SaaS Slack Integration: OAuth, Notifications & Commands

1CREATE TABLE slack_workspace_installations (
2    id BIGSERIAL PRIMARY KEY,
3    tenant_id UUID NOT NULL UNIQUE REFERENCES tenants(id) ON DELETE CASCADE,
4    slack_team_id VARCHAR(64) NOT NULL UNIQUE,
5    slack_team_name VARCHAR(255) NOT NULL,
6    bot_access_token TEXT NOT NULL,      -- encrypt with AES-256 before storing
7    incoming_channel_id VARCHAR(64),
8    installed_by_user_id UUID NOT NULL,
9    created_at TIMESTAMPTZ DEFAULT NOW()
10);
11
12CREATE INDEX idx_slack_tenant ON slack_workspace_installations (tenant_id, slack_team_id);

1// src/integrations/slack/templates/notification.template.ts
2export function buildApprovalBlock(projectName: string, requestId: string) {
3  return {
4    blocks: [
5      {
6        type: 'section',
7        text: { type: 'mrkdwn', text: `*Deployment alert:* request pending for *${projectName}*` },
8      },
9      {
10        type: 'actions',
11        elements: [
12          { type: 'button', text: { type: 'plain_text', text: 'Approve' }, style: 'primary',
13            action_id: 'approve_build', value: requestId },
14          { type: 'button', text: { type: 'plain_text', text: 'Reject' }, style: 'danger',
15            action_id: 'reject_build', value: requestId },
16        ],
17      },
18    ],
19  };
20}

1// src/integrations/slack/guards/slack-signature.guard.ts
2import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from '@nestjs/common';
3import * as crypto from 'crypto';
4
5@Injectable()
6export class SlackSignatureGuard implements CanActivate {
7  private readonly MAX_SKEW_SECONDS = 300;
8
9  canActivate(context: ExecutionContext): boolean {
10    const req = context.switchToHttp().getRequest();
11    const signature = req.headers['x-slack-signature'];
12    const timestamp = req.headers['x-slack-request-timestamp'];
13    const rawBody = req.rawBody; // requires preserving the raw body in NestJS
14
15    if (!signature || !timestamp || !rawBody) {
16      throw new UnauthorizedException('Missing Slack signature headers.');
17    }
18
19    // Block replays: reject stale timestamps.
20    const now = Math.floor(Date.now() / 1000);
21    if (Math.abs(now - parseInt(timestamp, 10)) > this.MAX_SKEW_SECONDS) {
22      throw new UnauthorizedException('Slack request timestamp expired.');
23    }
24
25    const base = `v0:${timestamp}:${rawBody}`;
26    const expected =
27      'v0=' +
28      crypto.createHmac('sha256', process.env.SLACK_SIGNING_SECRET!).update(base, 'utf8').digest('hex');
29
30    // Timing-safe compare so an attacker can't guess the signature byte by byte.
31    const valid =
32      expected.length === signature.length &&
33      crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
34
35    if (!valid) throw new UnauthorizedException('Invalid Slack signature.');
36    return true;
37  }
38}

1// src/integrations/slack/slack-command.controller.ts
2import { Controller, Post, Body, UseGuards, HttpCode, HttpStatus } from '@nestjs/common';
3import { InjectQueue } from '@nestjs/bullmq';
4import { Queue } from 'bullmq';
5import { SlackSignatureGuard } from './guards/slack-signature.guard';
6
7@Controller('integrations/slack')
8export class SlackCommandController {
9  constructor(@InjectQueue('slack-interaction-queue') private readonly queue: Queue) {}
10
11  @Post('commands')
12  @UseGuards(SlackSignatureGuard)
13  @HttpCode(HttpStatus.OK)
14  async slashCommand(@Body() payload: any) {
15    await this.queue.add('run-command', {
16      command: payload.text,
17      teamId: payload.team_id,
18      userId: payload.user_id,
19      responseUrl: payload.response_url, // worker POSTs the real result here later
20    });
21
22    return { response_type: 'ephemeral', text: 'Working on it…' };
23  }
24}