feat: M19 API audit log + M16a notifier connectors (Slack, Teams, PagerDuty, OpsGenie)

M19: HTTP middleware records every API call to the immutable audit trail with method, path, actor, SHA-256 body hash, status, and latency. Best-effort async recording via goroutine. Health/ready probes excluded. M16a: Four pluggable notifier connectors — Slack (incoming webhook), Teams (MessageCard), PagerDuty (Events API v2), OpsGenie (Alert API v2). Each enabled by config env var. 30 new tests across middleware and connectors. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-13 08:58:55 +00:00 · 2026-03-23 17:58:14 -04:00
parent b227502cef
commit 9b0ff37973
14 changed files with 1399 additions and 5 deletions
@@ -0,0 +1,92 @@
+package slack
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// Config holds configuration for the Slack notifier.
+type Config struct {
+	// WebhookURL is the Slack incoming webhook URL.
+	WebhookURL string `json:"webhook_url"`
+	// ChannelOverride optionally overrides the webhook's default channel.
+	ChannelOverride string `json:"channel,omitempty"`
+	// Username optionally sets the bot display name.
+	Username string `json:"username,omitempty"`
+	// IconEmoji optionally sets the bot icon (e.g., ":lock:").
+	IconEmoji string `json:"icon_emoji,omitempty"`
+}
+
+// Notifier sends notifications to Slack via incoming webhooks.
+type Notifier struct {
+	config     Config
+	httpClient *http.Client
+}
+
+// New creates a new Slack notifier.
+func New(config Config) *Notifier {
+	return &Notifier{
+		config: config,
+		httpClient: &http.Client{
+			Timeout: 10 * time.Second,
+		},
+	}
+}
+
+// Channel returns the channel identifier.
+func (n *Notifier) Channel() string {
+	return "Slack"
+}
+
+// Send delivers a notification to Slack via webhook.
+func (n *Notifier) Send(ctx context.Context, recipient string, subject string, body string) error {
+	payload := slackMessage{
+		Text: fmt.Sprintf("*%s*\n%s", subject, body),
+	}
+
+	if n.config.ChannelOverride != "" {
+		payload.Channel = n.config.ChannelOverride
+	}
+	if n.config.Username != "" {
+		payload.Username = n.config.Username
+	}
+	if n.config.IconEmoji != "" {
+		payload.IconEmoji = n.config.IconEmoji
+	}
+
+	jsonBytes, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("slack: failed to marshal payload: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, n.config.WebhookURL, bytes.NewReader(jsonBytes))
+	if err != nil {
+		return fmt.Errorf("slack: failed to create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := n.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("slack: request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		respBody, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("slack: webhook returned HTTP %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	return nil
+}
+
+type slackMessage struct {
+	Text      string `json:"text"`
+	Channel   string `json:"channel,omitempty"`
+	Username  string `json:"username,omitempty"`
+	IconEmoji string `json:"icon_emoji,omitempty"`
+}
@@ -0,0 +1,107 @@
+package slack
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSlack_Channel(t *testing.T) {
+	n := New(Config{WebhookURL: "https://hooks.slack.com/test"})
+	if n.Channel() != "Slack" {
+		t.Errorf("expected channel Slack, got %s", n.Channel())
+	}
+}
+
+func TestSlack_SendSuccess(t *testing.T) {
+	var receivedPayload slackMessage
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if ct := r.Header.Get("Content-Type"); ct != "application/json" {
+			t.Errorf("expected application/json, got %s", ct)
+		}
+		if err := json.NewDecoder(r.Body).Decode(&receivedPayload); err != nil {
+			t.Fatalf("failed to decode payload: %v", err)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	n := New(Config{WebhookURL: server.URL})
+	err := n.Send(context.Background(), "ops@example.com", "Cert Expiring", "mc-api-prod expires in 7 days")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if !strings.Contains(receivedPayload.Text, "*Cert Expiring*") {
+		t.Errorf("expected bold subject in text, got %q", receivedPayload.Text)
+	}
+	if !strings.Contains(receivedPayload.Text, "mc-api-prod expires in 7 days") {
+		t.Errorf("expected body in text, got %q", receivedPayload.Text)
+	}
+}
+
+func TestSlack_SendWithOverrides(t *testing.T) {
+	var receivedPayload slackMessage
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewDecoder(r.Body).Decode(&receivedPayload)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	n := New(Config{
+		WebhookURL:      server.URL,
+		ChannelOverride: "#alerts",
+		Username:        "certctl-bot",
+		IconEmoji:       ":lock:",
+	})
+	err := n.Send(context.Background(), "", "Test", "body")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if receivedPayload.Channel != "#alerts" {
+		t.Errorf("expected channel #alerts, got %s", receivedPayload.Channel)
+	}
+	if receivedPayload.Username != "certctl-bot" {
+		t.Errorf("expected username certctl-bot, got %s", receivedPayload.Username)
+	}
+	if receivedPayload.IconEmoji != ":lock:" {
+		t.Errorf("expected icon_emoji :lock:, got %s", receivedPayload.IconEmoji)
+	}
+}
+
+func TestSlack_SendHTTPError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		w.Write([]byte("invalid_token"))
+	}))
+	defer server.Close()
+
+	n := New(Config{WebhookURL: server.URL})
+	err := n.Send(context.Background(), "", "Test", "body")
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "HTTP 403") {
+		t.Errorf("expected HTTP 403 in error, got %v", err)
+	}
+}
+
+func TestSlack_SendConnectionError(t *testing.T) {
+	n := New(Config{WebhookURL: "http://127.0.0.1:1"})
+	err := n.Send(context.Background(), "", "Test", "body")
+	if err == nil {
+		t.Fatal("expected connection error, got nil")
+	}
+	if !strings.Contains(err.Error(), "request failed") {
+		t.Errorf("expected 'request failed' in error, got %v", err)
+	}
+}