Function verifySlackRequest

server/src/slack/verify.ts:63–99

(req: Request, res: Response, next: NextFunction)

 * before this middleware to preserve the raw body.
 */
export function verifySlackRequest(req: Request, res: Response, next: NextFunction): void {
  if (!SLACK_SIGNING_SECRET) {
    logger.warn('SLACK_SIGNING_SECRET not configured, skipping verification');
    next();
    return;
  }

  const signature = req.headers['x-slack-signature'] as string;
  const timestamp = req.headers['x-slack-request-timestamp'] as string;

  if (!signature || !timestamp) {
    logger.warn('Missing Slack signature headers');
    res.status(401).json({ error: 'Missing signature headers' });
    return;
  }

  // Get raw body - express.json() parses it, so we need to reconstruct
  // For URL-encoded forms (slash commands), we need the raw body
  const rawBody = typeof req.body === 'string'
    ? req.body
    : JSON.stringify(req.body);

  const isValid = verifySlackSignature(
    SLACK_SIGNING_SECRET,
    signature,
    timestamp,
    rawBody
  );

  if (!isValid) {
    logger.warn('Invalid Slack signature');
    res.status(401).json({ error: 'Invalid signature' });
    return;
  }

  next();
}

/**
 * Check if Slack signing secret is configured