create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/slack/actions.ts

@@ -0,0 +1,177 @@
+/**
+ * POST /v1/slack/actions
+ *
+ * The Slack button-click endpoint for the project-listings Approve/Reject
+ * workflow (#4999). Registered in `server.ts`'s `webhooksScope`, alongside
+ * the Stripe webhook, on the same raw-body discipline: verify BEFORE any
+ * parse, using the raw bytes Fastify hands back as a `Buffer` (the
+ * `webhooksScope` content-type parser override — see `server.ts`).
+ *
+ * Verification mirrors `routes/webhooks/stripe.ts`'s shape (secret present,
+ * header present, verify, reject before any work) with Slack's own scheme:
+ * `X-Slack-Signature` = `v0=` + HMAC-SHA256(`v0:{X-Slack-Request-Timestamp}:{rawBody}`,
+ * `AILK_SLACK_SIGNING_SECRET`), constant-time compared; the timestamp must be
+ * within 5 minutes of now (replay/skew guard). `AILK_SLACK_SIGNING_SECRET`
+ * absent -> 503 (mirrors Stripe's "webhook not configured"); a missing
+ * header, a stale timestamp, or a signature mismatch -> 401, before the
+ * `payload` form field is ever parsed.
+ *
+ * Once verified, the `block_actions` payload's `actions[0]` gives the
+ * decision (`action_id`: `listing_approve` | `listing_reject`) and the
+ * listing id (`value`); `user.id` becomes `decidedBy`. `decideListing` is
+ * the single transition function this route shares with the tenant-scoped
+ * PATCH route (`services/project-listing-decision.ts`) — on a `changed`
+ * decision this route updates the posted Slack message in place and emails
+ * the founder once; an already-decided listing (a stale second click) is a
+ * no-op. This route ALWAYS replies 200 with an empty body once the
+ * signature is verified — Slack retries on any non-200, and every outcome
+ * past that point (not found, invalid transition, already decided,
+ * decided) has already been fully handled here.
+ *
+ * PII boundary: the log line below carries only `listingId`/`decision`/
+ * `changed` — never founderEmail, founderName, or any payload text.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+import { zProjectListingId } from "@working-theory/ids";
+import type { FastifyReply, FastifyRequest } from "fastify";
+
+import { config } from "../../config/index.js";
+import {
+  decideListing,
+  sendListingDecisionEmail,
+  type ListingDecision,
+} from "../../services/project-listing-decision.js";
+import { updateListingMessage } from "../../services/slack-notify.js";
+
+const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
+
+function isValidSignature(
+  rawBody: Buffer,
+  timestamp: string,
+  signature: string,
+  secret: string,
+): boolean {
+  const base = `v0:${timestamp}:${rawBody.toString("utf8")}`;
+  const expected = `v0=${createHmac("sha256", secret).update(base).digest("hex")}`;
+  const expectedBuf = Buffer.from(expected, "utf8");
+  const providedBuf = Buffer.from(signature, "utf8");
+  if (expectedBuf.length !== providedBuf.length) return false;
+  return timingSafeEqual(expectedBuf, providedBuf);
+}
+
+type BlockActionsPayload = {
+  type?: string;
+  user?: { id?: string; username?: string; name?: string };
+  actions?: Array<{ action_id?: string; value?: string }>;
+};
+
+const ACTION_TO_DECISION: Record<string, ListingDecision> = {
+  listing_approve: "active",
+  listing_reject: "rejected",
+};
+
+export async function slackActionsHandler(
+  request: FastifyRequest,
+  reply: FastifyReply,
+): Promise<void> {
+  const secret = config.AILK_SLACK_SIGNING_SECRET;
+  if (!secret) {
+    request.log.warn("slack action hit but AILK_SLACK_SIGNING_SECRET is not set");
+    await reply.code(503).send();
+    return;
+  }
+
+  const rawBody = request.body;
+  if (!Buffer.isBuffer(rawBody)) {
+    request.log.error(
+      "slack action body is not a Buffer — content-type parser misconfigured",
+    );
+    await reply.code(401).send();
+    return;
+  }
+
+  const timestampHeader = request.headers["x-slack-request-timestamp"];
+  const signatureHeader = request.headers["x-slack-signature"];
+  if (typeof timestampHeader !== "string" || typeof signatureHeader !== "string") {
+    await reply.code(401).send();
+    return;
+  }
+
+  const timestampSeconds = Number(timestampHeader);
+  if (!Number.isFinite(timestampSeconds)) {
+    await reply.code(401).send();
+    return;
+  }
+  const ageSeconds = Math.abs(Date.now() / 1000 - timestampSeconds);
+  if (ageSeconds > SIGNATURE_TOLERANCE_SECONDS) {
+    request.log.warn("slack action timestamp outside the 5-minute tolerance window");
+    await reply.code(401).send();
+    return;
+  }
+
+  if (!isValidSignature(rawBody, timestampHeader, signatureHeader, secret)) {
+    request.log.warn("slack action signature verification failed");
+    await reply.code(401).send();
+    return;
+  }
+
+  // Signature verified — safe to parse now.
+  const form = new URLSearchParams(rawBody.toString("utf8"));
+  const payloadRaw = form.get("payload");
+  let payload: BlockActionsPayload | undefined;
+  try {
+    payload = payloadRaw ? (JSON.parse(payloadRaw) as BlockActionsPayload) : undefined;
+  } catch {
+    payload = undefined;
+  }
+
+  const action = payload?.actions?.[0];
+  const listingId = action?.value;
+  const decision = action?.action_id ? ACTION_TO_DECISION[action.action_id] : undefined;
+  const slackUserId = payload?.user?.id;
+
+  if (
+    payload?.type !== "block_actions" ||
+    !listingId ||
+    !zProjectListingId.safeParse(listingId).success ||
+    !decision ||
+    !slackUserId
+  ) {
+    // Nothing actionable in this payload (including a malformed listing id —
+    // boundary-validated the same way `patch.ts`'s `:id` param is) — still
+    // 200 (Slack retries on non-200).
+    await reply.code(200).send();
+    return;
+  }
+
+  const result = await decideListing({ id: listingId, decision, decidedBy: slackUserId });
+
+  if (result.ok && result.changed) {
+    const decidedByName = payload?.user?.username ?? payload?.user?.name ?? slackUserId;
+    const listingSlackInfo = {
+      id: result.value.id,
+      name: result.value.name,
+      oneLiner: result.value.oneLiner,
+      problem: result.value.problem,
+      url: result.value.url,
+      product: result.value.product,
+      founderName: result.value.founderName,
+      founderCompany: result.value.founderCompany,
+      slackChannel: result.slack.channel,
+      slackTs: result.slack.ts,
+    };
+
+    await Promise.all([
+      updateListingMessage(listingSlackInfo, decision, decidedByName),
+      sendListingDecisionEmail(result.value, decision),
+    ]);
+  }
+
+  request.log.info(
+    { listingId, decision, changed: result.ok ? result.changed : false },
+    "slack action processed",
+  );
+
+  await reply.code(200).send();
+}

package/templates/apps/api/src/routes/slack/index.ts

@@ -0,0 +1,38 @@
+/**
+ * Slack route group (#4999).
+ *
+ * Routes:
+ *   POST /v1/slack/actions — verify the Slack signature, apply the
+ *                             project-listing decision, respond 200.
+ *
+ * Rate limit: mirrors `routes/webhooks/index.ts`'s own scoped limiter (its
+ * own bucket, not the public content API's global limiter) — 100 req/min/IP,
+ * well above a healthy account's real Slack click rate.
+ */
+import rateLimit from "@fastify/rate-limit";
+import type { FastifyPluginAsync } from "fastify";
+
+import { slackActionsHandler } from "./actions.js";
+
+export const SLACK_ACTIONS_RATE_LIMIT_PER_MIN = 100;
+
+export const slackActionsRoute: FastifyPluginAsync = async (fastify) => {
+  await fastify.register(rateLimit, {
+    global: false,
+    max: SLACK_ACTIONS_RATE_LIMIT_PER_MIN,
+    timeWindow: "1 minute",
+  });
+
+  fastify.post(
+    "/v1/slack/actions",
+    {
+      config: {
+        rateLimit: {
+          max: SLACK_ACTIONS_RATE_LIMIT_PER_MIN,
+          timeWindow: "1 minute",
+        },
+      },
+    },
+    slackActionsHandler,
+  );
+};

package/templates/apps/api/src/routes/test/auth/__tests__/session.test.ts

@@ -33,8 +33,13 @@ jest.mock("../../../../lib/prisma.js", () => ({
 import { prisma } from "../../../../lib/prisma.js";
 import { registerTestAuthRoute, shouldMountTestAuth } from "../session.js";
 
-const ALLOWLISTED_USER_ID = "test-user-id-001";
-const NON_ALLOWLISTED_USER_ID = "user-not-in-allowlist";
+// Well-formed prefixed ids (ADR-0031): zUserId validates the body before the
+// allowlist check, so fixtures must be valid user_ ids. Reserved-range values
+// mirror database/seed-test.ts.
+const ALLOWLISTED_USER_ID = "user_00000000-0000-7000-8000-0000000000e1";
+const NON_ALLOWLISTED_USER_ID = "user_00000000-0000-7000-8000-00000000dead";
+const SECOND_ALLOWLISTED_USER_ID = "user_00000000-0000-7000-8000-0000000000e2";
+const THIRD_ALLOWLISTED_USER_ID = "user_00000000-0000-7000-8000-0000000000e3";
 
 /** Build a Fastify instance with the test-auth route registered unconditionally. */
 function buildAppWithRoute(): FastifyInstance {
@@ -193,9 +198,14 @@ describe("test-auth route — POST /api/test/auth/session", () => {
         userId: ALLOWLISTED_USER_ID,
         token: expect.any(String),
         expiresAt: expect.any(Date),
-        id: expect.any(String),
       }),
     });
+    // No caller-supplied id — the DATABASE default mints the sess_ id
+    // (ADR-0031); an explicit bare uuid would violate sessions_id_format.
+    const createArg = (prisma.session.create as jest.Mock).mock.calls[0][0] as {
+      data: Record<string, unknown>;
+    };
+    expect(createArg.data.id).toBeUndefined();
   });
 
   it("returns 403 when user is not in allowlist", async () => {
@@ -243,10 +253,10 @@ describe("test-auth route — POST /api/test/auth/session", () => {
   it("supports CSV-formatted allowlist (multiple userIds)", async () => {
     process.env.NODE_ENV = "test";
     process.env.AILK_TEST_AUTH_ENABLED = "true";
-    process.env.AILK_TEST_AUTH_USER_ALLOWLIST = `${ALLOWLISTED_USER_ID},another-user,third-user`;
+    process.env.AILK_TEST_AUTH_USER_ALLOWLIST = `${ALLOWLISTED_USER_ID},${SECOND_ALLOWLISTED_USER_ID},${THIRD_ALLOWLISTED_USER_ID}`;
 
     const userRow = {
-      id: "another-user",
+      id: SECOND_ALLOWLISTED_USER_ID,
       email: "another@example.com",
       name: "Another User",
       role: "admin",
@@ -268,7 +278,7 @@ describe("test-auth route — POST /api/test/auth/session", () => {
     const res = await app.inject({
       method: "POST",
       url: "/v1/test/auth/session",
-      payload: { userId: "another-user" },
+      payload: { userId: SECOND_ALLOWLISTED_USER_ID },
       headers: { "content-type": "application/json" },
     });
 

package/templates/apps/api/src/routes/test/auth/session.ts

@@ -22,8 +22,9 @@
  * ALLOWLIST FORMAT — comma-separated values (CSV), exact-match strings. No
  * regex or wildcard. Empty entries (between commas) are trimmed and ignored.
  */
-import { randomBytes, randomUUID } from "node:crypto";
+import { randomBytes } from "node:crypto";
 
+import { zUserId } from "@working-theory/ids";
 import { logger } from "@working-theory/observability";
 import type { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
@@ -39,7 +40,7 @@ import { prisma } from "../../../lib/prisma.js";
 const SESSION_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
 
 const sessionRequestSchema = z.object({
-  userId: z.string().min(1),
+  userId: zUserId,
 });
 
 /**
@@ -118,13 +119,14 @@ export const registerTestAuthRoute: FastifyPluginAsync = async (fastify) => {
     }
 
     // ── Mint the Session row ───────────────────────────────────────────────
+    // No explicit id: the database default mints the sess_-prefixed UUIDv7
+    // (ADR-0031) — a caller-supplied bare uuid would be rejected by the
+    // sessions_id_format CHECK.
     const token = generateSessionToken();
     const expiresAt = new Date(Date.now() + SESSION_LIFETIME_MS);
-    const sessionId = randomUUID();
 
-    await prisma.session.create({
+    const session = await prisma.session.create({
       data: {
-        id: sessionId,
         token,
         userId: user.id,
         expiresAt,
@@ -132,7 +134,7 @@ export const registerTestAuthRoute: FastifyPluginAsync = async (fastify) => {
     });
 
     logger.info(
-      { userId: user.id, sessionId },
+      { userId: user.id, sessionId: session.id },
       "[test-auth] minted session for e2e harness",
     );