feat: Slack integration — OAuth install, alert delivery, and MCP-backed Slack agent

[JeremyFunk]

Summary

Full Slack ↔ Maple integration across three areas, built on the eve-based Slack agent introduced earlier on this branch:

Backend (packages/db, packages/domain, apps/api)

• New slack_workspaces table: team_id → orgId binding with AES-256-GCM-encrypted bot token and an auto-minted org-scoped mcp-kind API key (secret stored encrypted so it can be handed to the bot). Partial unique index enforces one active workspace per org; installs transactionally revoke/replace prior same-org workspaces, and a guarded upsert closes the concurrent cross-org install race.
• Dashboard-initiated OAuth v2 install: POST /v2/integrations/slack/install (admin) → single-use, TTL-bound state → GET /oauth/slack/callback exchanges the code, mints the key, and redirects back to /integrations?integration=slack.
• GET/DELETE /v2/integrations/slack (status/uninstall — uninstall revokes both the row and the minted API key) and GET /v2/integrations/slack/channels (conversations.list proxy for the channel picker).
• Internal bot resolve endpoint GET /internal/slack/workspaces/:teamId guarded by the constant-time maple_svc_ bearer; returns {orgId, teamId, teamName, botToken, mapleApiKey}.
• New slack-bot alert destination type: posts Block Kit via chat.postMessage using the installed workspace token + configured channel; works with the existing POST /v2/alerts/destinations/:id/test.

Slack agent (apps/slack-agent)

• Multi-workspace: custom webhookVerifier owns Slack v0 signature verification and extracts team_id; per-team bot token resolved through a cached credentials client against the internal endpoint (SLACK_BOT_TOKEN remains a single-workspace dev fallback).
• Read path: eve MCP client connection to Maple's /mcp with a per-session auth resolver that selects the installing org's API key from the session's team_id — the bot gets the same tool set as the in-dashboard chat agent (listServices, searchTraces, findErrors, diagnoseService, …).
• Maple-domain instructions; README documents the manifest scopes, OAuth redirect, and the build-time MAPLE_API_BASE_URL baking footgun.

Web (apps/web)

• Slack card on the integrations page: Add to Slack → OAuth → success/error toast, workspace status, admin-gated disconnect.
• slack-bot destination in notification settings with searchable channel picker (public/private, invite-the-bot hint), only offered when the integration is installed.

Security review

An adversarial review of the OAuth flow, internal endpoint, crypto, and tenant isolation found no critical issues; its one real finding (ambiguous multi-workspace rows per org) is fixed as described above. Known accepted limitations, documented in the bot README: bot-side positive credential cache means uninstall takes up to ~5 min to fully propagate (MCP access dies immediately since the key is revoked), and concurrent events from different workspaces can make an outbound reply resolve the wrong team's token — which fails closed (Slack rejects the post).

Deployment notes

• New api env: SLACK_CLIENT_ID / SLACK_CLIENT_SECRET (wired in alchemy.run.ts).
• Railway bot env: MAPLE_API_BASE_URL (required at build time), MAPLE_INTERNAL_SERVICE_TOKEN.
• Slack app manifest: add redirect URL https://<api-host>/oauth/slack/callback, broaden bot scopes (see apps/slack-agent/README.md), enable public distribution.
• Migration 0017_fair_mandarin (slack_workspaces).

Testing

• Full repo typecheck green (30/30 turbo tasks).
• apps/api suite: 965+ passing incl. 12 new SlackIntegrationService PGlite tests (state handling, install/replace/revoke, resolve, dispatch token) and 16 AlertDeliveryDispatch tests incl. slack-bot arms.
• apps/web: destination-builder unit tests for slack-bot create/update params; suite green apart from the two known pre-existing localStorage jsdom failures.
• Bot: eve build + typecheck green; signature-verification/team-parsing/token-bridging verified by a 14-check standalone harness.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[pullfrog]

Your Pullfrog Router balance is exhausted.

You have a card on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.

Top up balance → · Enable auto-reload →

  ^{｜ ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot ｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[github-actions]

Ingest Rust Test + Benchmark Results

Commit: aec5c5661e65561067a03b3bb2c00dbda336940c

Load Benchmark — tinybird mode, median of 3 run(s) vs main

Metric	main (median)	PR (median)	Delta
Requests/sec	8947.94	7209.52	-19.4% worse
Rows/sec	89479.43	72095.24	-19.4% worse
p50 latency	6.88 ms	8.40 ms	+22.2% worse
p95 latency	13.46 ms	16.95 ms	+25.9% worse
p99 latency	16.68 ms	23.58 ms	+41.3% worse
Export catch-up	0.026 s	0.026 s	-2.9% better
Max RSS	15.43 MiB	14.72 MiB	-4.6% better
Failures	0	0	same

Same code path on both sides (same LOAD_TEST_INGEST_MODE), so the delta column is meaningful. Numbers come from ubuntu-latest, which is noisy — treat single-digit-percent deltas as noise.

PR load benchmark JSON (per-iteration)

[
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 16,
    "duration_seconds": 0.319051388,
    "export_catchup_seconds": 0.025543014,
    "request_rps": 6268.582664808843,
    "row_rps": 62685.82664808843,
    "p50_ms": 9.478,
    "p95_ms": 18.346,
    "p99_ms": 24.032,
    "max_rss_mb": 14.72265625,
    "max_cpu_percent": 33.3,
    "avg_cpu_percent": 33.3
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 14,
    "duration_seconds": 0.277410812,
    "export_catchup_seconds": 0.025682633,
    "request_rps": 7209.524335338451,
    "row_rps": 72095.2433533845,
    "p50_ms": 8.4,
    "p95_ms": 16.954,
    "p99_ms": 23.579,
    "max_rss_mb": 14.6953125,
    "max_cpu_percent": 25.0,
    "avg_cpu_percent": 25.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 14,
    "duration_seconds": 0.25751913,
    "export_catchup_seconds": 0.025710336,
    "request_rps": 7766.413314614724,
    "row_rps": 77664.13314614724,
    "p50_ms": 7.901,
    "p95_ms": 15.226,
    "p99_ms": 17.426,
    "max_rss_mb": 17.16015625,
    "max_cpu_percent": 33.3,
    "avg_cpu_percent": 33.3
  }
]

main load benchmark JSON (per-iteration)

[
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 12,
    "duration_seconds": 0.223771137,
    "export_catchup_seconds": 0.026449117,
    "request_rps": 8937.70316767886,
    "row_rps": 89377.0316767886,
    "p50_ms": 6.969,
    "p95_ms": 13.594,
    "p99_ms": 18.597,
    "max_rss_mb": 16.48046875,
    "max_cpu_percent": 20.0,
    "avg_cpu_percent": 20.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 12,
    "duration_seconds": 0.223515064,
    "export_catchup_seconds": 0.026566769,
    "request_rps": 8947.94276595156,
    "row_rps": 89479.4276595156,
    "p50_ms": 6.875,
    "p95_ms": 13.464,
    "p99_ms": 15.603,
    "max_rss_mb": 14.6484375,
    "max_cpu_percent": 16.6,
    "avg_cpu_percent": 16.6
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 12,
    "duration_seconds": 0.223079903,
    "export_catchup_seconds": 0.026074611,
    "request_rps": 8965.397479126572,
    "row_rps": 89653.97479126572,
    "p50_ms": 6.689,
    "p95_ms": 13.246,
    "p99_ms": 16.682,
    "max_rss_mb": 15.4296875,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  }
]

WAL-acked microbench (cargo bench --bench ingest_bench)

   Compiling maple-ingest v0.1.0 (/home/runner/_work/maple/maple/apps/ingest)
    Finished `bench` profile [optimized] target(s) in 24.83s
     Running benches/ingest_bench.rs (target/release/deps/ingest_bench-f6ec3881b8bd23cb)
Gnuplot not found, using plotters backend
test ingest_accept/logs_10_rows_wal_ack ... bench:      149765 ns/iter (+/- 12518)
test ingest_accept/traces_10_spans_wal_ack ... bench:      151349 ns/iter (+/- 30285)

cargo test

test usage_metrics::tests::each_interval_exports_only_its_own_increment ... ok
test usage_metrics::tests::records_bytes_and_items_per_org_and_signal ... ok
test telemetry::tests::wal_truncates_after_full_drain_allowing_further_appends ... ok
test usage_metrics::tests::cardinality_view_admits_more_orgs_than_the_sdk_default ... ok
test telemetry::tests::pipeline_exports_ready_org_to_clickhouse_without_tinybird_calls ... ok
test telemetry::tests::slow_clickhouse_lane_does_not_block_cosharded_tinybird_org ... ok
test telemetry::tests::clickhouse_breaker_sheds_after_threshold_failures ... ok

test result: ok. 66 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.76s

     Running unittests src/bin/load_test.rs (target/debug/deps/load_test-3a24fd5dee8f57f0)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/main.rs (target/debug/deps/maple_ingest-b89fa52019d5d48f)

running 53 tests
test autumn::tests::flat_overage_allows ... ok
test autumn::tests::allowed_only_no_balance_field ... ok
test autumn::tests::flat_hardcap_with_remaining_allows ... ok
test autumn::tests::flat_sub_one_gb_remaining_still_allows ... ok
test autumn::tests::flat_hardcap_depleted_blocks ... ok
test autumn::tests::flat_unlimited_allows ... ok
test autumn::tests::nested_balance_object_depleted_blocks ... ok
test autumn::tests::nested_balance_object_with_remaining_allows ... ok
test autumn::tests::nested_overage_allows ... ok
test autumn::tests::null_balance_no_subscription_blocks ... ok
test tests::api_error_from_pipeline_maps_variants_to_status ... ok
test tests::api_error_kind_maps_status_to_stable_label ... ok
test tests::caller_fault_rejections_do_not_mark_the_span_error ... ok
test autumn::tests::unrecognized_shape_returns_none ... ok
test tests::clickhouse_destination_is_terminal_in_dual_mode ... ok
test tests::clickhouse_destination_uses_native_pipeline_even_in_forward_mode ... ok
test tests::cloudflare_ndjson_payload_parses_multiple_records ... ok
test tests::cloudflare_log_record_maps_body_severity_and_attributes ... ok
test tests::cloudflare_timestamps_support_rfc3339_unix_and_unix_nano ... ok
test tests::clickhouse_target_resolver_requires_current_schema ... ok
test tests::cloudflare_validation_payload_is_detected ... ok
test tests::clickhouse_target_resolver_rejects_password_over_http ... ok
test tests::clickhouse_target_resolver_decrypts_current_schema_password ... ok
test tests::data_loss_rejections_mark_the_span_error_even_at_4xx ... ok
test tests::decrypt_aes256_gcm_matches_node_crypto_fixture ... ok
test tests::data_loss_labels_match_the_kinds_the_gateway_emits ... ok
test tests::empty_export_request_is_accepted ... ok
test tests::enrichment_overwrites_tenant_fields ... ok
test tests::extract_ingest_key_returns_sentinel_literal_unchanged ... ok
test tests::enrichment_applies_to_a_payload_with_no_resource ... ok
test tests::hash_is_deterministic ... ok
test tests::malformed_payload_is_rejected_with_the_parser_reason ... ok
test tests::lenient_log_payload_is_accepted ... ok
test tests::numeric_nanos_no_longer_silently_empty_a_metric ... ok
test tests::pipeline_error_fault_split_matches_http_status ... ok
test tests::rejection_reason_is_bounded ... ok
test tests::replay_budget_disabled_when_limit_is_zero ... ok
test tests::replay_budget_truncates_session_at_its_ceiling ... ok
test tests::replay_budget_scopes_totals_per_session_and_org ... ok
test tests::resolve_ingest_key_keeps_stale_schema_on_managed_native_path ... ok
test tests::resolve_ingest_key_returns_none_when_hash_missing ... ok
test tests::resolve_ingest_key_returns_self_managed_false_when_no_settings_row ... ok
test tests::resolve_ingest_key_returns_self_managed_true_when_active_settings_row ... ok
test tests::resolve_connector_refreshes_routing_before_auth_cache_expires ... ok
test tests::resolve_ingest_key_refreshes_routing_before_auth_cache_expires ... ok
test tests::sentinel_token_matches_only_exact_literal ... ok
test tests::server_faults_stay_error ... ok
test tests::tinybird_destination_keeps_forward_mode_on_forward_path ... ok
test tests::spec_compliant_payloads_still_decode ... ok
test tests::resolve_ingest_key_serves_last_known_routing_when_refresh_fails ... ok
test autumn::tests::fails_open_on_transport_error ... ok
test tests::native_request_emits_a_span_per_pipeline_stage ... ok
test tests::forward_mode_switches_ready_org_to_clickhouse_without_forwarding_again ... ok

test result: ok. 53 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.20s

   Doc-tests maple_ingest

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

[github-actions]

🍁 Maple PR preview

Note

Preview resources were removed when this pull request closed.

Final commit c2a7a26 · View workflow run