feat: admin slack configuration

backend/src/services/slack/slack-fns.ts

@@ -1,13 +1,57 @@
 import { Block, WebClient } from "@slack/web-api";
 
+import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
 import { TProjectDALFactory } from "../project/project-dal";
+import { TAdminSlackConfigDALFactory } from "./admin-slack-config-dal";
 import { TProjectSlackConfigDALFactory } from "./project-slack-config-dal";
 import { SlackTriggerFeature } from "./slack-types";
 
+const ADMIN_CONFIG_DB_UUID = "00000000-0000-0000-0000-000000000000";
+
+export const getCustomSlackBotManifest = () => {
+  const appCfg = getConfig();
+
+  return {
+    display_information: {
+      name: "Infisical",
+      description: "Get real-time Infisical updates in Slack",
+      background_color: "#c2d62b",
+      long_description: `This Slack application is designed specifically for use with your self-hosted Infisical instance, allowing seamless integration between your Infisical projects and your Slack workspace. With this integration, your team can stay up-to-date with the latest events, changes, and notifications directly inside Slack.
+      - Notifications: Receive real-time updates and alerts about critical events in your Infisical projects. Whether it's a new project being created, updates to secrets, or changes to your team's configuration, you will be promptly notified within the designated Slack channels of your choice.
+      - Customization: Tailor the notifications to your team's specific needs by configuring which types of events trigger alerts and in which channels they are sent.
+      - Collaboration: Keep your entire team in the loop with notifications that help facilitate more efficient collaboration by ensuring that everyone is aware of important developments in your Infisical projects.
+      
+      By integrating Infisical with Slack, you can enhance your workflow by combining the power of secure secrets management with the communication capabilities of Slack.`
+    },
+    features: {
+      app_home: {
+        home_tab_enabled: false,
+        messages_tab_enabled: false,
+        messages_tab_read_only_enabled: true
+      },
+      bot_user: {
+        display_name: "Infisical",
+        always_online: true
+      }
+    },
+    oauth_config: {
+      redirect_urls: [`${appCfg.SITE_URL}/api/v1/workflow-integrations/slack/oauth_redirect`],
+      scopes: {
+        bot: ["chat:write.public", "chat:write", "channels:read", "groups:read", "im:read", "mpim:read"]
+      }
+    },
+    settings: {
+      org_deploy_enabled: false,
+      socket_mode_enabled: false,
+      token_rotation_enabled: false
+    }
+  };
+};
+
 export const fetchSlackChannels = async (botKey: string) => {
   const slackChannels: {
     name: string;
@@ -98,3 +142,29 @@ export const triggerSlackNotification = async ({
       .catch((err) => void logger.error(err));
   }
 };
+
+export const getAdminSlackCredentials = async ({
+  adminSlackConfigDAL,
+  kmsService
+}: {
+  adminSlackConfigDAL: Pick<TAdminSlackConfigDALFactory, "findById">;
+  kmsService: Pick<TKmsServiceFactory, "encryptWithRootKey" | "decryptWithRootKey">;
+}) => {
+  const adminSlackConfig = await adminSlackConfigDAL.findById(ADMIN_CONFIG_DB_UUID);
+  let clientId = "";
+  let clientSecret = "";
+  const decrypt = await kmsService.decryptWithRootKey();
+
+  if (adminSlackConfig.encryptedClientId) {
+    clientId = (await decrypt({ cipherTextBlob: adminSlackConfig.encryptedClientId })).toString();
+  }
+
+  if (adminSlackConfig.encryptedClientSecret) {
+    clientSecret = (await decrypt({ cipherTextBlob: adminSlackConfig.encryptedClientSecret })).toString();
+  }
+
+  return {
+    clientId,
+    clientSecret
+  };
+};

backend/src/services/slack/slack-service.ts

@@ -8,7 +8,8 @@ import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { TKmsServiceFactory } from "../kms/kms-service";
 import { KmsDataKey } from "../kms/kms-types";
-import { fetchSlackChannels } from "./slack-fns";
+import { TAdminSlackConfigDALFactory } from "./admin-slack-config-dal";
+import { fetchSlackChannels, getAdminSlackCredentials } from "./slack-fns";
 import { TSlackIntegrationDALFactory } from "./slack-integration-dal";
 import {
   TCompleteSlackIntegrationDTO,
@@ -25,7 +26,8 @@ import {
 type TSlackServiceFactoryDep = {
   slackIntegrationDAL: Pick<TSlackIntegrationDALFactory, "find" | "findById" | "deleteById" | "updateById" | "create">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey" | "encryptWithRootKey" | "decryptWithRootKey">;
+  adminSlackConfigDAL: Pick<TAdminSlackConfigDALFactory, "findById">;
 };
 
 export type TSlackServiceFactory = ReturnType<typeof slackServiceFactory>;
@@ -33,7 +35,8 @@ export type TSlackServiceFactory = ReturnType<typeof slackServiceFactory>;
 export const slackServiceFactory = ({
   permissionService,
   slackIntegrationDAL,
-  kmsService
+  kmsService,
+  adminSlackConfigDAL
 }: TSlackServiceFactoryDep) => {
   const completeSlackIntegration = async ({
     orgId,
@@ -104,16 +107,31 @@ export const slackServiceFactory = ({
 
   const getSlackInstaller = async () => {
     const appCfg = getConfig();
+    const adminSlackCredentials = await getAdminSlackCredentials({
+      kmsService,
+      adminSlackConfigDAL
+    });
 
-    if (!appCfg.SLACK_CLIENT_ID || !appCfg.SLACK_CLIENT_SECRET) {
+    let slackClientId = "";
+    let slackClientSecret = "";
+
+    if (adminSlackCredentials.clientId && adminSlackCredentials.clientSecret) {
+      slackClientId = adminSlackCredentials.clientId;
+      slackClientSecret = adminSlackCredentials.clientSecret;
+    } else {
+      slackClientId = appCfg.SLACK_CLIENT_ID as string;
+      slackClientSecret = appCfg.SLACK_CLIENT_SECRET as string;
+    }
+
+    if (!slackClientId || !slackClientSecret) {
       throw new BadRequestError({
         message: "Invalid slack configuration"
       });
     }
 
     return new InstallProvider({
-      clientId: appCfg.SLACK_CLIENT_ID,
-      clientSecret: appCfg.SLACK_CLIENT_SECRET,
+      clientId: slackClientId,
+      clientSecret: slackClientSecret,
       stateSecret: appCfg.AUTH_SECRET,
       legacyStateVerification: true,
       installationStore: {