Build a Slack and Microsoft Teams Contract Approval Flow (2026)

import crypto from "crypto";

export function verifySlackRequest(
  slackSigningSecret: string,
  signatureHeader: string | undefined,
  timestampHeader: string | undefined,
  rawBody: string | Buffer
): boolean {
  if (!signatureHeader || !timestampHeader) return false;

  const timestamp = parseInt(timestampHeader, 10);
  const currentTime = Math.floor(Date.now() / 1000);

  // Reject replay attacks older than 5 minutes
  if (Math.abs(currentTime - timestamp) > 300) {
    return false;
  }

  const sigBaseString = `v0:${timestamp}:${rawBody.toString()}`;
  const mySignature = "v0=" + crypto
    .createHmac("sha256", slackSigningSecret)
    .update(sigBaseString, "utf8")
    .digest("hex");

  const sigBuf = Buffer.from(mySignature, "utf8");
  const headerBuf = Buffer.from(signatureHeader, "utf8");

  if (sigBuf.length !== headerBuf.length) {
    return false;
  }

  return crypto.timingSafeEqual(sigBuf, headerBuf);
}

import express, { Request, Response } from "express";
import { verifySlackRequest } from "./slack_security";

const app = express();
app.use(express.urlencoded({ extended: true }));

const SLACK_SIGNING_SECRET = process.env.SLACK_SIGNING_SECRET!;
const SIGNBEE_API_KEY = process.env.SIGNBEE_API_KEY!;

app.post("/slack/actions", async (req: Request, res: Response) => {
  const signature = req.headers["x-slack-signature"] as string;
  const timestamp = req.headers["x-slack-request-timestamp"] as string;

  // 1. Immediately acknowledge Slack within 3,000ms
  res.status(200).send();

  // 2. Perform background processing asynchronously
  try {
    const payload = JSON.parse(req.body.payload);
    const { actions, response_url, user, channel } = payload;
    const actionValue = actions[0]?.value; // e.g. "deal_982_nda"

    // 3. Dispatch document via Signbee REST API
    const signbeeRes = await fetch("https://signb.ee/api/v1/send", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "Authorization": `Bearer ${SIGNBEE_API_KEY}`
      },
      body: JSON.stringify({
        title: "Mutual NDA — Enterprise Vendor",
        markdown: `# Mutual Non-Disclosure Agreement\n\nApproved by ${user.name} for deal ${actionValue}...\n\n| Clause | Description |\n| :--- | :--- |\n| Confidentiality | 3 Years Strict |\n| Jurisdiction | State of Delaware |\n`,
        recipient_name: "John Doe",
        recipient_email: "john.doe@client.com",
        webhook_url: "https://api.yourdomain.com/webhooks/signbee"
      })
    });

    const doc = await signbeeRes.json();

    // 4. Update the Slack channel thread with signing link
    await fetch(response_url, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        text: `⚡ *Contract Dispatched:* <${doc.signing_url}|Click here to review & sign>`,
        replace_original: false
      })
    });
  } catch (err) {
    console.error("Slack interaction error:", err);
  }
});

{
  "type": "AdaptiveCard",
  "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
  "version": "1.5",
  "body": [
    {
      "type": "TextBlock",
      "text": "📄 Contract Approval Required",
      "weight": "Bolder",
      "size": "Large"
    },
    {
      "type": "FactSet",
      "facts": [
        { "title": "Client:", "value": "Acme Global Corp" },
        { "title": "Agreement:", "value": "Master Services Agreement" },
        { "title": "Contract Value:", "value": "$125,000 / year" }
      ]
    }
  ],
  "actions": [
    {
      "type": "Action.Execute",
      "title": "✅ Approve & Send Contract",
      "verb": "approve_contract",
      "data": {
        "deal_id": "deal_982_msa",
        "recipient_email": "procurement@acme.com"
      }
    }
  ]
}

import express, { Request, Response } from "express";
import crypto from "crypto";

const app = express();
const WEBHOOK_SECRET = process.env.SIGNBEE_WEBHOOK_SECRET!;

app.post(
  "/webhooks/signbee",
  express.raw({ type: "application/json" }),
  async (req: Request, res: Response) => {
    const signature = req.headers["x-signbee-signature"] as string;
    
    // 1. Verify Signbee HMAC
    const expected = crypto
      .createHmac("sha256", WEBHOOK_SECRET)
      .update(req.body)
      .digest("hex");

    if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
      return res.status(401).send("Invalid signature");
    }

    const payload = JSON.parse(req.body.toString("utf8"));

    if (payload.event === "document.signed") {
      // 2. Look up original Slack response_url from internal database
      const channelWebhookUrl = await getSlackResponseUrl(payload.document_id);

      if (channelWebhookUrl) {
        await fetch(channelWebhookUrl, {
          method: "POST",
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify({
            text: `🎉 *Agreement Executed!*\nDocument: *${payload.title}*\nRecipient: ${payload.recipient_name}\nVerified PDF: <${payload.signed_pdf_url}|Download PDF>\nSHA-256 Seal: `${payload.signature_hash.slice(0, 16)}...``
          })
        });
      }
    }

    res.status(200).json({ received: true });
  }
);