fix(slack): preserve referenced selector credentials

Author: Bill Leoutsakos

apps/sim/hooks/selectors/providers/slack/selectors.ts

@@ -5,8 +5,7 @@ import { ensureCredential, SELECTOR_STALE } from '@/hooks/selectors/providers/sh
 import type { SelectorDefinition, SelectorKey, SelectorQueryArgs } from '@/hooks/selectors/types'
 
 function slackCredentialQueryKey(credential: string | undefined): string {
-  if (!credential) return 'none'
-  return credential.startsWith('xoxb-') ? 'direct-bot-token' : credential
+  return credential ? 'credential-present' : 'none'
 }
 
 function slackCredentialHasServerSecret(credential: string | undefined): boolean {

apps/sim/hooks/selectors/providers/slack/server-resolved-context.test.ts

@@ -72,29 +72,30 @@ describe('Slack server-resolved selector context', () => {
     expect(mocks.requestJson.mock.calls[0][1].body).toEqual({ credential: 'credential-1' })
   })
 
-  it('separates direct-token cache entries without putting plaintext in keys', () => {
+  it('separates arbitrary credentials without putting their text in keys', () => {
     const definition = slackSelectors['slack.channels']
-    const firstKey = getScopedSelectorQueryKey(definition, {
-      key: 'slack.channels',
-      context: {
-        workflowId: 'workflow-1',
-        workspaceId: 'workspace-1',
-        oauthCredential: 'xoxb-first-secret',
-        selectorCacheScope: 'revision-1',
-      },
-    })
-    const secondKey = getScopedSelectorQueryKey(definition, {
-      key: 'slack.channels',
-      context: {
-        workflowId: 'workflow-1',
-        workspaceId: 'workspace-1',
-        oauthCredential: 'xoxb-second-secret',
-        selectorCacheScope: 'revision-2',
-      },
-    })
+    const credentials = [
+      'credential-id',
+      'xoxb-clean-secret',
+      ' xoxb-padded-secret',
+      '"xoxb-quoted-secret"',
+      '{{SLACK_SECRET_REFERENCE}}',
+    ]
+    const keys = credentials.map((oauthCredential, index) =>
+      getScopedSelectorQueryKey(definition, {
+        key: 'slack.channels',
+        context: {
+          workflowId: 'workflow-1',
+          workspaceId: 'workspace-1',
+          oauthCredential,
+          selectorCacheScope: `revision-${index}`,
+        },
+      })
+    )
 
-    expect(firstKey).not.toEqual(secondKey)
-    expect(JSON.stringify([firstKey, secondKey])).not.toContain('xoxb-first-secret')
-    expect(JSON.stringify([firstKey, secondKey])).not.toContain('xoxb-second-secret')
+    expect(new Set(keys.map((key) => JSON.stringify(key))).size).toBe(credentials.length)
+    for (const credential of credentials) {
+      expect(JSON.stringify(keys)).not.toContain(credential)
+    }
   })
 })

apps/sim/lib/selectors/server/slack-credential.test.ts

@@ -136,40 +136,108 @@ describe('resolveSlackSelectorCredential', () => {
     expect(mocks.refreshToken).not.toHaveBeenCalled()
   })
 
-  it('requires workflow scope for a direct bot token', async () => {
-    const result = await resolveSlackSelectorCredential(principal, {
-      credential: 'xoxb-literal-secret',
-      requestId: 'request-1',
-    })
+  it.each(['xoxb-literal-secret', '{{SLACK_CREDENTIAL}}'])(
+    'requires workflow scope before resolving %s',
+    async (credential) => {
+      const result = await resolveSlackSelectorCredential(principal, {
+        credential,
+        requestId: 'request-1',
+      })
 
-    expect(result).toEqual({
-      ok: false,
-      status: 400,
-      error: 'Unable to resolve selector configuration',
-    })
-    expect(mocks.resolveContext).not.toHaveBeenCalled()
-  })
+      expect(result).toEqual({
+        ok: false,
+        status: 400,
+        error: 'Unable to resolve selector configuration',
+      })
+      expect(mocks.resolveContext).not.toHaveBeenCalled()
+    }
+  )
 
-  it('does not reinterpret a referenced non-bot value as an OAuth credential id', async () => {
-    mocks.resolveContext.mockResolvedValue({
-      ok: true,
-      context: { credential: 'not-a-bot-token' },
-      requesterUserId: 'viewer-1',
-      workspaceId: 'workspace-1',
-    })
+  it.each([
+    ['OAuth', 'oauth', 'xoxp-oauth-token', false],
+    ['custom bot', 'service_account', 'xoxb-custom-bot-token', true],
+  ])(
+    'authorizes a referenced %s credential after environment resolution',
+    async (_label, credentialType, accessToken, isBotToken) => {
+      mocks.resolveContext
+        .mockResolvedValueOnce({
+          ok: true,
+          context: { credential: 'resolved-credential-id' },
+          requesterUserId: 'viewer-1',
+          workspaceId: 'workspace-1',
+        })
+        .mockResolvedValueOnce({
+          ok: true,
+          context: {},
+          requesterUserId: 'viewer-1',
+          workspaceId: 'workspace-1',
+          credentialAccess: {
+            ok: true,
+            workspaceId: 'workspace-1',
+            credentialOwnerUserId: 'owner-1',
+            credentialType,
+          },
+        })
+      mocks.refreshToken.mockResolvedValue(accessToken)
+
+      const result = await resolveSlackSelectorCredential(principal, {
+        credential: '{{SLACK_CREDENTIAL_ID}}',
+        workflowId: 'workflow-1',
+        requestId: 'request-1',
+      })
+
+      expect(mocks.resolveContext).toHaveBeenNthCalledWith(1, principal, {
+        workflowId: 'workflow-1',
+        context: { credential: '{{SLACK_CREDENTIAL_ID}}' },
+      })
+      expect(mocks.resolveContext).toHaveBeenNthCalledWith(2, principal, {
+        workflowId: 'workflow-1',
+        credentialId: 'resolved-credential-id',
+        context: {},
+      })
+      expect(mocks.providerMatches).toHaveBeenCalledWith({
+        credentialId: 'resolved-credential-id',
+        credentialOwnerUserId: 'owner-1',
+        serviceId: 'slack',
+      })
+      expect(mocks.refreshToken).toHaveBeenCalledWith(
+        'resolved-credential-id',
+        'owner-1',
+        'request-1'
+      )
+      expect(result).toMatchObject({ ok: true, accessToken, isBotToken })
+    }
+  )
+
+  it('provider-binds a referenced credential before token refresh', async () => {
+    mocks.resolveContext
+      .mockResolvedValueOnce({
+        ok: true,
+        context: { credential: 'resolved-credential-id' },
+        requesterUserId: 'viewer-1',
+        workspaceId: 'workspace-1',
+      })
+      .mockResolvedValueOnce({
+        ok: true,
+        context: {},
+        requesterUserId: 'viewer-1',
+        workspaceId: 'workspace-1',
+        credentialAccess: {
+          ok: true,
+          workspaceId: 'workspace-1',
+          credentialOwnerUserId: 'owner-1',
+          credentialType: 'oauth',
+        },
+      })
+    mocks.providerMatches.mockResolvedValue(false)
 
     const result = await resolveSlackSelectorCredential(principal, {
-      credential: '{{SLACK_BOT_TOKEN}}',
+      credential: '{{SLACK_CREDENTIAL_ID}}',
       workflowId: 'workflow-1',
       requestId: 'request-1',
     })
 
-    expect(result).toEqual({
-      ok: false,
-      status: 400,
-      error: 'Unable to resolve selector configuration',
-    })
-    expect(mocks.providerMatches).not.toHaveBeenCalled()
+    expect(result).toEqual({ ok: false, status: 400, error: 'Select a Slack credential.' })
     expect(mocks.refreshToken).not.toHaveBeenCalled()
   })
 

apps/sim/lib/selectors/server/slack-credential.ts

@@ -16,35 +16,13 @@ export type SlackSelectorCredentialResult =
     }
   | { ok: false; status: number; error: string }
 
-/** Resolves direct Slack bot-token references and credential ids behind one authorization path. */
-export async function resolveSlackSelectorCredential(
+async function resolveStoredSlackCredential(
   principal: Principal,
   input: { credential: string; workflowId?: string; requestId: string }
 ): Promise<SlackSelectorCredentialResult> {
-  let credential = input.credential
-  const isReferencedBotToken = isEnvVarReference(credential)
-  const isLiteralBotToken = credential.startsWith('xoxb-')
-
-  if (isReferencedBotToken || isLiteralBotToken) {
-    if (!input.workflowId) {
-      return { ok: false, status: 400, error: SAFE_RESOLUTION_ERROR }
-    }
-    const resolution = await resolveAuthorizedSelectorContext(principal, {
-      workflowId: input.workflowId,
-      context: { credential },
-    })
-    if (!resolution.ok) return resolution
-    credential = resolution.context.credential
-
-    if (credential.startsWith('xoxb-')) {
-      return { ok: true, accessToken: credential, isBotToken: true }
-    }
-    return { ok: false, status: 400, error: SAFE_RESOLUTION_ERROR }
-  }
-
   const resolution = await resolveAuthorizedSelectorContext(principal, {
     workflowId: input.workflowId,
-    credentialId: credential,
+    credentialId: input.credential,
     context: {},
   })
   if (!resolution.ok) return resolution
@@ -55,7 +33,7 @@ export async function resolveSlackSelectorCredential(
   }
 
   const providerMatches = await selectorCredentialMatchesService({
-    credentialId: credential,
+    credentialId: input.credential,
     credentialOwnerUserId: credentialAccess.credentialOwnerUserId,
     serviceId: 'slack',
   })
@@ -64,7 +42,7 @@ export async function resolveSlackSelectorCredential(
   }
 
   const accessToken = await refreshAccessTokenIfNeeded(
-    credential,
+    input.credential,
     credentialAccess.credentialOwnerUserId,
     input.requestId
   )
@@ -79,3 +57,41 @@ export async function resolveSlackSelectorCredential(
     credentialAccess,
   }
 }
+
+/** Resolves Slack references before selecting the direct-token or stored-credential path. */
+export async function resolveSlackSelectorCredential(
+  principal: Principal,
+  input: { credential: string; workflowId?: string; requestId: string }
+): Promise<SlackSelectorCredentialResult> {
+  let credential = input.credential
+  const isReferencedCredential = isEnvVarReference(credential)
+  const isLiteralBotToken = credential.startsWith('xoxb-')
+
+  if (isReferencedCredential || isLiteralBotToken) {
+    if (!input.workflowId) {
+      return { ok: false, status: 400, error: SAFE_RESOLUTION_ERROR }
+    }
+    const resolution = await resolveAuthorizedSelectorContext(principal, {
+      workflowId: input.workflowId,
+      context: { credential },
+    })
+    if (!resolution.ok) return resolution
+    credential = resolution.context.credential
+
+    if (credential.startsWith('xoxb-')) {
+      return { ok: true, accessToken: credential, isBotToken: true }
+    }
+
+    return resolveStoredSlackCredential(principal, {
+      credential,
+      workflowId: input.workflowId,
+      requestId: input.requestId,
+    })
+  }
+
+  return resolveStoredSlackCredential(principal, {
+    credential,
+    workflowId: input.workflowId,
+    requestId: input.requestId,
+  })
+}