Add interactif slack message

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-10-20 17:22:02 +02:00
parent de004ce8d7
commit 0073846d3b
23 changed files with 1833 additions and 173 deletions
--- a/pkg/trust/organization_service.go
+++ b/pkg/trust/organization_service.go
@@ -61,6 +61,40 @@ func (s OrganizationService) Get(
 	return organization, nil
 }

+func (s OrganizationService) GetOrganizationCustomDomain(
+	ctx context.Context,
+	organizationID gid.GID,
+) (*coredata.CustomDomain, error) {
+	var domain *coredata.CustomDomain
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			var org coredata.Organization
+			if err := org.LoadByID(ctx, conn, s.svc.scope, organizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			if org.CustomDomainID == nil {
+				return nil
+			}
+
+			domain = &coredata.CustomDomain{}
+			if err := domain.LoadByID(ctx, conn, s.svc.scope, s.svc.encryptionKey, *org.CustomDomainID); err != nil {
+				return fmt.Errorf("cannot load custom domain: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return domain, nil
+}
+
 func (s OrganizationService) GenerateLogoURL(
 	ctx context.Context,
 	organizationID gid.GID,
--- a/pkg/trust/service.go
+++ b/pkg/trust/service.go
@@ -15,6 +15,8 @@
 package trust

 import (
+	"time"
+
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/getprobo/probo/pkg/auth"
 	"github.com/getprobo/probo/pkg/coredata"
@@ -23,21 +25,32 @@ import (
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/getprobo/probo/pkg/html2pdf"
 	"github.com/getprobo/probo/pkg/probo"
+	"github.com/getprobo/probo/pkg/slack"
+	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
 )

 type (
+	TrustConfig struct {
+		TokenSecret   string
+		TokenDuration time.Duration
+		TokenType     string
+	}
+
 	Service struct {
-		pg                *pg.Client
-		s3                *s3.Client
-		bucket            string
-		proboSvc          *probo.Service
-		encryptionKey     cipher.EncryptionKey
-		tokenSecret       string
-		hostname          string
-		auth              *auth.Service
-		html2pdfConverter *html2pdf.Converter
-		fileManager       *filemanager.Service
+		pg                 *pg.Client
+		s3                 *s3.Client
+		bucket             string
+		proboSvc           *probo.Service
+		encryptionKey      cipher.EncryptionKey
+		tokenSecret        string
+		slackSigningSecret string
+		hostname           string
+		auth               *auth.Service
+		html2pdfConverter  *html2pdf.Converter
+		fileManager        *filemanager.Service
+		logger             *log.Logger
+		trustConfig        TrustConfig
 	}

 	TenantService struct {
@@ -52,6 +65,8 @@ type (
 		auth                  *auth.Service
 		html2pdfConverter     *html2pdf.Converter
 		fileManager           *filemanager.Service
+		logger                *log.Logger
+		trustConfig           TrustConfig
 		TrustCenters          *TrustCenterService
 		Documents             *DocumentService
 		Audits                *AuditService
@@ -61,6 +76,7 @@ type (
 		TrustCenterReferences *TrustCenterReferenceService
 		Reports               *ReportService
 		Organizations         *OrganizationService
+		SlackMessages         *SlackMessageService
 	}
 )

@@ -71,20 +87,26 @@ func NewService(
 	hostname string,
 	encryptionKey cipher.EncryptionKey,
 	tokenSecret string,
+	slackSigningSecret string,
 	auth *auth.Service,
 	html2pdfConverter *html2pdf.Converter,
 	fileManagerService *filemanager.Service,
+	logger *log.Logger,
+	trustConfig TrustConfig,
 ) *Service {
 	return &Service{
-		pg:                pgClient,
-		s3:                s3Client,
-		bucket:            bucket,
-		encryptionKey:     encryptionKey,
-		tokenSecret:       tokenSecret,
-		hostname:          hostname,
-		auth:              auth,
-		html2pdfConverter: html2pdfConverter,
-		fileManager:       fileManagerService,
+		pg:                 pgClient,
+		s3:                 s3Client,
+		bucket:             bucket,
+		encryptionKey:      encryptionKey,
+		tokenSecret:        tokenSecret,
+		slackSigningSecret: slackSigningSecret,
+		hostname:           hostname,
+		auth:               auth,
+		html2pdfConverter:  html2pdfConverter,
+		fileManager:        fileManagerService,
+		logger:             logger,
+		trustConfig:        trustConfig,
 	}
 }

@@ -101,17 +123,22 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 		auth:              s.auth,
 		html2pdfConverter: s.html2pdfConverter,
 		fileManager:       s.fileManager,
+		logger:            s.logger,
+		trustConfig:       s.trustConfig,
 	}

+	slackClient := slack.NewClient(s.logger)
+
 	tenantService.TrustCenters = &TrustCenterService{svc: tenantService}
 	tenantService.Documents = &DocumentService{svc: tenantService, html2pdfConverter: s.html2pdfConverter}
 	tenantService.Audits = &AuditService{svc: tenantService}
 	tenantService.Vendors = &VendorService{svc: tenantService}
 	tenantService.Frameworks = &FrameworkService{svc: tenantService}
-	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService, auth: s.auth}
+	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService, auth: s.auth, logger: s.logger}
 	tenantService.TrustCenterReferences = &TrustCenterReferenceService{svc: tenantService}
 	tenantService.Reports = &ReportService{svc: tenantService}
 	tenantService.Organizations = &OrganizationService{svc: tenantService}
+	tenantService.SlackMessages = &SlackMessageService{svc: tenantService, slackClient: slackClient}

 	return tenantService
 }
@@ -119,3 +146,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 func (s *Service) GetTokenSecret() string {
 	return s.tokenSecret
 }
+
+func (s *Service) GetSlackSigningSecret() string {
+	return s.slackSigningSecret
+}
--- a/pkg/trust/slack_message_service.go
+++ b/pkg/trust/slack_message_service.go
@@ -0,0 +1,337 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package trust
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/slack"
+	"go.gearno.de/kit/pg"
+)
+
+const (
+	slackMessageDeduplicationWindow = 7 * 24 * time.Hour
+	trustCenterAccessURLFormat      = "https://%s/organizations/%s/trust-center/access"
+)
+
+type SlackMessageService struct {
+	svc         *TenantService
+	slackClient *slack.Client
+}
+
+func (s *SlackMessageService) LoadSlackMessageUnscoped(
+	ctx context.Context,
+	channelID string,
+	messageTS string,
+) (*coredata.SlackMessage, error) {
+	var slackMessage coredata.SlackMessage
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		if err := slackMessage.LoadByChannelAndTSUnscoped(ctx, conn, channelID, messageTS); err != nil {
+			return fmt.Errorf("cannot load slack message: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &slackMessage, nil
+}
+
+func (s *SlackMessageService) UpdateSlackAccessMessage(
+	ctx context.Context,
+	slackMessageID gid.GID,
+	actionID string,
+	value string,
+	responseURL string,
+) error {
+	return s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		var slackMessage coredata.SlackMessage
+		if err := slackMessage.LoadById(ctx, tx, s.svc.scope, slackMessageID); err != nil {
+			return fmt.Errorf("cannot load slack message: %w", err)
+		}
+
+		baseBody := slackMessage.Body
+		var latestUpdate coredata.SlackMessageUpdate
+		if err := latestUpdate.LoadLatestBySlackMessageID(ctx, tx, slackMessage.ID); err == nil {
+			baseBody = latestUpdate.Body
+		}
+
+		accessTabURL := fmt.Sprintf(trustCenterAccessURLFormat, s.svc.hostname, slackMessage.OrganizationID)
+		updatedBody := s.changeButton(baseBody, actionID, value, accessTabURL)
+
+		slackMessageUpdate := coredata.NewSlackMessageUpdate(s.svc.scope, slackMessage.ID, updatedBody)
+		now := time.Now()
+		slackMessageUpdate.SentAt = &now
+		if err := slackMessageUpdate.Insert(ctx, tx, s.svc.scope); err != nil {
+			return fmt.Errorf("cannot insert slack message update: %w", err)
+		}
+
+		if err := s.slackClient.UpdateInteractiveMessage(ctx, responseURL, updatedBody); err != nil {
+			return fmt.Errorf("failed to update Slack message: %w", err)
+		}
+
+		return nil
+	})
+}
+
+func (s *SlackMessageService) QueueSlackNotification(
+	ctx context.Context,
+	requesterEmail string,
+	trustCenterID gid.GID,
+) error {
+	return s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		var trustCenterAccess coredata.TrustCenterAccess
+		if err := trustCenterAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, trustCenterID, requesterEmail); err != nil {
+			return fmt.Errorf("cannot load trust center access: %w", err)
+		}
+
+		var trustCenter coredata.TrustCenter
+		if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, trustCenterID); err != nil {
+			return fmt.Errorf("cannot load trust center: %w", err)
+		}
+
+		var accesses coredata.TrustCenterDocumentAccesses
+		if err := accesses.LoadAllByTrustCenterAccessID(ctx, tx, s.svc.scope, trustCenterAccess.ID); err != nil {
+			return fmt.Errorf("cannot load trust center document accesses: %w", err)
+		}
+
+		var documentIDs []string
+		var reportIDs []string
+		var documents []struct {
+			ID      string
+			Title   string
+			Granted bool
+		}
+		var reports []struct {
+			ID      string
+			Title   string
+			AuditID string
+			Granted bool
+		}
+
+		for _, access := range accesses {
+			if access.DocumentID != nil {
+				doc := &coredata.Document{}
+				if err := doc.LoadByID(ctx, tx, s.svc.scope, *access.DocumentID); err != nil {
+					return fmt.Errorf("cannot load document: %w", err)
+				}
+				documentIDs = append(documentIDs, access.DocumentID.String())
+				documents = append(documents, struct {
+					ID      string
+					Title   string
+					Granted bool
+				}{
+					ID:      access.DocumentID.String(),
+					Title:   doc.Title,
+					Granted: access.Active,
+				})
+			}
+
+			if access.ReportID != nil {
+				rep := &coredata.Report{}
+				if err := rep.LoadByID(ctx, tx, s.svc.scope, *access.ReportID); err != nil {
+					return fmt.Errorf("cannot load report: %w", err)
+				}
+
+				audit := &coredata.Audit{}
+				if err := audit.LoadByReportID(ctx, tx, s.svc.scope, *access.ReportID); err != nil {
+					return fmt.Errorf("cannot load audit: %w", err)
+				}
+
+				framework := &coredata.Framework{}
+				if err := framework.LoadByID(ctx, tx, s.svc.scope, audit.FrameworkID); err != nil {
+					return fmt.Errorf("cannot load framework: %w", err)
+				}
+
+				label := framework.Name
+				if audit.Name != nil && *audit.Name != "" {
+					label = label + " - " + *audit.Name
+				}
+				reportIDs = append(reportIDs, access.ReportID.String())
+				reports = append(reports, struct {
+					ID      string
+					Title   string
+					AuditID string
+					Granted bool
+				}{
+					ID:      access.ReportID.String(),
+					Title:   label,
+					AuditID: audit.ID.String(),
+					Granted: access.Active,
+				})
+			}
+		}
+
+		templateData := struct {
+			RequesterName  string
+			RequesterEmail string
+			OrganizationID string
+			Domain         string
+			DocumentIDs    []string
+			ReportIDs      []string
+			Documents      []struct {
+				ID      string
+				Title   string
+				Granted bool
+			}
+			Reports []struct {
+				ID      string
+				Title   string
+				AuditID string
+				Granted bool
+			}
+		}{
+			RequesterName:  trustCenterAccess.Name,
+			RequesterEmail: requesterEmail,
+			OrganizationID: trustCenter.OrganizationID.String(),
+			Domain:         s.svc.hostname,
+			DocumentIDs:    documentIDs,
+			ReportIDs:      reportIDs,
+			Documents:      documents,
+			Reports:        reports,
+		}
+
+		var buf bytes.Buffer
+		if err := accessRequestTemplate.Execute(&buf, templateData); err != nil {
+			return fmt.Errorf("failed to execute template: %w", err)
+		}
+
+		var body map[string]any
+		if err := json.NewDecoder(&buf).Decode(&body); err != nil {
+			return fmt.Errorf("failed to parse template JSON: %w", err)
+		}
+
+		sevenDaysAgo := time.Now().Add(-slackMessageDeduplicationWindow)
+		var existingMessage coredata.SlackMessage
+		err := existingMessage.LoadLatestByRequesterEmailAndType(
+			ctx,
+			tx,
+			s.svc.scope,
+			trustCenter.OrganizationID,
+			requesterEmail,
+			coredata.SlackMessageTypeTrustCenterAccessRequest,
+			sevenDaysAgo,
+		)
+
+		if err == nil && existingMessage.MessageTS != nil && existingMessage.ChannelID != nil {
+			slackMessageUpdate := coredata.NewSlackMessageUpdate(s.svc.scope, existingMessage.ID, body)
+			if err := slackMessageUpdate.Insert(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert slack message update: %w", err)
+			}
+
+			return nil
+		}
+
+		slackMessage := coredata.NewSlackMessage(s.svc.scope, trustCenter.OrganizationID, coredata.SlackMessageTypeTrustCenterAccessRequest, body, &requesterEmail)
+		if err := slackMessage.Insert(ctx, tx, s.svc.scope); err != nil {
+			return fmt.Errorf("cannot insert slack message: %w", err)
+		}
+
+		return nil
+	})
+}
+
+func (s *SlackMessageService) changeButton(body map[string]any, actionID string, value string, accessTabURL string) map[string]any {
+	blocks, ok := body["blocks"].([]any)
+	if !ok {
+		return body
+	}
+
+	isAcceptAll := actionID == "accept_all"
+
+	updatedBlocks := make([]any, len(blocks))
+	for i, blockAny := range blocks {
+		block, ok := blockAny.(map[string]any)
+		if !ok {
+			updatedBlocks[i] = blockAny
+			continue
+		}
+
+		blockCopy := make(map[string]any)
+		maps.Copy(blockCopy, block)
+
+		if blockType, ok := block["type"].(string); ok && blockType == "section" {
+			if acc, ok := block["accessory"].(map[string]any); ok {
+				if s.shouldChangeButton(acc, actionID, value, isAcceptAll) {
+					blockCopy["accessory"] = s.makeStaticButton(accessTabURL)
+				}
+			}
+		}
+
+		if blockType, ok := block["type"].(string); ok && blockType == "actions" {
+			if elements, ok := block["elements"].([]any); ok {
+				updatedElements := make([]any, len(elements))
+				for j, elemAny := range elements {
+					elem, ok := elemAny.(map[string]any)
+					if !ok {
+						updatedElements[j] = elemAny
+						continue
+					}
+
+					if s.shouldChangeButton(elem, actionID, value, isAcceptAll) {
+						updatedElements[j] = s.makeStaticButton(accessTabURL)
+					} else {
+						updatedElements[j] = elem
+					}
+				}
+				blockCopy["elements"] = updatedElements
+			}
+		}
+
+		updatedBlocks[i] = blockCopy
+	}
+
+	updatedBody := make(map[string]any)
+	maps.Copy(updatedBody, body)
+	updatedBody["blocks"] = updatedBlocks
+
+	return updatedBody
+}
+
+func (s *SlackMessageService) shouldChangeButton(button map[string]any, actionID string, value string, isAcceptAll bool) bool {
+	if button["type"] != "button" {
+		return false
+	}
+
+	btnActionID, _ := button["action_id"].(string)
+	btnValue, _ := button["value"].(string)
+
+	isExactMatch := btnActionID == actionID && btnValue == value
+	isAcceptAllMatch := isAcceptAll && (btnActionID == "accept_document" || btnActionID == "accept_report")
+
+	return isExactMatch || isAcceptAllMatch
+}
+
+func (s *SlackMessageService) makeStaticButton(accessTabURL string) map[string]any {
+	return map[string]any{
+		"type": "button",
+		"text": map[string]any{
+			"type": "plain_text",
+			"text": "✓ Granted",
+		},
+		"url": accessTabURL,
+	}
+}
--- a/pkg/trust/templates/access-request.json.tmpl
+++ b/pkg/trust/templates/access-request.json.tmpl
@@ -0,0 +1,121 @@
+{
+  "text": "New Trust Center Access Request",
+  "blocks": [
+    {
+      "type": "header",
+      "text": {
+        "type": "plain_text",
+        "text": "🔒 New Trust Center Access Request"
+      }
+    },
+    {
+      "type": "context",
+      "elements": [
+        {
+          "type": "mrkdwn",
+          "text": "👤 Requested by *{{jsonEscape .RequesterName}}* <{{jsonEscape .RequesterEmail}}>"
+        }
+      ]
+    },
+    {
+      "type": "actions",
+      "elements": [
+        {
+          "type": "button",
+          "text": {
+            "type": "plain_text",
+            "text": "✅ Accept All"
+          },
+          "action_id": "accept_all",
+          "value": "{{buildAcceptAllValue .DocumentIDs .ReportIDs}}",
+          "style": "primary"
+        },
+        {
+          "type": "button",
+          "text": {
+            "type": "plain_text",
+            "text": "👁️ View Requests"
+          },
+          "url": "https://{{.Domain}}/organizations/{{.OrganizationID}}/trust-center/access"
+        }
+      ]
+    }{{if .Documents}},
+    {
+      "type": "divider"
+    },
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "*📄 Requested Documents*"
+      }
+    }{{range .Documents}},
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "<https://{{$.Domain}}/organizations/{{$.OrganizationID}}/documents/{{.ID}}|{{jsonEscape .Title}}>"
+      },
+      "accessory": {{if .Granted}}{
+        "type": "button",
+        "text": {
+          "type": "plain_text",
+          "text": "✓ Granted"
+        },
+        "url": "https://{{$.Domain}}/organizations/{{$.OrganizationID}}/trust-center/access"
+      }{{else}}{
+        "type": "button",
+        "text": {
+          "type": "plain_text",
+          "text": "Accept"
+        },
+        "action_id": "accept_document",
+        "value": "{{.ID}}",
+        "style": "primary"
+      }{{end}}
+    }{{end}}{{end}}{{if .Reports}},
+    {
+      "type": "divider"
+    },
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "*📊 Requested Audit Reports*"
+      }
+    }{{range .Reports}},
+    {
+      "type": "section",
+      "text": {
+        "type": "mrkdwn",
+        "text": "<https://{{$.Domain}}/organizations/{{$.OrganizationID}}/audits/{{.AuditID}}|{{jsonEscape .Title}}>"
+      },
+      "accessory": {{if .Granted}}{
+        "type": "button",
+        "text": {
+          "type": "plain_text",
+          "text": "✓ Granted"
+        },
+        "url": "https://{{$.Domain}}/organizations/{{$.OrganizationID}}/trust-center/access"
+      }{{else}}{
+        "type": "button",
+        "text": {
+          "type": "plain_text",
+          "text": "Accept"
+        },
+        "action_id": "accept_report",
+        "value": "{{.ID}}",
+        "style": "primary"
+      }{{end}}
+    }{{end}}{{end}},
+    {
+      "type": "context",
+      "elements": [
+        {
+          "type": "mrkdwn",
+          "text": "⚠️ _Updates from this message will only work for 14 days_"
+        }
+      ]
+    }
+  ]
+}
--- a/pkg/trust/templates/access-request.txt.tmpl
+++ b/pkg/trust/templates/access-request.txt.tmpl
@@ -1,7 +0,0 @@
-*New Trust Center Access Request*
-
-*Organization:* {{.OrganizationName}}
-*Requested by:* {{.RequesterName}}
-*Email:* {{.RequesterEmail}}
-
-<{{.ConsoleUrl}}|View Access Requests>
--- a/pkg/trust/trust_center_access_service.go
+++ b/pkg/trust/trust_center_access_service.go
@@ -15,32 +15,58 @@
 package trust

 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"net/mail"
+	"net/url"
+	"strings"
 	"text/template"
 	"time"

+	"github.com/getprobo/probo/packages/emails"
 	"github.com/getprobo/probo/pkg/auth"
 	"github.com/getprobo/probo/pkg/coredata"
 	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/probo"
+	"github.com/getprobo/probo/pkg/statelesstoken"
+	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
 )

 var (
-	accessRequestTemplate = template.Must(template.ParseFS(Templates, "templates/access-request.txt.tmpl"))
+	accessRequestTemplate = template.Must(
+		template.New("access-request.json.tmpl").
+			Funcs(template.FuncMap{
+				"jsonEscape": func(s string) string {
+					b, _ := json.Marshal(s)
+					return string(b[1 : len(b)-1])
+				},
+				"buildAcceptAllValue": func(docIDs, repIDs []string) string {
+					value := map[string][]string{
+						"document_ids": docIDs,
+						"report_ids":   repIDs,
+					}
+					b, _ := json.Marshal(value)
+					s := string(b)
+					s = strings.ReplaceAll(s, `\`, `\\`)
+					s = strings.ReplaceAll(s, `"`, `\"`)
+					return s
+				},
+			}).
+			ParseFS(Templates, "templates/access-request.json.tmpl"),
+	)
 )

 type (
 	TrustCenterAccessService struct {
-		svc  *TenantService
-		auth *auth.Service
+		svc    *TenantService
+		auth   *auth.Service
+		logger *log.Logger
 	}

-	RequestTrustCenterAccessRequest struct {
+	TrustCenterAccessRequest struct {
 		TrustCenterID gid.GID
 		Email         string
 		Name          *string
@@ -50,7 +76,6 @@ type (
 )

 const (
-	TokenTypeTrustCenterAccess = "trust_center_access"
 	TrustCenterAccessURLFormat = "https://%s/organizations/%s/trust-center/access"
 )

@@ -76,7 +101,7 @@ func (s TrustCenterAccessService) ValidateToken(

 func (s TrustCenterAccessService) Request(
 	ctx context.Context,
-	req *RequestTrustCenterAccessRequest,
+	req *TrustCenterAccessRequest,
 ) (*coredata.TrustCenterAccess, error) {
 	now := time.Now()

@@ -175,10 +200,6 @@ func (s TrustCenterAccessService) Request(
 			return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
 		}

-		if err := s.queueSlackNotification(ctx, tx, organizationID, access.Name, access.Email); err != nil {
-			return fmt.Errorf("cannot queue slack notification: %w", err)
-		}
-
 		return nil
 	})

@@ -186,6 +207,10 @@ func (s TrustCenterAccessService) Request(
 		return nil, err
 	}

+	if err := s.svc.SlackMessages.QueueSlackNotification(ctx, access.Email, req.TrustCenterID); err != nil {
+		s.logger.ErrorCtx(ctx, "cannot queue slack notification")
+	}
+
 	return access, nil
 }

@@ -310,6 +335,136 @@ func (s TrustCenterAccessService) LoadReportAccess(
 	return reportAccess, nil
 }

+func (s *TrustCenterAccessService) AcceptByIDs(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	email string,
+	documentIDs []gid.GID,
+	reportIDs []gid.GID,
+) error {
+	return s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		access := &coredata.TrustCenterAccess{}
+		if err := access.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, trustCenterID, email); err != nil {
+			return fmt.Errorf("cannot load trust center access: %w", err)
+		}
+
+		wasInactive := !access.Active
+		now := time.Now()
+
+		if len(documentIDs) > 0 {
+			if err := coredata.ActivateByDocumentIDs(ctx, tx, s.svc.scope, access.ID, documentIDs, now); err != nil {
+				return fmt.Errorf("cannot activate document accesses: %w", err)
+			}
+		}
+		if len(reportIDs) > 0 {
+			if err := coredata.ActivateByReportIDs(ctx, tx, s.svc.scope, access.ID, reportIDs, now); err != nil {
+				return fmt.Errorf("cannot activate report accesses: %w", err)
+			}
+		}
+
+		if wasInactive {
+			access.Active = true
+			access.UpdatedAt = now
+			if err := access.Update(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update trust center access: %w", err)
+			}
+
+			if err := s.sendAccessEmail(ctx, tx, access); err != nil {
+				return fmt.Errorf("failed to send access email: %w", err)
+			}
+		}
+
+		return nil
+	})
+}
+
+func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Conn, access *coredata.TrustCenterAccess) error {
+	accessToken, err := statelesstoken.NewToken(
+		s.svc.trustConfig.TokenSecret,
+		s.svc.trustConfig.TokenType,
+		s.svc.trustConfig.TokenDuration,
+		probo.TrustCenterAccessData{
+			TrustCenterID: access.TrustCenterID,
+			Email:         access.Email,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("cannot generate access token: %w", err)
+	}
+
+	trustCenter := &coredata.TrustCenter{}
+	err = trustCenter.LoadByID(ctx, tx, s.svc.scope, access.TrustCenterID)
+	if err != nil {
+		return fmt.Errorf("cannot load trust center: %w", err)
+	}
+
+	organization := &coredata.Organization{}
+	err = organization.LoadByID(ctx, tx, s.svc.scope, trustCenter.OrganizationID)
+	if err != nil {
+		return fmt.Errorf("cannot load organization: %w", err)
+	}
+
+	hostname := s.svc.hostname
+	path := "/trust/" + trustCenter.Slug + "/access"
+
+	if organization.CustomDomainID != nil {
+		customDomain, err := s.svc.Organizations.GetOrganizationCustomDomain(ctx, organization.ID)
+		if err != nil {
+			return fmt.Errorf("cannot load custom domain: %w", err)
+		}
+
+		if customDomain == nil || customDomain.SSLStatus != coredata.CustomDomainSSLStatusActive {
+			return fmt.Errorf("custom domain is not active")
+		}
+
+		hostname = customDomain.Domain
+		path = "/access"
+	}
+
+	accessURL := url.URL{
+		Scheme: "https",
+		Host:   hostname,
+		Path:   path,
+		RawQuery: url.Values{
+			"token": []string{accessToken},
+		}.Encode(),
+	}
+
+	return s.sendTrustCenterAccessEmail(ctx, tx, access.Name, access.Email, organization.Name, accessURL.String())
+}
+
+func (s *TrustCenterAccessService) sendTrustCenterAccessEmail(
+	ctx context.Context,
+	tx pg.Conn,
+	name string,
+	email string,
+	companyName string,
+	accessURL string,
+) error {
+	subject, textBody, htmlBody, err := emails.RenderTrustCenterAccess(
+		s.svc.hostname,
+		name,
+		companyName,
+		accessURL,
+	)
+	if err != nil {
+		return fmt.Errorf("cannot render trust center access email: %w", err)
+	}
+
+	accessEmail := coredata.NewEmail(
+		name,
+		email,
+		subject,
+		textBody,
+		htmlBody,
+	)
+
+	if err := accessEmail.Insert(ctx, tx); err != nil {
+		return fmt.Errorf("cannot insert access email: %w", err)
+	}
+	return nil
+}
+
 func extractExistingIDs(accesses coredata.TrustCenterDocumentAccesses) ([]gid.GID, []gid.GID) {
 	var documentIDs []gid.GID
 	var reportIDs []gid.GID
@@ -341,42 +496,3 @@ func filterExistingIDs(allIDs []gid.GID, existingIDs []gid.GID) []gid.GID {

 	return newIDs
 }
-
-func (s TrustCenterAccessService) queueSlackNotification(
-	ctx context.Context,
-	tx pg.Conn,
-	organizationID gid.GID,
-	requesterName string,
-	requesterEmail string,
-) error {
-	var organization coredata.Organization
-	if err := organization.LoadByID(ctx, tx, s.svc.scope, organizationID); err != nil {
-		return fmt.Errorf("cannot load organization: %w", err)
-	}
-
-	consoleURL := fmt.Sprintf(TrustCenterAccessURLFormat, s.svc.hostname, organizationID)
-
-	data := struct {
-		OrganizationName string
-		RequesterName    string
-		RequesterEmail   string
-		ConsoleUrl       string
-	}{
-		OrganizationName: organization.Name,
-		RequesterName:    requesterName,
-		RequesterEmail:   requesterEmail,
-		ConsoleUrl:       consoleURL,
-	}
-
-	var buf bytes.Buffer
-	if err := accessRequestTemplate.Execute(&buf, data); err != nil {
-		return fmt.Errorf("failed to execute template: %w", err)
-	}
-
-	slackMessage := coredata.NewSlackMessage(s.svc.scope, organizationID, buf.String())
-	if err := slackMessage.Insert(ctx, tx, s.svc.scope); err != nil {
-		return fmt.Errorf("cannot insert slack message: %w", err)
-	}
-
-	return nil
-}