@slack/bolt - npm Package Compare versions

Comparing version 3.18.0 to 3.19.0

dist/errors.d.ts

@@ -12,2 +12,3 @@ /// <reference types="node" />
 }
+export declare function isCodedError(err: any): err is CodedError;
 export declare enum ErrorCode {
@@ -14,0 +15,0 @@ AppInitializationError = "slack_bolt_app_initialization_error",

dist/errors.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkflowStepInitializationError = exports.MultipleListenerError = exports.HTTPReceiverDeferredRequestError = exports.ReceiverInconsistentStateError = exports.ReceiverAuthenticityError = exports.ReceiverMultipleAckError = exports.CustomRouteInitializationError = exports.InvalidCustomPropertyError = exports.ContextMissingPropertyError = exports.AuthorizationError = exports.AppInitializationError = exports.asCodedError = exports.UnknownError = exports.ErrorCode = void 0;
+exports.WorkflowStepInitializationError = exports.MultipleListenerError = exports.HTTPReceiverDeferredRequestError = exports.ReceiverInconsistentStateError = exports.ReceiverAuthenticityError = exports.ReceiverMultipleAckError = exports.CustomRouteInitializationError = exports.InvalidCustomPropertyError = exports.ContextMissingPropertyError = exports.AuthorizationError = exports.AppInitializationError = exports.asCodedError = exports.UnknownError = exports.ErrorCode = exports.isCodedError = void 0;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function isCodedError(err) {
+    return 'code' in err;
+}
+exports.isCodedError = isCodedError;
 var ErrorCode;
@@ -5,0 +10,0 @@ (function (ErrorCode) {

dist/middleware/builtin.d.ts

@@ -49,5 +49,14 @@ import { Middleware, AnyMiddlewareArgs, SlackActionMiddlewareArgs, SlackCommandMiddlewareArgs, SlackEventMiddlewareArgs, SlackOptionsMiddlewareArgs, SlackViewMiddlewareArgs, SlackEvent, SlackAction, SlackShortcut, SlashCommand, SlackOptions, EventTypePattern, ViewOutput } from '../types';
 export declare function matchEventType(pattern: EventTypePattern): Middleware<SlackEventMiddlewareArgs>;
+/**
+ * Filters out any event originating from the handling app.
+ */
 export declare function ignoreSelf(): Middleware<AnyMiddlewareArgs>;
+/**
+ * Filters out any message events whose subtype does not match the provided subtype.
+ */
 export declare function subtype(subtype1: string): Middleware<SlackEventMiddlewareArgs<'message'>>;
+/**
+ * Filters out any message event whose text does not start with an @-mention of the handling app.
+ */
 export declare function directMention(): Middleware<SlackEventMiddlewareArgs<'message'>>;
 //# sourceMappingURL=builtin.d.ts.map

dist/middleware/builtin.js

@@ -249,2 +249,7 @@ "use strict";
 exports.matchEventType = matchEventType;
+// TODO: breaking change: why does this method have to be invoked as a function with no args, while other similar
+// method like the `only*` ones do not require that? should make this consistent.
+/**
+ * Filters out any event originating from the handling app.
+ */
 function ignoreSelf() {
@@ -279,2 +284,5 @@ return async (args) => {
 exports.ignoreSelf = ignoreSelf;
+/**
+ * Filters out any message events whose subtype does not match the provided subtype.
+ */
 function subtype(subtype1) {
@@ -289,2 +297,7 @@ return async ({ message, next }) => {
 const slackLink = /<(?<type>[@#!])?(?<link>[^>|]+)(?:\|(?<label>[^>]+))?>/;
+// TODO: breaking change: why does this method have to be invoked as a function with no args, while other similar
+// method like the `only*` ones do not require that? should make this consistent.
+/**
+ * Filters out any message event whose text does not start with an @-mention of the handling app.
+ */
 function directMention() {
@@ -291,0 +304,0 @@ return async ({ message, context, next }) => {

dist/receivers/AwsLambdaReceiver.d.ts

@@ -33,5 +33,37 @@ import { Logger, LogLevel } from '@slack/logger';
 export interface AwsLambdaReceiverOptions {
+    /**
+     * The Slack Signing secret to be used as an input to signature verification to ensure that requests are coming from
+     * Slack.
+     *
+     * If the {@link signatureVerification} flag is set to `false`, this can be set to any value as signature verification
+     * using this secret will not be performed.
+     *
+     * @see {@link https://api.slack.com/authentication/verifying-requests-from-slack#about} for details about signing secrets
+     */
     signingSecret: string;
+    /**
+     * The {@link Logger} for the receiver
+     *
+     * @default ConsoleLogger
+     */
     logger?: Logger;
+    /**
+     * The {@link LogLevel} to be used for the logger.
+     *
+     * @default LogLevel.INFO
+     */
     logLevel?: LogLevel;
+    /**
+     * Flag that determines whether Bolt should {@link https://api.slack.com/authentication/verifying-requests-from-slack|verify Slack's signature on incoming requests}.
+     *
+     * @default true
+     */
+    signatureVerification?: boolean;
+    /**
+     * Optional `function` that can extract custom properties from an incoming receiver event
+     * @param request The API Gateway event {@link AwsEvent}
+     * @returns An object containing custom properties
+     *
+     * @default noop
+     */
     customPropertiesExtractor?: (request: AwsEvent) => StringIndexed;
@@ -43,4 +75,5 @@ }
     private logger;
+    private signatureVerification;
     private customPropertiesExtractor;
-    constructor({ signingSecret, logger, logLevel, customPropertiesExtractor, }: AwsLambdaReceiverOptions);
+    constructor({ signingSecret, logger, logLevel, signatureVerification, customPropertiesExtractor, }: AwsLambdaReceiverOptions);
     init(app: App): void;
@@ -47,0 +80,0 @@ start(..._args: any[]): Promise<AwsHandler>;

dist/receivers/AwsLambdaReceiver.js

@@ -19,5 +19,6 @@ "use strict";
 class AwsLambdaReceiver {
-    constructor({ signingSecret, logger = undefined, logLevel = logger_1.LogLevel.INFO, customPropertiesExtractor = (_) => ({}), }) {
+    constructor({ signingSecret, logger = undefined, logLevel = logger_1.LogLevel.INFO, signatureVerification = true, customPropertiesExtractor = (_) => ({}), }) {
         // Initialize instance variables, substituting defaults for each value
         this.signingSecret = signingSecret;
+        this.signatureVerification = signatureVerification;
         this.logger = logger !== null && logger !== void 0 ? logger : (() => {
@@ -63,8 +64,10 @@ const defaultLogger = new logger_1.ConsoleLogger();
             }
-            // request signature verification
-            const signature = this.getHeaderValue(awsEvent.headers, 'X-Slack-Signature');
-            const ts = Number(this.getHeaderValue(awsEvent.headers, 'X-Slack-Request-Timestamp'));
-            if (!this.isValidRequestSignature(this.signingSecret, rawBody, signature, ts)) {
-                this.logger.info(`Invalid request signature detected (X-Slack-Signature: ${signature}, X-Slack-Request-Timestamp: ${ts})`);
-                return Promise.resolve({ statusCode: 401, body: '' });
+            if (this.signatureVerification) {
+                // request signature verification
+                const signature = this.getHeaderValue(awsEvent.headers, 'X-Slack-Signature');
+                const ts = Number(this.getHeaderValue(awsEvent.headers, 'X-Slack-Request-Timestamp'));
+                if (!this.isValidRequestSignature(this.signingSecret, rawBody, signature, ts)) {
+                    this.logger.info(`Invalid request signature detected (X-Slack-Signature: ${signature}, X-Slack-Request-Timestamp: ${ts})`);
+                    return Promise.resolve({ statusCode: 401, body: '' });
+                }
             }
@@ -71,0 +74,0 @@ // url_verification (Events API)

dist/receivers/ExpressReceiver.js

@@ -349,9 +349,11 @@ "use strict";
                     logError(logger, 'Request verification failed', error);
-                    return res.status(401).send();
+                    res.status(401).send();
+                    return;
                 }
                 logError(logger, 'Parsing request body failed', error);
-                return res.status(400).send();
+                res.status(400).send();
+                return;
             }
         }
-        return next();
+        next();
     };
@@ -418,6 +420,7 @@ }
                 logError(logger, 'Parsing request body failed', error);
-                return res.status(400).send();
+                res.status(400).send();
+                return;
             }
         }
-        return next();
+        next();
     };
@@ -424,0 +427,0 @@ }

dist/types/actions/block-action.d.ts

@@ -26,3 +26,3 @@ import { PlainTextElement, Confirmation, Option, RichTextBlock } from '@slack/types';
 export interface ButtonAction extends BasicElementAction<'button'> {
-    value: string;
+    value?: string;
     text: PlainTextElement;
@@ -29,0 +29,0 @@ url?: string;

package.json

 {
   "name": "@slack/bolt",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "description": "A framework for building Slack apps, fast.",
@@ -62,3 +62,3 @@ "author": "Slack Technologies, LLC",
     "@types/mocha": "^10.0.1",
-    "@types/node": "20.12.7",
+    "@types/node": "20.14.2",
     "@types/sinon": "^7.0.11",
@@ -65,0 +65,0 @@ "@typescript-eslint/eslint-plugin": "^4.4.1",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

527169

increased by0.6%

Lines of code

7534

increased by0.9%

No dependency changes