agent: @U0AJM7X8FBR API - we want to expand our current slack integration to in#289
agent: @U0AJM7X8FBR API - we want to expand our current slack integration to in#289sweetmantech wants to merge 1 commit intotestfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThese changes extend the coding-agent platform integration to support WhatsApp alongside existing Slack and GitHub adapters. A new GET endpoint initializes the bot, the POST flow incorporates Slack verification, the adapter infrastructure is expanded with WhatsApp, and required environment variables are added for WhatsApp configuration. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ❌ 1❌ Failed checks (1 warning)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan for PR comments
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
app/api/coding-agent/[platform]/route.ts (1)
49-55:⚠️ Potential issue | 🔴 CriticalVerify the Slack signature before responding to
url_verificationchallenges.The early return at lines 51–56 accepts any JSON request with
type === "url_verification"without validating theX-Slack-SignatureandX-Slack-Request-Timestampheaders. Per Slack's protocol, signature verification is required for all inbound requests, including the initial challenge handshake. Compute the HMAC-SHA256 of the base stringv0:{timestamp}:{raw_body}using your signing secret and validate it matches the request signature header before echoing the challenge.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@app/api/coding-agent/`[platform]/route.ts around lines 49 - 55, The current early-return for Slack url_verification must verify the Slack signature first: before returning the challenge in the platform === "slack" branch, read the raw request body (use request.clone().text() not parsed JSON), extract X-Slack-Signature and X-Slack-Request-Timestamp headers, build the base string `v0:{timestamp}:{raw_body}`, compute the HMAC-SHA256 using the Slack signing secret, prefix with `v0=` and compare using a timing-safe equality to the incoming signature, and only echo `body.challenge` when the signature and timestamp are present and valid; otherwise reject/return an error response and do not short-circuit the normal adapter initialization (refer to the platform check and the request.clone() usage to locate where to add this).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@app/api/coding-agent/`[platform]/route.ts:
- Around line 6-31: Add unit/integration tests for the new GET route handler to
cover all branches: call the exported GET function (or exercising the route) and
assert (1) successful verification flow when a valid platform-specific challenge
is provided (mock codingAgentBot.initialize and the platform handler in
codingAgentBot.webhooks to return a valid Response), (2) unknown platform
returns 404 when codingAgentBot.webhooks lacks the key, (3) invalid/malformed
challenge payloads produce the expected error response (mock the platform
handler to simulate invalid payload handling), and (4) normal webhook delegation
forwards the request to the platform handler and respects waitUntil behavior
(mock handler to capture the passed request and promise). Mock
codingAgentBot.initialize and codingAgentBot.webhooks entries and assert
responses and side effects for each case.
- Around line 16-30: Validate and parse the incoming platform param first (use a
Zod validate function) and early-return 404 for unknown platforms before
touching the module-scoped bot; then lazily create/initialize the bot and
resolve the handler. Concretely: in GET (and similarly in POST), run Zod
validation on params to extract platform, check
codingAgentBot.webhooks[platform] for a handler and return 404 if missing, and
only after selecting a valid handler call a lazy factory or function to
obtain/initialize the bot (instead of relying on the module-scoped
codingAgentBot created at import) and finally invoke handler(request, {
waitUntil: p => after(() => p) }). Ensure you update both occurrences (lines
matching GET and the POST handler region) to follow this pattern.
---
Outside diff comments:
In `@app/api/coding-agent/`[platform]/route.ts:
- Around line 49-55: The current early-return for Slack url_verification must
verify the Slack signature first: before returning the challenge in the platform
=== "slack" branch, read the raw request body (use request.clone().text() not
parsed JSON), extract X-Slack-Signature and X-Slack-Request-Timestamp headers,
build the base string `v0:{timestamp}:{raw_body}`, compute the HMAC-SHA256 using
the Slack signing secret, prefix with `v0=` and compare using a timing-safe
equality to the incoming signature, and only echo `body.challenge` when the
signature and timestamp are present and valid; otherwise reject/return an error
response and do not short-circuit the normal adapter initialization (refer to
the platform check and the request.clone() usage to locate where to add this).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 76e76f4c-b543-4e3d-bc29-7e46a0a13ab4
⛔ Files ignored due to path filters (2)
README.mdis excluded by none and included by noneapp/api/coding-agent/__tests__/route.test.tsis excluded by!**/*.test.*,!**/__tests__/**and included byapp/**
📒 Files selected for processing (3)
app/api/coding-agent/[platform]/route.tslib/coding-agent/bot.tslib/coding-agent/validateEnv.ts
| /** | ||
| * GET /api/coding-agent/[platform] | ||
| * | ||
| * Handles webhook verification handshakes for platforms that use GET-based challenges. | ||
| * Currently handles WhatsApp's hub.challenge verification. | ||
| * | ||
| * @param request - The incoming webhook verification request | ||
| * @param params.params | ||
| * @param params - Route params containing the platform name | ||
| */ | ||
| export async function GET( | ||
| request: NextRequest, | ||
| { params }: { params: Promise<{ platform: string }> }, | ||
| ) { | ||
| const { platform } = await params; | ||
|
|
||
| await codingAgentBot.initialize(); | ||
|
|
||
| const handler = codingAgentBot.webhooks[platform as keyof typeof codingAgentBot.webhooks]; | ||
|
|
||
| if (!handler) { | ||
| return new Response("Unknown platform", { status: 404 }); | ||
| } | ||
|
|
||
| return handler(request, { waitUntil: p => after(() => p) }); | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
Please add route coverage for the new verification branches.
The new GET handler and Slack challenge shortcut add several contracts that can regress quietly: verification success, unknown platform handling, invalid challenge payloads, and normal webhook delegation. I don't see matching tests in this PR.
Based on learnings "Write tests for new API endpoints covering all success and error paths".
Also applies to: 33-67
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@app/api/coding-agent/`[platform]/route.ts around lines 6 - 31, Add
unit/integration tests for the new GET route handler to cover all branches: call
the exported GET function (or exercising the route) and assert (1) successful
verification flow when a valid platform-specific challenge is provided (mock
codingAgentBot.initialize and the platform handler in codingAgentBot.webhooks to
return a valid Response), (2) unknown platform returns 404 when
codingAgentBot.webhooks lacks the key, (3) invalid/malformed challenge payloads
produce the expected error response (mock the platform handler to simulate
invalid payload handling), and (4) normal webhook delegation forwards the
request to the platform handler and respects waitUntil behavior (mock handler to
capture the passed request and promise). Mock codingAgentBot.initialize and
codingAgentBot.webhooks entries and assert responses and side effects for each
case.
| export async function GET( | ||
| request: NextRequest, | ||
| { params }: { params: Promise<{ platform: string }> }, | ||
| ) { | ||
| const { platform } = await params; | ||
|
|
||
| await codingAgentBot.initialize(); | ||
|
|
||
| const handler = codingAgentBot.webhooks[platform as keyof typeof codingAgentBot.webhooks]; | ||
|
|
||
| if (!handler) { | ||
| return new Response("Unknown platform", { status: 404 }); | ||
| } | ||
|
|
||
| return handler(request, { waitUntil: p => after(() => p) }); |
There was a problem hiding this comment.
The verification fast-path is ineffective while the bot stays module-scoped.
codingAgentBot is instantiated during module import in lib/coding-agent/bot.ts:66, so these handlers still validate env and touch Redis before GET or POST runs. That makes unknown-platform requests and Slack/WhatsApp verification depend on unrelated startup state, which can turn a simple 404/challenge response into a 500 or timeout. Validate platform first, then lazily create and initialize the bot only after a real handler has been selected.
As per coding guidelines "All API endpoints should use a validate function for input parsing using Zod for schema validation".
Also applies to: 43-58
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@app/api/coding-agent/`[platform]/route.ts around lines 16 - 30, Validate and
parse the incoming platform param first (use a Zod validate function) and
early-return 404 for unknown platforms before touching the module-scoped bot;
then lazily create/initialize the bot and resolve the handler. Concretely: in
GET (and similarly in POST), run Zod validation on params to extract platform,
check codingAgentBot.webhooks[platform] for a handler and return 404 if missing,
and only after selecting a valid handler call a lazy factory or function to
obtain/initialize the bot (instead of relying on the module-scoped
codingAgentBot created at import) and finally invoke handler(request, {
waitUntil: p => after(() => p) }). Ensure you update both occurrences (lines
matching GET and the POST handler region) to follow this pattern.
1 participant
Automated PR from coding agent.
Summary by CodeRabbit