chore: import clean Agent Desk snapshot (3/7)

internal/services/slack_inbound_service.go

@@ -0,0 +1,180 @@
+package services
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"strconv"
+	"strings"
+	"time"
+
+	"agent-desk/internal/pkg/config"
+
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/enums"
+	"agent-desk/internal/pkg/errorsx"
+	"agent-desk/internal/pkg/openidentity"
+	"agent-desk/internal/slack"
+)
+
+var SlackInboundService = newSlackInboundService()
+
+func newSlackInboundService() *slackInboundService {
+	return &slackInboundService{}
+}
+
+type slackInboundService struct{}
+
+// HandleWebhook processes an incoming Events API event from Slack.
+func (s *slackInboundService) HandleWebhook(ctx context.Context, channelID string, timestampHeader, signatureHeader string, rawPayload []byte) (*string, error) {
+	var event slack.EventCallback
+	if err := json.Unmarshal(rawPayload, &event); err != nil {
+		return nil, fmt.Errorf("unmarshal slack event failed: %w", err)
+	}
+
+	// 1. URL Verification Challenge
+	if event.Type == "url_verification" {
+		return &event.Challenge, nil
+	}
+
+	if event.Type != "event_callback" || event.Event == nil {
+		return nil, nil // Ignore non-message callbacks
+	}
+
+	teamID := strings.TrimSpace(event.TeamID)
+	ev := event.Event
+
+	if ev.BotID != "" || ev.Subtype == "bot_message" || strings.TrimSpace(ev.User) == "" {
+		return nil, nil // Ignore bot loops
+	}
+
+	text := strings.TrimSpace(ev.Text)
+	if text == "" {
+		return nil, nil
+	}
+
+	var channel *models.Channel
+	channelID = strings.TrimSpace(channelID)
+	if channelID != "" {
+		channel = ChannelService.Take("channel_id = ? AND channel_type = ? AND status = ?", channelID, enums.ChannelTypeSlack, enums.StatusOk)
+	}
+	if channel == nil && teamID != "" {
+		channel = ChannelService.Take("channel_type = ? AND status = ? AND (channel_id = ? OR config_json LIKE ?)",
+			enums.ChannelTypeSlack, enums.StatusOk, teamID, "%"+teamID+"%")
+	}
+	if channel == nil {
+		channel = ChannelService.Take("channel_type = ? AND status = ?", enums.ChannelTypeSlack, enums.StatusOk)
+	}
+	if channel == nil {
+		return nil, errorsx.InvalidParam("slack channel not found or disabled")
+	}
+
+	cfg, err := ChannelService.ParseSlackChannelConfig(channel.ConfigJSON)
+	if err != nil || cfg == nil {
+		return nil, errorsx.InvalidParam("slack channel config invalid")
+	}
+
+	// Verify the Slack signing secret whenever one resolves for this channel. A
+	// delivery with no signature headers is rejected rather than waved through:
+	// Slack always signs once a signing secret exists, so a missing header means
+	// the sender is not Slack.
+	slackCfg := config.ResolveSlack(cfg.BotToken, cfg.SigningSecret)
+	if slackCfg.SigningSecret != "" {
+		if strings.TrimSpace(signatureHeader) == "" || strings.TrimSpace(timestampHeader) == "" {
+			slog.Warn("slack webhook rejected: missing signature headers",
+				"channel_id", channelID, "secret_source", slackSecretSource(cfg.SigningSecret, slackCfg))
+			return nil, errorsx.UnauthorizedI18n("error.auth.invalidSignature")
+		}
+		if !verifySlackSignature(slackCfg.SigningSecret, timestampHeader, signatureHeader, rawPayload) {
+			slog.Warn("slack webhook rejected: signature verification failed",
+				"channel_id", channelID, "secret_source", slackSecretSource(cfg.SigningSecret, slackCfg))
+			return nil, errorsx.UnauthorizedI18n("error.auth.invalidSignature")
+		}
+	}
+
+	// 1. Resolve customer identity
+	senderID := strings.TrimSpace(ev.User)
+	externalUser := openidentity.ExternalUser{
+		ExternalSource: enums.ExternalSourceSlack,
+		ExternalID:     senderID,
+		ExternalName:   fmt.Sprintf("Slack User %s", senderID),
+	}
+
+	// 2. Create or match Conversation
+	conversation, err := ConversationService.Create(externalUser, channel.ID, channel.AIAgentID)
+	if err != nil {
+		return nil, fmt.Errorf("create slack conversation failed: %w", err)
+	}
+
+	// 3. Send message through MessageService
+	msgTS := strings.TrimSpace(ev.TS)
+	threadTS := strings.TrimSpace(ev.ThreadTS)
+	if threadTS == "" {
+		threadTS = msgTS
+	}
+	clientMsgID := fmt.Sprintf("slack_%s_%s", ev.Channel, msgTS)
+	payloadMap := map[string]any{
+		"slack_channel":   ev.Channel,
+		"slack_ts":        msgTS,
+		"slack_thread_ts": threadTS,
+		"slack_user":      senderID,
+		"slack_team":      teamID,
+	}
+	payloadBytes, _ := json.Marshal(payloadMap)
+
+	_, err = MessageService.SendCustomerMessage(
+		conversation.ID,
+		clientMsgID,
+		enums.IMMessageTypeText,
+		text,
+		string(payloadBytes),
+		externalUser,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("send customer message failed: %w", err)
+	}
+
+	return nil, nil
+}
+
+// slackSecretSource names where the verifying secret came from. A channel
+// bound to a different Slack app than the deployment-wide one starts failing
+// the moment the fallback secret appears, and this log field is the only way
+// an operator can tell that apart from a spoofed delivery.
+func slackSecretSource(channelSigningSecret string, resolved config.SlackConfig) string {
+	if strings.TrimSpace(channelSigningSecret) != "" {
+		return "channel"
+	}
+	if resolved.SigningSecret != "" {
+		return "deployment_fallback"
+	}
+	return "none"
+}
+
+// slackTimestampTolerance is how far a request timestamp may drift from now.
+//
+// Slack's own verification guide requires rejecting anything older than five
+// minutes. Without the check a captured request replays indefinitely: the
+// signature covers the timestamp and the body, but nothing in it expires.
+const slackTimestampTolerance = 5 * time.Minute
+
+func verifySlackSignature(signingSecret, timestampHeader, signatureHeader string, payload []byte) bool {
+	timestampHeader = strings.TrimSpace(timestampHeader)
+	timestamp, err := strconv.ParseInt(timestampHeader, 10, 64)
+	if err != nil || timestamp <= 0 {
+		return false
+	}
+	if drift := time.Since(time.Unix(timestamp, 0)); drift > slackTimestampTolerance || drift < -slackTimestampTolerance {
+		return false
+	}
+
+	sigBasestring := fmt.Sprintf("v0:%s:%s", timestampHeader, string(payload))
+	mac := hmac.New(sha256.New, []byte(signingSecret))
+	mac.Write([]byte(sigBasestring))
+	expectedSig := "v0=" + hex.EncodeToString(mac.Sum(nil))
+	return hmac.Equal([]byte(strings.TrimSpace(signatureHeader)), []byte(expectedSig))
+}