
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
botbuilder-glip
Advanced tools
[](https://www.npmjs.com/package/botbuilder-glip)
Microsoft Bot Framework connector for RingCentral Glip
npm install botbuilder-glip
const builder = require('botbuilder')
const restify = require('restify')
const dotenv = require('dotenv')
const fs = require('fs')
const path = require('path')
const { GlipConnector } = require('botbuilder-glip')
dotenv.config()
let botsData = {}
const botsDataFile = path.join(__dirname, '.cache')
if (fs.existsSync(botsDataFile)) {
botsData = JSON.parse(fs.readFileSync(botsDataFile, 'utf-8'))
}
const server = restify.createServer()
server.use(restify.plugins.queryParser())
server.use(restify.plugins.bodyParser())
server.listen(process.env.port || process.env.PORT || 3978, function () {
console.log('%s listening to %s', server.name, server.url)
})
const connector = new GlipConnector({
botLookup: (botId) => {
const botEntry = botsData[botId]
return botEntry
},
verificationToken: process.env.GLIP_BOT_VERIFICATION_TOKEN,
clientId: process.env.GLIP_CLIENT_ID,
clientSecret: process.env.GLIP_CLIENT_SECRET,
server: process.env.GLIP_API_SERVER,
redirectUrl: `${process.env.GLIP_BOT_SERVER}/oauth`,
webhookUrl: `${process.env.GLIP_BOT_SERVER}/webhook`
})
// For public glip bot
server.get('/oauth', connector.listenOAuth())
//For private glip bot
server.post('/oauth', connector.listenOAuth())
server.post('/webhook', connector.listen())
const bot = new builder.UniversalBot(connector)
bot.on('installationUpdate', (event) => {
console.log(`New bot installed: ${event.sourceEvent.TokenData.owner_name}`)
botsData[event.sourceEvent.TokenData.owner_id] = {
identity: event.address.bot,
token: event.sourceEvent.TokenData
}
fs.writeFileSync(botsDataFile, JSON.stringify(botsData)) // save token
})
bot.dialog('/', function (session) {
console.log('Get message from glip:', session.message)
session.send({
text: `You said: ${session.message.text}`,
attachments: [{
type: 'Card',
fallback: 'Text',
text: session.message.text,
}]
})
session.send("You said: %s", session.message.text)
});
There are two ways to create Webhook subscription:
If you enable Bot Webhook in RingCentral Developer website, it will create webhook subscription to your webhook URI when you add a bot.
The GlipConnector will create Webhook subscription after authrization. So it is recommended to disable the Bot Webhook setting in RingCentral Developer website, or you will have two webhook subscription.
If you want to enable the Bot Webhook setting in RingCentral Developer website, you can disable the bot to create subscription:
const connector = new GlipConnector({
botLookup: (botId) => {
const botEntry = botsData[botId]
return botEntry
},
verificationToken: process.env.GLIP_BOT_VERIFICATION_TOKEN,
clientId: process.env.GLIP_CLIENT_ID,
clientSecret: process.env.GLIP_CLIENT_SECRET,
server: process.env.GLIP_API_SERVER,
redirectUrl: `${process.env.GLIP_BOT_SERVER}/oauth`,
webhookUrl: `${process.env.GLIP_BOT_SERVER}/webhook`,
disableSubscribe: true
})
And you also need to keep verificationToken same as Verification Token in Bot Webhooks setting page. We use verificationToken to validate webhook request.
FAQs
[](https://www.npmjs.com/package/botbuilder-glip)
We found that botbuilder-glip demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.