ec1016a9a63da65998b75f35b6ceb3bb

Javascript junkie, technology enthusiast, tinkerer. Currently Technical Evangelist at Auth0 (https://auth0.com ). I like to learn new things and share that knowledge at conferences.

Technical Evangelist

Joel Lord

When I moved to my new building, I needed a way to get my enterphone to work with my cell phone. This is how I made this work using Nexmo and Webtask.



I’ve recently moved to Toronto. Moving to the big city meant for me to move from a house into a condo tower. For the first time, I actually had an Enterphone to let my guests into the building.

I moved here from the Ottawa area, which meant that my old phone number is technically a long-distance call. Now I didn’t want to change my phone number because I have 2FA enabled on most of my web accounts that will let me use it. Long distance fees don’t really exist on cell phones anymore but the problem is that the system they use for the Enterphone in my building cannot dial long distance numbers.

Another limitation that the system had is that we can only have one entry in the system. While this is usually okay for most people, between my work as a technical evangelist and my wife who is a flight attendant, there are many times when there is only one of us at home.

With all of that in mind, our building manager suggested that we get a basic landline that we could use only for the Enterphone.

Sure, but what’s the fun in that?

## Introducing Nexmo

I’ve had the chance to meet the Nexmo folks at various conferences throughout the year so this felt like the perfect occasion to take their platform for a spin.

[Nexmo’s platform](https://www.nexmo.com/) provides a comprehensive set of tools and experiences that allows developers to programmatically control a virtual phone number that is assigned to your account. From there, you can make calls, send SMS messages or, most importantly, control what to do when a call is received.

My first idea was to build a website where I could decide which number the calls from the Enterphone would be forwarded to. I didn’t find any real easy way to do this. Furthermore, it added the complexity of having to change the person the calls were forwarded to each time my wife or myself were either coming back from a trip or leaving for work.

I finally stumbled on a way to create conversations, essentially a conference call. I decided to build a serverless function that would answer the calls to my Nexmo number. If the person calling that number was the Enterphone, I would dial in both my cell phone and my wife’s and get everyone in a conference call. This way, we would both get called and either one of us would be able to open the door for our guests.

## Setting Up the Serverless Endpoint

Because I didn’t want to be bothered with any server setup whatsoever, I decided to use [Webtask.io](https://webtask.io/), a platform that allows you to build serverless endpoints, also known as functions as a service. This made it simple for me to build a quick Node.js function that would answer my call.

I went ahead and created my Webtask. I then copied the URL for this serverless endpoint and pasted it as my “Answer URL” in my Nexmo application.

While I was in my Nexmo dashboard, I copied the following: 

* API key
* API secret
* Application ID
* Private key 

as constants in my Webtask. I also added a constant for the Webtask as I will be using this later in the code. Finally, I also added a bunch of phone numbers as constants just to make my code easier to read afterward. The phone numbers involved were my own cell phone (JOEL_NUMBER), my wife’s phone (NATACHA_NUMBER), the Enterphone (ENTERPHONE_NUMBER) and finally my Nexmo virtual number (NEXMO_NUMBER).

```javascript
const API_KEY = "APIKEY";
const API_SECRET = "SECRET";
const APP_ID = "APPID";

const JOEL_NUMBER = "12345678901";
const NATACHA_NUMBER = "12345678901";
const NEXMO_NUMBER = "12345678901";
const ENTERPHONE_NUMBER = "12345678901";

const ANSWER_URL = "https://wt-13aebf4eeaa9913542725d4a90e4d49e-0.sandbox.auth0-extend.com/enterphone-inbound";

const PRIVATE_KEY_CONTENTS = "-----BEGIN PRIVATE KEY-----" + "..." + "-----END PRIVATE KEY-----";

module.exports = function(context, cb) {

  cb(null, resp);
};
```

> Note: I’ve used my private key directly in the code here for the sake of simplicity but it should be stored on a server and this should be the URL for the file itself.

## Handling the Call

Now that all my constants are defined, it’s time to write the code that will handle the calls. In order to create a conversation, I can use [NCCO (Nexmo Call Control Object)](https://developer.nexmo.com/voice/voice-api/guides/ncco). NCCO are the instructions that are returned to the Nexmo API in JSON format.

When a call comes into the virtual number, I can return the following JSON from my Webtask to create a conference call.

```javascript
module.exports = function(context, cb) {
  let ncco = [];
  
  ncco.push({
    "action": "conversation",
    "name": "enterphone"
  });

  cb(null, ncco);
};
```

Now everyone that dials into this number will be connected to the conversation called “enterphone”. That could work if I knew that someone was coming but I would need to be connected to the conference number at all times. This was not very convenient for what I was trying to accomplish.

The next step was to verify who was calling. If it was the Enterphone, it would call both cell phones from the Nexmo virtual number. This way, when they answer, they are connected to the conference call. In order to call the numbers, I used the npm library for the [Nexmo API](https://www.npmjs.com/package/nexmo). At the top of my Webtask, I imported the npm module.

```javascript
const Nexmo = require('nexmo');
```

I also added the module to my Webtask from the “NPM Modules” section of the settings.

Then, in my main function, I added the code to call the two numbers.

```javascript
nexmo.calls.create({
    to: [{
      type: 'phone',
      number: JOEL_NUMBER
    }],
    from: {
      type: 'phone',
      number: NEXMO_NUMBER
    },
    answer_url: [ANSWER_URL]
  });
```

Because the configuration to call both numbers was exactly the same for our two cell phones (apart from the number, obviously), I added a quick helper function that would generate the configuration object:

```javascript
function callOptions(number) {
  return {
    to: [{
      type: 'phone',
      number: number
    }],
    from: {
      type: 'phone',
      number: NEXMO_NUMBER
    },
    machine_detection: "hangup",
    answer_url: [ANSWER_URL]
  }
}
```

I then added the code to call our two numbers:

```javascript
nexmo.calls.create(callOptions(JOEL_NUMBER));
nexmo.calls.create(callOptions(NATACHA_NUMBER));
```

## Testing My Setup

When I tested this call, I realized that I had sent the whole system into an infinite loop. Each time it called one of the two numbers, the serverless function would dial the two numbers again, which would then call the two numbers and so on… I ended up filling up my voicemail with messages of my own voicemail asking me to leave a message.

In order to fix this issue, I needed to change this code so that it would only call the two cell phones when the call was from the Enterphone. My code now looked like this:

```javascript
const Nexmo = require('nexmo');

// Define numbers

// Define API keys

// Define Answer URL

function callOptions(number) {
  return {
    to: [{
      type: 'phone',
      number: number
    }],
    from: {
      type: 'phone',
      number: NEXMO_NUMBER
    },
    answer_url: [ANSWER_URL]
  }
}

module.exports = function(context, cb) {

  let ncco = [];
  
  // When the enterphone calls this number, dial in Joel and Natacha
  if (context.data.from == ENTERPHONE_NUMBER) {
    const nexmo = new Nexmo({
      apiKey: API_KEY,
      apiSecret: API_SECRET,
      applicationId: APP_ID,
      privateKey: (PRIVATE_KEY_CONTENTS),
    });
    
    nexmo.calls.create(callOptions(JOEL_NUMBER));
    nexmo.calls.create(callOptions(NATACHA_NUMBER));
  }

  // In either case, go ahead add connect to the conference call
  ncco.push({
    "action": "conversation",
    "name": "enterphone"
  });

  cb(null, ncco);
};
```

## It Works, But…

The code now works. I was able to use this code on my virtual number to get my Enterphone to work. It calls both of our phone numbers and we are both able to dial “9” to unlock the front door. All of this was fairly easy and without a lot of configuration but now I had a few minor problems.

First, when one of us didn’t answer, the other phone’s voicemail would connect to the conference call and record the conversation and about a minute of silence. It was also weird to hear the “Hi, you’ve reached the voicemail of Joel” in the Enterphone.

The other issue we had was with the time it took to actually initiate the conference call. It took a few seconds to initiate the call from the Enterphone, then the Nexmo virtual number would silently answer and dial us in, and then we would answer after a few rings. All of this lead up to having about 30 seconds of silence before someone actually answered the Enterphone. Surely we can do better.

## Avoiding the Voicemail

During my latest conference, I actually ran into one of the developer advocates from Nexmo. It turns out that avoiding the voicemail is actually quite simple. All I had to do was to add an option to my `nexmo.call.create` method. Because I am using a helper function for this, it was just a matter of adding this:

```javascript
machine_detection: "hangup",
```

...into the object that is returned by the `callOptions` function. This tells Nexmo to hang up when it detects that whatever answers the call is a machine. 

Problem fixed!

## Fixing That Long Wait

All of that waiting is a little bit awkward when you dial the Enterphone and you just stand there in the entrance. But there is not much we can do, right? All of those waiting times are kind of a necessary evil. 

It’s always about the perception. That wait only feels long because you look at a blank screen, listening to some silence. In order to help with this, I added a new item to my NCCO. When the number calling in is the Enterphone, I added the following:

```javascript
ncco.push({
  "action": "talk",
  "text": "Calling Joel and Natacha"
});
```

This way, the person waiting downstairs actually hears the Enterphone say something before it calls our cell phones. It definitely helps with the sense of, “Is something happening?”.

## A Little Bonus

As I was working on this code, I got a spam call to the number that is connected to my Enterphone. Those are so annoying. Now if I had a landline, there wouldn’t be much I could do about it. But thanks to the magic of the Internet and with a little bit of JavaScript, I simply check who the caller is and reject the calls right at the beginning of my function:

```javascript
let authorizedNumbers = [NEXMO_NUMBER, JOEL_NUMBER, NATACHA_NUMBER, ENTERPHONE_NUMBER];
  if (authorizedNumbers.indexOf(context.data.from) == -1) {
    // Spam caller ! Abort !
    return cb("Unauthorized number");
  }
```

So now, if a spam caller tries the number, it simply hangs up.

Here's an idea for a future project: connect the spammers to a machine learning algorithm and a conversational interface that will mislead them into a conversation that would last as long as possible to waste their time.

## In Summary

The Nexmo API is very easy to use and made all of this call management possible with very minimal configuration. I was able to use Webtask to easily create a serverless function and to use JavaScript, which I am familiar with. The two together worked like a charm. Most importantly, I now have a working Enterphone and both myself or my wife can unlock the building front door, even when we are not at home.

<include src="asides/AboutAuth0" />

---


Getting My Enterphone to Work with Nexmo and Webtask.io

eaeac922b9f3cc9fd18cb9629b9e79f6?s=80 avatar

eaeac922b9f3cc9fd18cb9629b9e79f6?s=80

Guest Author

Daniel James

Learn how to use Auth0 Webtasks to build a twitter bot that pulls data from Data.gov and does sentiment analysis



# I built a Twitter bot using Auth0 Webtasks and Data.gov

I wanted to build something small, fun, and socially-engaging. I have been following [Darius Kazemi][kazemi-website] ([@TinySubversions][kazemi-twitter]) and the community of bot makers at [Botwiki][botwiki-website] ([@Botwikidotorg][botwiki-twitter]), and I decided a Twitter bot was the way to go. I have also been following the US Executive Order 13792 pretty closely. The order directs the US Department of Interior to review whether to downsize "certain national monuments" or sell their oil and mineral rights for profit. The Department has an open ["Opportunity for Public Comment."][docket] I thought this would be a good chance to tinker with lightweight sentiment analysis of the public comments.

I needed a good place to host my small project, and Auth0's free [Webtask.io][webtask-io] offering turned out to be a great fit! I didn't want to sacrifice my time on infrastructure and hosting when I wanted to focus on this bot idea. I got to attend Glenn Block's Auth0 Webtasks workshop at .NET Fringe this year, and he fired me up to do this.

The [Auth0 Webtask.io Editor][webtask-io-editor] is nice, but I have a set of development tools I like. I also wanted to import npm modules to handle the sentiment analysis and Twitter posting. The Auth0 Webtasks CLI is perfect for this.

```bash
# Install the CLI globally
npm i -g wt-cli
# Log in to my Webtask.io account
wt-init
```

Next, I needed to set up my project in a new folder

```bash
# Use source control always
git init
# Create a package.json and fill in the basics
npm init
# Install modules that I'll need for this bot
npm install --save twitter sentence-tokenizer sentiment md5 node-fetch
```

I prefer writing ES6, so I'll be adding `'use latest'` to the top of my scripts. I want to split my logic into a couple of different modules, so I'll use the CLI to bundle my scripts (`-b`). While I'm hacking, I also want to have automatically update my webtask when I save, so I'll have the CLI watch for changes (`-w`). Finally, I have some API keys that I don't want to hard-code, so I'll create a file called `.secrets` to hold on to those for me. (And add `.secrets` to `.gitignore` so it doesn't accidentally get committed!)

```bash
wt create -b -w --secrets-file .secrets .
```

The first of my secrets to go in the `.secrets` file is my Data.gov API key. (It's free and [easy to sign up][data-gov] for, and provides access to other US government data besides Regulations.gov.) Next, I created a new Twitter account called [@EO13792Bot][eo13792bot-twitter] and created a [Twitter app][twitter-apps] for it. I copied the Consumer Key and Secret, and the Access Token and Secret into the `.secrets` file.

There are four distinct parts to this webtask:

* [Regulations.gov API client][regulations-gov-api-client]
* [Text analyzer][text-analyzer]
* [Comment selector and formatter][comment-selector-and-formatter]
* [Tweeter][tweeter]

The Regulations.gov API client exports a function to get the latest comments for a given docket. ([DOI-2017-0002][docket], in this case.) After testing requests against the API, it was necessary to add a timeout to `fetch`.

Source: [quoter/src/regulations-gov-api.js][regulations-gov-api-client]

```javascript
export default (apiKey, docketId, count) => new Promise((resolve, reject) => {
    fetch(`${baseUrl}/documents.json?api_key=${apiKey}&dktid=${docketId}&dct=PS&sb=postedDate&so=DESC&rpp=${count}`)
        .then(response => response.json())
        .then(page => page.documents)
        .then(resolve);

    setTimeout(reject.bind(null, {
        type: 'source-api-timeout'
    }), 25000);
})
```

The text analyzer exports a function to analyze a single comment. I found sentences with the most "negative" sentiment analysis score were [subjectively] the most interesting. I decided to use the most "negative" sentence from a comment as its "pull quote" candidate for tweeting. The text analyzer also hashes the comment to only consider identical "form letter" comments once.

Source: [quoter/src/analyzer.js][text-analyzer]

```javascript
export default (commentText) => {
  // The Tokenizer has a notion of words describing itself. Not used here.
  const tokenizer = new Tokenizer('unused', 'unused');
  tokenizer.setEntry(commentText);

  const pullQuote = tokenizer.getSentences()
    // Score each sentence
    .map(sentence => ({
      sentence,
      score: sentiment(sentence).score,
    }))
    // Select a single sentence with the most negative score and the longest character length
    .reduce((min, curr) => {
      const last = min || curr;
      return last.score < curr.score
        ? last
        : (
          last.sentence.length < curr.sentence.length ? curr : last
        );
    });
  
  // Hash the comment for duplication checks
  const hash = md5(tokenizer.getTokens().join(' '));

  return {
    pullQuote,
    hash,
  };
};
```

The [comment selector and formatter][comment-selector-and-formatter] exports a function that ultimately returns a single comment to tweet. It gets the comments from the Regulations.gov API client and maps each comment through the text analyzer. It takes in a list of hashes from previous tweets to exclude those comments. It also ensures that the pull quote can fit into a tweet.

The tweeter is the main body of the webtask. It initializes the Twitter client, gets the list of hashes out of the webtask context storage, and calls the comment selector and formatter to pick its tweet. Once it successfully tweets, the hash is added to the list in context storage.

Source: [quoter/src/index.js][tweeter]

```javascript
module.exports = (ctx, cb) => {
  const docketId = 'DOI-2017-0002';
  const apiKey = ctx.secrets.REGULATIONS_GOV_API_KEY;
  const backlogCount = 500;

  // Set up Twitter API client
  const client = new Twitter({
    consumer_key: ctx.secrets.TWITTER_CONSUMER_KEY,
    consumer_secret: ctx.secrets.TWITTER_CONSUMER_SECRET,
    access_token_key: ctx.secrets.TWITTER_ACCESS_TOKEN_KEY,
    access_token_secret: ctx.secrets.TWITTER_ACCESS_TOKEN_SECRET
  });

  // Get the context storage into `data`
  ctx.storage.get((error, data) => {
    const backlog = data || {};

    if (ctx.data.dump) {
      cb(null, backlog);
      return;
    }

    // Get a single comment to tweet
    getSingleComment(apiKey, docketId, backlogCount, backlog)
      // Then tweet it
      .then(document => {
        const status = `${document.tweet} ${document.targetUrl}`;
        return client.post('statuses/update', { status }).then(() => document);
      })
      // Then add the comment's hash to the context storage 
      .then(document => {
        backlog[document.hash] = true;
        backlog.lastError = null;
        // If something bad happened while saving to context storage, log it to STDERR and move on. No big deal.
        ctx.storage.set(backlog, console.error);
        return document;
      })
      // Then hit the webtask's callback and end this request
      .then(cb.bind(null, null))
      // If anything went wrong with the above, handle it
      .catch(err => {
        console.error('error', err);
        /* snip; Do some handling of specific errors */
      });
  })
}
```

Testing this work is as simple as hitting the webtask's endpoint in a browser. However, I wanted this to run on its own, checking for comments and tweeting every 10 minutes. I set up the webtask on a schedule with a simple change to the CLI command:

```bash
wt cron schedule -b --secrets-file .secrets 10m .
```

In order to make my code a little more usable by other developers and to save myself from having to remember all the switches for the CLI, I added two scripts to my `package.json` file. Also, I added `wt-cli` as a dev dependency.

Source: [quoter/package.json][package-file]

```json
"scripts": {
    "start": "wt create -w -b --secrets-file ../.secrets .",
    "publish": "wt cron schedule -b --secrets-file ../.secrets 10m ."
},
```

Now [@EO13792Bot][eo13792bot-twitter] is tweeting on its own! Following the bot has given me an insight into some of the 300,000 comments that people have made. And I'm ecstatic to spend my time hacking on my bot ideas and trust the infrastructure and hosting to Auth0!

I've made the source for [@EO13792Bot][eo13792bot-twitter] available on [GitHub][eo13792bot-website]. Take a peek!

[kazemi-website]: http://tinysubversions.com/
[kazemi-twitter]: https://twitter.com/tinysubversions
[botwiki-website]: https://botwiki.org/
[botwiki-twitter]: https://twitter.com/botwikidotorg
[docket]: https://www.regulations.gov/document?D=DOI-2017-0002-0001
[eo13792bot-website]: https://github.com/thzinc/eo13792bot
[eo13792bot-twitter]: https://twitter.com/eo13792bot
[twitter-apps]: https://apps.twitter.com/
[data-gov]: https://api.data.gov/signup/
[regulations-gov-api-client]: https://github.com/thzinc/eo13792bot/blob/master/quoter/src/regulations-gov-api.js
[text-analyzer]: https://github.com/thzinc/eo13792bot/blob/master/quoter/src/analyzer.js
[comment-selector-and-formatter]: https://github.com/thzinc/eo13792bot/blob/master/quoter/src/tweetUtils.js
[tweeter]: https://github.com/thzinc/eo13792bot/blob/master/quoter/src/index.js
[package-file]: https://github.com/thzinc/eo13792bot/blob/master/quoter/package.json
[webtask-io]: https://webtask.io/
[webtask-io-editor]: https://webtask.io/make


How I Built a Twitter Bot Using Auth0 Webtasks and Data.gov

71fb37b19e60e1b27a78dc91630dbb29

Alex Stanciu

A deep look at how we automated our employee access request system using Auth0 as the directory and Webtask for serverless last mile integration with our systems


## Automating Access Requests & Provisioning
_A deep look at how we automated our employee access request system_

> “Give me access to vpn”

This is all you need to tell our Slack bot; a request is created and your manager receives an approval request.

### Some Background
Granting users access to various resources is a challenge that many (if not most) organizations face. Unfortunately, many small/medium-sized companies find the cost of purchasing and operating monolithic provisioning systems prohibitive. User access often becomes a highly manual and messy process. Here at Auth0 we started out with a Google Form: employees would fill it out checking off various resources/apps they wanted access to. The form saved into a Google Sheet where a script would take each entry and create an Issue in a GitHub repository. Our IT team would then use the repo’s issues as a request tracking system and manually fulfill them.
There are a few problems with this approach:

- No approval mechanism
- No tracking, and no easy way to show what an employee has access to
- Very hard to automate
- Pretty bad UX

… so we decided to build something

## Goals
For our internal MVP, we wanted to at least address the above points, but also set ourselves up so this tool could grow:

- Provide an easy way to define resources (the things that people can request, for example: email distribution lists, building badges, access to AWS, GitHub, laptop, and VPNs, as well as work orders like “restore a backup” or “reset MFA”)
- Customizable, multi-step, dynamic approval workflows 
- Tracking/reporting to help our SOC2 audits
- Mechanism to setup automated fulfillment for things that can be automated (for ex, via APIs, automatically add a user to our GitHub organization)
- Frictionless UX: we are Slack bot junkies, so we knew this was a critical integration
- Architecture that will allow expansion
- Extendable: if someone wants to convert a resource from manual to automated fulfillment, it shouldn’t require changes to the app or redeployment
- Use this opportunity to explore any new technologies we’ve been watching/itching to play with

## End Result
After three months of on-the-side development, we launched our tool, code-named “Phenix” (no, it’s not misspelled).
![Phenix](https://images.ctfassets.net/23aumh6u8s0i/OSpKH5qrnboV0jXDlgCLa/470e00f1b6b8600931670fafb2c4e82b/phenix)

Let’s do a quick walkthrough of the basic flow. In this sample use case we’ll set up a resource to allow employees to request to be added to our Auth0 GitHub organization.

We first create the resource and specify a few options:
![Resource](https://images.ctfassets.net/23aumh6u8s0i/38KDHh0L4DMxsipMk91sR0/8d2e0c553ac793ea8040be78a198f958/resource)

For the rest of the resource, we configure a two-step serial approval workflow that includes Manager Approval and Security Team approval. 

For fulfillment, we’ll keep it manual for now and assign it to the Dev Ops group.

Resources also allow the creation of a custom form to capture data from the user at the time of request. We will use this to capture the user’s GitHub userid and a comment.
![Resource Tabs](https://images.ctfassets.net/23aumh6u8s0i/6AiN6btnQF400oa4L46st8/ef0df67416302a3992117a0d649a6c79/resource-fillout2)

Now that the resource is configured, let’s request it:
![Create Request](https://images.ctfassets.net/23aumh6u8s0i/2pZZRvy3HkZAcRAszzkLpg/9b94bb6c071f47d647b37856d321f6ca/create-request)

## Approvals
The above request will step through each stage of the approval process; if all stages are approved, the request will switch to fulfillment mode. If any stage is rejected, the approval process stops and the request is finished.

We configured an approval stage called Dynamic Approval for the Manager because each requester could have a different manager. We need to determine who the approver is at run-time, when the request is processing. We do this using the webtask platform. Setting the approval type as dynamic allows the creation of a webtask where the end user (the Administrator) can write custom code that figures out who the manager is.
![Dynamic Approval](https://images.ctfassets.net/23aumh6u8s0i/21EreRfb6flPav2l1PWSja/a70c177acb7d0542fef3a79e74d26dca/dynamic-approval)

Clicking Edit opens the webtask editor where we have simple code to retrieve the manager userid from the request beneficiary’s profile:
![Get Manager Webtask](https://images.ctfassets.net/23aumh6u8s0i/53cicumNduufCQTocCB8Tn/dcb98cb627e5b65023f785ab58fa5a89/get-manager-wt)

The manager info is saved in the Auth0 user’s `app_metadata` attribute; this is currently populated via an existing outside script that syncs our HR system with Auth0 profiles. If we didn’t have this data already in Auth0, this code would instead make an API call to our HR system (BambooHR) to get the user’s manager.

When the request is submitted, the approvers receive a ticket in their inbox representing a pending approval task. For the above request, since I am an admin, I will be able to see both approval tickets (for both the manager and security stages). I will approve both and then reject the fulfillment request. Normally these three steps would be performed by separate people
![Inbox - Approve Requests](https://images.ctfassets.net/23aumh6u8s0i/GKun89oDVrTgBWTv8FGyT/a0e9c1090ec562773b5e5bfb4b5db90b/inbox-approve)

We can see the final status of this request as:
![Final Request](https://images.ctfassets.net/23aumh6u8s0i/4GGFuqmQIJPKXRmwMxTY6V/fa3fcaf8755fbcf4b3606d9b692e76ac/final-request)

As you can see, for each stage it correctly shows who the intended approver/fulfiller was and who actually took the action. Great for our audit history!

## Slack
![Slack Approval](https://images.ctfassets.net/23aumh6u8s0i/50eLESbCPEwIhDKpf7ehsc/33dc2a199470066661f6f798aff8b39f/slack-approval)

When the approval tickets are created, the approvers also receive a message in Slack that they can approve or reject. If the approval is set to a group, we can create mappings of groups to Slack channels so only one message is posted in the group’s channel. The system ensures that only designated approvers are allowed to click the buttons (not everyone in the #devops channel is in the DevOps Group). 

We also wanted the ability to create requests from Slack.  This proved to be a bit more challenging in the end, but a ton of fun. 

This is what it looks like:
![Slack Request](https://images.ctfassets.net/23aumh6u8s0i/74iluPGFjW2YgBqKgDSeui/37713e91b29990cb1ac292e0fb5c68d0/create-request-slack)

It may not be immediately evident but there is a lot going on here.

First, the bot needs to keep track of different conversations, with different users, across different Slack teams. This is easy enough, but it also needs to keep track of _where_ in the conversation it is.

It accepts some built-in commands, like `help`, `list`, etc., but if someone says something like, “I need access to vpn”, this is not a built-in command. To make sense of this, we use [api.ai](https://api.ai)’s NLP services to process these kinds of phrases and detect if the user said something that matches making a request:

>“give [_user_] [_resource_]”

>“request [_resource_] for [_user_]”

>“I want access to [_resource_]”

>etc…

Once it detects that the user wants a resource and for whom (you can request things for other people, too), it then looks to see if that resource has a form defined. If so, we start a “conversation” with the user, progressively asking for the data in the form. 

The hard part here was keeping track of it all. With Slack bots, there is no inherent concept of a session, so we had to build this.  The bot could receive a message like “jdoe35” and it would need to figure out that user X, on team Y, is making a request for resource Z which has five form fields and this is the response to the third field, which we must have previously asked for (ex: “Enter your GitHub user id”). 

## Automating The Fulfillment
In the above example request for GitHub, the resource was configured for manual fulfillment. It means the designated fulfiller received a ticket representing the to-do item. They would manually do the work (add the user to our GitHub organization), and mark it as done.

To automate this, you can configure automated provisioning via a webtask. This is a very simple and straight-forward way to quickly call an API and get something done. In the Fulfillment tab of the resource, we can select “Webtask Auto Fulfillment”:
![Auto Fulfillment](https://images.ctfassets.net/23aumh6u8s0i/2aRfbUt5AMpunM2bSwzJF6/2ecec744f44e08a8a2b3a2cd221c3f1d/auto-fulfillment)

In the webtask code, we can grab the user’s GitHub userid from the form submitted with the request and make the API call:
![Auto Fulfill Webtask](https://images.ctfassets.net/23aumh6u8s0i/5cKuaOVtwSlrv0zBPVQFw6/9df73a1c0b08a965b7792a1b0f40a1de/auto-fulfill-wt)

Using the [webtask platform](https://webtask.io) for extensibility was a huge saver. We can let the administrators and end users customize the tool without burdening the development team. I wish every SaaS/Webapp had something like this, where, for example, you might be given a configuration choice between A or B, but maybe you want that to change depending on certain factors. The webtask platform allowed us to add this third option C to figure it out at runtime by running your own custom code. 

## Tracking
Now that a whole system is in place, it’s very easy to keep track of who has what and why. Below is a very crude interface that shows the basics, but the data is there and generating compliance reports is now trivial.

Building a lightweight certification mechanism on top of this would also be fairly straight-forward. (Certification is the process of periodically asking someone, usually a manager, if a user should still have access to X, thereby catching sensitive access that was only temporarily needed.)
![User Resource List](https://images.ctfassets.net/23aumh6u8s0i/5dU3ya3Mt3s2VKFc21dBpn/56923b5b34218f8fd182b424a7bd8720/user-resource-list)

## Engineering
From the start we wanted to design and engineer this application as if it might some-day become a product. This meant building it from the ground up with scaling, multi-tenancy, security and performance in mind. We also wanted to try out some new technologies and patterns.

The front end is a React, Single Page App. Nothing too fancy going on here beyond current modern standards and recommendations (code splitting, lazy loading, etc…)

We decided to try out GraphQL as the API interface. The data model fits pretty well for the use case. There are lots of joins happening in the data model and with GraphQL the client can get everything in one shot. 

To keep the API as light as possible, we split out the request processing and notification services into separate workers and handed them tasks via a queue.

The bot also follows this convention. We decided to not use Slack’s RTM API since it uses WebSockets, which come with different types of scaling problems. Instead, we use Slack’s Event API which functions like a webhook; we subscribe to chat messages and Slack does a POST to us with those messages. The trick here is that there could be many teams, with many channels, and if the bot is invited to very chatty channels, it will result in LOTS of POSTed messages from Slack.

_If the bot is in a channel (versus Direct Message), it only responds if called by name and it responds in a thread. This minimizes “bot-spam” in public channels._

To handle this, we have an extremely light-weight HTTP server that receives the POSTed message, replies back to Slack with a 200, and puts the data in a queue. A separate bot worker processes the messages and replies to the user. We use Redis to store the conversation sessions, so while making a request and answering questions, there could be many bot workers actually replying.

Speaking of Redis, we also have a fairly standard caching layer for things that don’t change that often (resources, groups, users, tenant settings, API tokens, etc…) we proxy those through a layer of Local Cache -> Redis -> Mongo. A solid caching strategy is especially important when using GraphQL.
![Component Architecture](https://images.ctfassets.net/23aumh6u8s0i/1UjhzXALFyO0NivWKAdsRt/20ff08968249cda32ea6cba8e8c71261/diagram)

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can help you make your product secure with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## Going Forward
In its current state, Phenix is a fairly solid access request platform with some light provisioning. We are planning to keep building on top of this to create a robust provisioning engine with full connector support that handles all types of CRUD operations against target systems. We are also building a reconciliation engine to sync data into the system from other sources. 

While Phenix is an internal tool for now, we are aware that it could be beneficial to others and we may decide to open it later. If you think something like this would be useful to your organization, or if you have any other thoughts or questions on this topic, please leave us a comment.


User Provisioning and Access Request with Auth0 and Webtask

a5878db74baa36ad0ae9cda759f9f2f8

Javier Centurion

We've just shipped a brand new editor for Webtask to go from 0 to code in seconds!


## Serverless Development Reimagined with the New Webtask Editor

If you are building serverless applications, then you want to get from zero to code in seconds. We've just shipped a brand new editor for Webtask which makes this desire a reality!

The Webtask Editor is a rich online environment for creating, editing and testing your Webtasks. In addition, it allows you to manage secrets, configure github two-way sync, view realtime logs, and more. It makes serverless development a breeze and you _never have to leave the browser or install anything to use it_. And with our out-of-the-box support for over 1000+ [Node modules](https://webtask.io/docs/modules?utm_source=auth0.com&utm_medium=blog&utm_campaign=webtask_editor_launch), you can get a lot of work done.

Let’s take a quick walkthrough of the experience.

## Creating a New Webtask
With the new editor, getting started can't get any easier. Just head to [webtask.io/make](https://webtask.io/make?utm_source=auth0.com&utm_medium=blog&utm_campaign=webtask_editor_launch), log in with your preferred credentials, and you'll be on your way. 

![Webtask Editor](https://images.ctfassets.net/23aumh6u8s0i/60cS0X3pZZqIkFYxNqA82I/7d4a4e2d45f2ecb51cea550e9f676292/screenshot)

From the popup dialog, you will see a few options:

- *Webtask*: this creates an empty webtask.
- *Cron*: this creates an empty scheduled webtask. 
- *Pick a template*: start coding based on selecting from a library of templates.
- *Import from GitHub*: import your code from a Github repo to a webtask.

### Webtask
Selecting "Webtask" will put you right into the editor where you can start authoring a new task.

![Create a Webtask](https://images.ctfassets.net/23aumh6u8s0i/7DNhJv22bem62OfkNLNCDY/609cf51bdc17b3056e647bcf88dbb997/new-webtask)

### Cron
Cron tasks are great for executing a task on a schedule, such as checking a Twitter feed for mentions. When you create a new cron task, you will see two panes. The left pane is the scheduler where you specify the schedule for your task and the right pane is where you put the code for your task. 

![Create a Cron with Auth0 Webtask](https://images.ctfassets.net/23aumh6u8s0i/aktaX2AvsI1rOz9eLbSZG/2794b8295c0ff1f180e24cc15d9773aa/new-cron)

For more info about cron, check [this document](https://webtask.io/docs/cron).

### Templates
Templates let you choose from a selection of starter code that you can use for building your tasks. We've included templates for integrating Webtask with common services like [Stripe](https://stripe.com), [Slack](https://slack.com), [Sendgrid](https://sendgrid.com), [Github](https://github.com), [Twilio](https://twilio.com), [Facebook](https://facebook.com), and many more. 

![Webtask Templates](https://images.ctfassets.net/23aumh6u8s0i/4ZgecL7OpNB1voK28SYpLH/2d526ba1ad9d0bc02e29ee3f04c7055a/templates)

### Importing from GitHub
If you have existing Webtasks in a repo, you can import them directly into Webtask by pointing to the repo.

## Editor Features
Now let's take a look at some of the awesome editor features.

### Runner and Logs
We've designed the new editor to streamline your development and allow you to iterate fast. To help with testing, the editor comes with an intergrated runner. In the runner you can set different HTTP methods, parameters, headers, etc. To help with debugging, we've added a realtime logs viewer that lets you view you tasks console output while it is executing.

![Webtask runner and logs](https://images.ctfassets.net/23aumh6u8s0i/7gBevZ4sa1qmi8C7NnBHLW/5dab3616501bb17f20a149ef55770ce1/runner)

### Secrets Management
If your tasks are talking to other authenticated services, you don't want to store credentials in the code. You can define new secure secrets right in the editor, which are then accessible from the code via the `context` object.

![Secrets management](https://images.ctfassets.net/23aumh6u8s0i/4tIT2Q38DvtD7hP0w7dE6z/698c9eada30c221733d8fb50910fec28/secrets)

### GitHub Integration
To take your experience up a notch, we've baked in Github integration support. This allows you to sync your webtask with a file in a Github repo. You can enable this to work bi-directionally, such that commits and pull requests to the repo result in the task automatically being deployed and any changes in the editor result in commits to the repo. You can also bind multiple tasks to different branches of the same repo, thus having dev, test, and prod versions of your tasks. It's super powerful!

![GitHub integration with Webtask](https://images.ctfassets.net/23aumh6u8s0i/70PeF2y7xmgj64x8XuU6Tr/5f1640d312490030496af901ed16ec95/github-integration)

### Task Management
Press `CMD + P` or click on the list or on the "Webtasks" icon and you'll see a list of all your tasks. From the list, you can switch to a different task, open a task in a different window, or even delete tasks. You can type into the search bar to filter the list of displayed tasks.

![Webtask Quicksearch](https://images.ctfassets.net/23aumh6u8s0i/013ieClwPQkwz7ZgygiQKT/94a6e743044be87d83bd432ec5bc75c9/quicksearch)

### Shortcuts
The new editor has tons of shortcuts for common actions within the editor as well as additional features like beautifying your code. You can see the list of shortcuts by clicking on the Shortcuts icon in the upper right corner.

![Webtask shortcuts](https://images.ctfassets.net/23aumh6u8s0i/5s8ULTLcTgcg0p459psONK/9fb487afcd17f69e08098cb9d1bdb924/shortcuts)

### CLI Support
If you like using our [CLI](https://webtask.io/cli?utm_source=auth0.com&utm_medium=blog&utm_campaign=webtask_editor_launch), we've got you covered. You can go right from the shell to the editor with the `edit` command, i.e. `wt edit mytask`.

![Webtask CLI support](https://images.ctfassets.net/23aumh6u8s0i/5Xi5ZMbIkevHxrD3eaMgMi/e8d4f572b0627611def2cd6ed385b3ab/from-cli)

## Go Try It! 
The new Webtask Editor is an amazing tool for serverless development. It will let you instantly go from idea => code => running. Not only do you get a rich browser-based authoring experience, but you get a tool to secure, test, and debug your code. Go get started playing with the Webtask editor now: [webtask.io/make](https://webtask.io/make?utm_source=auth0.com&utm_medium=blog&utm_campaign=webtask_editor_launch). Also check out our documentation at [webtask.io/docs/editor](https://webtask.io/docs/editor?utm_source=auth0.com&utm_medium=blog&utm_campaign=webtask_editor_launch).


Serverless development reimagined with the new Webtask Editor

53f70144dc9d7c76455fa91f858d4cec?s=200 avatar

53f70144dc9d7c76455fa91f858d4cec?s=200

Tomasz Janczuk

Customize Auth0 platform with Node.js using Auth0 Hooks, a new extensibility mechanism powered by Webtasks.

<div class="alert alert-danger alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>We are deprecating Auth0 Rules and Hooks by November 18, 2024. To learn more about what's changing, check out the <a href="https://auth0.com/blog/preparing-for-rules-and-hooks-end-of-life/">deprecation announcement blog post</a>.</strong>
</div>

Auth0 Hooks are a new extensibility mechanism in Auth0 that allows you to customize the behavior of our platform using Node.js.

-----

## Developers love code and extensibility

Customization flexibility has always been an integral part of the Auth0 platform. Until now, you could use [Auth0 Rules](https://auth0.com/docs/rules) to execute arbitrary Node.js code during an authorization transaction. Today, we are introducing [Auth0 Hooks](https://auth0.com/docs/auth0-hooks), a new and improved mechanism to extend the Auth0 platform using code.

![Auth0 Hooks in Webtask Editor](https://images.ctfassets.net/23aumh6u8s0i/7AhEd6rE5LSLZ32DLUJ3Ax/15c33539f6464608a138ce0e499bee8c/wt-editor-auth0-hooks)  

## Better developer experience

While Auth0 Hooks are building on the same underlying [Webtask](https://webtask.io) technology we have developed to run Auth0 Rules, several aspects of the developer experience are improved:

* Using the [management dashboard](https://auth0.com/docs/auth0-hooks/dashboard) you can create, move in and out of production, and edit hooks for selected extensibility points in the Auth0 platform.

![Auth0 Hooks dashboard](https://images.ctfassets.net/23aumh6u8s0i/5kHLjW7V9ovSFHxRAXhxxC/2dbccc8615c5308bb6c2adc7860f7ca4/manage-hooks)  

* You edit hooks in the Webtask Editor, which offers a much richer featureset compared to the experience you are used to with Auth0 rules.  
* Syntax completion allows you write the code faster without referring to documentation.  
* Integrated secret management improves the security of your code by providing a mechanism to securely store secrets while making them conveniently available in code.  
* Integrated runner allows you to test your code without leaving the webtask editor.  
* Real-time logs simplify debugging by streaming the output generated by your code.  
* GitHub integration allows you synchronize your hook with code stored in a github repository. Updating your hook is as simple as pushing to GitHub.  

## What can you do today

The initial release of Auth0 Hooks supports customizing the behavior of Auth0 at three new extensibility points:  

* [Client Credentials Exchange](https://auth0.com/docs/hooks/extensibility-points/credentials-exchange) allows you to change the scopes and add custom claims to issued access tokens.  
* [Pre User Registration](https://auth0.com/docs/auth0-hooks/extensibility-points/pre-user-registration) allows you to intercept creation of a new database user to enforce custom password policy, or employ application specific logic to prevent the signup.  
* [Post User Registration](https://auth0.com/docs/auth0-hooks/extensibility-points/post-user-registration) allows you to perform any actions as a result of a succcessful creation of a new database user, e.g. send a message to Slack, or create a record in your CRM system.  

This is just the beginning. We are going to be adding many more extensibility points in the Auth0 platform using the Auth0 Hooks mechanism in the future.   

## Auth0 Hooks vs Auth0 Rules

Introduction of Auth0 Hooks does not affect any existing Auth0 Rules. Your rules continue to work unchanged.

Auth0 Hooks provide a foundation for a new extensibility mechanism in Auth0. All future extensibility points in the platform will build on top of Auth0 Hooks. We are also planning to add support in Auth0 Hooks for the same things you use Auth0 Rules for today.   

## Differences with Auth0 Rules

If you have been using Auth0 Rules before, these are some of the key differences in the development experience when moving on to Auth0 Hooks:

* In Auth0 Rules, you are editing code on the Auth0 management dashboard. When using Auth0 Hooks, you edit code in the Webtask Editor.  
* When using Auth0 Rules, you are specifying rule configuration common to all rules on the Auth0 management dashboard. Auth0 Hooks allow you to specify secret configuration directly in the Webtask Editor, and separately for each hook.  
* When developing Auth0 Rules, you can dry run a rule from within the Auth0 management dashboard. Auth0 Hooks can be tested from within the Webtask Editor using the integrated runner and access to real-time logs. 
* Auth0 management HTTP APIs offer a way to manipulate Auth0 Rules using any HTTP client. Auth0 Hooks are managed using [Webtask management APIs](https://webtask.io/docs/101).  

## Aside: Auth0 Extend

We have recently released a product called [Auth0 Extend](https://auth0.com/extend/). This product enables companies to provide an easy extension point where customers can run arbitrary JavaScript code. With [Auth0 Extend](https://auth0.com/extend/), customers can create custom business rules, scheduled jobs, or connect to the ecosystem by integrating with other SaaS systems, like Marketo, Salesforce, and Concur. All using plain JavaScript and NPM modules.

## Learn more

> Give your customers enterprise identity integration, frictionless SSO across your products and adaptive authentication with MFA and Anomaly Detection. [All of this with a flip of a switch](https://auth0.com/b2b-enterprise-identity-management).

Check out the [Auth0 Hooks documentation](https://auth0.com/docs/auth0-hooks) or head over directly to the [Auth0 Hooks management dashboard](https://manage.auth0.com/#/hooks) to create your first hook.  


Introducing Auth0 Hooks

54f3fecf3ce3bbef2d7a62b4f0496de2

Thameera Senanayaka

Learn how to create a bot that posts mentions in Zendesk to relevant Slack users using the Auth0 Webtask platform



If you’re like me, whenever you get a cool idea to create an app, the mere thought of preparing and maintaining a server always gets you down—and then there’s all the security considerations you have to think about. The advent of PaaS services like Heroku solved this problem to some extent. Now that serverless technologies have come into the mainstream, making your ideas reality is easier than ever.

Serverless platforms allow you to focus more on the code and get real work done without worrying about managing servers. Many people prefer the term function-as-a-service (FaaS) instead of serverless to serverless, because what essentially functions are the unit of application logic in this realm. Auth0's [Webtask](https://webtask.io/) is a hassle-free serverless platform you can use to deploy and run functions.

At Auth0, we tend to solve most of our problems using Webtasks. Here's an example of how we used them to create a Slack bot to tackle a pressing need we had.

## Go Beyond Basic Slack and Zendesk Integration

We’re not trying to brag, but Auth0 is known for its wonderful customer service. We use Zendesk to manage the hundreds of customer queries we get every day. Since this is an integral part of our day-to-day work, we use multiple Zendesk-to-Slack integrations to make sure we respond to every customer query in a timely manner.

For a long time, we needed the ability to mention someone else in a ticket. The only out-of-the box option was to cc that person’s email, but this had its own drawbacks. We wanted to achieve an integration that would go hand-in-hand with our primary method of communication: Slack. Zendesk has some basic Slack integration options, but it’s not programmable enough to handle mentions.

Then we thought, “Can we use a webtask to achieve this?”

## Webtasks to the rescue

Of course we can! Any time you want to automate something, you can use a webtask. We quickly implemented a Zendesk-mentions-to-Slack integration in a webtask. We didn’t need to procure any servers or worry about how much computing power or uptime we would need. All we had to do was write the code and create a trigger in Zendesk.

## Overview

Here’s an overview of the data flow in our app:

![Slack and Zendesk Integration](https://images.ctfassets.net/23aumh6u8s0i/4FPj0WOpBZklsSsdchQd0V/507cef8b51d949b8b61e23c83a55f5f5/slack-and-zendesk-integration)

Peter, a Zendesk agent, mentions his colleague Rodrigo as `<@rodrigo>`. That’s Rodrigo’s Slack username. A Zendesk trigger picks up the comment with a mention and does an HTTP POST request to our webtask. The webtask analyzes the comment and determines the exact Slack user (`@rodrigo` in this case). It then calls the Slack API to send a direct message to `@rodrigo` with details about the comment. If Peter mentioned a Slack channel name instead of a username, it would be sent to that specific Slack channel.

To set this up, we needed to do the following:

- Create a Slackbot
- Write and deploy the webtask
- Create a trigger in Zendesk

## 1. Create a Slackbot

Simply visit [this page](https://my.slack.com/services/new/bot) and enter a name for the bot. A new Slack bot will be created. After it has been created, an API token will be assigned to the bot. Make a note of this because we will need it in the next step.

## 2. Create the webtask

Now the fun begins. First, if you haven’t set up the webtask CLI, follow the three simple steps on this [webtask.io](https://webtask.io/cli) page. Once you’re done, it’s time to write the code.

Here's the code we used at Auth0. You may edit it to your liking.

```javascript
'use latest';

const request = require('request');
const _ = require('lodash@4.8.2');

const baseURL = 'https://slack.com/api/';
const usersListEndpoint = 'users.list';
const imOpenEndpoint = 'im.open';
const chatPostEndpoint = 'chat.postMessage';
let token;

/* Call the given endpoing in Slack API */
const callAPI = (endpoint, form, cb) => {
  request.post(baseURL + endpoint, {form}, (err, res, body) => {
    if (err) return cb(err);

    body = JSON.parse(body);
    if (!body.ok) return cb(body.error);

    return cb(null, body);
  });
};

/* Find Slack ID of the user with given username */
const findUser = (username, cb) => {
  callAPI(usersListEndpoint, {token}, (err, body) => {
    if (err) return cb(err);

    const user = _.find(body.members, {name: username});

    if (!user) return cb(`User ${username} not found`);
    cb(null, user.id);
  });
};

/* Open a direct msg channel with given Slack user id */
const openIM = (user, cb) => {
  callAPI(imOpenEndpoint, {token, user}, (err, body) => {
    if (err) return cb(err);
    cb(null, body.channel.id);
  });
};

/* Post message to specified Slack channel */
const postMsg = (channel, data, cb) => {
  const obj = {
    title: `#${data.id} | ${data.title}`,
    title_link: 'https://auth0.zendesk.com/agent/tickets/' + data.id,
    fields: [
      {title: 'Mentioned by', value: data.author},
      {title: 'Comment', value: data.comment},
      {title: 'Tags', value: data.tags}
    ]
  };
  callAPI(chatPostEndpoint, {
    token,
    channel,
    as_user: false,
    username: 'Zendesk Mentions Bot',
    icon_url: 'http://i.imgur.com/IhN4IzR.png?1',
    text: 'You were mentioned in this ticket:',
    attachments: JSON.stringify([obj])
  }, (err, body) => {
    if (err) { console.log(err); return cb(err); }
    cb(null);
  });
};

/* Extract mentioned user's name from comment */
const extractName = (comment) => {
  const start = comment.indexOf('<@') + 2;
  const end = comment.substr(start).indexOf('>');
  return comment.substr(start, end);
};

module.exports = (context, cb) => {

  // Slack bot token
  token = context.data.BOT_TOKEN;

  const name = extractName(context.data.comment).toLowerCase();

  findUser(name, (err, id) => {
    if (err) {
      // If no such user, assume it's a channel
      return postMsg(name, context.data, cb);
    }

    return openIM(id, (err, channelId) => {
      if (err) { console.log(err); return cb(); }
      else postMsg(channelId, context.data, cb);
    });
  });

};
```

That’s less than 100 lines of code!

The entry point to the code is the line starting with `module.exports = (context, cb) => {`. When the webtask is triggered, this function will be executed, which will in turn call the rest of the functions when necessary.

For security reasons, we add the bot’s token as a configuration (as described below) instead of in the code. Then we find the mentioned name from the comment text. We check Slack to see if such a user exists. If not, we assume it’s a channel name and post it into the channel with that name. If a user is found, we open an IM channel with that user and post the message.

Save this code in a file named `slackmention.js` and enter the following command to deploy it as a webtask:

```
wt create --secret BOT_TOKEN=<Slack bot token from step 1 goes here> slackmention.js
```

After the webtask is deployed, the CLI will present you with its unique URL. We will use this in the next step.

## 3. Create a trigger in Zendesk

The last step is to tell Zendesk to call our webtask when it sees a comment that might have a mention in it. You need to be an admin in Zendesk to do this. If you are not, reach out to your friendly Zendesk admin (and don’t forget to give them a cookie!).

In Zendesk, go to **Settings > Extensions** and create a new HTTP target with the webtask’s URL as the URL (obtained in Step 2), POST as the method, and JSON as the content type.


Now go to **Settings > Triggers** and create a new trigger with _‘Ticket: Comment text...’_ as the condition, “Contains the following string” as the op, and `<@` as the string. The performed action should be _‘Notifications: Notify target’_ set to the HTTP target created above. Set the JSON body as follows:

```json

{ "id": "{{ticket.id}}", "title": "{{ticket.title}}", "comment": "{{ticket.latest_comment}}", "author": "{{ticket.latest_comment.author.name}}", "tags": "{{ticket.tags}}" }

```

## Test it!

Now we are all done. To test our new setup, add the following comment in a new (or existing) Zendesk ticket. You can add it to a public comment or an internal comment.


```
Hello <@thameera>!
```

Replace `thameera` with your Slack username, of course. If you performed all the steps in order, you will get a Slack notification like this:

![Slack mention in the Zendesk ticket](https://images.ctfassets.net/23aumh6u8s0i/6vYCYmGihKFIEtHrecV9Kd/04d132295f04d63293749edb6f7b0f0a/zendesk-bot-with-slack-mention)

That’s it! You can customize the trigger and the webtask to suit your company’s needs and deploy your own Zendesk-to-Slack-mentions implementation in a few minutes. For example, you can modify it to send an email or send a DM via HipChat if that’s your chat application of choice.

## Conclusion

The next time you need to create a bot, automate something, or write a program, remember that you can use a webtask to say no to [yak shaving](http://www.hanselman.com/blog/YakShavingDefinedIllGetThatDoneAsSoonAsIShaveThisYak.aspx) and focus on your code.

You can start experimenting with webtasks by creating a free Auth0 account below or heading directly to [https://webtask.io](https://webtask.io). Enjoy!


Build a Serverless Slack Bot with Webtask.io

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Learn how to build a serverless app with Lambda, the function-as-a-service platform from Amazon. Find out how AWS Lambda stacks up against Webtask.

Building Serverless Apps with AWS Lambda

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Learn how to fix your Twitter share count with a simple HTTP proxy without a server using Webtasks



Recently Twitter decided to [shutdown](https://blog.twitter.com/2015/hard-decisions-for-a-sustainable-platform) one of its unofficial API endpoints: the URL share count. In this post we will show you how to get that functionality back with a simple [Webtask](https://webtask.io) acting as a proxy to a different counts provider.

-----

## The problem
Twitter used to provide a *non-public* API endpoint for URL share counts:

```
$ curl http://cdn.api.twitter.com/1/urls/count.json?url=http://my.url.com
{"count":27438,"url":"http:\/\/my.url.com\/"}
```

![Twitter share count](https://images.ctfassets.net/23aumh6u8s0i/4m43U8hB07Ec0PsCc2RrGu/2aea8f8a6794a65f6ff7200ee93c9a85/twittercount)

Although this endpoint was not public (and therefore Twitter never committed to supporting it), it stayed available for a long time and people started using it. Unfortunately this [changed recently](https://blog.twitter.com/2015/hard-decisions-for-a-sustainable-platform). However the need for a Twitter URL share count remained. At Auth0 we use URL share counts in our [blog](https://blog.auth0.com), so we had to find a way to fix this.

> It should be noted that as the endpoint was not public Twitter really can't be blamed for removing it.

## The alternative
So we set out to find an alternative service providing link counts on Twitter. We found [OpenShareCount](http://opensharecount.com/). The service basically works by performing periodic searches using the official Twitter search API, then counting the results and storing them for quick retrieval. If you are familiar with the Twitter API, then this should trigger an alarm: Twitter searches only go back a few days, so count results are not absolute. OpenShareCount resolves this by running the search periodically and adding up newer results. Good enough.

After signing up and setting up your domain for counts, a simple call to OpenShareCount's API will do the thing:

```
$ curl http://opensharecount.com/count.json?url=http://my.url.com
{"count":27438,"url":"http:\/\/my.url.com\/"}
```

> It should be noted that OpenShareCount does not support JSONP (using the callback parameter) as the old Twitter API did, so further changes to your site might be needed.

Looking good. However we still have one problem to solve: cross site requests.

## Another problem: the same origin policy
Our blog is hosted at [https://blog.auth0.com](https://blog.auth0.com) and OpenShareCount provides the API endpoint at `http://opensharecount.com/count.json?url=http://my.url.com`. There are two things we need to take into account:

1. The `Access-Control-Allow-Origin` header.
2. The use of the same communications protocol (HTTP or HTTPS).

By running a simple cURL test to the URL we see the `Access-Control-Allow-Origin` header is correctly set:

```
curl -v http://opensharecount.com/count.json\?url\=http://my.url.com
*   Trying 104.27.164.180...
* Connected to opensharecount.com (104.27.164.180) port 80 (#0)
> GET /count.json?url=http://my.url.com HTTP/1.1
> Host: opensharecount.com
> User-Agent: curl/7.45.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Thu, 10 Dec 2015 17:07:23 GMT
< Content-Type: text/html; charset=ISO-8859-1
< Transfer-Encoding: chunked
< Connection: keep-alive
< Set-Cookie: __cfduid=d953733a4896a8010a92b07f02928451f1449767243; expires=Fri, 09-Dec-16 17:07:23 GMT; path=/; domain=.opensharecount.com; HttpOnly
< Vary: Accept-Encoding
< Access-Control-Allow-Origin: *
< CF-Cache-Status: MISS
< Expires: Thu, 10 Dec 2015 17:37:23 GMT
< Cache-Control: public, max-age=1800
< Server: cloudflare-nginx
< CF-RAY: 252a8bb960980320-MIA
<
* Connection #0 to host opensharecount.com left intact
{"url":"http://my.url.com","error":"Domain my.url.com not authorised, register for free at http://opensharecount.com first","count":0}
```

So the `Access-Control-Allow-Origin` header is not a problem. However the difference between HTTPS and HTTP *is*. Browsers forbid AJAX requests to non-TLS resources from a TLS-secured page.

### A Webtasks Proxy
The obvious solution to the problem above is a *proxy*. This proxy will simply provide a HTTPS frontend for the HTTP OpenShareCount API. This is a simple matter, but forces us to think about hosting, load-balancing and other stuff related to setting up a new service. As we face these problems daily, at Auth0 we developed [webtasks](https://webtask.io), which fit this problem domain perfectly.

Here's our simple HTTP to HTTPS proxy:

```
var url = require('url');
var request = require('request');

module.exports = function (ctx, cb) {
  var whitelist = ['metrics.it.auth0.com', 'opensharecount.com'];

  var targetUrl = ctx.data.url;
  var target = url.parse(targetUrl).hostname;
  var ok = whitelist.some(function (host) {
    return target === host;
  });

  if (!ok) {
    return cb(new Error('no way'));
  }

  request.get({url: targetUrl}, function(err, resp, body) {
     if (err) return cb(err);
     cb(null, JSON.parse(body));
  });
};
```

And this is our endpoint with parameters: `https://webtask.it.auth0.com/api/run/auth0/proxy?webtask_no_cache=1&url=http://opensharecount.com/count.json?url=LINK_COUNT_URL`

The proxy has a simple embedded whitelist to prevent misuse by third-parties. After running the whitelist filter, it performs an HTTP request and sends back the result to the original caller.

> Please note that browser restrictions with regards to access to unprotected resources from a TLS secured page are in place for a reason. Study carefully if the unprotected resource can be handled this way before doing something like this.

## Get Your Twitter Share Counts Back: Create Your Own Webtask!
If you are interested in learning more about webtasks or creating your own, head over to [https://webtask.io](https://webtask.io) and get started. With the webtasks command line interface, creating your first script is a matter of running a few commands:

<include src="TweetQuote" quoteText="With the webtasks command line interface, creating your first script is a matter of running a few commands."/>

```
npm install wt-cli -g
wt init your@email.com
echo "module.exports = function (cb) {cb(null, 'Hello');}" > hello.js
wt create hello.js
```

You can then run the webtask:

```
curl https://webtask.it.auth0.com/api/run/wt-sebastian_peyrott-auth0_com-0/hello?webtask_no_cache=1
```

Replace your webtask URL by the one returned by `wt create`.

## Conclusion
The decision to remove the link counts API by Twitter was unfortunate but perfectly understandable. It was never meant for public use. Fortunately OpenShareCount and Webtasks make a perfect fit for solving this issue as soon as possible and in a convenient manner. If you decide to use or extend our simple proxy sample, let us know in the comments. Good luck!
