Add Slack support to Execution Policy API

.generator/schemas/v2/openapi.yaml

@@ -42088,12 +42088,14 @@ components:
         - INTEGRATION_KUBERNETES
         - INTEGRATION_SCRIPT
         - INTEGRATION_REMOTE_ACTION
+        - INTEGRATION_SLACK
       example: INTEGRATION_SCRIPT
       type: string
       x-enum-varnames:
         - INTEGRATION_KUBERNETES
         - INTEGRATION_SCRIPT
         - INTEGRATION_REMOTE_ACTION
+        - INTEGRATION_SLACK
     ExecutionPolicyKubernetesScope:
       description: Restricts the policy to specific Kubernetes namespaces.
       properties:
@@ -42216,16 +42218,18 @@ components:
       type: object
     ExecutionPolicyScope:
       description: |-
-        Restricts where the policy applies. At most one of `kubernetes`, `scripts`,
-        or `remote_action_rshell` can be set. An empty object means the policy has
-        no scope restriction.
+        Restricts where the policy applies. At most one scope type can be set,
+        and it must match the action pattern's integration. An empty object means
+        the policy has no scope restriction.
       properties:
         kubernetes:
           $ref: "#/components/schemas/ExecutionPolicyKubernetesScope"
         remote_action_rshell:
           $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellScope"
         scripts:
           $ref: "#/components/schemas/ExecutionPolicyScriptScope"
+        slack:
+          $ref: "#/components/schemas/ExecutionPolicySlackScope"
       type: object
     ExecutionPolicyScriptScope:
       description: Restricts the policy to specific scripts.
@@ -42251,11 +42255,43 @@ components:
       required:
         - target_script_names
       type: object
+    ExecutionPolicySlackScope:
+      description: Restricts the policy to specific Slack private channel names.
+      properties:
+        rules:
+          description: The Slack scope rules.
+          items:
+            $ref: "#/components/schemas/ExecutionPolicySlackScopeRule"
+          minItems: 1
+          type: array
+      required:
+        - rules
+      type: object
+    ExecutionPolicySlackScopeRule:
+      description: A rule restricting a Slack scope to specific private channel names.
+      properties:
+        channel_name_selectors:
+          description: |-
+            The private channel name selectors this rule applies to. Selectors are lowercase private channel names
+            without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name.
+          example:
+            - "incident-*"
+          items:
+            maxLength: 80
+            minLength: 1
+            type: string
+          maxItems: 100
+          minItems: 1
+          type: array
+          uniqueItems: true
+      required:
+        - channel_name_selectors
+      type: object
     ExecutionPolicyTarget:
-      description: A target this policy is scoped to, expressed as a set of Agent tags.
+      description: A target this policy is scoped to, expressed as a set of tags.
       properties:
         agent_tags:
-          description: The Agent tags identifying the target.
+          description: The tags identifying the target.
           example:
             - "env:prod"
           items:
@@ -255987,9 +256023,8 @@ tags:
     name: Events
   - description: |-
       Execution policies control which actions Datadog Action Platform is allowed to run
-      against your infrastructure, and where. Each policy pairs an effect (allow or deny)
-      with a pattern of actions, and can scope that decision to specific Kubernetes
-      namespaces, scripts, or remote shell paths.
+      and where. Each policy pairs an effect (allow or deny) with a pattern of actions,
+      and can scope that decision to specific resources.
     name: Execution Policy
   - description: Create and manage experiments, metrics, subject types, SQL models, and protocols.
     name: Experiments

examples/v2/execution-policy/CreateExecutionPolicy_1868371302.rb

@@ -0,0 +1,25 @@
+# Create a Slack execution policy returns "Created" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.create_execution_policy".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::ExecutionPolicyAPI.new
+
+body = DatadogAPIClient::V2::ExecutionPolicyCreateRequest.new({
+  data: DatadogAPIClient::V2::ExecutionPolicyCreateRequestData.new({
+    type: DatadogAPIClient::V2::ExecutionPolicyType::EXECUTION_POLICY,
+    attributes: DatadogAPIClient::V2::ExecutionPolicyWriteAttributes.new({
+      name: "Cassette Execution Policy exampleexecutionpolicy",
+      effect: DatadogAPIClient::V2::ExecutionPolicyEffect::ALLOW,
+      action_pattern: DatadogAPIClient::V2::ExecutionPolicyActionPattern.new({
+        integration: DatadogAPIClient::V2::ExecutionPolicyIntegration::INTEGRATION_SLACK,
+        action_fqns: [
+          "com.datadoghq.slack.*",
+        ],
+      }),
+    }),
+  }),
+})
+p api_instance.create_execution_policy(body)

examples/v2/execution-policy/CreateExecutionPolicy_3240435177.rb

@@ -0,0 +1,44 @@
+# Create a Slack execution policy with scope and targets returns "Created" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.create_execution_policy".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::ExecutionPolicyAPI.new
+
+body = DatadogAPIClient::V2::ExecutionPolicyCreateRequest.new({
+  data: DatadogAPIClient::V2::ExecutionPolicyCreateRequestData.new({
+    type: DatadogAPIClient::V2::ExecutionPolicyType::EXECUTION_POLICY,
+    attributes: DatadogAPIClient::V2::ExecutionPolicyWriteAttributes.new({
+      name: "Cassette Execution Policy exampleexecutionpolicy",
+      effect: DatadogAPIClient::V2::ExecutionPolicyEffect::ALLOW,
+      action_pattern: DatadogAPIClient::V2::ExecutionPolicyActionPattern.new({
+        integration: DatadogAPIClient::V2::ExecutionPolicyIntegration::INTEGRATION_SLACK,
+        action_fqns: [
+          "com.datadoghq.slack.*",
+        ],
+      }),
+      scope: DatadogAPIClient::V2::ExecutionPolicyScope.new({
+        slack: DatadogAPIClient::V2::ExecutionPolicySlackScope.new({
+          rules: [
+            DatadogAPIClient::V2::ExecutionPolicySlackScopeRule.new({
+              channel_name_selectors: [
+                "incident-*",
+              ],
+            }),
+          ],
+        }),
+      }),
+      targets: [
+        DatadogAPIClient::V2::ExecutionPolicyTarget.new({
+          name: "Incident workspace",
+          agent_tags: [
+            "slack_workspace_id:T01234567",
+          ],
+        }),
+      ],
+    }),
+  }),
+})
+p api_instance.create_execution_policy(body)

examples/v2/execution-policy/ListExecutionPolicies_4120778561.rb

@@ -0,0 +1,14 @@
+# List execution policies filtered by Slack returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.list_execution_policies".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::ExecutionPolicyAPI.new
+opts = {
+  filter_integration: [
+    ExecutionPolicyIntegration::INTEGRATION_SLACK,
+  ],
+}
+p api_instance.list_execution_policies(opts)

examples/v2/execution-policy/UpdateExecutionPolicy_2851872075.rb

@@ -0,0 +1,48 @@
+# Update an execution policy to Slack with scope and targets returns "OK" response
+
+require "datadog_api_client"
+DatadogAPIClient.configure do |config|
+  config.access_token = ENV["DD_BEARER_TOKEN"]
+  config.unstable_operations["v2.update_execution_policy".to_sym] = true
+end
+api_instance = DatadogAPIClient::V2::ExecutionPolicyAPI.new
+
+# there is a valid "execution_policy" in the system
+EXECUTION_POLICY_DATA_ID = ENV["EXECUTION_POLICY_DATA_ID"]
+
+body = DatadogAPIClient::V2::ExecutionPolicyUpdateRequest.new({
+  data: DatadogAPIClient::V2::ExecutionPolicyUpdateRequestData.new({
+    id: EXECUTION_POLICY_DATA_ID,
+    type: DatadogAPIClient::V2::ExecutionPolicyType::EXECUTION_POLICY,
+    attributes: DatadogAPIClient::V2::ExecutionPolicyWriteAttributes.new({
+      name: "Cassette Execution Policy Updated",
+      effect: DatadogAPIClient::V2::ExecutionPolicyEffect::DENY,
+      action_pattern: DatadogAPIClient::V2::ExecutionPolicyActionPattern.new({
+        integration: DatadogAPIClient::V2::ExecutionPolicyIntegration::INTEGRATION_SLACK,
+        action_fqns: [
+          "*",
+        ],
+      }),
+      scope: DatadogAPIClient::V2::ExecutionPolicyScope.new({
+        slack: DatadogAPIClient::V2::ExecutionPolicySlackScope.new({
+          rules: [
+            DatadogAPIClient::V2::ExecutionPolicySlackScopeRule.new({
+              channel_name_selectors: [
+                "incident-denied",
+              ],
+            }),
+          ],
+        }),
+      }),
+      targets: [
+        DatadogAPIClient::V2::ExecutionPolicyTarget.new({
+          name: "Incident workspace",
+          agent_tags: [
+            "slack_workspace_id:T01234567",
+          ],
+        }),
+      ],
+    }),
+  }),
+})
+p api_instance.update_execution_policy(EXECUTION_POLICY_DATA_ID, body)

features/v2/execution_policy.feature

@@ -1,16 +1,51 @@
 @endpoint(execution-policy) @endpoint(execution-policy-v2)
 Feature: Execution Policy
   Execution policies control which actions Datadog Action Platform is
-  allowed to run against your infrastructure, and where. Each policy pairs
-  an effect (allow or deny) with a pattern of actions, and can scope that
-  decision to specific Kubernetes namespaces, scripts, or remote shell
-  paths.
+  allowed to run and where. Each policy pairs an effect (allow or deny) with
+  a pattern of actions, and can scope that decision to specific resources.
 
   Background:
     Given a valid "apiKeyAuth" key in the system
     And a valid "appKeyAuth" key in the system
     And an instance of "ExecutionPolicy" API
 
+  @team:ddoghq/action-platform
+  Scenario: Create a Slack execution policy returns "Created" response
+    Given operation "CreateExecutionPolicy" enabled
+    And new "CreateExecutionPolicy" request
+    And body with value {"data": {"type": "execution_policy", "attributes": {"name": "Cassette Execution Policy {{ unique_lower_alnum }}", "effect": "allow", "action_pattern": {"integration": "INTEGRATION_SLACK", "action_fqns": ["com.datadoghq.slack.*"]}}}}
+    When the request is sent
+    Then the response status is 201 Created
+    And the response "data.attributes.action_pattern.integration" is equal to "INTEGRATION_SLACK"
+    And the response "data.attributes.targets" is equal to []
+
+  @skip-python @skip-ruby @team:ddoghq/action-platform
+  Scenario: Create a Slack execution policy with empty channel selectors returns "Bad Request" response
+    Given operation "CreateExecutionPolicy" enabled
+    And new "CreateExecutionPolicy" request
+    And body with value {"data": {"type": "execution_policy", "attributes": {"name": "Cassette Execution Policy {{ unique_lower_alnum }}", "effect": "allow", "action_pattern": {"integration": "INTEGRATION_SLACK", "action_fqns": ["com.datadoghq.slack.*"]}, "scope": {"slack": {"rules": [{"channel_name_selectors": []}]}}}}}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @team:ddoghq/action-platform
+  Scenario: Create a Slack execution policy with mismatched scope returns "Bad Request" response
+    Given operation "CreateExecutionPolicy" enabled
+    And new "CreateExecutionPolicy" request
+    And body with value {"data": {"type": "execution_policy", "attributes": {"name": "Cassette Execution Policy {{ unique_lower_alnum }}", "effect": "allow", "action_pattern": {"integration": "INTEGRATION_SLACK", "action_fqns": ["com.datadoghq.slack.*"]}, "scope": {"scripts": {"rules": [{"target_script_names": ["restart_service.sh"]}]}}}}}
+    When the request is sent
+    Then the response status is 400 Bad Request
+
+  @team:ddoghq/action-platform
+  Scenario: Create a Slack execution policy with scope and targets returns "Created" response
+    Given operation "CreateExecutionPolicy" enabled
+    And new "CreateExecutionPolicy" request
+    And body with value {"data": {"type": "execution_policy", "attributes": {"name": "Cassette Execution Policy {{ unique_lower_alnum }}", "effect": "allow", "action_pattern": {"integration": "INTEGRATION_SLACK", "action_fqns": ["com.datadoghq.slack.*"]}, "scope": {"slack": {"rules": [{"channel_name_selectors": ["incident-*"]}]}}, "targets": [{"name": "Incident workspace", "agent_tags": ["slack_workspace_id:T01234567"]}]}}}
+    When the request is sent
+    Then the response status is 201 Created
+    And the response "data.attributes.action_pattern.integration" is equal to "INTEGRATION_SLACK"
+    And the response "data.attributes.scope.slack.rules" is equal to [{"channel_name_selectors": ["incident-*"]}]
+    And the response "data.attributes.targets" is equal to [{"name": "Incident workspace", "agent_tags": ["slack_workspace_id:T01234567"]}]
+
   @team:ddoghq/action-platform
   Scenario: Create an execution policy returns "Bad Request" response
     Given operation "CreateExecutionPolicy" enabled
@@ -69,6 +104,14 @@ Feature: Execution Policy
     When the request is sent
     Then the response status is 200 OK
 
+  @team:ddoghq/action-platform
+  Scenario: List execution policies filtered by Slack returns "OK" response
+    Given operation "ListExecutionPolicies" enabled
+    And new "ListExecutionPolicies" request
+    And request contains "filter[integration]" parameter with value ["INTEGRATION_SLACK"]
+    When the request is sent
+    Then the response status is 200 OK
+
   @team:ddoghq/action-platform
   Scenario: List execution policies returns "Bad Request" response
     Given operation "ListExecutionPolicies" enabled
@@ -129,3 +172,17 @@ Feature: Execution Policy
     And body with value {"data": {"id": "{{ execution_policy.data.id }}", "type": "execution_policy", "attributes": {"name": "Cassette Execution Policy Updated", "effect": "allow", "action_pattern": {"integration": "INTEGRATION_SCRIPT", "action_fqns": ["com.datadoghq.script.*"]}}}}
     When the request is sent
     Then the response status is 200 OK
+
+  @team:ddoghq/action-platform
+  Scenario: Update an execution policy to Slack with scope and targets returns "OK" response
+    Given there is a valid "execution_policy" in the system
+    And operation "UpdateExecutionPolicy" enabled
+    And new "UpdateExecutionPolicy" request
+    And request contains "policy_id" parameter from "execution_policy.data.id"
+    And body with value {"data": {"id": "{{ execution_policy.data.id }}", "type": "execution_policy", "attributes": {"name": "Cassette Execution Policy Updated", "effect": "deny", "action_pattern": {"integration": "INTEGRATION_SLACK", "action_fqns": ["*"]}, "scope": {"slack": {"rules": [{"channel_name_selectors": ["incident-denied"]}]}}, "targets": [{"name": "Incident workspace", "agent_tags": ["slack_workspace_id:T01234567"]}]}}}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "data.attributes.effect" is equal to "deny"
+    And the response "data.attributes.action_pattern.integration" is equal to "INTEGRATION_SLACK"
+    And the response "data.attributes.scope.slack.rules" is equal to [{"channel_name_selectors": ["incident-denied"]}]
+    And the response "data.attributes.targets" is equal to [{"name": "Incident workspace", "agent_tags": ["slack_workspace_id:T01234567"]}]

generated-test/test-runner-data/manifest.json

@@ -5502,6 +5502,34 @@
       "scenario": "Search events returns \"OK\" response with pagination",
       "version": "v2"
     },
+    {
+      "feature": "Execution Policy",
+      "feature_file": "../../features/v2/execution_policy.feature",
+      "file": "v2/execution-policy/create-a-slack-execution-policy-returns-created-response.json",
+      "scenario": "Create a Slack execution policy returns \"Created\" response",
+      "version": "v2"
+    },
+    {
+      "feature": "Execution Policy",
+      "feature_file": "../../features/v2/execution_policy.feature",
+      "file": "v2/execution-policy/create-a-slack-execution-policy-with-empty-channel-selectors-returns-bad-request-response.json",
+      "scenario": "Create a Slack execution policy with empty channel selectors returns \"Bad Request\" response",
+      "version": "v2"
+    },
+    {
+      "feature": "Execution Policy",
+      "feature_file": "../../features/v2/execution_policy.feature",
+      "file": "v2/execution-policy/create-a-slack-execution-policy-with-mismatched-scope-returns-bad-request-response.json",
+      "scenario": "Create a Slack execution policy with mismatched scope returns \"Bad Request\" response",
+      "version": "v2"
+    },
+    {
+      "feature": "Execution Policy",
+      "feature_file": "../../features/v2/execution_policy.feature",
+      "file": "v2/execution-policy/create-a-slack-execution-policy-with-scope-and-targets-returns-created-response.json",
+      "scenario": "Create a Slack execution policy with scope and targets returns \"Created\" response",
+      "version": "v2"
+    },
     {
       "feature": "Execution Policy",
       "feature_file": "../../features/v2/execution_policy.feature",
@@ -5551,6 +5579,13 @@
       "scenario": "Get an execution policy returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Execution Policy",
+      "feature_file": "../../features/v2/execution_policy.feature",
+      "file": "v2/execution-policy/list-execution-policies-filtered-by-slack-returns-ok-response.json",
+      "scenario": "List execution policies filtered by Slack returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Execution Policy",
       "feature_file": "../../features/v2/execution_policy.feature",
@@ -5593,6 +5628,13 @@
       "scenario": "Update an execution policy returns \"OK\" response",
       "version": "v2"
     },
+    {
+      "feature": "Execution Policy",
+      "feature_file": "../../features/v2/execution_policy.feature",
+      "file": "v2/execution-policy/update-an-execution-policy-to-slack-with-scope-and-targets-returns-ok-response.json",
+      "scenario": "Update an execution policy to Slack with scope and targets returns \"OK\" response",
+      "version": "v2"
+    },
     {
       "feature": "Experiments",
       "feature_file": "../../features/v2/experiments.feature",