SlackV3 - be able to lookup a user with by their user id (demisto#38173)

* adding logs
mirror-investigation

* more logs

* yml file

* revert yml

* RN

* DO

* replace to EXTENSIVE_LOGGING the new logs

* extensive_logging

* Napoleon's suggestion

* RN

* revert docker

* fix UT

* fix UT

* pre-commit

* DO

* RN

* revert docker

* revert docker

* docker

* add condition to get_user

Packs/Slack/Integrations/SlackV3/SlackV3.py

@@ -402,6 +402,37 @@ def get_user_by_name(user_to_search: str, add_to_context: bool = True) -> dict:
         return get_user_by_name_with_caching(user_to_search=user_to_search, add_to_context=add_to_context)
 
 
+def get_user_by_id(user_id: str) -> dict:
+    """
+    Retrieves a Slack user's details by user ID.
+
+    Args:
+        user_id: The user's unique ID in Slack.
+
+    Returns:
+        Formatted user results if a user is found.
+    """
+    if not user_id:
+        raise ValueError('User ID must be provided')
+
+    _body = {
+        'user': user_id
+    }
+    response = send_slack_request_sync(CLIENT, 'users.info', http_verb='GET', body=_body)
+    user = response.get('user', {})  # type: ignore
+
+    if not user:
+        err_str = format_user_not_found_error(user_id)
+        demisto.results({
+            'Type': WARNING_ENTRY_TYPE,
+            'Contents': err_str,
+            'ContentsFormat': formats['text']
+        })
+        return {}
+    else:
+        return format_user_results(user)
+
+
 def search_slack_users(users: Union[list, str]) -> list:
     """
     Search given users in Slack
@@ -734,11 +765,13 @@ def mirror_investigation():
     private = argToBoolean(demisto.args().get('private', 'false'))
 
     investigation = demisto.investigation()
+    demisto.debug(f'SlackV3 integration: This is the investigation - {investigation}')
 
     if investigation.get('type') == PLAYGROUND_INVESTIGATION_TYPE:
         return_error('Can not perform this action in playground.')
 
     integration_context = get_integration_context(SYNC_CONTEXT)
+    demisto.debug(f'SlackV3 integration: This is the integration context - {integration_context}')
 
     if not integration_context or not integration_context.get('mirrors', []):
         mirrors: list = []
@@ -751,6 +784,8 @@ def mirror_investigation():
     channel_filter: list = []
     if channel_name:
         channel_filter = list(filter(lambda m: m['channel_name'] == channel_name, mirrors))
+        demisto.debug(f'SlackV3 integration: This is the channel filter - {channel_filter}')
+
     if not current_mirror:
         channel_name = channel_name or f'incident-{investigation_id}'
 
@@ -840,6 +875,7 @@ def mirror_investigation():
     mirror['channel_topic'] = channel_topic
 
     mirrors.append(mirror)
+    demisto.debug(f'SlackV3 integration: This is the mirrors list - {mirrors}')
 
     if DISABLE_CACHING:
         set_to_integration_context_with_retries({'mirrors': mirrors}, OBJECTS_TO_KEYS, SYNC_CONTEXT)
@@ -2573,11 +2609,18 @@ def kick_from_channel():
 
 
 def get_user():
-    user = demisto.args()['user']
+    user_input = demisto.args()['user']
+
+    # Check if the input might be an email or a user ID
+    if re.match(emailRegex, user_input):
+        slack_user = get_user_by_email(user_input)
+    elif re.match("^[UW](?=.*\d)[A-Z0-9]{8}$", user_input):
+        slack_user = get_user_by_id(user_input)
+    else:
+        slack_user = get_user_by_name(user_input)
 
-    slack_user = get_user_by_name(user)
     if not slack_user:
-        err_str = format_user_not_found_error(user=user)
+        err_str = format_user_not_found_error(user=user_input)
         demisto.results({
             'Type': WARNING_ENTRY_TYPE,
             'Contents': err_str,
@@ -2593,7 +2636,7 @@ def get_user():
         'Email': profile.get('email')
     }
 
-    hr = tableToMarkdown('Details for Slack user: ' + user, result_user,
+    hr = tableToMarkdown('Details for Slack user: ' + user_input, result_user,
                          headers=['ID', 'Username', 'Name', 'DisplayName', 'Email'], headerTransform=pascalToSpace,
                          removeNull=True)
     context = {

Packs/Slack/Integrations/SlackV3/SlackV3.yml

@@ -501,7 +501,7 @@ script:
       description: Set this argument to specify how many results to return.
     description: Retrieves replies to specific messages, regardless of whether it's from a public or private channel, direct message, or otherwise.
     name: slack-get-conversation-replies
-  dockerimage: demisto/slackv3:1.0.0.112417
+  dockerimage: demisto/slackv3:1.0.0.117556
   longRunning: true
   runonce: false
   script: '-'

Packs/Slack/Integrations/SlackV3/SlackV3_test.py

@@ -8,6 +8,7 @@
 from slack_sdk.errors import SlackApiError
 from slack_sdk.web.async_slack_response import AsyncSlackResponse
 from slack_sdk.web.slack_response import SlackResponse
+
 from SlackV3 import get_war_room_url, parse_common_channels
 
 from CommonServerPython import *
@@ -3935,14 +3936,30 @@ def test_get_user(mocker):
     from SlackV3 import get_user
 
     # Set
+    def api_call(method: str, http_verb: str = 'POST', file: str = None, params=None, json=None, data=None):
+        new_user = {
+            'name': 'perikles',
+            'profile': {
+                'email': '[email protected]',
+                'display_name': 'Dingus',
+                'real_name': 'Lingus'
+            },
+            'id': 'U012B3CUI'
+        }
+        if method == 'users.info':
+            user = {'user': js.loads(USERS)[0]}
+            return user
+        elif method == 'users.lookupByEmail':
+            return {'user': new_user}
+        return None
 
     mocker.patch.object(demisto, 'args', return_value={'user': 'spengler'})
     mocker.patch.object(demisto, 'getIntegrationContext', side_effect=get_integration_context)
     mocker.patch.object(demisto, 'setIntegrationContext', side_effect=set_integration_context)
+    mocker.patch.object(slack_sdk.WebClient, 'api_call', side_effect=api_call)
     mocker.patch.object(demisto, 'results')
 
     # Arrange
-
     get_user()
     user_results = demisto.results.call_args[0]
 

Packs/Slack/ReleaseNotes/3_5_6.md

@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### Slack v3
+- Updated the Docker image to: *demisto/slackv3:1.0.0.117556*.
+- Improved implementation by adding more logs.
+- Added support for lookup users by their user IDs.

Packs/Slack/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Slack",
     "description": "Interact with Slack API - collect logs, send messages and notifications to your Slack team.",
     "support": "xsoar",
-    "currentVersion": "3.5.5",
+    "currentVersion": "3.5.6",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",