Slack & MS Teams Integrations
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Slack and Microsoft Teams integrations in Hoop provide a seamless workflow for managing risky infrastructure operations through common communication platforms. These integrations allow teams to route command approval requests (JIT access, destructive queries, or production writes) directly to Slack channels or Teams adaptive cards, enabling human-in-the-loop governance without leaving the chat interface.
The system acts as a bridge between the Hoop Gateway and third-party collaboration tools. When a user executes a command that requires review, the Gateway triggers a plugin event that formats the request data—including the user identity, target connection, and the specific script—into platform-specific payloads for reviewer interaction.
Sources: README.md, gateway/transport/plugins/slack/slack.go:210-230
Slack Integration Architecture
The Slack integration is implemented as a Gateway transport plugin. It maintains per-organization service instances that handle event processing and message posting. The plugin lifecycle is managed through OnStartup and OnUpdate hooks, ensuring that configuration changes (such as token rotations) are applied in real-time.
Components and Data Flow
The integration utilizes a socket-mode like pattern where the slackPlugin starts a SlackService instance for each configured organization. This instance manages two primary goroutines: one for processing incoming events from Slack (like button clicks for approvals) and one for handling responses back to the Gateway.
The diagram above shows the lifecycle of a command execution requiring Slack approval, from initial request to the final release of the connection.
Sources: gateway/transport/plugins/slack/slack.go:57-85, gateway/transport/plugins/slack/slack.go:210-240
Key Functions and Structures
slackPlugin: The main structure implementing thePlugininterface, holding the transport release function and API URL.startSlackServiceInstance: Initializes the Slack service for an organization, creating communication channels for review responses.OnReceive: Triggered when a session opens; it fetches review details and sends the initial review request message to the configured Slack channel.slackConfig: Contains the credentials required for the integration.
Sources: gateway/transport/plugins/slack/slack.go:27-35, gateway/transport/plugins/slack/slack.go:88-120
Configuration Parameters
Slack integration requires specific environment variables configured within the plugin settings. These values must be Base64 encoded when stored in the database.
| Parameter | Type | Description |
|---|---|---|
SLACK_BOT_TOKEN | String | The Bot User OAuth Token for the Slack App. |
SLACK_APP_TOKEN | String | The App-level token for socket mode communication. |
SLACK_CHANNEL | String | The default channel ID where review requests are posted. |
Sources: gateway/transport/plugins/slack/slack.go:252-265, gateway/api/openapi/openapiv3.json
Microsoft Teams Integration
Microsoft Teams integration primarily utilizes Adaptive Cards and webhooks to facilitate the review process. Unlike the Slack integration's complex service state management, the Teams integration is often triggered via the webhooks plugin using predefined JSON templates for "Review Created" events.
Adaptive Card Structure
Hoop uses Microsoft's Adaptive Card format (version 1.4 or higher) to present rich, interactive messages in Teams. These cards include session metadata and a SQL/Script code block for the reviewer to inspect.
The diagram represents the schema of the Microsoft Teams review card used for session approvals.
Sources: gateway/transport/plugins/webhooks/microsoftteams.review.create.json
Review Event Data Model
The Teams integration provides a structured view of the request:
| Field | Content Example |
|---|---|
| Session ID | 6bb1f879-f994-4ade-9d69-121676c03a59 |
| Created By | `Sandro Mello |
| Approval Groups | ["admin"] |
| Connection | postgres-demo |
| Code Snippet | The actual SQL or shell script to be executed. |
Sources: gateway/transport/plugins/webhooks/microsoftteams.review.create.json:17-85
Review Workflow Integration
Both integrations rely on the core Review System API. When an interaction occurs (e.g., an "Approve" button is clicked in chat), the integration calls the Gateway's internal review endpoints.
Sequence of Approval
The sequence above illustrates how a chat-based interaction transitions a session from PENDING to APPROVED status.
Sources: gateway/transport/plugins/slack/slack.go:200-208, gateway/api/openapi/openapiv3.json
Summary
The Slack and MS Teams integrations provide critical human-in-the-loop security controls for the Hoop project. By leveraging Slack's Socket Mode and MS Teams' Adaptive Cards, Hoop allows organizations to implement complex approval workflows for infrastructure access. These integrations ensure that every sensitive command is reviewed in a transparent, audited, and accessible environment, effectively bridging the gap between DevOps operations and organizational security policies.
Sources: README.md, webapp_v2/src/utils/docsUrl.js