remove sig validation after discovering slack doesn't sign oauth reqs

Keeping signature checking logic in `Slack.has_valid_signature` for
future use

Author: yasunariw

lib/action.ml

@@ -233,15 +233,12 @@ module Action (Github_api : Api.Github) (Slack_api : Api.Slack) = struct
       log#error "%s" msg;
       Lwt.return_unit
 
-  let process_slack_oauth (ctx : Context.t) args headers body =
+  let process_slack_oauth (ctx : Context.t) args =
     try%lwt
       let secrets = Context.get_secrets_exn ctx in
       match secrets.slack_access_token with
       | Some _ -> Lwt.return_unit
       | None ->
-      match Slack.has_valid_signature ?signing_key:secrets.slack_signing_secret ~headers body with
-      | false -> action_error "failed to verify signature of slack authorization request"
-      | true ->
       match Slack.has_valid_state ?oauth_state:secrets.slack_oauth_state ~args with
       | false -> action_error "expected state not found in slack authorization request"
       | true ->

src/request_handler.ml

@@ -40,7 +40,7 @@ let setup_http ~ctx ~signature ~port ~ip =
           ret (Lwt.return "ok")
         | _, [ "slack" ] ->
           log#info "%s" request.body;
-          let%lwt () = Action.process_slack_oauth ctx request.args request.headers request.body in
+          let%lwt () = Action.process_slack_oauth ctx request.args in
           ret (Lwt.return "ok")
         | _, _ ->
           log#error "unknown path : %s" (Httpev.show_request request);

test/slack_oauth.expected

@@ -1,13 +1,8 @@
 ===== slack oauth: success, valid params ====
 will generate token
-===== slack oauth: success, no signing key ====
-will generate token
 ===== slack oauth: success, with state ====
 will generate token
 ===== slack oauth: no-op, token exists ====
 ===== slack oauth: failure, no state arg ====
 ===== slack oauth: failure, bad state arg ====
 ===== slack oauth: failure, no code arg ====
-===== slack oauth: failure, bad timestamp ====
-===== slack oauth: failure, no signature ====
-===== slack oauth: failure, no timestamp ====

test/slack_oauth_test.ml

@@ -2,14 +2,6 @@ open Base
 open Lib
 module Action = Action.Action (Api_local.Github) (Api_local.Slack)
 
-let signing_key = "8f742231b10e8888abcd99yyyzzz85a5"
-
-let sig_header = "x-slack-signature", "v0=abb033014f155dcde840b8dc150b1fb12433b8f8233ffc2853be34e151bad9e8"
-
-let ts_valid = "x-slack-request-timestamp", "1531420618"
-
-let ts_invalid = "x-slack-request-timestamp", "5000000000"
-
 let arg_code = "code", "1591663521684.1613458437648.4a18cf683e541ff9d8fd75075181cac49c7acae9431d7e4ffd424ce1ca8d2543"
 
 let arg_state = "state", "foo"
@@ -27,30 +19,24 @@ let secrets_default : Config_t.secrets =
     slack_access_token = None;
   }
 
-let secrets_with_key = { secrets_default with slack_signing_secret = Some signing_key }
-
 let secrets_with_state = { secrets_default with slack_oauth_state = Some "foo" }
 
 let secrets_with_token = { secrets_default with slack_access_token = Some "123" }
 
 let tests =
   [
-    "success, valid params", [ arg_code ], [ sig_header; ts_valid ], "text=hello", secrets_with_key;
-    "success, no signing key", [ arg_code ], [ sig_header; ts_valid ], "text=hello", secrets_default;
-    "success, with state", [ arg_code; arg_state ], [ sig_header; ts_valid ], "text=hello", secrets_with_state;
-    "no-op, token exists", [ arg_code ], [ sig_header; ts_valid ], "text=hello", secrets_with_token;
-    "failure, no state arg", [ arg_code ], [ sig_header; ts_valid ], "text=hello", secrets_with_state;
-    "failure, bad state arg", [ arg_code; arg_state_bad ], [ sig_header; ts_valid ], "text=hello", secrets_with_state;
-    "failure, no code arg", [], [ sig_header; ts_valid ], "text=hello", secrets_with_key;
-    "failure, bad timestamp", [ arg_code ], [ sig_header; ts_invalid ], "text=hello", secrets_with_key;
-    "failure, no signature", [ arg_code ], [ ts_valid ], "text=hello", secrets_with_key;
-    "failure, no timestamp", [ arg_code ], [ sig_header ], "text=hello", secrets_with_key;
+    "success, valid params", [ arg_code ], secrets_default;
+    "success, with state", [ arg_code; arg_state ], secrets_with_state;
+    "no-op, token exists", [ arg_code ], secrets_with_token;
+    "failure, no state arg", [ arg_code ], secrets_with_state;
+    "failure, bad state arg", [ arg_code; arg_state_bad ], secrets_with_state;
+    "failure, no code arg", [], secrets_default;
   ]
 
-let process (ctx : Context.t) (name, args, headers, body, secrets) =
+let process (ctx : Context.t) (name, args, secrets) =
   ctx.secrets <- Some secrets;
   Stdio.printf "===== slack oauth: %s ====\n" name;
-  Action.process_slack_oauth ctx args headers body
+  Action.process_slack_oauth ctx args
 
 let () =
   let ctx = Context.make () in