Omar SobhandClaude Fable 5
6dbdd20ee0
- Broker op VerifySlackSignature: v0 HMAC-SHA256 computed INSIDE the broker
(constant-time compare); the signing secret never crosses the socket.
Slack secrets are one JSON credential {bot_token, signing_secret}; the
broker extracts the right field per operation
- Public POST /api/slack/events: signature verified against connected slack
connections via the broker; forged signatures 401; url_verification
handshake echoed only when signed; app_mention starts a real run in the
agent's dedicated '💬 Slack' session — and the agent's reply is itself a
gated outbound post
- SlackApp Connection tab captures bot token + signing secret
- Integration test: forged 401, signed challenge, signed mention -> run ->
slack.post pending in the approval queue
- E2E: full loop — connect, gated outbound (sink empty -> exactly one post),
then a node-crypto-signed mention -> approval card -> approve -> 'On it!'
lands in the sink
134 Rust + 63 frontend tests + 21 Playwright journeys.
Co-Authored-By: Claude Fable 5 <[email protected]>
35 lines
752 B
TOML
35 lines
752 B
TOML
[package]
|
|
name = "tc-secrets"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[dependencies]
|
|
chacha20poly1305 = "0.10"
|
|
hex = "0.4"
|
|
hmac = "0.12"
|
|
sha2 = "0.10"
|
|
reqwest = { version = "0.12", default-features = false, features = [
|
|
"json",
|
|
"rustls-tls",
|
|
] }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
tc-domain = { path = "../tc-domain" }
|
|
tc-safety = { path = "../tc-safety" }
|
|
thiserror = { workspace = true }
|
|
tokio = { workspace = true }
|
|
uuid = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
time = { workspace = true }
|
|
axum = "0.8"
|
|
tc-db = { path = "../tc-db" }
|
|
tc-testkit = { path = "../tc-testkit" }
|
|
|
|
[lints]
|
|
workspace = true
|