@opengeni/api-router 0.14.4 → 0.15.1

package/src/app.ts

@@ -68,11 +68,13 @@ import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
 import { registerWorkspaceInstructionPolicyRoutes } from "./routes/workspace-instruction-policies";
 import { registerWorkspaceStateRoutes } from "./routes/workspace-state";
+import { registerWorkspaceArtifactRoutes } from "./routes/workspace-artifacts";
 import { registerPreferenceRegistryRoutes } from "./routes/preference-registry";
 import { registerInsightsRoutes } from "./routes/insights";
 import { registerTranscriptionRoutes } from "./routes/transcriptions";
 import { projectClientModel } from "./model-catalog";
 import { createTranscriptionService } from "./transcription/service";
+import { registerSlackInteractionRoutes } from "./integrations/slack-interactions";
 
 export type {
   ApiRouteDeps,
@@ -104,6 +106,13 @@ export function apiRequestBodyLimitBytes(settings: { voiceInputMaxSizeBytes: num
 const API_PUBLIC_ERROR_MESSAGE_MAX_BYTES = 512;
 
 export function createApp(deps: AppDependencies): Hono {
+  return createAppComposition(deps).app;
+}
+
+export function createAppComposition(deps: AppDependencies): {
+  app: Hono;
+  routeDeps: ApiRouteDeps;
+} {
   const managedAuth = deps.managedAuth ?? createManagedAuth(deps.settings, deps.db);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
@@ -186,28 +195,34 @@ export function createApp(deps: AppDependencies): Hono {
     await next();
   });
 
-  app.use(
-    "*",
-    cors({
-      credentials: true,
-      allowHeaders: [
-        "Accept",
-        "Authorization",
-        "Content-Type",
-        "X-OpenGeni-Access-Key",
-        "X-OpenGeni-Api-Contract",
-        "X-OpenGeni-Correlation-Id",
-        "X-OpenGeni-Subject",
-      ],
-      exposeHeaders: ["X-OpenGeni-Api-Contract", "X-OpenGeni-Correlation-Id"],
-      origin: (origin) => {
-        if (!origin) {
-          return null;
-        }
-        return allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null;
-      },
-    }),
-  );
+  const corsHeaders = {
+    allowHeaders: [
+      "Accept",
+      "Authorization",
+      "Content-Type",
+      "X-OpenGeni-Access-Key",
+      "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Subject",
+    ],
+    exposeHeaders: ["X-OpenGeni-Api-Contract", "X-OpenGeni-Correlation-Id"],
+  };
+  const publicApiCors = cors({ ...corsHeaders, credentials: false, origin: "*" });
+  const credentialedCors = cors({
+    ...corsHeaders,
+    credentials: true,
+    origin: (origin) =>
+      allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null,
+  });
+
+  app.use("*", (c, next) => {
+    const origin = c.req.header("origin");
+    const middleware =
+      origin && allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin)
+        ? credentialedCors
+        : publicApiCors;
+    return middleware(c, next);
+  });
 
   app.use(
     "*",
@@ -392,7 +407,9 @@ export function createApp(deps: AppDependencies): Hono {
       boundedRequest = await boundedMcpRequest(c.req.raw);
     } catch (error) {
       if (error instanceof McpPayloadTooLargeError) {
-        throw new HTTPException(413, { message: "MCP request body exceeds the safety limit" });
+        throw new HTTPException(413, {
+          message: "MCP request body exceeds the safety limit",
+        });
       }
       throw error;
     }
@@ -414,7 +431,9 @@ export function createApp(deps: AppDependencies): Hono {
           throw new HTTPException(404, { message: "session not found" });
         }
         if (error instanceof SessionAuthorizationUnavailableError) {
-          throw new HTTPException(503, { message: "session authorization is unavailable" });
+          throw new HTTPException(503, {
+            message: "session authorization is unavailable",
+          });
         }
         throw error;
       }
@@ -422,10 +441,15 @@ export function createApp(deps: AppDependencies): Hono {
     let toolspace: Awaited<ReturnType<typeof prepareToolspaceMcpSurface>> = null;
     if (toolspaceGrant) {
       try {
-        toolspace = await prepareToolspaceMcpSurface({ deps: routeDeps, grant });
+        toolspace = await prepareToolspaceMcpSurface({
+          deps: routeDeps,
+          grant,
+        });
       } catch (error) {
         if (error instanceof McpPayloadTooLargeError) {
-          throw new HTTPException(413, { message: "MCP tool list exceeds the safety limit" });
+          throw new HTTPException(413, {
+            message: "MCP tool list exceeds the safety limit",
+          });
         }
         throw error;
       }
@@ -458,6 +482,7 @@ export function createApp(deps: AppDependencies): Hono {
   registerInsightsRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
+  registerWorkspaceArtifactRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
@@ -472,6 +497,7 @@ export function createApp(deps: AppDependencies): Hono {
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
+  registerSlackInteractionRoutes(app, routeDeps);
 
   app.notFound((c) => {
     if (!new URL(c.req.url).pathname.startsWith("/v1/")) return c.text("Not Found", 404);
@@ -513,7 +539,7 @@ export function createApp(deps: AppDependencies): Hono {
     return c.json(envelope, status as ContentfulStatusCode);
   });
 
-  return app;
+  return { app, routeDeps };
 }
 
 async function requireMcpAccessGrant(
@@ -694,7 +720,9 @@ async function runReadinessChecks<const Checks extends Readonly<Record<string, R
       }
     }),
   );
-  const result = Object.fromEntries(entries) as { [Name in keyof Checks]: ReadinessCheckResult };
+  const result = Object.fromEntries(entries) as {
+    [Name in keyof Checks]: ReadinessCheckResult;
+  };
   return {
     ok: Object.values(result).every((check) => check.ok),
     checks: result,
@@ -1122,6 +1150,9 @@ export function isApiContractProtectedMutation(method: string, pathname: string)
     pathname.startsWith("/v1/auth/") ||
     pathname.startsWith("/v1/webhooks/") ||
     pathname.startsWith("/v1/integrations/oauth/") ||
+    pathname === "/v1/integrations/slack/events" ||
+    pathname === "/v1/integrations/slack/commands" ||
+    pathname === "/v1/integrations/slack/interactions" ||
     pathname.startsWith("/v1/github/") ||
     pathname === "/v1/enrollments/device/start" ||
     pathname === "/v1/enrollments/device/poll" ||

package/src/http/auth.ts

@@ -50,7 +50,10 @@ function isAuthExempt(c: Context, settings: Settings): boolean {
   if (
     path === "/v1/integrations/oauth/callback" ||
     path === "/v1/integrations/oauth/client-metadata.json" ||
-    path === "/v1/integrations/slack/callback"
+    path === "/v1/integrations/slack/callback" ||
+    path === "/v1/integrations/slack/events" ||
+    path === "/v1/integrations/slack/commands" ||
+    path === "/v1/integrations/slack/interactions"
   ) {
     return true;
   }

package/src/index.ts

@@ -30,10 +30,11 @@ import {
   WorkflowExecutionAlreadyStartedError,
 } from "@temporalio/client";
 import type { ScheduleOptions, ScheduleSpec, ScheduleUpdateOptions } from "@temporalio/client";
-import { createApp, type DocumentIndexClient, type SessionWorkflowClient } from "./app";
+import { createAppComposition, type DocumentIndexClient, type SessionWorkflowClient } from "./app";
 import { observabilityEventLogger } from "./observability";
 import { startAuthCalloutResponder } from "./sandbox/auth-callout";
 import { startHelloIngestion, startMetricsIngestion } from "./sandbox/metrics-ingestion";
+import { startSlackInteractionPump } from "./integrations/slack-interactions";
 
 /**
  * A REJECT_DUPLICATE start collides on the deterministic workflowId when the
@@ -310,7 +311,7 @@ export async function startApi() {
     await dbClient.close();
     throw new Error("OpenGeni API startup dependencies were not initialized");
   }
-  const app = createApp({
+  const { app, routeDeps } = createAppComposition({
     settings,
     db: dbClient.db,
     bus,
@@ -327,6 +328,9 @@ export async function startApi() {
     idleTimeout: 255,
     fetch: app.fetch,
   });
+  const stopSlackInteractionPump = settings.slackSigningSecret
+    ? startSlackInteractionPump(routeDeps)
+    : undefined;
   // M10 — start the metrics-ingestion consumer (agent heartbeats → DB last-sample
   // + downsampled series), gated on the selfhosted flag. A no-op when disabled.
   let stopMetricsIngestion: (() => void) | undefined;
@@ -342,8 +346,16 @@ export async function startApi() {
   // user), separate from the privileged control-plane bus.
   let authCalloutResponder: ResponderConnection | undefined;
   if (settings.sandboxSelfhostedEnabled) {
-    stopMetricsIngestion = startMetricsIngestion({ db: dbClient.db, bus, observability });
-    stopHelloIngestion = startHelloIngestion({ db: dbClient.db, bus, observability });
+    stopMetricsIngestion = startMetricsIngestion({
+      db: dbClient.db,
+      bus,
+      observability,
+    });
+    stopHelloIngestion = startHelloIngestion({
+      db: dbClient.db,
+      bus,
+      observability,
+    });
     observability.info("OpenGeni machine-metrics + hello ingestion consumers started", {});
 
     const callout = resolveNatsCalloutConfig(settings);
@@ -375,6 +387,7 @@ export async function startApi() {
     server,
     close: async () => {
       server.stop(true);
+      stopSlackInteractionPump?.();
       stopMetricsIngestion?.();
       stopHelloIngestion?.();
       await Promise.allSettled([

package/src/integrations/slack-bot.ts

@@ -96,10 +96,14 @@ export async function exchangeOpenGeniSlackAuthorizationCode(
       signal: AbortSignal.timeout(SLACK_TIMEOUT_MS),
     });
   } catch {
-    throw new HTTPException(502, { message: "Slack installation token exchange failed" });
+    throw new HTTPException(502, {
+      message: "Slack installation token exchange failed",
+    });
   }
   if (!response.ok) {
-    throw new HTTPException(502, { message: "Slack installation token exchange failed" });
+    throw new HTTPException(502, {
+      message: "Slack installation token exchange failed",
+    });
   }
   const payload = await readResponseJsonBounded<unknown>(
     response,
@@ -112,7 +116,9 @@ export async function exchangeOpenGeniSlackAuthorizationCode(
   }
   const accessToken = slackString(record.access_token);
   if (!accessToken?.startsWith("xoxb-")) {
-    throw new HTTPException(502, { message: "Slack installation did not return a bot token" });
+    throw new HTTPException(502, {
+      message: "Slack installation did not return a bot token",
+    });
   }
   return accessToken;
 }
@@ -342,6 +348,11 @@ export class OpenGeniSlackBotClient {
     });
   }
 
+  async verifyChannelAccess(channelId: string) {
+    const headers = await this.headersFor("channel_history.read");
+    return await this.requireMemberChannel(headers, channelId);
+  }
+
   async channelHistory(input: { channelId: string; limit?: number; cursor?: string }) {
     return await this.withAudit("channel_history.read", async (headers) => {
       const info = await this.requireMemberChannel(headers, input.channelId);
@@ -484,7 +495,9 @@ export class OpenGeniSlackBotClient {
       const headers = await this.headersFor(operation);
       let channelId = input.channelId;
       if (input.userId) {
-        const opened = await this.call(headers, "conversations.open", { users: input.userId });
+        const opened = await this.call(headers, "conversations.open", {
+          users: input.userId,
+        });
         channelId = requiredSlackString(slackRecord(opened.channel)?.id, "channel.id");
       } else if (channelId) {
         await this.requireMemberChannel(headers, channelId);
@@ -704,7 +717,10 @@ export class OpenGeniSlackBotClient {
       `${SLACK_API_BASE}chat.getPermalink`,
     );
     try {
-      await this.call(headers, "chat.getPermalink", { channel: channelId, message_ts: timestamp });
+      await this.call(headers, "chat.getPermalink", {
+        channel: channelId,
+        message_ts: timestamp,
+      });
       return true;
     } catch (error) {
       if (error instanceof SlackBotProviderError && error.code === "message_not_found") {
@@ -715,7 +731,9 @@ export class OpenGeniSlackBotClient {
   }
 
   private async requireMemberChannel(headers: Record<string, string>, channelId: string) {
-    const payload = await this.call(headers, "conversations.info", { channel: channelId });
+    const payload = await this.call(headers, "conversations.info", {
+      channel: channelId,
+    });
     const projected = projectChannel(payload.channel);
     if (!projected || projected.isMember !== true) {
       throw new SlackBotProviderError("not_in_channel");
@@ -946,7 +964,10 @@ export class OpenGeniSlackBotClient {
   }
 
   private completedDeleteResult(
-    operation: { slackChannelId: string | null; slackMessageTimestamp: string | null },
+    operation: {
+      slackChannelId: string | null;
+      slackMessageTimestamp: string | null;
+    },
     operationId: string,
   ) {
     if (!operation.slackChannelId || !operation.slackMessageTimestamp) {
@@ -1008,9 +1029,15 @@ export class OpenGeniSlackBotClient {
       return { type: "subject", id: this.context.subjectId };
     }
     if (this.context.scheduledTaskId) {
-      return { type: "service", id: `scheduler:${this.context.scheduledTaskId}` };
+      return {
+        type: "service",
+        id: `scheduler:${this.context.scheduledTaskId}`,
+      };
     }
-    return { type: "service", id: `session:${this.context.sessionId ?? "workspace"}` };
+    return {
+      type: "service",
+      id: `session:${this.context.sessionId ?? "workspace"}`,
+    };
   }
 
   private fileListPage(input: {
@@ -1020,13 +1047,19 @@ export class OpenGeniSlackBotClient {
   }): SlackFilesListPage {
     const key = environmentsEncryptionKeyBytes(this.settings);
     if (!key) throw new Error("connection encryption is not configured");
-    return resolveSlackFilesListPage(input, { connectionId: this.connection.id, key });
+    return resolveSlackFilesListPage(input, {
+      connectionId: this.connection.id,
+      key,
+    });
   }
 
   private fileListCursor(input: { channelId: string; count: number; page: number }): string {
     const key = environmentsEncryptionKeyBytes(this.settings);
     if (!key) throw new Error("connection encryption is not configured");
-    return createSlackFilesListCursor(input, { connectionId: this.connection.id, key });
+    return createSlackFilesListCursor(input, {
+      connectionId: this.connection.id,
+      key,
+    });
   }
 
   private async recordAudit(
@@ -1076,6 +1109,42 @@ export function createOpenGeniSlackBotClient(
   );
 }
 
+export async function createOpenGeniSlackBotInteractionClient(
+  deps: { db: Database; settings: Settings; slackFetch?: typeof fetch },
+  input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    subjectId: string;
+    sessionId?: string | null;
+  },
+): Promise<OpenGeniSlackBotClient> {
+  const connection = await requireOpenGeniSlackBotConnection(
+    deps.db,
+    input.workspaceId,
+    input.connectionId,
+  );
+  if (connection.accountId !== input.accountId) {
+    throw new Error("OpenGeni Slack bot connection tenant mismatch");
+  }
+  const metadata = openGeniSlackBotMetadata(connection.metadata);
+  if (!metadata) throw new Error("OpenGeni Slack bot connection metadata is invalid");
+  return new OpenGeniSlackBotClient(
+    deps.db,
+    deps.settings,
+    connection,
+    metadata,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      sessionId: input.sessionId ?? null,
+      scheduledTaskId: null,
+    },
+    deps.slackFetch,
+  );
+}
+
 async function slackApiFetch(
   fetchImpl: FetchLike,
   method: string,