@maroonedsoftware/slack 1.8.2 → 1.9.0

package/README.md

@@ -25,6 +25,7 @@ pnpm add @maroonedsoftware/slack
 | `SlackInteractionHandlerMap`    | `Map<routingKey, SlackInteractionHandler>` — keys are `${type}:${identifier}`; see [interaction routing](#interaction-routing). |
 | `SlackError`                    | `ServerkitError` subclass for non-HTTP domain failures (signature mismatch, webhook POST failed, …).          |
 | `verifySlackSignature(input)`   | Pure helper that validates Slack's v0 HMAC scheme + replay window. No request/context coupling.               |
+| `SlackSignaturePolicy`          | `@maroonedsoftware/policies` form of `verifySlackSignature` (registered under `SLACK_SIGNATURE_POLICY`). Delegates to the helper but answers as a `PolicyResult`, so it slots into ServerKit's policy pipeline. |
 | `interactionRouteKey(payload)`  | Helper that produces the `SlackInteractionHandlerMap` key for a given payload.                                |
 
 ## Configuration
@@ -271,6 +272,29 @@ On any failure the helper throws `SlackError` with `internalDetails.reason` set
 
 For deterministic tests, pass `now` (Unix seconds) to override the clock.
 
+### As a policy
+
+`SlackSignaturePolicy` is the same rule wrapped as a `@maroonedsoftware/policies` policy, so signature verification slots into ServerKit's policy pipeline alongside session/MFA policies. It delegates to `verifySlackSignature` (one source of truth) but returns a `PolicyResult` instead of throwing — denying with the same `SlackSignatureFailureReason` as the denial `reason`, and anchoring the replay window to the evaluation's `envelope.now`.
+
+Register it in your `PolicyRegistryMap` and evaluate it via `PolicyService`:
+
+```ts
+import { SlackSignaturePolicy, SLACK_SIGNATURE_POLICY, SlackConfig } from '@maroonedsoftware/slack';
+
+// wiring
+registry.set(SLACK_SIGNATURE_POLICY, SlackSignaturePolicy);
+
+// in a route handler (ctx is a ServerKit Koa context)
+const result = await ctx.container.get(PolicyService).check(SLACK_SIGNATURE_POLICY, {
+  rawBody: ctx.rawBody,
+  getHeader: name => ctx.get(name),
+  options: ctx.container.get(SlackConfig),
+});
+if (isPolicyResultDenied(result)) throw httpError(401).withInternalDetails(result.internalDetails ?? {});
+```
+
+The context (`rawBody` + a case-insensitive `getHeader` + `options`) is structurally compatible with `@maroonedsoftware/koa`'s `SignaturePolicyContext<SlackSignatureOptions>`, so the koa `requireSignature` middleware can drive this policy when it's registered under the signature policy name — no koa dependency in this package.
+
 ## Limitations
 
 - v1 supports a single workspace via the bot token in `SlackConfig`. Multi-workspace OAuth install is out of scope.

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from './slack.config.js';
 export * from './slack.error.js';
 export * from './slack.signature.js';
+export * from './slack.signature.policy.js';
 export * from './slack.event.handler.js';
 export * from './slack.command.handler.js';
 export * from './slack.interaction.handler.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC"}