@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/slack-provisioning/offer-cli.js

@@ -0,0 +1,113 @@
+/**
+ * Offer to install Slack CLI and sign in during channel add.
+ *
+ * @fileoverview Interactive TTY only — CI / JSON keep remaining steps
+ */
+
+'use strict';
+
+const inquirer = require('inquirer');
+const { isChannelAddInteractive } = require('../channel-add-wizard');
+const { shouldSkipLiveSlackCli, resolveSlackBinary } = require('./cli');
+const {
+  isSlackCliInstallerSupported,
+  installOfficialSlackCli,
+  runSlackLogin
+} = require('./install-cli');
+const { slackProvisioningError } = require('./errors');
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipCliOffer(deps = {}) {
+  if (typeof deps.confirm === 'function') {
+    return false;
+  }
+  if (typeof deps.slackApi === 'function') {
+    return true;
+  }
+  return shouldSkipLiveSlackCli(deps);
+}
+
+/**
+ * @param {Object} [options]
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function canOfferSlackCliInstall(options = {}, deps = {}) {
+  if (typeof deps.confirm === 'function') {
+    return true;
+  }
+  if (!isSlackCliInstallerSupported()) {
+    return false;
+  }
+  return isChannelAddInteractive(options);
+}
+
+/**
+ * @param {string} message
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function confirmYesNo(message, deps = {}) {
+  if (typeof deps.confirm === 'function') {
+    return deps.confirm(message);
+  }
+  const answers = await inquirer.prompt([
+    {
+      type: 'confirm',
+      name: 'ok',
+      message,
+      default: true
+    }
+  ]);
+  return answers.ok === true;
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function offerInstallAndLogin(deps = {}) {
+  const accepted = await confirmYesNo('Install Slack CLI now?', deps);
+  if (!accepted) {
+    throw slackProvisioningError('Slack CLI install declined.', 'SLACK_CLI_MISSING');
+  }
+  await installOfficialSlackCli(deps);
+  const signIn = await confirmYesNo('Sign in to Slack now?', deps);
+  if (signIn) {
+    await runSlackLogin(deps);
+  }
+}
+
+/**
+ * Prompt + install Slack CLI when missing, then continue channel add.
+ * @param {Object} [options]
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function ensureSlackCliReady(options = {}, deps = {}) {
+  if (shouldSkipCliOffer(deps)) {
+    return;
+  }
+  const existing = await resolveSlackBinary(deps);
+  if (existing) {
+    return;
+  }
+  if (!canOfferSlackCliInstall(options, deps)) {
+    throw slackProvisioningError(
+      'Slack CLI (`slack`) is not installed or not on PATH.',
+      'SLACK_CLI_MISSING'
+    );
+  }
+  await offerInstallAndLogin(deps);
+}
+
+module.exports = {
+  shouldSkipCliOffer,
+  canOfferSlackCliInstall,
+  confirmYesNo,
+  offerInstallAndLogin,
+  ensureSlackCliReady
+};

package/lib/channels/slack-provisioning/onboard-members.js

@@ -0,0 +1,122 @@
+/**
+ * Slack workspace member list + email-join helpers for channel onboard.
+ *
+ * @fileoverview Skip bots; never print emails or Slack user ids on TTY
+ */
+
+'use strict';
+
+const { listUsers } = require('../../api/users.api');
+const { extractUserListItems } = require('../../identity/resolve-user-id');
+const { runSlackApi } = require('./cli');
+const { slackProvisioningError } = require('./errors');
+
+/**
+ * @param {Object} member
+ * @returns {'skip'|'unmatched'|'candidate'}
+ */
+function classifySlackMember(member) {
+  if (!member || member.deleted === true) {
+    return 'skip';
+  }
+  if (member.is_bot === true || member.is_app_user === true || member.id === 'USLACKBOT') {
+    return 'skip';
+  }
+  if (typeof member.id !== 'string' || !member.id.trim()) {
+    return 'skip';
+  }
+  const email = member.profile && String(member.profile.email || '').trim();
+  if (!email || !email.includes('@')) {
+    return 'unmatched';
+  }
+  return 'candidate';
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<Object[]>}
+ */
+async function listSlackWorkspaceMembers(deps = {}) {
+  const members = [];
+  let cursor = '';
+  for (let page = 0; page < 50; page += 1) {
+    const payload = { limit: 200 };
+    if (cursor) {
+      payload.cursor = cursor;
+    }
+    const body = await runSlackApi('users.list', payload, deps);
+    if (!body || body.ok !== true) {
+      throw slackProvisioningError('Slack users.list failed.', 'SLACK_API');
+    }
+    members.push(...(Array.isArray(body.members) ? body.members : []));
+    cursor = (body.response_metadata && body.response_metadata.next_cursor) || '';
+    if (!cursor) {
+      break;
+    }
+  }
+  return members;
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} email
+ * @returns {Promise<Object|null>}
+ */
+async function lookupUniqueUserByEmail(controllerUrl, authConfig, email) {
+  const value = String(email || '').trim();
+  if (!value) {
+    return null;
+  }
+  const listed = await listUsers(controllerUrl, authConfig, {
+    filter: `email:eq:${value}`,
+    pageSize: 2,
+    page: 1
+  });
+  if (!listed || listed.success === false) {
+    return null;
+  }
+  const lower = value.toLowerCase();
+  const matches = extractUserListItems(listed).filter(
+    (user) => String(user.email || '').toLowerCase() === lower && user.id
+  );
+  return matches.length === 1 ? matches[0] : null;
+}
+
+/**
+ * @async
+ * @param {Object[]} members
+ * @param {{ controllerUrl: string, authConfig: Object }} ctx
+ * @param {Object} [deps]
+ * @returns {Promise<{ items: Object[], unmatched: number }>}
+ */
+async function matchSlackMembersToUsers(members, ctx, deps = {}) {
+  const lookup = deps.lookupUniqueUserByEmail || lookupUniqueUserByEmail;
+  const items = [];
+  let unmatched = 0;
+  for (const member of members || []) {
+    const kind = classifySlackMember(member);
+    if (kind === 'skip') {
+      continue;
+    }
+    if (kind !== 'candidate') {
+      unmatched += 1;
+      continue;
+    }
+    const user = await lookup(ctx.controllerUrl, ctx.authConfig, member.profile.email.trim());
+    if (user && user.id) {
+      items.push({ externalUserId: member.id, platformUserId: user.id });
+    } else {
+      unmatched += 1;
+    }
+  }
+  return { items, unmatched };
+}
+
+module.exports = {
+  classifySlackMember,
+  listSlackWorkspaceMembers,
+  lookupUniqueUserByEmail,
+  matchSlackMembersToUsers
+};

package/lib/channels/slack-provisioning/onboard.js

@@ -0,0 +1,89 @@
+/**
+ * Optional Slack user onboard after channel add (email join).
+ *
+ * @fileoverview One yes/no question; no member dump on default TTY
+ */
+
+'use strict';
+
+const { isChannelAddInteractive } = require('../channel-add-wizard');
+const { upsertChannelIdentityMappings } = require('../../api/channel-identity.api');
+const { confirmYesNo } = require('./offer-cli');
+const { listSlackWorkspaceMembers, matchSlackMembersToUsers } = require('./onboard-members');
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldSkipOnboard(options = {}) {
+  if (options.dryRun === true) {
+    return true;
+  }
+  if (options.onboardUsers === false) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * @param {Object} [options]
+ * @param {Object} [deps]
+ * @returns {Promise<boolean>}
+ */
+async function shouldOnboardUsers(options = {}, deps = {}) {
+  if (shouldSkipOnboard(options)) {
+    return false;
+  }
+  if (options.onboardUsers === true) {
+    return true;
+  }
+  if (!isChannelAddInteractive(options)) {
+    return false;
+  }
+  return confirmYesNo('Onboard users?', deps);
+}
+
+/**
+ * @param {number} unmatched
+ * @returns {string|null}
+ */
+function unmatchedRemainingStep(unmatched) {
+  const count = Number(unmatched) || 0;
+  if (count <= 0) {
+    return null;
+  }
+  return `${count} Slack users still use Link account (no email match)`;
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ ran: boolean, linked: number, unmatched: number }>}
+ */
+async function maybeOnboardSlackUsers(params = {}, deps = {}) {
+  const options = params.options || {};
+  const ctx = params.ctx || {};
+  if (ctx.slackConnected !== true && options.onboardUsers !== true) {
+    return { ran: false, linked: 0, unmatched: 0 };
+  }
+  if (!(await shouldOnboardUsers(options, deps))) {
+    return { ran: false, linked: 0, unmatched: 0 };
+  }
+  const members = await listSlackWorkspaceMembers(deps);
+  const matched = await matchSlackMembersToUsers(members, ctx, deps);
+  if (matched.items.length > 0) {
+    const upsert = deps.upsertChannelIdentityMappings || upsertChannelIdentityMappings;
+    await upsert(ctx.dataplaneUrl, ctx.authConfig, {
+      sourceChannel: 'slack',
+      items: matched.items
+    });
+  }
+  return { ran: true, linked: matched.items.length, unmatched: matched.unmatched };
+}
+
+module.exports = {
+  shouldSkipOnboard,
+  shouldOnboardUsers,
+  unmatchedRemainingStep,
+  maybeOnboardSlackUsers
+};

package/lib/channels/slack-provisioning/persist.js

@@ -0,0 +1,95 @@
+/**
+ * Persist non-secret Slack app / workspace IDs only.
+ *
+ * @fileoverview Never store bot tokens or signing secrets
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../../internal/fs-real-sync');
+const { STATE_FILE, STATE_KIND, SECRET_KEY_RE } = require('./constants');
+const { slackProvisioningError } = require('./errors');
+
+/**
+ * @param {string} projectRoot
+ * @returns {string}
+ */
+function provisioningStatePath(projectRoot) {
+  const root = projectRoot || process.cwd();
+  return path.join(root, 'dist', 'channels', 'slack', STATE_FILE);
+}
+
+/**
+ * @param {Object} record
+ * @returns {void}
+ */
+function assertNoSecrets(record) {
+  const keys = record && typeof record === 'object' ? Object.keys(record) : [];
+  const hit = keys.find((key) => SECRET_KEY_RE.test(key));
+  if (hit) {
+    throw slackProvisioningError(`Refusing to persist Slack secret field "${hit}".`, 'SECRET');
+  }
+  const blob = JSON.stringify(record || {});
+  if (/xox[baprs]-/i.test(blob)) {
+    throw slackProvisioningError('Refusing to persist a Slack token value.', 'SECRET');
+  }
+}
+
+/**
+ * @param {string} projectRoot
+ * @returns {Object|null}
+ */
+function readProvisioningState(projectRoot) {
+  const filePath = provisioningStatePath(projectRoot);
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!parsed || parsed.kind !== STATE_KIND) {
+      return null;
+    }
+    assertNoSecrets(parsed);
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {Object|null} state
+ * @returns {boolean}
+ */
+function hasProvenAppIdentity(state) {
+  return Boolean(state && typeof state.appId === 'string' && state.appId.trim());
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {Object} state
+ * @returns {void}
+ */
+function writeProvisioningState(projectRoot, state) {
+  const record = {
+    kind: STATE_KIND,
+    environment: state.environment,
+    appId: state.appId,
+    clientId: state.clientId || null,
+    teamId: state.teamId || null,
+    botId: state.botId || null,
+    secretsStored: state.secretsStored === true
+  };
+  assertNoSecrets(record);
+  const filePath = provisioningStatePath(projectRoot);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+}
+
+module.exports = {
+  provisioningStatePath,
+  readProvisioningState,
+  writeProvisioningState,
+  hasProvenAppIdentity,
+  assertNoSecrets
+};

package/lib/channels/slack-provisioning/remaining-urls.js

@@ -0,0 +1,158 @@
+/**
+ * Slack post-create consent URLs (app, Install App, workspace approve).
+ *
+ * @fileoverview App id and team id are public; never include client_secret
+ */
+
+'use strict';
+
+/**
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function slackAppRootUrl(appId) {
+  if (typeof appId !== 'string' || !appId.trim()) {
+    return '';
+  }
+  return `https://api.slack.com/apps/${encodeURIComponent(appId.trim())}`;
+}
+
+/**
+ * @param {string} [appId]
+ * @param {string} page
+ * @returns {string}
+ */
+function slackAppPageUrl(appId, page) {
+  const root = slackAppRootUrl(appId);
+  if (!root || typeof page !== 'string' || !page.trim()) {
+    return root;
+  }
+  return `${root}/${page}`;
+}
+
+/**
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function slackAppGeneralUrl(appId) {
+  return slackAppPageUrl(appId, 'general');
+}
+
+/**
+ * Workspace install URL that actually adds the app (`/install-on-team`).
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function slackAppInstallOnTeamUrl(appId) {
+  return slackAppPageUrl(appId, 'install-on-team');
+}
+
+/**
+ * Slack workspace admin approval for this app.
+ * @param {string} [teamId]
+ * @param {string} [appId]
+ * @returns {string}
+ */
+function buildSlackWorkspaceApproveUrl(teamId, appId) {
+  if (typeof teamId !== 'string' || !teamId.trim()) {
+    return '';
+  }
+  if (typeof appId !== 'string' || !appId.trim()) {
+    return '';
+  }
+  const team = encodeURIComponent(teamId.trim());
+  const app = encodeURIComponent(appId.trim());
+  return `https://app.slack.com/apps-manage/${team}/integrations/profile/${app}/permissions`;
+}
+
+/**
+ * @param {string} [url]
+ * @returns {string}
+ */
+function clientIdFromAuthorizeUrl(url) {
+  if (typeof url !== 'string' || !url.includes('client_id=')) {
+    return '';
+  }
+  try {
+    return String(new URL(url).searchParams.get('client_id') || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {Object} [captured]
+ * @returns {string}
+ */
+function pickSlackClientId(captured) {
+  const credentials = (captured && captured.credentials) || {};
+  const nested = captured && captured.data && typeof captured.data === 'object' ? captured.data : {};
+  const candidates = [
+    captured && captured.clientId,
+    captured && captured.client_id,
+    credentials.clientId,
+    credentials.client_id,
+    nested.clientId,
+    nested.client_id
+  ];
+  const direct = candidates.find((value) => typeof value === 'string' && value.trim());
+  if (direct) {
+    return String(direct).trim();
+  }
+  return clientIdFromAuthorizeUrl(
+    (captured && captured.oauth_authorize_url) || credentials.oauth_authorize_url
+  );
+}
+
+/**
+ * @param {Object} [captured]
+ * @returns {string}
+ */
+function pickSlackTeamId(captured) {
+  const credentials = (captured && captured.credentials) || {};
+  const candidates = [
+    captured && captured.teamId,
+    captured && captured.team_id,
+    credentials.teamId,
+    credentials.team_id
+  ];
+  const hit = candidates.find((value) => typeof value === 'string' && value.trim());
+  return hit ? String(hit).trim() : '';
+}
+
+/**
+ * @param {Object} [captured]
+ * @returns {{ slackAppSettingsUrl: string, slackInstallAppUrl: string,
+ *   slackWorkspaceApproveUrl: string }}
+ */
+function slackConsentUrls(captured) {
+  const appId = captured && captured.appId;
+  return {
+    slackAppSettingsUrl: slackAppRootUrl(appId),
+    slackInstallAppUrl: slackAppInstallOnTeamUrl(appId),
+    slackWorkspaceApproveUrl: buildSlackWorkspaceApproveUrl(pickSlackTeamId(captured), appId)
+  };
+}
+
+/**
+ * @param {{ storedSigningSecret?: boolean }} [stored]
+ * @returns {string[]}
+ */
+function slackConsentRemaining(stored) {
+  const steps = ['Upload your logo (Basic Information)', 'Activate the application'];
+  if (!stored || stored.storedSigningSecret !== true) {
+    steps.push('Store the signing secret in Authentication (Slack cannot re-read it after create)');
+  }
+  return steps;
+}
+
+module.exports = {
+  slackAppRootUrl,
+  slackAppGeneralUrl,
+  slackAppInstallOnTeamUrl,
+  buildSlackWorkspaceApproveUrl,
+  pickSlackClientId,
+  pickSlackTeamId,
+  slackConsentUrls,
+  slackConsentRemaining
+};

package/lib/channels/slack-provisioning/with-curl-on-path.js

@@ -0,0 +1,53 @@
+/**
+ * Ensure `curl` is on PATH for Slack CLI install.sh (Node shim when missing).
+ */
+
+'use strict';
+
+const { execFile } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { promisify } = require('util');
+
+const execFileAsync = promisify(execFile);
+
+async function curlExists(env) {
+  try {
+    await execFileAsync('curl', ['--version'], { env, timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function writeCurlShim(dir) {
+  const source = path.join(__dirname, 'curl-shim.js');
+  if (!fs.existsSync(source)) {
+    throw new Error(`Slack CLI curl shim missing: ${source}`);
+  }
+  const runtime = path.join(dir, 'curl-shim.js');
+  fs.copyFileSync(source, runtime);
+  const wrapper = `#!/bin/sh\nexec "${process.execPath}" "${runtime}" "$@"\n`;
+  fs.writeFileSync(path.join(dir, 'curl'), wrapper, { mode: 0o755 });
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @param {{ curlExists?: Function }} [deps]
+ * @returns {Promise<NodeJS.ProcessEnv>}
+ */
+async function withCurlOnPath(env = process.env, deps = {}) {
+  const exists = deps.curlExists || curlExists;
+  if (await exists(env)) {
+    return env;
+  }
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'aifabrix-curl-'));
+  writeCurlShim(dir);
+  return {
+    ...env,
+    PATH: `${dir}${path.delimiter}${env.PATH || ''}`
+  };
+}
+
+module.exports = { curlExists, withCurlOnPath };