chore: import upstream snapshot with attribution

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.test.ts

@@ -0,0 +1,136 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockParseWebhookBody,
+  mockFindWebhooksByRoutingKey,
+  mockDispatchResolvedWebhookTarget,
+  mockGetSlackBotCredential,
+  mockHandleChallenge,
+  mockVerifySignature,
+} = vi.hoisted(() => ({
+  mockParseWebhookBody: vi.fn(),
+  mockFindWebhooksByRoutingKey: vi.fn(),
+  mockDispatchResolvedWebhookTarget: vi.fn(),
+  mockGetSlackBotCredential: vi.fn(),
+  mockHandleChallenge: vi.fn(),
+  mockVerifySignature: vi.fn(),
+}))
+
+vi.mock('@/lib/core/admission/gate', () => ({
+  tryAdmit: () => ({ release: vi.fn() }),
+  admissionRejectedResponse: () => new Response(null, { status: 503 }),
+}))
+
+vi.mock('@/app/api/auth/oauth/utils', () => ({
+  getSlackBotCredential: mockGetSlackBotCredential,
+}))
+
+vi.mock('@/lib/webhooks/processor', () => ({
+  parseWebhookBody: mockParseWebhookBody,
+  findWebhooksByRoutingKey: mockFindWebhooksByRoutingKey,
+  dispatchResolvedWebhookTarget: mockDispatchResolvedWebhookTarget,
+}))
+
+vi.mock('@/lib/webhooks/providers/slack', () => ({
+  handleSlackChallenge: mockHandleChallenge,
+  verifySlackRequestSignature: mockVerifySignature,
+  resolveSlackEventKey: () => null,
+}))
+
+import { POST } from '@/app/api/webhooks/slack/custom/[credentialId]/route'
+
+const CREDENTIAL_ID = 'cred-123'
+
+function makeRequest() {
+  return new Request('https://sim.test/api/webhooks/slack/custom/cred-123', {
+    method: 'POST',
+    headers: { 'x-slack-request-timestamp': '1700000000' },
+  }) as unknown as import('next/server').NextRequest
+}
+
+const context = { params: Promise.resolve({ credentialId: CREDENTIAL_ID }) }
+
+const messageBody = {
+  team_id: 'T1',
+  api_app_id: 'A1',
+  event: { type: 'message', channel_type: 'channel', channel: 'C1', ts: '1.1' },
+}
+
+function webhook(id: string) {
+  return { webhook: { id, blockId: `blk-${id}`, providerConfig: {} }, workflow: { id: `wf-${id}` } }
+}
+
+describe('Slack custom-bot webhook route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockHandleChallenge.mockReturnValue(null)
+    mockVerifySignature.mockReturnValue(null)
+    mockParseWebhookBody.mockResolvedValue({
+      body: messageBody,
+      rawBody: JSON.stringify(messageBody),
+    })
+    mockGetSlackBotCredential.mockResolvedValue({
+      signingSecret: 'sec',
+      botToken: 'xoxb-x',
+      teamId: 'T1',
+    })
+    mockFindWebhooksByRoutingKey.mockResolvedValue([webhook('wh1')])
+    mockDispatchResolvedWebhookTarget.mockResolvedValue({
+      outcome: 'queued',
+      response: new Response(null, { status: 200 }),
+      reason: 'queued',
+    })
+  })
+
+  it('echoes the url_verification challenge without loading the credential', async () => {
+    mockHandleChallenge.mockReturnValue(new Response('ok', { status: 200 }))
+    await POST(makeRequest(), context)
+    expect(mockGetSlackBotCredential).not.toHaveBeenCalled()
+    expect(mockVerifySignature).not.toHaveBeenCalled()
+  })
+
+  it('404s an unknown credential', async () => {
+    mockGetSlackBotCredential.mockResolvedValue(null)
+    const res = await POST(makeRequest(), context)
+    expect(res.status).toBe(404)
+    expect(mockDispatchResolvedWebhookTarget).not.toHaveBeenCalled()
+  })
+
+  it('verifies with the credential signing secret and rejects a bad signature', async () => {
+    mockVerifySignature.mockReturnValue(new Response(null, { status: 401 }))
+    const res = await POST(makeRequest(), context)
+    expect(mockVerifySignature).toHaveBeenCalledWith(
+      'sec',
+      expect.anything(),
+      expect.any(String),
+      expect.any(String)
+    )
+    expect(res.status).toBe(401)
+    expect(mockDispatchResolvedWebhookTarget).not.toHaveBeenCalled()
+  })
+
+  it('fans out by credential id (provider slack) and dispatches each webhook', async () => {
+    const res = await POST(makeRequest(), context)
+    expect(mockFindWebhooksByRoutingKey).toHaveBeenCalledWith(
+      CREDENTIAL_ID,
+      expect.any(String),
+      'slack'
+    )
+    expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledTimes(1)
+    expect(res.status).toBe(200)
+  })
+
+  it('still returns 200 when the dispatcher filters the event', async () => {
+    mockDispatchResolvedWebhookTarget.mockResolvedValue({
+      outcome: 'ignored',
+      response: new Response(null, { status: 200 }),
+      reason: 'filtered',
+    })
+    const res = await POST(makeRequest(), context)
+    expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledTimes(1)
+    expect(res.status).toBe(200)
+  })
+})

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.ts

@@ -0,0 +1,88 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { findWebhooksByRoutingKey, parseWebhookBody } from '@/lib/webhooks/processor'
+import { handleSlackChallenge, verifySlackRequestSignature } from '@/lib/webhooks/providers/slack'
+import { dispatchSlackWebhooks } from '@/lib/webhooks/slack-dispatch'
+import { getSlackBotCredential } from '@/app/api/auth/oauth/utils'
+
+const logger = createLogger('SlackCustomBotWebhookAPI')
+
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+export const maxDuration = 60
+
+/**
+ * Ingest endpoint for a reusable custom Slack bot. The bot's single Event
+ * Subscriptions Request URL embeds its credential id, so every trigger that
+ * references the same bot credential shares one URL — routed here by
+ * `routingKey = credentialId` (mirrors the native `/api/webhooks/slack`
+ * `team_id` fan-out). Requests are HMAC-verified with the credential's OWN
+ * signing secret (not the shared env secret).
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ credentialId: string }> }) => {
+    const ticket = tryAdmit()
+    if (!ticket) {
+      return admissionRejectedResponse()
+    }
+    try {
+      return await handleSlackCustomBotWebhook(request, context)
+    } finally {
+      ticket.release()
+    }
+  }
+)
+
+async function handleSlackCustomBotWebhook(
+  request: NextRequest,
+  context: { params: Promise<{ credentialId: string }> }
+): Promise<NextResponse> {
+  const receivedAt = Date.now()
+  const requestId = generateRequestId()
+  const { credentialId } = await context.params
+
+  const parseResult = await parseWebhookBody(request, requestId)
+  if (parseResult instanceof NextResponse) {
+    return parseResult
+  }
+  const { body, rawBody } = parseResult
+
+  // Echo Slack's url_verification challenge unconditionally — this is how Slack
+  // verifies the Request URL when the app is created from the manifest, before
+  // the bot is installed / the credential is finalized.
+  const challenge = handleSlackChallenge(body)
+  if (challenge) {
+    return challenge
+  }
+
+  const botCredential = await getSlackBotCredential(credentialId)
+  if (!botCredential) {
+    logger.warn(`[${requestId}] Unknown Slack bot credential ${credentialId}`)
+    return new NextResponse(null, { status: 404 })
+  }
+
+  const authError = verifySlackRequestSignature(
+    botCredential.signingSecret,
+    request,
+    rawBody,
+    requestId
+  )
+  if (authError) {
+    return authError
+  }
+
+  const webhooks = await findWebhooksByRoutingKey(credentialId, requestId, 'slack')
+  if (webhooks.length === 0) {
+    logger.info(
+      `[${requestId}] No active trigger for bot credential ${credentialId}; nothing to run`
+    )
+    return new NextResponse(null, { status: 200 })
+  }
+
+  await dispatchSlackWebhooks(webhooks, { body, request, requestId, receivedAt })
+
+  return new NextResponse(null, { status: 200 })
+}