Function createSlackSignatureVerifier

server/src/middleware/slack.ts:43–85

(
  signingSecret: string | undefined,
  appName: string = 'Slack'
)

 * @returns Express middleware that verifies signatures
 */
export function createSlackSignatureVerifier(
  signingSecret: string | undefined,
  appName: string = 'Slack'
): RequestHandler {
  return (req: Request, res: Response, next: NextFunction): void => {
    if (!signingSecret) {
      logger.warn(`${appName}: Signing secret not configured, skipping verification`);
      next();
      return;
    }

    const signature = req.headers['x-slack-signature'] as string;
    const timestamp = req.headers['x-slack-request-timestamp'] as string;

    if (!signature || !timestamp) {
      logger.warn(`${appName}: Missing signature headers`);
      res.status(401).json({ error: 'Missing signature headers' });
      return;
    }

    const rawBody = (req as any).rawBody;
    if (!rawBody) {
      logger.warn(`${appName}: Raw body not captured for signature verification`);
      res.status(500).json({ error: 'Internal error' });
      return;
    }

    const isValid = verifySlackSignature(
      signingSecret,
      signature,
      timestamp,
      rawBody
    );

    if (!isValid) {
      logger.warn(`${appName}: Invalid signature`);
      res.status(401).json({ error: 'Invalid signature' });
      return;
    }

    next();
  };
}

/**
 * Middleware to handle Slack URL verification challenge