feat(slack): answer the order nudge in Slack, without opening the app

Being sent to a web app to answer "was this shared?" is enough friction
that the question stops getting answered — which is the exact failure the
nudge exists to prevent. So the buttons now act in place: pressing
"Shared 50/50" writes the transaction_splits row and edits the message,
and the app is never opened.

Slack does NOT reach this route directly. It posts to an n8n webhook that
forwards the raw body and signature headers here (user's suggestion).
That is the better shape: n8n already terminates public webhooks, so the
app keeps its blanket OAuth chain and gains no internet-facing
unauthenticated route, and no Traefik change is needed. n8n cannot verify
the signature itself — its Code sandbox has no `require`, so no `crypto`.

Two independent gates, both failing closed: the shared x-ingest-token
(came from n8n) and Slack's v0 signature over the raw body (came from
Slack, not replayed within 5 minutes). An unset signing secret rejects
everything rather than waving it through, because the alternative turns a
misconfigured deploy into an open write endpoint.

An unmapped Slack user is refused rather than defaulted to the owner. In
a two-person household a wrong attribution is not a rounding error, it is
the other person's opinion recorded under your name.

Block Kit is built in the app (ingest returns slack_blocks) rather than
in n8n expressions: a template string is untestable, and this shape has
to stay in step with what the interactive endpoint re-renders after each
press. Null when there is no transaction yet — a card-settled order is
parked until its statement arrives, so there is nothing to split or rate.

Also: /transactions now honours ?q=, so the link lands on the row instead
of the top of an unfiltered ledger.

src/lib/slack-blocks.ts

@@ -0,0 +1,95 @@
+import { RATINGS, type Rating } from "@/lib/order-reviews";
+
+/**
+ * The order nudge as Block Kit, so the answer happens IN Slack.
+ *
+ * A link to the app was the first version and it was the wrong shape: being
+ * sent to a web app to answer "was this shared?" is enough friction that the
+ * question stops getting answered, which is the whole failure the nudge exists
+ * to prevent (user, 2026-07-28).
+ *
+ * Buttons carry `<transactionId>:<verb>` in `value`. The transaction id has to
+ * travel in the payload because Slack gives the handler nothing else to
+ * identify the row — the message text is not a key.
+ */
+
+export interface NudgeState {
+  transactionId: number;
+  merchant: string;
+  currency: string;
+  total: number;
+  isFamily?: boolean;
+  shared: boolean;
+  /** Ratings already recorded, as participant name → rating. */
+  ratings?: { name: string; rating: Rating }[];
+  warn?: boolean;
+  warnNote?: string | null;
+}
+
+const RATING_LABEL: Record<Rating, string> = {
+  loved: "Loved it",
+  liked: "Liked it",
+  ok: "OK",
+  never: "Never again",
+};
+
+export function nudgeBlocks(s: NudgeState) {
+  const lines = [
+    `:receipt: *${s.merchant}* — ${s.currency} ${s.total.toFixed(2)}` +
+      (s.isFamily ? "  ·  [Family]" : ""),
+  ];
+  if (s.warn) {
+    lines.push(
+      `:warning: You marked this merchant *never again* before` +
+        (s.warnNote ? ` — _${s.warnNote}_` : "")
+    );
+  }
+  if (s.ratings?.length) {
+    lines.push(s.ratings.map((r) => `${r.name}: *${RATING_LABEL[r.rating]}*`).join("   ·   "));
+  }
+
+  return [
+    { type: "section", text: { type: "mrkdwn", text: lines.join("\n") } },
+    {
+      type: "actions",
+      block_id: "share",
+      elements: [
+        {
+          type: "button",
+          action_id: "share_toggle",
+          // The label states what pressing it will DO, not the current state.
+          // A button labelled with its own state reads as already-pressed and
+          // gets tapped to "fix" it, toggling the thing it was reporting.
+          text: {
+            type: "plain_text",
+            text: s.shared ? "Make it just me" : "Shared 50/50",
+          },
+          style: s.shared ? undefined : "primary",
+          value: `${s.transactionId}:share`,
+        },
+      ],
+    },
+    {
+      type: "actions",
+      block_id: "rate",
+      elements: RATINGS.map((r) => ({
+        type: "button",
+        action_id: `rate_${r}`,
+        text: { type: "plain_text", text: RATING_LABEL[r] },
+        style: r === "never" ? "danger" : undefined,
+        value: `${s.transactionId}:rate:${r}`,
+      })),
+    },
+    {
+      type: "context",
+      elements: [
+        {
+          type: "mrkdwn",
+          text: s.shared
+            ? ":busts_in_silhouette: Split 50/50 — both verdicts welcome"
+            : ":bust_in_silhouette: Not shared",
+        },
+      ],
+    },
+  ];
+}

src/lib/slack-verify.ts

@@ -0,0 +1,60 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/**
+ * Slack request signature verification.
+ *
+ * This endpoint is the one route in the app that is NOT behind Traefik's OAuth
+ * chain — it has to be, because Slack posts to it as a machine with no browser
+ * session. The signature IS the authentication, so it is not optional and it
+ * fails closed: an unset signing secret rejects everything rather than waving
+ * requests through, which is the failure mode that would quietly expose split
+ * writes to the open internet.
+ *
+ * The v0 scheme signs `v0:<timestamp>:<raw body>`. It must be the RAW body —
+ * re-serialising the parsed form changes the bytes and every signature fails.
+ */
+export function verifySlackSignature(
+  rawBody: string,
+  timestamp: string | null,
+  signature: string | null
+): boolean {
+  const secret = process.env.SLACK_SIGNING_SECRET;
+  if (!secret || !timestamp || !signature) return false;
+
+  // Replay window. Slack recommends 5 minutes; a captured request is otherwise
+  // valid forever, and these actions move money between people.
+  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
+  if (!Number.isFinite(age) || age > 300) return false;
+
+  const expected =
+    "v0=" +
+    createHmac("sha256", secret)
+      .update(`v0:${timestamp}:${rawBody}`)
+      .digest("hex");
+
+  const a = Buffer.from(expected);
+  const b = Buffer.from(signature);
+  // timingSafeEqual throws on length mismatch, which is itself a leak of one
+  // bit; check length first and return the same false either way.
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+/**
+ * Which participant pressed the button.
+ *
+ * SLACK_USER_MAP is `<slack user id>:<participant id>` pairs, comma separated.
+ * An unknown Slack user is rejected rather than defaulted to the owner: in a
+ * two-person household a wrong attribution is not a rounding error, it is the
+ * other person's opinion recorded under your name.
+ */
+export function participantForSlackUser(slackUserId: string): number | null {
+  const map = process.env.SLACK_USER_MAP ?? "";
+  for (const pair of map.split(",")) {
+    const [slack, participant] = pair.split(":").map((s) => s.trim());
+    if (slack && slack === slackUserId && participant) {
+      const id = Number(participant);
+      if (Number.isInteger(id)) return id;
+    }
+  }
+  return null;
+}