Update teams sink validation to accept post-2026 webhook hosts

[JohnBlackwell]

https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet

Will allow new MS teams webhooks to be used in addtion to legacy ones. Introduces new helper function to avoid creating additional regex expressions.

Test environment: https://console.plrl-dev-aws.onplural.sh/

Tested with local dev env with the following urls:

Pass

https://environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/abc123/triggers/manual/paths/invoke?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=test
https://prod-01.westus.logic.azure.com:443/workflows/abc123/triggers/manual/paths/invoke?api-version=2016-10-01&sig=test
https://make.powerautomate.com/workflows/abc123/triggers/manual/paths/invoke?sig=test
https://outlook.office.com/webhook/abc123/IncomingWebhook/test
https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

Fail

http://environment.api.powerplatform.com/workflows/abc123
https://example.com/workflows/abc123
https://not-slack.example.com/services/test
not-a-url

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[soffi-ai]

Soffi AI Summary

This PR updates the webhook URL validation logic for Microsoft Teams and Slack notification sinks to support the post-2026 Microsoft webhook infrastructure. Previously, Teams webhook validation only accepted URLs containing "office" in the hostname, which excluded newer Microsoft Power Automate and Power Platform webhook hosts. The fix introduces a proper allowlist-based validation approach on both the server side (Elixir) and the frontend (React), replacing fragile regex pattern matching with explicit hostname checks against known-good domains.

Changes

MS Teams webhook host allowlist

• Replaced the single-regex Teams webhook validation with a server-side allowlist of known Microsoft webhook hosts (office.com, office365.com, powerautomate.com, powerplatform.com, logic.azure.com), allowing post-2026 Power Automate and Power Platform webhook URLs to pass validation alongside legacy Office 365 webhooks. (51093e0)
• Added error handling for malformed URLs during webhook validation so that non-parseable inputs are gracefully rejected with a clear error message rather than causing unexpected failures. (f6f3cb7)
• Extended the Slack webhook host allowlist to include slack-gov.com, preserving support for Slack Government environment webhooks alongside standard slack.com URLs. (86a3d73)
• Refactored notification sink webhook validation on both the server (Elixir changeset) and the frontend (React modal) levels. Server-side: introduced dedicated slack_changeset/2 and teams_changeset/2 with host-based URI validation (HTTPS-only, no userinfo, valid port range). Frontend: removed the dual-regex hook-type detection in favor of preserving the known sink type during edits and defaulting new sinks to Teams when the URL doesn't match a Slack host, while also relaxing the submit guard so Teams webhooks are no longer blocked. (a9a83b9)

---

Updated: 2026-09-08 12:54 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

Updates notification sink URL validation to support current Microsoft Teams webhook domains while restricting Slack and Teams URLs to HTTPS on approved hosts.

• Replaces permissive hostname regexes with exact-domain and subdomain matching.
• Handles malformed URLs, including invalid ports, as validation failures instead of render-time exceptions.
• Stabilizes edit-mode memoization dependencies.

Confidence Score: 5/5

The PR appears safe to merge; the previously reported invalid-port crash is fixed and no new actionable failures were identified.

The URL constructor is now guarded, so malformed HTTPS URLs such as those with out-of-range ports return false rather than crashing the notification sink modal. The previous finding was also manually resolved.

Important Files Changed

Filename	Overview
js/console/src/components/settings/notifications/sinks/UpsertNotificationSinkModal.tsx	Adds reusable HTTPS webhook-host validation and safely handles URL parsing failures; no actionable issues remain.

_{Reviews (2): Last reviewed commit: "catch malformed urls" | Re-trigger Greptile}

[JohnBlackwell]

@greptile

[JohnBlackwell]

plural review this

[plural-copilot]

Plural Summary

Final-head review found no actionable defects. The webhook classifier now parses HTTPS URLs before allowlist matching, preserves Slack/Teams mutation behavior, and the focused helper tests pass (5/5).

Mergeability Grade: A

A — merge-ready. The change replaces permissive string matching with exact or dot-delimited subdomain checks on parsed HTTPS hostnames, preventing the reviewed userinfo and suffix spoofing cases while retaining Slack Gov and the newly supported Teams host families. No correctness, security, TypeScript, or call-site regression was found.

Files changed (3)

Filename	Summary
js/console/src/components/settings/notifications/sinks/UpsertNotificationSinkModal.tsx	Uses the parsed URL classifier for sink-type inference while preserving create/edit state initialization and the existing type-specific mutation payload.
js/console/src/components/settings/notifications/sinks/notificationSinkUrl.ts	Adds HTTPS-only parsed hostname allowlisting for Slack, Slack Gov, and supported Teams webhook host families.
js/console/src/components/settings/notifications/sinks/notificationSinkUrl.test.ts	Adds focused coverage for standard and GovSlack URLs, userinfo/suffix hostname spoofing, and invalid out-of-range ports.

[JohnBlackwell]

plural review this

[michaeljguarino]

this validation shouldn't be on the frontend at all, it should be done server-side.

[JohnBlackwell]

plural deploy to dev

[floreks]

Acknowledged. I inspected PR #4112 at head c005feaeaea77a060b94b0a945b867fa1bf6e3a3 against master and reviewed the notification-sink frontend/backend diff. The requested dev pin is sha-c005fea; no go/deployment-operator/pkg/agentrun-harness path is involved. The separate GitOps pin PR is https://github.com/pluralsh/plrl-dev-aws/pull/297.