chore: import upstream snapshot with attribution

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.ts

@@ -0,0 +1,88 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { findWebhooksByRoutingKey, parseWebhookBody } from '@/lib/webhooks/processor'
+import { handleSlackChallenge, verifySlackRequestSignature } from '@/lib/webhooks/providers/slack'
+import { dispatchSlackWebhooks } from '@/lib/webhooks/slack-dispatch'
+import { getSlackBotCredential } from '@/app/api/auth/oauth/utils'
+
+const logger = createLogger('SlackCustomBotWebhookAPI')
+
+export const dynamic = 'force-dynamic'
+export const runtime = 'nodejs'
+export const maxDuration = 60
+
+/**
+ * Ingest endpoint for a reusable custom Slack bot. The bot's single Event
+ * Subscriptions Request URL embeds its credential id, so every trigger that
+ * references the same bot credential shares one URL — routed here by
+ * `routingKey = credentialId` (mirrors the native `/api/webhooks/slack`
+ * `team_id` fan-out). Requests are HMAC-verified with the credential's OWN
+ * signing secret (not the shared env secret).
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ credentialId: string }> }) => {
+    const ticket = tryAdmit()
+    if (!ticket) {
+      return admissionRejectedResponse()
+    }
+    try {
+      return await handleSlackCustomBotWebhook(request, context)
+    } finally {
+      ticket.release()
+    }
+  }
+)
+
+async function handleSlackCustomBotWebhook(
+  request: NextRequest,
+  context: { params: Promise<{ credentialId: string }> }
+): Promise<NextResponse> {
+  const receivedAt = Date.now()
+  const requestId = generateRequestId()
+  const { credentialId } = await context.params
+
+  const parseResult = await parseWebhookBody(request, requestId)
+  if (parseResult instanceof NextResponse) {
+    return parseResult
+  }
+  const { body, rawBody } = parseResult
+
+  // Echo Slack's url_verification challenge unconditionally — this is how Slack
+  // verifies the Request URL when the app is created from the manifest, before
+  // the bot is installed / the credential is finalized.
+  const challenge = handleSlackChallenge(body)
+  if (challenge) {
+    return challenge
+  }
+
+  const botCredential = await getSlackBotCredential(credentialId)
+  if (!botCredential) {
+    logger.warn(`[${requestId}] Unknown Slack bot credential ${credentialId}`)
+    return new NextResponse(null, { status: 404 })
+  }
+
+  const authError = verifySlackRequestSignature(
+    botCredential.signingSecret,
+    request,
+    rawBody,
+    requestId
+  )
+  if (authError) {
+    return authError
+  }
+
+  const webhooks = await findWebhooksByRoutingKey(credentialId, requestId, 'slack')
+  if (webhooks.length === 0) {
+    logger.info(
+      `[${requestId}] No active trigger for bot credential ${credentialId}; nothing to run`
+    )
+    return new NextResponse(null, { status: 200 })
+  }
+
+  await dispatchSlackWebhooks(webhooks, { body, request, requestId, receivedAt })
+
+  return new NextResponse(null, { status: 200 })
+}