@shipfox/api-integration-slack 4.0.0 → 6.0.0

package/drizzle/0001_dark_tyrannus.sql

@@ -0,0 +1 @@
+ALTER TABLE "integrations_slack_installations" ADD COLUMN "generation" integer DEFAULT 1 NOT NULL;

package/drizzle/meta/0001_snapshot.json

@@ -0,0 +1,139 @@
+{
+  "id": "5acf9796-7da0-4134-b7f8-000a1a5a7de0",
+  "prevId": "62801d4c-2399-4306-8d37-9773d10cbb02",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.integrations_slack_installations": {
+      "name": "integrations_slack_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "uuidv7()"
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_name": {
+          "name": "team_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "app_id": {
+          "name": "app_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_user_id": {
+          "name": "bot_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "token_expires_at": {
+          "name": "token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "integrations_slack_installations_connection_unique": {
+          "name": "integrations_slack_installations_connection_unique",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "integrations_slack_installations_team_unique": {
+          "name": "integrations_slack_installations_team_unique",
+          "columns": [
+            {
+              "expression": "team_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/drizzle/meta/_journal.json

@@ -8,6 +8,13 @@
       "when": 1784372558063,
       "tag": "0000_calm_fantastic_four",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1784407778470,
+      "tag": "0001_dark_tyrannus",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-integration-slack",
   "license": "MIT",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -13,56 +13,46 @@
   "types": "dist/index.d.ts",
   "imports": {
     "#test/*": "./test/*",
-    "#*": {
-      "workspace-source": "./src/*",
-      "development": "./src/*",
-      "default": "./dist/*"
-    }
+    "#*": "./dist/*"
   },
   "exports": {
     ".": {
-      "development": {
-        "types": "./src/index.ts",
-        "default": "./src/index.ts"
-      },
-      "default": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      }
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
   "dependencies": {
     "drizzle-orm": "^0.45.2",
     "ky": "^2.0.0",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "3.0.0",
-    "@shipfox/api-integration-core-dto": "3.0.0",
-    "@shipfox/config": "1.2.1",
-    "@shipfox/api-integration-slack-dto": "4.0.0",
-    "@shipfox/api-workspaces": "4.0.0",
-    "@shipfox/node-drizzle": "0.3.0",
-    "@shipfox/node-fastify": "0.2.2",
-    "@shipfox/node-opentelemetry": "0.5.1",
-    "@shipfox/node-postgres": "0.4.1"
-  },
-  "peerDependencies": {
-    "@shipfox/api-secrets": "4.0.0"
+    "@shipfox/api-auth-context": "6.0.0",
+    "@shipfox/api-integration-core-dto": "6.0.0",
+    "@shipfox/api-integration-slack-dto": "6.0.0",
+    "@shipfox/api-workspaces-dto": "6.0.0",
+    "@shipfox/config": "1.2.2",
+    "@shipfox/inter-module": "0.2.0",
+    "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-fastify": "0.2.4",
+    "@shipfox/node-opentelemetry": "0.5.2",
+    "@shipfox/node-postgres": "0.4.2"
   },
   "devDependencies": {
     "@types/pg": "^8.15.5",
     "drizzle-kit": "^0.31.10",
     "fastify": "^5.3.3",
     "fishery": "^2.4.0",
-    "@shipfox/swc": "1.2.5",
-    "@shipfox/biome": "1.8.1",
+    "@shipfox/biome": "1.8.2",
+    "@shipfox/depcruise": "1.0.2",
+    "@shipfox/swc": "1.2.6",
     "@shipfox/ts-config": "1.3.8",
-    "@shipfox/typescript": "1.1.6",
-    "@shipfox/vitest": "1.2.2"
+    "@shipfox/typescript": "1.1.7",
+    "@shipfox/vitest": "1.2.3"
   },
   "scripts": {
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/api/client.test.ts

@@ -217,6 +217,30 @@ describe('createSlackApiClient', () => {
     expect(options.body.has('latest')).toBe(false);
   });
 
+  it('normalizes a trailing slash in the Slack API base URL', async () => {
+    vi.stubEnv('SLACK_API_BASE_URL', 'http://127.0.0.1:0/');
+    vi.resetModules();
+    mocks.post.mockReturnValue(resolves({ok: true}));
+    try {
+      const {createSlackApiClient: createClient} = await import('./client.js');
+
+      await createClient().callMethod({
+        method: 'conversations.replies',
+        token: 'xoxb-secret',
+        arguments: {channel: 'C123', ts: '1721300000.000001'},
+      });
+
+      expect(mocks.post).toHaveBeenCalledWith('http://127.0.0.1:0/conversations.replies', {
+        headers: {authorization: 'Bearer xoxb-secret'},
+        body: new URLSearchParams({channel: 'C123', ts: '1721300000.000001'}),
+        timeout: 10_000,
+      });
+    } finally {
+      vi.unstubAllEnvs();
+      vi.resetModules();
+    }
+  });
+
   it.each([
     [httpError(429, {'retry-after': '17'}), 'rate-limited', 17],
     [httpError(413), 'content-too-large', undefined],

package/src/api/client.ts

@@ -8,6 +8,7 @@ import {
 } from '#core/errors.js';
 
 const SLACK_API_TIMEOUT_MS = 10_000;
+const trailingSlashesPattern = /\/+$/;
 
 export interface SlackAuthorization {
   accessToken: string;
@@ -232,7 +233,8 @@ function slackMethodArguments(input: Record<string, unknown>): URLSearchParams {
 }
 
 function slackApiUrl(path: string): string {
-  return new URL(path, `${config.SLACK_API_BASE_URL}/`).toString();
+  const baseUrl = config.SLACK_API_BASE_URL.replace(trailingSlashesPattern, '');
+  return new URL(path, `${baseUrl}/`).toString();
 }
 
 function retryAfterSeconds(headers: Headers): number | undefined {

package/src/core/disconnect.test.ts

@@ -0,0 +1,96 @@
+import {disconnectSlackInstallation} from './disconnect.js';
+
+vi.mock('#db/installations.js', () => ({
+  deleteSlackInstallationByConnectionId: vi.fn(() => Promise.resolve(true)),
+}));
+
+const {deleteSlackInstallationByConnectionId} = await import('#db/installations.js');
+const deleteSlackInstallationByConnectionIdMock = vi.mocked(deleteSlackInstallationByConnectionId);
+
+describe('disconnectSlackInstallation', () => {
+  beforeEach(() => {
+    deleteSlackInstallationByConnectionIdMock.mockClear();
+    deleteSlackInstallationByConnectionIdMock.mockResolvedValue(true);
+  });
+
+  it('deletes stored tokens before deleting connection records', async () => {
+    const tx = Symbol('tx');
+    const calls: string[] = [];
+    const deleteSecrets = vi.fn(() => {
+      calls.push('secrets');
+      return Promise.resolve(1);
+    });
+    const deleteConnection = vi.fn(() => {
+      calls.push('connection');
+      return Promise.resolve(true);
+    });
+
+    await disconnectSlackInstallation({
+      connectionId: 'connection-1',
+      getConnection: vi.fn(() => Promise.resolve({workspaceId: 'workspace-1'})),
+      deleteSecrets,
+      transaction: async (fn) => await fn(tx),
+      deleteConnection,
+    });
+
+    expect(deleteSecrets).toHaveBeenCalledWith({
+      workspaceId: 'workspace-1',
+      namespace: 'system/integrations/slack/connection-1',
+    });
+    expect(deleteSlackInstallationByConnectionIdMock).toHaveBeenCalledWith('connection-1', {tx});
+    expect(deleteConnection).toHaveBeenCalledWith({connectionId: 'connection-1'}, {tx});
+    expect(calls).toEqual(['secrets', 'connection']);
+    expect(deleteSecrets.mock.invocationCallOrder[0]).toBeLessThan(
+      deleteSlackInstallationByConnectionIdMock.mock.invocationCallOrder[0] ?? 0,
+    );
+    expect(deleteSlackInstallationByConnectionIdMock.mock.invocationCallOrder[0]).toBeLessThan(
+      deleteConnection.mock.invocationCallOrder[0] ?? 0,
+    );
+  });
+
+  it('keeps connection records when secret deletion fails', async () => {
+    const transaction = vi.fn();
+    const deleteConnection = vi.fn();
+
+    const run = disconnectSlackInstallation({
+      connectionId: 'connection-1',
+      getConnection: vi.fn(() => Promise.resolve({workspaceId: 'workspace-1'})),
+      deleteSecrets: vi.fn(() => Promise.reject(new Error('secret store unavailable'))),
+      transaction,
+      deleteConnection,
+    });
+
+    await expect(run).rejects.toThrow('secret store unavailable');
+    expect(transaction).not.toHaveBeenCalled();
+    expect(deleteSlackInstallationByConnectionIdMock).not.toHaveBeenCalled();
+    expect(deleteConnection).not.toHaveBeenCalled();
+  });
+
+  it('retries idempotent secret deletion after the records transaction fails', async () => {
+    const tx = Symbol('tx');
+    const deleteSecrets = vi.fn(() => Promise.resolve(0));
+    const deleteConnection = vi.fn(() => Promise.resolve(true));
+    const transaction = vi
+      .fn()
+      .mockImplementationOnce(async (fn: (value: symbol) => Promise<unknown>) => {
+        await fn(tx);
+        throw new Error('database commit failed');
+      })
+      .mockImplementationOnce(async (fn: (value: symbol) => Promise<unknown>) => await fn(tx));
+    const params = {
+      connectionId: 'connection-1',
+      getConnection: vi.fn(() => Promise.resolve({workspaceId: 'workspace-1'})),
+      deleteSecrets,
+      transaction,
+      deleteConnection,
+    };
+
+    const firstAttempt = disconnectSlackInstallation(params);
+    await expect(firstAttempt).rejects.toThrow('database commit failed');
+    await disconnectSlackInstallation(params);
+
+    expect(deleteSecrets).toHaveBeenCalledTimes(2);
+    expect(deleteSlackInstallationByConnectionIdMock).toHaveBeenCalledTimes(2);
+    expect(deleteConnection).toHaveBeenCalledTimes(2);
+  });
+});

package/src/core/signature.test.ts

@@ -3,11 +3,11 @@ import {verifySlackSignature} from './signature.js';
 
 const secret = 'test-signing-secret';
 const timestamp = '1721300000';
-const rawBody = '{"type":"event_callback"}';
+const rawBody = Buffer.from('{"type":"event_callback"}');
 const now = Number(timestamp) * 1000;
 
 function signature(body = rawBody): string {
-  return `v0=${createHmac('sha256', secret).update(`v0:${timestamp}:${body}`).digest('hex')}`;
+  return `v0=${createHmac('sha256', secret).update(`v0:${timestamp}:`).update(body).digest('hex')}`;
 }
 
 describe('verifySlackSignature', () => {
@@ -24,7 +24,7 @@ describe('verifySlackSignature', () => {
   });
 
   it.each([
-    ['a tampered body', {rawBody: '{"type":"tampered"}'}],
+    ['a tampered body', {rawBody: Buffer.from('{"type":"tampered"}')}],
     ['a missing signature', {signature: undefined}],
     ['an empty signing secret', {signingSecret: ''}],
     ['a missing timestamp', {timestamp: undefined}],

package/src/core/signature.ts

@@ -6,11 +6,25 @@ export interface VerifySlackSignatureParams {
   signingSecret: string;
   signature: string | undefined;
   timestamp: string | undefined;
-  rawBody: string;
+  rawBody: Uint8Array;
   now?: number | undefined;
   replayWindowMs?: number | undefined;
 }
 
+export function isSlackTimestampWithinReplayWindow(
+  timestamp: string,
+  now = Date.now(),
+  replayWindowMs = 300_000,
+): boolean {
+  if (!unixTimestampPattern.test(timestamp)) return false;
+
+  const timestampSeconds = Number(timestamp);
+  if (!Number.isSafeInteger(timestampSeconds)) return false;
+  const timestampMilliseconds = timestampSeconds * 1000;
+  if (!Number.isSafeInteger(timestampMilliseconds)) return false;
+  return Math.abs(now - timestampMilliseconds) <= replayWindowMs;
+}
+
 export function verifySlackSignature({
   signingSecret,
   signature,
@@ -19,18 +33,14 @@ export function verifySlackSignature({
   now = Date.now(),
   replayWindowMs = 300_000,
 }: VerifySlackSignatureParams): boolean {
-  if (!signingSecret || !signature || !timestamp || !unixTimestampPattern.test(timestamp)) {
+  if (!signingSecret || !signature || !timestamp) {
     return false;
   }
-
-  const timestampSeconds = Number(timestamp);
-  if (!Number.isSafeInteger(timestampSeconds)) return false;
-  const timestampMilliseconds = timestampSeconds * 1000;
-  if (!Number.isSafeInteger(timestampMilliseconds)) return false;
-  if (Math.abs(now - timestampMilliseconds) > replayWindowMs) return false;
+  if (!isSlackTimestampWithinReplayWindow(timestamp, now, replayWindowMs)) return false;
 
   const expected = `v0=${createHmac('sha256', signingSecret)
-    .update(`v0:${timestamp}:${rawBody}`)
+    .update(`v0:${timestamp}:`)
+    .update(rawBody)
     .digest('hex')}`;
   const expectedBuffer = Buffer.from(expected, 'utf8');
   const receivedBuffer = Buffer.from(signature, 'utf8');

package/src/core/tokens.test.ts

@@ -9,8 +9,8 @@ import {
 
 let slackSecrets: SlackSecretsStore;
 
-beforeAll(async () => {
-  slackSecrets = await import('@shipfox/api-secrets');
+beforeEach(() => {
+  slackSecrets = createInMemorySecretsStore();
 });
 
 function createConnectionContext() {
@@ -161,3 +161,17 @@ describe('createSlackTokenStore', () => {
     await expect(result).rejects.toBeInstanceOf(SlackConnectionNotFoundError);
   });
 });
+
+function createInMemorySecretsStore(): SlackSecretsStore {
+  const values = new Map<string, string>();
+  const id = (params: {workspaceId: string; namespace: string; key: string}) =>
+    `${params.workspaceId}\0${params.namespace}\0${params.key}`;
+  return {
+    getSecret: async (params) => values.get(id(params)) ?? null,
+    setSecrets: async (params) => {
+      await Promise.resolve();
+      for (const [key, value] of Object.entries(params.values))
+        values.set(id({...params, key}), value);
+    },
+  };
+}

package/src/core/webhook-processor.test.ts

@@ -0,0 +1,106 @@
+import {createHmac, randomUUID} from 'node:crypto';
+import type {IntegrationConnection} from '@shipfox/api-integration-core-dto';
+import {createStoredWebhookRequest} from '@shipfox/api-integration-core-dto';
+import {db} from '#db/db.js';
+import {upsertSlackInstallation} from '#db/installations.js';
+import {slackInstallations} from '#db/schema/installations.js';
+import {createSlackWebhookProcessor} from './webhook-processor.js';
+
+const signingSecret = 'test-signing-secret';
+
+function fakeConnection(): IntegrationConnection {
+  return {
+    id: randomUUID(),
+    workspaceId: randomUUID(),
+    provider: 'slack',
+    externalAccountId: 'T1',
+    slug: 'slack_acme',
+    displayName: 'Slack Acme',
+    lifecycleStatus: 'active',
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  };
+}
+
+function signedEventRequest(input: {
+  receivedAt: string;
+  timestamp?: number;
+}): ReturnType<typeof createStoredWebhookRequest> {
+  const body = Buffer.from(
+    JSON.stringify({
+      type: 'event_callback',
+      team_id: 'T1',
+      api_app_id: 'A1',
+      event: {type: 'app_mention', channel: 'C1', user: 'U1', text: 'hello', ts: '1.0'},
+      event_id: 'Ev-delayed',
+      event_time: 1_721_300_000,
+    }),
+  );
+  const timestamp = `${input.timestamp ?? Math.floor(new Date(input.receivedAt).getTime() / 1000)}`;
+  const signature = `v0=${createHmac('sha256', signingSecret)
+    .update(`v0:${timestamp}:`)
+    .update(body)
+    .digest('hex')}`;
+  return createStoredWebhookRequest({
+    requestId: randomUUID(),
+    routeId: 'slack.event',
+    receivedAt: input.receivedAt,
+    rawQueryString: '',
+    headers: {
+      'content-type': 'application/json',
+      'x-slack-request-timestamp': timestamp,
+      'x-slack-signature': signature,
+    },
+    body,
+  });
+}
+
+describe('Slack webhook processor', () => {
+  beforeEach(async () => {
+    await db().delete(slackInstallations);
+  });
+
+  it('accepts an event delayed after a valid receipt', async () => {
+    const connection = fakeConnection();
+    const receivedAt = new Date(Date.now() - 10 * 60_000).toISOString();
+    await upsertSlackInstallation({
+      connectionId: connection.id,
+      teamId: 'T1',
+      teamName: 'Acme',
+      appId: 'A1',
+      botUserId: 'UBOT',
+      scopes: [],
+      status: 'installed',
+    });
+    const publishIntegrationEventReceived = vi.fn(() => Promise.resolve({published: true}));
+    const processor = createSlackWebhookProcessor({
+      coreDb: db,
+      claimWebhookDelivery: vi.fn(() => Promise.resolve({claimed: true})),
+      publishIntegrationEventReceived,
+      recordDeliveryOnly: vi.fn(() => Promise.resolve()),
+      getIntegrationConnectionById: vi.fn(() => Promise.resolve(connection)),
+    });
+
+    const result = await processor.process(signedEventRequest({receivedAt}));
+
+    expect(result).toMatchObject({outcome: 'processed', deliveryId: 'Ev-delayed'});
+    expect(publishIntegrationEventReceived).toHaveBeenCalledTimes(1);
+  });
+
+  it('discards an event stale at receipt', async () => {
+    const receivedAt = new Date().toISOString();
+    const processor = createSlackWebhookProcessor({
+      coreDb: db,
+      claimWebhookDelivery: vi.fn(() => Promise.resolve({claimed: true})),
+      publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: true})),
+      recordDeliveryOnly: vi.fn(() => Promise.resolve()),
+      getIntegrationConnectionById: vi.fn(),
+    });
+
+    const result = await processor.process(
+      signedEventRequest({receivedAt, timestamp: Math.floor(Date.now() / 1000) - 301}),
+    );
+
+    expect(result).toMatchObject({outcome: 'discarded', reason: 'stale_at_receipt'});
+  });
+});