unsplash / mercury Goto Github PK
View Code? Open in Web Editor NEWThe guide of souls to the underworld.
Home Page: https://unsplash.github.io/mercury/
License: MIT License
The guide of souls to the underworld.
Home Page: https://unsplash.github.io/mercury/
License: MIT License
We currently warn!
on a missing or invalid Heroku secret. We don't do the same thing for Slack bearer tokens, probably because it's implemented in a more shorthand way via ValidateRequestHeaderLayer
. We should be logging this because in this type of application any such occurrences are likely to be due to a bug or bad configuration somewhere.
There may be a wider question here about our lack of logging on invalid requests aside from the resultant status code. The client tends to get more information in the body at least.
Doable with some additional boilerplate: tokio-rs/axum#1654
nix run
works on macOS, however because it's built against our host system the binary fails inside of a container:
$ nix run
2023-10-30T14:53:25.596675Z WARN No .env found
[...]
$ nix build ".#dockerImage" && ./result | podman load
$ podman run mercury
{"msg":"exec container process `/nix/store/zi27abixfpaq0x4czinw34dyjwvb7lrb-mercury-0.0.0/bin/mercury`: Exec format error","level":"error","time":"2023-10-30T14:55:01.480708Z"}
We could potentially use crossSystem
1, however that loses access to the Nix binary cache, meaning we end up building the universe.
Thus our options for building the container on macOS are:
And add a full E2E test that brings up the server using it.
The channel map is cached in memory after the first successful request, and there's currently no way to reset it without restarting the app. This could be an issue if channels are renamed.
Line 132 in 4b0b337
Repro directly against the Slack API:
$ # Replaced with a space character
$ curl -X POST https://slack.com/api/chat.postMessage --oauth2-bearer TOKEN -d channel=CHANNEL -d text=+
$ # Works
$ curl -X POST https://slack.com/api/chat.postMessage --oauth2-bearer TOKEN -d channel=CHANNEL -d text='%2B'
$ # Works
$ curl -X POST https://slack.com/api/chat.postMessage --oauth2-bearer TOKEN -d channel=CHANNEL --data-urlencode text=+
So far this has been confirmed to affect +
and &
.
Also -X POST
is technically redundant but I guess better to be explicit.
There are some third-party middlewares for reqwest. I tried one to no avail. This is the first-party issue: seanmonstar/reqwest#155
In terms of authentication we act as a proxy in front of the Slack API. This poses the risk that someone uses their own access token on our hosted instance - which will be visible in public repos - to send messages to their own instance.
This is particularly unlikely given that they can't be sure we won't steal their access token, but I thought it's worth documenting.
It should be noted that this is an improvement over Otto which allows anyone to post arbitrary messages to our own Slack instance.
Heroku webhooks could offer support for notifications for the following:
Otto does at least the latter.
Now, the docs... https://devcenter.heroku.com/articles/webhook-events
We support dynamically mapping channel names to IDs. Could we do the same for user and/or group mentions?:
Line 6 in 4b0b337
Mercury currently anticipates a single Slack token which is present at runtime. This is used to:
This appears incompatible with potentially supporting multiple Slack workspaces.
We should be able to use ok: bool
as a tag:
Line 42 in 4b0b337
This is why the custom only_true
and only_false
deserialisers exist.
Blocked by: serde-rs/serde#745 (comment)
This limitation is why none of the fields in Message
take a Vec
: nox/serde_urlencoded#52
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.