@inkeep/agents-work-apps 0.47.5 → 0.48.1

package/dist/slack/routes/users.js

@@ -0,0 +1,365 @@
+import { getLogger } from "../../logger.js";
+import runDbClient_default from "../../db/runDbClient.js";
+import { createConnectSession } from "../services/nango.js";
+import "../services/index.js";
+import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { createWorkAppSlackUserMapping, deleteWorkAppSlackUserMapping, findWorkAppSlackUserMapping, findWorkAppSlackUserMappingByInkeepUserId, verifySlackLinkToken } from "@inkeep/agents-core";
+
+//#region src/slack/routes/users.ts
+/**
+* Slack User Routes
+*
+* Endpoints for user linking:
+* - GET /link-status - Check link status
+* - POST /link/verify-token - Verify JWT link token (primary linking method)
+* - POST /connect - Create Nango session
+* - POST /disconnect - Disconnect user
+*/
+const logger = getLogger("slack-users");
+/**
+* Verify the authenticated caller matches the requested userId.
+* System tokens and API keys are allowed to act on behalf of any user.
+*/
+function isAuthorizedForUser(c, requestedUserId) {
+	const sessionUserId = c.get("userId");
+	if (!sessionUserId) return false;
+	if (sessionUserId === requestedUserId) return true;
+	if (sessionUserId === "system" || sessionUserId.startsWith("apikey:")) return true;
+	if (sessionUserId === "dev-user" && (process.env.ENVIRONMENT === "development" || process.env.ENVIRONMENT === "test")) return true;
+	return false;
+}
+const app = new OpenAPIHono();
+app.openapi(createRoute({
+	method: "get",
+	path: "/link-status",
+	summary: "Check Link Status",
+	description: "Check if a Slack user is linked to an Inkeep account",
+	operationId: "slack-link-status",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Users"
+	],
+	request: { query: z.object({
+		slackUserId: z.string(),
+		slackTeamId: z.string(),
+		tenantId: z.string().optional().default("default")
+	}) },
+	responses: { 200: {
+		description: "Link status",
+		content: { "application/json": { schema: z.object({
+			linked: z.boolean(),
+			linkId: z.string().optional(),
+			linkedAt: z.string().optional(),
+			slackUsername: z.string().optional()
+		}) } }
+	} }
+}), async (c) => {
+	const { slackUserId, slackTeamId, tenantId } = c.req.valid("query");
+	const sessionTenantId = c.get("tenantId");
+	if (sessionTenantId && sessionTenantId !== tenantId) return c.json({ linked: false });
+	const link = await findWorkAppSlackUserMapping(runDbClient_default)(tenantId, slackUserId, slackTeamId, "work-apps-slack");
+	if (link) return c.json({
+		linked: true,
+		linkId: link.id,
+		linkedAt: link.linkedAt,
+		slackUsername: link.slackUsername || void 0
+	});
+	return c.json({ linked: false });
+});
+app.openapi(createRoute({
+	method: "post",
+	path: "/link/verify-token",
+	summary: "Verify Link Token",
+	description: "Verify a JWT link token and create user mapping",
+	operationId: "slack-verify-link-token",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Users"
+	],
+	request: { body: { content: { "application/json": { schema: z.object({
+		token: z.string().min(1),
+		userId: z.string().min(1),
+		userEmail: z.string().email().optional()
+	}) } } } },
+	responses: {
+		200: {
+			description: "Link successful",
+			content: { "application/json": { schema: z.object({
+				success: z.boolean(),
+				linkId: z.string().optional(),
+				slackUsername: z.string().optional(),
+				slackTeamId: z.string().optional(),
+				tenantId: z.string().optional()
+			}) } }
+		},
+		400: { description: "Invalid or expired token" },
+		409: { description: "Account already linked" }
+	}
+}), async (c) => {
+	const body = c.req.valid("json");
+	try {
+		const verifyResult = await verifySlackLinkToken(body.token);
+		if (!verifyResult.valid || !verifyResult.payload) {
+			logger.warn({ error: verifyResult.error }, "Invalid link token");
+			return c.json({ error: verifyResult.error || "Invalid or expired link token. Please run /inkeep link in Slack to get a new one." }, 400);
+		}
+		const { tenantId, slack } = verifyResult.payload;
+		const { teamId, userId: slackUserId, enterpriseId, username } = slack;
+		const sessionUserId = c.get("userId");
+		if (!(sessionUserId && sessionUserId !== "dev-user" && !sessionUserId.startsWith("apikey:") && sessionUserId !== "system")) {
+			logger.warn({ sessionUserId }, "Link token verification rejected: no valid session user");
+			return c.json({ error: "Session authentication required for account linking" }, 403);
+		}
+		const inkeepUserId = sessionUserId;
+		const existingLink = await findWorkAppSlackUserMapping(runDbClient_default)(tenantId, slackUserId, teamId, "work-apps-slack");
+		if (existingLink && existingLink.inkeepUserId === inkeepUserId) {
+			logger.info({
+				slackUserId,
+				tenantId,
+				inkeepUserId: body.userId
+			}, "Slack user already linked to same account");
+			return c.json({
+				success: true,
+				linkId: existingLink.id,
+				slackUsername: existingLink.slackUsername || void 0,
+				slackTeamId: teamId,
+				tenantId
+			});
+		}
+		if (existingLink) logger.info({
+			slackUserId,
+			existingUserId: existingLink.inkeepUserId,
+			newUserId: inkeepUserId,
+			tenantId
+		}, "Slack user already linked, updating to new user");
+		const slackUserMapping = await createWorkAppSlackUserMapping(runDbClient_default)({
+			tenantId,
+			clientId: "work-apps-slack",
+			slackUserId,
+			slackTeamId: teamId,
+			slackEnterpriseId: enterpriseId,
+			slackUsername: username,
+			slackEmail: body.userEmail,
+			inkeepUserId
+		});
+		logger.info({
+			slackUserId,
+			slackTeamId: teamId,
+			tenantId,
+			inkeepUserId: body.userId,
+			linkId: slackUserMapping.id
+		}, "Successfully linked Slack user to Inkeep account via JWT token");
+		return c.json({
+			success: true,
+			linkId: slackUserMapping.id,
+			slackUsername: username || void 0,
+			slackTeamId: teamId,
+			tenantId
+		});
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : String(error);
+		if (errorMessage.includes("duplicate key") || errorMessage.includes("unique constraint")) {
+			logger.warn({ userId: body.userId }, "Slack user already linked");
+			return c.json({ error: "This Slack account is already linked to an Inkeep account." }, 409);
+		}
+		logger.error({
+			error,
+			userId: body.userId
+		}, "Failed to verify link token");
+		return c.json({ error: "Failed to verify link. Please try again." }, 500);
+	}
+});
+app.openapi(createRoute({
+	method: "post",
+	path: "/connect",
+	summary: "Create Nango Connect Session",
+	description: "Create a Nango session for Slack OAuth flow. Used by the dashboard.",
+	operationId: "slack-user-connect",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Users"
+	],
+	request: { body: { content: { "application/json": { schema: z.object({
+		userId: z.string().describe("Inkeep user ID"),
+		userEmail: z.string().optional().describe("User email"),
+		userName: z.string().optional().describe("User display name"),
+		tenantId: z.string().optional().describe("Tenant ID")
+	}) } } } },
+	responses: {
+		200: {
+			description: "Connect session created",
+			content: { "application/json": { schema: z.object({
+				sessionToken: z.string().optional(),
+				connectUrl: z.string().optional()
+			}) } }
+		},
+		400: { description: "Missing required userId" },
+		500: { description: "Failed to create session" }
+	}
+}), async (c) => {
+	const { userId, userEmail, userName, tenantId } = c.req.valid("json");
+	if (!userId) return c.json({ error: "userId is required" }, 400);
+	if (!isAuthorizedForUser(c, userId)) return c.json({ error: "Can only create sessions for your own account" }, 403);
+	logger.debug({
+		userId,
+		userEmail,
+		userName
+	}, "Creating Nango connect session");
+	const session = await createConnectSession({
+		userId,
+		userEmail,
+		userName,
+		tenantId: tenantId || c.get("tenantId") || ""
+	});
+	if (!session) return c.json({ error: "Failed to create session" }, 500);
+	return c.json(session);
+});
+app.openapi(createRoute({
+	method: "post",
+	path: "/disconnect",
+	summary: "Disconnect User",
+	description: "Unlink a Slack user from their Inkeep account.",
+	operationId: "slack-user-disconnect",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Users"
+	],
+	request: { body: { content: { "application/json": { schema: z.object({
+		userId: z.string().optional().describe("Inkeep user ID"),
+		slackUserId: z.string().optional().describe("Slack user ID"),
+		slackTeamId: z.string().optional().describe("Slack team ID"),
+		tenantId: z.string().optional().describe("Tenant ID")
+	}) } } } },
+	responses: {
+		200: {
+			description: "User disconnected",
+			content: { "application/json": { schema: z.object({ success: z.boolean() }) } }
+		},
+		400: { description: "Missing required identifiers" },
+		404: { description: "No connection found" },
+		500: { description: "Failed to disconnect" }
+	}
+}), async (c) => {
+	const { userId, slackUserId, slackTeamId, tenantId } = c.req.valid("json");
+	if (!userId && !(slackUserId && slackTeamId)) return c.json({ error: "Either userId or (slackUserId + slackTeamId) is required" }, 400);
+	if (userId && !isAuthorizedForUser(c, userId)) return c.json({ error: "Can only disconnect your own account" }, 403);
+	try {
+		const effectiveTenantId = tenantId || c.get("tenantId") || "";
+		if (slackUserId && slackTeamId) {
+			const mapping = await findWorkAppSlackUserMapping(runDbClient_default)(effectiveTenantId, slackUserId, slackTeamId, "work-apps-slack");
+			if (!mapping) return c.json({ error: "No link found for this user" }, 404);
+			if (!isAuthorizedForUser(c, mapping.inkeepUserId)) return c.json({ error: "Can only disconnect your own account" }, 403);
+			if (await deleteWorkAppSlackUserMapping(runDbClient_default)(effectiveTenantId, slackUserId, slackTeamId, "work-apps-slack")) {
+				logger.info({
+					slackUserId,
+					slackTeamId,
+					tenantId: effectiveTenantId
+				}, "User unlinked");
+				return c.json({ success: true });
+			}
+			return c.json({ error: "Failed to unlink user" }, 500);
+		}
+		if (userId) {
+			const userMappings = await findWorkAppSlackUserMappingByInkeepUserId(runDbClient_default)(userId);
+			if (userMappings.length === 0) return c.json({ error: "No link found for this user" }, 404);
+			let deletedCount = 0;
+			for (const mapping of userMappings) if (await deleteWorkAppSlackUserMapping(runDbClient_default)(mapping.tenantId, mapping.slackUserId, mapping.slackTeamId, "work-apps-slack")) deletedCount++;
+			logger.info({
+				userId,
+				deletedCount
+			}, "User disconnected from Slack");
+			return c.json({ success: true });
+		}
+		return c.json({ error: "No connection found for this user" }, 404);
+	} catch (error) {
+		logger.error({
+			error,
+			userId,
+			slackUserId,
+			slackTeamId
+		}, "Failed to disconnect from Slack");
+		return c.json({ error: "Failed to disconnect" }, 500);
+	}
+});
+app.openapi(createRoute({
+	method: "get",
+	path: "/status",
+	summary: "Get Connection Status",
+	description: "Check if an Inkeep user has a linked Slack account.",
+	operationId: "slack-user-status",
+	tags: [
+		"Work Apps",
+		"Slack",
+		"Users"
+	],
+	request: { query: z.object({ userId: z.string().describe("Inkeep user ID") }) },
+	responses: {
+		200: {
+			description: "Connection status",
+			content: { "application/json": { schema: z.object({
+				connected: z.boolean(),
+				connection: z.object({
+					connectionId: z.string(),
+					appUserId: z.string(),
+					appUserEmail: z.string(),
+					slackDisplayName: z.string(),
+					linkedAt: z.string(),
+					tenantId: z.string(),
+					slackUserId: z.string(),
+					slackTeamId: z.string()
+				}).nullable()
+			}) } }
+		},
+		400: { description: "Missing userId" },
+		500: { description: "Failed to get status" }
+	}
+}), async (c) => {
+	const { userId: appUserId } = c.req.valid("query");
+	if (!isAuthorizedForUser(c, appUserId)) return c.json({ error: "Can only query your own connection status" }, 403);
+	try {
+		const userMappings = await findWorkAppSlackUserMappingByInkeepUserId(runDbClient_default)(appUserId);
+		if (userMappings.length === 0) {
+			logger.debug({
+				appUserId,
+				connected: false
+			}, "Retrieved connection status from DB");
+			return c.json({
+				connected: false,
+				connection: null
+			});
+		}
+		const mostRecent = userMappings.sort((a, b) => new Date(b.linkedAt).getTime() - new Date(a.linkedAt).getTime())[0];
+		const connection = {
+			connectionId: mostRecent.id,
+			appUserId: mostRecent.inkeepUserId,
+			appUserEmail: mostRecent.slackEmail || "",
+			slackDisplayName: mostRecent.slackUsername || "",
+			linkedAt: mostRecent.linkedAt,
+			tenantId: mostRecent.tenantId,
+			slackUserId: mostRecent.slackUserId,
+			slackTeamId: mostRecent.slackTeamId
+		};
+		logger.debug({
+			appUserId,
+			connected: true
+		}, "Retrieved connection status from DB");
+		return c.json({
+			connected: true,
+			connection
+		});
+	} catch (error) {
+		logger.error({
+			error,
+			appUserId
+		}, "Failed to get connection status");
+		return c.json({ error: "Failed to get connection status" }, 500);
+	}
+});
+var users_default = app;
+
+//#endregion
+export { users_default as default };

package/dist/slack/routes/workspaces.d.ts

@@ -0,0 +1,10 @@
+import { ManageAppVariables } from "../types.js";
+import { OpenAPIHono } from "@hono/zod-openapi";
+
+//#region src/slack/routes/workspaces.d.ts
+
+declare const app: OpenAPIHono<{
+  Variables: ManageAppVariables;
+}, {}, "/">;
+//#endregion
+export { app as default };