fix: verify Slack signature for url_verification and check handler early

SW
7mo ago
+485-112

Summary

Addresses PR #289 code review feedback:

  • Slack signature verification: Before echoing a url_verification challenge, the handler now reads the raw body, computes HMAC-SHA256 using SLACK_SIGNING_SECRET, and performs a timing-safe comparison against the x-slack-signature header. Requests with invalid/missing signatures or stale timestamps (>5 min) receive a 401 response.
  • Early platform check: The webhook handler is now resolved before calling codingAgentBot.initialize(), so unknown platforms get a 404 immediately without touching the bot/Redis.
  • GET handler tests: Added tests covering successful delegation, 404 for unknown platforms, and no-initialize behavior.

Test plan

  • pnpm test app/api/coding-agent/__tests__/route.test.ts — all 11 tests pass
  • pnpm lint:check — no errors in changed files

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features

    • Added WhatsApp support alongside Slack and GitHub.
    • Webhook endpoint now supports platform-specific routing and a GET handler for platform probes.

  • Improvements

    • Slack webhook signature verification and URL verification challenge handling added.
    • Bot initialization now deferred until platform and signature checks pass.
    • Thread identifiers made platform-agnostic.
    • Environment validation now checks WhatsApp variables as a group.

  • Bug Fixes

    • Improved error handling for task fetching with clearer fallback messages.