Fix alert resolved via bot messages

message.go

@@ -18,6 +18,7 @@ type Message struct {
 	Event     string
 	Plaintext string
 	Asset     string
+	Resolved  bool
 }
 
 func (m Message) Empty() bool {
@@ -59,6 +60,9 @@ type (
 	slackEvent struct {
 		ID      string `json:"event_ts"`
 		Channel string
+		// rewrites
+		Nested          *slackEvent `json:"message"`
+		PreviousMessage *slackEvent `json:"previous_message"`
 		// human
 		ParentID string `json:"thread_ts"`
 		Text     string
@@ -119,6 +123,7 @@ func ParseSlack(b []byte) (Message, error) {
 			Event:     strings.Split(s.Event.Attachments[0].Title, ":")[0],
 			Plaintext: s.Event.Attachments[0].Text,
 			Asset:     "TODO",
+			Resolved:  !strings.HasPrefix(s.Event.Attachments[0].Color, "F"),
 		}, nil
 	}
 
@@ -138,5 +143,21 @@ func ParseSlack(b []byte) (Message, error) {
 func parseSlack(b []byte) (slackMessage, error) {
 	var result slackMessage
 	err := json.Unmarshal(b, &result)
+	if result.Event.Nested != nil && !result.Event.Nested.Empty() {
+		result.Event.Blocks = result.Event.Nested.Blocks
+		result.Event.Bot = result.Event.Nested.Bot
+		result.Event.Attachments = result.Event.Nested.Attachments
+		result.Event.Nested = nil
+	}
+	if result.Event.PreviousMessage != nil {
+		if result.Event.PreviousMessage.ID != "" {
+			result.Event.ID = result.Event.PreviousMessage.ID
+		}
+		result.Event.PreviousMessage = nil
+	}
 	return result, err
 }
+
+func (this slackEvent) Empty() bool {
+	return fmt.Sprintf("%+v", this) == fmt.Sprintf("%+v", slackEvent{})
+}

message_test.go

@@ -79,6 +79,41 @@ func TestParseSlackTestdata(t *testing.T) {
 				Asset:     "TODO",
 			},
 		},
+		"opsgenie_alert_resolved.json": {
+			slackMessage: slackMessage{
+				TS: 1712916339,
+				Event: slackEvent{
+					ID:      "1712916339.000300",
+					Channel: "C06U1DDBBU4",
+					Bot: slackBot{
+						Name: "Opsgenie for Alert Management",
+					},
+					Attachments: []slackAttachment{{
+						Color: "2ecc71",
+						Title: "#11069: [Grafana]: Firing: Alertconfig Workflow Failed",
+						Text:  "At least one alertconfig run has failed unexpectedly.\nDashboard: <https://grafana.render.com/d/VLZU83YVk?orgId=1>\nPanel: <https://grafana.render.com/d/VLZU83YVk?orgId=1&amp;viewPanel=17>\nSource: <https://grafana.render.com/alerting/grafana/fa7b06b8-b4d8-4979-bce7-5e1c432edd81/view?orgId=1>",
+						Fields: []slackField{
+							{Value: "P3", Title: "Priority"},
+							{Value: "alertname:Alertconfig Workflow Failed, grafana_folder:Datastores, rule_uid:a7639f7e-6950-41be-850a-b22119f74cbb", Title: "Tags"},
+							{Value: "Datastores Non-Critical", Title: "Routed Teams"},
+						},
+						Actions: []slackAction{},
+					}},
+				},
+			},
+			message: Message{
+				ID:        "1712916339.000300/1712916339",
+				TS:        1712916339,
+				Source:    "https://renderinc.slack.com/archives/C06U1DDBBU4/p1712916339000300",
+				Channel:   "C06U1DDBBU4",
+				Thread:    "1712916339.000300",
+				EventName: "Alertconfig Workflow Failed",
+				Event:     "#11069",
+				Plaintext: "At least one alertconfig run has failed unexpectedly.\nDashboard: <https://grafana.render.com/d/VLZU83YVk?orgId=1>\nPanel: <https://grafana.render.com/d/VLZU83YVk?orgId=1&amp;viewPanel=17>\nSource: <https://grafana.render.com/alerting/grafana/fa7b06b8-b4d8-4979-bce7-5e1c432edd81/view?orgId=1>",
+				Asset:     "TODO",
+				Resolved:  true,
+			},
+		},
 	}
 
 	for name, d := range cases {