@useatlas/create 0.0.1

package/templates/docker/src/lib/slack/api.ts

@@ -0,0 +1,102 @@
+/**
+ * Thin Slack Web API client using native fetch.
+ *
+ * No heavy dependencies — POST to slack.com/api endpoints with JSON body
+ * and Bearer token auth. For oauth.v2.access, pass an empty token — Slack
+ * uses client_id/client_secret from the body instead.
+ */
+
+import { createLogger } from "@atlas/api/lib/logger";
+import type { SlackBlock } from "@atlas/api/lib/slack/format";
+
+const log = createLogger("slack-api");
+
+const SLACK_API_BASE = "https://slack.com/api";
+
+export type SlackAPIResponse =
+  | { ok: true; ts?: string; channel?: string; [key: string]: unknown }
+  | { ok: false; error: string };
+
+/**
+ * Call a Slack Web API method.
+ */
+export async function slackAPI(
+  method: string,
+  token: string,
+  body: Record<string, unknown>,
+): Promise<SlackAPIResponse> {
+  try {
+    const resp = await fetch(`${SLACK_API_BASE}/${method}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        Authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify(body),
+    });
+
+    if (!resp.ok) {
+      log.error({ method, status: resp.status }, "Slack API HTTP error");
+      return { ok: false, error: `HTTP ${resp.status}` };
+    }
+
+    const data = (await resp.json()) as Record<string, unknown>;
+    if (!data.ok) {
+      log.warn({ method, error: data.error }, "Slack API returned error");
+      return { ok: false, error: String(data.error ?? "unknown_error") };
+    }
+    return data as SlackAPIResponse;
+  } catch (err) {
+    log.error(
+      { method, err: err instanceof Error ? err.message : String(err) },
+      "Slack API request failed",
+    );
+    return { ok: false, error: `request_failed: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+
+/**
+ * Post a message to a Slack channel.
+ */
+export async function postMessage(
+  token: string,
+  params: {
+    channel: string;
+    text: string;
+    blocks?: SlackBlock[];
+    thread_ts?: string;
+  },
+): Promise<SlackAPIResponse> {
+  return slackAPI("chat.postMessage", token, params as Record<string, unknown>);
+}
+
+/**
+ * Update an existing Slack message.
+ */
+export async function updateMessage(
+  token: string,
+  params: {
+    channel: string;
+    ts: string;
+    text: string;
+    blocks?: SlackBlock[];
+  },
+): Promise<SlackAPIResponse> {
+  return slackAPI("chat.update", token, params as Record<string, unknown>);
+}
+
+/**
+ * Post an ephemeral message visible only to a specific user.
+ */
+export async function postEphemeral(
+  token: string,
+  params: {
+    channel: string;
+    user: string;
+    text: string;
+    blocks?: SlackBlock[];
+    thread_ts?: string;
+  },
+): Promise<SlackAPIResponse> {
+  return slackAPI("chat.postEphemeral", token, params as Record<string, unknown>);
+}

package/templates/docker/src/lib/slack/format.ts

@@ -0,0 +1,209 @@
+/**
+ * Convert Atlas query responses to Slack Block Kit format.
+ *
+ * Respects Slack limits: 50 blocks max, 3000 chars per text block.
+ * Truncates large data tables and adds a "Showing first N rows" note.
+ */
+
+import type { AgentQueryResult, PendingAction } from "@atlas/api/lib/agent-query";
+
+const MAX_TEXT_LENGTH = 3000;
+const MAX_DATA_ROWS = 20;
+const MAX_DATA_CHARS = 3000;
+const MAX_BLOCKS = 50;
+
+/** Alias for the shared agent query result — same shape, Slack-specific name. */
+export type SlackQueryResult = AgentQueryResult;
+
+export interface SlackButton {
+  type: "button";
+  text: { type: "plain_text"; text: string };
+  action_id: string;
+  value: string;
+  style?: "primary" | "danger";
+}
+
+export type SlackBlock =
+  | { type: "section"; text: { type: "mrkdwn" | "plain_text"; text: string } }
+  | { type: "context"; elements: { type: "mrkdwn" | "plain_text"; text: string }[] }
+  | { type: "actions"; elements: SlackButton[] };
+
+/**
+ * Format a query result as Slack Block Kit blocks.
+ */
+export function formatQueryResponse(result: SlackQueryResult): SlackBlock[] {
+  const blocks: SlackBlock[] = [];
+
+  // Answer section
+  const answer = truncate(result.answer || "No answer generated.", MAX_TEXT_LENGTH);
+  blocks.push({
+    type: "section",
+    text: { type: "mrkdwn", text: answer },
+  });
+
+  // SQL section
+  if (result.sql.length > 0) {
+    const sqlText = result.sql.join("\n\n");
+    const formatted = truncate(`*SQL*\n\`\`\`${sqlText}\`\`\``, MAX_TEXT_LENGTH);
+    blocks.push({
+      type: "section",
+      text: { type: "mrkdwn", text: formatted },
+    });
+  }
+
+  // Data section — column-aligned plain text
+  for (const dataset of result.data) {
+    if (!dataset.columns.length || !dataset.rows.length) continue;
+
+    const table = formatDataTable(dataset.columns, dataset.rows);
+    if (table) {
+      blocks.push({
+        type: "section",
+        text: { type: "mrkdwn", text: table },
+      });
+    }
+
+    // Stay under the block limit
+    if (blocks.length >= MAX_BLOCKS - 1) break;
+  }
+
+  // Context block with metadata
+  blocks.push({
+    type: "context",
+    elements: [
+      {
+        type: "mrkdwn",
+        text: `${result.steps} steps | ${result.usage.totalTokens.toLocaleString()} tokens`,
+      },
+    ],
+  });
+
+  return blocks.slice(0, MAX_BLOCKS);
+}
+
+/**
+ * Format column data as a code block table.
+ */
+function formatDataTable(
+  columns: string[],
+  rows: Record<string, unknown>[],
+): string | null {
+  if (columns.length === 0 || rows.length === 0) return null;
+
+  const totalRows = rows.length;
+  const displayRows = rows.slice(0, MAX_DATA_ROWS);
+  const truncated = totalRows > MAX_DATA_ROWS;
+
+  // Build column-aligned output
+  const header = columns.join(" | ");
+  const separator = columns.map((c) => "-".repeat(c.length)).join("-+-");
+  const dataLines = displayRows.map((row) =>
+    columns.map((col) => String(row[col] ?? "")).join(" | "),
+  );
+
+  let table = [header, separator, ...dataLines].join("\n");
+
+  // Truncate if too long
+  if (table.length > MAX_DATA_CHARS) {
+    const lines = table.split("\n");
+    let charCount = 0;
+    let lineCount = 0;
+    for (const line of lines) {
+      if (charCount + line.length + 1 > MAX_DATA_CHARS - 50) break;
+      charCount += line.length + 1;
+      lineCount++;
+    }
+    table = lines.slice(0, Math.max(lineCount, 3)).join("\n");
+    return `\`\`\`${table}\`\`\`\n_Showing first ${Math.max(lineCount - 2, 1)} of ${totalRows} rows (truncated)_`;
+  }
+
+  const note = truncated
+    ? `\n_Showing first ${MAX_DATA_ROWS} of ${totalRows} rows_`
+    : "";
+
+  return `\`\`\`${table}\`\`\`${note}`;
+}
+
+function truncate(text: string, maxLength: number): string {
+  if (text.length <= maxLength) return text;
+  return text.slice(0, maxLength - 3) + "...";
+}
+
+/**
+ * Format an error message for Slack.
+ */
+export function formatErrorResponse(error: string): SlackBlock[] {
+  return [
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `:warning: Something went wrong: ${truncate(error, 200)}`,
+      },
+    },
+  ];
+}
+
+/**
+ * Format a pending action as a Slack Block Kit approval prompt.
+ * Returns a section with the action summary and an actions block with
+ * Approve/Deny buttons.
+ */
+export function formatActionApproval(action: PendingAction): SlackBlock[] {
+  return [
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `:lock: *Action requires approval*\n${truncate(action.summary || action.type, MAX_TEXT_LENGTH - 40)}`,
+      },
+    },
+    {
+      type: "actions",
+      elements: [
+        {
+          type: "button",
+          text: { type: "plain_text", text: "Approve" },
+          action_id: "atlas_action_approve",
+          value: action.id,
+          style: "primary",
+        },
+        {
+          type: "button",
+          text: { type: "plain_text", text: "Deny" },
+          action_id: "atlas_action_deny",
+          value: action.id,
+          style: "danger",
+        },
+      ],
+    },
+  ];
+}
+
+/**
+ * Format a resolved action status (replaces the approval buttons).
+ */
+export function formatActionResult(
+  action: PendingAction,
+  status: "approved" | "denied" | "executed" | "failed",
+  error?: string,
+): SlackBlock[] {
+  const emoji =
+    status === "executed"
+      ? ":white_check_mark:"
+      : status === "approved"
+        ? ":white_check_mark:"
+        : status === "denied"
+          ? ":no_entry_sign:"
+          : ":x:";
+
+  let text = `${emoji} *Action ${status}*: ${truncate(action.summary || action.type, 200)}`;
+  if (error) text += `\n_${truncate(error, 200)}_`;
+
+  return [
+    {
+      type: "section",
+      text: { type: "mrkdwn", text },
+    },
+  ];
+}

package/templates/docker/src/lib/slack/store.ts

@@ -0,0 +1,107 @@
+/**
+ * Slack installation storage.
+ *
+ * Stores OAuth bot tokens in the internal database when available.
+ * Falls back to SLACK_BOT_TOKEN env var for single-workspace mode.
+ */
+
+import { hasInternalDB, internalQuery, getInternalDB } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+
+const log = createLogger("slack-store");
+
+export interface SlackInstallation {
+  team_id: string;
+  bot_token: string;
+  installed_at: string;
+}
+
+/**
+ * Get the bot token for a team. Checks internal DB first, then falls
+ * back to SLACK_BOT_TOKEN env var.
+ */
+export async function getInstallation(
+  teamId: string,
+): Promise<SlackInstallation | null> {
+  if (hasInternalDB()) {
+    try {
+      const rows = await internalQuery<Record<string, unknown>>(
+        "SELECT team_id, bot_token, installed_at::text FROM slack_installations WHERE team_id = $1",
+        [teamId],
+      );
+      if (rows.length > 0) {
+        const teamIdVal = rows[0].team_id;
+        const botToken = rows[0].bot_token;
+        const installedAt = rows[0].installed_at;
+        if (typeof teamIdVal !== "string" || typeof botToken !== "string" || !botToken) {
+          log.warn({ teamId }, "Invalid installation record in database");
+          return null;
+        }
+        return {
+          team_id: teamIdVal,
+          bot_token: botToken,
+          installed_at: typeof installedAt === "string" ? installedAt : new Date().toISOString(),
+        };
+      }
+      return null;
+    } catch (err) {
+      log.error(
+        { err: err instanceof Error ? err.message : String(err), teamId },
+        "Failed to query slack_installations",
+      );
+      throw err;
+    }
+  }
+
+  // Single-workspace mode: no internal DB configured, use env var
+  const envToken = process.env.SLACK_BOT_TOKEN;
+  if (envToken) {
+    return {
+      team_id: teamId,
+      bot_token: envToken,
+      installed_at: new Date().toISOString(),
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Save or update a Slack installation (OAuth flow).
+ * Throws if the database write fails.
+ */
+export async function saveInstallation(teamId: string, botToken: string): Promise<void> {
+  if (!hasInternalDB()) {
+    throw new Error("Cannot save Slack installation — no internal database configured");
+  }
+
+  const pool = getInternalDB();
+  await pool.query(
+    `INSERT INTO slack_installations (team_id, bot_token)
+     VALUES ($1, $2)
+     ON CONFLICT (team_id) DO UPDATE SET bot_token = $2, installed_at = now()`,
+    [teamId, botToken],
+  );
+}
+
+/**
+ * Remove a Slack installation.
+ * Throws if the database delete fails.
+ */
+export async function deleteInstallation(teamId: string): Promise<void> {
+  if (!hasInternalDB()) {
+    log.warn({ teamId }, "Cannot delete Slack installation — no internal database configured");
+    return;
+  }
+
+  const pool = getInternalDB();
+  await pool.query("DELETE FROM slack_installations WHERE team_id = $1", [teamId]);
+}
+
+/**
+ * Get the bot token for a team — convenience wrapper.
+ */
+export async function getBotToken(teamId: string): Promise<string | null> {
+  const installation = await getInstallation(teamId);
+  return installation?.bot_token ?? null;
+}

package/templates/docker/src/lib/slack/threads.ts

@@ -0,0 +1,64 @@
+/**
+ * Slack thread → Atlas conversation ID mapping.
+ *
+ * Maps Slack thread_ts values to Atlas conversation IDs so follow-up
+ * messages in a thread continue the same conversation context.
+ *
+ * Thread mapping is stored but conversation context is not yet loaded
+ * across messages. Each message is currently standalone.
+ */
+
+import { hasInternalDB, internalQuery, getInternalDB } from "@atlas/api/lib/db/internal";
+import { createLogger } from "@atlas/api/lib/logger";
+
+const log = createLogger("slack-threads");
+
+/**
+ * Get the Atlas conversation ID for a Slack thread.
+ * Returns null if no mapping exists or conversation persistence isn't available.
+ */
+export async function getConversationId(
+  channelId: string,
+  threadTs: string,
+): Promise<string | null> {
+  if (!hasInternalDB()) {
+    log.debug("No internal DB — skipping thread mapping lookup");
+    return null;
+  }
+
+  try {
+    const rows = await internalQuery<{ conversation_id: string }>(
+      "SELECT conversation_id FROM slack_threads WHERE channel_id = $1 AND thread_ts = $2",
+      [channelId, threadTs],
+    );
+    return rows[0]?.conversation_id ?? null;
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err.message : String(err), channelId, threadTs },
+      "Failed to look up thread mapping",
+    );
+    return null;
+  }
+}
+
+/**
+ * Store a mapping from Slack thread to Atlas conversation ID.
+ */
+export async function setConversationId(
+  channelId: string,
+  threadTs: string,
+  conversationId: string,
+): Promise<void> {
+  if (!hasInternalDB()) {
+    log.debug("No internal DB — skipping thread mapping storage");
+    return;
+  }
+
+  const pool = getInternalDB();
+  await pool.query(
+    `INSERT INTO slack_threads (channel_id, thread_ts, conversation_id)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (thread_ts, channel_id) DO UPDATE SET conversation_id = $3`,
+    [channelId, threadTs, conversationId],
+  );
+}

package/templates/docker/src/lib/slack/verify.ts

@@ -0,0 +1,71 @@
+/**
+ * Slack request signature verification.
+ *
+ * Verifies incoming requests are genuinely from Slack using HMAC-SHA256
+ * signature validation with timing-safe comparison. Rejects requests
+ * with timestamps older than 5 minutes to prevent replay attacks.
+ *
+ * @see https://api.slack.com/authentication/verifying-requests-from-slack
+ */
+
+import crypto from "crypto";
+
+const MAX_TIMESTAMP_AGE_SECONDS = 300; // 5 minutes
+
+export type VerifyResult =
+  | { valid: true }
+  | { valid: false; error: string };
+
+/**
+ * Verify a Slack request signature.
+ *
+ * @param signingSecret - The SLACK_SIGNING_SECRET from app credentials
+ * @param signature - The `x-slack-signature` header value (v0=...)
+ * @param timestamp - The `x-slack-request-timestamp` header value (unix seconds)
+ * @param body - The raw request body string
+ */
+export function verifySlackSignature(
+  signingSecret: string,
+  signature: string | null,
+  timestamp: string | null,
+  body: string,
+): VerifyResult {
+  if (!signature || !timestamp) {
+    return { valid: false, error: "Missing signature or timestamp headers" };
+  }
+
+  const ts = parseInt(timestamp, 10);
+  if (isNaN(ts)) {
+    return { valid: false, error: "Invalid timestamp" };
+  }
+
+  // Reject requests with timestamps more than 5 minutes from current time (past or future)
+  const now = Math.floor(Date.now() / 1000);
+  if (Math.abs(now - ts) > MAX_TIMESTAMP_AGE_SECONDS) {
+    return { valid: false, error: "Request timestamp too old" };
+  }
+
+  const sigBasestring = `v0:${timestamp}:${body}`;
+  const mySignature =
+    "v0=" +
+    crypto
+      .createHmac("sha256", signingSecret)
+      .update(sigBasestring)
+      .digest("hex");
+
+  // Timing-safe comparison to prevent timing attacks
+  try {
+    const sigBuffer = Buffer.from(signature, "utf8");
+    const myBuffer = Buffer.from(mySignature, "utf8");
+    if (sigBuffer.length !== myBuffer.length) {
+      return { valid: false, error: "Invalid signature" };
+    }
+    if (!crypto.timingSafeEqual(sigBuffer, myBuffer)) {
+      return { valid: false, error: "Invalid signature" };
+    }
+  } catch {
+    return { valid: false, error: "Signature verification error" };
+  }
+
+  return { valid: true };
+}