@eliya-oss/agent-slack 0.1.0

package/dist/adapters/localhost-oauth/NodeLocalhostOAuthFlow.js

@@ -0,0 +1,160 @@
+import { randomBytes } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { PermissionDenied, SlackApiFailed, UsageError } from "../../domain/errors.js";
+import { ProfileName, Scope } from "../../domain/ids.js";
+export class NodeLocalhostOAuthFlow {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    static fromEnv(env = process.env) {
+        const apiBaseUrl = env.SLK_SLACK_API_BASE_URL;
+        const emulatorBaseUrl = apiBaseUrl?.replace(/\/api\/?$/, "");
+        return new NodeLocalhostOAuthFlow({
+            authorizeUrl: env.SLK_SLACK_OAUTH_AUTHORIZE_URL ?? (emulatorBaseUrl === undefined ? "https://slack.com/oauth/v2/authorize" : `${emulatorBaseUrl}/oauth/v2/authorize`),
+            tokenUrl: env.SLK_SLACK_OAUTH_ACCESS_URL ?? (apiBaseUrl === undefined ? "https://slack.com/api/oauth.v2.access" : `${apiBaseUrl.replace(/\/?$/, "/")}oauth.v2.access`),
+            ...(env.SLK_OAUTH_REDIRECT_HOST === undefined ? {} : { defaultRedirectHost: env.SLK_OAUTH_REDIRECT_HOST }),
+            ...(env.SLK_OAUTH_REDIRECT_PATH === undefined ? {} : { defaultRedirectPath: env.SLK_OAUTH_REDIRECT_PATH }),
+            ...(env.SLK_OAUTH_TIMEOUT_MS === undefined ? {} : { defaultTimeoutMs: Number(env.SLK_OAUTH_TIMEOUT_MS) })
+        });
+    }
+    async login(input) {
+        const state = randomBytes(24).toString("base64url");
+        const timeoutMs = input.timeoutMs ?? this.options.defaultTimeoutMs ?? 120_000;
+        const server = createServer();
+        const started = await listen(server, input.redirectUri, {
+            host: this.options.defaultRedirectHost ?? "127.0.0.1",
+            path: this.options.defaultRedirectPath ?? "/oauth/slack/callback"
+        });
+        const authorizationUrl = buildAuthorizationUrl({
+            authorizeUrl: this.options.authorizeUrl,
+            clientId: input.clientId,
+            redirectUri: started.redirectUri,
+            scopes: input.scopes,
+            userScopes: input.userScopes,
+            state
+        });
+        if (input.authUrlOut !== undefined) {
+            await writeFile(input.authUrlOut, authorizationUrl, "utf8");
+        }
+        else {
+            process.stderr.write(`Open this Slack OAuth URL:\n${authorizationUrl}\n`);
+        }
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                closeServer(server);
+                reject(new UsageError("Timed out waiting for Slack OAuth callback", { timeoutMs }));
+            }, timeoutMs);
+            server.on("request", async (request, response) => {
+                try {
+                    const requestUrl = new URL(request.url ?? "/", started.redirectUri);
+                    if (requestUrl.pathname !== started.path) {
+                        response.writeHead(404).end("Not found");
+                        return;
+                    }
+                    if (requestUrl.searchParams.get("state") !== state) {
+                        throw new PermissionDenied("Slack OAuth state mismatch");
+                    }
+                    const code = requestUrl.searchParams.get("code");
+                    const oauthError = requestUrl.searchParams.get("error");
+                    if (oauthError !== null) {
+                        throw new PermissionDenied(`Slack OAuth failed: ${oauthError}`, { slackError: oauthError });
+                    }
+                    if (code === null || code === "") {
+                        throw new UsageError("Slack OAuth callback did not include a code");
+                    }
+                    const access = await exchangeCode({
+                        tokenUrl: this.options.tokenUrl,
+                        code,
+                        clientId: input.clientId,
+                        clientSecret: input.clientSecret,
+                        redirectUri: started.redirectUri
+                    });
+                    const profile = toAuthProfile(input.profileName, access);
+                    response.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end("<html><body>Slack auth complete. You can close this tab.</body></html>");
+                    clearTimeout(timer);
+                    closeServer(server);
+                    resolve(profile);
+                }
+                catch (error) {
+                    response.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end(error instanceof Error ? error.message : String(error));
+                    clearTimeout(timer);
+                    closeServer(server);
+                    reject(error);
+                }
+            });
+        });
+    }
+}
+const listen = (server, redirectUri, fallback) => new Promise((resolve, reject) => {
+    const parsed = redirectUri === undefined ? null : new URL(redirectUri);
+    const host = parsed?.hostname ?? fallback.host;
+    const path = parsed?.pathname ?? fallback.path;
+    const port = parsed === null || parsed.port === "" ? 0 : Number(parsed.port);
+    if (!Number.isInteger(port) || port < 0) {
+        reject(new UsageError("OAuth redirect URI must include a valid port", { redirectUri }));
+        return;
+    }
+    server.once("error", reject);
+    server.listen(port, host, () => {
+        const address = server.address();
+        const actualPort = parsed === null || parsed.port === "" ? address.port : port;
+        resolve({
+            redirectUri: redirectUri ?? `http://${host}:${actualPort}${path}`,
+            path
+        });
+    });
+});
+const buildAuthorizationUrl = (input) => {
+    const url = new URL(input.authorizeUrl);
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("scope", input.scopes.join(","));
+    if (input.userScopes.length > 0) {
+        url.searchParams.set("user_scope", input.userScopes.join(","));
+    }
+    url.searchParams.set("redirect_uri", input.redirectUri);
+    url.searchParams.set("state", input.state);
+    return url.toString();
+};
+const exchangeCode = async (input) => {
+    const response = await fetch(input.tokenUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            code: input.code,
+            client_id: input.clientId,
+            client_secret: input.clientSecret,
+            redirect_uri: input.redirectUri
+        })
+    });
+    const body = await response.json();
+    if (body.ok === false) {
+        throw new PermissionDenied(`Slack OAuth token exchange failed: ${body.error ?? "unknown_error"}`, {
+            slackError: body.error ?? "unknown_error"
+        });
+    }
+    if (body.access_token === undefined && body.authed_user?.access_token === undefined) {
+        throw new SlackApiFailed("Slack OAuth token exchange did not return a token");
+    }
+    return body;
+};
+const toAuthProfile = (profileName, response) => {
+    const botScopes = splitScopes(response.scope);
+    const userScopes = splitScopes(response.authed_user?.scope);
+    return {
+        name: ProfileName.make(profileName),
+        tokenType: response.access_token === undefined ? "user" : "bot",
+        enterpriseId: response.enterprise?.id ?? null,
+        ...(response.team?.id === undefined ? {} : { teamId: response.team.id }),
+        ...(response.authed_user?.id === undefined ? {} : { userId: response.authed_user.id }),
+        ...(response.bot_user_id === undefined ? {} : { botId: response.bot_user_id }),
+        ...(response.access_token === undefined ? {} : { botToken: response.access_token }),
+        ...(response.authed_user?.access_token === undefined ? {} : { userToken: response.authed_user.access_token }),
+        scopes: [...new Set([...botScopes, ...userScopes])].map(Scope.make)
+    };
+};
+const splitScopes = (value) => value === undefined || value.trim() === "" ? [] : value.split(",").map((scope) => scope.trim()).filter(Boolean);
+const closeServer = (server) => {
+    server.close();
+};

package/dist/adapters/profile-file/FileTokenStore.js

@@ -0,0 +1,67 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { ProfileName, Scope } from "../../domain/ids.js";
+export class FileTokenStore {
+    filePath;
+    envProfile;
+    constructor(filePath, envProfile = null) {
+        this.filePath = filePath;
+        this.envProfile = envProfile;
+    }
+    static fromEnv(env = process.env) {
+        const configDir = env.SLK_CONFIG_DIR ?? join(env.HOME ?? process.cwd(), ".config", "slk");
+        const token = env.SLK_TOKEN ?? env.SLACK_BOT_TOKEN ?? null;
+        const envProfile = token === null
+            ? null
+            : {
+                name: ProfileName.default,
+                tokenType: "bot",
+                botToken: token,
+                scopes: (env.SLK_SCOPES ?? "").split(",").filter(Boolean).map(Scope.make)
+            };
+        return new FileTokenStore(join(configDir, "profiles.json"), envProfile);
+    }
+    async getProfile(name) {
+        const profiles = await this.readProfiles();
+        return profiles.find((profile) => profile.name === name) ?? (name === "default" ? this.envProfile : null);
+    }
+    async setProfile(profile) {
+        const profiles = await this.readProfiles();
+        const next = [profile, ...profiles.filter((item) => item.name !== profile.name)];
+        await this.writeProfiles(next);
+    }
+    async listProfiles() {
+        const profiles = await this.readProfiles();
+        return this.envProfile === null ? profiles : [this.envProfile, ...profiles.filter((item) => item.name !== this.envProfile?.name)];
+    }
+    async deleteProfile(name) {
+        const profiles = await this.readProfiles();
+        const next = profiles.filter((profile) => profile.name !== name);
+        if (next.length === profiles.length) {
+            return false;
+        }
+        if (next.length === 0) {
+            await rm(this.filePath, { force: true });
+            return true;
+        }
+        await this.writeProfiles(next);
+        return true;
+    }
+    async readProfiles() {
+        try {
+            const raw = await readFile(this.filePath, "utf8");
+            const parsed = JSON.parse(raw);
+            return parsed.profiles ?? [];
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return [];
+            }
+            throw error;
+        }
+    }
+    async writeProfiles(profiles) {
+        await mkdir(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        await writeFile(this.filePath, JSON.stringify({ profiles }, null, 2), { mode: 0o600 });
+    }
+}

package/dist/adapters/slack-sdk/SlackSdkWebApi.js

@@ -0,0 +1,48 @@
+import { WebClient } from "@slack/web-api";
+import { MissingScope, PermissionDenied, SlackApiFailed, SlackRateLimited } from "../../domain/errors.js";
+export class SlackSdkWebApi {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async call(input) {
+        const client = new WebClient(input.token, {
+            ...(this.options.slackApiUrl === undefined ? {} : { slackApiUrl: this.options.slackApiUrl }),
+            allowAbsoluteUrls: false
+        });
+        try {
+            const response = await client.apiCall(input.method, input.payload);
+            const record = response;
+            if (record.ok === false) {
+                throw slackError(input.method, record);
+            }
+            return { method: input.method, response: record };
+        }
+        catch (error) {
+            if (error instanceof SlackApiFailed || error instanceof MissingScope || error instanceof PermissionDenied || error instanceof SlackRateLimited) {
+                throw error;
+            }
+            const maybe = error;
+            if (maybe.code === "slack_webapi_rate_limited") {
+                throw new SlackRateLimited("Slack rate limit reached", maybe.retryAfter === undefined ? {} : { retryAfterSeconds: maybe.retryAfter });
+            }
+            if (maybe.code === "slack_webapi_platform_error" && maybe.data !== undefined) {
+                throw slackError(input.method, maybe.data);
+            }
+            throw new SlackApiFailed(`Slack method failed: ${input.method}`, { method: input.method, cause: error instanceof Error ? error.message : String(error) });
+        }
+    }
+}
+const slackError = (method, response) => {
+    const slackErrorText = typeof response.error === "string" ? response.error : "unknown_error";
+    if (slackErrorText === "missing_scope") {
+        throw new MissingScope("Slack method is missing required scope", { method, slackError: slackErrorText, response });
+    }
+    if (slackErrorText === "invalid_auth" || slackErrorText === "not_authed" || slackErrorText === "account_inactive") {
+        throw new PermissionDenied("Slack authentication failed", { method, slackError: slackErrorText });
+    }
+    if (slackErrorText === "ratelimited") {
+        throw new SlackRateLimited("Slack rate limit reached", { method, slackError: slackErrorText });
+    }
+    throw new SlackApiFailed(`Slack method returned ${slackErrorText}`, { method, slackError: slackErrorText, response });
+};

package/dist/application/auth.js

@@ -0,0 +1,35 @@
+import { NotAuthenticated, UnsafeMethodBlocked, UsageError } from "../domain/errors.js";
+export const getProfile = async (services, name) => {
+    const profile = await services.tokenStore.getProfile(name);
+    if (profile === null) {
+        throw new NotAuthenticated(`No auth profile named ${name}`, { profile: name });
+    }
+    return profile;
+};
+export const tokenFor = (profile, tokenType) => {
+    const token = tokenType === "user" ? profile.userToken :
+        tokenType === "admin" ? profile.adminToken :
+            tokenType === "app" ? profile.appToken :
+                profile.botToken ?? profile.userToken ?? profile.adminToken ?? profile.appToken;
+    if (token === undefined || token.length === 0) {
+        throw new NotAuthenticated(`Profile ${profile.name} does not have a ${tokenType} token`, {
+            profile: profile.name,
+            tokenType
+        });
+    }
+    return token;
+};
+export const parseTokenType = (value) => {
+    if (value === undefined) {
+        return "bot";
+    }
+    if (value === "user" || value === "bot" || value === "admin" || value === "app") {
+        return value;
+    }
+    throw new UsageError("Invalid token type", { tokenType: value });
+};
+export const requireYes = (input) => {
+    if (!input.yes) {
+        throw new UnsafeMethodBlocked(input.message);
+    }
+};