create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/routes/slack/actions.ts

@@ -1,177 +0,0 @@
-/**
- * POST /v1/slack/actions
- *
- * The Slack button-click endpoint for the project-listings Approve/Reject
- * workflow (#4999). Registered in `server.ts`'s `webhooksScope`, alongside
- * the Stripe webhook, on the same raw-body discipline: verify BEFORE any
- * parse, using the raw bytes Fastify hands back as a `Buffer` (the
- * `webhooksScope` content-type parser override — see `server.ts`).
- *
- * Verification mirrors `routes/webhooks/stripe.ts`'s shape (secret present,
- * header present, verify, reject before any work) with Slack's own scheme:
- * `X-Slack-Signature` = `v0=` + HMAC-SHA256(`v0:{X-Slack-Request-Timestamp}:{rawBody}`,
- * `AILK_SLACK_SIGNING_SECRET`), constant-time compared; the timestamp must be
- * within 5 minutes of now (replay/skew guard). `AILK_SLACK_SIGNING_SECRET`
- * absent -> 503 (mirrors Stripe's "webhook not configured"); a missing
- * header, a stale timestamp, or a signature mismatch -> 401, before the
- * `payload` form field is ever parsed.
- *
- * Once verified, the `block_actions` payload's `actions[0]` gives the
- * decision (`action_id`: `listing_approve` | `listing_reject`) and the
- * listing id (`value`); `user.id` becomes `decidedBy`. `decideListing` is
- * the single transition function this route shares with the tenant-scoped
- * PATCH route (`services/project-listing-decision.ts`) — on a `changed`
- * decision this route updates the posted Slack message in place and emails
- * the founder once; an already-decided listing (a stale second click) is a
- * no-op. This route ALWAYS replies 200 with an empty body once the
- * signature is verified — Slack retries on any non-200, and every outcome
- * past that point (not found, invalid transition, already decided,
- * decided) has already been fully handled here.
- *
- * PII boundary: the log line below carries only `listingId`/`decision`/
- * `changed` — never founderEmail, founderName, or any payload text.
- */
-import { createHmac, timingSafeEqual } from "node:crypto";
-
-import { zProjectListingId } from "@working-theory/ids";
-import type { FastifyReply, FastifyRequest } from "fastify";
-
-import { config } from "../../config/index.js";
-import {
-  decideListing,
-  sendListingDecisionEmail,
-  type ListingDecision,
-} from "../../services/project-listing-decision.js";
-import { updateListingMessage } from "../../services/slack-notify.js";
-
-const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
-
-function isValidSignature(
-  rawBody: Buffer,
-  timestamp: string,
-  signature: string,
-  secret: string,
-): boolean {
-  const base = `v0:${timestamp}:${rawBody.toString("utf8")}`;
-  const expected = `v0=${createHmac("sha256", secret).update(base).digest("hex")}`;
-  const expectedBuf = Buffer.from(expected, "utf8");
-  const providedBuf = Buffer.from(signature, "utf8");
-  if (expectedBuf.length !== providedBuf.length) return false;
-  return timingSafeEqual(expectedBuf, providedBuf);
-}
-
-type BlockActionsPayload = {
-  type?: string;
-  user?: { id?: string; username?: string; name?: string };
-  actions?: Array<{ action_id?: string; value?: string }>;
-};
-
-const ACTION_TO_DECISION: Record<string, ListingDecision> = {
-  listing_approve: "active",
-  listing_reject: "rejected",
-};
-
-export async function slackActionsHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  const secret = config.AILK_SLACK_SIGNING_SECRET;
-  if (!secret) {
-    request.log.warn("slack action hit but AILK_SLACK_SIGNING_SECRET is not set");
-    await reply.code(503).send();
-    return;
-  }
-
-  const rawBody = request.body;
-  if (!Buffer.isBuffer(rawBody)) {
-    request.log.error(
-      "slack action body is not a Buffer — content-type parser misconfigured",
-    );
-    await reply.code(401).send();
-    return;
-  }
-
-  const timestampHeader = request.headers["x-slack-request-timestamp"];
-  const signatureHeader = request.headers["x-slack-signature"];
-  if (typeof timestampHeader !== "string" || typeof signatureHeader !== "string") {
-    await reply.code(401).send();
-    return;
-  }
-
-  const timestampSeconds = Number(timestampHeader);
-  if (!Number.isFinite(timestampSeconds)) {
-    await reply.code(401).send();
-    return;
-  }
-  const ageSeconds = Math.abs(Date.now() / 1000 - timestampSeconds);
-  if (ageSeconds > SIGNATURE_TOLERANCE_SECONDS) {
-    request.log.warn("slack action timestamp outside the 5-minute tolerance window");
-    await reply.code(401).send();
-    return;
-  }
-
-  if (!isValidSignature(rawBody, timestampHeader, signatureHeader, secret)) {
-    request.log.warn("slack action signature verification failed");
-    await reply.code(401).send();
-    return;
-  }
-
-  // Signature verified — safe to parse now.
-  const form = new URLSearchParams(rawBody.toString("utf8"));
-  const payloadRaw = form.get("payload");
-  let payload: BlockActionsPayload | undefined;
-  try {
-    payload = payloadRaw ? (JSON.parse(payloadRaw) as BlockActionsPayload) : undefined;
-  } catch {
-    payload = undefined;
-  }
-
-  const action = payload?.actions?.[0];
-  const listingId = action?.value;
-  const decision = action?.action_id ? ACTION_TO_DECISION[action.action_id] : undefined;
-  const slackUserId = payload?.user?.id;
-
-  if (
-    payload?.type !== "block_actions" ||
-    !listingId ||
-    !zProjectListingId.safeParse(listingId).success ||
-    !decision ||
-    !slackUserId
-  ) {
-    // Nothing actionable in this payload (including a malformed listing id —
-    // boundary-validated the same way `patch.ts`'s `:id` param is) — still
-    // 200 (Slack retries on non-200).
-    await reply.code(200).send();
-    return;
-  }
-
-  const result = await decideListing({ id: listingId, decision, decidedBy: slackUserId });
-
-  if (result.ok && result.changed) {
-    const decidedByName = payload?.user?.username ?? payload?.user?.name ?? slackUserId;
-    const listingSlackInfo = {
-      id: result.value.id,
-      name: result.value.name,
-      oneLiner: result.value.oneLiner,
-      problem: result.value.problem,
-      url: result.value.url,
-      product: result.value.product,
-      founderName: result.value.founderName,
-      founderCompany: result.value.founderCompany,
-      slackChannel: result.slack.channel,
-      slackTs: result.slack.ts,
-    };
-
-    await Promise.all([
-      updateListingMessage(listingSlackInfo, decision, decidedByName),
-      sendListingDecisionEmail(result.value, decision),
-    ]);
-  }
-
-  request.log.info(
-    { listingId, decision, changed: result.ok ? result.changed : false },
-    "slack action processed",
-  );
-
-  await reply.code(200).send();
-}

package/templates/apps/api/src/routes/slack/index.ts

@@ -1,38 +0,0 @@
-/**
- * Slack route group (#4999).
- *
- * Routes:
- *   POST /v1/slack/actions — verify the Slack signature, apply the
- *                             project-listing decision, respond 200.
- *
- * Rate limit: mirrors `routes/webhooks/index.ts`'s own scoped limiter (its
- * own bucket, not the public content API's global limiter) — 100 req/min/IP,
- * well above a healthy account's real Slack click rate.
- */
-import rateLimit from "@fastify/rate-limit";
-import type { FastifyPluginAsync } from "fastify";
-
-import { slackActionsHandler } from "./actions.js";
-
-export const SLACK_ACTIONS_RATE_LIMIT_PER_MIN = 100;
-
-export const slackActionsRoute: FastifyPluginAsync = async (fastify) => {
-  await fastify.register(rateLimit, {
-    global: false,
-    max: SLACK_ACTIONS_RATE_LIMIT_PER_MIN,
-    timeWindow: "1 minute",
-  });
-
-  fastify.post(
-    "/v1/slack/actions",
-    {
-      config: {
-        rateLimit: {
-          max: SLACK_ACTIONS_RATE_LIMIT_PER_MIN,
-          timeWindow: "1 minute",
-        },
-      },
-    },
-    slackActionsHandler,
-  );
-};