@nuvlore/extension-access-okta-slack 0.1.1

package/src/slackCanvasCreate.mjs

@@ -0,0 +1,165 @@
+import { loadSlackSession } from "./slackSessionRead.mjs";
+import { readTokenFromKeychain } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
+
+const CHANNEL_ID_PATTERN = /^[CG][A-Z0-9]+$/;
+const DEFAULT_KEYCHAIN_CANDIDATES = [
+  { service: "nuvlore", account: "nuvlore.slack_canvas" },
+  { service: "nuvlore", account: "nuvlore.slack" },
+  { service: "workday", account: "workday.slack_canvas" },
+  { service: "devops-tool", account: "devops-tool.slack_canvas" }
+];
+
+function resolveEnvCanvasToken(options = {}) {
+  const env = options.env ?? process.env;
+  return (
+    options.token ||
+    env.WORKDAY_SLACK_CANVAS_TOKEN ||
+    env.SLACK_CANVAS_TOKEN ||
+    env.WORKDAY_SLACK_BOT_TOKEN ||
+    env.SLACK_BOT_TOKEN ||
+    ""
+  );
+}
+
+function parseKeychainCandidates(options = {}) {
+  const env = options.env ?? process.env;
+  if (Array.isArray(options.keychainCandidates)) return options.keychainCandidates;
+  const service = options.keychainService || env.WORKDAY_SLACK_CANVAS_KEYCHAIN_SERVICE;
+  const account = options.keychainAccount || env.WORKDAY_SLACK_CANVAS_KEYCHAIN_ACCOUNT;
+  if (service && account) return [{ service, account }];
+  return DEFAULT_KEYCHAIN_CANDIDATES;
+}
+
+async function resolveCanvasToken(options = {}) {
+  const envToken = resolveEnvCanvasToken(options);
+  if (envToken) return { token: envToken, tokenSource: options.token ? "input" : "env" };
+
+  for (const candidate of parseKeychainCandidates(options)) {
+    try {
+      const token = await readTokenFromKeychain({
+        execFileImpl: options.execFileImpl,
+        keychainService: candidate.service,
+        keychainAccount: candidate.account
+      });
+      if (token) {
+        return {
+          token,
+          tokenSource: `keychain:${candidate.service}/${candidate.account}`
+        };
+      }
+    } catch {
+      // Try the next configured Keychain alias without exposing secret metadata in errors.
+    }
+  }
+
+  return { token: "", tokenSource: "" };
+}
+
+function normalizeCanvasInput(input = {}) {
+  const channelId = String(input.channelId ?? input.channel_id ?? "").trim();
+  const title = String(input.title ?? "").trim();
+  const content = String(input.content ?? input.markdown ?? "").trim();
+  const channelCanvas = input.channelCanvas ?? input.channel_canvas ?? true;
+
+  if (!channelId) throw new Error("Slack channelId is required.");
+  if (!CHANNEL_ID_PATTERN.test(channelId)) {
+    throw new Error("Slack channelId must be a channel conversation id such as C... or G...");
+  }
+  if (!title) throw new Error("Slack canvas title is required.");
+  if (!content) throw new Error("Slack canvas content is required.");
+  if (title.length > 255) throw new Error("Slack canvas title must be 255 characters or fewer.");
+
+  return {
+    channelId,
+    title,
+    content,
+    channelCanvas: Boolean(channelCanvas)
+  };
+}
+
+function canvasLink(baseUrl, canvasId) {
+  return `${baseUrl}/canvas/${canvasId}`;
+}
+
+async function postSlackCanvasApi({ baseUrl, token, cookieHeader, method, params, fetchImpl }) {
+  const headers = {
+    "content-type": "application/x-www-form-urlencoded"
+  };
+  const body = {
+    ...params,
+    document_content: JSON.stringify({
+      type: "markdown",
+      markdown: params.content
+    })
+  };
+  delete body.content;
+
+  if (cookieHeader) headers.cookie = cookieHeader;
+  if (token && !cookieHeader) headers.authorization = `Bearer ${token}`;
+  if (token && cookieHeader) body.token = token;
+
+  const response = await fetchImpl(`${baseUrl}/api/${method}`, {
+    method: "POST",
+    headers,
+    body: new URLSearchParams(body)
+  });
+  return response.json();
+}
+
+export async function createSlackCanvas(input, options = {}) {
+  const normalized = normalizeCanvasInput(input);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const resolved = await resolveCanvasToken(options);
+  const baseUrl = options.baseUrl ?? "https://workday.enterprise.slack.com";
+  const method = normalized.channelCanvas ? "conversations.canvases.create" : "canvases.create";
+  const params = {
+    channel_id: normalized.channelId,
+    title: normalized.title,
+    content: normalized.content
+  };
+
+  let tokenSource = resolved.tokenSource;
+  let token = resolved.token;
+  let cookieHeader = "";
+  let apiBaseUrl = baseUrl;
+
+  if (!token) {
+    const session = options.session ?? await loadSlackSession(options);
+    token = session.token;
+    cookieHeader = session.cookieHeader;
+    apiBaseUrl = session.baseUrl ?? baseUrl;
+    tokenSource = "browser-session";
+  }
+
+  const data = await postSlackCanvasApi({
+    baseUrl: apiBaseUrl,
+    token,
+    cookieHeader,
+    method,
+    params,
+    fetchImpl
+  });
+
+  if (!data.ok) {
+    const tokenHint =
+      data.error === "not_allowed_token_type" && tokenSource === "browser-session"
+        ? "Chrome Slack session tokens cannot create canvases through Slack Canvas API. Set WORKDAY_SLACK_CANVAS_TOKEN or SLACK_CANVAS_TOKEN, or save the token in Keychain as service=nuvlore account=nuvlore.slack_canvas, with canvases:write scope, then retry."
+        : undefined;
+    const error = new Error(
+      `Slack ${method} failed: ${data.error || "unknown_error"}${tokenHint ? `. ${tokenHint}` : ""}`
+    );
+    error.slackError = data.error;
+    error.detail = data.detail;
+    throw error;
+  }
+
+  return {
+    readOnly: false,
+    ok: true,
+    method,
+    channel: normalized.channelId,
+    canvasId: data.canvas_id,
+    canvasLink: data.canvas_id ? canvasLink(apiBaseUrl, data.canvas_id) : undefined,
+    tokenSource
+  };
+}

package/src/slackConfig.mjs

@@ -0,0 +1,18 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function getSlackConfig(env = process.env) {
+  const baseDir = join(homedir(), ".nuvlore", "workday");
+  const exportDir = env.WORKDAY_SLACK_EXPORT_DIR?.trim() || join(baseDir, "slack-export");
+  const syncIntervalMs = Number(env.WORKDAY_SLACK_SYNC_INTERVAL_MS ?? 3_600_000);
+  const workspaceUrl =
+    env.WORKDAY_SLACK_WORKSPACE_URL?.trim() || "https://workday.enterprise.slack.com";
+
+  return {
+    exportDir,
+    syncIntervalMs,
+    workspaceUrl,
+    syncStatePath: join(exportDir, "sync-state.json"),
+    manifestPath: join(exportDir, "manifest.json")
+  };
+}

package/src/slackMessageSend.mjs

@@ -0,0 +1,71 @@
+import { loadSlackSession } from "./slackSessionRead.mjs";
+
+const SLACK_TS_PATTERN = /^\d+\.\d+$/;
+
+function normalizeMessageInput(input = {}) {
+  const channelId = String(input.channelId ?? input.channel_id ?? "").trim();
+  const message = String(input.message ?? input.text ?? "").trim();
+  const threadTs = input.threadTs ?? input.thread_ts;
+
+  if (!channelId) throw new Error("Slack channelId is required.");
+  if (!/^[A-Z][A-Z0-9]+$/.test(channelId)) {
+    throw new Error("Slack channelId must be a Slack conversation id such as C..., G..., or D...");
+  }
+  if (!message) throw new Error("Slack message is required.");
+  if (message.length > 5000) throw new Error("Slack message must be 5000 characters or fewer.");
+  if (threadTs && !SLACK_TS_PATTERN.test(String(threadTs))) {
+    throw new Error("Slack threadTs must be a Slack timestamp such as 1234567890.123456.");
+  }
+
+  return {
+    channelId,
+    message,
+    threadTs: threadTs ? String(threadTs) : undefined,
+    replyBroadcast: input.replyBroadcast ?? input.reply_broadcast,
+    unfurlLinks: input.unfurlLinks ?? input.unfurl_links ?? false,
+    unfurlMedia: input.unfurlMedia ?? input.unfurl_media ?? false
+  };
+}
+
+export function slackMessageLink(baseUrl, channelId, ts) {
+  return `${baseUrl}/archives/${channelId}/p${String(ts).replace(".", "")}`;
+}
+
+export async function sendSlackMessage(input, options = {}) {
+  const normalized = normalizeMessageInput(input);
+  const session = options.session ?? await loadSlackSession(options);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+
+  const params = {
+    token: session.token,
+    channel: normalized.channelId,
+    text: normalized.message,
+    unfurl_links: normalized.unfurlLinks ? "true" : "false",
+    unfurl_media: normalized.unfurlMedia ? "true" : "false"
+  };
+  if (normalized.threadTs) params.thread_ts = normalized.threadTs;
+  if (normalized.replyBroadcast !== undefined) {
+    params.reply_broadcast = normalized.replyBroadcast ? "true" : "false";
+  }
+
+  const response = await fetchImpl(`${session.baseUrl}/api/chat.postMessage`, {
+    method: "POST",
+    headers: {
+      cookie: session.cookieHeader,
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(params)
+  });
+  const data = await response.json();
+  if (!data.ok) {
+    throw new Error(`Slack chat.postMessage failed: ${data.error || "unknown_error"}`);
+  }
+
+  return {
+    readOnly: false,
+    ok: true,
+    channel: data.channel,
+    ts: data.ts,
+    messageLink: slackMessageLink(session.baseUrl, data.channel, data.ts)
+  };
+}

package/src/slackSearch.mjs

@@ -0,0 +1,103 @@
+import {
+  createSlackApiClient,
+  loadSlackSession,
+  slackUserBoot
+} from "./slackSessionRead.mjs";
+
+function compactMatch(match) {
+  return {
+    type: match.type,
+    channel: match.channel?.name || match.channel?.id,
+    channelId: match.channel?.id,
+    user: match.username || match.user,
+    text: match.text,
+    ts: match.ts,
+    threadTs: match.thread_ts,
+    permalink: match.permalink
+  };
+}
+
+export async function searchSlackMessages(query, options = {}) {
+  const session = await loadSlackSession(options);
+  const slackApi = createSlackApiClient(session, options);
+  const result = await slackApi("search.messages", {
+    query: String(query),
+    count: String(options.count ?? 20),
+    sort: options.sort ?? "timestamp",
+    sort_dir: options.sortDir ?? "desc",
+    highlight: options.highlight ? "1" : "0"
+  });
+  return {
+    readOnly: true,
+    query,
+    total: result.messages?.total ?? 0,
+    matches: (result.messages?.matches ?? []).map(compactMatch)
+  };
+}
+
+export async function searchSlackAll(query, options = {}) {
+  const session = await loadSlackSession(options);
+  const slackApi = createSlackApiClient(session, options);
+  const result = await slackApi("search.all", {
+    query: String(query),
+    count: String(options.count ?? 20),
+    sort: options.sort ?? "timestamp",
+    sort_dir: options.sortDir ?? "desc"
+  });
+  return {
+    readOnly: true,
+    query,
+    messages: (result.messages?.matches ?? []).map(compactMatch),
+    files: result.files?.matches ?? [],
+    posts: result.posts?.matches ?? []
+  };
+}
+
+export async function searchSlackFiles(query, options = {}) {
+  const session = await loadSlackSession(options);
+  const slackApi = createSlackApiClient(session, options);
+  const result = await slackApi("search.files", {
+    query: String(query),
+    count: String(options.count ?? 20),
+    sort: options.sort ?? "timestamp",
+    sort_dir: options.sortDir ?? "desc"
+  });
+  return {
+    readOnly: true,
+    query,
+    total: result.files?.total ?? 0,
+    files: result.files?.matches ?? []
+  };
+}
+
+export async function searchSlackAutocomplete(query, options = {}) {
+  const session = await loadSlackSession(options);
+  const slackApi = createSlackApiClient(session, options);
+  const result = await slackApi("search.autocomplete", {
+    query: String(query),
+    types: options.types ?? "channels,users"
+  });
+  return { readOnly: true, query, results: result };
+}
+
+export async function getSlackAiCapabilities(options = {}) {
+  const session = await loadSlackSession(options);
+  const slackApi = createSlackApiClient(session, options);
+  const boot = await slackUserBoot(session, options);
+  const paidFeatures = boot.paid_features ?? [];
+  const hasSlackAi = paidFeatures.includes("slack_ai_enterprise_grid_workspaces");
+  let assistantSearch = null;
+  try {
+    assistantSearch = await slackApi("assistant.search.info", {});
+  } catch (error) {
+    assistantSearch = { ok: false, error: error.message };
+  }
+  return {
+    readOnly: true,
+    slackAiEnabled: hasSlackAi,
+    paidFeatures,
+    assistantSearch,
+    note:
+      "Browser session supports keyword search (search.messages). Slack AI semantic answers (assistant.search.context) require OAuth user tokens, not xoxc session tokens."
+  };
+}

package/src/slackSessionRead.mjs

@@ -0,0 +1,200 @@
+import { importCookiesFromChrome } from "@nuvlore/extension-sso/session-manager";
+import { resolveAutoAuthOptions } from "@nuvlore/extension-sso/auto-auth";
+import { ensureOktaAppSession, openOktaAppForAuth } from "@nuvlore/extension-sso/session-auth";
+import { getSsoConfig } from "@nuvlore/extension-sso/sso-config";
+
+/** Slack Web API methods that only fetch data (read-only session POST). */
+export const SLACK_READ_ONLY_METHODS = new Set([
+  "client.userBoot",
+  "conversations.history",
+  "conversations.replies",
+  "conversations.info",
+  "users.info",
+  "files.info",
+  "search.messages",
+  "search.all",
+  "search.files",
+  "search.autocomplete",
+  "team.info"
+]);
+
+const SLACK_DOMAINS = [
+  "workday.enterprise.slack.com",
+  "workday.slack.com",
+  "workday-dev.slack.com",
+  ".slack.com",
+  "slack.com",
+  "app.slack.com"
+];
+
+export const DEFAULT_SLACK_WORKSPACE = "https://workday.enterprise.slack.com";
+
+export function assertSlackReadOnlyMethod(method) {
+  const name = String(method || "").trim();
+  if (!SLACK_READ_ONLY_METHODS.has(name)) {
+    throw new Error(`Read-only Slack: method ${name} is not allowed.`);
+  }
+  return name;
+}
+
+export function buildSlackCookieHeader(cookies) {
+  return cookies
+    .filter((c) => c.domain?.includes("slack"))
+    .map((c) => `${c.name}=${c.value}`)
+    .join("; ");
+}
+
+export function extractSlackApiToken(html) {
+  const text = String(html || "");
+  return (
+    text.match(/"api_token":"(xoxc-[^"]+)"/)?.[1] ||
+    text.match(/(xoxc-[A-Za-z0-9-]+)/)?.[1] ||
+    ""
+  );
+}
+
+export async function loadSlackSession(options = {}) {
+  const config = options.config ?? getSsoConfig();
+  const authOptions = resolveAutoAuthOptions(options);
+  const baseUrl = options.baseUrl ?? DEFAULT_SLACK_WORKSPACE;
+  const host = new URL(baseUrl).host;
+
+  try {
+    await ensureOktaAppSession("Slack", { ...authOptions, config });
+  } catch {
+    // Cookie import below may still succeed when Okta probe is stale.
+  }
+
+  const imported = await importCookiesFromChrome(config, [host, ...SLACK_DOMAINS]);
+  const cookies = imported?.cookies ?? [];
+  const cookieHeader = buildSlackCookieHeader(cookies);
+  if (!cookieHeader) {
+    throw new Error("No Slack cookies in Chrome. Open Slack via Okta and retry.");
+  }
+
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+
+  async function fetchSlackToken(cookieHdr) {
+    const browserHeaders = {
+      cookie: cookieHdr,
+      accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "accept-language": "en-US,en;q=0.9",
+      "user-agent":
+        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+    };
+    for (const path of ["/messages", "/slack-ai", "/"]) {
+      const page = await fetchImpl(`${baseUrl}${path}`, { headers: browserHeaders });
+      const html = await page.text();
+      const token = extractSlackApiToken(html);
+      if (token) return token;
+    }
+    return "";
+  }
+
+  let activeCookieHeader = cookieHeader;
+  let token = await fetchSlackToken(activeCookieHeader);
+  if (!token && authOptions.openBrowserOnMissing) {
+    await openOktaAppForAuth("Slack", { ...authOptions, config });
+    const refreshed = await importCookiesFromChrome(config, [host, ...SLACK_DOMAINS]);
+    const refreshedHeader = buildSlackCookieHeader(refreshed?.cookies ?? []);
+    if (refreshedHeader) {
+      activeCookieHeader = refreshedHeader;
+      token = await fetchSlackToken(activeCookieHeader);
+    }
+  }
+  if (!token) {
+    throw new Error(
+      "Could not extract Slack session token (xoxc). Open Slack via Okta in Chrome, then retry."
+    );
+  }
+
+  return { baseUrl, host, cookieHeader: activeCookieHeader, token, config };
+}
+
+export function createSlackApiClient(session, options = {}) {
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const rateLimitMs = options.rateLimitMs ?? 1200;
+  let lastCall = 0;
+
+  async function throttle() {
+    const wait = rateLimitMs - (Date.now() - lastCall);
+    if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+    lastCall = Date.now();
+  }
+
+  return async function slackApi(method, params = {}) {
+    assertSlackReadOnlyMethod(method);
+    await throttle();
+    const body = new URLSearchParams({ token: session.token, ...params });
+    const response = await fetchImpl(`${session.baseUrl}/api/${method}`, {
+      method: "POST",
+      headers: {
+        cookie: session.cookieHeader,
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body
+    });
+    const data = await response.json();
+    if (!data.ok) {
+      if (data.error === "ratelimited") {
+        const retryAfter = Number(response.headers.get("retry-after") || 30);
+        await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000));
+        return slackApi(method, params);
+      }
+      throw new Error(`Slack ${method} failed: ${data.error || "unknown_error"}`);
+    }
+    return data;
+  };
+}
+
+export async function slackUserBoot(session, options = {}) {
+  const slackApi = createSlackApiClient(session, options);
+  return slackApi("client.userBoot", { version_ts: String(Date.now()) });
+}
+
+export function listChannelsFromBoot(boot) {
+  const channels = Object.values(boot.channels ?? {});
+  const ims = Object.values(boot.ims ?? {}).map((im) => ({
+    ...im,
+    is_im: true,
+    name: im.user ? `dm-${im.user}` : `im-${im.id}`
+  }));
+  const mpims = Object.values(boot.mpims ?? {}).map((mp) => ({
+    ...mp,
+    is_mpim: true,
+    name: mp.name || `mpim-${mp.id}`
+  }));
+  return [...channels, ...ims, ...mpims].filter((c) => c?.id);
+}
+
+export async function fetchAllHistory(slackApi, channelId, { oldest } = {}) {
+  const messages = [];
+  let cursor = "";
+  do {
+    const page = await slackApi("conversations.history", {
+      channel: channelId,
+      limit: "200",
+      ...(oldest ? { oldest: String(oldest) } : {}),
+      ...(cursor ? { cursor } : {})
+    });
+    messages.push(...(page.messages ?? []));
+    cursor = page.response_metadata?.next_cursor ?? "";
+  } while (cursor);
+  return messages;
+}
+
+export async function fetchAllReplies(slackApi, channelId, threadTs) {
+  const messages = [];
+  let cursor = "";
+  do {
+    const page = await slackApi("conversations.replies", {
+      channel: channelId,
+      ts: threadTs,
+      limit: "200",
+      ...(cursor ? { cursor } : {})
+    });
+    messages.push(...(page.messages ?? []));
+    cursor = page.response_metadata?.next_cursor ?? "";
+  } while (cursor);
+  return messages;
+}