@shipfox/api-integration-slack 5.0.0 → 6.0.0

package/src/presentation/routes/install.ts

@@ -7,7 +7,6 @@ import {
   slackCallbackQuerySchema,
   slackCallbackResponseSchema,
 } from '@shipfox/api-integration-slack-dto';
-import {requireWorkspaceMembership} from '@shipfox/api-workspaces';
 import {defineRoute, type RouteGroup} from '@shipfox/node-fastify';
 import type {SlackApiClient} from '#api/client.js';
 import {config} from '#config.js';
@@ -33,6 +32,11 @@ export interface CreateSlackIntegrationRoutesOptions {
   ) => Promise<IntegrationConnection<'slack'>>;
   disconnectSlackInstallation: (input: {connectionId: string}) => Promise<void>;
   connectionCapabilities: IntegrationCapability[];
+  requireActiveWorkspaceMembership?: (input: {
+    workspaceId: string;
+    userId: string;
+    memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+  }) => Promise<unknown>;
 }
 
 export function createSlackIntegrationRoutes({
@@ -42,6 +46,7 @@ export function createSlackIntegrationRoutes({
   connectSlackInstallation,
   disconnectSlackInstallation,
   connectionCapabilities,
+  requireActiveWorkspaceMembership,
 }: CreateSlackIntegrationRoutesOptions): RouteGroup {
   const installRoute = defineRoute({
     method: 'POST',
@@ -86,7 +91,8 @@ export function createSlackIntegrationRoutes({
           errorDescription: query.error_description,
           sessionUserId: actor.userId,
           sessionMemberships: actor.memberships,
-          requireWorkspaceMembership,
+          requireWorkspaceMembership:
+            requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
         });
       }
       const connection = await handleSlackCallback({
@@ -96,7 +102,8 @@ export function createSlackIntegrationRoutes({
         state: query.state,
         sessionUserId: actor.userId,
         sessionMemberships: actor.memberships,
-        requireWorkspaceMembership,
+        requireWorkspaceMembership:
+          requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
         getExistingSlackConnection,
         connectSlackInstallation,
         disconnectSlackInstallation,
@@ -108,6 +115,14 @@ export function createSlackIntegrationRoutes({
   return {prefix: '/integrations/slack', routes: [installRoute, callbackApiRoute]};
 }
 
+function unavailableWorkspaceMembershipCheck(_input: {
+  workspaceId: string;
+  userId: string;
+  memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+}): Promise<never> {
+  return Promise.reject(new Error('Workspaces inter-module client is not configured'));
+}
+
 function isSlackOAuthErrorCallback(query: SlackCallbackQueryDto): query is SlackCallbackQueryDto & {
   error: string;
   error_description?: string | undefined;

package/src/presentation/routes/webhooks.test.ts

@@ -1,5 +1,6 @@
 import {createHmac, randomUUID} from 'node:crypto';
 import type {IntegrationConnection} from '@shipfox/api-integration-core-dto';
+import {WEBHOOK_MAX_RAW_BODY_BYTES} from '@shipfox/api-integration-core-dto';
 import {closeApp, createApp} from '@shipfox/node-fastify';
 import {db} from '#db/db.js';
 import {getSlackInstallationByTeamId, upsertSlackInstallation} from '#db/installations.js';
@@ -161,6 +162,23 @@ describe('Slack webhook routes', () => {
     expect(recordDeliveryOnly).not.toHaveBeenCalled();
   });
 
+  it('rejects a body too large for the shared webhook request before processing it', async () => {
+    const {app, publishIntegrationEventReceived, recordDeliveryOnly} = await createTestApp();
+    const rawBody = 'a'.repeat(WEBHOOK_MAX_RAW_BODY_BYTES + 1);
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/slack/events',
+      headers: slackHeaders(rawBody, 'application/json'),
+      payload: rawBody,
+    });
+
+    expect(response.statusCode).toBe(413);
+    expect(response.json()).toEqual({code: 'body-too-large'});
+    expect(publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(recordDeliveryOnly).not.toHaveBeenCalled();
+  });
+
   it('publishes a signed event delivery through the route transaction', async () => {
     const {app, connection, publishIntegrationEventReceived} = await createTestApp();
     await seedInstallation(connection);

package/src/presentation/routes/webhooks.ts

@@ -1,20 +1,24 @@
-import {Buffer} from 'node:buffer';
+import {randomUUID} from 'node:crypto';
 import type {
   ClaimWebhookDeliveryFn,
   GetIntegrationConnectionByIdFn,
   PublishIntegrationEventReceivedFn,
   RecordDeliveryOnlyFn,
+  StoredWebhookRequest,
+  WebhookProcessingResult,
 } from '@shipfox/api-integration-core-dto';
 import {
-  slackEventsRequestSchema,
-  slackSlashCommandSchema,
-} from '@shipfox/api-integration-slack-dto';
-import {createRawBodyPlugin, defineRoute, type RouteGroup} from '@shipfox/node-fastify';
-import {logger} from '@shipfox/node-opentelemetry';
+  createStoredWebhookRequest,
+  WEBHOOK_MAX_RAW_BODY_BYTES,
+} from '@shipfox/api-integration-core-dto';
+import {
+  ClientError,
+  createRawBodyPlugin,
+  defineRoute,
+  type RouteGroup,
+} from '@shipfox/node-fastify';
 import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
-import {config} from '#config.js';
-import {verifySlackSignature} from '#core/signature.js';
-import {handleSlackCommand, handleSlackEvent} from '#core/webhook.js';
+import {createSlackWebhookProcessor, type SlackWebhookProcessor} from '#core/webhook-processor.js';
 
 export const SLACK_WEBHOOK_BODY_LIMIT = 1024 * 1024;
 export const SLASH_COMMAND_ACK = {response_type: 'ephemeral', text: 'Working on it.'} as const;
@@ -34,9 +38,11 @@ export interface CreateSlackWebhookRoutesOptions {
   publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
   recordDeliveryOnly: RecordDeliveryOnlyFn;
   getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+  processor?: SlackWebhookProcessor | undefined;
 }
 
 export function createSlackWebhookRoutes(options: CreateSlackWebhookRoutesOptions): RouteGroup[] {
+  const processor = options.processor ?? createSlackWebhookProcessor(options);
   const eventsRoute = defineRoute({
     method: 'POST',
     path: '/',
@@ -44,59 +50,25 @@ export function createSlackWebhookRoutes(options: CreateSlackWebhookRoutesOption
     description: 'Slack Events API receiver.',
     options: {bodyLimit: SLACK_WEBHOOK_BODY_LIMIT},
     handler: async (request, reply) => {
-      const rawBody = rawRequestBody(request.body);
-      if (rawBody === undefined) {
+      const body = rawRequestBody(request.body);
+      if (!body) {
         reply.code(400);
         return {error: 'expected raw JSON body'};
       }
-      if (!hasValidSlackSignature(request.headers, rawBody)) {
-        reply.code(401);
-        return {error: 'invalid signature'};
-      }
-
-      let parsedJson: unknown;
-      try {
-        parsedJson = JSON.parse(rawBody);
-      } catch (error) {
-        logger().warn(
-          {errorName: error instanceof Error ? error.name : 'unknown'},
-          'slack events payload JSON parse failed',
-        );
-        reply.code(400);
-        return {error: 'malformed JSON'};
-      }
-
-      const parsed = slackEventsRequestSchema.safeParse(parsedJson);
-      if (!parsed.success) {
-        logger().warn(
-          {issues: parsed.error.issues},
-          'slack events envelope failed schema validation',
-        );
-        reply.code(200);
-        return null;
-      }
-      const eventRequest = parsed.data;
-      if (eventRequest.type === 'url_verification') {
-        reply.code(200);
-        return {challenge: eventRequest.challenge};
-      }
-
-      await options.coreDb().transaction(async (tx) => {
-        await handleSlackEvent({
-          tx,
-          deliveryId: eventRequest.event_id,
-          envelope: eventRequest,
-          claimWebhookDelivery: options.claimWebhookDelivery,
-          publishIntegrationEventReceived: options.publishIntegrationEventReceived,
-          recordDeliveryOnly: options.recordDeliveryOnly,
-          getIntegrationConnectionById: options.getIntegrationConnectionById,
-        });
-      });
-      reply.code(200);
-      return null;
+      const result = await processor.process(
+        createSlackStoredWebhookRequest(
+          {
+            routeId: 'slack.event',
+            body,
+            headers: request.headers,
+            rawQueryString: rawQueryString(request),
+          },
+          new Date().toISOString(),
+        ),
+      );
+      return sendSlackEventResponse(reply, result);
     },
   });
-
   const commandsRoute = defineRoute({
     method: 'POST',
     path: '/',
@@ -104,37 +76,23 @@ export function createSlackWebhookRoutes(options: CreateSlackWebhookRoutesOption
     description: 'Slack slash-command receiver.',
     options: {bodyLimit: SLACK_WEBHOOK_BODY_LIMIT},
     handler: async (request, reply) => {
-      const rawBody = rawRequestBody(request.body);
-      if (rawBody === undefined) {
+      const body = rawRequestBody(request.body);
+      if (!body) {
         reply.code(400);
         return {error: 'expected raw form body'};
       }
-      if (!hasValidSlackSignature(request.headers, rawBody)) {
-        reply.code(401);
-        return {error: 'invalid signature'};
-      }
-
-      const command = slackSlashCommandSchema.safeParse(
-        Object.fromEntries(new URLSearchParams(rawBody)),
+      const result = await processor.process(
+        createSlackStoredWebhookRequest(
+          {
+            routeId: 'slack.command',
+            body,
+            headers: request.headers,
+            rawQueryString: rawQueryString(request),
+          },
+          new Date().toISOString(),
+        ),
       );
-      if (!command.success) {
-        logger().warn({issues: command.error.issues}, 'slack command failed schema validation');
-        reply.code(200);
-        return SLASH_COMMAND_ACK;
-      }
-
-      await options.coreDb().transaction(async (tx) => {
-        await handleSlackCommand({
-          tx,
-          deliveryId: command.data.trigger_id,
-          command: command.data,
-          publishIntegrationEventReceived: options.publishIntegrationEventReceived,
-          recordDeliveryOnly: options.recordDeliveryOnly,
-          getIntegrationConnectionById: options.getIntegrationConnectionById,
-        });
-      });
-      reply.code(200);
-      return SLASH_COMMAND_ACK;
+      return sendSlackCommandResponse(reply, result);
     },
   });
 
@@ -154,20 +112,89 @@ export function createSlackWebhookRoutes(options: CreateSlackWebhookRoutesOption
   ];
 }
 
-function rawRequestBody(body: unknown): string | undefined {
-  return Buffer.isBuffer(body) ? body.toString('utf8') : undefined;
+function rawRequestBody(body: unknown): Uint8Array | undefined {
+  return body instanceof Uint8Array ? body : undefined;
 }
 
-function hasValidSlackSignature(
-  headers: Record<string, string | string[] | undefined>,
-  rawBody: string,
-): boolean {
-  const signature = headers['x-slack-signature'];
-  const timestamp = headers['x-slack-request-timestamp'];
-  return verifySlackSignature({
-    signingSecret: config.SLACK_SIGNING_SECRET,
-    signature: typeof signature === 'string' ? signature : undefined,
-    timestamp: typeof timestamp === 'string' ? timestamp : undefined,
-    rawBody,
-  });
+function rawQueryString(request: {raw: {url?: string | undefined}}): string {
+  return request.raw.url?.split('?')[1] ?? '';
+}
+
+function createSlackStoredWebhookRequest(
+  input: {
+    routeId: 'slack.event' | 'slack.command';
+    body: Uint8Array;
+    headers: Record<string, string | string[] | undefined>;
+    rawQueryString: string;
+  },
+  receivedAt: string,
+): StoredWebhookRequest {
+  if (input.body.byteLength > WEBHOOK_MAX_RAW_BODY_BYTES) {
+    throw new ClientError('Webhook request body is too large', 'body-too-large', {status: 413});
+  }
+  try {
+    return createStoredWebhookRequest({
+      requestId: randomUUID(),
+      routeId: input.routeId,
+      receivedAt,
+      rawQueryString: input.rawQueryString,
+      headers: slackWebhookHeaders(input.headers),
+      body: input.body,
+    });
+  } catch (error) {
+    throw new ClientError('Webhook request metadata is invalid', 'invalid-webhook-request', {
+      cause: error,
+    });
+  }
+}
+
+function slackWebhookHeaders(headers: Record<string, string | string[] | undefined>) {
+  return Object.fromEntries(
+    ['content-type', 'x-slack-signature', 'x-slack-request-timestamp'].flatMap((name) => {
+      const value = headers[name];
+      return typeof value === 'string' ? [[name, value]] : [];
+    }),
+  );
+}
+
+function sendSlackEventResponse(
+  reply: {code(statusCode: number): void},
+  result: WebhookProcessingResult,
+) {
+  if (result.outcome === 'processed' && 'challenge' in result) {
+    reply.code(200);
+    return {challenge: result.challenge};
+  }
+  if (
+    result.outcome === 'discarded' &&
+    (result.reason === 'invalid_signature' ||
+      result.reason === 'missing_required_input' ||
+      result.reason === 'stale_at_receipt')
+  ) {
+    reply.code(401);
+    return {error: 'invalid signature'};
+  }
+  if (result.outcome === 'discarded' && result.reason === 'malformed_payload') {
+    reply.code(400);
+    return {error: 'malformed JSON'};
+  }
+  reply.code(200);
+  return null;
+}
+
+function sendSlackCommandResponse(
+  reply: {code(statusCode: number): void},
+  result: WebhookProcessingResult,
+) {
+  if (
+    result.outcome === 'discarded' &&
+    (result.reason === 'invalid_signature' ||
+      result.reason === 'missing_required_input' ||
+      result.reason === 'stale_at_receipt')
+  ) {
+    reply.code(401);
+    return {error: 'invalid signature'};
+  }
+  reply.code(200);
+  return SLASH_COMMAND_ACK;
 }

package/test/globalSetup.ts

@@ -8,15 +8,6 @@ export async function setup() {
   createPostgresClient();
 
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_integrations_slack');
-  const {secretsModule} = await import('@shipfox/api-secrets');
-  if (!secretsModule.database || Array.isArray(secretsModule.database)) {
-    throw new Error('Secrets module database is not configured');
-  }
-  await runMigrations(
-    secretsModule.database.db(),
-    secretsModule.database.migrationsPath,
-    '__drizzle_migrations_secrets',
-  );
 
   closeDb();
   await closePostgresClient();