QRun-IO/qbit-slack
3
0 Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

feat: phase 2 - interactive buttons as the clicking user, Events API revocations #8

Merged
KofTwentyTwo merged 3 commits from feature/interactivity into develop 2026-10-14 19:56:07 +00:00
Conversation 0 Commits 3 Files Changed 22
+1663 -29
3 Commits
Author SHA1 Message Date
james.maesandClaude Opus 5.5 0c298f893e feat(interactivity): button actions run as the clicking user; Events API revocations 
POST /qqq/hooks/slack/interactions: verified, acknowledged, token checked
against the stored message, Slack user mapped to a connection in the same
workspace row, process run in that user's session with permission, tenant and
record locks; idempotent message update; ephemeral replies only to
hooks.slack.com. POST /qqq/hooks/slack/events: url_verification,
tokens_revoked and app_uninstalled across every tenant row of the team.
Built-in acknowledge_alert / resolve_alert when those processes exist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 13:49:23 -05:00
james.maesandClaude Opus 5.5 fb93a01a41 feat(metadata): slack_interaction audit table (child of messages) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 13:49:22 -05:00
james.maesandClaude Opus 5.5 d486153ca8 feat(security): Slack request signature verifier and signed button tokens 
v0 HMAC-SHA256 over timestamp and raw body, 300 s window, constant-time
compare; button values are server-signed (message, action, record, expiry).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 13:49:21 -05:00