Security

CLOUDFLARE_API_TOKEN: z.string().min(1)

const cloudflaredToken = await this.cloudflareService.getTunnelToken(cfTunnel.id);

return {
  tunnelId: dbTunnel.id,
  hostname,
  cloudflaredToken,
  heartbeatIntervalSec: 20,
};

async startSlackAuth(input: {
  email: string;
  codeChallenge: string;
  cliCallbackUrl: string;
}): Promise<{ authorizeUrl: string; state: string }> {
  const email = assertAllowedEmail(input.email, this.env.ALLOWED_EMAIL_DOMAIN);

  const state = randomBytes(24).toString('base64url');
  const expiresAt = new Date(Date.now() + OAUTH_SESSION_TTL_MS);

  await this.repository.createOauthSession({
    email,
    state,
    codeChallenge: input.codeChallenge,
    cliCallbackUrl: input.cliCallbackUrl,
    expiresAt,
  });

  const query = new URLSearchParams({
    response_type: 'code',
    client_id: this.env.SLACK_CLIENT_ID,
    scope: 'openid profile email',
    state,
    redirect_uri: this.env.SLACK_REDIRECT_URI,
  });

  return {
    authorizeUrl: `https://slack.com/openid/connect/authorize?${query.toString()}`,
    state,
  };
}

const challenge = createCodeChallenge(input.codeVerifier);
if (challenge !== session.codeChallenge) {
  throw new AppError(400, 'INVALID_CODE_VERIFIER', 'PKCE code verifier mismatch.');
}

signAccessToken(payload: AccessTokenPayload): string {
  return jwt.sign(payload, this.env.JWT_SECRET, {
    algorithm: 'HS256',
    expiresIn: `${this.env.JWT_ACCESS_TTL_MINUTES}m`,
  });
}

JWT_ACCESS_TTL_MINUTES: z.coerce.number().int().positive().default(15)

generateRefreshToken(): string {
  return randomBytes(48).toString('base64url');
}

REFRESH_TTL_DAYS: z.coerce.number().int().positive().default(30)

hashToken(token: string): string {
  return createHash('sha256').update(token).digest('hex');
}

async refreshTokens(refreshToken: string): Promise<TokenPair> {
  const tokenHash = this.tokenService.hashToken(refreshToken);
  const record = await this.repository.getActiveRefreshTokenWithUser(tokenHash);

  if (!record) {
    throw new AppError(401, 'INVALID_REFRESH_TOKEN', 'Refresh token is invalid or expired.');
  }

  await this.repository.revokeRefreshToken(tokenHash);

  return this.issueTokenPair({
    id: record.user.id,
    email: record.user.email,
    slackUserId: record.user.slackUserId,
    slackTeamId: record.user.slackTeamId,
  });
}

ALLOWED_EMAIL_DOMAIN: z
  .string()
  .min(3)
  .transform((value) => normalizeEmailDomain(value))

ALLOWED_EMAIL_DOMAIN=@example.com

const email = assertAllowedEmail(slackProfile.email ?? '', this.env.ALLOWED_EMAIL_DOMAIN);
if (normalizeEmail(session.email) !== email) {
  throw new AppError(403, 'EMAIL_MISMATCH', 'Authenticated Slack user email does not match requested email.');
}

ALLOWED_SLACK_TEAM_ID: z.string().min(1)

if (slackTeamId !== this.env.ALLOWED_SLACK_TEAM_ID) {
  throw new AppError(403, 'WORKSPACE_NOT_ALLOWED', 'Slack workspace is not allowed.');
}

ALLOWED_SLACK_TEAM_ID=T01234567

await this.repository.createAuditLog({
  userId: user.id,
  action: 'auth.oauth.authorized',
  metadata: { email },
});

SELECT created_at, user_id, action, metadata
FROM audit_logs
WHERE action LIKE 'auth.%'
ORDER BY created_at DESC
LIMIT 100;