@shipfox/api-integration-slack 4.0.0

package/src/core/agent-tools-provider.ts

@@ -0,0 +1,147 @@
+import type {
+  AgentToolSession,
+  AgentToolsProvider,
+  IntegrationConnection,
+  OpenAgentToolsSessionInput,
+} from '@shipfox/api-integration-core-dto';
+import {logger} from '@shipfox/node-opentelemetry';
+import type {SlackApiClient, SlackWebApiResponse} from '#api/client.js';
+import {
+  SLACK_TOOL_METHODS,
+  type SlackAgentToolCatalogEntry,
+  type SlackAgentToolId,
+  type SlackAgentToolRequiredScope,
+  slackAgentToolCatalog,
+  slackAgentToolSelectionCatalog,
+} from '#core/agent-tools.js';
+import {SlackIntegrationProviderError} from '#core/errors.js';
+import type {SlackTokenStore} from '#core/tokens.js';
+
+type SlackIntegrationConnection = IntegrationConnection<'slack'>;
+
+export type SlackToolCallResult = {
+  isError?: boolean | undefined;
+  content: readonly {type: 'text'; text: string}[];
+  structuredContent?: Record<string, unknown> | undefined;
+};
+
+export interface SlackAgentToolsProviderOptions {
+  slack: Pick<SlackApiClient, 'callMethod'>;
+  tokenStore: Pick<SlackTokenStore, 'getAccessToken'>;
+}
+
+export class SlackAgentToolsProvider
+  implements
+    AgentToolsProvider<
+      SlackIntegrationConnection,
+      SlackAgentToolRequiredScope,
+      unknown,
+      SlackToolCallResult
+    >
+{
+  constructor(private readonly options: SlackAgentToolsProviderOptions) {}
+
+  catalog() {
+    return slackAgentToolCatalog;
+  }
+
+  selectionCatalog() {
+    return slackAgentToolSelectionCatalog;
+  }
+
+  async openSession(
+    input: OpenAgentToolsSessionInput<
+      SlackIntegrationConnection,
+      SlackAgentToolRequiredScope,
+      unknown
+    >,
+  ): Promise<AgentToolSession<SlackToolCallResult>> {
+    const token = await this.options.tokenStore.getAccessToken({connectionId: input.connection.id});
+
+    return {
+      call: async (call) => {
+        const tool = input.tools.find((candidate) => candidate.id === call.toolId);
+        if (!tool) return slackToolError(`Unknown Slack tool: ${call.toolId}`);
+        const method = slackToolMethod(tool.id);
+        if (!method) return slackToolError(`Unknown Slack tool method: ${tool.id}`);
+        const missingParameter = missingRequiredParameter(tool, call.arguments);
+        if (missingParameter) {
+          return slackToolError(`Missing required parameter: ${missingParameter}`);
+        }
+
+        let body: SlackWebApiResponse;
+        try {
+          body = await this.options.slack.callMethod({
+            method,
+            token,
+            arguments: call.arguments,
+          });
+        } catch (error) {
+          if (error instanceof SlackIntegrationProviderError) {
+            return slackToolError(error.message, {
+              code: error.reason,
+              retryAfterSeconds: error.retryAfterSeconds,
+            });
+          }
+          throw error;
+        }
+
+        if (body.ok) return slackToolResult(body);
+        const slackError = typeof body.error === 'string' ? body.error : 'Slack request failed';
+        if (isSlackAccessError(slackError)) {
+          logger().warn(
+            {connectionId: input.connection.id, slackError},
+            'Slack API rejected integration credentials',
+          );
+          return slackToolError(slackError, {code: 'access-denied'});
+        }
+        if (slackError === 'ratelimited') {
+          return slackToolError(slackError, {code: 'rate-limited'});
+        }
+        return slackToolError(slackError);
+      },
+      close: () => Promise.resolve(),
+    };
+  }
+}
+
+function slackToolMethod(toolId: string): string | undefined {
+  return SLACK_TOOL_METHODS[toolId as SlackAgentToolId];
+}
+
+function missingRequiredParameter(
+  tool: SlackAgentToolCatalogEntry,
+  args: Record<string, unknown>,
+): string | undefined {
+  const required = tool.inputSchema.required;
+  if (!Array.isArray(required)) return undefined;
+  return required.find((parameter) => typeof parameter === 'string' && !(parameter in args));
+}
+
+function isSlackAccessError(error: string): boolean {
+  return error === 'invalid_auth' || error === 'token_revoked' || error === 'account_inactive';
+}
+
+function slackToolResult(body: SlackWebApiResponse): SlackToolCallResult {
+  return {
+    content: [{type: 'text', text: JSON.stringify(body)}],
+    structuredContent: body,
+  };
+}
+
+function slackToolError(
+  message: string,
+  options: {code?: string | undefined; retryAfterSeconds?: number | undefined} = {},
+): SlackToolCallResult {
+  const structuredContent = {
+    ...(options.code === undefined ? {} : {code: options.code}),
+    ...(options.retryAfterSeconds === undefined
+      ? {}
+      : {retryAfterSeconds: options.retryAfterSeconds}),
+  };
+  return {
+    isError: true,
+    content: [{type: 'text', text: message}],
+    ...(Object.keys(structuredContent).length === 0 ? {} : {structuredContent}),
+  };
+}

package/src/core/agent-tools.test.ts

@@ -0,0 +1,90 @@
+import {
+  SLACK_TOOL_METHODS,
+  type SlackAgentToolId,
+  slackAgentToolCatalog,
+  slackAgentToolSelectionCatalog,
+} from './agent-tools.js';
+
+const expectedTools = [
+  {id: 'conversations_history', sensitivity: 'read', requiredScope: 'read'},
+  {id: 'conversations_replies', sensitivity: 'read', requiredScope: 'read'},
+  {id: 'conversations_list', sensitivity: 'read', requiredScope: 'read'},
+  {id: 'users_info', sensitivity: 'read', requiredScope: 'read'},
+  {id: 'chat_postMessage', sensitivity: 'write', requiredScope: 'write'},
+  {id: 'chat_update', sensitivity: 'write', requiredScope: 'write'},
+  {id: 'reactions_add', sensitivity: 'write', requiredScope: 'write'},
+] as const;
+
+describe('slackAgentToolCatalog', () => {
+  it('defines the seven Slack tools with their access requirements', () => {
+    const tools = slackAgentToolCatalog.map(({id, sensitivity, requiredScope, sensitive}) => ({
+      id,
+      sensitivity,
+      requiredScope,
+      sensitive,
+    }));
+
+    expect(tools).toEqual(expectedTools.map((tool) => ({...tool, sensitive: false})));
+  });
+
+  it('documents every tool with an object input schema', () => {
+    const schemas = slackAgentToolCatalog.map(({description, inputSchema}) => ({
+      description,
+      type: inputSchema.type,
+    }));
+
+    expect(schemas).toHaveLength(7);
+    expect(
+      schemas.every(({description, type}) => description.length > 0 && type === 'object'),
+    ).toBe(true);
+  });
+
+  it('models Block Kit messages and Slack scalar parameters without narrowing valid calls', () => {
+    const postMessage = slackAgentToolCatalog.find(({id}) => id === 'chat_postMessage');
+    const listConversations = slackAgentToolCatalog.find(({id}) => id === 'conversations_list');
+    const history = slackAgentToolCatalog.find(({id}) => id === 'conversations_history');
+
+    expect(postMessage?.inputSchema).toMatchObject({
+      required: ['channel'],
+      properties: {
+        blocks: {type: 'array', items: {type: 'object'}},
+        thread_ts: {type: 'string'},
+      },
+    });
+    expect(listConversations?.inputSchema).toMatchObject({
+      properties: {types: {type: 'string'}, limit: {type: 'number'}},
+    });
+    expect(history?.inputSchema).toMatchObject({
+      properties: {oldest: {type: 'string'}, latest: {type: 'string'}},
+    });
+  });
+
+  it('maps every tool id to its dotted Slack Web API method', () => {
+    const methods = Object.fromEntries(
+      slackAgentToolCatalog.map(({id}) => [id, SLACK_TOOL_METHODS[id as SlackAgentToolId]]),
+    );
+
+    expect(methods).toEqual({
+      conversations_history: 'conversations.history',
+      conversations_replies: 'conversations.replies',
+      conversations_list: 'conversations.list',
+      users_info: 'users.info',
+      chat_postMessage: 'chat.postMessage',
+      chat_update: 'chat.update',
+      reactions_add: 'reactions.add',
+    });
+  });
+
+  it('exposes one standalone selector per tool with matching sensitivity', () => {
+    const selectors = slackAgentToolSelectionCatalog.selectors;
+
+    expect(selectors).toEqual(
+      expectedTools.map(({id, sensitivity}) => ({
+        token: id,
+        kind: 'standalone',
+        sensitivity,
+        sensitive: false,
+      })),
+    );
+  });
+});

package/src/core/agent-tools.ts

@@ -0,0 +1,189 @@
+import type {
+  AgentToolCatalogEntry,
+  AgentToolJsonSchema,
+  AgentToolSelectionCatalog,
+  AgentToolSelector,
+} from '@shipfox/api-integration-core-dto';
+
+export type SlackAgentToolRequiredScope = 'read' | 'write';
+export type SlackAgentToolCatalogEntry = AgentToolCatalogEntry<SlackAgentToolRequiredScope>;
+
+interface SlackAgentToolCatalogInput {
+  id: string;
+  description: string;
+  sensitivity: 'read' | 'write';
+  sensitive: boolean;
+  requiredScope: SlackAgentToolRequiredScope;
+  inputSchema: AgentToolJsonSchema;
+}
+
+const channelSchema = stringSchema('Slack channel ID');
+const cursorSchema = stringSchema('Next page cursor');
+const limitSchema = numberSchema('Maximum number of results to return');
+
+export const slackAgentToolCatalog = [
+  tool({
+    id: 'conversations_history',
+    description: 'List messages in a Slack channel or direct message.',
+    sensitivity: 'read',
+    sensitive: false,
+    requiredScope: 'read',
+    inputSchema: objectSchema(
+      {
+        channel: channelSchema,
+        cursor: cursorSchema,
+        limit: limitSchema,
+        oldest: stringSchema('Only messages after this Slack timestamp'),
+        latest: stringSchema('Only messages before this Slack timestamp'),
+        inclusive: booleanSchema('Include messages at the oldest or latest timestamp'),
+      },
+      ['channel'],
+    ),
+  }),
+  tool({
+    id: 'conversations_replies',
+    description: 'List replies in a Slack message thread.',
+    sensitivity: 'read',
+    sensitive: false,
+    requiredScope: 'read',
+    inputSchema: objectSchema(
+      {
+        channel: channelSchema,
+        ts: stringSchema('Slack timestamp of the parent message'),
+        cursor: cursorSchema,
+        limit: limitSchema,
+      },
+      ['channel', 'ts'],
+    ),
+  }),
+  tool({
+    id: 'conversations_list',
+    description: 'List Slack channels visible to the bot.',
+    sensitivity: 'read',
+    sensitive: false,
+    requiredScope: 'read',
+    inputSchema: objectSchema({
+      cursor: cursorSchema,
+      limit: limitSchema,
+      types: stringSchema('Comma-separated channel types, such as public_channel,private_channel'),
+      exclude_archived: booleanSchema('Exclude archived channels'),
+    }),
+  }),
+  tool({
+    id: 'users_info',
+    description: 'Look up a Slack user and profile by user ID.',
+    sensitivity: 'read',
+    sensitive: false,
+    requiredScope: 'read',
+    inputSchema: objectSchema({user: stringSchema('Slack user ID')}, ['user']),
+  }),
+  tool({
+    id: 'chat_postMessage',
+    description: 'Post a Slack message to a channel or thread. Provide text, blocks, or both.',
+    sensitivity: 'write',
+    sensitive: false,
+    requiredScope: 'write',
+    inputSchema: objectSchema(
+      {
+        channel: channelSchema,
+        text: stringSchema('Message text'),
+        thread_ts: stringSchema('Slack timestamp of the parent message when replying in a thread'),
+        blocks: arraySchema({type: 'object'}),
+      },
+      ['channel'],
+    ),
+  }),
+  tool({
+    id: 'chat_update',
+    description: 'Update a Slack message with text, blocks, or both.',
+    sensitivity: 'write',
+    sensitive: false,
+    requiredScope: 'write',
+    inputSchema: objectSchema(
+      {
+        channel: channelSchema,
+        ts: stringSchema('Slack timestamp of the message to update'),
+        text: stringSchema('Updated message text'),
+        blocks: arraySchema({type: 'object'}),
+      },
+      ['channel', 'ts'],
+    ),
+  }),
+  tool({
+    id: 'reactions_add',
+    description: 'Add an emoji reaction to a Slack message.',
+    sensitivity: 'write',
+    sensitive: false,
+    requiredScope: 'write',
+    inputSchema: objectSchema(
+      {
+        channel: channelSchema,
+        timestamp: stringSchema('Slack timestamp of the message'),
+        name: stringSchema('Emoji name without surrounding colons'),
+      },
+      ['channel', 'timestamp', 'name'],
+    ),
+  }),
+] as const satisfies readonly SlackAgentToolCatalogEntry[];
+
+export type SlackAgentToolId = (typeof slackAgentToolCatalog)[number]['id'];
+
+export const SLACK_TOOL_METHODS = {
+  conversations_history: 'conversations.history',
+  conversations_replies: 'conversations.replies',
+  conversations_list: 'conversations.list',
+  users_info: 'users.info',
+  chat_postMessage: 'chat.postMessage',
+  chat_update: 'chat.update',
+  reactions_add: 'reactions.add',
+} as const satisfies Record<SlackAgentToolId, string>;
+
+export const slackAgentToolSelectionCatalog =
+  buildSlackAgentToolSelectionCatalog(slackAgentToolCatalog);
+
+function buildSlackAgentToolSelectionCatalog(
+  catalog: readonly SlackAgentToolCatalogEntry[],
+): AgentToolSelectionCatalog {
+  return {
+    selectors: catalog.map(
+      (entry): AgentToolSelector => ({
+        token: entry.id,
+        kind: 'standalone',
+        sensitivity: entry.sensitivity,
+        sensitive: entry.sensitive,
+      }),
+    ),
+  };
+}
+
+function tool<const Entry extends SlackAgentToolCatalogInput>(input: Entry): Entry {
+  return input;
+}
+
+function objectSchema(
+  properties: Record<string, AgentToolJsonSchema>,
+  required: string[] = [],
+): AgentToolJsonSchema {
+  return {
+    type: 'object',
+    additionalProperties: false,
+    properties,
+    ...(required.length > 0 ? {required} : {}),
+  };
+}
+
+function stringSchema(description?: string): AgentToolJsonSchema {
+  return {type: 'string', ...(description ? {description} : {})};
+}
+
+function numberSchema(description?: string): AgentToolJsonSchema {
+  return {type: 'number', ...(description ? {description} : {})};
+}
+
+function booleanSchema(description: string): AgentToolJsonSchema {
+  return {type: 'boolean', description};
+}
+
+function arraySchema(items: AgentToolJsonSchema): AgentToolJsonSchema {
+  return {type: 'array', items};
+}

package/src/core/disconnect.ts

@@ -0,0 +1,26 @@
+import {deleteSlackInstallationByConnectionId} from '#db/installations.js';
+import {slackSecretsNamespace} from './tokens.js';
+
+export interface DisconnectSlackInstallationParams<Tx = unknown> {
+  connectionId: string;
+  getConnection(connectionId: string): Promise<{workspaceId: string} | undefined>;
+  deleteSecrets(params: {workspaceId: string; namespace: string}): Promise<number>;
+  transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+  deleteConnection(params: {connectionId: string}, options: {tx: Tx}): Promise<boolean>;
+}
+
+export async function disconnectSlackInstallation<Tx = unknown>(
+  params: DisconnectSlackInstallationParams<Tx>,
+): Promise<void> {
+  const connection = await params.getConnection(params.connectionId);
+  if (connection) {
+    await params.deleteSecrets({
+      workspaceId: connection.workspaceId,
+      namespace: slackSecretsNamespace(params.connectionId),
+    });
+  }
+  await params.transaction(async (tx) => {
+    await deleteSlackInstallationByConnectionId(params.connectionId, {tx});
+    await params.deleteConnection({connectionId: params.connectionId}, {tx});
+  });
+}

package/src/core/errors.ts

@@ -0,0 +1,92 @@
+import {IntegrationProviderError} from '@shipfox/api-integration-core-dto';
+
+export class SlackIntegrationProviderError extends IntegrationProviderError {}
+
+export class SlackInstallStateError extends Error {
+  constructor(message = 'Invalid Slack install state') {
+    super(message);
+    this.name = 'SlackInstallStateError';
+  }
+}
+
+export class SlackInstallStateActorMismatchError extends Error {
+  constructor() {
+    super('Slack install state was created by a different user');
+    this.name = 'SlackInstallStateActorMismatchError';
+  }
+}
+
+export class SlackOAuthCallbackError extends Error {
+  constructor(
+    public readonly providerError: string,
+    public readonly providerDescription: string | undefined,
+  ) {
+    super(providerDescription ?? `Slack OAuth callback failed: ${providerError}`);
+    this.name = 'SlackOAuthCallbackError';
+  }
+}
+
+export class SlackAuthorizationScopeMismatchError extends Error {
+  constructor(public readonly missingScopes: string[]) {
+    super(`Slack authorization is missing required scopes: ${missingScopes.join(', ')}`);
+    this.name = 'SlackAuthorizationScopeMismatchError';
+  }
+}
+
+export class SlackEnterpriseInstallUnsupportedError extends Error {
+  constructor() {
+    super('Slack Enterprise Grid installations are not supported');
+    this.name = 'SlackEnterpriseInstallUnsupportedError';
+  }
+}
+
+export class SlackTokenRotationUnsupportedError extends Error {
+  constructor() {
+    super('Slack token rotation is not supported');
+    this.name = 'SlackTokenRotationUnsupportedError';
+  }
+}
+
+export class SlackInstallationAlreadyLinkedError extends Error {
+  constructor(teamId: string) {
+    super(`Slack team is already linked to another Shipfox workspace: ${teamId}`);
+    this.name = 'SlackInstallationAlreadyLinkedError';
+  }
+}
+
+export class SlackConnectionAlreadyLinkedError extends Error {
+  constructor(connectionId: string) {
+    super(`Integration connection is already linked to another Slack team: ${connectionId}`);
+    this.name = 'SlackConnectionAlreadyLinkedError';
+  }
+}
+
+export class SlackConnectionNotFoundError extends Error {
+  constructor(connectionId: string) {
+    super(`Slack integration connection was not found: ${connectionId}`);
+    this.name = 'SlackConnectionNotFoundError';
+  }
+}
+
+export class SlackBotTokenMissingError extends Error {
+  constructor(connectionId: string) {
+    super(`Slack bot token is missing for connection: ${connectionId}`);
+    this.name = 'SlackBotTokenMissingError';
+  }
+}
+
+export type SlackAccessTokenUnavailableReason =
+  | 'installation-not-found'
+  | 'not-installed'
+  | 'expired';
+
+export class SlackAccessTokenUnavailableError extends Error {
+  constructor(
+    public readonly connectionId: string,
+    public readonly reason: SlackAccessTokenUnavailableReason,
+    public readonly expiresAt?: Date,
+  ) {
+    super(`Slack access token is unavailable for connection: ${connectionId} (${reason})`);
+    this.name = 'SlackAccessTokenUnavailableError';
+  }
+}

package/src/core/install.test.ts

@@ -0,0 +1,155 @@
+import type {UserContextMembership} from '@shipfox/api-auth-context';
+import type {IntegrationConnection} from '@shipfox/api-integration-core-dto';
+import type {SlackApiClient} from '#api/client.js';
+import type {ConnectSlackInstallationInput} from './install.js';
+import {handleSlackCallback} from './install.js';
+import {signSlackInstallState} from './state.js';
+
+function authorization(overrides: Record<string, unknown> = {}) {
+  return {
+    accessToken: 'xoxb-token',
+    botUserId: 'U123',
+    appId: 'A123',
+    teamId: 'T123',
+    teamName: 'Acme',
+    scopes: [
+      'app_mentions:read',
+      'im:history',
+      'chat:write',
+      'channels:history',
+      'groups:history',
+      'channels:read',
+      'groups:read',
+      'users:read',
+      'reactions:read',
+      'reactions:write',
+      'commands',
+    ],
+    ...overrides,
+  };
+}
+
+function connection(overrides: Partial<IntegrationConnection<'slack'>> = {}) {
+  return {
+    id: '00000000-0000-4000-8000-000000000001',
+    workspaceId: '00000000-0000-4000-8000-000000000002',
+    provider: 'slack',
+    externalAccountId: 'T123',
+    slug: 'slack_acme',
+    displayName: 'Slack Acme',
+    lifecycleStatus: 'active',
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  } satisfies IntegrationConnection<'slack'>;
+}
+
+function callbackParams(
+  overrides: Partial<Parameters<typeof handleSlackCallback>[0]> = {},
+): Parameters<typeof handleSlackCallback>[0] {
+  const slack: SlackApiClient = {
+    exchangeAuthorizationCode: vi.fn(() => Promise.resolve(authorization())),
+    revokeToken: vi.fn(() => Promise.resolve()),
+    callMethod: vi.fn(() => Promise.resolve({ok: true})),
+  };
+  return {
+    slack,
+    tokenStore: {storeTokens: vi.fn(() => Promise.resolve())},
+    code: 'code',
+    state: signSlackInstallState({
+      workspaceId: '00000000-0000-4000-8000-000000000002',
+      userId: 'user-1',
+    }),
+    sessionUserId: 'user-1',
+    sessionMemberships: [
+      {workspaceId: '00000000-0000-4000-8000-000000000002', role: 'admin'},
+    ] satisfies UserContextMembership[],
+    requireWorkspaceMembership: vi.fn(() => Promise.resolve()),
+    getExistingSlackConnection: vi.fn(() => Promise.resolve(undefined)),
+    connectSlackInstallation: vi.fn(() => Promise.resolve(connection())),
+    disconnectSlackInstallation: vi.fn(() => Promise.resolve()),
+    ...overrides,
+  };
+}
+
+describe('handleSlackCallback', () => {
+  it('connects a Slack installation and stores its bot token', async () => {
+    const params = callbackParams();
+
+    const result = await handleSlackCallback(params);
+
+    expect(result).toMatchObject({provider: 'slack', externalAccountId: 'T123'});
+    expect(params.connectSlackInstallation).toHaveBeenCalledWith({
+      workspaceId: '00000000-0000-4000-8000-000000000002',
+      teamId: 'T123',
+      teamName: 'Acme',
+      appId: 'A123',
+      botUserId: 'U123',
+      scopes: authorization().scopes,
+      tokenExpiresAt: null,
+      displayName: 'Slack Acme',
+    } satisfies ConnectSlackInstallationInput);
+    expect(params.tokenStore.storeTokens).toHaveBeenCalledWith({
+      connectionId: '00000000-0000-4000-8000-000000000001',
+      botToken: 'xoxb-token',
+      editedBy: 'user-1',
+    });
+  });
+
+  it('revokes the minted token when scopes do not match', async () => {
+    const slack: SlackApiClient = {
+      exchangeAuthorizationCode: vi.fn(() =>
+        Promise.resolve(authorization({scopes: ['chat:write']})),
+      ),
+      revokeToken: vi.fn(() => Promise.resolve()),
+      callMethod: vi.fn(() => Promise.resolve({ok: true})),
+    };
+    const params = callbackParams({slack});
+
+    const result = handleSlackCallback(params);
+
+    await expect(result).rejects.toThrow('missing required scopes');
+    expect(slack.revokeToken).toHaveBeenCalledWith({token: 'xoxb-token'});
+    expect(params.connectSlackInstallation).not.toHaveBeenCalled();
+  });
+
+  it('revokes a cross-workspace installation attempt', async () => {
+    const params = callbackParams({
+      getExistingSlackConnection: vi.fn(() =>
+        Promise.resolve(connection({workspaceId: crypto.randomUUID()})),
+      ),
+    });
+
+    const result = handleSlackCallback(params);
+
+    await expect(result).rejects.toThrow('already linked');
+    expect(params.slack.revokeToken).not.toHaveBeenCalled();
+  });
+
+  it('compensates a newly created connection when token storage fails', async () => {
+    const params = callbackParams({
+      tokenStore: {storeTokens: vi.fn(() => Promise.reject(new Error('store failed')))},
+    });
+
+    const result = handleSlackCallback(params);
+
+    await expect(result).rejects.toThrow('store failed');
+    expect(params.slack.revokeToken).toHaveBeenCalledWith({token: 'xoxb-token'});
+    expect(params.disconnectSlackInstallation).toHaveBeenCalledWith({
+      connectionId: connection().id,
+    });
+  });
+
+  it('refreshes an existing connection token without disconnecting it on storage failure', async () => {
+    const params = callbackParams({
+      getExistingSlackConnection: vi.fn(() => Promise.resolve(connection())),
+      tokenStore: {storeTokens: vi.fn(() => Promise.reject(new Error('store failed')))},
+    });
+
+    const result = handleSlackCallback(params);
+
+    await expect(result).rejects.toThrow('store failed');
+    expect(params.disconnectSlackInstallation).not.toHaveBeenCalled();
+    expect(params.slack.revokeToken).not.toHaveBeenCalled();
+  });
+});