp(state.appId, deps) : remote;
+  const merged = preserveSlackOAuthLocks(manifest, exported);
+  await validateManifestRemote(merged, { ...deps, appId: state.appId });
+  await updateManifestApp(state.appId, merged, deps);
+  const installed = await maybeInstallSlackApp(
+    state.appId,
+    slackInstallDeps(params, manifest, deps)
+  );
+  return storeAndFinish(
+    { ...params, priorSecretsStored: state.secretsStored === true },
+    {
+      appId: state.appId,
+      clientId: state.clientId,
+      teamId: installed.teamId || state.teamId || params.workspaceTeamId,
+      botId: installed.botId || state.botId,
+      botToken: installed.botToken
+    },
+    deps
+  );
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ connected: boolean, remaining: string[], appId?: string }>}
+ */
+async function provisionSlackChannel(params, deps = {}) {
+  assertSlackCallbackUrls(params.runtimeValues);
+  const manifest = parseGeneratedManifest(params.artifact && params.artifact.content);
+  assertLocalManifest(manifest);
+  const workspace = await resolveWorkspace(params, deps);
+  const workspaceTeamId = workspace.team_id || workspace.teamId;
+  const apiDeps = {
+    ...deps,
+    teamId: workspaceTeamId
+  };
+  const state = loadProvenState(params);
+  const withTeam = { ...params, workspaceTeamId };
+  const reuseKnownApp =
+    hasProvenAppIdentity(state) && (await localSlackSigningPresent(apiDeps));
+  if (reuseKnownApp) {
+    const lookup = await exportManifestLookup(state.appId, apiDeps);
+    if (!lookup.missing) {
+      return reuseSlackApp(withTeam, manifest, state, apiDeps, lookup.manifest);
+    }
+  }
+  return createNewSlackApp(withTeam, manifest, apiDeps);
+}
+
+module.exports = {
+  provisionSlackChannel,
+  loadProvenState,
+  persistIds
+};

package/lib/channels/slack-provisioning/install-cli.js

@@ -0,0 +1,335 @@
+/**
+ * Official Slack CLI installer (Mac/Linux install.sh only).
+ *
+ * @fileoverview Do not apt/snap install the Slack desktop app
+ */
+
+'use strict';
+
+const fs = require('fs');
+const https = require('https');
+const os = require('os');
+const path = require('path');
+const { promisify } = require('util');
+const { spawn } = require('child_process');
+const execFileDefault = promisify(require('child_process').execFile);
+const chalk = require('chalk');
+const ora = require('ora');
+const logger = require('../../utils/logger');
+const { formatSuccessLine } = require('../../utils/cli-layout-chalk');
+const { SLACK_CLI_INSTALL_SCRIPT_URL } = require('./constants');
+const { slackProvisioningError } = require('./errors');
+const { withGoTrustedCa } = require('./go-ca-bundle');
+const { withCurlOnPath } = require('./with-curl-on-path');
+
+const MAX_SCRIPT_BYTES = 512 * 1024;
+const MAX_REDIRECTS = 5;
+const SLACK_CLI_FALLBACK_HOME = 'aifabrix-slack-home';
+
+/**
+ * @param {string} dir
+ * @returns {boolean}
+ */
+function isRootHomeDir(dir) {
+  const resolved = path.resolve(dir);
+  return resolved === path.parse(resolved).root;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function usableHomeDir(value) {
+  const trimmed = typeof value === 'string' ? value.trim() : '';
+  if (!trimmed || isRootHomeDir(trimmed)) {
+    return '';
+  }
+  return path.resolve(trimmed);
+}
+
+/**
+ * HOME=/ in builder-api cannot mkdir ~/.slack. Use a writable temp home instead.
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+function slackCliHomeDir(env = process.env) {
+  const ownHome = Boolean(env && Object.prototype.hasOwnProperty.call(env, 'HOME'));
+  const home = ownHome
+    ? usableHomeDir(env.HOME)
+    : usableHomeDir(env && env.HOME) || usableHomeDir(process.env.HOME);
+  if (home) {
+    return home;
+  }
+  const fallback = path.join(os.tmpdir(), SLACK_CLI_FALLBACK_HOME);
+  fs.mkdirSync(fallback, { recursive: true });
+  return fallback;
+}
+
+/**
+ * @returns {boolean}
+ */
+function isSlackCliInstallerSupported() {
+  return process.platform === 'linux' || process.platform === 'darwin';
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+function slackCliLocalBinDir(env = process.env) {
+  return path.join(slackCliHomeDir(env), '.local', 'bin');
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function withSlackCliPath(env = process.env) {
+  const home = slackCliHomeDir(env);
+  const dir = slackCliLocalBinDir({ ...env, HOME: home });
+  const current = env.PATH || '';
+  const parts = current.split(path.delimiter).filter(Boolean);
+  const nextPath = parts.includes(dir) ? current : `${dir}${path.delimiter}${current}`;
+  return withGoTrustedCa({ ...env, HOME: home, PATH: nextPath }, home);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {void}
+ */
+function applySlackCliPath(deps = {}) {
+  const next = withSlackCliPath(deps.env || process.env);
+  deps.env = next;
+  process.env.PATH = next.PATH;
+  if (next.SSL_CERT_FILE) {
+    process.env.SSL_CERT_FILE = next.SSL_CERT_FILE;
+  }
+  if (!usableHomeDir(process.env.HOME)) {
+    process.env.HOME = next.HOME;
+  }
+}
+
+/**
+ * @param {string} url
+ * @param {import('http').IncomingMessage} res
+ * @param {number} redirects
+ * @param {(value: string) => void} resolve
+ * @param {(reason: Error) => void} reject
+ * @returns {boolean}
+ */
+function followHttpsRedirect(url, res, redirects, resolve, reject) {
+  const status = res.statusCode || 0;
+  if (!(status >= 300 && status < 400 && res.headers.location)) {
+    return false;
+  }
+  res.resume();
+  if (redirects >= MAX_REDIRECTS) {
+    reject(new Error('Too many redirects downloading Slack CLI installer.'));
+    return true;
+  }
+  const nextUrl = new URL(res.headers.location, url).toString();
+  if (!nextUrl.startsWith('https://')) {
+    reject(new Error('Slack CLI installer redirect was not HTTPS.'));
+    return true;
+  }
+  fetchHttpsText(nextUrl, redirects + 1).then(resolve, reject);
+  return true;
+}
+
+/**
+ * @param {import('http').IncomingMessage} res
+ * @param {(value: string) => void} resolve
+ * @param {(reason: Error) => void} reject
+ * @returns {void}
+ */
+function readInstallScriptBody(res, resolve, reject) {
+  const chunks = [];
+  let size = 0;
+  res.on('data', (chunk) => {
+    size += chunk.length;
+    if (size > MAX_SCRIPT_BYTES) {
+      res.destroy(new Error('Slack CLI installer script is larger than expected.'));
+      return;
+    }
+    chunks.push(chunk);
+  });
+  res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+  res.on('error', reject);
+}
+
+/**
+ * @param {string} url
+ * @param {number} [redirects]
+ * @returns {Promise<string>}
+ */
+function fetchHttpsText(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { timeout: 30000 }, (res) => {
+      if (followHttpsRedirect(url, res, redirects, resolve, reject)) {
+        return;
+      }
+      if ((res.statusCode || 0) !== 200) {
+        res.resume();
+        reject(new Error(`Slack CLI installer download failed (${res.statusCode || 0}).`));
+        return;
+      }
+      readInstallScriptBody(res, resolve, reject);
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Drop Node's version footer; prefer an Error: line when present.
+ * @param {string} text
+ * @returns {string}
+ */
+function lastUsefulInstallLine(text) {
+  const lines = text.split('\n').map((line) => line.trim()).filter(Boolean);
+  const withoutNode = lines.filter((line) => !/^Node\.js v\d/i.test(line));
+  const pool = withoutNode.length ? withoutNode : lines;
+  const errorLine = [...pool].reverse().find((line) => /^Error:/i.test(line));
+  return errorLine || pool[pool.length - 1] || '';
+}
+
+/**
+ * Prefer child stderr over Node's "Command failed: bash /tmp/…" wrapper.
+ * @param {unknown} error
+ * @returns {string}
+ */
+function slackCliInstallFailureMessage(error) {
+  const stderr = error && error.stderr ? String(error.stderr).trim() : '';
+  const stdout = error && error.stdout ? String(error.stdout).trim() : '';
+  const raw = error && error.message ? String(error.message) : '';
+  const fromChild = stderr || stdout;
+  if (fromChild) {
+    return lastUsefulInstallLine(fromChild) || fromChild;
+  }
+  const stripped = raw.replace(/^Command failed: bash \S+\s*/i, '').trim();
+  return stripped || 'Slack CLI install failed.';
+}
+
+function assertInstallScript(script) {
+  const text = String(script || '').trim();
+  if (!text.startsWith('#!')) {
+    throw slackProvisioningError('Slack CLI installer script is not a shell script.', 'SLACK_CLI');
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function runInstallScript(deps = {}) {
+  const fetchFn = deps.fetchInstallScript || fetchHttpsText;
+  const script = await fetchFn(SLACK_CLI_INSTALL_SCRIPT_URL);
+  assertInstallScript(script);
+  const scriptPath = path.join(os.tmpdir(), `aifabrix-slack-cli-install-${process.pid}.sh`);
+  fs.writeFileSync(scriptPath, script, { mode: 0o700 });
+  const execFileImpl = deps.execFile || execFileDefault;
+  const env = await withCurlOnPath(withSlackCliPath(deps.env || process.env));
+  try {
+    await execFileImpl('bash', [scriptPath], {
+      env,
+      timeout: deps.timeout || 180000,
+      maxBuffer: 2 * 1024 * 1024
+    });
+  } catch (error) {
+    throw slackProvisioningError(slackCliInstallFailureMessage(error), 'SLACK_CLI');
+  } finally {
+    try {
+      fs.unlinkSync(scriptPath);
+    } catch {
+      // ignore
+    }
+  }
+}
+
+/**
+ * @param {string} text
+ * @returns {import('ora').Ora|null}
+ */
+function startInstallSpinner(text) {
+  if (!process.stdout || !process.stdout.isTTY) {
+    logger.log(chalk.white(text));
+    return null;
+  }
+  return ora({ text: chalk.white(text), spinner: 'dots' }).start();
+}
+
+/**
+ * Official Slack install.sh. Never apt/snap `slack` (desktop app).
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function installOfficialSlackCli(deps = {}) {
+  if (typeof deps.installCli === 'function') {
+    await deps.installCli();
+    applySlackCliPath(deps);
+    return;
+  }
+  if (!isSlackCliInstallerSupported()) {
+    throw slackProvisioningError(
+      'Automatic Slack CLI install is available on Linux and macOS only.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  const spinner = startInstallSpinner('Installing Slack CLI…');
+  try {
+    await runInstallScript(deps);
+    applySlackCliPath(deps);
+    if (spinner) {
+      spinner.stop();
+    }
+    logger.log(formatSuccessLine('Slack CLI installed'));
+  } catch (error) {
+    if (spinner) {
+      spinner.stop();
+    }
+    throw slackProvisioningError(
+      error && error.message ? error.message : 'Slack CLI install failed.',
+      'SLACK_CLI'
+    );
+  }
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function runSlackLogin(deps = {}) {
+  if (typeof deps.slackLogin === 'function') {
+    await deps.slackLogin();
+    return;
+  }
+  const bin = typeof deps.slackBinary === 'string' && deps.slackBinary.trim()
+    ? deps.slackBinary.trim()
+    : 'slack';
+  await new Promise((resolve, reject) => {
+    const child = spawn(bin, ['login'], {
+      stdio: 'inherit',
+      env: withSlackCliPath(deps.env || process.env)
+    });
+    child.on('error', reject);
+    child.on('exit', (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(slackProvisioningError(`slack login exited ${code}.`, 'SLACK_CLI'));
+    });
+  });
+}
+
+module.exports = {
+  isSlackCliInstallerSupported,
+  slackCliHomeDir,
+  slackCliLocalBinDir,
+  withSlackCliPath,
+  applySlackCliPath,
+  fetchHttpsText,
+  assertInstallScript,
+  slackCliInstallFailureMessage,
+  installOfficialSlackCli,
+  runSlackLogin
+};

package/lib/channels/slack-provisioning/manifest.js

@@ -0,0 +1,89 @@
+/**
+ * Local Slack manifest checks — generated artifact is SSOT.
+ *
+ * @fileoverview Do not rebuild Slack fields; validate the generated JSON
+ */
+
+'use strict';
+
+const { slackProvisioningError } = require('./errors');
+const { SLACK_APP_LONG_DESCRIPTION_MIN_LENGTH } = require('../channel-description');
+
+/**
+ * @param {string} content
+ * @returns {Object}
+ */
+function parseGeneratedManifest(content) {
+  if (typeof content !== 'string' || !content.trim()) {
+    throw slackProvisioningError('Generated Slack manifest is empty.', 'MANIFEST');
+  }
+  try {
+    const parsed = JSON.parse(content);
+    if (!parsed || typeof parsed !== 'object') {
+      throw new Error('not an object');
+    }
+    return parsed;
+  } catch {
+    throw slackProvisioningError('Generated Slack manifest is not valid JSON.', 'MANIFEST');
+  }
+}
+
+/**
+ * @param {Object} [display]
+ * @returns {boolean}
+ */
+function hasDisplayParts(display) {
+  const name = display && display.name;
+  const longDescription = String((display && display.long_description) || '').trim();
+  return Boolean(name && longDescription.length >= SLACK_APP_LONG_DESCRIPTION_MIN_LENGTH);
+}
+
+/**
+ * @param {Object} [features]
+ * @returns {boolean}
+ */
+function hasFeatureParts(features) {
+  const commands = features && features.slash_commands;
+  return Boolean(features && features.bot_user && Array.isArray(commands) && commands.length > 0);
+}
+
+/**
+ * @param {Object} [settings]
+ * @returns {boolean}
+ */
+function hasSettingsParts(settings) {
+  return Boolean(settings && settings.event_subscriptions && settings.interactivity);
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {boolean}
+ */
+function hasRequiredManifestParts(manifest) {
+  return Boolean(
+    hasDisplayParts(manifest && manifest.display_information) &&
+      hasFeatureParts(manifest && manifest.features) &&
+      hasSettingsParts(manifest && manifest.settings)
+  );
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {void}
+ */
+function assertLocalManifest(manifest) {
+  if (!hasRequiredManifestParts(manifest)) {
+    throw slackProvisioningError(
+      'Generated Slack manifest is missing required display, long_description (min 175 characters), bot, events, interactivity, or slash commands.',
+      'MANIFEST'
+    );
+  }
+  if (manifest.settings && manifest.settings.socket_mode_enabled === true) {
+    throw slackProvisioningError('Slack Socket Mode must stay disabled for this channel.', 'MANIFEST');
+  }
+}
+
+module.exports = {
+  parseGeneratedManifest,
+  assertLocalManifest
+};

package/lib/channels/slack-provisioning/oauth-lock.js

@@ -0,0 +1,33 @@
+/**
+ * Keep Slack OAuth fields Slack will not let us turn off.
+ *
+ * @fileoverview Token rotation cannot be disabled after it was enabled.
+ * Never copy remote OAuth redirect URLs — Slack HMAC does not use a callback.
+ */
+
+'use strict';
+
+/**
+ * @param {Object} manifest
+ * @param {Object|null} remote
+ * @returns {Object}
+ */
+function preserveSlackOAuthLocks(manifest, remote) {
+  if (!manifest || typeof manifest !== 'object') {
+    return manifest;
+  }
+  const next = {
+    ...manifest,
+    settings: { ...(manifest.settings || {}) },
+    oauth_config: { ...(manifest.oauth_config || {}) }
+  };
+  if (remote && remote.settings && remote.settings.token_rotation_enabled === true) {
+    next.settings.token_rotation_enabled = true;
+  }
+  next.oauth_config.redirect_urls = [];
+  return next;
+}
+
+module.exports = {
+  preserveSlackOAuthLocks
+};