@shipfox/api-integration-slack 4.0.0

package/src/presentation/routes/webhooks.ts

@@ -0,0 +1,170 @@
+import {Buffer} from 'node:buffer';
+import type {
+  GetIntegrationConnectionByIdFn,
+  PublishIntegrationEventReceivedFn,
+  RecordDeliveryOnlyFn,
+} from '@shipfox/api-integration-core-dto';
+import {
+  slackEventsRequestSchema,
+  slackSlashCommandSchema,
+} from '@shipfox/api-integration-slack-dto';
+import {createRawBodyPlugin, defineRoute, type RouteGroup} from '@shipfox/node-fastify';
+import {logger} from '@shipfox/node-opentelemetry';
+import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
+import {config} from '#config.js';
+import {verifySlackSignature} from '#core/signature.js';
+import {handleSlackCommand, handleSlackEvent} from '#core/webhook.js';
+
+export const SLACK_WEBHOOK_BODY_LIMIT = 1024 * 1024;
+export const SLASH_COMMAND_ACK = {response_type: 'ephemeral', text: 'Working on it.'} as const;
+
+const slackJsonRawBodyPlugin = createRawBodyPlugin({
+  contentType: 'application/json',
+  bodyLimit: SLACK_WEBHOOK_BODY_LIMIT,
+});
+const slackFormRawBodyPlugin = createRawBodyPlugin({
+  contentType: 'application/x-www-form-urlencoded',
+  bodyLimit: SLACK_WEBHOOK_BODY_LIMIT,
+});
+
+export interface CreateSlackWebhookRoutesOptions {
+  coreDb: () => NodePgDatabase<Record<string, unknown>>;
+  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  recordDeliveryOnly: RecordDeliveryOnlyFn;
+  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+
+export function createSlackWebhookRoutes(options: CreateSlackWebhookRoutesOptions): RouteGroup[] {
+  const eventsRoute = defineRoute({
+    method: 'POST',
+    path: '/',
+    auth: [],
+    description: 'Slack Events API receiver.',
+    options: {bodyLimit: SLACK_WEBHOOK_BODY_LIMIT},
+    handler: async (request, reply) => {
+      const rawBody = rawRequestBody(request.body);
+      if (rawBody === undefined) {
+        reply.code(400);
+        return {error: 'expected raw JSON body'};
+      }
+      if (!hasValidSlackSignature(request.headers, rawBody)) {
+        reply.code(401);
+        return {error: 'invalid signature'};
+      }
+
+      let parsedJson: unknown;
+      try {
+        parsedJson = JSON.parse(rawBody);
+      } catch (error) {
+        logger().warn(
+          {errorName: error instanceof Error ? error.name : 'unknown'},
+          'slack events payload JSON parse failed',
+        );
+        reply.code(400);
+        return {error: 'malformed JSON'};
+      }
+
+      const parsed = slackEventsRequestSchema.safeParse(parsedJson);
+      if (!parsed.success) {
+        logger().warn(
+          {issues: parsed.error.issues},
+          'slack events envelope failed schema validation',
+        );
+        reply.code(200);
+        return null;
+      }
+      const eventRequest = parsed.data;
+      if (eventRequest.type === 'url_verification') {
+        reply.code(200);
+        return {challenge: eventRequest.challenge};
+      }
+
+      await options.coreDb().transaction(async (tx) => {
+        await handleSlackEvent({
+          tx,
+          deliveryId: eventRequest.event_id,
+          envelope: eventRequest,
+          publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+          recordDeliveryOnly: options.recordDeliveryOnly,
+          getIntegrationConnectionById: options.getIntegrationConnectionById,
+        });
+      });
+      reply.code(200);
+      return null;
+    },
+  });
+
+  const commandsRoute = defineRoute({
+    method: 'POST',
+    path: '/',
+    auth: [],
+    description: 'Slack slash-command receiver.',
+    options: {bodyLimit: SLACK_WEBHOOK_BODY_LIMIT},
+    handler: async (request, reply) => {
+      const rawBody = rawRequestBody(request.body);
+      if (rawBody === undefined) {
+        reply.code(400);
+        return {error: 'expected raw form body'};
+      }
+      if (!hasValidSlackSignature(request.headers, rawBody)) {
+        reply.code(401);
+        return {error: 'invalid signature'};
+      }
+
+      const command = slackSlashCommandSchema.safeParse(
+        Object.fromEntries(new URLSearchParams(rawBody)),
+      );
+      if (!command.success) {
+        logger().warn({issues: command.error.issues}, 'slack command failed schema validation');
+        reply.code(200);
+        return SLASH_COMMAND_ACK;
+      }
+
+      await options.coreDb().transaction(async (tx) => {
+        await handleSlackCommand({
+          tx,
+          deliveryId: command.data.trigger_id,
+          command: command.data,
+          publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+          recordDeliveryOnly: options.recordDeliveryOnly,
+          getIntegrationConnectionById: options.getIntegrationConnectionById,
+        });
+      });
+      reply.code(200);
+      return SLASH_COMMAND_ACK;
+    },
+  });
+
+  return [
+    {
+      prefix: '/webhooks/integrations/slack/events',
+      auth: [],
+      plugins: [slackJsonRawBodyPlugin],
+      routes: [eventsRoute],
+    },
+    {
+      prefix: '/webhooks/integrations/slack/commands',
+      auth: [],
+      plugins: [slackFormRawBodyPlugin],
+      routes: [commandsRoute],
+    },
+  ];
+}
+
+function rawRequestBody(body: unknown): string | undefined {
+  return Buffer.isBuffer(body) ? body.toString('utf8') : undefined;
+}
+
+function hasValidSlackSignature(
+  headers: Record<string, string | string[] | undefined>,
+  rawBody: string,
+): boolean {
+  const signature = headers['x-slack-signature'];
+  const timestamp = headers['x-slack-request-timestamp'];
+  return verifySlackSignature({
+    signingSecret: config.SLACK_SIGNING_SECRET,
+    signature: typeof signature === 'string' ? signature : undefined,
+    timestamp: typeof timestamp === 'string' ? timestamp : undefined,
+    rawBody,
+  });
+}

package/test/api-secrets.d.ts

@@ -0,0 +1,26 @@
+declare module '@shipfox/api-secrets' {
+  import type {NodePgDatabase} from '@shipfox/node-drizzle';
+
+  export function getSecret(params: {
+    workspaceId: string;
+    namespace: string;
+    key: string;
+  }): Promise<string | null>;
+
+  export function setSecrets(params: {
+    workspaceId: string;
+    namespace: string;
+    values: Record<string, string>;
+    editedBy?: string | null | undefined;
+  }): Promise<void>;
+
+  export const secretsModule: {
+    database?:
+      | {
+          db(): NodePgDatabase<Record<string, unknown>>;
+          migrationsPath: string;
+        }
+      | unknown[]
+      | undefined;
+  };
+}

package/test/env.ts

@@ -0,0 +1,13 @@
+process.env.POSTGRES_HOST ??= 'localhost';
+process.env.POSTGRES_PORT ??= '5432';
+process.env.POSTGRES_USERNAME ??= 'shipfox';
+process.env.POSTGRES_PASSWORD ??= 'password';
+process.env.POSTGRES_DATABASE = 'api_test';
+process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
+process.env.TZ = 'UTC';
+process.env.SLACK_OAUTH_CLIENT_ID = 'test-client-id';
+process.env.SLACK_OAUTH_CLIENT_SECRET = 'test-client-secret';
+process.env.SLACK_SIGNING_SECRET = 'test-signing-secret';
+process.env.SLACK_OAUTH_REDIRECT_URL = 'https://shipfox.example.com/integrations/slack/callback';
+process.env.SLACK_API_BASE_URL = 'http://127.0.0.1:0';
+process.env.SECRETS_ENCRYPTION_KEK = 'ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=';

package/test/factories/index.ts

@@ -0,0 +1 @@
+export {};

package/test/globalSetup.ts

@@ -0,0 +1,23 @@
+import './env.js';
+import {runMigrations} from '@shipfox/node-drizzle';
+import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
+import {closeDb, db} from '#db/db.js';
+import {migrationsPath} from '#db/migrations.js';
+
+export async function setup() {
+  createPostgresClient();
+
+  await runMigrations(db(), migrationsPath, '__drizzle_migrations_integrations_slack');
+  const {secretsModule} = await import('@shipfox/api-secrets');
+  if (!secretsModule.database || Array.isArray(secretsModule.database)) {
+    throw new Error('Secrets module database is not configured');
+  }
+  await runMigrations(
+    secretsModule.database.db(),
+    secretsModule.database.migrationsPath,
+    '__drizzle_migrations_secrets',
+  );
+
+  closeDb();
+  await closePostgresClient();
+}

package/test/index.ts

@@ -0,0 +1 @@
+export * from './factories/index.js';

package/test/setup.ts

@@ -0,0 +1,17 @@
+import './env.js';
+import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
+import {afterAll, afterEach, beforeAll, vi} from '@shipfox/vitest/vi';
+import {closeDb} from '#db/db.js';
+
+beforeAll(() => {
+  createPostgresClient();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+afterAll(async () => {
+  closeDb();
+  await closePostgresClient();
+});

package/tsconfig.build.json

@@ -0,0 +1,9 @@
+{
+  "extends": "@shipfox/ts-config/node",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist"
+  },
+  "include": ["src"],
+  "exclude": ["**/*.test.tsx", "**/*.test.ts"]
+}