@oneuptime/common 14.0.0 → 14.0.2

package/build/dist/Server/API/SlackAPI.js

@@ -26,10 +26,96 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import CommonAPI from "./CommonAPI";
 import AIService, { AI_DISABLED_MESSAGE } from "../Services/AIService";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
-import { PrivateNoteEmojis, PublicNoteEmojis, } from "../Utils/Workspace/Slack/Actions/ActionTypes";
-import AccessTokenService from "../Services/AccessTokenService";
+import WorkspaceNoteReactionUtil from "../../Types/Workspace/WorkspaceNoteReaction";
+import SlackReactionNoteActions from "../Utils/Workspace/Slack/Actions/ReactionNote";
+import WorkspaceActionAuthorization from "../Utils/Workspace/WorkspaceActionAuthorization";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import ObservabilityAssistant from "../Utils/AI/Chat/ObservabilityAssistant";
-export default class SlackAPI {
+import WorkspaceNotificationRuleService from "../Services/WorkspaceNotificationRuleService";
+import WorkspaceNotificationRule from "../../Models/DatabaseModels/WorkspaceNotificationRule";
+import WorkspaceOAuthState, { WorkspaceOAuthFlow, } from "../Utils/Workspace/WorkspaceOAuthState";
+import OneUptimeDate from "../../Types/Date";
+class SlackAPI {
+    /*
+     * Turns the channel-cache editor's `{ [channelName]: channelId }` map into
+     * the stored cache shape, keyed by lower-cased name. Blank rows are dropped,
+     * as the editor always did; anything that is not a name and a Slack channel
+     * id is refused.
+     */
+    static parseChannelCacheInput(input) {
+        if (!input || typeof input !== "object" || Array.isArray(input)) {
+            throw new BadDataException("channels must be an object mapping Slack channel names to channel IDs.");
+        }
+        const entries = Object.entries(input);
+        if (entries.length > SlackAPI.MAX_CHANNEL_CACHE_ENTRIES) {
+            throw new BadDataException(`A Slack channel list can hold at most ${SlackAPI.MAX_CHANNEL_CACHE_ENTRIES} channels.`);
+        }
+        const lastUpdated = OneUptimeDate.toString(OneUptimeDate.getCurrentDate());
+        const channelCache = {};
+        for (const [rawName, rawId] of entries) {
+            if (typeof rawId !== "string") {
+                throw new BadDataException(`The channel ID for "${rawName}" must be a string.`);
+            }
+            const name = rawName.trim();
+            const id = rawId.trim();
+            if (!name || !id) {
+                continue;
+            }
+            const key = name.toLowerCase();
+            if (name.length > SlackAPI.MAX_CHANNEL_NAME_LENGTH ||
+                SlackAPI.RESERVED_CHANNEL_KEYS.includes(key)) {
+                throw new BadDataException(`"${name}" is not a valid channel name.`);
+            }
+            if (!SlackAPI.CHANNEL_ID_PATTERN.test(id)) {
+                throw new BadDataException(`"${id}" is not a valid Slack channel ID (for example C0123456789).`);
+            }
+            channelCache[key] = {
+                id: id,
+                name: name,
+                lastUpdated: lastUpdated,
+            };
+        }
+        return channelCache;
+    }
+    static getInstallRedirectUri(data) {
+        return `${AppApiClientUrl.toString()}/slack/auth/${data.projectId.toString()}/${data.userId.toString()}`;
+    }
+    static getUserSignInRedirectUri(data) {
+        return `${SlackAPI.getInstallRedirectUri(data)}/user`;
+    }
+    /*
+     * Spends the `state` Slack hands back and returns the project and user it
+     * was issued for, or null when the callback must be refused.
+     *
+     * The ids in the redirect path are only there because Slack matches
+     * redirect URIs by prefix; they are never used. They must still agree with
+     * the state, so a hand-edited path is refused rather than quietly ignored.
+     */
+    static async consumeStateForCallback(data) {
+        var _a, _b, _c;
+        let stateRecord = null;
+        try {
+            stateRecord = await WorkspaceOAuthState.consume({
+                req: data.req,
+                state: (_a = data.req.query["state"]) === null || _a === void 0 ? void 0 : _a.toString(),
+                flows: [data.flow],
+            });
+        }
+        catch (err) {
+            logger.error(err, getLogAttributesFromRequest(data.req));
+            return null;
+        }
+        if (!stateRecord) {
+            return null;
+        }
+        if (((_b = data.req.params["projectId"]) === null || _b === void 0 ? void 0 : _b.toString()) !==
+            stateRecord.projectId.toString() ||
+            ((_c = data.req.params["userId"]) === null || _c === void 0 ? void 0 : _c.toString()) !== stateRecord.userId.toString()) {
+            logger.warn("Slack OAuth callback refused: the redirect path does not match the project and user the state was issued for.", getLogAttributesFromRequest(data.req));
+            return null;
+        }
+        return stateRecord;
+    }
     getRouter() {
         const router = Express.getRouter();
         router.get("/slack/app-manifest", (req, res) => {
@@ -45,42 +131,113 @@ export default class SlackAPI {
             const manifest = JSON.parse(manifestInString);
             return Response.sendJsonObjectResponse(req, res, manifest);
         });
+        /*
+         * Start installing OneUptime into a Slack workspace for this project.
+         *
+         * Returns the Slack authorize URL for the dashboard to navigate to. The
+         * redirect path still names the project and user (existing Slack app
+         * configurations register /api/slack/auth as a prefix), but the callback
+         * does not trust it: it trusts the single-use `state` recorded here, for
+         * a signed-in member allowed to manage the project's workspace
+         * connections. See WorkspaceOAuthState.
+         */
+        router.get("/slack/install-url", UserMiddleware.getUserMiddleware, async (req, res) => {
+            try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                CommonAPI.assertPermittedInProject({
+                    databaseProps: databaseProps,
+                    allowedPermissions: WorkspaceOAuthState.MANAGE_CONNECTION_PERMISSIONS,
+                    errorMessage: "You do not have permission to connect this project to Slack.",
+                });
+                if (!SlackAppClientId) {
+                    throw new BadDataException("Slack App Client ID is not set");
+                }
+                const userId = databaseProps.userId;
+                const { state } = await WorkspaceOAuthState.create({
+                    req,
+                    res,
+                    flow: WorkspaceOAuthFlow.SlackInstall,
+                    projectId: projectId,
+                    userId: userId,
+                });
+                const scopes = SlackAppManifest["oauth_config"]["scopes"];
+                const authorizationUrl = `https://slack.com/oauth/v2/authorize?scope=${encodeURIComponent((scopes["bot"] || []).join(","))}&user_scope=${encodeURIComponent((scopes["user"] || []).join(","))}&client_id=${encodeURIComponent(SlackAppClientId)}&redirect_uri=${encodeURIComponent(SlackAPI.getInstallRedirectUri({ projectId, userId }))}&state=${encodeURIComponent(state)}`;
+                return Response.sendJsonObjectResponse(req, res, {
+                    authorizationUrl: authorizationUrl,
+                });
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
+        /*
+         * Start "sign in with Slack" for the calling user, in a project already
+         * connected to a Slack workspace. Same single-use state as above.
+         */
+        router.get("/slack/sign-in-url", UserMiddleware.getUserMiddleware, async (req, res) => {
+            try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                if (!SlackAppClientId) {
+                    throw new BadDataException("Slack App Client ID is not set");
+                }
+                const userId = databaseProps.userId;
+                const { state } = await WorkspaceOAuthState.create({
+                    req,
+                    res,
+                    flow: WorkspaceOAuthFlow.SlackUserSignIn,
+                    projectId: projectId,
+                    userId: userId,
+                });
+                const authorizationUrl = `https://slack.com/openid/connect/authorize?response_type=code&scope=${encodeURIComponent("openid profile email")}&client_id=${encodeURIComponent(SlackAppClientId)}&redirect_uri=${encodeURIComponent(SlackAPI.getUserSignInRedirectUri({ projectId, userId }))}&state=${encodeURIComponent(state)}`;
+                return Response.sendJsonObjectResponse(req, res, {
+                    authorizationUrl: authorizationUrl,
+                });
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
         // this is project specific auth endpoint.
         router.get("/slack/auth/:projectId/:userId", async (req, res) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+            var _a, _b, _c, _d, _e, _f, _g, _h;
             if (!SlackAppClientId) {
                 return Response.sendErrorResponse(req, res, new BadDataException("Slack App Client ID is not set"));
             }
             if (!SlackAppClientSecret) {
                 return Response.sendErrorResponse(req, res, new BadDataException("Slack App Client Secret is not set"));
             }
-            const projectId = (_a = req.params["projectId"]) === null || _a === void 0 ? void 0 : _a.toString();
-            const userId = (_b = req.params["userId"]) === null || _b === void 0 ? void 0 : _b.toString();
-            if (!projectId) {
-                return Response.sendErrorResponse(req, res, new BadDataException("Invalid ProjectID in request"));
-            }
-            if (!userId) {
-                return Response.sendErrorResponse(req, res, new BadDataException("Invalid UserID in request"));
+            const stateRecord = await SlackAPI.consumeStateForCallback({
+                req,
+                flow: WorkspaceOAuthFlow.SlackInstall,
+            });
+            if (!stateRecord) {
+                return Response.sendErrorResponse(req, res, new BadRequestException(WorkspaceOAuthState.INVALID_STATE_MESSAGE));
             }
+            const projectId = stateRecord.projectId.toString();
+            const userId = stateRecord.userId.toString();
             // if there's an error query param.
-            const error = (_c = req.query["error"]) === null || _c === void 0 ? void 0 : _c.toString();
+            const error = (_a = req.query["error"]) === null || _a === void 0 ? void 0 : _a.toString();
             const slackIntegrationPageUrl = URL.fromString(DashboardClientUrl.toString() +
                 `/${projectId.toString()}/settings/slack-integration`);
             if (error) {
                 return Response.redirect(req, res, slackIntegrationPageUrl.addQueryParam("error", error));
             }
             // slack returns the code on successful auth.
-            const code = (_d = req.query["code"]) === null || _d === void 0 ? void 0 : _d.toString();
+            const code = (_b = req.query["code"]) === null || _b === void 0 ? void 0 : _b.toString();
             if (!code) {
                 return Response.sendErrorResponse(req, res, new BadRequestException("Invalid request"));
             }
             // get access token from slack api.
-            const redirectUri = URL.fromString(`${AppApiClientUrl.toString()}/slack/auth/${projectId}/${userId}`);
             const requestBody = {
                 code: code,
                 client_id: SlackAppClientId,
                 client_secret: SlackAppClientSecret,
-                redirect_uri: redirectUri.toString(),
+                redirect_uri: SlackAPI.getInstallRedirectUri({
+                    projectId: stateRecord.projectId,
+                    userId: stateRecord.userId,
+                }),
             };
             /*
              * Neither the token request nor the token response is logged: the
@@ -137,25 +294,25 @@ export default class SlackAPI {
             }
             if (responseBody["team"] &&
                 responseBody["team"]["id"]) {
-                slackTeamId = (_e = responseBody["team"]["id"]) === null || _e === void 0 ? void 0 : _e.toString();
+                slackTeamId = (_c = responseBody["team"]["id"]) === null || _c === void 0 ? void 0 : _c.toString();
             }
             if (responseBody["access_token"]) {
-                slackBotAccessToken = (_f = responseBody["access_token"]) === null || _f === void 0 ? void 0 : _f.toString();
+                slackBotAccessToken = (_d = responseBody["access_token"]) === null || _d === void 0 ? void 0 : _d.toString();
             }
             if (responseBody["authed_user"] &&
                 responseBody["authed_user"]["id"]) {
-                slackUserId = (_g = responseBody["authed_user"]["id"]) === null || _g === void 0 ? void 0 : _g.toString();
+                slackUserId = (_e = responseBody["authed_user"]["id"]) === null || _e === void 0 ? void 0 : _e.toString();
             }
             if (responseBody["authed_user"] &&
                 responseBody["authed_user"]["access_token"]) {
-                slackUserAccessToken = (_h = responseBody["authed_user"]["access_token"]) === null || _h === void 0 ? void 0 : _h.toString();
+                slackUserAccessToken = (_f = responseBody["authed_user"]["access_token"]) === null || _f === void 0 ? void 0 : _f.toString();
             }
             if (responseBody["team"] &&
                 responseBody["team"]["name"]) {
-                slackTeamName = (_j = responseBody["team"]["name"]) === null || _j === void 0 ? void 0 : _j.toString();
+                slackTeamName = (_g = responseBody["team"]["name"]) === null || _g === void 0 ? void 0 : _g.toString();
             }
             if (responseBody["bot_user_id"]) {
-                botUserId = (_k = responseBody["bot_user_id"]) === null || _k === void 0 ? void 0 : _k.toString();
+                botUserId = (_h = responseBody["bot_user_id"]) === null || _h === void 0 ? void 0 : _h.toString();
             }
             await WorkspaceProjectAuthTokenService.refreshAuthToken({
                 projectId: new ObjectID(projectId),
@@ -183,40 +340,43 @@ export default class SlackAPI {
         });
         // this is user specific auth endpoint to sign in to slack.
         router.get("/slack/auth/:projectId/:userId/user", async (req, res) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+            var _a, _b, _c, _d, _e, _f, _g, _h;
             if (!SlackAppClientId) {
                 return Response.sendErrorResponse(req, res, new BadDataException("Slack App Client ID is not set"));
             }
             if (!SlackAppClientSecret) {
                 return Response.sendErrorResponse(req, res, new BadDataException("Slack App Client Secret is not set"));
             }
-            const projectId = (_a = req.params["projectId"]) === null || _a === void 0 ? void 0 : _a.toString();
-            const userId = (_b = req.params["userId"]) === null || _b === void 0 ? void 0 : _b.toString();
-            if (!projectId) {
-                return Response.sendErrorResponse(req, res, new BadDataException("Invalid ProjectID in request"));
-            }
-            if (!userId) {
-                return Response.sendErrorResponse(req, res, new BadDataException("Invalid UserID in request"));
+            const stateRecord = await SlackAPI.consumeStateForCallback({
+                req,
+                flow: WorkspaceOAuthFlow.SlackUserSignIn,
+            });
+            if (!stateRecord) {
+                return Response.sendErrorResponse(req, res, new BadRequestException(WorkspaceOAuthState.INVALID_STATE_MESSAGE));
             }
+            const projectId = stateRecord.projectId.toString();
+            const userId = stateRecord.userId.toString();
             // if there's an error query param.
-            const error = (_c = req.query["error"]) === null || _c === void 0 ? void 0 : _c.toString();
+            const error = (_a = req.query["error"]) === null || _a === void 0 ? void 0 : _a.toString();
             const slackIntegrationPageUrl = URL.fromString(DashboardClientUrl.toString() +
                 `/${projectId.toString()}/settings/slack-integration`);
             if (error) {
                 return Response.redirect(req, res, slackIntegrationPageUrl.addQueryParam("error", error));
             }
             // slack returns the code on successful auth.
-            const code = (_d = req.query["code"]) === null || _d === void 0 ? void 0 : _d.toString();
+            const code = (_b = req.query["code"]) === null || _b === void 0 ? void 0 : _b.toString();
             if (!code) {
                 return Response.sendErrorResponse(req, res, new BadRequestException("Invalid request"));
             }
             // get access token from slack api.
-            const redirectUri = URL.fromString(`${AppApiClientUrl.toString()}/slack/auth/${projectId}/${userId}/user`);
             const requestBody = {
                 code: code,
                 client_id: SlackAppClientId,
                 client_secret: SlackAppClientSecret,
-                redirect_uri: redirectUri.toString(),
+                redirect_uri: SlackAPI.getUserSignInRedirectUri({
+                    projectId: stateRecord.projectId,
+                    userId: stateRecord.userId,
+                }),
             };
             // Same as above: the body holds the client secret and the auth code.
             logger.debug("Exchanging Slack authorization code for a user token.", getLogAttributesFromRequest(req));
@@ -238,7 +398,7 @@ export default class SlackAPI {
                 typeof responseBody["id_token"] === "string" &&
                 responseBody["id_token"].split(".").length > 0) {
                 const idToken = responseBody["id_token"];
-                const decodedIdToken = JSON.parse(Buffer.from(((_e = idToken.split(".")) === null || _e === void 0 ? void 0 : _e[1]) || "", "base64").toString("utf8"));
+                const decodedIdToken = JSON.parse(Buffer.from(((_c = idToken.split(".")) === null || _c === void 0 ? void 0 : _c[1]) || "", "base64").toString("utf8"));
                 // The decoded ID token is identity material; only the fact is logged.
                 logger.debug("Decoded Slack ID token.", getLogAttributesFromRequest(req));
                 responseBody["id_token"] = decodedIdToken;
@@ -293,9 +453,9 @@ export default class SlackAPI {
                 logger.debug(idToken["https://slack.com/team_id"], getLogAttributesFromRequest(req));
                 logger.debug("Response User ID: ", getLogAttributesFromRequest(req));
                 logger.debug(idToken["https://slack.com/user_id"], getLogAttributesFromRequest(req));
-                if (((_f = projectAuth.workspaceProjectId) === null || _f === void 0 ? void 0 : _f.toString()) !==
-                    ((_g = idToken["https://slack.com/team_id"]) === null || _g === void 0 ? void 0 : _g.toString())) {
-                    const teamName = (_h = projectAuth.miscData) === null || _h === void 0 ? void 0 : _h.teamName;
+                if (((_d = projectAuth.workspaceProjectId) === null || _d === void 0 ? void 0 : _d.toString()) !==
+                    ((_e = idToken["https://slack.com/team_id"]) === null || _e === void 0 ? void 0 : _e.toString())) {
+                    const teamName = (_f = projectAuth.miscData) === null || _f === void 0 ? void 0 : _f.teamName;
                     // send error response.
                     return Response.redirect(req, res, slackIntegrationPageUrl.addQueryParam("error", "Looks like you are trying to sign in to a different slack workspace. Please try again and sign in to the workspace " +
                         teamName));
@@ -305,8 +465,8 @@ export default class SlackAPI {
                 // send error response.
                 return Response.redirect(req, res, slackIntegrationPageUrl.addQueryParam("error", "Looks like this OneUptime project is not connected to any slack workspace. Please try again and sign in to the workspace"));
             }
-            const authToken = (_j = responseBody["access_token"]) === null || _j === void 0 ? void 0 : _j.toString();
-            const slackUserId = (_k = idToken["https://slack.com/user_id"]) === null || _k === void 0 ? void 0 : _k.toString();
+            const authToken = (_g = responseBody["access_token"]) === null || _g === void 0 ? void 0 : _g.toString();
+            const slackUserId = (_h = idToken["https://slack.com/user_id"]) === null || _h === void 0 ? void 0 : _h.toString();
             if (!slackUserId) {
                 return Response.redirect(req, res, slackIntegrationPageUrl.addQueryParam("error", "Unfortunately, we were unable to get your slack user id. Please try again."));
             }
@@ -474,6 +634,42 @@ export default class SlackAPI {
                 return Response.sendErrorResponse(req, res, err);
             }
         });
+        // Send a test notification to one channel ("Send Test" in Project Settings).
+        router.post("/slack/channels/test", UserMiddleware.getUserMiddleware, async (req, res) => {
+            var _a;
+            try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                /*
+                 * Posting into a channel is a side effect, so membership alone is
+                 * not enough. Anyone who could create a workspace notification rule
+                 * - including its team block list, which the CRUD create enforces
+                 * too - can already make OneUptime post to this channel; a Viewer,
+                 * or a member whose team is blocked from creating rules, cannot.
+                 * getUserMiddleware admits unauthenticated requests as "public", so
+                 * the membership check is mandatory as well.
+                 */
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+                CommonAPI.assertCanCreateTable({
+                    modelType: WorkspaceNotificationRule,
+                    props: databaseProps,
+                    errorMessage: "You do not have permission to send test notifications in this project.",
+                });
+                const channelId = typeof ((_a = req.body) === null || _a === void 0 ? void 0 : _a["channelId"]) === "string"
+                    ? req.body["channelId"]
+                    : "";
+                // Slack has no chats or teams: only the channel id is forwarded.
+                await WorkspaceNotificationRuleService.sendTestNotificationToDestination({
+                    projectId: projectId,
+                    workspaceType: WorkspaceType.Slack,
+                    testByUserId: databaseProps.userId,
+                    channelId: channelId,
+                });
+                return Response.sendEmptySuccessResponse(req, res);
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
         // Fetch and cache all Slack channels for current tenant's project
         router.get("/slack/get-all-channels", UserMiddleware.getUserMiddleware, async (req, res) => {
             var _a, _b;
@@ -517,6 +713,38 @@ export default class SlackAPI {
             const channelCache = ((_b = ((updatedProjectAuth === null || updatedProjectAuth === void 0 ? void 0 : updatedProjectAuth.miscData) || {})) === null || _b === void 0 ? void 0 : _b.channelCache) || {};
             return Response.sendJsonObjectResponse(req, res, channelCache);
         });
+        /*
+         * Save the dashboard's edited Slack channel list for the current project.
+         *
+         * The channel cache lives in WorkspaceProjectAuthToken.miscData, which is
+         * not writable through the CRUD API because other connections keep
+         * server-trusted values there. This route writes the channel cache and
+         * nothing else, for a member allowed to manage the project's workspace
+         * connections. The body is `{ channels: { [channelName]: channelId } }`.
+         */
+        router.put("/slack/channel-cache", UserMiddleware.getUserMiddleware, async (req, res) => {
+            var _a;
+            try {
+                const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+                CommonAPI.assertPermittedInProject({
+                    databaseProps: props,
+                    allowedPermissions: WorkspaceOAuthState.MANAGE_CONNECTION_PERMISSIONS,
+                    errorMessage: "You do not have permission to edit this project's Slack channels.",
+                });
+                const channelCache = SlackAPI.parseChannelCacheInput((_a = req.body) === null || _a === void 0 ? void 0 : _a["channels"]);
+                await WorkspaceProjectAuthTokenService.replaceSlackChannelCache({
+                    projectId: projectId,
+                    channelCache: channelCache,
+                });
+                return Response.sendJsonObjectResponse(req, res, {
+                    channelCache: channelCache,
+                });
+            }
+            catch (err) {
+                return Response.sendErrorResponse(req, res, err);
+            }
+        });
         // Slack Events API endpoint for handling events like emoji reactions
         router.post("/slack/events", SlackAuthorization.isAuthorizedSlackRequest, async (req, res) => {
             var _a, _b;
@@ -536,6 +764,30 @@ export default class SlackAPI {
                     logger.debug("No event found in payload", getLogAttributesFromRequest(req));
                     return Response.sendTextResponse(req, res, "ok");
                 }
+                /*
+                 * "Pin to channel" is Slack's own pin, not an emoji, and it means the
+                 * same thing as a 📌 reaction: save the message as a private note.
+                 * Both share one note per message, so doing both saves it once.
+                 */
+                if (event["type"] === "pin_added") {
+                    Response.sendTextResponse(req, res, "ok");
+                    const pinData = SlackReactionNoteActions.getReactionDataFromPinEvent({
+                        payload: payload,
+                        event: event,
+                    });
+                    if (!pinData) {
+                        logger.debug("Pinned item is not a message. Skipping.", getLogAttributesFromRequest(req));
+                        return;
+                    }
+                    try {
+                        await SlackReactionNoteActions.handleEmojiReaction(pinData);
+                    }
+                    catch (err) {
+                        logger.error("Error handling pinned message:", getLogAttributesFromRequest(req));
+                        logger.error(err, getLogAttributesFromRequest(req));
+                    }
+                    return;
+                }
                 // Handle reaction_added events
                 if (event["type"] === "reaction_added") {
                     logger.debug("Reaction added event received", getLogAttributesFromRequest(req));
@@ -552,49 +804,19 @@ export default class SlackAPI {
                         messageTs: (_b = event["item"]) === null || _b === void 0 ? void 0 : _b["ts"],
                     };
                     // OPTIMIZATION: Quick check if this is a supported emoji before any DB queries
-                    const isSupportedEmoji = PrivateNoteEmojis.includes(reactionData.reaction) ||
-                        PublicNoteEmojis.includes(reactionData.reaction);
-                    if (!isSupportedEmoji) {
+                    if (!WorkspaceNoteReactionUtil.isNoteReaction(reactionData.reaction)) {
                         logger.debug(`Emoji "${reactionData.reaction}" is not supported. Skipping.`, getLogAttributesFromRequest(req));
                         return;
                     }
                     /*
-                     * Process emoji reactions for Incidents, Alerts, and Scheduled Maintenance
-                     * Each handler will silently ignore if the channel is not linked to their resource type
+                     * Works out which incident, alert, scheduled maintenance or episode
+                     * the channel belongs to, then saves the message as a note there.
                      */
                     try {
-                        await SlackIncidentActions.handleEmojiReaction(reactionData);
-                    }
-                    catch (err) {
-                        logger.error("Error handling incident emoji reaction:", getLogAttributesFromRequest(req));
-                        logger.error(err, getLogAttributesFromRequest(req));
-                    }
-                    try {
-                        await SlackAlertActions.handleEmojiReaction(reactionData);
-                    }
-                    catch (err) {
-                        logger.error("Error handling alert emoji reaction:", getLogAttributesFromRequest(req));
-                        logger.error(err, getLogAttributesFromRequest(req));
-                    }
-                    try {
-                        await SlackAlertEpisodeActions.handleEmojiReaction(reactionData);
-                    }
-                    catch (err) {
-                        logger.error("Error handling alert episode emoji reaction:", getLogAttributesFromRequest(req));
-                        logger.error(err, getLogAttributesFromRequest(req));
-                    }
-                    try {
-                        await SlackIncidentEpisodeActions.handleEmojiReaction(reactionData);
-                    }
-                    catch (err) {
-                        logger.error("Error handling incident episode emoji reaction:", getLogAttributesFromRequest(req));
-                        logger.error(err, getLogAttributesFromRequest(req));
-                    }
-                    try {
-                        await SlackScheduledMaintenanceActions.handleEmojiReaction(reactionData);
+                        await SlackReactionNoteActions.handleEmojiReaction(reactionData);
                     }
                     catch (err) {
-                        logger.error("Error handling scheduled maintenance emoji reaction:", getLogAttributesFromRequest(req));
+                        logger.error("Error handling emoji reaction:", getLogAttributesFromRequest(req));
                         logger.error(err, getLogAttributesFromRequest(req));
                     }
                     return;
@@ -992,10 +1214,20 @@ export default class SlackAPI {
      * threaded / DM follow-ups context-aware.
      */
     static async getAiOpsAnswerMarkdown(data) {
-        const props = await AccessTokenService.getDatabaseCommonInteractionPropsByUserAndProject({
-            userId: data.userId,
-            projectId: data.projectId,
-        });
+        let props;
+        try {
+            props = await WorkspaceActionAuthorization.getProjectMemberProps({
+                userId: data.userId,
+                projectId: data.projectId,
+            });
+        }
+        catch (err) {
+            // A linked Slack account whose user has since left the project.
+            if (err instanceof NotAuthorizedException) {
+                return err.message;
+            }
+            throw err;
+        }
         const result = await ObservabilityAssistant.answerQuestion({
             projectId: data.projectId,
             userId: data.userId,
@@ -1096,4 +1328,16 @@ export default class SlackAPI {
         return AI_DISABLED_MESSAGE;
     }
 }
+// Generous: the server-side channel fetch caches up to ~100k channels.
+SlackAPI.MAX_CHANNEL_CACHE_ENTRIES = 100000;
+// Slack caps channel names at 80 characters.
+SlackAPI.MAX_CHANNEL_NAME_LENGTH = 255;
+// Slack channel ids are short upper-case alphanumerics, e.g. C0123456789.
+SlackAPI.CHANNEL_ID_PATTERN = /^[A-Za-z0-9]{1,64}$/;
+SlackAPI.RESERVED_CHANNEL_KEYS = [
+    "__proto__",
+    "constructor",
+    "prototype",
+];
+export default SlackAPI;
 //# sourceMappingURL=SlackAPI.js.map