@opengeni/api-router 0.14.4 → 0.15.4

package/src/integrations/slack-bot.ts

@@ -96,10 +96,14 @@ export async function exchangeOpenGeniSlackAuthorizationCode(
       signal: AbortSignal.timeout(SLACK_TIMEOUT_MS),
     });
   } catch {
-    throw new HTTPException(502, { message: "Slack installation token exchange failed" });
+    throw new HTTPException(502, {
+      message: "Slack installation token exchange failed",
+    });
   }
   if (!response.ok) {
-    throw new HTTPException(502, { message: "Slack installation token exchange failed" });
+    throw new HTTPException(502, {
+      message: "Slack installation token exchange failed",
+    });
   }
   const payload = await readResponseJsonBounded<unknown>(
     response,
@@ -112,7 +116,9 @@ export async function exchangeOpenGeniSlackAuthorizationCode(
   }
   const accessToken = slackString(record.access_token);
   if (!accessToken?.startsWith("xoxb-")) {
-    throw new HTTPException(502, { message: "Slack installation did not return a bot token" });
+    throw new HTTPException(502, {
+      message: "Slack installation did not return a bot token",
+    });
   }
   return accessToken;
 }
@@ -147,7 +153,10 @@ type SlackBotContext = {
 };
 
 export class SlackBotProviderError extends Error {
-  constructor(readonly code: string) {
+  constructor(
+    readonly code: string,
+    readonly retryAfterMs: number | null = null,
+  ) {
     super(`Slack bot request failed: ${safeSlackCode(code)}`);
     this.name = "SlackBotProviderError";
   }
@@ -342,6 +351,11 @@ export class OpenGeniSlackBotClient {
     });
   }
 
+  async verifyChannelAccess(channelId: string) {
+    const headers = await this.headersFor("channel_history.read");
+    return await this.requireMemberChannel(headers, channelId);
+  }
+
   async channelHistory(input: { channelId: string; limit?: number; cursor?: string }) {
     return await this.withAudit("channel_history.read", async (headers) => {
       const info = await this.requireMemberChannel(headers, input.channelId);
@@ -484,7 +498,9 @@ export class OpenGeniSlackBotClient {
       const headers = await this.headersFor(operation);
       let channelId = input.channelId;
       if (input.userId) {
-        const opened = await this.call(headers, "conversations.open", { users: input.userId });
+        const opened = await this.call(headers, "conversations.open", {
+          users: input.userId,
+        });
         channelId = requiredSlackString(slackRecord(opened.channel)?.id, "channel.id");
       } else if (channelId) {
         await this.requireMemberChannel(headers, channelId);
@@ -704,7 +720,10 @@ export class OpenGeniSlackBotClient {
       `${SLACK_API_BASE}chat.getPermalink`,
     );
     try {
-      await this.call(headers, "chat.getPermalink", { channel: channelId, message_ts: timestamp });
+      await this.call(headers, "chat.getPermalink", {
+        channel: channelId,
+        message_ts: timestamp,
+      });
       return true;
     } catch (error) {
       if (error instanceof SlackBotProviderError && error.code === "message_not_found") {
@@ -715,9 +734,14 @@ export class OpenGeniSlackBotClient {
   }
 
   private async requireMemberChannel(headers: Record<string, string>, channelId: string) {
-    const payload = await this.call(headers, "conversations.info", { channel: channelId });
+    const payload = await this.call(headers, "conversations.info", {
+      channel: channelId,
+    });
     const projected = projectChannel(payload.channel);
-    if (!projected || projected.isMember !== true) {
+    // Slack omits `is_member` for a bot's one-to-one App Home conversation.
+    // A successful conversations.info response with `is_im` is itself proof
+    // that this installation can address that direct conversation.
+    if (!projected || (projected.isMember !== true && projected.isDirectMessage !== true)) {
       throw new SlackBotProviderError("not_in_channel");
     }
     return projected;
@@ -946,7 +970,10 @@ export class OpenGeniSlackBotClient {
   }
 
   private completedDeleteResult(
-    operation: { slackChannelId: string | null; slackMessageTimestamp: string | null },
+    operation: {
+      slackChannelId: string | null;
+      slackMessageTimestamp: string | null;
+    },
     operationId: string,
   ) {
     if (!operation.slackChannelId || !operation.slackMessageTimestamp) {
@@ -1008,9 +1035,15 @@ export class OpenGeniSlackBotClient {
       return { type: "subject", id: this.context.subjectId };
     }
     if (this.context.scheduledTaskId) {
-      return { type: "service", id: `scheduler:${this.context.scheduledTaskId}` };
+      return {
+        type: "service",
+        id: `scheduler:${this.context.scheduledTaskId}`,
+      };
     }
-    return { type: "service", id: `session:${this.context.sessionId ?? "workspace"}` };
+    return {
+      type: "service",
+      id: `session:${this.context.sessionId ?? "workspace"}`,
+    };
   }
 
   private fileListPage(input: {
@@ -1020,13 +1053,19 @@ export class OpenGeniSlackBotClient {
   }): SlackFilesListPage {
     const key = environmentsEncryptionKeyBytes(this.settings);
     if (!key) throw new Error("connection encryption is not configured");
-    return resolveSlackFilesListPage(input, { connectionId: this.connection.id, key });
+    return resolveSlackFilesListPage(input, {
+      connectionId: this.connection.id,
+      key,
+    });
   }
 
   private fileListCursor(input: { channelId: string; count: number; page: number }): string {
     const key = environmentsEncryptionKeyBytes(this.settings);
     if (!key) throw new Error("connection encryption is not configured");
-    return createSlackFilesListCursor(input, { connectionId: this.connection.id, key });
+    return createSlackFilesListCursor(input, {
+      connectionId: this.connection.id,
+      key,
+    });
   }
 
   private async recordAudit(
@@ -1076,6 +1115,42 @@ export function createOpenGeniSlackBotClient(
   );
 }
 
+export async function createOpenGeniSlackBotInteractionClient(
+  deps: { db: Database; settings: Settings; slackFetch?: typeof fetch },
+  input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    subjectId: string;
+    sessionId?: string | null;
+  },
+): Promise<OpenGeniSlackBotClient> {
+  const connection = await requireOpenGeniSlackBotConnection(
+    deps.db,
+    input.workspaceId,
+    input.connectionId,
+  );
+  if (connection.accountId !== input.accountId) {
+    throw new Error("OpenGeni Slack bot connection tenant mismatch");
+  }
+  const metadata = openGeniSlackBotMetadata(connection.metadata);
+  if (!metadata) throw new Error("OpenGeni Slack bot connection metadata is invalid");
+  return new OpenGeniSlackBotClient(
+    deps.db,
+    deps.settings,
+    connection,
+    metadata,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      sessionId: input.sessionId ?? null,
+      scheduledTaskId: null,
+    },
+    deps.slackFetch,
+  );
+}
+
 async function slackApiFetch(
   fetchImpl: FetchLike,
   method: string,
@@ -1117,8 +1192,9 @@ async function slackApiFetchWithHeaders(
     throw new SlackBotProviderError("transport_error");
   }
   if (!response.ok) {
+    const retryAfterMs = slackRetryAfterMs(response);
     await response.body?.cancel().catch(() => undefined);
-    throw new SlackBotProviderError(`http_${response.status}`);
+    throw new SlackBotProviderError(`http_${response.status}`, retryAfterMs);
   }
   let payload: SlackPayload;
   try {
@@ -1136,6 +1212,15 @@ async function slackApiFetchWithHeaders(
   return { response, payload };
 }
 
+function slackRetryAfterMs(response: Response): number | null {
+  if (response.status !== 429) return null;
+  const raw = response.headers.get("retry-after");
+  if (!raw || !/^\d+$/.test(raw)) return null;
+  const seconds = Number(raw);
+  if (!Number.isSafeInteger(seconds) || seconds < 1) return null;
+  return Math.min(seconds, 3_600) * 1_000;
+}
+
 function assertOpenGeniSlackBotScopes(grantedScopes: string[]): void {
   const policy = evaluateOpenGeniSlackBotScopes(grantedScopes);
   if (!policy.accepted) {
@@ -1176,6 +1261,7 @@ function projectChannel(value: unknown) {
     name: boundedSlackString(channel.name, 256),
     isPrivate: channel.is_private === true,
     isMember: channel.is_member === true,
+    isDirectMessage: channel.is_im === true,
     isArchived: channel.is_archived === true,
     topic: boundedSlackString(slackRecord(channel.topic)?.value, 1_024),
     purpose: boundedSlackString(slackRecord(channel.purpose)?.value, 1_024),