Compare commits

..
23 Commits
Author SHA1 Message Date
Pablo F.G 7da6d06f51 refactor(ui): model Slack channel and test-message state as unions
- Collapse the channel-list fetch state into one discriminated union
- Collapse the test-message flag and outcome into one status union
- Group the saved-channel mirror and sync marker into channel refs
2026-08-18 17:46:46 +02:00
Pablo F.G 0c9aa84676 chore(ui): drop the channel test-message changelog entry
The Slack integration ships one changelog entry on the stack's first PR
2026-08-18 17:46:46 +02:00
Pablo F.G b388bb68f6 docs(ui): trim the Slack channel page-test and harness comments
- Shorten Given/When/Then notes to one clause
- Compress harness JSDoc to single informative lines
2026-08-18 17:46:46 +02:00
Pablo F.G df0775d135 docs(ui): trim the Slack channel unit-test comments
- Keep the Given/When/Then scaffold without essayistic tails
- Keep pagination-origin and body-read gotchas as one-liners
2026-08-18 17:46:46 +02:00
Pablo F.G 5af26a5f53 docs(ui): trim the Slack channel MSW comments
- Keep fixture semantics and handler precedence notes
- Drop narrative around refusal shapes
2026-08-18 17:46:46 +02:00
Pablo F.G 5690d1ad94 docs(ui): trim the Slack channel component comments
- Compress state and rendering rationale to one-liners
- Drop prose restating the JSX
2026-08-18 17:46:46 +02:00
Pablo F.G e178722f0b docs(ui): trim the Slack channel action comments
- Cut narrative prose to the load-bearing why
- Keep ordering, security, and contract anchors
2026-08-18 17:46:46 +02:00
Pablo F.G d28272b17b fix(ui): label the Slack channel picker only where there is one
- Stop the destination label pointing at an element the error and empty
  states never render
- Match the Slack copy in tests as the sentences it is, so rewording it
  cannot turn an assertion into an invalid pattern
2026-08-18 17:46:46 +02:00
Pablo F.G 4ffe215a67 chore(ui): drop the unread Slack wiring in the generic integration paths
- Remove the Slack entry from the shared test-connection copy map and
  the Slack branch of the generic update, both unreachable: the Slack
  page runs its connection test and channel save through its own actions
2026-08-18 17:46:46 +02:00
Pablo F.G d60cb02f72 fix(ui): stop the Slack card contradicting its own channel state
- Read as still loading on the server-rendered first paint, instead of
  telling a healthy workspace to go create or invite in Slack
- Say a saved channel is recorded even when its name is not on hand
2026-08-18 17:46:46 +02:00
Pablo F.G 349d6d8dd4 fix(ui): keep an unworded Slack refusal inside Prowler's sentence
- Wrap a reason code this UI has no copy for instead of showing the
  raw protocol token as the whole message
- Share the reason-shape gate with the OAuth callback instead of
  keeping a private copy of it
2026-08-18 17:46:46 +02:00
Pablo F.G 6d1852b38a fix(ui): show the Slack channels that were read when the list is partial
- Keep the picker usable when a later page is refused, with the refusal
  as the explanation instead of a blocking error
- Say when the workspace has more channels than one read covers, so a
  missing channel is not misread as a missing @Prowler invite
2026-08-18 17:46:46 +02:00
Pablo F.G 531b7fd311 fix(ui): report a Slack channel-flow server fault to Sentry
- Give the channel listing, the channel save and the test message the
  same upstream-fault reporting the OAuth actions already have
- Keep every user-facing message exactly as it was
2026-08-18 17:46:46 +02:00
Pablo F.G d19c81bdbb fix(ui): report an unreadable Slack channel save as its own outcome
- Read the save result like the install result: an empty or non-JSON
  answer is an unknown outcome, not a parser message shown verbatim
- Refresh the cached pages before judging the answer, since the API
  records the channel before answering
- Stop a resource without a configuration from reaching the card
2026-08-18 17:46:46 +02:00
Pablo F.G b323ab139e fix(ui): track the recorded Slack channel from a single source
- Gate the connection check and its next-step hint on the same
  acknowledged save that reveals the test message
- Follow a destination recorded elsewhere when the page data refreshes,
  without clobbering a pick the user has not saved yet
2026-08-18 17:46:46 +02:00
Pablo F.G 57434ea16e fix(ui): validate the integration id in the Slack channel actions
- Refuse an id that is not API-shaped before it reaches a request URL,
  answering the open request-forgery alerts on these actions
- Align the Slack fixtures with the ids the API actually issues
2026-08-18 17:46:46 +02:00
Pablo F.G c9c769c1df fix(ui): keep the Slack channel pagination on the API origin
- Resolve a relative `links.next` against the page it arrived on, not
  the API root, so a cursor-only link keeps the listing's path
- End pagination instead of following a link that leaves the API origin
  carrying the tenant's token
2026-08-18 17:46:46 +02:00
Pablo F.G 71be560bc2 fix(ui): tell the user why Slack refused a channel or message
Read the refusal's `code` on every Slack-backed flow, not only on the
OAuth ones: the channel listing kept the wait Slack asked for nowhere,
the channel save reported the two channel refusals as one sentence, and
the test message showed Slack's raw reason as if it were copy.

- Keep `Retry-After` on a rate-limited channel listing, so the user is
  told when to come back instead of only that it failed
- Record the destination through a Slack action, so "the channel is
  gone" and "invite @Prowler to it" stop collapsing into one message
- Map the reason the test-message task settles with, falling back to the
  API's own wording when it is not one Prowler has copy for
- Give the MSW refusals the API's real body shape, code and all
2026-08-18 17:46:46 +02:00
Pablo F.G 608ce240d0 feat(ui): pick a Slack channel and send a test message
Offer the connected workspace's channels — public, plus the private ones
@Prowler has been invited to — through a props-driven picker the alerts
form can import unchanged, record the choice as the integration's default
(only channel_id travels; the API derives the name), and prove delivery
with a test message that polls the task the API hands back.
2026-08-18 17:46:46 +02:00
Pablo F.G c3420151b5 docs(ui): trim the Slack install-guard comment 2026-08-18 17:43:39 +02:00
Pablo F.G 6adbb75ca9 test(ui): pin the exact OAuth scopes Prowler asks Slack for 2026-08-18 17:40:26 +02:00
Pablo F.G 23d6c77a78 fix(ui): hide the decorative Slack icon from assistive technology 2026-08-18 17:39:03 +02:00
Pablo F.G 9d43aa0c33 fix(ui): confirm a Slack install only from a Slack-typed resource
- Require a non-empty id, the integrations resource type and the slack
  integration kind before reporting the workspace as installed
2026-08-18 17:38:40 +02:00
4 changed files with 35 additions and 13 deletions
+9
View File
@@ -264,10 +264,19 @@ describe("exchangeSlackOAuthCode result shape", () => {
["an array", []],
["a bare string", "invalid"],
["a resource with no id", { type: "integrations", attributes: {} }],
["a resource with an empty id", { ...INTEGRATION, id: "" }],
["a resource of another type", { ...INTEGRATION, type: "tasks" }],
[
"a resource with no attributes",
{ id: INTEGRATION.id, type: "integrations" },
],
[
"another kind of integration",
{
...INTEGRATION,
attributes: { ...INTEGRATION.attributes, integration_type: "jira" },
},
],
])("cannot confirm the install from %s", async (_label, data) => {
// Given — a 2xx whose `data` is truthy but is not an integration resource.
fetchMock.mockResolvedValue(exchangeResponse(data));
+23 -9
View File
@@ -16,9 +16,10 @@ import {
slackUnknownReasonMessage,
} from "@/lib/integrations/slack-errors";
import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
import type {
IntegrationProps,
SlackChannelOption,
import {
INTEGRATION_TYPE,
type IntegrationProps,
type SlackChannelOption,
} from "@/types/integrations";
interface SlackUnavailable {
@@ -116,23 +117,36 @@ const isSlackAuthorizeUrl = (value: string): boolean => {
}
};
const INTEGRATIONS_RESOURCE_TYPE = "integrations";
/**
* The callback names the workspace and redirects on this value alone, so a `2xx`
* payload that is not a JSON:API resource (`{}`, `[]`, `"invalid"`) must read as
* unreadable rather than as a connected workspace.
* unreadable rather than as a connected workspace. Identity too: a resource
* that is not a linkable Slack integration would be shown as the workspace
* just installed.
*/
const isIntegrationResource = (value: unknown): boolean => {
if (typeof value !== "object" || value === null || Array.isArray(value)) {
return false;
}
const { id, attributes } = value as Record<string, unknown>;
const { id, type, attributes } = value as Record<string, unknown>;
if (
typeof id !== "string" ||
id === "" ||
type !== INTEGRATIONS_RESOURCE_TYPE ||
typeof attributes !== "object" ||
attributes === null ||
Array.isArray(attributes)
) {
return false;
}
return (
typeof id === "string" &&
typeof attributes === "object" &&
attributes !== null &&
!Array.isArray(attributes)
(attributes as Record<string, unknown>).integration_type ===
INTEGRATION_TYPE.SLACK
);
};
@@ -64,9 +64,9 @@ describe("starting the install", () => {
expect(`${consentScreen.origin}${consentScreen.pathname}`).toBe(
"https://slack.com/oauth/v2/authorize",
);
expect((consentScreen.searchParams.get("scope") ?? "").split(",")).toEqual(
expect.arrayContaining(REQUIRED_SCOPES),
);
const scopes = (consentScreen.searchParams.get("scope") ?? "").split(",");
expect(scopes).toHaveLength(REQUIRED_SCOPES.length);
expect(scopes).toEqual(expect.arrayContaining(REQUIRED_SCOPES));
// The state is server-minted, binding this install to the session
// (design D5).
expect(consentScreen.searchParams.get("state")).toBeTruthy();
@@ -764,7 +764,6 @@ export const SlackIcon: React.FC<IconSvgProps> = ({
fill="none"
focusable="false"
height={height ?? size}
role="presentation"
viewBox="0 0 48 48"
width={width ?? size}
className={className}