@shipfox/api-integration-slack 5.0.0 → 6.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 24 files with swc (243.83ms)
+Successfully compiled: 25 files with swc (476.32ms)

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @shipfox/api-integration-slack
 
+## 6.0.0
+
+### Minor Changes
+
+- 40a6e0f: Adds shared processing for signed Slack event and command webhook deliveries.
+- f262539: Adds a composed webhook processor and optional provider-neutral delivery source for hosted API runtimes.
+- a42b575: Exposes Secrets through its inter-module contract and migrates Agent, integrations, and Workflows consumers.
+
+### Patch Changes
+
+- 3bb4e26: Fixes composed webhook processing and exposes Slack URL-verification responses through the shared contract.
+- f73da5d: Enforces bounded API context imports and routes inter-module consumers through producer contracts.
+- 326f4c0: Exposes Workspaces inter-module operations and moves Auth and OAuth providers onto injected clients.
+- 1820feb: Adds Slack Settings installation and callback recovery while returning stable workspace access errors.
+- Updated dependencies [0bb82a4]
+- Updated dependencies [7ac43a4]
+- Updated dependencies [f262539]
+- Updated dependencies [3bb4e26]
+- Updated dependencies [1b79cda]
+- Updated dependencies [c2db8c3]
+- Updated dependencies [8bdc149]
+- Updated dependencies [b00ed29]
+- Updated dependencies [8aa7cd3]
+- Updated dependencies [326f4c0]
+- Updated dependencies [4a91956]
+- Updated dependencies [81f9544]
+- Updated dependencies [4604a06]
+  - @shipfox/api-integration-core-dto@6.0.0
+  - @shipfox/node-drizzle@0.3.2
+  - @shipfox/api-workspaces-dto@6.0.0
+  - @shipfox/api-auth-context@6.0.0
+  - @shipfox/node-fastify@0.2.4
+  - @shipfox/inter-module@0.2.0
+  - @shipfox/api-integration-slack-dto@6.0.0
+
 ## 5.0.0
 
 ### Minor Changes

package/dist/core/signature.d.ts

@@ -2,9 +2,10 @@ export interface VerifySlackSignatureParams {
     signingSecret: string;
     signature: string | undefined;
     timestamp: string | undefined;
-    rawBody: string;
+    rawBody: Uint8Array;
     now?: number | undefined;
     replayWindowMs?: number | undefined;
 }
+export declare function isSlackTimestampWithinReplayWindow(timestamp: string, now?: number, replayWindowMs?: number): boolean;
 export declare function verifySlackSignature({ signingSecret, signature, timestamp, rawBody, now, replayWindowMs, }: VerifySlackSignatureParams): boolean;
 //# sourceMappingURL=signature.d.ts.map

package/dist/core/signature.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/core/signature.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,SAAS,EACT,SAAS,EACT,OAAO,EACP,GAAgB,EAChB,cAAwB,GACzB,EAAE,0BAA0B,GAAG,OAAO,CAoBtC"}
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/core/signature.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,MAAM,EACjB,GAAG,SAAa,EAChB,cAAc,SAAU,GACvB,OAAO,CAQT;AAED,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,SAAS,EACT,SAAS,EACT,OAAO,EACP,GAAgB,EAChB,cAAwB,GACzB,EAAE,0BAA0B,GAAG,OAAO,CAgBtC"}

package/dist/core/signature.js

@@ -1,15 +1,19 @@
 import { createHmac, timingSafeEqual } from 'node:crypto';
 const unixTimestampPattern = /^\d+$/;
-export function verifySlackSignature({ signingSecret, signature, timestamp, rawBody, now = Date.now(), replayWindowMs = 300_000 }) {
-    if (!signingSecret || !signature || !timestamp || !unixTimestampPattern.test(timestamp)) {
-        return false;
-    }
+export function isSlackTimestampWithinReplayWindow(timestamp, now = Date.now(), replayWindowMs = 300_000) {
+    if (!unixTimestampPattern.test(timestamp)) return false;
     const timestampSeconds = Number(timestamp);
     if (!Number.isSafeInteger(timestampSeconds)) return false;
     const timestampMilliseconds = timestampSeconds * 1000;
     if (!Number.isSafeInteger(timestampMilliseconds)) return false;
-    if (Math.abs(now - timestampMilliseconds) > replayWindowMs) return false;
-    const expected = `v0=${createHmac('sha256', signingSecret).update(`v0:${timestamp}:${rawBody}`).digest('hex')}`;
+    return Math.abs(now - timestampMilliseconds) <= replayWindowMs;
+}
+export function verifySlackSignature({ signingSecret, signature, timestamp, rawBody, now = Date.now(), replayWindowMs = 300_000 }) {
+    if (!signingSecret || !signature || !timestamp) {
+        return false;
+    }
+    if (!isSlackTimestampWithinReplayWindow(timestamp, now, replayWindowMs)) return false;
+    const expected = `v0=${createHmac('sha256', signingSecret).update(`v0:${timestamp}:`).update(rawBody).digest('hex')}`;
     const expectedBuffer = Buffer.from(expected, 'utf8');
     const receivedBuffer = Buffer.from(signature, 'utf8');
     return expectedBuffer.length === receivedBuffer.length && timingSafeEqual(expectedBuffer, receivedBuffer);

package/dist/core/signature.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/signature.ts"],"sourcesContent":["import {createHmac, timingSafeEqual} from 'node:crypto';\n\nconst unixTimestampPattern = /^\\d+$/;\n\nexport interface VerifySlackSignatureParams {\n  signingSecret: string;\n  signature: string | undefined;\n  timestamp: string | undefined;\n  rawBody: string;\n  now?: number | undefined;\n  replayWindowMs?: number | undefined;\n}\n\nexport function verifySlackSignature({\n  signingSecret,\n  signature,\n  timestamp,\n  rawBody,\n  now = Date.now(),\n  replayWindowMs = 300_000,\n}: VerifySlackSignatureParams): boolean {\n  if (!signingSecret || !signature || !timestamp || !unixTimestampPattern.test(timestamp)) {\n    return false;\n  }\n\n  const timestampSeconds = Number(timestamp);\n  if (!Number.isSafeInteger(timestampSeconds)) return false;\n  const timestampMilliseconds = timestampSeconds * 1000;\n  if (!Number.isSafeInteger(timestampMilliseconds)) return false;\n  if (Math.abs(now - timestampMilliseconds) > replayWindowMs) return false;\n\n  const expected = `v0=${createHmac('sha256', signingSecret)\n    .update(`v0:${timestamp}:${rawBody}`)\n    .digest('hex')}`;\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  const receivedBuffer = Buffer.from(signature, 'utf8');\n  return (\n    expectedBuffer.length === receivedBuffer.length &&\n    timingSafeEqual(expectedBuffer, receivedBuffer)\n  );\n}\n"],"names":["createHmac","timingSafeEqual","unixTimestampPattern","verifySlackSignature","signingSecret","signature","timestamp","rawBody","now","Date","replayWindowMs","test","timestampSeconds","Number","isSafeInteger","timestampMilliseconds","Math","abs","expected","update","digest","expectedBuffer","Buffer","from","receivedBuffer","length"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,eAAe,QAAO,cAAc;AAExD,MAAMC,uBAAuB;AAW7B,OAAO,SAASC,qBAAqB,EACnCC,aAAa,EACbC,SAAS,EACTC,SAAS,EACTC,OAAO,EACPC,MAAMC,KAAKD,GAAG,EAAE,EAChBE,iBAAiB,OAAO,EACG;IAC3B,IAAI,CAACN,iBAAiB,CAACC,aAAa,CAACC,aAAa,CAACJ,qBAAqBS,IAAI,CAACL,YAAY;QACvF,OAAO;IACT;IAEA,MAAMM,mBAAmBC,OAAOP;IAChC,IAAI,CAACO,OAAOC,aAAa,CAACF,mBAAmB,OAAO;IACpD,MAAMG,wBAAwBH,mBAAmB;IACjD,IAAI,CAACC,OAAOC,aAAa,CAACC,wBAAwB,OAAO;IACzD,IAAIC,KAAKC,GAAG,CAACT,MAAMO,yBAAyBL,gBAAgB,OAAO;IAEnE,MAAMQ,WAAW,CAAC,GAAG,EAAElB,WAAW,UAAUI,eACzCe,MAAM,CAAC,CAAC,GAAG,EAAEb,UAAU,CAAC,EAAEC,SAAS,EACnCa,MAAM,CAAC,QAAQ;IAClB,MAAMC,iBAAiBC,OAAOC,IAAI,CAACL,UAAU;IAC7C,MAAMM,iBAAiBF,OAAOC,IAAI,CAAClB,WAAW;IAC9C,OACEgB,eAAeI,MAAM,KAAKD,eAAeC,MAAM,IAC/CxB,gBAAgBoB,gBAAgBG;AAEpC"}
+{"version":3,"sources":["../../src/core/signature.ts"],"sourcesContent":["import {createHmac, timingSafeEqual} from 'node:crypto';\n\nconst unixTimestampPattern = /^\\d+$/;\n\nexport interface VerifySlackSignatureParams {\n  signingSecret: string;\n  signature: string | undefined;\n  timestamp: string | undefined;\n  rawBody: Uint8Array;\n  now?: number | undefined;\n  replayWindowMs?: number | undefined;\n}\n\nexport function isSlackTimestampWithinReplayWindow(\n  timestamp: string,\n  now = Date.now(),\n  replayWindowMs = 300_000,\n): boolean {\n  if (!unixTimestampPattern.test(timestamp)) return false;\n\n  const timestampSeconds = Number(timestamp);\n  if (!Number.isSafeInteger(timestampSeconds)) return false;\n  const timestampMilliseconds = timestampSeconds * 1000;\n  if (!Number.isSafeInteger(timestampMilliseconds)) return false;\n  return Math.abs(now - timestampMilliseconds) <= replayWindowMs;\n}\n\nexport function verifySlackSignature({\n  signingSecret,\n  signature,\n  timestamp,\n  rawBody,\n  now = Date.now(),\n  replayWindowMs = 300_000,\n}: VerifySlackSignatureParams): boolean {\n  if (!signingSecret || !signature || !timestamp) {\n    return false;\n  }\n  if (!isSlackTimestampWithinReplayWindow(timestamp, now, replayWindowMs)) return false;\n\n  const expected = `v0=${createHmac('sha256', signingSecret)\n    .update(`v0:${timestamp}:`)\n    .update(rawBody)\n    .digest('hex')}`;\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  const receivedBuffer = Buffer.from(signature, 'utf8');\n  return (\n    expectedBuffer.length === receivedBuffer.length &&\n    timingSafeEqual(expectedBuffer, receivedBuffer)\n  );\n}\n"],"names":["createHmac","timingSafeEqual","unixTimestampPattern","isSlackTimestampWithinReplayWindow","timestamp","now","Date","replayWindowMs","test","timestampSeconds","Number","isSafeInteger","timestampMilliseconds","Math","abs","verifySlackSignature","signingSecret","signature","rawBody","expected","update","digest","expectedBuffer","Buffer","from","receivedBuffer","length"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,eAAe,QAAO,cAAc;AAExD,MAAMC,uBAAuB;AAW7B,OAAO,SAASC,mCACdC,SAAiB,EACjBC,MAAMC,KAAKD,GAAG,EAAE,EAChBE,iBAAiB,OAAO;IAExB,IAAI,CAACL,qBAAqBM,IAAI,CAACJ,YAAY,OAAO;IAElD,MAAMK,mBAAmBC,OAAON;IAChC,IAAI,CAACM,OAAOC,aAAa,CAACF,mBAAmB,OAAO;IACpD,MAAMG,wBAAwBH,mBAAmB;IACjD,IAAI,CAACC,OAAOC,aAAa,CAACC,wBAAwB,OAAO;IACzD,OAAOC,KAAKC,GAAG,CAACT,MAAMO,0BAA0BL;AAClD;AAEA,OAAO,SAASQ,qBAAqB,EACnCC,aAAa,EACbC,SAAS,EACTb,SAAS,EACTc,OAAO,EACPb,MAAMC,KAAKD,GAAG,EAAE,EAChBE,iBAAiB,OAAO,EACG;IAC3B,IAAI,CAACS,iBAAiB,CAACC,aAAa,CAACb,WAAW;QAC9C,OAAO;IACT;IACA,IAAI,CAACD,mCAAmCC,WAAWC,KAAKE,iBAAiB,OAAO;IAEhF,MAAMY,WAAW,CAAC,GAAG,EAAEnB,WAAW,UAAUgB,eACzCI,MAAM,CAAC,CAAC,GAAG,EAAEhB,UAAU,CAAC,CAAC,EACzBgB,MAAM,CAACF,SACPG,MAAM,CAAC,QAAQ;IAClB,MAAMC,iBAAiBC,OAAOC,IAAI,CAACL,UAAU;IAC7C,MAAMM,iBAAiBF,OAAOC,IAAI,CAACP,WAAW;IAC9C,OACEK,eAAeI,MAAM,KAAKD,eAAeC,MAAM,IAC/CzB,gBAAgBqB,gBAAgBG;AAEpC"}

package/dist/core/webhook-processor.d.ts

@@ -0,0 +1,15 @@
+import type { ClaimWebhookDeliveryFn, GetIntegrationConnectionByIdFn, PublishIntegrationEventReceivedFn, RecordDeliveryOnlyFn, StoredWebhookRequest, WebhookProcessingResult } from '@shipfox/api-integration-core-dto';
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+export interface CreateSlackWebhookProcessorOptions {
+    coreDb: () => NodePgDatabase<Record<string, unknown>>;
+    claimWebhookDelivery: ClaimWebhookDeliveryFn;
+    publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+export type SlackWebhookProcessingResult = WebhookProcessingResult;
+export interface SlackWebhookProcessor {
+    process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;
+}
+export declare function createSlackWebhookProcessor(options: CreateSlackWebhookProcessorOptions): SlackWebhookProcessor;
+//# sourceMappingURL=webhook-processor.d.ts.map

package/dist/core/webhook-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-processor.d.ts","sourceRoot":"","sources":["../../src/core/webhook-processor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,mCAAmC,CAAC;AAO3C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAQ9D,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,oBAAoB,EAAE,sBAAsB,CAAC;IAC7C,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC1E;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,qBAAqB,CAEvB"}

package/dist/core/webhook-processor.js

@@ -0,0 +1,127 @@
+import { Buffer } from 'node:buffer';
+import { decodeWebhookBody } from '@shipfox/api-integration-core-dto';
+import { slackEventsRequestSchema, slackSlashCommandSchema } from '@shipfox/api-integration-slack-dto';
+import { logger } from '@shipfox/node-opentelemetry';
+import { config } from '#config.js';
+import { isSlackTimestampWithinReplayWindow, verifySlackSignature } from '#core/signature.js';
+import { handleSlackCommand, handleSlackEvent } from '#core/webhook.js';
+const SIGNATURE_HEADER = 'x-slack-signature';
+const TIMESTAMP_HEADER = 'x-slack-request-timestamp';
+export function createSlackWebhookProcessor(options) {
+    return {
+        process: (request)=>processSlackWebhookRequest(options, request)
+    };
+}
+function processSlackWebhookRequest(options, request) {
+    if (request.route_id !== 'slack.event' && request.route_id !== 'slack.command') {
+        throw new Error(`Slack processor cannot process ${request.route_id} requests`);
+    }
+    const signature = request.headers[SIGNATURE_HEADER];
+    const timestamp = request.headers[TIMESTAMP_HEADER];
+    if (!signature || !timestamp) {
+        return Promise.resolve({
+            outcome: 'discarded',
+            reason: 'missing_required_input'
+        });
+    }
+    const rawBody = decodeWebhookBody(request.body);
+    const receiptTime = new Date(request.received_at).getTime();
+    if (!isSlackTimestampWithinReplayWindow(timestamp, receiptTime)) {
+        return Promise.resolve({
+            outcome: 'discarded',
+            reason: 'stale_at_receipt'
+        });
+    }
+    if (!verifySlackSignature({
+        signingSecret: config.SLACK_SIGNING_SECRET,
+        signature,
+        timestamp,
+        rawBody,
+        now: receiptTime
+    })) {
+        return Promise.resolve({
+            outcome: 'discarded',
+            reason: 'invalid_signature'
+        });
+    }
+    return request.route_id === 'slack.event' ? processSlackEvent(options, rawBody) : processSlackCommand(options, rawBody);
+}
+async function processSlackEvent(options, rawBody) {
+    let rawPayload;
+    try {
+        rawPayload = JSON.parse(Buffer.from(rawBody).toString('utf8'));
+    } catch (error) {
+        logger().warn({
+            err: error
+        }, 'slack events payload JSON parse failed');
+        return {
+            outcome: 'discarded',
+            reason: 'malformed_payload'
+        };
+    }
+    const event = slackEventsRequestSchema.safeParse(rawPayload);
+    if (!event.success) {
+        logger().warn({
+            issues: event.error.issues
+        }, 'slack events envelope failed schema validation');
+        return {
+            outcome: 'discarded',
+            reason: 'unsupported_event'
+        };
+    }
+    const envelope = event.data;
+    if (envelope.type === 'url_verification') {
+        return {
+            outcome: 'processed',
+            challenge: envelope.challenge
+        };
+    }
+    const result = await options.coreDb().transaction(async (tx)=>handleSlackEvent({
+            tx,
+            deliveryId: envelope.event_id,
+            envelope,
+            claimWebhookDelivery: options.claimWebhookDelivery,
+            publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+            recordDeliveryOnly: options.recordDeliveryOnly,
+            getIntegrationConnectionById: options.getIntegrationConnectionById
+        }));
+    return toProcessingResult(result.outcome, envelope.event_id);
+}
+async function processSlackCommand(options, rawBody) {
+    const command = slackSlashCommandSchema.safeParse(Object.fromEntries(new URLSearchParams(Buffer.from(rawBody).toString('utf8'))));
+    if (!command.success) {
+        logger().warn({
+            issues: command.error.issues
+        }, 'slack command failed schema validation');
+        return {
+            outcome: 'discarded',
+            reason: 'unsupported_event'
+        };
+    }
+    const result = await options.coreDb().transaction(async (tx)=>handleSlackCommand({
+            tx,
+            deliveryId: command.data.trigger_id,
+            command: command.data,
+            publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+            recordDeliveryOnly: options.recordDeliveryOnly,
+            getIntegrationConnectionById: options.getIntegrationConnectionById
+        }));
+    return toProcessingResult(result.outcome, command.data.trigger_id);
+}
+function toProcessingResult(outcome, deliveryId) {
+    if (outcome === 'published') return {
+        outcome: 'processed',
+        deliveryId
+    };
+    if (outcome === 'duplicate') return {
+        outcome: 'duplicate',
+        deliveryId
+    };
+    return {
+        outcome: 'discarded',
+        reason: outcome === 'unsupported-event' ? 'unsupported_event' : 'connection_unavailable',
+        deliveryId
+    };
+}
+
+//# sourceMappingURL=webhook-processor.js.map

package/dist/core/webhook-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook-processor.ts"],"sourcesContent":["import {Buffer} from 'node:buffer';\nimport type {\n  ClaimWebhookDeliveryFn,\n  GetIntegrationConnectionByIdFn,\n  PublishIntegrationEventReceivedFn,\n  RecordDeliveryOnlyFn,\n  StoredWebhookRequest,\n  WebhookProcessingResult,\n} from '@shipfox/api-integration-core-dto';\nimport {decodeWebhookBody} from '@shipfox/api-integration-core-dto';\nimport {\n  slackEventsRequestSchema,\n  slackSlashCommandSchema,\n} from '@shipfox/api-integration-slack-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {NodePgDatabase} from 'drizzle-orm/node-postgres';\nimport {config} from '#config.js';\nimport {isSlackTimestampWithinReplayWindow, verifySlackSignature} from '#core/signature.js';\nimport {handleSlackCommand, handleSlackEvent, type SlackWebhookOutcome} from '#core/webhook.js';\n\nconst SIGNATURE_HEADER = 'x-slack-signature';\nconst TIMESTAMP_HEADER = 'x-slack-request-timestamp';\n\nexport interface CreateSlackWebhookProcessorOptions {\n  coreDb: () => NodePgDatabase<Record<string, unknown>>;\n  claimWebhookDelivery: ClaimWebhookDeliveryFn;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport type SlackWebhookProcessingResult = WebhookProcessingResult;\n\nexport interface SlackWebhookProcessor {\n  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;\n}\n\nexport function createSlackWebhookProcessor(\n  options: CreateSlackWebhookProcessorOptions,\n): SlackWebhookProcessor {\n  return {process: (request) => processSlackWebhookRequest(options, request)};\n}\n\nfunction processSlackWebhookRequest(\n  options: CreateSlackWebhookProcessorOptions,\n  request: StoredWebhookRequest,\n): Promise<WebhookProcessingResult> {\n  if (request.route_id !== 'slack.event' && request.route_id !== 'slack.command') {\n    throw new Error(`Slack processor cannot process ${request.route_id} requests`);\n  }\n\n  const signature = request.headers[SIGNATURE_HEADER];\n  const timestamp = request.headers[TIMESTAMP_HEADER];\n  if (!signature || !timestamp) {\n    return Promise.resolve({outcome: 'discarded', reason: 'missing_required_input'});\n  }\n\n  const rawBody = decodeWebhookBody(request.body);\n  const receiptTime = new Date(request.received_at).getTime();\n  if (!isSlackTimestampWithinReplayWindow(timestamp, receiptTime)) {\n    return Promise.resolve({outcome: 'discarded', reason: 'stale_at_receipt'});\n  }\n  if (\n    !verifySlackSignature({\n      signingSecret: config.SLACK_SIGNING_SECRET,\n      signature,\n      timestamp,\n      rawBody,\n      now: receiptTime,\n    })\n  ) {\n    return Promise.resolve({outcome: 'discarded', reason: 'invalid_signature'});\n  }\n\n  return request.route_id === 'slack.event'\n    ? processSlackEvent(options, rawBody)\n    : processSlackCommand(options, rawBody);\n}\n\nasync function processSlackEvent(\n  options: CreateSlackWebhookProcessorOptions,\n  rawBody: Uint8Array,\n): Promise<WebhookProcessingResult> {\n  let rawPayload: unknown;\n  try {\n    rawPayload = JSON.parse(Buffer.from(rawBody).toString('utf8'));\n  } catch (error) {\n    logger().warn({err: error}, 'slack events payload JSON parse failed');\n    return {outcome: 'discarded', reason: 'malformed_payload'};\n  }\n\n  const event = slackEventsRequestSchema.safeParse(rawPayload);\n  if (!event.success) {\n    logger().warn({issues: event.error.issues}, 'slack events envelope failed schema validation');\n    return {outcome: 'discarded', reason: 'unsupported_event'};\n  }\n  const envelope = event.data;\n  if (envelope.type === 'url_verification') {\n    return {outcome: 'processed', challenge: envelope.challenge};\n  }\n\n  const result = await options.coreDb().transaction(async (tx) =>\n    handleSlackEvent({\n      tx,\n      deliveryId: envelope.event_id,\n      envelope,\n      claimWebhookDelivery: options.claimWebhookDelivery,\n      publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n      recordDeliveryOnly: options.recordDeliveryOnly,\n      getIntegrationConnectionById: options.getIntegrationConnectionById,\n    }),\n  );\n  return toProcessingResult(result.outcome, envelope.event_id);\n}\n\nasync function processSlackCommand(\n  options: CreateSlackWebhookProcessorOptions,\n  rawBody: Uint8Array,\n): Promise<WebhookProcessingResult> {\n  const command = slackSlashCommandSchema.safeParse(\n    Object.fromEntries(new URLSearchParams(Buffer.from(rawBody).toString('utf8'))),\n  );\n  if (!command.success) {\n    logger().warn({issues: command.error.issues}, 'slack command failed schema validation');\n    return {outcome: 'discarded', reason: 'unsupported_event'};\n  }\n\n  const result = await options.coreDb().transaction(async (tx) =>\n    handleSlackCommand({\n      tx,\n      deliveryId: command.data.trigger_id,\n      command: command.data,\n      publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n      recordDeliveryOnly: options.recordDeliveryOnly,\n      getIntegrationConnectionById: options.getIntegrationConnectionById,\n    }),\n  );\n  return toProcessingResult(result.outcome, command.data.trigger_id);\n}\n\nfunction toProcessingResult(\n  outcome: SlackWebhookOutcome,\n  deliveryId: string,\n): WebhookProcessingResult {\n  if (outcome === 'published') return {outcome: 'processed', deliveryId};\n  if (outcome === 'duplicate') return {outcome: 'duplicate', deliveryId};\n  return {\n    outcome: 'discarded',\n    reason: outcome === 'unsupported-event' ? 'unsupported_event' : 'connection_unavailable',\n    deliveryId,\n  };\n}\n"],"names":["Buffer","decodeWebhookBody","slackEventsRequestSchema","slackSlashCommandSchema","logger","config","isSlackTimestampWithinReplayWindow","verifySlackSignature","handleSlackCommand","handleSlackEvent","SIGNATURE_HEADER","TIMESTAMP_HEADER","createSlackWebhookProcessor","options","process","request","processSlackWebhookRequest","route_id","Error","signature","headers","timestamp","Promise","resolve","outcome","reason","rawBody","body","receiptTime","Date","received_at","getTime","signingSecret","SLACK_SIGNING_SECRET","now","processSlackEvent","processSlackCommand","rawPayload","JSON","parse","from","toString","error","warn","err","event","safeParse","success","issues","envelope","data","type","challenge","result","coreDb","transaction","tx","deliveryId","event_id","claimWebhookDelivery","publishIntegrationEventReceived","recordDeliveryOnly","getIntegrationConnectionById","toProcessingResult","command","Object","fromEntries","URLSearchParams","trigger_id"],"mappings":"AAAA,SAAQA,MAAM,QAAO,cAAc;AASnC,SAAQC,iBAAiB,QAAO,oCAAoC;AACpE,SACEC,wBAAwB,EACxBC,uBAAuB,QAClB,qCAAqC;AAC5C,SAAQC,MAAM,QAAO,8BAA8B;AAEnD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,kCAAkC,EAAEC,oBAAoB,QAAO,qBAAqB;AAC5F,SAAQC,kBAAkB,EAAEC,gBAAgB,QAAiC,mBAAmB;AAEhG,MAAMC,mBAAmB;AACzB,MAAMC,mBAAmB;AAgBzB,OAAO,SAASC,4BACdC,OAA2C;IAE3C,OAAO;QAACC,SAAS,CAACC,UAAYC,2BAA2BH,SAASE;IAAQ;AAC5E;AAEA,SAASC,2BACPH,OAA2C,EAC3CE,OAA6B;IAE7B,IAAIA,QAAQE,QAAQ,KAAK,iBAAiBF,QAAQE,QAAQ,KAAK,iBAAiB;QAC9E,MAAM,IAAIC,MAAM,CAAC,+BAA+B,EAAEH,QAAQE,QAAQ,CAAC,SAAS,CAAC;IAC/E;IAEA,MAAME,YAAYJ,QAAQK,OAAO,CAACV,iBAAiB;IACnD,MAAMW,YAAYN,QAAQK,OAAO,CAACT,iBAAiB;IACnD,IAAI,CAACQ,aAAa,CAACE,WAAW;QAC5B,OAAOC,QAAQC,OAAO,CAAC;YAACC,SAAS;YAAaC,QAAQ;QAAwB;IAChF;IAEA,MAAMC,UAAUzB,kBAAkBc,QAAQY,IAAI;IAC9C,MAAMC,cAAc,IAAIC,KAAKd,QAAQe,WAAW,EAAEC,OAAO;IACzD,IAAI,CAACzB,mCAAmCe,WAAWO,cAAc;QAC/D,OAAON,QAAQC,OAAO,CAAC;YAACC,SAAS;YAAaC,QAAQ;QAAkB;IAC1E;IACA,IACE,CAAClB,qBAAqB;QACpByB,eAAe3B,OAAO4B,oBAAoB;QAC1Cd;QACAE;QACAK;QACAQ,KAAKN;IACP,IACA;QACA,OAAON,QAAQC,OAAO,CAAC;YAACC,SAAS;YAAaC,QAAQ;QAAmB;IAC3E;IAEA,OAAOV,QAAQE,QAAQ,KAAK,gBACxBkB,kBAAkBtB,SAASa,WAC3BU,oBAAoBvB,SAASa;AACnC;AAEA,eAAeS,kBACbtB,OAA2C,EAC3Ca,OAAmB;IAEnB,IAAIW;IACJ,IAAI;QACFA,aAAaC,KAAKC,KAAK,CAACvC,OAAOwC,IAAI,CAACd,SAASe,QAAQ,CAAC;IACxD,EAAE,OAAOC,OAAO;QACdtC,SAASuC,IAAI,CAAC;YAACC,KAAKF;QAAK,GAAG;QAC5B,OAAO;YAAClB,SAAS;YAAaC,QAAQ;QAAmB;IAC3D;IAEA,MAAMoB,QAAQ3C,yBAAyB4C,SAAS,CAACT;IACjD,IAAI,CAACQ,MAAME,OAAO,EAAE;QAClB3C,SAASuC,IAAI,CAAC;YAACK,QAAQH,MAAMH,KAAK,CAACM,MAAM;QAAA,GAAG;QAC5C,OAAO;YAACxB,SAAS;YAAaC,QAAQ;QAAmB;IAC3D;IACA,MAAMwB,WAAWJ,MAAMK,IAAI;IAC3B,IAAID,SAASE,IAAI,KAAK,oBAAoB;QACxC,OAAO;YAAC3B,SAAS;YAAa4B,WAAWH,SAASG,SAAS;QAAA;IAC7D;IAEA,MAAMC,SAAS,MAAMxC,QAAQyC,MAAM,GAAGC,WAAW,CAAC,OAAOC,KACvD/C,iBAAiB;YACf+C;YACAC,YAAYR,SAASS,QAAQ;YAC7BT;YACAU,sBAAsB9C,QAAQ8C,oBAAoB;YAClDC,iCAAiC/C,QAAQ+C,+BAA+B;YACxEC,oBAAoBhD,QAAQgD,kBAAkB;YAC9CC,8BAA8BjD,QAAQiD,4BAA4B;QACpE;IAEF,OAAOC,mBAAmBV,OAAO7B,OAAO,EAAEyB,SAASS,QAAQ;AAC7D;AAEA,eAAetB,oBACbvB,OAA2C,EAC3Ca,OAAmB;IAEnB,MAAMsC,UAAU7D,wBAAwB2C,SAAS,CAC/CmB,OAAOC,WAAW,CAAC,IAAIC,gBAAgBnE,OAAOwC,IAAI,CAACd,SAASe,QAAQ,CAAC;IAEvE,IAAI,CAACuB,QAAQjB,OAAO,EAAE;QACpB3C,SAASuC,IAAI,CAAC;YAACK,QAAQgB,QAAQtB,KAAK,CAACM,MAAM;QAAA,GAAG;QAC9C,OAAO;YAACxB,SAAS;YAAaC,QAAQ;QAAmB;IAC3D;IAEA,MAAM4B,SAAS,MAAMxC,QAAQyC,MAAM,GAAGC,WAAW,CAAC,OAAOC,KACvDhD,mBAAmB;YACjBgD;YACAC,YAAYO,QAAQd,IAAI,CAACkB,UAAU;YACnCJ,SAASA,QAAQd,IAAI;YACrBU,iCAAiC/C,QAAQ+C,+BAA+B;YACxEC,oBAAoBhD,QAAQgD,kBAAkB;YAC9CC,8BAA8BjD,QAAQiD,4BAA4B;QACpE;IAEF,OAAOC,mBAAmBV,OAAO7B,OAAO,EAAEwC,QAAQd,IAAI,CAACkB,UAAU;AACnE;AAEA,SAASL,mBACPvC,OAA4B,EAC5BiC,UAAkB;IAElB,IAAIjC,YAAY,aAAa,OAAO;QAACA,SAAS;QAAaiC;IAAU;IACrE,IAAIjC,YAAY,aAAa,OAAO;QAACA,SAAS;QAAaiC;IAAU;IACrE,OAAO;QACLjC,SAAS;QACTC,QAAQD,YAAY,sBAAsB,sBAAsB;QAChEiC;IACF;AACF"}

package/dist/index.d.ts

@@ -23,13 +23,15 @@ export type { ConnectSlackInstallationInput, HandleSlackCallbackParams } from '#
 export { handleSlackCallback, handleSlackOAuthCallbackError } from '#core/install.js';
 export { assertSlackAuthorizationScopes, formatSlackBotScopes, SLACK_BOT_SCOPES, } from '#core/scopes.js';
 export type { VerifySlackSignatureParams } from '#core/signature.js';
-export { verifySlackSignature } from '#core/signature.js';
+export { isSlackTimestampWithinReplayWindow, verifySlackSignature } from '#core/signature.js';
 export type { SlackInstallStateClaims } from '#core/state.js';
 export { signSlackInstallState, verifySlackInstallState } from '#core/state.js';
 export type { CreateSlackTokenStoreParams, GetSlackAccessTokenParams, SlackConnectionResolverResult, SlackSecretsStore, SlackTokenStore, StoreSlackTokensParams, } from '#core/tokens.js';
 export { createSlackTokenStore, slackSecretsNamespace } from '#core/tokens.js';
 export type { HandleSlackCommandParams, HandleSlackEventParams, SlackWebhookOutcome, } from '#core/webhook.js';
 export { handleSlackCommand, handleSlackEvent, isSelfAuthoredSlackEvent } from '#core/webhook.js';
+export type { CreateSlackWebhookProcessorOptions, SlackWebhookProcessingResult, SlackWebhookProcessor, } from '#core/webhook-processor.js';
+export { createSlackWebhookProcessor } from '#core/webhook-processor.js';
 export type { SlackInstallation, SlackInstallationStatus, UpsertSlackInstallationParams, } from '#db/installations.js';
 export { deleteSlackInstallationByConnectionId, getSlackInstallationByConnectionId, getSlackInstallationByTeamId, markSlackInstallationRevoked, upsertSlackInstallation, } from '#db/installations.js';
 export { type CreateSlackE2eRoutesOptions, createSlackE2eRoutes, } from '#presentation/e2eRoutes/index.js';
@@ -56,6 +58,10 @@ export interface CreateSlackIntegrationProviderOptions {
 }
 export declare function createSlackIntegrationProvider(options?: CreateSlackIntegrationProviderOptions): {
     routes: RouteGroup[];
+    webhookProcessors: {
+        routeIds: readonly ["slack.event", "slack.command"];
+        processor: import("#core/webhook-processor.js").SlackWebhookProcessor;
+    }[] | undefined;
     deleteConnectionRecords?: (connection: {
         id: string;
     }, options: {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAuB,KAAK,cAAc,EAAC,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAC,MAAM,EAAC,MAAM,YAAY,CAAC;AAClC,OAAO,EAAC,uBAAuB,EAAC,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAC,OAAO,EAAE,EAAE,EAAC,MAAM,WAAW,CAAC;AACtC,OAAO,EAAC,kCAAkC,EAAC,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAC,cAAc,EAAC,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,+BAA+B,EAErC,MAAM,kCAAkC,CAAC;AAE1C,KAAK,6BAA6B,GAAG,IAAI,CACvC,mCAAmC,EACnC,OAAO,GAAG,wBAAwB,CACnC,CAAC;AACF,KAAK,iBAAiB,GAAG,OAAO,CAAC,6BAA6B,CAAC,GAC7D,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAE3C,YAAY,EAAC,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACtE,YAAY,EAAC,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAC,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAC,oBAAoB,EAAC,MAAM,gBAAgB,CAAC;AACpD,YAAY,EACV,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,uBAAuB,EAAC,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,KAAK,iCAAiC,EACtC,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,KAAK,iCAAiC,EACtC,oCAAoC,EACpC,yBAAyB,EACzB,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,mCAAmC,EACnC,mCAAmC,EACnC,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAC,6BAA6B,EAAE,yBAAyB,EAAC,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAC,mBAAmB,EAAE,6BAA6B,EAAC,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAC,0BAA0B,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAC,oBAAoB,EAAC,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAC,uBAAuB,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,qBAAqB,EAAE,uBAAuB,EAAC,MAAM,gBAAgB,CAAC;AAC9E,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AAChG,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,2BAA2B,EAChC,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAC,CAAC;AAE7C,MAAM,WAAW,qCAAqC;IACpD,KAAK,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE;QAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC;IAC/E,kCAAkC,CAAC,EAAE,OAAO,kCAAkC,GAAG,SAAS,CAAC;IAC3F,OAAO,CAAC,EACJ;QACE,uBAAuB,CAAC,EAAE,CACxB,UAAU,EAAE;YAAC,EAAE,EAAE,MAAM,CAAA;SAAC,EACxB,OAAO,EAAE;YAAC,EAAE,EAAE,OAAO,CAAA;SAAC,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,uBAAuB,CAAC,EAAE,CAAC,UAAU,EAAE;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC5F,GACD,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACxC;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,GAAE,qCAA0C;;8BAXnB,CACxB,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EACxB,OAAO,EAAE;QAAC,EAAE,EAAE,OAAO,CAAA;KAAC,KACnB,OAAO,CAAC,IAAI,CAAC;8BACQ,CAAC,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC;;;;;;;;sCAsDtD;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;EAQrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAuB,KAAK,cAAc,EAAC,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAC,MAAM,EAAC,MAAM,YAAY,CAAC;AAClC,OAAO,EAAC,uBAAuB,EAAC,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAC,OAAO,EAAE,EAAE,EAAC,MAAM,WAAW,CAAC;AACtC,OAAO,EAAC,kCAAkC,EAAC,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAC,cAAc,EAAC,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,+BAA+B,EAErC,MAAM,kCAAkC,CAAC;AAE1C,KAAK,6BAA6B,GAAG,IAAI,CACvC,mCAAmC,EACnC,OAAO,GAAG,wBAAwB,CACnC,CAAC;AACF,KAAK,iBAAiB,GAAG,OAAO,CAAC,6BAA6B,CAAC,GAC7D,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAE3C,YAAY,EAAC,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACtE,YAAY,EAAC,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAC,MAAM,gBAAgB,CAAC;AAC5F,OAAO,EAAC,oBAAoB,EAAC,MAAM,gBAAgB,CAAC;AACpD,YAAY,EACV,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,uBAAuB,EAAC,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACL,KAAK,iCAAiC,EACtC,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,KAAK,iCAAiC,EACtC,oCAAoC,EACpC,yBAAyB,EACzB,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,mCAAmC,EACnC,mCAAmC,EACnC,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAC,6BAA6B,EAAE,yBAAyB,EAAC,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAC,mBAAmB,EAAE,6BAA6B,EAAC,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAC,0BAA0B,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAC,kCAAkC,EAAE,oBAAoB,EAAC,MAAM,oBAAoB,CAAC;AAC5F,YAAY,EAAC,uBAAuB,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,qBAAqB,EAAE,uBAAuB,EAAC,MAAM,gBAAgB,CAAC;AAC9E,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAC,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,kBAAkB,EAAE,gBAAgB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AAChG,YAAY,EACV,kCAAkC,EAClC,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAC,2BAA2B,EAAC,MAAM,4BAA4B,CAAC;AACvE,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,2BAA2B,EAChC,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAC,CAAC;AAE7C,MAAM,WAAW,qCAAqC;IACpD,KAAK,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACnC,UAAU,CAAC,EAAE;QAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAA;KAAC,GAAG,SAAS,CAAC;IAC/E,kCAAkC,CAAC,EAAE,OAAO,kCAAkC,GAAG,SAAS,CAAC;IAC3F,OAAO,CAAC,EACJ;QACE,uBAAuB,CAAC,EAAE,CACxB,UAAU,EAAE;YAAC,EAAE,EAAE,MAAM,CAAA;SAAC,EACxB,OAAO,EAAE;YAAC,EAAE,EAAE,OAAO,CAAA;SAAC,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,uBAAuB,CAAC,EAAE,CAAC,UAAU,EAAE;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAC5F,GACD,SAAS,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACxC;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,GAAE,qCAA0C;;;;;;8BAXnB,CACxB,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EACxB,OAAO,EAAE;QAAC,EAAE,EAAE,OAAO,CAAA;KAAC,KACnB,OAAO,CAAC,IAAI,CAAC;8BACQ,CAAC,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC;;;;;;;;sCA4DtD;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;EAWrF"}

package/dist/index.js

@@ -2,6 +2,7 @@ import { SLACK_PROVIDER } from '@shipfox/api-integration-slack-dto';
 import { createSlackApiClient } from '#api/client.js';
 import { config } from '#config.js';
 import { SlackAgentToolsProvider } from '#core/agent-tools-provider.js';
+import { createSlackWebhookProcessor } from '#core/webhook-processor.js';
 import { closeDb, db } from '#db/db.js';
 import { getSlackInstallationByConnectionId } from '#db/installations.js';
 import { migrationsPath } from '#db/migrations.js';
@@ -14,10 +15,11 @@ export { disconnectSlackInstallation } from '#core/disconnect.js';
 export { SlackAccessTokenUnavailableError, SlackAuthorizationScopeMismatchError, SlackBotTokenMissingError, SlackConnectionAlreadyLinkedError, SlackConnectionNotFoundError, SlackEnterpriseInstallUnsupportedError, SlackInstallationAlreadyLinkedError, SlackInstallStateActorMismatchError, SlackInstallStateError, SlackIntegrationProviderError, SlackOAuthCallbackError } from '#core/errors.js';
 export { handleSlackCallback, handleSlackOAuthCallbackError } from '#core/install.js';
 export { assertSlackAuthorizationScopes, formatSlackBotScopes, SLACK_BOT_SCOPES } from '#core/scopes.js';
-export { verifySlackSignature } from '#core/signature.js';
+export { isSlackTimestampWithinReplayWindow, verifySlackSignature } from '#core/signature.js';
 export { signSlackInstallState, verifySlackInstallState } from '#core/state.js';
 export { createSlackTokenStore, slackSecretsNamespace } from '#core/tokens.js';
 export { handleSlackCommand, handleSlackEvent, isSelfAuthoredSlackEvent } from '#core/webhook.js';
+export { createSlackWebhookProcessor } from '#core/webhook-processor.js';
 export { deleteSlackInstallationByConnectionId, getSlackInstallationByConnectionId, getSlackInstallationByTeamId, markSlackInstallationRevoked, upsertSlackInstallation } from '#db/installations.js';
 export { createSlackE2eRoutes } from '#presentation/e2eRoutes/index.js';
 export { createSlackWebhookRoutes, SLACK_WEBHOOK_BODY_LIMIT, SLASH_COMMAND_ACK } from '#presentation/routes/webhooks.js';
@@ -35,8 +37,9 @@ export function createSlackIntegrationProvider(options = {}) {
         throw new Error('Slack webhook routes require every core persistence dependency');
     }
     const routes = [];
+    const webhookProcessor = options.routes && hasSlackWebhookRoutesOptions(options.routes) ? createSlackWebhookProcessor(options.routes) : undefined;
     if (options.routes && hasSlackInstallationRoutesOptions(options.routes)) {
-        const { tokenStore, getExistingSlackConnection, connectSlackInstallation, disconnectSlackInstallation } = options.routes;
+        const { tokenStore, getExistingSlackConnection, connectSlackInstallation, disconnectSlackInstallation, requireActiveWorkspaceMembership } = options.routes;
         routes.push(createSlackIntegrationRoutes({
             slack,
             connectionCapabilities: adapters.agent_tools ? [
@@ -45,11 +48,17 @@ export function createSlackIntegrationProvider(options = {}) {
             tokenStore,
             getExistingSlackConnection,
             connectSlackInstallation,
-            disconnectSlackInstallation
+            disconnectSlackInstallation,
+            ...requireActiveWorkspaceMembership ? {
+                requireActiveWorkspaceMembership
+            } : {}
         }));
     }
-    if (options.routes && hasSlackWebhookRoutesOptions(options.routes)) {
-        routes.push(...createSlackWebhookRoutes(options.routes));
+    if (options.routes && hasSlackWebhookRoutesOptions(options.routes) && webhookProcessor) {
+        routes.push(...createSlackWebhookRoutes({
+            ...options.routes,
+            processor: webhookProcessor
+        }));
     }
     return {
         provider: SLACK_PROVIDER,
@@ -61,7 +70,16 @@ export function createSlackIntegrationProvider(options = {}) {
             return `https://app.slack.com/client/${encodeURIComponent(installation.teamId)}`;
         },
         ...options.cleanup,
-        routes
+        routes,
+        webhookProcessors: webhookProcessor ? [
+            {
+                routeIds: [
+                    'slack.event',
+                    'slack.command'
+                ],
+                processor: webhookProcessor
+            }
+        ] : undefined
     };
 }
 function hasSlackInstallationRoutesOptions(routes) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {SLACK_PROVIDER} from '@shipfox/api-integration-slack-dto';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {createSlackApiClient, type SlackApiClient} from '#api/client.js';\nimport {config} from '#config.js';\nimport {SlackAgentToolsProvider} from '#core/agent-tools-provider.js';\nimport type {SlackTokenStore} from '#core/tokens.js';\nimport {closeDb, db} from '#db/db.js';\nimport {getSlackInstallationByConnectionId} from '#db/installations.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {\n  type CreateSlackIntegrationRoutesOptions,\n  createSlackIntegrationRoutes,\n} from '#presentation/routes/install.js';\nimport {\n  type CreateSlackWebhookRoutesOptions,\n  createSlackWebhookRoutes,\n} from '#presentation/routes/webhooks.js';\n\ntype SlackInstallationRouteOptions = Omit<\n  CreateSlackIntegrationRoutesOptions,\n  'slack' | 'connectionCapabilities'\n>;\ntype SlackRouteOptions = Partial<SlackInstallationRouteOptions> &\n  Partial<CreateSlackWebhookRoutesOptions>;\n\nexport type {SlackProvider} from '@shipfox/api-integration-slack-dto';\nexport type {SlackApiClient, SlackAuthorization, SlackWebApiResponse} from '#api/client.js';\nexport {createSlackApiClient} from '#api/client.js';\nexport type {\n  SlackAgentToolCatalogEntry,\n  SlackAgentToolId,\n  SlackAgentToolRequiredScope,\n} from '#core/agent-tools.js';\nexport {\n  SLACK_TOOL_METHODS,\n  slackAgentToolCatalog,\n  slackAgentToolSelectionCatalog,\n} from '#core/agent-tools.js';\nexport type {\n  SlackAgentToolsProviderOptions,\n  SlackToolCallResult,\n} from '#core/agent-tools-provider.js';\nexport {SlackAgentToolsProvider} from '#core/agent-tools-provider.js';\nexport {\n  type DisconnectSlackInstallationParams,\n  disconnectSlackInstallation,\n} from '#core/disconnect.js';\nexport {\n  SlackAccessTokenUnavailableError,\n  type SlackAccessTokenUnavailableReason,\n  SlackAuthorizationScopeMismatchError,\n  SlackBotTokenMissingError,\n  SlackConnectionAlreadyLinkedError,\n  SlackConnectionNotFoundError,\n  SlackEnterpriseInstallUnsupportedError,\n  SlackInstallationAlreadyLinkedError,\n  SlackInstallStateActorMismatchError,\n  SlackInstallStateError,\n  SlackIntegrationProviderError,\n  SlackOAuthCallbackError,\n} from '#core/errors.js';\nexport type {ConnectSlackInstallationInput, HandleSlackCallbackParams} from '#core/install.js';\nexport {handleSlackCallback, handleSlackOAuthCallbackError} from '#core/install.js';\nexport {\n  assertSlackAuthorizationScopes,\n  formatSlackBotScopes,\n  SLACK_BOT_SCOPES,\n} from '#core/scopes.js';\nexport type {VerifySlackSignatureParams} from '#core/signature.js';\nexport {verifySlackSignature} from '#core/signature.js';\nexport type {SlackInstallStateClaims} from '#core/state.js';\nexport {signSlackInstallState, verifySlackInstallState} from '#core/state.js';\nexport type {\n  CreateSlackTokenStoreParams,\n  GetSlackAccessTokenParams,\n  SlackConnectionResolverResult,\n  SlackSecretsStore,\n  SlackTokenStore,\n  StoreSlackTokensParams,\n} from '#core/tokens.js';\nexport {createSlackTokenStore, slackSecretsNamespace} from '#core/tokens.js';\nexport type {\n  HandleSlackCommandParams,\n  HandleSlackEventParams,\n  SlackWebhookOutcome,\n} from '#core/webhook.js';\nexport {handleSlackCommand, handleSlackEvent, isSelfAuthoredSlackEvent} from '#core/webhook.js';\nexport type {\n  SlackInstallation,\n  SlackInstallationStatus,\n  UpsertSlackInstallationParams,\n} from '#db/installations.js';\nexport {\n  deleteSlackInstallationByConnectionId,\n  getSlackInstallationByConnectionId,\n  getSlackInstallationByTeamId,\n  markSlackInstallationRevoked,\n  upsertSlackInstallation,\n} from '#db/installations.js';\nexport {\n  type CreateSlackE2eRoutesOptions,\n  createSlackE2eRoutes,\n} from '#presentation/e2eRoutes/index.js';\nexport {\n  type CreateSlackWebhookRoutesOptions,\n  createSlackWebhookRoutes,\n  SLACK_WEBHOOK_BODY_LIMIT,\n  SLASH_COMMAND_ACK,\n} from '#presentation/routes/webhooks.js';\nexport {closeDb, config, db, migrationsPath};\n\nexport interface CreateSlackIntegrationProviderOptions {\n  slack?: SlackApiClient | undefined;\n  agentTools?: {tokenStore: Pick<SlackTokenStore, 'getAccessToken'>} | undefined;\n  getSlackInstallationByConnectionId?: typeof getSlackInstallationByConnectionId | undefined;\n  cleanup?:\n    | {\n        deleteConnectionRecords?: (\n          connection: {id: string},\n          options: {tx: unknown},\n        ) => Promise<void>;\n        deleteConnectionSecrets?: (connection: {id: string; workspaceId: string}) => Promise<void>;\n      }\n    | undefined;\n  routes?: SlackRouteOptions | undefined;\n}\n\nexport function createSlackIntegrationProvider(\n  options: CreateSlackIntegrationProviderOptions = {},\n) {\n  const slack = options.slack ?? createSlackApiClient();\n  const getInstallationByConnectionId =\n    options.getSlackInstallationByConnectionId ?? getSlackInstallationByConnectionId;\n  const adapters = options.agentTools\n    ? {\n        agent_tools: new SlackAgentToolsProvider({\n          slack,\n          tokenStore: options.agentTools.tokenStore,\n        }),\n      }\n    : {};\n  if (\n    options.routes &&\n    !hasSlackInstallationRoutesOptions(options.routes) &&\n    !hasSlackWebhookRoutesOptions(options.routes)\n  ) {\n    throw new Error('Slack webhook routes require every core persistence dependency');\n  }\n  const routes: RouteGroup[] = [];\n  if (options.routes && hasSlackInstallationRoutesOptions(options.routes)) {\n    const {\n      tokenStore,\n      getExistingSlackConnection,\n      connectSlackInstallation,\n      disconnectSlackInstallation,\n    } = options.routes;\n    routes.push(\n      createSlackIntegrationRoutes({\n        slack,\n        connectionCapabilities: adapters.agent_tools ? ['agent_tools'] : [],\n        tokenStore,\n        getExistingSlackConnection,\n        connectSlackInstallation,\n        disconnectSlackInstallation,\n      }),\n    );\n  }\n  if (options.routes && hasSlackWebhookRoutesOptions(options.routes)) {\n    routes.push(...createSlackWebhookRoutes(options.routes));\n  }\n\n  return {\n    provider: SLACK_PROVIDER,\n    displayName: 'Slack',\n    adapters,\n    async connectionExternalUrl(connection: {id: string}): Promise<string | undefined> {\n      const installation = await getInstallationByConnectionId(connection.id);\n      if (!installation) return undefined;\n      return `https://app.slack.com/client/${encodeURIComponent(installation.teamId)}`;\n    },\n    ...options.cleanup,\n    routes,\n  };\n}\n\nfunction hasSlackInstallationRoutesOptions(\n  routes: SlackRouteOptions,\n): routes is SlackInstallationRouteOptions {\n  return (\n    routes.tokenStore !== undefined &&\n    routes.getExistingSlackConnection !== undefined &&\n    routes.connectSlackInstallation !== undefined &&\n    routes.disconnectSlackInstallation !== undefined\n  );\n}\n\nfunction hasSlackWebhookRoutesOptions(\n  routes: SlackRouteOptions,\n): routes is CreateSlackWebhookRoutesOptions {\n  return (\n    routes.coreDb !== undefined &&\n    routes.claimWebhookDelivery !== undefined &&\n    routes.publishIntegrationEventReceived !== undefined &&\n    routes.recordDeliveryOnly !== undefined &&\n    routes.getIntegrationConnectionById !== undefined\n  );\n}\n"],"names":["SLACK_PROVIDER","createSlackApiClient","config","SlackAgentToolsProvider","closeDb","db","getSlackInstallationByConnectionId","migrationsPath","createSlackIntegrationRoutes","createSlackWebhookRoutes","SLACK_TOOL_METHODS","slackAgentToolCatalog","slackAgentToolSelectionCatalog","disconnectSlackInstallation","SlackAccessTokenUnavailableError","SlackAuthorizationScopeMismatchError","SlackBotTokenMissingError","SlackConnectionAlreadyLinkedError","SlackConnectionNotFoundError","SlackEnterpriseInstallUnsupportedError","SlackInstallationAlreadyLinkedError","SlackInstallStateActorMismatchError","SlackInstallStateError","SlackIntegrationProviderError","SlackOAuthCallbackError","handleSlackCallback","handleSlackOAuthCallbackError","assertSlackAuthorizationScopes","formatSlackBotScopes","SLACK_BOT_SCOPES","verifySlackSignature","signSlackInstallState","verifySlackInstallState","createSlackTokenStore","slackSecretsNamespace","handleSlackCommand","handleSlackEvent","isSelfAuthoredSlackEvent","deleteSlackInstallationByConnectionId","getSlackInstallationByTeamId","markSlackInstallationRevoked","upsertSlackInstallation","createSlackE2eRoutes","SLACK_WEBHOOK_BODY_LIMIT","SLASH_COMMAND_ACK","createSlackIntegrationProvider","options","slack","getInstallationByConnectionId","adapters","agentTools","agent_tools","tokenStore","routes","hasSlackInstallationRoutesOptions","hasSlackWebhookRoutesOptions","Error","getExistingSlackConnection","connectSlackInstallation","push","connectionCapabilities","provider","displayName","connectionExternalUrl","connection","installation","id","undefined","encodeURIComponent","teamId","cleanup","coreDb","claimWebhookDelivery","publishIntegrationEventReceived","recordDeliveryOnly","getIntegrationConnectionById"],"mappings":"AAAA,SAAQA,cAAc,QAAO,qCAAqC;AAElE,SAAQC,oBAAoB,QAA4B,iBAAiB;AACzE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,uBAAuB,QAAO,gCAAgC;AAEtE,SAAQC,OAAO,EAAEC,EAAE,QAAO,YAAY;AACtC,SAAQC,kCAAkC,QAAO,uBAAuB;AACxE,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAEEC,4BAA4B,QACvB,kCAAkC;AACzC,SAEEC,wBAAwB,QACnB,mCAAmC;AAW1C,SAAQR,oBAAoB,QAAO,iBAAiB;AAMpD,SACES,kBAAkB,EAClBC,qBAAqB,EACrBC,8BAA8B,QACzB,uBAAuB;AAK9B,SAAQT,uBAAuB,QAAO,gCAAgC;AACtE,SAEEU,2BAA2B,QACtB,sBAAsB;AAC7B,SACEC,gCAAgC,EAEhCC,oCAAoC,EACpCC,yBAAyB,EACzBC,iCAAiC,EACjCC,4BAA4B,EAC5BC,sCAAsC,EACtCC,mCAAmC,EACnCC,mCAAmC,EACnCC,sBAAsB,EACtBC,6BAA6B,EAC7BC,uBAAuB,QAClB,kBAAkB;AAEzB,SAAQC,mBAAmB,EAAEC,6BAA6B,QAAO,mBAAmB;AACpF,SACEC,8BAA8B,EAC9BC,oBAAoB,EACpBC,gBAAgB,QACX,kBAAkB;AAEzB,SAAQC,oBAAoB,QAAO,qBAAqB;AAExD,SAAQC,qBAAqB,EAAEC,uBAAuB,QAAO,iBAAiB;AAS9E,SAAQC,qBAAqB,EAAEC,qBAAqB,QAAO,kBAAkB;AAM7E,SAAQC,kBAAkB,EAAEC,gBAAgB,EAAEC,wBAAwB,QAAO,mBAAmB;AAMhG,SACEC,qCAAqC,EACrChC,kCAAkC,EAClCiC,4BAA4B,EAC5BC,4BAA4B,EAC5BC,uBAAuB,QAClB,uBAAuB;AAC9B,SAEEC,oBAAoB,QACf,mCAAmC;AAC1C,SAEEjC,wBAAwB,EACxBkC,wBAAwB,EACxBC,iBAAiB,QACZ,mCAAmC;AAC1C,SAAQxC,OAAO,EAAEF,MAAM,EAAEG,EAAE,EAAEE,cAAc,GAAE;AAkB7C,OAAO,SAASsC,+BACdC,UAAiD,CAAC,CAAC;IAEnD,MAAMC,QAAQD,QAAQC,KAAK,IAAI9C;IAC/B,MAAM+C,gCACJF,QAAQxC,kCAAkC,IAAIA;IAChD,MAAM2C,WAAWH,QAAQI,UAAU,GAC/B;QACEC,aAAa,IAAIhD,wBAAwB;YACvC4C;YACAK,YAAYN,QAAQI,UAAU,CAACE,UAAU;QAC3C;IACF,IACA,CAAC;IACL,IACEN,QAAQO,MAAM,IACd,CAACC,kCAAkCR,QAAQO,MAAM,KACjD,CAACE,6BAA6BT,QAAQO,MAAM,GAC5C;QACA,MAAM,IAAIG,MAAM;IAClB;IACA,MAAMH,SAAuB,EAAE;IAC/B,IAAIP,QAAQO,MAAM,IAAIC,kCAAkCR,QAAQO,MAAM,GAAG;QACvE,MAAM,EACJD,UAAU,EACVK,0BAA0B,EAC1BC,wBAAwB,EACxB7C,2BAA2B,EAC5B,GAAGiC,QAAQO,MAAM;QAClBA,OAAOM,IAAI,CACTnD,6BAA6B;YAC3BuC;YACAa,wBAAwBX,SAASE,WAAW,GAAG;gBAAC;aAAc,GAAG,EAAE;YACnEC;YACAK;YACAC;YACA7C;QACF;IAEJ;IACA,IAAIiC,QAAQO,MAAM,IAAIE,6BAA6BT,QAAQO,MAAM,GAAG;QAClEA,OAAOM,IAAI,IAAIlD,yBAAyBqC,QAAQO,MAAM;IACxD;IAEA,OAAO;QACLQ,UAAU7D;QACV8D,aAAa;QACbb;QACA,MAAMc,uBAAsBC,UAAwB;YAClD,MAAMC,eAAe,MAAMjB,8BAA8BgB,WAAWE,EAAE;YACtE,IAAI,CAACD,cAAc,OAAOE;YAC1B,OAAO,CAAC,6BAA6B,EAAEC,mBAAmBH,aAAaI,MAAM,GAAG;QAClF;QACA,GAAGvB,QAAQwB,OAAO;QAClBjB;IACF;AACF;AAEA,SAASC,kCACPD,MAAyB;IAEzB,OACEA,OAAOD,UAAU,KAAKe,aACtBd,OAAOI,0BAA0B,KAAKU,aACtCd,OAAOK,wBAAwB,KAAKS,aACpCd,OAAOxC,2BAA2B,KAAKsD;AAE3C;AAEA,SAASZ,6BACPF,MAAyB;IAEzB,OACEA,OAAOkB,MAAM,KAAKJ,aAClBd,OAAOmB,oBAAoB,KAAKL,aAChCd,OAAOoB,+BAA+B,KAAKN,aAC3Cd,OAAOqB,kBAAkB,KAAKP,aAC9Bd,OAAOsB,4BAA4B,KAAKR;AAE5C"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {SLACK_PROVIDER} from '@shipfox/api-integration-slack-dto';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {createSlackApiClient, type SlackApiClient} from '#api/client.js';\nimport {config} from '#config.js';\nimport {SlackAgentToolsProvider} from '#core/agent-tools-provider.js';\nimport type {SlackTokenStore} from '#core/tokens.js';\nimport {createSlackWebhookProcessor} from '#core/webhook-processor.js';\nimport {closeDb, db} from '#db/db.js';\nimport {getSlackInstallationByConnectionId} from '#db/installations.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {\n  type CreateSlackIntegrationRoutesOptions,\n  createSlackIntegrationRoutes,\n} from '#presentation/routes/install.js';\nimport {\n  type CreateSlackWebhookRoutesOptions,\n  createSlackWebhookRoutes,\n} from '#presentation/routes/webhooks.js';\n\ntype SlackInstallationRouteOptions = Omit<\n  CreateSlackIntegrationRoutesOptions,\n  'slack' | 'connectionCapabilities'\n>;\ntype SlackRouteOptions = Partial<SlackInstallationRouteOptions> &\n  Partial<CreateSlackWebhookRoutesOptions>;\n\nexport type {SlackProvider} from '@shipfox/api-integration-slack-dto';\nexport type {SlackApiClient, SlackAuthorization, SlackWebApiResponse} from '#api/client.js';\nexport {createSlackApiClient} from '#api/client.js';\nexport type {\n  SlackAgentToolCatalogEntry,\n  SlackAgentToolId,\n  SlackAgentToolRequiredScope,\n} from '#core/agent-tools.js';\nexport {\n  SLACK_TOOL_METHODS,\n  slackAgentToolCatalog,\n  slackAgentToolSelectionCatalog,\n} from '#core/agent-tools.js';\nexport type {\n  SlackAgentToolsProviderOptions,\n  SlackToolCallResult,\n} from '#core/agent-tools-provider.js';\nexport {SlackAgentToolsProvider} from '#core/agent-tools-provider.js';\nexport {\n  type DisconnectSlackInstallationParams,\n  disconnectSlackInstallation,\n} from '#core/disconnect.js';\nexport {\n  SlackAccessTokenUnavailableError,\n  type SlackAccessTokenUnavailableReason,\n  SlackAuthorizationScopeMismatchError,\n  SlackBotTokenMissingError,\n  SlackConnectionAlreadyLinkedError,\n  SlackConnectionNotFoundError,\n  SlackEnterpriseInstallUnsupportedError,\n  SlackInstallationAlreadyLinkedError,\n  SlackInstallStateActorMismatchError,\n  SlackInstallStateError,\n  SlackIntegrationProviderError,\n  SlackOAuthCallbackError,\n} from '#core/errors.js';\nexport type {ConnectSlackInstallationInput, HandleSlackCallbackParams} from '#core/install.js';\nexport {handleSlackCallback, handleSlackOAuthCallbackError} from '#core/install.js';\nexport {\n  assertSlackAuthorizationScopes,\n  formatSlackBotScopes,\n  SLACK_BOT_SCOPES,\n} from '#core/scopes.js';\nexport type {VerifySlackSignatureParams} from '#core/signature.js';\nexport {isSlackTimestampWithinReplayWindow, verifySlackSignature} from '#core/signature.js';\nexport type {SlackInstallStateClaims} from '#core/state.js';\nexport {signSlackInstallState, verifySlackInstallState} from '#core/state.js';\nexport type {\n  CreateSlackTokenStoreParams,\n  GetSlackAccessTokenParams,\n  SlackConnectionResolverResult,\n  SlackSecretsStore,\n  SlackTokenStore,\n  StoreSlackTokensParams,\n} from '#core/tokens.js';\nexport {createSlackTokenStore, slackSecretsNamespace} from '#core/tokens.js';\nexport type {\n  HandleSlackCommandParams,\n  HandleSlackEventParams,\n  SlackWebhookOutcome,\n} from '#core/webhook.js';\nexport {handleSlackCommand, handleSlackEvent, isSelfAuthoredSlackEvent} from '#core/webhook.js';\nexport type {\n  CreateSlackWebhookProcessorOptions,\n  SlackWebhookProcessingResult,\n  SlackWebhookProcessor,\n} from '#core/webhook-processor.js';\nexport {createSlackWebhookProcessor} from '#core/webhook-processor.js';\nexport type {\n  SlackInstallation,\n  SlackInstallationStatus,\n  UpsertSlackInstallationParams,\n} from '#db/installations.js';\nexport {\n  deleteSlackInstallationByConnectionId,\n  getSlackInstallationByConnectionId,\n  getSlackInstallationByTeamId,\n  markSlackInstallationRevoked,\n  upsertSlackInstallation,\n} from '#db/installations.js';\nexport {\n  type CreateSlackE2eRoutesOptions,\n  createSlackE2eRoutes,\n} from '#presentation/e2eRoutes/index.js';\nexport {\n  type CreateSlackWebhookRoutesOptions,\n  createSlackWebhookRoutes,\n  SLACK_WEBHOOK_BODY_LIMIT,\n  SLASH_COMMAND_ACK,\n} from '#presentation/routes/webhooks.js';\nexport {closeDb, config, db, migrationsPath};\n\nexport interface CreateSlackIntegrationProviderOptions {\n  slack?: SlackApiClient | undefined;\n  agentTools?: {tokenStore: Pick<SlackTokenStore, 'getAccessToken'>} | undefined;\n  getSlackInstallationByConnectionId?: typeof getSlackInstallationByConnectionId | undefined;\n  cleanup?:\n    | {\n        deleteConnectionRecords?: (\n          connection: {id: string},\n          options: {tx: unknown},\n        ) => Promise<void>;\n        deleteConnectionSecrets?: (connection: {id: string; workspaceId: string}) => Promise<void>;\n      }\n    | undefined;\n  routes?: SlackRouteOptions | undefined;\n}\n\nexport function createSlackIntegrationProvider(\n  options: CreateSlackIntegrationProviderOptions = {},\n) {\n  const slack = options.slack ?? createSlackApiClient();\n  const getInstallationByConnectionId =\n    options.getSlackInstallationByConnectionId ?? getSlackInstallationByConnectionId;\n  const adapters = options.agentTools\n    ? {\n        agent_tools: new SlackAgentToolsProvider({\n          slack,\n          tokenStore: options.agentTools.tokenStore,\n        }),\n      }\n    : {};\n  if (\n    options.routes &&\n    !hasSlackInstallationRoutesOptions(options.routes) &&\n    !hasSlackWebhookRoutesOptions(options.routes)\n  ) {\n    throw new Error('Slack webhook routes require every core persistence dependency');\n  }\n  const routes: RouteGroup[] = [];\n  const webhookProcessor =\n    options.routes && hasSlackWebhookRoutesOptions(options.routes)\n      ? createSlackWebhookProcessor(options.routes)\n      : undefined;\n  if (options.routes && hasSlackInstallationRoutesOptions(options.routes)) {\n    const {\n      tokenStore,\n      getExistingSlackConnection,\n      connectSlackInstallation,\n      disconnectSlackInstallation,\n      requireActiveWorkspaceMembership,\n    } = options.routes;\n    routes.push(\n      createSlackIntegrationRoutes({\n        slack,\n        connectionCapabilities: adapters.agent_tools ? ['agent_tools'] : [],\n        tokenStore,\n        getExistingSlackConnection,\n        connectSlackInstallation,\n        disconnectSlackInstallation,\n        ...(requireActiveWorkspaceMembership ? {requireActiveWorkspaceMembership} : {}),\n      }),\n    );\n  }\n  if (options.routes && hasSlackWebhookRoutesOptions(options.routes) && webhookProcessor) {\n    routes.push(...createSlackWebhookRoutes({...options.routes, processor: webhookProcessor}));\n  }\n\n  return {\n    provider: SLACK_PROVIDER,\n    displayName: 'Slack',\n    adapters,\n    async connectionExternalUrl(connection: {id: string}): Promise<string | undefined> {\n      const installation = await getInstallationByConnectionId(connection.id);\n      if (!installation) return undefined;\n      return `https://app.slack.com/client/${encodeURIComponent(installation.teamId)}`;\n    },\n    ...options.cleanup,\n    routes,\n    webhookProcessors: webhookProcessor\n      ? [{routeIds: ['slack.event', 'slack.command'] as const, processor: webhookProcessor}]\n      : undefined,\n  };\n}\n\nfunction hasSlackInstallationRoutesOptions(\n  routes: SlackRouteOptions,\n): routes is SlackInstallationRouteOptions {\n  return (\n    routes.tokenStore !== undefined &&\n    routes.getExistingSlackConnection !== undefined &&\n    routes.connectSlackInstallation !== undefined &&\n    routes.disconnectSlackInstallation !== undefined\n  );\n}\n\nfunction hasSlackWebhookRoutesOptions(\n  routes: SlackRouteOptions,\n): routes is CreateSlackWebhookRoutesOptions {\n  return (\n    routes.coreDb !== undefined &&\n    routes.claimWebhookDelivery !== undefined &&\n    routes.publishIntegrationEventReceived !== undefined &&\n    routes.recordDeliveryOnly !== undefined &&\n    routes.getIntegrationConnectionById !== undefined\n  );\n}\n"],"names":["SLACK_PROVIDER","createSlackApiClient","config","SlackAgentToolsProvider","createSlackWebhookProcessor","closeDb","db","getSlackInstallationByConnectionId","migrationsPath","createSlackIntegrationRoutes","createSlackWebhookRoutes","SLACK_TOOL_METHODS","slackAgentToolCatalog","slackAgentToolSelectionCatalog","disconnectSlackInstallation","SlackAccessTokenUnavailableError","SlackAuthorizationScopeMismatchError","SlackBotTokenMissingError","SlackConnectionAlreadyLinkedError","SlackConnectionNotFoundError","SlackEnterpriseInstallUnsupportedError","SlackInstallationAlreadyLinkedError","SlackInstallStateActorMismatchError","SlackInstallStateError","SlackIntegrationProviderError","SlackOAuthCallbackError","handleSlackCallback","handleSlackOAuthCallbackError","assertSlackAuthorizationScopes","formatSlackBotScopes","SLACK_BOT_SCOPES","isSlackTimestampWithinReplayWindow","verifySlackSignature","signSlackInstallState","verifySlackInstallState","createSlackTokenStore","slackSecretsNamespace","handleSlackCommand","handleSlackEvent","isSelfAuthoredSlackEvent","deleteSlackInstallationByConnectionId","getSlackInstallationByTeamId","markSlackInstallationRevoked","upsertSlackInstallation","createSlackE2eRoutes","SLACK_WEBHOOK_BODY_LIMIT","SLASH_COMMAND_ACK","createSlackIntegrationProvider","options","slack","getInstallationByConnectionId","adapters","agentTools","agent_tools","tokenStore","routes","hasSlackInstallationRoutesOptions","hasSlackWebhookRoutesOptions","Error","webhookProcessor","undefined","getExistingSlackConnection","connectSlackInstallation","requireActiveWorkspaceMembership","push","connectionCapabilities","processor","provider","displayName","connectionExternalUrl","connection","installation","id","encodeURIComponent","teamId","cleanup","webhookProcessors","routeIds","coreDb","claimWebhookDelivery","publishIntegrationEventReceived","recordDeliveryOnly","getIntegrationConnectionById"],"mappings":"AAAA,SAAQA,cAAc,QAAO,qCAAqC;AAElE,SAAQC,oBAAoB,QAA4B,iBAAiB;AACzE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,uBAAuB,QAAO,gCAAgC;AAEtE,SAAQC,2BAA2B,QAAO,6BAA6B;AACvE,SAAQC,OAAO,EAAEC,EAAE,QAAO,YAAY;AACtC,SAAQC,kCAAkC,QAAO,uBAAuB;AACxE,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAEEC,4BAA4B,QACvB,kCAAkC;AACzC,SAEEC,wBAAwB,QACnB,mCAAmC;AAW1C,SAAQT,oBAAoB,QAAO,iBAAiB;AAMpD,SACEU,kBAAkB,EAClBC,qBAAqB,EACrBC,8BAA8B,QACzB,uBAAuB;AAK9B,SAAQV,uBAAuB,QAAO,gCAAgC;AACtE,SAEEW,2BAA2B,QACtB,sBAAsB;AAC7B,SACEC,gCAAgC,EAEhCC,oCAAoC,EACpCC,yBAAyB,EACzBC,iCAAiC,EACjCC,4BAA4B,EAC5BC,sCAAsC,EACtCC,mCAAmC,EACnCC,mCAAmC,EACnCC,sBAAsB,EACtBC,6BAA6B,EAC7BC,uBAAuB,QAClB,kBAAkB;AAEzB,SAAQC,mBAAmB,EAAEC,6BAA6B,QAAO,mBAAmB;AACpF,SACEC,8BAA8B,EAC9BC,oBAAoB,EACpBC,gBAAgB,QACX,kBAAkB;AAEzB,SAAQC,kCAAkC,EAAEC,oBAAoB,QAAO,qBAAqB;AAE5F,SAAQC,qBAAqB,EAAEC,uBAAuB,QAAO,iBAAiB;AAS9E,SAAQC,qBAAqB,EAAEC,qBAAqB,QAAO,kBAAkB;AAM7E,SAAQC,kBAAkB,EAAEC,gBAAgB,EAAEC,wBAAwB,QAAO,mBAAmB;AAMhG,SAAQnC,2BAA2B,QAAO,6BAA6B;AAMvE,SACEoC,qCAAqC,EACrCjC,kCAAkC,EAClCkC,4BAA4B,EAC5BC,4BAA4B,EAC5BC,uBAAuB,QAClB,uBAAuB;AAC9B,SAEEC,oBAAoB,QACf,mCAAmC;AAC1C,SAEElC,wBAAwB,EACxBmC,wBAAwB,EACxBC,iBAAiB,QACZ,mCAAmC;AAC1C,SAAQzC,OAAO,EAAEH,MAAM,EAAEI,EAAE,EAAEE,cAAc,GAAE;AAkB7C,OAAO,SAASuC,+BACdC,UAAiD,CAAC,CAAC;IAEnD,MAAMC,QAAQD,QAAQC,KAAK,IAAIhD;IAC/B,MAAMiD,gCACJF,QAAQzC,kCAAkC,IAAIA;IAChD,MAAM4C,WAAWH,QAAQI,UAAU,GAC/B;QACEC,aAAa,IAAIlD,wBAAwB;YACvC8C;YACAK,YAAYN,QAAQI,UAAU,CAACE,UAAU;QAC3C;IACF,IACA,CAAC;IACL,IACEN,QAAQO,MAAM,IACd,CAACC,kCAAkCR,QAAQO,MAAM,KACjD,CAACE,6BAA6BT,QAAQO,MAAM,GAC5C;QACA,MAAM,IAAIG,MAAM;IAClB;IACA,MAAMH,SAAuB,EAAE;IAC/B,MAAMI,mBACJX,QAAQO,MAAM,IAAIE,6BAA6BT,QAAQO,MAAM,IACzDnD,4BAA4B4C,QAAQO,MAAM,IAC1CK;IACN,IAAIZ,QAAQO,MAAM,IAAIC,kCAAkCR,QAAQO,MAAM,GAAG;QACvE,MAAM,EACJD,UAAU,EACVO,0BAA0B,EAC1BC,wBAAwB,EACxBhD,2BAA2B,EAC3BiD,gCAAgC,EACjC,GAAGf,QAAQO,MAAM;QAClBA,OAAOS,IAAI,CACTvD,6BAA6B;YAC3BwC;YACAgB,wBAAwBd,SAASE,WAAW,GAAG;gBAAC;aAAc,GAAG,EAAE;YACnEC;YACAO;YACAC;YACAhD;YACA,GAAIiD,mCAAmC;gBAACA;YAAgC,IAAI,CAAC,CAAC;QAChF;IAEJ;IACA,IAAIf,QAAQO,MAAM,IAAIE,6BAA6BT,QAAQO,MAAM,KAAKI,kBAAkB;QACtFJ,OAAOS,IAAI,IAAItD,yBAAyB;YAAC,GAAGsC,QAAQO,MAAM;YAAEW,WAAWP;QAAgB;IACzF;IAEA,OAAO;QACLQ,UAAUnE;QACVoE,aAAa;QACbjB;QACA,MAAMkB,uBAAsBC,UAAwB;YAClD,MAAMC,eAAe,MAAMrB,8BAA8BoB,WAAWE,EAAE;YACtE,IAAI,CAACD,cAAc,OAAOX;YAC1B,OAAO,CAAC,6BAA6B,EAAEa,mBAAmBF,aAAaG,MAAM,GAAG;QAClF;QACA,GAAG1B,QAAQ2B,OAAO;QAClBpB;QACAqB,mBAAmBjB,mBACf;YAAC;gBAACkB,UAAU;oBAAC;oBAAe;iBAAgB;gBAAWX,WAAWP;YAAgB;SAAE,GACpFC;IACN;AACF;AAEA,SAASJ,kCACPD,MAAyB;IAEzB,OACEA,OAAOD,UAAU,KAAKM,aACtBL,OAAOM,0BAA0B,KAAKD,aACtCL,OAAOO,wBAAwB,KAAKF,aACpCL,OAAOzC,2BAA2B,KAAK8C;AAE3C;AAEA,SAASH,6BACPF,MAAyB;IAEzB,OACEA,OAAOuB,MAAM,KAAKlB,aAClBL,OAAOwB,oBAAoB,KAAKnB,aAChCL,OAAOyB,+BAA+B,KAAKpB,aAC3CL,OAAO0B,kBAAkB,KAAKrB,aAC9BL,OAAO2B,4BAA4B,KAAKtB;AAE5C"}

package/dist/presentation/routes/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/errors.ts"],"names":[],"mappings":"AAuBA,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA4C5D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/errors.ts"],"names":[],"mappings":"AAyBA,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA8D5D"}

package/dist/presentation/routes/errors.js

@@ -1,4 +1,6 @@
 import { ConnectionSlugConflictError } from '@shipfox/api-integration-core-dto';
+import { workspacesInterModuleContract } from '@shipfox/api-workspaces-dto/inter-module';
+import { isInterModuleKnownError } from '@shipfox/inter-module';
 import { ClientError } from '@shipfox/node-fastify';
 import { SlackAuthorizationScopeMismatchError, SlackConnectionAlreadyLinkedError, SlackEnterpriseInstallUnsupportedError, SlackInstallationAlreadyLinkedError, SlackInstallStateActorMismatchError, SlackInstallStateError, SlackIntegrationProviderError, SlackOAuthCallbackError, SlackTokenRotationUnsupportedError } from '#core/errors.js';
 function providerStatus(reason) {
@@ -7,6 +9,26 @@ function providerStatus(reason) {
     return 422;
 }
 export function slackRouteErrorHandler(error) {
+    if (isInterModuleKnownError(workspacesInterModuleContract.methods.requireActiveMembership, error)) {
+        if (error.code === 'workspace-not-found') throw new ClientError('Workspace not found', 'not-found', {
+            status: 404,
+            details: {
+                workspace_id: error.details.workspaceId
+            }
+        });
+        if (error.code === 'membership-required') throw new ClientError('Workspace membership required', 'forbidden', {
+            status: 403,
+            details: {
+                workspace_id: error.details.workspaceId
+            }
+        });
+        throw new ClientError('Workspace is inactive', 'workspace-inactive', {
+            status: 403,
+            details: {
+                workspace_id: error.details.workspaceId
+            }
+        });
+    }
     if (error instanceof SlackInstallStateError) {
         throw new ClientError(error.message, 'invalid-slack-install-state', {
             status: 400

package/dist/presentation/routes/errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/errors.ts"],"sourcesContent":["import {\n  ConnectionSlugConflictError,\n  type IntegrationProviderErrorReason,\n} from '@shipfox/api-integration-core-dto';\nimport {ClientError} from '@shipfox/node-fastify';\nimport {\n  SlackAuthorizationScopeMismatchError,\n  SlackConnectionAlreadyLinkedError,\n  SlackEnterpriseInstallUnsupportedError,\n  SlackInstallationAlreadyLinkedError,\n  SlackInstallStateActorMismatchError,\n  SlackInstallStateError,\n  SlackIntegrationProviderError,\n  SlackOAuthCallbackError,\n  SlackTokenRotationUnsupportedError,\n} from '#core/errors.js';\n\nfunction providerStatus(reason: IntegrationProviderErrorReason): number {\n  if (reason === 'rate-limited') return 429;\n  if (reason === 'timeout' || reason === 'provider-unavailable') return 503;\n  return 422;\n}\n\nexport function slackRouteErrorHandler(error: unknown): never {\n  if (error instanceof SlackInstallStateError) {\n    throw new ClientError(error.message, 'invalid-slack-install-state', {status: 400});\n  }\n  if (error instanceof SlackInstallStateActorMismatchError) {\n    throw new ClientError(error.message, 'slack-install-state-actor-mismatch', {status: 403});\n  }\n  if (error instanceof SlackInstallationAlreadyLinkedError) {\n    throw new ClientError(error.message, 'slack-installation-already-linked', {status: 409});\n  }\n  if (error instanceof SlackConnectionAlreadyLinkedError) {\n    throw new ClientError(error.message, 'slack-connection-already-linked', {status: 409});\n  }\n  if (error instanceof SlackAuthorizationScopeMismatchError) {\n    throw new ClientError(error.message, 'slack-authorization-scope-mismatch', {\n      status: 422,\n      details: {missing_scopes: error.missingScopes},\n    });\n  }\n  if (error instanceof SlackEnterpriseInstallUnsupportedError) {\n    throw new ClientError(error.message, 'slack-enterprise-install-unsupported', {status: 422});\n  }\n  if (error instanceof SlackTokenRotationUnsupportedError) {\n    throw new ClientError(error.message, 'slack-token-rotation-unsupported', {status: 422});\n  }\n  if (error instanceof SlackOAuthCallbackError) {\n    throw new ClientError(error.message, 'slack-oauth-callback-error', {\n      status: 422,\n      details: {\n        error: error.providerError,\n        ...(error.providerDescription ? {error_description: error.providerDescription} : {}),\n      },\n    });\n  }\n  if (error instanceof ConnectionSlugConflictError) {\n    throw new ClientError(error.message, 'slug-conflict', {status: 409});\n  }\n  if (error instanceof SlackIntegrationProviderError) {\n    throw new ClientError(error.message, error.reason, {\n      details: {retry_after_seconds: error.retryAfterSeconds},\n      status: providerStatus(error.reason),\n    });\n  }\n  throw error;\n}\n"],"names":["ConnectionSlugConflictError","ClientError","SlackAuthorizationScopeMismatchError","SlackConnectionAlreadyLinkedError","SlackEnterpriseInstallUnsupportedError","SlackInstallationAlreadyLinkedError","SlackInstallStateActorMismatchError","SlackInstallStateError","SlackIntegrationProviderError","SlackOAuthCallbackError","SlackTokenRotationUnsupportedError","providerStatus","reason","slackRouteErrorHandler","error","message","status","details","missing_scopes","missingScopes","providerError","providerDescription","error_description","retry_after_seconds","retryAfterSeconds"],"mappings":"AAAA,SACEA,2BAA2B,QAEtB,oCAAoC;AAC3C,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SACEC,oCAAoC,EACpCC,iCAAiC,EACjCC,sCAAsC,EACtCC,mCAAmC,EACnCC,mCAAmC,EACnCC,sBAAsB,EACtBC,6BAA6B,EAC7BC,uBAAuB,EACvBC,kCAAkC,QAC7B,kBAAkB;AAEzB,SAASC,eAAeC,MAAsC;IAC5D,IAAIA,WAAW,gBAAgB,OAAO;IACtC,IAAIA,WAAW,aAAaA,WAAW,wBAAwB,OAAO;IACtE,OAAO;AACT;AAEA,OAAO,SAASC,uBAAuBC,KAAc;IACnD,IAAIA,iBAAiBP,wBAAwB;QAC3C,MAAM,IAAIN,YAAYa,MAAMC,OAAO,EAAE,+BAA+B;YAACC,QAAQ;QAAG;IAClF;IACA,IAAIF,iBAAiBR,qCAAqC;QACxD,MAAM,IAAIL,YAAYa,MAAMC,OAAO,EAAE,sCAAsC;YAACC,QAAQ;QAAG;IACzF;IACA,IAAIF,iBAAiBT,qCAAqC;QACxD,MAAM,IAAIJ,YAAYa,MAAMC,OAAO,EAAE,qCAAqC;YAACC,QAAQ;QAAG;IACxF;IACA,IAAIF,iBAAiBX,mCAAmC;QACtD,MAAM,IAAIF,YAAYa,MAAMC,OAAO,EAAE,mCAAmC;YAACC,QAAQ;QAAG;IACtF;IACA,IAAIF,iBAAiBZ,sCAAsC;QACzD,MAAM,IAAID,YAAYa,MAAMC,OAAO,EAAE,sCAAsC;YACzEC,QAAQ;YACRC,SAAS;gBAACC,gBAAgBJ,MAAMK,aAAa;YAAA;QAC/C;IACF;IACA,IAAIL,iBAAiBV,wCAAwC;QAC3D,MAAM,IAAIH,YAAYa,MAAMC,OAAO,EAAE,wCAAwC;YAACC,QAAQ;QAAG;IAC3F;IACA,IAAIF,iBAAiBJ,oCAAoC;QACvD,MAAM,IAAIT,YAAYa,MAAMC,OAAO,EAAE,oCAAoC;YAACC,QAAQ;QAAG;IACvF;IACA,IAAIF,iBAAiBL,yBAAyB;QAC5C,MAAM,IAAIR,YAAYa,MAAMC,OAAO,EAAE,8BAA8B;YACjEC,QAAQ;YACRC,SAAS;gBACPH,OAAOA,MAAMM,aAAa;gBAC1B,GAAIN,MAAMO,mBAAmB,GAAG;oBAACC,mBAAmBR,MAAMO,mBAAmB;gBAAA,IAAI,CAAC,CAAC;YACrF;QACF;IACF;IACA,IAAIP,iBAAiBd,6BAA6B;QAChD,MAAM,IAAIC,YAAYa,MAAMC,OAAO,EAAE,iBAAiB;YAACC,QAAQ;QAAG;IACpE;IACA,IAAIF,iBAAiBN,+BAA+B;QAClD,MAAM,IAAIP,YAAYa,MAAMC,OAAO,EAAED,MAAMF,MAAM,EAAE;YACjDK,SAAS;gBAACM,qBAAqBT,MAAMU,iBAAiB;YAAA;YACtDR,QAAQL,eAAeG,MAAMF,MAAM;QACrC;IACF;IACA,MAAME;AACR"}
+{"version":3,"sources":["../../../src/presentation/routes/errors.ts"],"sourcesContent":["import {\n  ConnectionSlugConflictError,\n  type IntegrationProviderErrorReason,\n} from '@shipfox/api-integration-core-dto';\nimport {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {ClientError} from '@shipfox/node-fastify';\nimport {\n  SlackAuthorizationScopeMismatchError,\n  SlackConnectionAlreadyLinkedError,\n  SlackEnterpriseInstallUnsupportedError,\n  SlackInstallationAlreadyLinkedError,\n  SlackInstallStateActorMismatchError,\n  SlackInstallStateError,\n  SlackIntegrationProviderError,\n  SlackOAuthCallbackError,\n  SlackTokenRotationUnsupportedError,\n} from '#core/errors.js';\n\nfunction providerStatus(reason: IntegrationProviderErrorReason): number {\n  if (reason === 'rate-limited') return 429;\n  if (reason === 'timeout' || reason === 'provider-unavailable') return 503;\n  return 422;\n}\n\nexport function slackRouteErrorHandler(error: unknown): never {\n  if (\n    isInterModuleKnownError(workspacesInterModuleContract.methods.requireActiveMembership, error)\n  ) {\n    if (error.code === 'workspace-not-found')\n      throw new ClientError('Workspace not found', 'not-found', {\n        status: 404,\n        details: {workspace_id: error.details.workspaceId},\n      });\n    if (error.code === 'membership-required')\n      throw new ClientError('Workspace membership required', 'forbidden', {\n        status: 403,\n        details: {workspace_id: error.details.workspaceId},\n      });\n    throw new ClientError('Workspace is inactive', 'workspace-inactive', {\n      status: 403,\n      details: {workspace_id: error.details.workspaceId},\n    });\n  }\n  if (error instanceof SlackInstallStateError) {\n    throw new ClientError(error.message, 'invalid-slack-install-state', {status: 400});\n  }\n  if (error instanceof SlackInstallStateActorMismatchError) {\n    throw new ClientError(error.message, 'slack-install-state-actor-mismatch', {status: 403});\n  }\n  if (error instanceof SlackInstallationAlreadyLinkedError) {\n    throw new ClientError(error.message, 'slack-installation-already-linked', {status: 409});\n  }\n  if (error instanceof SlackConnectionAlreadyLinkedError) {\n    throw new ClientError(error.message, 'slack-connection-already-linked', {status: 409});\n  }\n  if (error instanceof SlackAuthorizationScopeMismatchError) {\n    throw new ClientError(error.message, 'slack-authorization-scope-mismatch', {\n      status: 422,\n      details: {missing_scopes: error.missingScopes},\n    });\n  }\n  if (error instanceof SlackEnterpriseInstallUnsupportedError) {\n    throw new ClientError(error.message, 'slack-enterprise-install-unsupported', {status: 422});\n  }\n  if (error instanceof SlackTokenRotationUnsupportedError) {\n    throw new ClientError(error.message, 'slack-token-rotation-unsupported', {status: 422});\n  }\n  if (error instanceof SlackOAuthCallbackError) {\n    throw new ClientError(error.message, 'slack-oauth-callback-error', {\n      status: 422,\n      details: {\n        error: error.providerError,\n        ...(error.providerDescription ? {error_description: error.providerDescription} : {}),\n      },\n    });\n  }\n  if (error instanceof ConnectionSlugConflictError) {\n    throw new ClientError(error.message, 'slug-conflict', {status: 409});\n  }\n  if (error instanceof SlackIntegrationProviderError) {\n    throw new ClientError(error.message, error.reason, {\n      details: {retry_after_seconds: error.retryAfterSeconds},\n      status: providerStatus(error.reason),\n    });\n  }\n  throw error;\n}\n"],"names":["ConnectionSlugConflictError","workspacesInterModuleContract","isInterModuleKnownError","ClientError","SlackAuthorizationScopeMismatchError","SlackConnectionAlreadyLinkedError","SlackEnterpriseInstallUnsupportedError","SlackInstallationAlreadyLinkedError","SlackInstallStateActorMismatchError","SlackInstallStateError","SlackIntegrationProviderError","SlackOAuthCallbackError","SlackTokenRotationUnsupportedError","providerStatus","reason","slackRouteErrorHandler","error","methods","requireActiveMembership","code","status","details","workspace_id","workspaceId","message","missing_scopes","missingScopes","providerError","providerDescription","error_description","retry_after_seconds","retryAfterSeconds"],"mappings":"AAAA,SACEA,2BAA2B,QAEtB,oCAAoC;AAC3C,SAAQC,6BAA6B,QAAO,2CAA2C;AACvF,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SACEC,oCAAoC,EACpCC,iCAAiC,EACjCC,sCAAsC,EACtCC,mCAAmC,EACnCC,mCAAmC,EACnCC,sBAAsB,EACtBC,6BAA6B,EAC7BC,uBAAuB,EACvBC,kCAAkC,QAC7B,kBAAkB;AAEzB,SAASC,eAAeC,MAAsC;IAC5D,IAAIA,WAAW,gBAAgB,OAAO;IACtC,IAAIA,WAAW,aAAaA,WAAW,wBAAwB,OAAO;IACtE,OAAO;AACT;AAEA,OAAO,SAASC,uBAAuBC,KAAc;IACnD,IACEd,wBAAwBD,8BAA8BgB,OAAO,CAACC,uBAAuB,EAAEF,QACvF;QACA,IAAIA,MAAMG,IAAI,KAAK,uBACjB,MAAM,IAAIhB,YAAY,uBAAuB,aAAa;YACxDiB,QAAQ;YACRC,SAAS;gBAACC,cAAcN,MAAMK,OAAO,CAACE,WAAW;YAAA;QACnD;QACF,IAAIP,MAAMG,IAAI,KAAK,uBACjB,MAAM,IAAIhB,YAAY,iCAAiC,aAAa;YAClEiB,QAAQ;YACRC,SAAS;gBAACC,cAAcN,MAAMK,OAAO,CAACE,WAAW;YAAA;QACnD;QACF,MAAM,IAAIpB,YAAY,yBAAyB,sBAAsB;YACnEiB,QAAQ;YACRC,SAAS;gBAACC,cAAcN,MAAMK,OAAO,CAACE,WAAW;YAAA;QACnD;IACF;IACA,IAAIP,iBAAiBP,wBAAwB;QAC3C,MAAM,IAAIN,YAAYa,MAAMQ,OAAO,EAAE,+BAA+B;YAACJ,QAAQ;QAAG;IAClF;IACA,IAAIJ,iBAAiBR,qCAAqC;QACxD,MAAM,IAAIL,YAAYa,MAAMQ,OAAO,EAAE,sCAAsC;YAACJ,QAAQ;QAAG;IACzF;IACA,IAAIJ,iBAAiBT,qCAAqC;QACxD,MAAM,IAAIJ,YAAYa,MAAMQ,OAAO,EAAE,qCAAqC;YAACJ,QAAQ;QAAG;IACxF;IACA,IAAIJ,iBAAiBX,mCAAmC;QACtD,MAAM,IAAIF,YAAYa,MAAMQ,OAAO,EAAE,mCAAmC;YAACJ,QAAQ;QAAG;IACtF;IACA,IAAIJ,iBAAiBZ,sCAAsC;QACzD,MAAM,IAAID,YAAYa,MAAMQ,OAAO,EAAE,sCAAsC;YACzEJ,QAAQ;YACRC,SAAS;gBAACI,gBAAgBT,MAAMU,aAAa;YAAA;QAC/C;IACF;IACA,IAAIV,iBAAiBV,wCAAwC;QAC3D,MAAM,IAAIH,YAAYa,MAAMQ,OAAO,EAAE,wCAAwC;YAACJ,QAAQ;QAAG;IAC3F;IACA,IAAIJ,iBAAiBJ,oCAAoC;QACvD,MAAM,IAAIT,YAAYa,MAAMQ,OAAO,EAAE,oCAAoC;YAACJ,QAAQ;QAAG;IACvF;IACA,IAAIJ,iBAAiBL,yBAAyB;QAC5C,MAAM,IAAIR,YAAYa,MAAMQ,OAAO,EAAE,8BAA8B;YACjEJ,QAAQ;YACRC,SAAS;gBACPL,OAAOA,MAAMW,aAAa;gBAC1B,GAAIX,MAAMY,mBAAmB,GAAG;oBAACC,mBAAmBb,MAAMY,mBAAmB;gBAAA,IAAI,CAAC,CAAC;YACrF;QACF;IACF;IACA,IAAIZ,iBAAiBhB,6BAA6B;QAChD,MAAM,IAAIG,YAAYa,MAAMQ,OAAO,EAAE,iBAAiB;YAACJ,QAAQ;QAAG;IACpE;IACA,IAAIJ,iBAAiBN,+BAA+B;QAClD,MAAM,IAAIP,YAAYa,MAAMQ,OAAO,EAAER,MAAMF,MAAM,EAAE;YACjDO,SAAS;gBAACS,qBAAqBd,MAAMe,iBAAiB;YAAA;YACtDX,QAAQP,eAAeG,MAAMF,MAAM;QACrC;IACF;IACA,MAAME;AACR"}

package/dist/presentation/routes/install.d.ts

@@ -14,6 +14,11 @@ export interface CreateSlackIntegrationRoutesOptions {
         connectionId: string;
     }) => Promise<void>;
     connectionCapabilities: IntegrationCapability[];
+    requireActiveWorkspaceMembership?: (input: {
+        workspaceId: string;
+        userId: string;
+        memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+    }) => Promise<unknown>;
 }
-export declare function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSlackConnection, connectSlackInstallation, disconnectSlackInstallation, connectionCapabilities, }: CreateSlackIntegrationRoutesOptions): RouteGroup;
+export declare function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSlackConnection, connectSlackInstallation, disconnectSlackInstallation, connectionCapabilities, requireActiveWorkspaceMembership, }: CreateSlackIntegrationRoutesOptions): RouteGroup;
 //# sourceMappingURL=install.d.ts.map

package/dist/presentation/routes/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AASpG,OAAO,EAAc,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EACL,KAAK,6BAA6B,EAGnC,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAIrD,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,cAAc,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACjD,0BAA0B,EAAE,CAAC,KAAK,EAAE;QAClC,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1D,wBAAwB,EAAE,CACxB,KAAK,EAAE,6BAA6B,KACjC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,2BAA2B,EAAE,CAAC,KAAK,EAAE;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;CACjD;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,KAAK,EACL,UAAU,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,GACvB,EAAE,mCAAmC,GAAG,UAAU,CAgElD"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AAQpG,OAAO,EAAc,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EACL,KAAK,6BAA6B,EAGnC,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AAIrD,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,cAAc,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACjD,0BAA0B,EAAE,CAAC,KAAK,EAAE;QAClC,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1D,wBAAwB,EAAE,CACxB,KAAK,EAAE,6BAA6B,KACjC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,2BAA2B,EAAE,CAAC,KAAK,EAAE;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;IAChD,gCAAgC,CAAC,EAAE,CAAC,KAAK,EAAE;QACzC,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,aAAa,CAAC,OAAO,2BAA2B,EAAE,qBAAqB,CAAC,CAAC;KACvF,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxB;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,KAAK,EACL,UAAU,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,gCAAgC,GACjC,EAAE,mCAAmC,GAAG,UAAU,CAkElD"}

package/dist/presentation/routes/install.js

@@ -1,6 +1,5 @@
 import { AUTH_USER, requireUserContext, requireWorkspaceAccess } from '@shipfox/api-auth-context';
 import { createSlackInstallBodySchema, createSlackInstallResponseSchema, slackCallbackQuerySchema, slackCallbackResponseSchema } from '@shipfox/api-integration-slack-dto';
-import { requireWorkspaceMembership } from '@shipfox/api-workspaces';
 import { defineRoute } from '@shipfox/node-fastify';
 import { config } from '#config.js';
 import { handleSlackCallback, handleSlackOAuthCallbackError } from '#core/install.js';
@@ -8,7 +7,7 @@ import { formatSlackBotScopes } from '#core/scopes.js';
 import { signSlackInstallState } from '#core/state.js';
 import { toIntegrationConnectionDto } from '#presentation/dto/integrations.js';
 import { slackRouteErrorHandler } from './errors.js';
-export function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSlackConnection, connectSlackInstallation, disconnectSlackInstallation, connectionCapabilities }) {
+export function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSlackConnection, connectSlackInstallation, disconnectSlackInstallation, connectionCapabilities, requireActiveWorkspaceMembership }) {
     const installRoute = defineRoute({
         method: 'POST',
         path: '/install',
@@ -63,7 +62,7 @@ export function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSla
                     errorDescription: query.error_description,
                     sessionUserId: actor.userId,
                     sessionMemberships: actor.memberships,
-                    requireWorkspaceMembership
+                    requireWorkspaceMembership: requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck
                 });
             }
             const connection = await handleSlackCallback({
@@ -73,7 +72,7 @@ export function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSla
                 state: query.state,
                 sessionUserId: actor.userId,
                 sessionMemberships: actor.memberships,
-                requireWorkspaceMembership,
+                requireWorkspaceMembership: requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
                 getExistingSlackConnection,
                 connectSlackInstallation,
                 disconnectSlackInstallation
@@ -91,6 +90,9 @@ export function createSlackIntegrationRoutes({ slack, tokenStore, getExistingSla
         ]
     };
 }
+function unavailableWorkspaceMembershipCheck(_input) {
+    return Promise.reject(new Error('Workspaces inter-module client is not configured'));
+}
 function isSlackOAuthErrorCallback(query) {
     return 'error' in query && typeof query.error === 'string';
 }