Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

slackbot: api and config protos #1201

Merged
merged 10 commits into from
Apr 6, 2021
Merged

slackbot: api and config protos #1201

merged 10 commits into from
Apr 6, 2021

Conversation

scarlettperry
Copy link
Contributor

@scarlettperry scarlettperry commented Mar 30, 2021

Description

PR creates the protos for the API that will receive requests from the Slack Events API.

  • given that the request/response contain sensitive data (ie tokens, challenges), I've add the redacted option to the request/response protos so that the field values don't get saved in the audit DB. Ideally, it'd be nice to specify which exact fields we want to redact, so I opened an issue. I can follow up on that later.

PR also creates a new config for the user to specify the slack bot token and signing secret, which will be used to create a slack client instance via slack-go and confirm that each request came from Slack.

  • we decided that the module will be provider-specific (ie Slack, Discord, etc) and that the service will be generic, which is why I set the module to have the config.

Testing Performed

Locally
Screen Shot 2021-04-02 at 4 36 38 PM

GitHub Issue

#8

@scarlettperry scarlettperry marked this pull request as ready for review April 2, 2021 21:23
@scarlettperry scarlettperry requested a review from a team as a code owner April 2, 2021 21:23

message Config {
// Bot tokens begin with "xoxb-", https://api.slack.com/authentication/token-types#bot
string bot_token = 1 [ (validate.rules).string = {min_bytes : 1} ];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a chance we would want to have potentially n bot tokens if somehow we wanted a single clutch instance to talk to multiple slack teams or potentially have many bots?

Copy link
Contributor Author

@scarlettperry scarlettperry Apr 5, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah it crossed my mind that it's something we might do in the future. though if we were to support that, then I think the config structure would be very different. Perhaps it would be similar to Omnibot's https://lyft.github.io/omnibot/configuration.html#bots, where we'd want the slack workspace, bot app id, bot name, and bot token etc to know which messages to route to which bot.

I'll add a todo for now and come back to it when I open a PR for the module b/c may want to add more stuff

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 sounds good. My only concern would be that modifying the config down the road might be more difficult

api/bot/slackbot/v1/slackbot.proto Show resolved Hide resolved
Comment on lines 33 to 34
// image urls
map<string, string> icons = 6;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's kind of unclear what icons is scoped to? Is it possible for a bot to have icons?

Copy link
Contributor Author

@scarlettperry scarlettperry Apr 5, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll add a comment to clarify. the Slack API sends us something like the snippet below which refers to the display picture of the bot user. I'm guessing that Slack saves a given image in a few different sizes or saves a history of the different display images the bot has had

"icons": {
            "image_36": "https://...",
            "image_48": "https://...",
            "image_72": "https://..."
        }

api/bot/slackbot/v1/slackbot.proto Show resolved Hide resolved
Comment on lines 47 to 48
string bot_id = 3;
Bot bot_profile = 4;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

comments? :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep! will add a comment

// Respond back to the Slack Events API with the challenge or a 2xx,
// https://api.slack.com/apis/connections/events-api#the-events-api__responding-to-events
message EventResponse {
option (clutch.api.v1.redacted) = true;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a todo with a link to #1227?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in this case, the response just has the challenge field so i think it's fine to redact the entire response

api/bot/slackbot/v1/slackbot.proto Show resolved Hide resolved
api/bot/slackbot/v1/slackbot.proto Show resolved Hide resolved
api/bot/slackbot/v1/slackbot.proto Show resolved Hide resolved
Comment on lines 92 to 93
// an installation of the app, object type
google.protobuf.Value authorizations = 10;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a bit unclear what this is

Copy link
Contributor Author

@scarlettperry scarlettperry Apr 5, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'll add a comment, it indicates who the event is visible to

example of what it can look like

"authorizations": [
        {
            "enterprise_id": "E12345",
            "team_id": "T12345",
            "user_id": "U12345",
            "is_bot": false
        }
    ],

@scarlettperry
Copy link
Contributor Author

@dschaller, thank you for all the feedback! addressed, lmk if you have any Qs about the comments I left.

@scarlettperry scarlettperry merged commit ba5d938 into main Apr 6, 2021
@scarlettperry scarlettperry deleted the sperry-slackbot-api branch April 6, 2021 18:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants