Serve a landing page and a Slack-sign-in-gated configuration page - #13
Merged
Conversation
mod.redhawkrobotics.org now shows a person something: a landing page at / with the enrollment link, and /config, the web equivalent of /hawkmod config. Sign-in is OpenID Connect against the same Slack app — identity only, no scopes, no stored token — and authority is the same question every entry point asks, answered by administrator() on every request, so the cookie only says who is asking. Setting validation moves to slack/settingsAdmin.ts, shared by the slash command and the web page: one implementation, so a value one door refuses cannot be slipped in through the other. Sessions and OAuth state are stateless HMAC tokens signed with SLACK_STATE_SECRET, purpose-bound so a captured state parameter can never pass as a session cookie. The manifest gains a second redirect URL (/auth/slack/callback), which has to be registered in the Slack app config before sign-in works. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
mod.redhawkrobotics.org (handled by hawk_suite's proxy;
PUBLIC_URLpoints at it) now serves:/— a landing page: what Hawk Mod is, the enrollment link for mentors, and a link to the configuration page for admins. Same visual language as the existing enrollment pages./config— the web equivalent of/hawkmod config: every setting with its value and where it came from (Slack / env seed / unset), and a form to change each one. Changes are validated against Slack before storing, recorded insetting_changesunder the signed-in admin's name, and a role-group change re-syncs the roster immediately.Access control
administrator()— workspace Owners and Admins, re-checked on every/configrequest. The cookie only says who; losing Slack admin locks the page within a minute.SLACK_STATE_SECRET, purpose-bound so a captured state parameter can never replay as a session cookie. Cookie isHttpOnly; SameSite=Lax; Secure, 8-hour lifetime, with an Origin check on POST.esc()— setting values and display names are whatever their owner typed.How
commands.tsintosrc/slack/settingsAdmin.ts, shared by the slash command and the web page — one implementation, so a value one door refuses cannot be slipped in through the other.src/web/{session,pages,routes}.ts; routes ride Bolt'scustomRoutes, no new dependencies.test/webSession.test.tscovers token round-trip, tampering, expiry, wrong secret, and purpose confusion.Deployment note
The Slack app config needs the second redirect URL registered before sign-in works:
https://mod.redhawkrobotics.org/auth/slack/callback(manifest updated).docs/deploy.mddocuments the pages and this requirement.npm run typecheck && npm test && npm run format:check && npm run buildall pass (112 tests).🤖 Generated with Claude Code