Repository navigation
feat(slack): Require Google sign-in before first Slack use - #2220
Draft
sentry-junior[bot] wants to merge 3 commits into
Draft
sentry-junior[bot] wants to merge 3 commits into
sentry-junior[bot] wants to merge 3 commits into
Conversation
Add the experimental slack-sign-in feature. When it is on, Slack mentions and DMs from a user who has not signed in are dropped, and the user gets a private link to the dashboard sign-in page. The page marks Slack identities already linked to the Google user through a verified email as signed in. Refs #2219 Co-Authored-By: David Cramer <david@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Slack sign-in now runs its own Google OAuth flow at /api/sign-in/callback, like plugin OAuth callbacks, so it does not need the dashboard. The state binds one Slack identity. The callback checks the dashboard allowlist and the Slack email before it marks that identity as signed in. Refs #2219 Co-Authored-By: David Cramer <david@sentry.io>
sentry-junior
Bot
changed the title
Drop the signed_in_at column and migration. Sign-in now links a verified Google identity to the user of the Slack identity that started it. Slack ingress checks that the Slack identity's user has that Google identity, so other features can reuse it. Refs #2219 Co-Authored-By: David Cramer <david@sentry.io>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proof of concept for #2219. This adds an experimental
slack-sign-infeature. With it on, Junior replies to a Slack user's mentions or DMs only when that Slack identity's user has a linked, verified Google identity. The dashboard is not required, and there is no new table or column: the Google identity is a normaljunior_identitiesrow that other features can reuse.How it works:
googleidentity, Junior drops the message. Ingress saves the Slack identity with its Slack profile email, stores one sign-in state for that identity (PKCE, 10 minute TTL), and privately sends the user a Google consent link./api/sign-in/callback, a core route like the plugin OAuth callbacks. It exchanges the code and reads the verified email andsubfrom the ID token. Then it checks the email against the dashboard allowlist (dashboard.allowedGoogleDomains/allowedEmails, elseJUNIOR_DASHBOARD_GOOGLE_DOMAINS/JUNIOR_DASHBOARD_ALLOWED_EMAILS).provider: "google", subjectsub) only when the Slack identity in the state already belongs to the user with that Google email. A forwarded link cannot give another person's Slack account access.GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET. The Google OAuth client needs<base-url>/api/sign-in/callbackas an authorized redirect URI.createAppthrows if the feature is on with an empty allowlist.Open questions for a real version:
googleidentity on the user. A plugin that links user OAuth accounts under thegoogleprovider name would also satisfy it, so the sign-in provider name may need to be reserved.passive-routing), slash commands, and Slack actions are not checked.via David Cramer.
--
View Junior Session [Sentry]