deepline 0.3.89 → 0.3.90

package/dist/bundling-sources/shared_libs/product-notifications/slack-delivery.ts

@@ -0,0 +1,624 @@
+import { isSyntheticActorEmail } from '@deepline/auth/synthetic-identity';
+import { getCurrentRequestMetadata } from '../observability/log-metadata';
+import { getRuntimeEnv } from '../play-runtime/runtime-env';
+import { removeHttpHeadersFromSlackPayload } from '../security/slack-sanitize';
+import { buildSlackActivityPayload, type SlackPayload } from './slack-payload';
+import {
+  postMessageToSlack,
+  type SlackMessageOptions,
+} from './slack-transport';
+
+export type SlackChannelKey =
+  | 'user_signup'
+  | 'session_activity'
+  | 'error_activity'
+  | 'daily_activity_summary'
+  | 'integration_requests'
+  | 'deploy_events'
+  | 'provider_health'
+  | 'provider_alerts'
+  | 'sdk_cli_activity'
+  | 'sdk_cli_errors'
+  | 'sdk_cli_feedback'
+  | 'dashboard_feedback'
+  | 'python_cli_feedback'
+  | 'python_cli_session'
+  | 'monitor_activity'
+  | 'monitor_error_activity'
+  | 'plain_thread_activity';
+
+export type SlackPayloadEnricher = (
+  payload: SlackPayload,
+) => SlackPayload | Promise<SlackPayload>;
+
+export type SlackDeliveryOptions = {
+  enrichPayload?: SlackPayloadEnricher;
+  postMessage?: (
+    token: string,
+    channelId: string,
+    text: string,
+    options?: SlackMessageOptions,
+  ) => Promise<void>;
+};
+
+type ResolvedRequestMetadata = {
+  requestId: string | null;
+  requestPath: string | null;
+};
+
+const CHANNEL_WEBHOOK_ENV: Partial<Record<SlackChannelKey, string>> = {
+  session_activity: 'SLACK_SESSION_ACTIVITY_WEBHOOK_URL',
+  error_activity: 'SLACK_ERROR_ACTIVITY_WEBHOOK_URL',
+  daily_activity_summary: 'SLACK_DAILY_ACTIVITY_SUMMARY_WEBHOOK_URL',
+  integration_requests: 'SLACK_INTEGRATION_REQUEST_WEBHOOK_URL',
+  deploy_events: 'SLACK_DEV_WEBHOOK_URL',
+  provider_health: 'SLACK_PROVIDER_HEALTH_WEBHOOK_URL',
+  provider_alerts: 'SLACK_PROVIDER_ALERTS_WEBHOOK_URL',
+  monitor_activity: 'SLACK_MONITOR_ACTIVITY_WEBHOOK_URL',
+  monitor_error_activity: 'SLACK_MONITOR_ERROR_ACTIVITY_WEBHOOK_URL',
+  plain_thread_activity: 'SLACK_PLAIN_THREAD_ACTIVITY_WEBHOOK_URL',
+};
+
+const CHANNEL_WEBHOOK_FALLBACK_ENVS: Partial<
+  Record<SlackChannelKey, string[]>
+> = {
+  deploy_events: ['SLACK_INTERNAL_BOTS_WEBHOOK_URL'],
+};
+
+const SLACK_DEEPLINE_REPORTING_BOT_TOKEN_ENV =
+  'SLACK_DEEPLINE_REPORTING_BOT_TOKEN';
+const SLACK_PROVIDER_ALERTS_CHANNEL_ID_ENV = 'SLACK_PROVIDER_ALERTS_CHANNEL_ID';
+const SLACK_ERROR_ACTIVITY_CHANNEL_ID_ENV = 'SLACK_ERROR_ACTIVITY_CHANNEL_ID';
+const SLACK_USER_SIGNUP_CHANNEL_ID_ENV = 'SLACK_USER_SIGNUP_CHANNEL_ID';
+const SLACK_MONITOR_ACTIVITY_CHANNEL_ID_ENV =
+  'SLACK_MONITOR_ACTIVITY_CHANNEL_ID';
+const SLACK_MONITOR_ERROR_ACTIVITY_CHANNEL_ID_ENV =
+  'SLACK_MONITOR_ERROR_ACTIVITY_CHANNEL_ID';
+const DEFAULT_PROVIDER_ALERTS_CHANNEL_ID = 'C0B4QRC8NEM';
+const DEFAULT_USER_SIGNUP_CHANNEL_ID = 'C0AGWVD2TNK';
+const DEFAULT_MONITOR_ACTIVITY_CHANNEL_ID = 'C0BDRFY7NE7';
+const DEFAULT_MONITOR_ERROR_ACTIVITY_CHANNEL_ID = 'C0BDGCEMLBZ';
+
+export const SDK_CLI_ACTIVITY_SLACK_CHANNEL_ID = 'C0B7D7DB40Y';
+export const SDK_CLI_ERRORS_SLACK_CHANNEL_ID = 'C0B6JUJ9QJW';
+export const SDK_CLI_FEEDBACK_SLACK_CHANNEL_ID = 'C0B63EX130F';
+export const DASHBOARD_FEEDBACK_SLACK_CHANNEL_ID =
+  SDK_CLI_FEEDBACK_SLACK_CHANNEL_ID;
+export const PYTHON_CLI_FEEDBACK_SLACK_CHANNEL_ID = 'C0AFL96TPA8';
+export const PYTHON_CLI_SESSION_SLACK_CHANNEL_ID = 'C0AJ6MEEL8Y';
+
+const BLOCKED_SLACK_EMAIL_DOMAINS = [
+  'getaero.io',
+  'deepline.com',
+  'deepline.local',
+];
+const BLOCKED_SLACK_ACTOR_EMAILS = ['ci-auth@example.com'];
+const DEFAULT_TIMEOUT_MS = 2500;
+const VERCEL_LOGS_BASE_URL =
+  'https://vercel.com/aero-team-0f650658/deepline-api/logs';
+const CHANNEL_ALERT_LEVEL: Record<
+  SlackChannelKey,
+  'error' | 'warning' | 'info'
+> = {
+  user_signup: 'info',
+  session_activity: 'info',
+  error_activity: 'error',
+  daily_activity_summary: 'info',
+  integration_requests: 'info',
+  deploy_events: 'info',
+  provider_health: 'warning',
+  provider_alerts: 'error',
+  sdk_cli_activity: 'info',
+  sdk_cli_errors: 'error',
+  sdk_cli_feedback: 'info',
+  dashboard_feedback: 'info',
+  python_cli_feedback: 'info',
+  python_cli_session: 'info',
+  monitor_activity: 'info',
+  monitor_error_activity: 'error',
+  plain_thread_activity: 'info',
+};
+
+function normalizeText(value: unknown): string {
+  if (value === null || value === undefined) return '';
+  return String(value).trim();
+}
+
+function assertUnreachable(value: never): never {
+  throw new Error(`Unexpected Slack channel: ${String(value)}`);
+}
+
+function getSlackChannelEnvironmentRequirement(
+  channel: SlackChannelKey,
+): 'prod' | 'all' {
+  switch (channel) {
+    case 'user_signup':
+    case 'sdk_cli_activity':
+    case 'sdk_cli_errors':
+      return 'prod';
+    case 'session_activity':
+    case 'error_activity':
+    case 'daily_activity_summary':
+    case 'integration_requests':
+    case 'deploy_events':
+    case 'provider_alerts':
+    case 'provider_health':
+    case 'sdk_cli_feedback':
+    case 'dashboard_feedback':
+    case 'python_cli_feedback':
+    case 'python_cli_session':
+    case 'monitor_activity':
+    case 'monitor_error_activity':
+    case 'plain_thread_activity':
+      return 'all';
+    default:
+      return assertUnreachable(channel);
+  }
+}
+
+function resolveTimeoutMs(): number {
+  const raw = Number(process.env.SLACK_EVENTS_TIMEOUT_MS);
+  if (!Number.isFinite(raw) || raw <= 0) return DEFAULT_TIMEOUT_MS;
+  return Math.floor(raw);
+}
+
+function resolveWebhookUrl(channel: SlackChannelKey): string | null {
+  const envName = CHANNEL_WEBHOOK_ENV[channel];
+  if (!envName) return null;
+  const primary = process.env[envName]?.trim();
+  if (primary) return primary;
+  for (const fallbackEnvName of CHANNEL_WEBHOOK_FALLBACK_ENVS[channel] ?? []) {
+    const fallback = process.env[fallbackEnvName]?.trim();
+    if (fallback) return fallback;
+  }
+  return null;
+}
+
+function requireWebhookUrl(channel: SlackChannelKey): string {
+  const envName = CHANNEL_WEBHOOK_ENV[channel];
+  if (!envName) {
+    throw new Error(`Slack channel ${channel} requires bot delivery.`);
+  }
+  const url = resolveWebhookUrl(channel);
+  if (!url) throw new Error(`Missing ${envName}.`);
+  return url;
+}
+
+function isBotOnlySlackChannel(channel: SlackChannelKey): boolean {
+  return (
+    channel === 'user_signup' ||
+    channel === 'sdk_cli_activity' ||
+    channel === 'sdk_cli_errors' ||
+    channel === 'sdk_cli_feedback' ||
+    channel === 'dashboard_feedback' ||
+    channel === 'python_cli_feedback' ||
+    channel === 'python_cli_session'
+  );
+}
+
+function resolveBotChannel(
+  channel: SlackChannelKey,
+): { token: string; channelId: string } | null {
+  const token = process.env[SLACK_DEEPLINE_REPORTING_BOT_TOKEN_ENV]?.trim();
+  if (!token) return null;
+
+  switch (channel) {
+    case 'error_activity': {
+      // This is an explicit production cutover, not a global behavior change
+      // whenever a local test or Preview happens to have a reporting token.
+      const channelId =
+        process.env[SLACK_ERROR_ACTIVITY_CHANNEL_ID_ENV]?.trim();
+      if (!channelId) return null;
+      return {
+        token,
+        channelId,
+      };
+    }
+    case 'user_signup':
+      return {
+        token,
+        channelId:
+          process.env[SLACK_USER_SIGNUP_CHANNEL_ID_ENV]?.trim() ||
+          DEFAULT_USER_SIGNUP_CHANNEL_ID,
+      };
+    case 'provider_alerts':
+      return {
+        token,
+        channelId:
+          process.env[SLACK_PROVIDER_ALERTS_CHANNEL_ID_ENV]?.trim() ||
+          DEFAULT_PROVIDER_ALERTS_CHANNEL_ID,
+      };
+    case 'monitor_activity':
+      return {
+        token,
+        channelId:
+          process.env[SLACK_MONITOR_ACTIVITY_CHANNEL_ID_ENV]?.trim() ||
+          DEFAULT_MONITOR_ACTIVITY_CHANNEL_ID,
+      };
+    case 'monitor_error_activity':
+      return {
+        token,
+        channelId:
+          process.env[SLACK_MONITOR_ERROR_ACTIVITY_CHANNEL_ID_ENV]?.trim() ||
+          DEFAULT_MONITOR_ERROR_ACTIVITY_CHANNEL_ID,
+      };
+    case 'sdk_cli_activity':
+      return { token, channelId: SDK_CLI_ACTIVITY_SLACK_CHANNEL_ID };
+    case 'sdk_cli_errors':
+      return { token, channelId: SDK_CLI_ERRORS_SLACK_CHANNEL_ID };
+    case 'sdk_cli_feedback':
+      return { token, channelId: SDK_CLI_FEEDBACK_SLACK_CHANNEL_ID };
+    case 'dashboard_feedback':
+      return { token, channelId: DASHBOARD_FEEDBACK_SLACK_CHANNEL_ID };
+    case 'python_cli_feedback':
+      return { token, channelId: PYTHON_CLI_FEEDBACK_SLACK_CHANNEL_ID };
+    case 'python_cli_session':
+      return { token, channelId: PYTHON_CLI_SESSION_SLACK_CHANNEL_ID };
+    default:
+      return null;
+  }
+}
+
+function isSlackChannelUnavailableError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return (
+    message.includes('channel_not_found') || message.includes('not_in_channel')
+  );
+}
+
+async function postSlackWebhook(
+  url: string,
+  payload: SlackPayload,
+): Promise<void> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), resolveTimeoutMs());
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      const details = await response.text();
+      throw new Error(
+        `Slack webhook failed: ${details || response.statusText}`,
+      );
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function normalizeMetadataField(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const text = value.trim();
+  return text.length > 0 ? text : null;
+}
+
+function coalesceRequestMetadata(...candidates: unknown[]): string | null {
+  for (const candidate of candidates) {
+    const normalized = normalizeMetadataField(candidate);
+    if (normalized) return normalized;
+  }
+  return null;
+}
+
+function resolveRequestMetadataFromPayload(
+  payload: SlackPayload,
+): ResolvedRequestMetadata {
+  const metadata = getCurrentRequestMetadata();
+  return {
+    requestId: coalesceRequestMetadata(
+      metadata.requestId,
+      metadata.request_id,
+      payload.requestId,
+      payload.request_id,
+    ),
+    requestPath: coalesceRequestMetadata(
+      metadata.request_path,
+      metadata.requestPath,
+      payload.requestPath,
+      payload.request_path,
+    ),
+  };
+}
+
+export function buildVercelLogsUrlForRequest(input: {
+  requestId: string;
+  requestPath?: string | null;
+  level?: 'error' | 'warning' | 'info';
+}): string {
+  const requestId = normalizeText(input.requestId);
+  const requestPath = normalizeText(input.requestPath);
+  const level = normalizeText(input.level);
+  const search = [
+    level ? `level:${level}` : '',
+    requestPath ? `requestPath:${requestPath}` : '',
+    requestId,
+  ]
+    .filter(Boolean)
+    .join(' ');
+  return `${VERCEL_LOGS_BASE_URL}?search=${encodeURIComponent(search)}`;
+}
+
+function buildVercelLogsContextBlock(
+  requestId: string,
+  vercelLogsUrl: string,
+): Record<string, unknown> {
+  return {
+    type: 'section',
+    text: {
+      type: 'mrkdwn',
+      text: `\`request_id\`: \`${requestId}\`  ·  <${vercelLogsUrl}|Vercel logs>`,
+    },
+  };
+}
+
+function hasVercelLogsLink(
+  blocks: Array<Record<string, unknown>> | undefined,
+): boolean {
+  return (blocks ?? []).some((block) => {
+    const serialized = JSON.stringify(block);
+    return (
+      serialized.includes('Vercel logs') ||
+      serialized.includes('vercelLogsUrl') ||
+      serialized.includes('selectedLogId')
+    );
+  });
+}
+
+function attachVercelLogsToPayload(
+  payload: SlackPayload,
+  channel: SlackChannelKey,
+): SlackPayload {
+  if (
+    channel === 'plain_thread_activity' ||
+    normalizeText(payload.vercelLogsUrl)
+  ) {
+    return payload;
+  }
+
+  const { requestId, requestPath } = resolveRequestMetadataFromPayload(payload);
+  if (!requestId) return payload;
+
+  const vercelLogsUrl = buildVercelLogsUrlForRequest({
+    requestId,
+    requestPath,
+    level: CHANNEL_ALERT_LEVEL[channel],
+  });
+  const nextPayload = {
+    ...payload,
+    requestId,
+    request_id: requestId,
+    requestPath: requestPath ?? payload.requestPath ?? null,
+    request_path: requestPath ?? payload.request_path ?? null,
+    vercelLogsUrl,
+  } as SlackPayload;
+
+  if (
+    Array.isArray(nextPayload.blocks) &&
+    !hasVercelLogsLink(nextPayload.blocks)
+  ) {
+    nextPayload.blocks = [
+      ...nextPayload.blocks,
+      buildVercelLogsContextBlock(requestId, vercelLogsUrl),
+    ];
+    return nextPayload;
+  }
+
+  const baseText = normalizeText(payload.text);
+  if (baseText && !baseText.includes('Vercel logs')) {
+    nextPayload.text = `${baseText}  ·  Vercel Logs: ${vercelLogsUrl}`;
+  }
+  return nextPayload;
+}
+
+export function extractActorEmail(payload: SlackPayload): string | null {
+  const raw = payload.email ?? payload.actorEmail;
+  if (typeof raw !== 'string') return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+export function isBlockedInternalActor(payload: SlackPayload): boolean {
+  const email = extractActorEmail(payload);
+  if (!email) return false;
+  const normalizedEmail = email.toLowerCase();
+  if (BLOCKED_SLACK_ACTOR_EMAILS.includes(normalizedEmail)) return true;
+  const domain = normalizedEmail.split('@')[1];
+  return domain ? BLOCKED_SLACK_EMAIL_DOMAINS.includes(domain) : false;
+}
+
+function truncateSlackDispatchValue(value: unknown): string | null {
+  const text = normalizeText(value);
+  if (!text) return null;
+  return text.length > 1000 ? `${text.slice(0, 1000)}...` : text;
+}
+
+function compactSlackDispatchPayload(
+  channel: SlackChannelKey,
+  payload: SlackPayload,
+  delivery: 'bot' | 'webhook',
+): Record<string, unknown> {
+  const requestMetadata = resolveRequestMetadataFromPayload(payload);
+  const blockCount = Array.isArray(payload.blocks) ? payload.blocks.length : 0;
+  const fieldNames = [
+    'orgId',
+    'org_id',
+    'userId',
+    'user_id',
+    'email',
+    'actorEmail',
+    'provider',
+    'integration',
+    'operation',
+    'code',
+    'errorCategory',
+    'error_category',
+    'credentialOwner',
+    'credential_owner',
+    'status',
+    'route',
+    'sessionId',
+    'session_id',
+    'runId',
+    'run_id',
+    'cliVersionStatus',
+  ];
+  const fields: Record<string, unknown> = {};
+  for (const name of fieldNames) {
+    const value = payload[name];
+    if (
+      typeof value === 'string' ||
+      typeof value === 'number' ||
+      typeof value === 'boolean' ||
+      value === null
+    ) {
+      fields[name] = value;
+    }
+  }
+
+  return removeHttpHeadersFromSlackPayload({
+    tag: 'slack_event_dispatch',
+    channel,
+    alertLevel: CHANNEL_ALERT_LEVEL[channel],
+    delivery,
+    source: payload.source,
+    text: truncateSlackDispatchValue(payload.text),
+    requestedAt: payload.requestedAt ?? null,
+    requestId: requestMetadata.requestId,
+    requestPath: requestMetadata.requestPath,
+    vercelLogsUrl: truncateSlackDispatchValue(payload.vercelLogsUrl),
+    hasBlocks: blockCount > 0,
+    blockCount,
+    fields,
+  }) as Record<string, unknown>;
+}
+
+function logSlackEventDispatch(
+  channel: SlackChannelKey,
+  payload: SlackPayload,
+  delivery: 'bot' | 'webhook',
+): void {
+  console.info(
+    '[slack-events] dispatch',
+    compactSlackDispatchPayload(channel, payload, delivery),
+  );
+}
+
+function messageOptions(payload: SlackPayload) {
+  return Array.isArray(payload.blocks)
+    ? {
+        blocks: payload.blocks,
+        unfurlLinks: payload.unfurl_links ?? false,
+        unfurlMedia: payload.unfurl_media ?? false,
+      }
+    : undefined;
+}
+
+export async function sendSlackEvent(
+  channel: SlackChannelKey,
+  payload: SlackPayload,
+  options: SlackDeliveryOptions = {},
+): Promise<void> {
+  if (
+    getSlackChannelEnvironmentRequirement(channel) === 'prod' &&
+    getRuntimeEnv() !== 'prod'
+  ) {
+    return;
+  }
+  if (isSyntheticActorEmail(extractActorEmail(payload))) return;
+  if (!payload.bypassInternalActorBlock && isBlockedInternalActor(payload)) {
+    return;
+  }
+
+  const sanitizedPayload = removeHttpHeadersFromSlackPayload(
+    payload,
+  ) as SlackPayload;
+  const enrichedPayload = attachVercelLogsToPayload(sanitizedPayload, channel);
+  const normalized = enrichedPayload.blocks
+    ? {
+        ...enrichedPayload,
+        requestedAt: enrichedPayload.requestedAt ?? new Date().toISOString(),
+      }
+    : buildSlackActivityPayload({
+        source: enrichedPayload.source,
+        activityTitle: 'You have a new activity:',
+        activityPrimary:
+          normalizeText(enrichedPayload.text) || 'Activity update',
+        fields: [],
+        fallbackText: enrichedPayload.text,
+        requestedAt: enrichedPayload.requestedAt,
+        extra: enrichedPayload,
+      });
+  const versionedNormalized = options.enrichPayload
+    ? await options.enrichPayload(normalized)
+    : normalized;
+  const sanitizedNormalized = removeHttpHeadersFromSlackPayload({
+    unfurl_links: false,
+    unfurl_media: false,
+    ...versionedNormalized,
+  }) as SlackPayload;
+  const postMessage = options.postMessage ?? postMessageToSlack;
+
+  const botChannel = resolveBotChannel(channel);
+  if (botChannel) {
+    try {
+      await postMessage(
+        botChannel.token,
+        botChannel.channelId,
+        sanitizedNormalized.text,
+        messageOptions(sanitizedNormalized),
+      );
+      logSlackEventDispatch(channel, sanitizedNormalized, 'bot');
+      return;
+    } catch (error) {
+      if (
+        channel === 'sdk_cli_feedback' &&
+        isSlackChannelUnavailableError(error)
+      ) {
+        await postMessage(
+          botChannel.token,
+          SDK_CLI_ACTIVITY_SLACK_CHANNEL_ID,
+          sanitizedNormalized.text,
+          messageOptions(sanitizedNormalized),
+        );
+        logSlackEventDispatch(channel, sanitizedNormalized, 'bot');
+        return;
+      }
+      if (isBotOnlySlackChannel(channel)) throw error;
+      const webhookUrl = resolveWebhookUrl(channel);
+      if (!webhookUrl) throw error;
+      await postSlackWebhook(webhookUrl, sanitizedNormalized);
+      logSlackEventDispatch(channel, sanitizedNormalized, 'webhook');
+      return;
+    }
+  }
+
+  if (isBotOnlySlackChannel(channel)) {
+    throw new Error(`Missing ${SLACK_DEEPLINE_REPORTING_BOT_TOKEN_ENV}.`);
+  }
+  await postSlackWebhook(requireWebhookUrl(channel), sanitizedNormalized);
+  logSlackEventDispatch(channel, sanitizedNormalized, 'webhook');
+}
+
+export async function sendSlackEventSafe(
+  channel: SlackChannelKey,
+  payload: SlackPayload,
+  options: SlackDeliveryOptions = {},
+): Promise<boolean> {
+  try {
+    await sendSlackEvent(channel, payload, options);
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith('Missing SLACK_')) return false;
+    console.warn('Slack event send failed.', {
+      channel,
+      source: payload.source,
+      error: message,
+    });
+    return false;
+  }
+}