Update teams sink validation to accept post-2026 webhook hosts

[JohnBlackwell]

https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet

Will allow new MS teams webhooks to be used in addtion to legacy ones. Introduces new helper function to avoid creating additional regex expressions.

Test environment: https://console.plrl-dev-aws.onplural.sh/

Tested with local dev env with the following urls:

Pass

https://environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/abc123/triggers/manual/paths/invoke?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=test
https://prod-01.westus.logic.azure.com:443/workflows/abc123/triggers/manual/paths/invoke?api-version=2016-10-01&sig=test
https://make.powerautomate.com/workflows/abc123/triggers/manual/paths/invoke?sig=test
https://outlook.office.com/webhook/abc123/IncomingWebhook/test
https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

Fail

http://environment.api.powerplatform.com/workflows/abc123
https://example.com/workflows/abc123
https://not-slack.example.com/services/test
not-a-url

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[soffi-ai]

Soffi AI Summary

This PR hardens webhook URL validation for Microsoft Teams and Slack notification sinks to support the new post-2026 Microsoft webhook hosts (e.g., powerplatform.com, powerautomate.com, logic.azure.com) while closing spoofing attack vectors.

Previously, Teams webhook validation only accepted office.com-based hosts, which means legitimate Power Automate and Azure Logic App webhook URLs were being rejected. The fix moves URL validation server-side (Elixir schema layer) using an explicit allow-list of valid hostnames for both Slack and Teams, enforces HTTPS-only, and rejects userinfo-based and suffix-based hostname spoofing attacks.

On the frontend, client-side URL pattern matching that previously gated form submission is removed — the form now submits and surfaces server-side validation errors directly to the user via a GqlError component. The Slack vs. Teams icon hint in the input field is retained using a lightweight regex, but it no longer blocks submission. When editing an existing sink, the type is preserved from the saved record rather than re-inferred from the URL.

Changes

Expanded Teams webhook host support

• Added post-2026 Microsoft Teams webhook hosts (powerplatform.com, powerautomate.com, logic.azure.com) to the server-side allow-list, replacing the previous office.com-only pattern so modern Power Automate and Azure Logic App webhook URLs are accepted. (51093e0)
• Added handling for malformed URLs during server-side validation — URI.new/1 errors are now caught and consistently rejected rather than crashing or producing unexpected results. (f6f3cb7)
• Retained support for Slack Government (hooks.slack-gov.com) webhook URLs alongside standard slack.com hosts in the server-side allow-list. (86a3d73)
• Moved webhook URL validation from client-side regex to server-side Elixir changesets with explicit hostname allow-lists for Slack and Teams. Added tests covering valid URLs, HTTPS enforcement, and hostname spoofing (userinfo and suffix attacks). (a9a83b9)
• Surfaced server-side webhook URL validation errors to the user in the notification sink modal using the GqlError component, replacing the previous silent client-side block. (c005fea)
• Removed port-based URL validation from the client-side form so URLs with explicit port numbers (e.g., :443) are no longer incorrectly rejected before reaching server-side validation. (45b2417)

---

Updated: 2026-09-15 18:34 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

Updates notification sink URL validation to support current Microsoft Teams webhook domains while restricting Slack and Teams URLs to HTTPS on approved hosts.

• Replaces permissive hostname regexes with exact-domain and subdomain matching.
• Handles malformed URLs, including invalid ports, as validation failures instead of render-time exceptions.
• Stabilizes edit-mode memoization dependencies.

Confidence Score: 5/5

The PR appears safe to merge; the previously reported invalid-port crash is fixed and no new actionable failures were identified.

The URL constructor is now guarded, so malformed HTTPS URLs such as those with out-of-range ports return false rather than crashing the notification sink modal. The previous finding was also manually resolved.

Important Files Changed

Filename	Overview
js/console/src/components/settings/notifications/sinks/UpsertNotificationSinkModal.tsx	Adds reusable HTTPS webhook-host validation and safely handles URL parsing failures; no actionable issues remain.

_{Reviews (2): Last reviewed commit: "catch malformed urls" | Re-trigger Greptile}

[JohnBlackwell]

@greptile

[JohnBlackwell]

plural review this

[plural-copilot]

Plural Summary

Final-head review found no actionable defects. The webhook classifier now parses HTTPS URLs before allowlist matching, preserves Slack/Teams mutation behavior, and the focused helper tests pass (5/5).

Mergeability Grade: A

A — merge-ready. The change replaces permissive string matching with exact or dot-delimited subdomain checks on parsed HTTPS hostnames, preventing the reviewed userinfo and suffix spoofing cases while retaining Slack Gov and the newly supported Teams host families. No correctness, security, TypeScript, or call-site regression was found.

Files changed (3)

Filename	Summary
js/console/src/components/settings/notifications/sinks/UpsertNotificationSinkModal.tsx	Uses the parsed URL classifier for sink-type inference while preserving create/edit state initialization and the existing type-specific mutation payload.
js/console/src/components/settings/notifications/sinks/notificationSinkUrl.ts	Adds HTTPS-only parsed hostname allowlisting for Slack, Slack Gov, and supported Teams webhook host families.
js/console/src/components/settings/notifications/sinks/notificationSinkUrl.test.ts	Adds focused coverage for standard and GovSlack URLs, userinfo/suffix hostname spoofing, and invalid out-of-range ports.

[JohnBlackwell]

plural review this

[michaeljguarino]

this validation shouldn't be on the frontend at all, it should be done server-side.

[JohnBlackwell]

plural deploy to dev

[floreks]

Acknowledged. I inspected PR #4112 at head c005feaeaea77a060b94b0a945b867fa1bf6e3a3 against master and reviewed the notification-sink frontend/backend diff. The requested dev pin is sha-c005fea; no go/deployment-operator/pkg/agentrun-harness path is involved. The separate GitOps pin PR is https://github.com/pluralsh/plrl-dev-aws/pull/297.

[JohnBlackwell]

plural deploy to dev

[floreks]

Acknowledged. I verified PR #4112 at head 45b24178809406c63dc5b14d213d62e492d1d152 against the GitOps deployment rules in plrl-dev-aws (main). None of the three changed paths matches a deployment mapping in bootstrap/core/console.yaml or bootstrap/agents/runtimes, so no image field should be set to sha-45b2417. The GitOps worktree is clean; no GitOps PR is warranted.