@shipfox/api-integration-slack 4.0.0 → 6.0.0

package/src/core/webhook-processor.ts

@@ -0,0 +1,152 @@
+import {Buffer} from 'node:buffer';
+import type {
+  ClaimWebhookDeliveryFn,
+  GetIntegrationConnectionByIdFn,
+  PublishIntegrationEventReceivedFn,
+  RecordDeliveryOnlyFn,
+  StoredWebhookRequest,
+  WebhookProcessingResult,
+} from '@shipfox/api-integration-core-dto';
+import {decodeWebhookBody} from '@shipfox/api-integration-core-dto';
+import {
+  slackEventsRequestSchema,
+  slackSlashCommandSchema,
+} from '@shipfox/api-integration-slack-dto';
+import {logger} from '@shipfox/node-opentelemetry';
+import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
+import {config} from '#config.js';
+import {isSlackTimestampWithinReplayWindow, verifySlackSignature} from '#core/signature.js';
+import {handleSlackCommand, handleSlackEvent, type SlackWebhookOutcome} from '#core/webhook.js';
+
+const SIGNATURE_HEADER = 'x-slack-signature';
+const TIMESTAMP_HEADER = 'x-slack-request-timestamp';
+
+export interface CreateSlackWebhookProcessorOptions {
+  coreDb: () => NodePgDatabase<Record<string, unknown>>;
+  claimWebhookDelivery: ClaimWebhookDeliveryFn;
+  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  recordDeliveryOnly: RecordDeliveryOnlyFn;
+  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+
+export type SlackWebhookProcessingResult = WebhookProcessingResult;
+
+export interface SlackWebhookProcessor {
+  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;
+}
+
+export function createSlackWebhookProcessor(
+  options: CreateSlackWebhookProcessorOptions,
+): SlackWebhookProcessor {
+  return {process: (request) => processSlackWebhookRequest(options, request)};
+}
+
+function processSlackWebhookRequest(
+  options: CreateSlackWebhookProcessorOptions,
+  request: StoredWebhookRequest,
+): Promise<WebhookProcessingResult> {
+  if (request.route_id !== 'slack.event' && request.route_id !== 'slack.command') {
+    throw new Error(`Slack processor cannot process ${request.route_id} requests`);
+  }
+
+  const signature = request.headers[SIGNATURE_HEADER];
+  const timestamp = request.headers[TIMESTAMP_HEADER];
+  if (!signature || !timestamp) {
+    return Promise.resolve({outcome: 'discarded', reason: 'missing_required_input'});
+  }
+
+  const rawBody = decodeWebhookBody(request.body);
+  const receiptTime = new Date(request.received_at).getTime();
+  if (!isSlackTimestampWithinReplayWindow(timestamp, receiptTime)) {
+    return Promise.resolve({outcome: 'discarded', reason: 'stale_at_receipt'});
+  }
+  if (
+    !verifySlackSignature({
+      signingSecret: config.SLACK_SIGNING_SECRET,
+      signature,
+      timestamp,
+      rawBody,
+      now: receiptTime,
+    })
+  ) {
+    return Promise.resolve({outcome: 'discarded', reason: 'invalid_signature'});
+  }
+
+  return request.route_id === 'slack.event'
+    ? processSlackEvent(options, rawBody)
+    : processSlackCommand(options, rawBody);
+}
+
+async function processSlackEvent(
+  options: CreateSlackWebhookProcessorOptions,
+  rawBody: Uint8Array,
+): Promise<WebhookProcessingResult> {
+  let rawPayload: unknown;
+  try {
+    rawPayload = JSON.parse(Buffer.from(rawBody).toString('utf8'));
+  } catch (error) {
+    logger().warn({err: error}, 'slack events payload JSON parse failed');
+    return {outcome: 'discarded', reason: 'malformed_payload'};
+  }
+
+  const event = slackEventsRequestSchema.safeParse(rawPayload);
+  if (!event.success) {
+    logger().warn({issues: event.error.issues}, 'slack events envelope failed schema validation');
+    return {outcome: 'discarded', reason: 'unsupported_event'};
+  }
+  const envelope = event.data;
+  if (envelope.type === 'url_verification') {
+    return {outcome: 'processed', challenge: envelope.challenge};
+  }
+
+  const result = await options.coreDb().transaction(async (tx) =>
+    handleSlackEvent({
+      tx,
+      deliveryId: envelope.event_id,
+      envelope,
+      claimWebhookDelivery: options.claimWebhookDelivery,
+      publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+      recordDeliveryOnly: options.recordDeliveryOnly,
+      getIntegrationConnectionById: options.getIntegrationConnectionById,
+    }),
+  );
+  return toProcessingResult(result.outcome, envelope.event_id);
+}
+
+async function processSlackCommand(
+  options: CreateSlackWebhookProcessorOptions,
+  rawBody: Uint8Array,
+): Promise<WebhookProcessingResult> {
+  const command = slackSlashCommandSchema.safeParse(
+    Object.fromEntries(new URLSearchParams(Buffer.from(rawBody).toString('utf8'))),
+  );
+  if (!command.success) {
+    logger().warn({issues: command.error.issues}, 'slack command failed schema validation');
+    return {outcome: 'discarded', reason: 'unsupported_event'};
+  }
+
+  const result = await options.coreDb().transaction(async (tx) =>
+    handleSlackCommand({
+      tx,
+      deliveryId: command.data.trigger_id,
+      command: command.data,
+      publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+      recordDeliveryOnly: options.recordDeliveryOnly,
+      getIntegrationConnectionById: options.getIntegrationConnectionById,
+    }),
+  );
+  return toProcessingResult(result.outcome, command.data.trigger_id);
+}
+
+function toProcessingResult(
+  outcome: SlackWebhookOutcome,
+  deliveryId: string,
+): WebhookProcessingResult {
+  if (outcome === 'published') return {outcome: 'processed', deliveryId};
+  if (outcome === 'duplicate') return {outcome: 'duplicate', deliveryId};
+  return {
+    outcome: 'discarded',
+    reason: outcome === 'unsupported-event' ? 'unsupported_event' : 'connection_unavailable',
+    deliveryId,
+  };
+}

package/src/core/webhook.test.ts

@@ -4,7 +4,7 @@ import type {
   IntegrationConnection,
 } from '@shipfox/api-integration-core-dto';
 import {db} from '#db/db.js';
-import {upsertSlackInstallation} from '#db/installations.js';
+import {getSlackInstallationByTeamId, upsertSlackInstallation} from '#db/installations.js';
 import {slackInstallations} from '#db/schema/installations.js';
 import {handleSlackCommand, handleSlackEvent} from './webhook.js';
 
@@ -30,7 +30,7 @@ function eventEnvelope(overrides: Record<string, unknown> = {}) {
     api_app_id: 'A1',
     event: {type: 'app_mention', channel: 'C1', user: 'U1', text: 'hello', ts: '1.0'},
     event_id: 'Ev1',
-    event_time: 1_721_300_000,
+    event_time: Math.floor(Date.now() / 1000) + 60,
     ...overrides,
   };
 }
@@ -69,6 +69,7 @@ function handlers(connection = fakeConnection()) {
     connection,
     publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: true})),
     recordDeliveryOnly: vi.fn(() => Promise.resolve()),
+    claimWebhookDelivery: vi.fn(() => Promise.resolve({claimed: true})),
     getIntegrationConnectionById: vi.fn<GetIntegrationConnectionByIdFn>(() =>
       Promise.resolve(connection),
     ),
@@ -126,6 +127,134 @@ describe('Slack webhook handlers', () => {
     );
   });
 
+  it('revokes an installation when Slack uninstalls the app', async () => {
+    const deps = handlers();
+    await seedInstallation(deps.connection);
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-uninstalled',
+      envelope: eventEnvelope({event: {type: 'app_uninstalled'}}),
+      ...deps,
+    });
+
+    const installation = await getSlackInstallationByTeamId('T1');
+    expect(result.outcome).toBe('revoked');
+    expect(installation?.status).toBe('revoked');
+    expect(deps.claimWebhookDelivery).toHaveBeenCalledTimes(1);
+    expect(deps.publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(deps.getIntegrationConnectionById).not.toHaveBeenCalled();
+  });
+
+  it('revokes an installation when its bot token is revoked', async () => {
+    const deps = handlers();
+    await seedInstallation(deps.connection);
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-bot-revoked',
+      envelope: eventEnvelope({event: {type: 'tokens_revoked', tokens: {bot: ['UBOT']}}}),
+      ...deps,
+    });
+
+    const installation = await getSlackInstallationByTeamId('T1');
+    expect(result.outcome).toBe('revoked');
+    expect(installation?.status).toBe('revoked');
+  });
+
+  it.each([
+    ['an OAuth token is revoked', {oauth: ['UOAUTH']}],
+    ['the revoked token set is missing', undefined],
+    ['the revoked bot token set is empty', {bot: []}],
+  ])('keeps an installation active when %s', async (_description, tokens) => {
+    const deps = handlers();
+    await seedInstallation(deps.connection);
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-oauth-revoked',
+      envelope: eventEnvelope({event: {type: 'tokens_revoked', tokens}}),
+      ...deps,
+    });
+
+    const installation = await getSlackInstallationByTeamId('T1');
+    expect(result.outcome).toBe('unaffected-revocation');
+    expect(installation?.status).toBe('installed');
+    expect(deps.publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(deps.claimWebhookDelivery).toHaveBeenCalledTimes(1);
+  });
+
+  it('records an unknown lifecycle-event team without resolving a connection', async () => {
+    const deps = handlers();
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-uninstalled-missing',
+      envelope: eventEnvelope({
+        team_id: 'T-missing',
+        event: {type: 'app_uninstalled'},
+      }),
+      ...deps,
+    });
+
+    expect(result.outcome).toBe('unknown-team');
+    expect(deps.getIntegrationConnectionById).not.toHaveBeenCalled();
+    expect(deps.claimWebhookDelivery).toHaveBeenCalledTimes(1);
+  });
+
+  it('records an already revoked lifecycle-event installation without throwing', async () => {
+    const deps = handlers();
+    await seedInstallation(deps.connection, 'revoked');
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-uninstalled-replay',
+      envelope: eventEnvelope({event: {type: 'app_uninstalled'}}),
+      ...deps,
+    });
+
+    expect(result.outcome).toBe('revoked-installation');
+    expect(deps.claimWebhookDelivery).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not revoke an installation after a duplicate lifecycle delivery', async () => {
+    const deps = handlers();
+    deps.claimWebhookDelivery.mockResolvedValue({claimed: false});
+    await seedInstallation(deps.connection);
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-uninstalled-duplicate',
+      envelope: eventEnvelope({event: {type: 'app_uninstalled'}}),
+      ...deps,
+    });
+
+    const installation = await getSlackInstallationByTeamId('T1');
+    expect(result.outcome).toBe('duplicate');
+    expect(installation?.status).toBe('installed');
+    expect(deps.getIntegrationConnectionById).not.toHaveBeenCalled();
+  });
+
+  it('does not revoke a reconnected installation for a delayed lifecycle event', async () => {
+    const deps = handlers();
+    await seedInstallation(deps.connection);
+    await seedInstallation(deps.connection);
+
+    const result = await handleSlackEvent({
+      tx: db(),
+      deliveryId: 'Ev-uninstalled-stale',
+      envelope: eventEnvelope({
+        event: {type: 'app_uninstalled'},
+        event_time: Math.floor(Date.now() / 1000) - 60,
+      }),
+      ...deps,
+    });
+
+    const installation = await getSlackInstallationByTeamId('T1');
+    expect(result.outcome).toBe('stale-lifecycle-event');
+    expect(installation?.status).toBe('installed');
+  });
+
   it.each([
     ['a bot-authored event', {event: {type: 'message', bot_id: 'B1'}}],
     ['an event from this installation bot', {event: {type: 'reaction_added', user: 'UBOT'}}],

package/src/core/webhook.ts

@@ -1,4 +1,5 @@
 import type {
+  ClaimWebhookDeliveryFn,
   GetIntegrationConnectionByIdFn,
   IntegrationConnection,
   IntegrationTx,
@@ -6,15 +7,23 @@ import type {
   RecordDeliveryOnlyFn,
 } from '@shipfox/api-integration-core-dto';
 import {
+  SLACK_APP_UNINSTALLED_EVENT,
   SLACK_PROVIDER,
   SLACK_SLASH_COMMAND_EVENT,
   type SlackEventBaseEnvelopeDto,
+  type SlackLifecycleEventType,
   type SlackSlashCommandDto,
   slackEventEnvelopeSchema,
+  slackLifecycleEventTypes,
+  slackTokensRevokedEventSchema,
 } from '@shipfox/api-integration-slack-dto';
 import {logger} from '@shipfox/node-opentelemetry';
 import {z} from 'zod';
-import {getSlackInstallationByTeamId, type SlackInstallation} from '#db/installations.js';
+import {
+  getSlackInstallationByTeamId,
+  markSlackInstallationRevoked,
+  type SlackInstallation,
+} from '#db/installations.js';
 
 const slackSelfAuthoredEventSchema = z
   .object({
@@ -35,6 +44,9 @@ export type SlackWebhookOutcome =
   | 'duplicate'
   | 'unknown-team'
   | 'revoked-installation'
+  | 'revoked'
+  | 'unaffected-revocation'
+  | 'stale-lifecycle-event'
   | 'missing-connection'
   | 'inactive-connection'
   | 'unsupported-event'
@@ -50,6 +62,7 @@ interface SlackWebhookParams {
 
 export interface HandleSlackEventParams extends SlackWebhookParams {
   envelope: SlackEventBaseEnvelopeDto;
+  claimWebhookDelivery: ClaimWebhookDeliveryFn;
 }
 
 export interface HandleSlackCommandParams extends SlackWebhookParams {
@@ -60,15 +73,25 @@ type SlackConnectionResolution =
   | {kind: 'ok'; connection: IntegrationConnection; installation: SlackInstallation}
   | {
       kind: 'drop';
-      outcome: Exclude<
-        SlackWebhookOutcome,
-        'published' | 'duplicate' | 'unsupported-event' | 'self-message'
-      >;
+      outcome: SlackConnectionDropOutcome;
     };
 
+type SlackCommandOutcome = Exclude<
+  SlackWebhookOutcome,
+  | 'unsupported-event'
+  | 'self-message'
+  | 'revoked'
+  | 'unaffected-revocation'
+  | 'stale-lifecycle-event'
+>;
+type SlackConnectionDropOutcome = Exclude<SlackCommandOutcome, 'published' | 'duplicate'>;
+
 export async function handleSlackEvent(
   params: HandleSlackEventParams,
 ): Promise<{outcome: SlackWebhookOutcome}> {
+  const lifecycleType = asSlackLifecycleEventType(params.envelope.event.type);
+  if (lifecycleType) return handleSlackLifecycleEvent(params, lifecycleType);
+
   const resolution = await resolveSlackConnection({
     ...params,
     teamId: params.envelope.team_id,
@@ -120,7 +143,7 @@ export async function handleSlackEvent(
 
 export async function handleSlackCommand(
   params: HandleSlackCommandParams,
-): Promise<{outcome: Exclude<SlackWebhookOutcome, 'unsupported-event' | 'self-message'>}> {
+): Promise<{outcome: SlackCommandOutcome}> {
   const resolution = await resolveSlackConnection({
     ...params,
     teamId: params.command.team_id,
@@ -158,6 +181,120 @@ export function isSelfAuthoredSlackEvent(event: unknown, botUserId: string): boo
   );
 }
 
+function asSlackLifecycleEventType(eventType: string): SlackLifecycleEventType | undefined {
+  return slackLifecycleEventTypes.find((type) => type === eventType);
+}
+
+async function handleSlackLifecycleEvent(
+  params: HandleSlackEventParams,
+  lifecycleType: SlackLifecycleEventType,
+): Promise<{outcome: SlackWebhookOutcome}> {
+  const claim = await params.claimWebhookDelivery({
+    tx: params.tx,
+    provider: SLACK_PROVIDER,
+    deliveryId: params.deliveryId,
+  });
+  if (!claim.claimed) {
+    logger().info(
+      {deliveryId: params.deliveryId, teamId: params.envelope.team_id, lifecycleType},
+      'slack lifecycle event: duplicate delivery, dropping',
+    );
+    return {outcome: 'duplicate'};
+  }
+
+  const installation = await getSlackInstallationByTeamId(params.envelope.team_id, {tx: params.tx});
+  if (!installation) {
+    logger().warn(
+      {deliveryId: params.deliveryId, teamId: params.envelope.team_id, lifecycleType},
+      'slack lifecycle event: unknown team, dropping',
+    );
+    return {outcome: 'unknown-team'};
+  }
+
+  if (installation.status !== 'installed') {
+    logger().info(
+      {
+        deliveryId: params.deliveryId,
+        teamId: params.envelope.team_id,
+        connectionId: installation.connectionId,
+        lifecycleType,
+      },
+      'slack lifecycle event: installation is not installed, dropping',
+    );
+    return {outcome: 'revoked-installation'};
+  }
+
+  if (
+    isSlackLifecycleEventOlderThanInstallation(params.envelope.event_time, installation.updatedAt)
+  ) {
+    logger().info(
+      {
+        deliveryId: params.deliveryId,
+        teamId: params.envelope.team_id,
+        connectionId: installation.connectionId,
+      },
+      'slack lifecycle event: predates the current installation, dropping',
+    );
+    return {outcome: 'stale-lifecycle-event'};
+  }
+
+  const revokesInstallation =
+    lifecycleType === SLACK_APP_UNINSTALLED_EVENT ||
+    slackTokensRevokedAffectsBot(params.envelope.event, installation.botUserId);
+  if (!revokesInstallation) {
+    logger().info(
+      {
+        deliveryId: params.deliveryId,
+        teamId: params.envelope.team_id,
+        connectionId: installation.connectionId,
+      },
+      'slack lifecycle event: token revocation does not affect installation bot, dropping',
+    );
+    return {outcome: 'unaffected-revocation'};
+  }
+
+  const revoked = await markSlackInstallationRevoked(installation.connectionId, {
+    tx: params.tx,
+    expectedGeneration: installation.generation,
+  });
+  if (!revoked) {
+    logger().info(
+      {
+        deliveryId: params.deliveryId,
+        teamId: params.envelope.team_id,
+        connectionId: installation.connectionId,
+      },
+      'slack lifecycle event: installation changed before revocation, dropping',
+    );
+    return {outcome: 'stale-lifecycle-event'};
+  }
+
+  logger().info(
+    {
+      deliveryId: params.deliveryId,
+      teamId: params.envelope.team_id,
+      connectionId: installation.connectionId,
+      lifecycleType,
+    },
+    'slack lifecycle event: installation revoked',
+  );
+  return {outcome: 'revoked'};
+}
+
+function slackTokensRevokedAffectsBot(event: unknown, botUserId: string): boolean {
+  const parsed = slackTokensRevokedEventSchema.safeParse(event);
+  // Only a named bot token proves this installation credential was revoked; OAuth-only and missing lists do not.
+  return parsed.success && (parsed.data.tokens?.bot?.includes(botUserId) ?? false);
+}
+
+function isSlackLifecycleEventOlderThanInstallation(
+  eventTime: number,
+  installationUpdatedAt: Date,
+): boolean {
+  // Slack event_time has second precision, so an event stamped in the installation second is not provably stale.
+  return eventTime < Math.floor(installationUpdatedAt.getTime() / 1000);
+}
+
 async function resolveSlackConnection(
   params: SlackWebhookParams & {teamId: string},
 ): Promise<SlackConnectionResolution> {

package/src/db/installations.test.ts

@@ -90,4 +90,19 @@ describe('slack installations', () => {
 
     expect(result?.status).toBe('revoked');
   });
+
+  it('does not revoke an installation updated after the lifecycle event was read', async () => {
+    const input = createInstallationInput();
+    const installation = await upsertSlackInstallation(input);
+    await upsertSlackInstallation(input);
+
+    const result = await markSlackInstallationRevoked(input.connectionId, {
+      expectedGeneration: installation.generation,
+    });
+
+    expect(result).toBeUndefined();
+    await expect(getSlackInstallationByConnectionId(input.connectionId)).resolves.toMatchObject({
+      status: 'installed',
+    });
+  });
 });

package/src/db/installations.ts

@@ -1,5 +1,5 @@
 import {isUniqueViolation} from '@shipfox/node-drizzle';
-import {eq} from 'drizzle-orm';
+import {and, eq, sql} from 'drizzle-orm';
 import {
   SlackConnectionAlreadyLinkedError,
   SlackInstallationAlreadyLinkedError,
@@ -18,6 +18,7 @@ export interface SlackInstallation {
   botUserId: string;
   scopes: string[];
   status: SlackInstallationStatus;
+  generation: number;
   tokenExpiresAt: Date | null;
   createdAt: Date;
   updatedAt: Date;
@@ -69,6 +70,7 @@ export async function upsertSlackInstallation(
           botUserId: params.botUserId,
           scopes: params.scopes,
           status: params.status,
+          generation: sql`${slackInstallations.generation} + 1`,
           tokenExpiresAt: params.tokenExpiresAt ?? null,
           updatedAt: now,
         },
@@ -128,13 +130,19 @@ export async function deleteSlackInstallationByConnectionId(
 
 export async function markSlackInstallationRevoked(
   connectionId: string,
-  options: {tx?: unknown} = {},
+  options: {tx?: unknown; expectedGeneration?: number | undefined} = {},
 ): Promise<SlackInstallation | undefined> {
   const executor = (options.tx ?? db()) as SlackDb | SlackTx;
+  const expectedInstallation = options.expectedGeneration
+    ? and(
+        eq(slackInstallations.connectionId, connectionId),
+        eq(slackInstallations.generation, options.expectedGeneration),
+      )
+    : eq(slackInstallations.connectionId, connectionId);
   const [row] = await executor
     .update(slackInstallations)
     .set({status: 'revoked', updatedAt: new Date()})
-    .where(eq(slackInstallations.connectionId, connectionId))
+    .where(expectedInstallation)
     .returning();
   if (!row) return undefined;
   return toSlackInstallation(row);

package/src/db/schema/installations.ts

@@ -1,5 +1,5 @@
 import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
-import {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import {integer, jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
 import type {SlackInstallation} from '#db/installations.js';
 import {pgTable} from './common.js';
 
@@ -14,6 +14,7 @@ export const slackInstallations = pgTable(
     botUserId: text('bot_user_id').notNull(),
     scopes: jsonb('scopes').notNull().$type<string[]>(),
     status: text('status').notNull().$type<SlackInstallation['status']>(),
+    generation: integer('generation').notNull().default(1),
     tokenExpiresAt: timestamp('token_expires_at', {withTimezone: true}),
     createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
     updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
@@ -37,6 +38,7 @@ export function toSlackInstallation(row: SlackInstallationDb): SlackInstallation
     botUserId: row.botUserId,
     scopes: row.scopes,
     status: row.status,
+    generation: row.generation,
     tokenExpiresAt: row.tokenExpiresAt,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,

package/src/index.test.ts

@@ -22,4 +22,15 @@ describe('createSlackIntegrationProvider', () => {
 
     expect(catalog).toBe(slackAgentToolCatalog);
   });
+
+  it('exposes explicit connection cleanup without requiring routes', () => {
+    const deleteConnectionRecords = vi.fn(() => Promise.resolve());
+    const deleteConnectionSecrets = vi.fn(() => Promise.resolve());
+    const provider = createSlackIntegrationProvider({
+      cleanup: {deleteConnectionRecords, deleteConnectionSecrets},
+    });
+
+    expect(provider.deleteConnectionRecords).toBe(deleteConnectionRecords);
+    expect(provider.deleteConnectionSecrets).toBe(deleteConnectionSecrets);
+  });
 });