@opengeni/contracts 0.31.1 → 0.35.0

package/dist/chunk-7JZMI22I.js

@@ -0,0 +1,126 @@
+// src/slack-bot-scopes.ts
+var OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [
+  "app_mentions:read",
+  "canvases:read",
+  "channels:history",
+  "channels:read",
+  "chat:write",
+  "commands",
+  "files:read",
+  "groups:history",
+  "groups:read",
+  "im:history",
+  "im:read",
+  "im:write",
+  "mpim:history",
+  "mpim:read",
+  "users:read"
+];
+var OPENGENI_SLACK_REACTION_REQUIRED_SCOPE = "reactions:read";
+var OPENGENI_SLACK_BOT_REQUESTED_SCOPES = [
+  ...OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE
+];
+var OPENGENI_SLACK_BOT_EVENTS = [
+  "app_mention",
+  "message.channels",
+  "message.groups",
+  "message.im",
+  "message.mpim",
+  "reaction_added"
+];
+var OPENGENI_MANAGED_PUBLIC_BASE_URL = "https://app.opengeni.ai";
+function normalizedSlackManifestBaseUrl(publicBaseUrl) {
+  const parsed = new URL(publicBaseUrl);
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
+    throw new Error("Slack bot manifest public base URL must be credential-free HTTPS");
+  }
+  parsed.hash = "";
+  parsed.search = "";
+  parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+  return parsed.toString().replace(/\/$/, "");
+}
+function buildOpenGeniSlackBotManifest(publicBaseUrl) {
+  const baseUrl = normalizedSlackManifestBaseUrl(publicBaseUrl);
+  return {
+    display_information: { name: "OpenGeni" },
+    features: {
+      bot_user: { display_name: "OpenGeni", always_online: false },
+      slash_commands: [
+        {
+          command: "/opengeni",
+          description: "Start an OpenGeni task in this channel",
+          should_escape: false,
+          url: `${baseUrl}/v1/integrations/slack/commands`
+        }
+      ],
+      shortcuts: [
+        {
+          callback_id: "opengeni_message",
+          description: "Start an OpenGeni task from this Slack message",
+          name: "Open in OpenGeni",
+          type: "message"
+        }
+      ]
+    },
+    oauth_config: {
+      redirect_urls: [
+        `${baseUrl}/v1/integrations/oauth/callback`,
+        `${baseUrl}/v1/integrations/slack/callback`
+      ],
+      scopes: { bot: [...OPENGENI_SLACK_BOT_REQUESTED_SCOPES] }
+    },
+    settings: {
+      event_subscriptions: {
+        bot_events: [...OPENGENI_SLACK_BOT_EVENTS],
+        request_url: `${baseUrl}/v1/integrations/slack/events`
+      },
+      interactivity: {
+        is_enabled: true,
+        request_url: `${baseUrl}/v1/integrations/slack/interactions`
+      },
+      org_deploy_enabled: false,
+      socket_mode_enabled: false,
+      token_rotation_enabled: false
+    }
+  };
+}
+var OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [
+  "team:read",
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE
+];
+var OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = ["channels:join", "chat:write.public"];
+function isOpenGeniSlackBotScopeAllowed(scope) {
+  return OPENGENI_SLACK_BOT_REQUIRED_SCOPES.includes(scope) || OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES.includes(scope);
+}
+function areOpenGeniSlackBotScopesAccepted(grantedScopes) {
+  return OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => grantedScopes.includes(scope)) && grantedScopes.every(isOpenGeniSlackBotScopeAllowed);
+}
+function hasOpenGeniSlackReactionScope(grantedScopes) {
+  return grantedScopes.includes(OPENGENI_SLACK_REACTION_REQUIRED_SCOPE);
+}
+function evaluateOpenGeniSlackBotScopes(grantedScopes) {
+  const granted = new Set(grantedScopes);
+  const missingRequired = OPENGENI_SLACK_BOT_REQUIRED_SCOPES.filter((scope) => !granted.has(scope));
+  const unsupported = [...granted].filter((scope) => !isOpenGeniSlackBotScopeAllowed(scope)).sort();
+  return {
+    accepted: areOpenGeniSlackBotScopesAccepted(grantedScopes),
+    missingRequired,
+    unsupported
+  };
+}
+
+export {
+  OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,
+  OPENGENI_SLACK_BOT_REQUESTED_SCOPES,
+  OPENGENI_SLACK_BOT_EVENTS,
+  OPENGENI_MANAGED_PUBLIC_BASE_URL,
+  buildOpenGeniSlackBotManifest,
+  OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES,
+  OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES,
+  areOpenGeniSlackBotScopesAccepted,
+  hasOpenGeniSlackReactionScope,
+  evaluateOpenGeniSlackBotScopes
+};
+//# sourceMappingURL=chunk-7JZMI22I.js.map

package/dist/chunk-7JZMI22I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/slack-bot-scopes.ts"],"sourcesContent":["export const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [\n  \"app_mentions:read\",\n  \"canvases:read\",\n  \"channels:history\",\n  \"channels:read\",\n  \"chat:write\",\n  \"commands\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"im:write\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"users:read\",\n] as const;\n\n/** Read-only scope needed only for the optional emoji-reaction summon surface. */\nexport const OPENGENI_SLACK_REACTION_REQUIRED_SCOPE = \"reactions:read\" as const;\n\n/**\n * Scopes requested by the managed and generated self-hosted manifests.\n *\n * `reactions:read` is deliberately not part of the base eligibility contract:\n * legacy installations may continue using existing Slack interactions and\n * tools while the reaction setting stays disabled and the UI asks an admin to\n * reinstall.\n */\nexport const OPENGENI_SLACK_BOT_REQUESTED_SCOPES = [\n  ...OPENGENI_SLACK_BOT_REQUIRED_SCOPES,\n  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,\n] as const;\n\nexport const OPENGENI_SLACK_BOT_EVENTS = [\n  \"app_mention\",\n  \"message.channels\",\n  \"message.groups\",\n  \"message.im\",\n  \"message.mpim\",\n  \"reaction_added\",\n] as const;\n\nexport const OPENGENI_MANAGED_PUBLIC_BASE_URL = \"https://app.opengeni.ai\" as const;\n\nfunction normalizedSlackManifestBaseUrl(publicBaseUrl: string): string {\n  const parsed = new URL(publicBaseUrl);\n  if (parsed.protocol !== \"https:\" || parsed.username || parsed.password) {\n    throw new Error(\"Slack bot manifest public base URL must be credential-free HTTPS\");\n  }\n  parsed.hash = \"\";\n  parsed.search = \"\";\n  parsed.pathname = parsed.pathname.replace(/\\/+$/, \"\");\n  return parsed.toString().replace(/\\/$/, \"\");\n}\n\n/** Canonical managed/self-hosted Slack app manifest. Slack accepts JSON manifests. */\nexport function buildOpenGeniSlackBotManifest(publicBaseUrl: string) {\n  const baseUrl = normalizedSlackManifestBaseUrl(publicBaseUrl);\n  return {\n    display_information: { name: \"OpenGeni\" },\n    features: {\n      bot_user: { display_name: \"OpenGeni\", always_online: false },\n      slash_commands: [\n        {\n          command: \"/opengeni\",\n          description: \"Start an OpenGeni task in this channel\",\n          should_escape: false,\n          url: `${baseUrl}/v1/integrations/slack/commands`,\n        },\n      ],\n      shortcuts: [\n        {\n          callback_id: \"opengeni_message\",\n          description: \"Start an OpenGeni task from this Slack message\",\n          name: \"Open in OpenGeni\",\n          type: \"message\",\n        },\n      ],\n    },\n    oauth_config: {\n      redirect_urls: [\n        `${baseUrl}/v1/integrations/oauth/callback`,\n        `${baseUrl}/v1/integrations/slack/callback`,\n      ],\n      scopes: { bot: [...OPENGENI_SLACK_BOT_REQUESTED_SCOPES] },\n    },\n    settings: {\n      event_subscriptions: {\n        bot_events: [...OPENGENI_SLACK_BOT_EVENTS],\n        request_url: `${baseUrl}/v1/integrations/slack/events`,\n      },\n      interactivity: {\n        is_enabled: true,\n        request_url: `${baseUrl}/v1/integrations/slack/interactions`,\n      },\n      org_deploy_enabled: false,\n      socket_mode_enabled: false,\n      token_rotation_enabled: false,\n    },\n  } as const;\n}\n\n/**\n * Optional bot grants that remain inside the shipped bot's read/identity\n * boundary. Every other unrequired scope fails closed, including unknown future\n * Slack scopes, so verification, core routing, and UI eligibility cannot drift.\n */\nexport const OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [\n  \"team:read\",\n  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,\n] as const;\n\n/** @deprecated Use evaluateOpenGeniSlackBotScopes; an allowlist is the policy. */\nexport const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = [\"channels:join\", \"chat:write.public\"] as const;\n\nexport type OpenGeniSlackBotScopePolicy = {\n  accepted: boolean;\n  missingRequired: string[];\n  unsupported: string[];\n};\n\nfunction isOpenGeniSlackBotScopeAllowed(scope: string): boolean {\n  return (\n    (OPENGENI_SLACK_BOT_REQUIRED_SCOPES as readonly string[]).includes(scope) ||\n    (OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES as readonly string[]).includes(scope)\n  );\n}\n\nexport function areOpenGeniSlackBotScopesAccepted(grantedScopes: readonly string[]): boolean {\n  return (\n    OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => grantedScopes.includes(scope)) &&\n    grantedScopes.every(isOpenGeniSlackBotScopeAllowed)\n  );\n}\n\nexport function hasOpenGeniSlackReactionScope(grantedScopes: readonly string[]): boolean {\n  return grantedScopes.includes(OPENGENI_SLACK_REACTION_REQUIRED_SCOPE);\n}\n\nexport function evaluateOpenGeniSlackBotScopes(\n  grantedScopes: readonly string[],\n): OpenGeniSlackBotScopePolicy {\n  const granted = new Set(grantedScopes);\n  const missingRequired = OPENGENI_SLACK_BOT_REQUIRED_SCOPES.filter((scope) => !granted.has(scope));\n  const unsupported = [...granted].filter((scope) => !isOpenGeniSlackBotScopeAllowed(scope)).sort();\n  return {\n    accepted: areOpenGeniSlackBotScopesAccepted(grantedScopes),\n    missingRequired,\n    unsupported,\n  };\n}\n"],"mappings":";AAAO,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,yCAAyC;AAU/C,IAAM,sCAAsC;AAAA,EACjD,GAAG;AAAA,EACH;AACF;AAEO,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,mCAAmC;AAEhD,SAAS,+BAA+B,eAA+B;AACrE,QAAM,SAAS,IAAI,IAAI,aAAa;AACpC,MAAI,OAAO,aAAa,YAAY,OAAO,YAAY,OAAO,UAAU;AACtE,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO,OAAO;AACd,SAAO,SAAS;AAChB,SAAO,WAAW,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACpD,SAAO,OAAO,SAAS,EAAE,QAAQ,OAAO,EAAE;AAC5C;AAGO,SAAS,8BAA8B,eAAuB;AACnE,QAAM,UAAU,+BAA+B,aAAa;AAC5D,SAAO;AAAA,IACL,qBAAqB,EAAE,MAAM,WAAW;AAAA,IACxC,UAAU;AAAA,MACR,UAAU,EAAE,cAAc,YAAY,eAAe,MAAM;AAAA,MAC3D,gBAAgB;AAAA,QACd;AAAA,UACE,SAAS;AAAA,UACT,aAAa;AAAA,UACb,eAAe;AAAA,UACf,KAAK,GAAG,OAAO;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,GAAG,OAAO;AAAA,QACV,GAAG,OAAO;AAAA,MACZ;AAAA,MACA,QAAQ,EAAE,KAAK,CAAC,GAAG,mCAAmC,EAAE;AAAA,IAC1D;AAAA,IACA,UAAU;AAAA,MACR,qBAAqB;AAAA,QACnB,YAAY,CAAC,GAAG,yBAAyB;AAAA,QACzC,aAAa,GAAG,OAAO;AAAA,MACzB;AAAA,MACA,eAAe;AAAA,QACb,YAAY;AAAA,QACZ,aAAa,GAAG,OAAO;AAAA,MACzB;AAAA,MACA,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,IAC1B;AAAA,EACF;AACF;AAOO,IAAM,0CAA0C;AAAA,EACrD;AAAA,EACA;AACF;AAGO,IAAM,sCAAsC,CAAC,iBAAiB,mBAAmB;AAQxF,SAAS,+BAA+B,OAAwB;AAC9D,SACG,mCAAyD,SAAS,KAAK,KACvE,wCAA8D,SAAS,KAAK;AAEjF;AAEO,SAAS,kCAAkC,eAA2C;AAC3F,SACE,mCAAmC,MAAM,CAAC,UAAU,cAAc,SAAS,KAAK,CAAC,KACjF,cAAc,MAAM,8BAA8B;AAEtD;AAEO,SAAS,8BAA8B,eAA2C;AACvF,SAAO,cAAc,SAAS,sCAAsC;AACtE;AAEO,SAAS,+BACd,eAC6B;AAC7B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,kBAAkB,mCAAmC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC;AAChG,QAAM,cAAc,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,+BAA+B,KAAK,CAAC,EAAE,KAAK;AAChG,SAAO;AAAA,IACL,UAAU,kCAAkC,aAAa;AAAA,IACzD;AAAA,IACA;AAAA,EACF;AACF;","names":[]}