Skip to content

fix(slack): guard invalid timestamp tolerance config - #875

Open
aiirvizionz wants to merge 1 commit into
profullstack:masterfrom
aiirvizionz:clientkit/slack-session-env-guard
Open

fix(slack): guard invalid timestamp tolerance config#875
aiirvizionz wants to merge 1 commit into
profullstack:masterfrom
aiirvizionz:clientkit/slack-session-env-guard

Conversation

@aiirvizionz

Copy link
Copy Markdown
Contributor

Summary

  • Keep Slack request timestamp validation active when timestampToleranceSeconds receives invalid numeric values.
  • Preserve the explicit 0 escape hatch for disabling timestamp checks, while falling back to the default 300 seconds for NaN, negative, or otherwise invalid values.
  • Add a regression test that sends a stale but correctly signed Slack Events request with Number.NaN config and expects rejection.

Validation

  • git diff --check

I attempted pnpm vitest run packages/bots/slack/src/index.test.ts and pnpm --filter @profullstack/sh1pt-bot-slack typecheck, but this checkout stops during dependency preparation because the committed lockfile fails the active supply-chain policy: @profullstack/autoblog@0.4.0 has no tarball integrity field. I did not modify the lockfile; the regression test is included for maintainers' normal CI/runtime.

Copilot AI review requested due to automatic review settings July 29, 2026 04:36

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants