@oomol-lab/open-connector 1.9.2 → 1.9.3

package/src/server/api/oauth-completion-page.js

@@ -23,6 +23,10 @@ export const oauthCompletionStrings = {
         network: "Could not reach Connect. Check your connection and try again.",
         notFound: "This request was not found or has expired. Return to the initiating client.",
         forbidden: "Synchronization was rejected. Check that OOMOL_CONNECT_ORIGIN matches your Console address.",
+        refusedBadge: "Not connected",
+        cancelledTitle: "Authorization cancelled",
+        refusedTitle: "Authorization not completed",
+        refusedBody: "Nothing was connected. Close this window to return where you started.",
     },
     "zh-CN": {
         badge: "已连接",
@@ -43,6 +47,10 @@ export const oauthCompletionStrings = {
         network: "无法连接到 Connect，请检查网络后重试。",
         notFound: "授权请求不存在或已过期，请返回发起授权的应用。",
         forbidden: "同步请求被拒绝，请检查 OOMOL_CONNECT_ORIGIN 是否与控制台地址一致。",
+        refusedBadge: "未连接",
+        cancelledTitle: "已取消授权",
+        refusedTitle: "授权未完成",
+        refusedBody: "未建立任何连接。关闭此窗口即可返回刚才的应用。",
     },
     "zh-TW": {
         badge: "已連線",
@@ -63,6 +71,10 @@ export const oauthCompletionStrings = {
         network: "無法連線至 Connect，請檢查網路後重試。",
         notFound: "授權請求不存在或已過期，請返回發起授權的應用。",
         forbidden: "同步請求遭拒，請檢查 OOMOL_CONNECT_ORIGIN 是否與控制台位址一致。",
+        refusedBadge: "未連線",
+        cancelledTitle: "已取消授權",
+        refusedTitle: "授權未完成",
+        refusedBody: "未建立任何連線。關閉此視窗即可返回剛才的應用。",
     },
     ja: {
         badge: "接続済み",
@@ -83,6 +95,10 @@ export const oauthCompletionStrings = {
         network: "Connect に接続できません。ネットワークを確認して再試行してください。",
         notFound: "リクエストが見つからないか期限切れです。元のアプリに戻ってください。",
         forbidden: "同期が拒否されました。OOMOL_CONNECT_ORIGIN とコンソールのアドレスを確認してください。",
+        refusedBadge: "未接続",
+        cancelledTitle: "認可をキャンセルしました",
+        refusedTitle: "認可は完了しませんでした",
+        refusedBody: "接続は作成されていません。このウィンドウを閉じて元のアプリに戻ってください。",
     },
     fr: {
         badge: "Connecté",
@@ -103,6 +119,10 @@ export const oauthCompletionStrings = {
         network: "Connect est inaccessible. Vérifiez votre connexion et réessayez.",
         notFound: "Cette demande est introuvable ou expirée. Revenez à l’application de départ.",
         forbidden: "Synchronisation refusée. Vérifiez que OOMOL_CONNECT_ORIGIN correspond à l’adresse de la Console.",
+        refusedBadge: "Non connecté",
+        cancelledTitle: "Autorisation annulée",
+        refusedTitle: "Autorisation non terminée",
+        refusedBody: "Aucune connexion n’a été créée. Fermez cette fenêtre pour revenir à l’application de départ.",
     },
     ru: {
         badge: "Подключено",
@@ -123,6 +143,10 @@ export const oauthCompletionStrings = {
         network: "Нет связи с Connect. Проверьте сеть и повторите попытку.",
         notFound: "Запрос не найден или истёк. Вернитесь в исходное приложение.",
         forbidden: "Синхронизация отклонена. Проверьте соответствие OOMOL_CONNECT_ORIGIN адресу консоли.",
+        refusedBadge: "Не подключено",
+        cancelledTitle: "Авторизация отменена",
+        refusedTitle: "Авторизация не завершена",
+        refusedBody: "Подключение не создано. Закройте это окно, чтобы вернуться в исходное приложение.",
     },
 };
 export const oauthCompletionStyles = `
@@ -239,6 +263,20 @@ a.button{text-decoration:none}
 export const oauthCompletionLocaleScript = `const pick=()=>{try{const stored=localStorage.getItem("oomol-connect.lang");if(Object.hasOwn(STR,stored))return stored;}catch{}const langs=navigator.languages&&navigator.languages.length?navigator.languages:[navigator.language||"en"];for(const raw of langs){const l=String(raw).toLowerCase();if(l.startsWith("zh"))return (!l.includes("hans")&&(l.includes("tw")||l.includes("hk")||l.includes("mo")||l.includes("hant")))?"zh-TW":"zh-CN";const primary=l.split("-")[0];if(STR[raw])return raw;if(STR[primary])return primary;}return "en";};`;
 /** Seconds the OAuth completion page counts down before it tries to close its window. */
 export const DEFAULT_OAUTH_CLOSE_DELAY_SECONDS = 5;
+// Shared by every page this module renders: count down, then close the window,
+// or say it can be closed when the browser refuses.
+function oauthCloseWindowScript(closeDelaySeconds) {
+    return `const note=document.querySelector("[data-close-note]");
+const button=document.querySelector("[data-t=closeButton]");
+const showManual=()=>{if(note)note.textContent=t.manualClose;};
+// window.close() only works for script-opened windows; on a tab the user
+// navigated to it is a no-op. Attempt it, then fall back to a manual hint.
+const tryClose=()=>{window.close();setTimeout(showManual,300);};
+if(button)button.addEventListener("click",tryClose);
+let remaining=${scriptJson(closeDelaySeconds)};
+const tick=()=>{if(remaining<=0){tryClose();return;}if(note)note.textContent=t.autoClose.replace("%N%",String(remaining));remaining-=1;setTimeout(tick,1000);};
+tick();`;
+}
 export function renderOAuthCompletionPage(service, closeDelaySeconds = DEFAULT_OAUTH_CLOSE_DELAY_SECONDS) {
     const payload = scriptJson({
         type: oauthCompletedType,
@@ -272,16 +310,7 @@ const t=STR[pick()]||STR.en;
 document.documentElement.lang=pick();
 for(const el of document.querySelectorAll("[data-t]")){const key=el.getAttribute("data-t");if(t[key]!=null)el.textContent=t[key];}
 if(t.title)document.title=t.title;
-const note=document.querySelector("[data-close-note]");
-const button=document.querySelector("[data-t=closeButton]");
-const showManual=()=>{if(note)note.textContent=t.manualClose;};
-// window.close() only works for script-opened windows; on a tab the user
-// navigated to it is a no-op. Attempt it, then fall back to a manual hint.
-const tryClose=()=>{window.close();setTimeout(showManual,300);};
-if(button)button.addEventListener("click",tryClose);
-let remaining=${scriptJson(closeDelaySeconds)};
-const tick=()=>{if(remaining<=0){tryClose();return;}if(note)note.textContent=t.autoClose.replace("%N%",String(remaining));remaining-=1;setTimeout(tick,1000);};
-tick();
+${oauthCloseWindowScript(closeDelaySeconds)}
 })();</script>
 </body>
 </html>`;
@@ -289,3 +318,99 @@ tick();
 function scriptJson(value) {
     return JSON.stringify(value).replaceAll("<", "\\u003c");
 }
+/** The `type` of the message a refusal page posts to the window that opened it. */
+export const oauthRefusedType = "oauth.refused";
+/**
+ * Reads the origins a refusal page may post its result to: a comma-separated
+ * list of exact HTTP(S) origins. `*` and anything that is not an origin are
+ * rejected, so the result can never be broadcast to an arbitrary opener.
+ */
+export function parseOAuthResultOrigins(value) {
+    return normalizeOAuthResultOrigins((value ?? "").split(","));
+}
+/**
+ * The same rules for origins given as a list, such as the `oauthResultOrigins`
+ * runtime option: blank entries are skipped and duplicates dropped; anything
+ * that is not an exact http(s) origin, `*` included, throws.
+ */
+export function normalizeOAuthResultOrigins(entries) {
+    const origins = [];
+    for (const raw of entries) {
+        const entry = raw.trim().replace(/\/+$/, "");
+        if (!entry)
+            continue;
+        let origin;
+        try {
+            const url = new URL(entry);
+            if (url.protocol === "http:" || url.protocol === "https:")
+                origin = url.origin;
+        }
+        catch {
+            origin = undefined;
+        }
+        if (origin !== entry) {
+            throw new Error(`OAuth result origin "${entry}" must be an exact http(s) origin such as https://console.example.com.`);
+        }
+        if (!origins.includes(origin))
+            origins.push(origin);
+    }
+    return origins;
+}
+/** A provider error code that is safe to echo: short and code-shaped, else `provider_error`. */
+export function oauthProviderErrorCode(providerError) {
+    return /^[A-Za-z0-9_.-]{1,64}$/.test(providerError) ? providerError : "provider_error";
+}
+/**
+ * The page a provider's refusal lands on when the authorization has no return
+ * address. When this window was opened by a page on an allowed origin, it
+ * posts `{ type: "oauth.refused", status, code, state }` to that origin only;
+ * either way the shared countdown closes it after `closeDelaySeconds`. Success is never
+ * reported this way: the opener learns it from its own server.
+ */
+export function renderOAuthRefusedPage(input) {
+    const closeDelaySeconds = input.closeDelaySeconds ?? DEFAULT_OAUTH_CLOSE_DELAY_SECONDS;
+    const cancelled = input.code === "access_denied";
+    const titleKey = cancelled ? "cancelledTitle" : "refusedTitle";
+    const strings = oauthCompletionStrings.en;
+    const result = {
+        type: oauthRefusedType,
+        status: cancelled ? "cancelled" : "error",
+        code: input.code,
+        state: input.state,
+    };
+    const codeLine = cancelled ? "" : `\n    <p><code>${input.code}</code></p>`;
+    const postScript = input.resultOrigins.length > 0 && input.state
+        ? `if(window.opener){const result=${scriptJson(result)};for(const origin of ${scriptJson(input.resultOrigins)}){try{window.opener.postMessage(result,origin);}catch{}}}\n`
+        : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${strings[titleKey]}</title>
+<style>${oauthCompletionStyles}</style>
+</head>
+<body>
+<main class="card" role="status" aria-live="polite">
+  <div class="header">
+    <span class="badge" data-t="refusedBadge">${strings.refusedBadge}</span>
+    <h1 data-t="${titleKey}">${strings[titleKey]}</h1>
+    <p data-t="refusedBody">${strings.refusedBody}</p>${codeLine}
+  </div>
+  <div class="actions">
+    <button class="button" type="button" data-t="closeButton">${strings.closeButton}</button>
+    <p class="close-note" data-close-note>${strings.autoClose.replace("%N%", String(closeDelaySeconds))}</p>
+  </div>
+</main>
+<script>(()=>{
+${postScript}const STR=${scriptJson(oauthCompletionStrings)};
+${oauthCompletionLocaleScript}
+const t=STR[pick()]||STR.en;
+document.documentElement.lang=pick();
+for(const el of document.querySelectorAll("[data-t]")){const key=el.getAttribute("data-t");if(t[key]!=null)el.textContent=t[key];}
+if(t[${scriptJson(titleKey)}])document.title=t[${scriptJson(titleKey)}];
+${oauthCloseWindowScript(closeDelaySeconds)}
+})();</script>
+</body>
+</html>`;
+}

package/src/server/api/openapi.d.ts

@@ -14,6 +14,11 @@ export type OpenApiDocument = {
     }>;
     paths: Record<string, unknown>;
     components: {
+        securitySchemes: Record<string, {
+            type: "http";
+            scheme: "bearer";
+            description: string;
+        }>;
         schemas: Record<string, JsonSchema>;
     };
 };

package/src/server/api/openapi.js

@@ -43,7 +43,7 @@ const actionFailureMetaSchema = jsonSchema.object({
 const oauthClientConfigRequestSchema = jsonSchema.object({
     clientId: jsonSchema.string({ description: "OAuth app client id." }),
     clientSecret: jsonSchema.string({
-        description: "OAuth app client secret. Optional only for public-client providers.",
+        description: "OAuth app client secret. When updating the default app with the same clientId, omission preserves the stored secret. Required for a new confidential client.",
     }),
     requestedScopes: jsonSchema.array(jsonSchema.string(), {
         minItems: 1,
@@ -285,6 +285,59 @@ export function createOpenApiDocument(providers, options = {}) {
             parameters: [{ name: "service", in: "path", required: true, schema: jsonSchema.string() }],
             errorStatuses: [401, 404],
         }),
+        "/v1/providers/slackbot/events/verify": {
+            post: {
+                tags: ["Triggers"],
+                summary: "Verify an inbound Slack Events API request.",
+                description: "Requires the dedicated OOMOL_CONNECT_EVENT_VERIFY_TOKEN. The raw Slack request body is verified against the deployment-default slackbot OAuth client configuration, not a connection-specific configuration; no event is stored or scheduled.",
+                security: [{ eventVerificationToken: [] }],
+                parameters: [
+                    {
+                        name: "x-slack-request-timestamp",
+                        in: "header",
+                        required: true,
+                        schema: jsonSchema.string(),
+                    },
+                    { name: "x-slack-signature", in: "header", required: true, schema: jsonSchema.string() },
+                ],
+                requestBody: {
+                    required: true,
+                    content: {
+                        "application/json": { schema: { type: "object", additionalProperties: true } },
+                        "application/x-www-form-urlencoded": {
+                            schema: {
+                                type: "object",
+                                properties: {
+                                    payload: {
+                                        type: "string",
+                                        description: "URL-encoded JSON block_actions interaction payload.",
+                                    },
+                                },
+                                required: ["payload"],
+                            },
+                        },
+                    },
+                },
+                responses: {
+                    200: jsonResponse(runtimeSuccessSchema({
+                        type: "object",
+                        properties: {
+                            valid: { type: "boolean", const: true },
+                            appId: { type: "string" },
+                            challenge: jsonSchema.nullableString("Challenge value returned for Slack URL verification."),
+                        },
+                        required: ["valid", "appId", "challenge"],
+                    })),
+                    400: jsonResponse(runtimeFailureSchema(), "invalid_event_payload: invalid JSON or unsupported Slack envelope."),
+                    401: jsonResponse(runtimeFailureSchema(), "unauthorized, invalid_webhook_signature, or invalid_webhook_timestamp."),
+                    403: jsonResponse(runtimeFailureSchema(), "webhook_app_mismatch."),
+                    404: jsonResponse(runtimeFailureSchema(), "event_verification_disabled: no dedicated verification token is configured."),
+                    409: jsonResponse(runtimeFailureSchema(), "event_verification_not_configured: default Slack App ID or Signing Secret is missing."),
+                    413: jsonResponse(runtimeFailureSchema(), "webhook_request_too_large: the Slack request body exceeds 64 KiB."),
+                    500: jsonResponse(runtimeFailureSchema(), "Internal verification failure."),
+                },
+            },
+        },
         "/v1/providers/{service}/triggers/{triggerId}/execute": {
             post: {
                 tags: ["Triggers"],
@@ -369,6 +422,13 @@ export function createOpenApiDocument(providers, options = {}) {
         ],
         paths,
         components: {
+            securitySchemes: {
+                eventVerificationToken: {
+                    type: "http",
+                    scheme: "bearer",
+                    description: "Dedicated OOMOL_CONNECT_EVENT_VERIFY_TOKEN; admin and runtime tokens are not accepted.",
+                },
+            },
             schemas: {
                 ActionDefinition: jsonSchema.unknownObject("Public action catalog definition with runtime execution status."),
                 LocalAuthSession: jsonSchema.object({
@@ -1238,7 +1298,7 @@ function createOAuthConfigPath() {
         put: {
             tags: ["OAuth"],
             summary: "Upsert local OAuth client configuration.",
-            description: "Open-source users provide their own OAuth app. requestedScopes replaces the default scope list with an explicit selection from the provider's scopes and optionalScopes; default scopes are not added automatically. Omit it to use the defaults without optional scopes. Undeclared scopes are refused. Additional extra fields are declared by provider catalog auth metadata.",
+            description: "Open-source users provide their own OAuth app. requestedScopes replaces the default scope list with an explicit selection from the provider's scopes and optionalScopes; default scopes are not added automatically. Omit it to use the defaults without optional scopes. Undeclared scopes are refused. Additional extra fields are declared by provider catalog auth metadata. For the same clientId, omitted clientSecret and omitted secretExtra keys retain saved secrets. Explicit empty secretExtra values clear optional secrets. Changing clientId requires new secrets.",
             requestBody: {
                 required: true,
                 content: {

package/src/server/api/runtime-api.d.ts

@@ -1,5 +1,6 @@
 import type { RuntimeActionDefinition, RuntimeProviderDefinition } from "../../catalog-store.ts";
-import type { ConnectionError, ConnectionSummary, ManagedConnectionSummary } from "../../connection-service.ts";
+import type { ConnectionError } from "../../connection-error.ts";
+import type { ConnectionSummary, ManagedConnectionSummary } from "../../connection-service.ts";
 import type { ProviderAuthSetup } from "../../core/provider-setup.ts";
 import type { ExecutionResult, ProviderScenario } from "../../core/types.ts";
 import type { OAuthClientConfigSummary } from "../../oauth/oauth-client-config-service.ts";

package/src/server/api/runtime-app-routes.js

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { ConnectionError } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
 import { mapConnectionErrorStatus, serializeRuntimeConnectedApp, writeRuntimeFailure, writeRuntimeSuccess, } from "./runtime-api.js";
 function filterAllowedConnections(policy, connections) {
     return connections.filter((connection) => connection.authType === "no_auth" || policy.evaluateConnection(connection.id).allowed);

package/src/server/api/runtime-execution-routes.js

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
-import { ConnectionError, defaultConnectionName } from "../../connection-service.js";
+import { ConnectionError } from "../../connection-error.js";
+import { defaultConnectionName } from "../../connection-service.js";
 import { optionalString } from "../../core/cast.js";
 import { ActionInputDepthError, createIdempotencyExpiry, hashActionRequest, hashIdempotencyKey, readIdempotencyKey, } from "../actions/action-idempotency.js";
 import { readRuntimeGrant } from "./auth.js";

package/src/server/connect-app.d.ts

@@ -1,6 +1,7 @@
 import type { CatalogStore } from "../catalog-store.ts";
 import type { ActionPolicyService } from "../core/action-policy.ts";
 import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
+import type { ProviderNetworkPolicy } from "../core/provider-network-policy.ts";
 import type { RuntimeLogger, TransitFileUpload } from "../core/types.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
 import type { RuntimeJwtVerifier } from "./api/runtime-jwt.ts";
@@ -11,6 +12,7 @@ import type { Hono } from "hono";
 import { SaasCleanupService } from "../saas/saas-cleanup-service.ts";
 import { TriggerMaintenance } from "../triggers/maintenance.ts";
 export interface ConnectAppOptions {
+    network?: ProviderNetworkPolicy;
     catalog: CatalogStore;
     providerLoader: IProviderLoader;
     providerHttpDispatch?: ProviderHttpDispatchOptions;
@@ -22,6 +24,7 @@ export interface ConnectAppOptions {
     secretCodec: ISecretCodec;
     adminToken?: string;
     runtimeToken?: string;
+    eventVerifyToken?: string;
     requireRuntimeAuth?: boolean;
     allowedCustomOAuth?: string[];
     verifyRuntimeJwt?: RuntimeJwtVerifier;
@@ -32,6 +35,7 @@ export interface ConnectAppOptions {
     compressApiResponses?: boolean;
     serveDocumentation?: boolean;
     oauthCloseDelaySeconds?: number;
+    oauthResultOrigins?: string[];
 }
 export interface ConnectApp {
     saasCleanup: SaasCleanupService;

package/src/server/connect-app.js

@@ -1,5 +1,6 @@
 import { ConnectionService } from "../connection-service.js";
 import { ActionPolicyService as ExecutionPolicyService } from "../core/action-policy.js";
+import { withProviderNetworkPolicy } from "../core/provider-network-policy.js";
 import { MarketplaceService } from "../marketplace/marketplace-service.js";
 import { OAuthClientConfigService } from "../oauth/oauth-client-config-service.js";
 import { OAuthCredentialRefreshService } from "../oauth/oauth-credential-refresh-service.js";
@@ -12,9 +13,14 @@ import { SaasProjectService } from "../saas/saas-project-service.js";
 import { TriggerMaintenance } from "../triggers/maintenance.js";
 import { TriggerRunner } from "../triggers/trigger-runner.js";
 import { ActionRunner } from "./actions/action-runner.js";
+import { normalizeOAuthResultOrigins } from "./api/oauth-completion-page.js";
 import { ConnectServer } from "./connect-server.js";
 import { RuntimeTokenService } from "./storage/runtime-token-service.js";
 export async function createConnectApp(options) {
+    const network = Object.freeze({
+        allowPrivateNetwork: options.network?.allowPrivateNetwork ?? false,
+        trustedHosts: Object.freeze([...(options.network?.trustedHosts ?? [])]),
+    });
     const saasClient = new SaasClient();
     const saasProject = new SaasProjectService({
         catalog: options.catalog,
@@ -34,7 +40,7 @@ export async function createConnectApp(options) {
         store: options.runtimeDatabase.marketplaceStore,
         secretCodec: options.secretCodec,
     });
-    await marketplace.initialize();
+    await withProviderNetworkPolicy(network, () => marketplace.initialize());
     const runtimeTokens = new RuntimeTokenService(options.runtimeDatabase.runtimeTokenStore, options.logger);
     const hasStoredRuntimeTokens = async () => (await runtimeTokens.listTokens()).length > 0;
     const allowedCustomOAuth = new Set(options.allowedCustomOAuth);
@@ -74,6 +80,7 @@ export async function createConnectApp(options) {
         store: options.runtimeDatabase.triggerStore,
     });
     const triggerMaintenance = new TriggerMaintenance({
+        network,
         store: options.runtimeDatabase.triggerStore,
         runner: triggers,
         tokens: options.runtimeDatabase.runtimeTokenStore,
@@ -84,12 +91,14 @@ export async function createConnectApp(options) {
     return {
         triggerMaintenance,
         saasCleanup: new SaasCleanupService({
+            network,
             store: options.runtimeDatabase.saasProjectStore,
             requests: options.runtimeDatabase.connectionRequestStore,
             client: saasClient,
             logger: options.logger,
         }),
         app: new ConnectServer({
+            network,
             providerHttpDispatch: options.providerHttpDispatch,
             catalog: options.catalog,
             publicOrigin: options.publicOrigin,
@@ -115,6 +124,7 @@ export async function createConnectApp(options) {
             runtimeTokens,
             runtimePolicyStore: options.runtimeDatabase.runtimePolicyStore,
             registerStaticRoutes: options.registerStaticRoutes,
+            eventVerifyToken: options.eventVerifyToken,
             auth: {
                 adminToken: options.adminToken,
                 runtimeToken: options.runtimeToken,
@@ -132,6 +142,9 @@ export async function createConnectApp(options) {
             compressApiResponses: options.compressApiResponses,
             serveDocumentation: options.serveDocumentation,
             oauthCloseDelaySeconds: options.oauthCloseDelaySeconds,
+            // Validated here as well as where the environment is read, so a host
+            // that passes the option directly gets the same refusal of `*`.
+            oauthResultOrigins: normalizeOAuthResultOrigins(options.oauthResultOrigins ?? []),
         }).createApp(),
         runtimeAuthConfigured: Boolean(options.requireRuntimeAuth) ||
             Boolean(options.runtimeToken) ||

package/src/server/connect-server.d.ts

@@ -2,6 +2,7 @@ import type { CatalogStore } from "../catalog-store.ts";
 import type { ConnectionService } from "../connection-service.ts";
 import type { ActionSearchIndexProvider } from "../core/action-search.ts";
 import type { ProviderHttpDispatchOptions } from "../core/provider-http-dispatch.ts";
+import type { ProviderNetworkPolicy } from "../core/provider-network-policy.ts";
 import type { RuntimeLogger, TransitFileUpload } from "../core/types.ts";
 import type { MarketplaceService } from "../marketplace/marketplace-service.ts";
 import type { OAuthClientConfigService } from "../oauth/oauth-client-config-service.ts";
@@ -30,6 +31,7 @@ export declare function preloadOptionalServerModules(): Promise<void>;
  * Dependencies required to construct the local connector server.
  */
 export interface IConnectServerOptions {
+    network?: ProviderNetworkPolicy;
     providerHttpDispatch?: ProviderHttpDispatchOptions;
     catalog: CatalogStore;
     /** Public origin of this runtime, used for the HTTP request examples in Action guides. */
@@ -46,6 +48,8 @@ export interface IConnectServerOptions {
     transitFiles: ITransitFileService;
     uploadTransitFile?: (request: Request) => Promise<TransitFileUpload>;
     auth?: LocalAuthOptions;
+    /** Dedicated token for inbound provider event verification. */
+    eventVerifyToken?: string;
     actionPolicy?: ActionPolicyService;
     runtimePolicyStore: IRuntimePolicyStore;
     actionSearch?: ActionSearchIndexProvider;
@@ -55,6 +59,8 @@ export interface IConnectServerOptions {
     serveDocumentation?: boolean;
     /** Seconds the OAuth completion page waits before closing its window. `0` closes it as soon as it loads. */
     oauthCloseDelaySeconds?: number;
+    /** Origins a provider-refusal page may post its result to (`OOMOL_CONNECT_OAUTH_RESULT_ORIGINS`). */
+    oauthResultOrigins?: readonly string[];
     marketplace?: MarketplaceService;
     saasProject?: SaasProjectService;
     saas?: SaasExecutionService;

package/src/server/connect-server.js

@@ -4,6 +4,7 @@ import { ActionPolicyService } from "../core/action-policy.js";
 import { createActionSearchIndexProvider } from "../core/action-search.js";
 import { optionalRecord } from "../core/cast.js";
 import { withProviderHttpDispatch } from "../core/provider-http-dispatch.js";
+import { withProviderNetworkPolicy } from "../core/provider-network-policy.js";
 import { ProviderDispatchRequestError, toProviderExecutionError } from "../providers/provider-runtime.js";
 import { SaasError } from "../saas/saas-client.js";
 import { ActionRunner } from "./actions/action-runner.js";
@@ -28,6 +29,7 @@ import { createSaasProjectRoutes } from "./api/saas-project-routes.js";
 import { createTransitFileRoutes } from "./api/transit-file-routes.js";
 import { createTriggerRoutes } from "./api/trigger-routes.js";
 import { ProxyRunner } from "./proxy/proxy-runner.js";
+import { readSlackEventRequestBody, verifySlackEventRequest } from "./slack-event-verification.js";
 /**
  * Import and evaluate the modules the /mcp and /docs routes defer to their first request. The Node server never
  * calls this, so its startup graph stays small; Cloudflare Workers call it at app creation so an isolate keeps
@@ -68,7 +70,7 @@ export class ConnectServer {
         const app = new Hono();
         const auth = this.options.auth ?? {};
         app.use("*", async (_context, next) => {
-            await withProviderHttpDispatch({ operation: "runtime" }, next, this.options.providerHttpDispatch);
+            await withProviderNetworkPolicy(this.options.network ?? {}, () => withProviderHttpDispatch({ operation: "runtime" }, next, this.options.providerHttpDispatch));
         });
         app.use("*", async (context, next) => {
             await next();
@@ -92,6 +94,84 @@ export class ConnectServer {
             app.use("/api/*", compress());
         }
         app.use("*", createLocalAuthMiddleware(auth));
+        // Inbound provider event verification. This route authenticates with a dedicated token
+        // so a host ingress can delegate signature verification without receiving the admin token.
+        app.post("/v1/providers/slackbot/events/verify", async (context) => {
+            const expected = this.options.eventVerifyToken?.trim();
+            if (!expected)
+                return writeRuntimeFailure(context, {
+                    status: 404,
+                    errorCode: "event_verification_disabled",
+                    message: "Event verification is disabled.",
+                });
+            const authorization = context.req.header("authorization") ?? "";
+            const provided = authorization.startsWith("Bearer ") ? authorization.slice(7).trim() : "";
+            if (!(await sameSecret(provided, expected)))
+                return writeRuntimeFailure(context, {
+                    status: 401,
+                    errorCode: "unauthorized",
+                    message: "A valid event verification token is required.",
+                });
+            const config = await this.options.oauthClientConfigs.getConfig("slackbot");
+            const appId = String(config?.extra?.appId ?? "").trim();
+            const signingSecret = String(config?.secretExtra?.signingSecret ?? "").trim();
+            if (!appId || !signingSecret)
+                return writeRuntimeFailure(context, {
+                    status: 409,
+                    errorCode: "event_verification_not_configured",
+                    message: "Configure the default Slack App ID and Signing Secret.",
+                });
+            const rawBody = await readSlackEventRequestBody(context.req.raw);
+            if (!rawBody)
+                return writeRuntimeFailure(context, {
+                    status: 413,
+                    errorCode: "webhook_request_too_large",
+                    message: "Slack request body exceeds 64 KiB.",
+                });
+            const result = await verifySlackEventRequest({
+                timestamp: context.req.header("x-slack-request-timestamp") ?? "",
+                signature: context.req.header("x-slack-signature") ?? "",
+                rawBody,
+                configuredAppId: appId,
+                signingSecret,
+                contentType: context.req.header("content-type") ?? "",
+            });
+            if (!result.valid) {
+                switch (result.reason) {
+                    case "body_too_large":
+                        return writeRuntimeFailure(context, {
+                            status: 413,
+                            errorCode: "webhook_request_too_large",
+                            message: "Slack request body exceeds 64 KiB.",
+                        });
+                    case "payload":
+                        return writeRuntimeFailure(context, {
+                            status: 400,
+                            errorCode: "invalid_event_payload",
+                            message: "Invalid Slack event envelope.",
+                        });
+                    case "app":
+                        return writeRuntimeFailure(context, {
+                            status: 403,
+                            errorCode: "webhook_app_mismatch",
+                            message: "Slack App ID does not match the configured application.",
+                        });
+                    case "timestamp":
+                        return writeRuntimeFailure(context, {
+                            status: 401,
+                            errorCode: "invalid_webhook_timestamp",
+                            message: "Invalid or expired Slack request timestamp.",
+                        });
+                    case "signature":
+                        return writeRuntimeFailure(context, {
+                            status: 401,
+                            errorCode: "invalid_webhook_signature",
+                            message: "Invalid Slack request signature.",
+                        });
+                }
+            }
+            return writeRuntimeSuccess(context, result);
+        });
         // Health and runtime discovery / execution endpoints
         app.get("/v1/health", (context) => writeRuntimeSuccess(context, { ok: true, runtime: "oomol-connect" }));
         app.route("/v1", createRuntimeCatalogRoutes({
@@ -162,7 +242,10 @@ export class ConnectServer {
             app.route("/api", createSaasProjectRoutes({ saasProject: saas }));
         }
         if (saas && this.options.saasOAuth) {
-            app.route("/", createSaasOAuthRoutes({ saasProject: saas, saasOAuth: this.options.saasOAuth }));
+            app.route("/", createSaasOAuthRoutes({
+                saasProject: saas,
+                saasOAuth: this.options.saasOAuth,
+            }));
         }
         app.route("/", createConsoleOAuthRoutes({
             connections: this.options.connections,
@@ -171,6 +254,7 @@ export class ConnectServer {
             saasProject: this.options.saasProject,
             logger: this.options.logger,
             oauthCloseDelaySeconds: this.options.oauthCloseDelaySeconds,
+            oauthResultOrigins: this.options.oauthResultOrigins,
         }));
         // Without a console the API owns every unknown path; a console host layers its fallback over these 404s.
         if (this.options.registerStaticRoutes)
@@ -202,8 +286,18 @@ export class ConnectServer {
                 if (error.retryAfter)
                     context.header("Retry-After", error.retryAfter);
                 if (context.req.path.startsWith("/v1/"))
-                    return writeRuntimeFailure(context, { status: error.status, errorCode: error.code, message: error.message });
-                return context.json({ error: { code: error.code, message: error.message, reason: error.reason } }, error.status);
+                    return writeRuntimeFailure(context, {
+                        status: error.status,
+                        errorCode: error.code,
+                        message: error.message,
+                    });
+                return context.json({
+                    error: {
+                        code: error.code,
+                        message: error.message,
+                        reason: error.reason,
+                    },
+                }, error.status);
             }
             if (error instanceof HttpRequestError) {
                 if (context.req.path.startsWith("/v1/")) {
@@ -232,3 +326,19 @@ export class ConnectServer {
         return app;
     }
 }
+/** Hash both values before a constant-time comparison so length never leaks. */
+async function sameSecret(provided, expected) {
+    if (!provided || !expected)
+        return false;
+    const encoder = new TextEncoder();
+    const [left, right] = await Promise.all([
+        crypto.subtle.digest("SHA-256", encoder.encode(provided)),
+        crypto.subtle.digest("SHA-256", encoder.encode(expected)),
+    ]);
+    const a = new Uint8Array(left);
+    const b = new Uint8Array(right);
+    let difference = 0;
+    for (let index = 0; index < a.length; index += 1)
+        difference |= a[index] ^ b[index];
+    return difference === 0;
+}