@vellumai/assistant 0.6.3 → 0.6.5

package/src/runtime/routes/integrations/slack/__tests__/channel.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Unit tests for the POST /v1/integrations/slack/channel/config HTTP route.
+ *
+ * Mocks `setSlackChannelConfig` in the config-slack-channel handler module so
+ * the test can observe which arguments the HTTP handler forwards from the
+ * request body — particularly the optional `userToken` field.
+ */
+
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+import type { SlackChannelConfigResult } from "../../../../../daemon/handlers/config-slack-channel.js";
+
+// ---------------------------------------------------------------------------
+// Module mock — must appear before importing the module under test
+// ---------------------------------------------------------------------------
+
+interface SetConfigCall {
+  botToken?: string;
+  appToken?: string;
+  userToken?: string;
+}
+
+let lastSetConfigCall: SetConfigCall | null = null;
+let mockSetConfigResult: SlackChannelConfigResult = {
+  success: true,
+  hasBotToken: false,
+  hasAppToken: false,
+  hasUserToken: false,
+  connected: false,
+};
+
+mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
+  setSlackChannelConfig: async (
+    botToken?: string,
+    appToken?: string,
+    userToken?: string,
+  ): Promise<SlackChannelConfigResult> => {
+    lastSetConfigCall = { botToken, appToken, userToken };
+    return mockSetConfigResult;
+  },
+  getSlackChannelConfig: async (): Promise<SlackChannelConfigResult> => ({
+    success: true,
+    hasBotToken: false,
+    hasAppToken: false,
+    hasUserToken: false,
+    connected: false,
+  }),
+  clearSlackChannelConfig: async (): Promise<SlackChannelConfigResult> => ({
+    success: true,
+    hasBotToken: false,
+    hasAppToken: false,
+    hasUserToken: false,
+    connected: false,
+  }),
+}));
+
+const { handleSetSlackChannelConfig } = await import("../channel.js");
+
+describe("POST /v1/integrations/slack/channel/config", () => {
+  afterEach(() => {
+    lastSetConfigCall = null;
+    mockSetConfigResult = {
+      success: true,
+      hasBotToken: false,
+      hasAppToken: false,
+      hasUserToken: false,
+      connected: false,
+    };
+  });
+
+  test("forwards userToken from request body as the third argument", async () => {
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({ userToken: "xoxp-test-user-token" }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(200);
+
+    expect(lastSetConfigCall).not.toBeNull();
+    expect(lastSetConfigCall?.botToken).toBeUndefined();
+    expect(lastSetConfigCall?.appToken).toBeUndefined();
+    expect(lastSetConfigCall?.userToken).toBe("xoxp-test-user-token");
+  });
+
+  test("forwards all three tokens when present in body", async () => {
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({
+        botToken: "xoxb-bot",
+        appToken: "xapp-app",
+        userToken: "xoxp-user",
+      }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(200);
+
+    expect(lastSetConfigCall?.botToken).toBe("xoxb-bot");
+    expect(lastSetConfigCall?.appToken).toBe("xapp-app");
+    expect(lastSetConfigCall?.userToken).toBe("xoxp-user");
+  });
+
+  test("leaves userToken undefined when absent from body", async () => {
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({ botToken: "xoxb-bot", appToken: "xapp-app" }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(200);
+
+    expect(lastSetConfigCall?.botToken).toBe("xoxb-bot");
+    expect(lastSetConfigCall?.appToken).toBe("xapp-app");
+    expect(lastSetConfigCall?.userToken).toBeUndefined();
+  });
+
+  test("returns 400 when handler reports success: false", async () => {
+    mockSetConfigResult = {
+      success: false,
+      hasBotToken: false,
+      hasAppToken: false,
+      hasUserToken: false,
+      connected: false,
+      error: "Invalid user token: must start with \"xoxp-\"",
+    };
+
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({ userToken: "abc-123" }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(400);
+    expect(lastSetConfigCall?.userToken).toBe("abc-123");
+  });
+});

package/src/runtime/routes/integrations/slack/__tests__/share.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Unit tests for the Share UI Slack route handlers.
+ *
+ * Verifies the read/write auth split mirrors `messaging/providers/slack/adapter.ts`:
+ * - Channel enumeration (GET /v1/slack/channels) is a read path and must
+ *   prefer the user_token when present so the picker surfaces channels the
+ *   user is in but the bot isn't.
+ * - Channel sharing (POST /v1/slack/share) is a write path and must always
+ *   use the bot_token so posts come from the bot identity.
+ */
+
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { credentialKey } from "../../../../../security/credential-key.js";
+
+// ── Module mocks ────────────────────────────────────────────────────────────
+
+const getSecureKeyAsyncMock = mock(
+  async (_key: string): Promise<string | null> => null,
+);
+mock.module("../../../../../security/secure-keys.js", () => ({
+  getSecureKeyAsync: getSecureKeyAsyncMock,
+}));
+
+// share.ts imports getConnectionByProvider from oauth-store at module load.
+// Stub it to return undefined so Socket Mode tokens are the only source.
+mock.module("../../../../../oauth/oauth-store.js", () => ({
+  getConnectionByProvider: () => undefined,
+}));
+
+// Stub the app store so handleShareToSlackChannel finds the app.
+const FAKE_APP = { id: "app-1", name: "Test App", description: "desc" };
+mock.module("../../../../../memory/app-store.js", () => ({
+  getApp: (id: string) => (id === FAKE_APP.id ? FAKE_APP : undefined),
+}));
+
+const { handleListSlackChannels, handleShareToSlackChannel } = await import(
+  "../share.js"
+);
+
+// ── fetch capture ───────────────────────────────────────────────────────────
+
+type CapturedRequest = {
+  url: string;
+  method: string;
+  authorization: string | null;
+};
+
+const captured: CapturedRequest[] = [];
+const originalFetch = globalThis.fetch;
+
+function installFetchStub() {
+  globalThis.fetch = (async (
+    input: RequestInfo | URL,
+    init?: RequestInit,
+  ): Promise<Response> => {
+    const url =
+      typeof input === "string"
+        ? input
+        : input instanceof URL
+          ? input.toString()
+          : input.url;
+    const method = (init?.method ?? "GET").toUpperCase();
+    const headers = new Headers(init?.headers ?? {});
+    captured.push({
+      url,
+      method,
+      authorization: headers.get("authorization"),
+    });
+
+    // Minimal OK Slack envelopes so handlers don't throw on shape mismatches.
+    const body = fakeSlackResponse(url);
+    return new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }) as typeof fetch;
+}
+
+function fakeSlackResponse(url: string): Record<string, unknown> {
+  if (url.includes("/conversations.list")) {
+    return { ok: true, channels: [], response_metadata: { next_cursor: "" } };
+  }
+  if (url.includes("/chat.postMessage")) {
+    return { ok: true, ts: "1700000000.000100", channel: "C123" };
+  }
+  return { ok: true };
+}
+
+// ── Test fixtures ───────────────────────────────────────────────────────────
+
+const BOT_TOKEN = "xoxb-BOT";
+const USER_TOKEN = "xoxp-USER";
+
+describe("Slack share route token routing", () => {
+  beforeEach(() => {
+    captured.length = 0;
+    getSecureKeyAsyncMock.mockReset();
+    installFetchStub();
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  test("GET /v1/slack/channels: bot-only install reads with bot token", async () => {
+    getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
+      if (key === credentialKey("slack_channel", "bot_token")) return BOT_TOKEN;
+      return null;
+    });
+
+    const res = await handleListSlackChannels();
+    expect(res.status).toBe(200);
+
+    const listCall = captured.find((c) =>
+      c.url.includes("/conversations.list"),
+    );
+    expect(listCall).toBeDefined();
+    expect(listCall!.authorization).toBe(`Bearer ${BOT_TOKEN}`);
+  });
+
+  test("GET /v1/slack/channels: bot + user tokens prefer user_token for reads", async () => {
+    // Core fix: with both tokens stored, the Share UI picker must see every
+    // channel the USER can see — not just ones the bot is a member of.
+    getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
+      if (key === credentialKey("slack_channel", "bot_token")) return BOT_TOKEN;
+      if (key === credentialKey("slack_channel", "user_token"))
+        return USER_TOKEN;
+      return null;
+    });
+
+    const res = await handleListSlackChannels();
+    expect(res.status).toBe(200);
+
+    const listCall = captured.find((c) =>
+      c.url.includes("/conversations.list"),
+    );
+    expect(listCall).toBeDefined();
+    expect(listCall!.authorization).toBe(`Bearer ${USER_TOKEN}`);
+  });
+
+  test("POST /v1/slack/share: bot + user tokens still write with bot token", async () => {
+    // SAFETY invariant: posts MUST come from the bot identity. If the handler
+    // ever routed the write through user_token, the posted message would
+    // appear as the user — unambiguously wrong.
+    getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
+      if (key === credentialKey("slack_channel", "bot_token")) return BOT_TOKEN;
+      if (key === credentialKey("slack_channel", "user_token"))
+        return USER_TOKEN;
+      return null;
+    });
+
+    const req = new Request("http://localhost/v1/slack/share", {
+      method: "POST",
+      body: JSON.stringify({ appId: FAKE_APP.id, channelId: "C123" }),
+    });
+
+    const res = await handleShareToSlackChannel(req);
+    expect(res.status).toBe(200);
+
+    const postCall = captured.find((c) => c.url.includes("/chat.postMessage"));
+    expect(postCall).toBeDefined();
+    expect(postCall!.authorization).toBe(`Bearer ${BOT_TOKEN}`);
+  });
+
+  test("no tokens configured: both handlers return 503", async () => {
+    getSecureKeyAsyncMock.mockImplementation(async () => null);
+
+    const listRes = await handleListSlackChannels();
+    expect(listRes.status).toBe(503);
+
+    const shareReq = new Request("http://localhost/v1/slack/share", {
+      method: "POST",
+      body: JSON.stringify({ appId: FAKE_APP.id, channelId: "C123" }),
+    });
+    const shareRes = await handleShareToSlackChannel(shareReq);
+    expect(shareRes.status).toBe(503);
+  });
+});

package/src/runtime/routes/integrations/slack/channel.ts

@@ -1,9 +1,10 @@
 /**
  * Route handlers for Slack channel configuration.
  *
- * GET    /v1/integrations/slack/channel/config — get current config status
- * POST   /v1/integrations/slack/channel/config — validate and store credentials
- * DELETE /v1/integrations/slack/channel/config — clear credentials
+ * GET    /v1/integrations/slack/channel/config        — get current config status
+ * POST   /v1/integrations/slack/channel/config        — validate and store credentials
+ * DELETE /v1/integrations/slack/channel/config        — clear credentials
+ * POST   /v1/integrations/slack/channel/oauth-install — run OAuth loopback to capture bot+user tokens
  */
 
 import {
@@ -11,6 +12,7 @@ import {
   getSlackChannelConfig,
   setSlackChannelConfig,
 } from "../../../../daemon/handlers/config-slack-channel.js";
+import { runSlackChannelOAuthInstall } from "../../../../daemon/handlers/slack-channel-oauth-install.js";
 import type { RouteDefinition } from "../../../http-router.js";
 
 // ---------------------------------------------------------------------------
@@ -28,13 +30,21 @@ export async function handleGetSlackChannelConfig(): Promise<Response> {
 /**
  * POST /v1/integrations/slack/channel/config
  *
- * Body: { botToken?: string, appToken?: string }
+ * Body: { botToken?: string, appToken?: string, userToken?: string }
  */
 export async function handleSetSlackChannelConfig(
   req: Request,
 ): Promise<Response> {
-  const body = (await req.json()) as { botToken?: string; appToken?: string };
-  const result = await setSlackChannelConfig(body.botToken, body.appToken);
+  const body = (await req.json()) as {
+    botToken?: string;
+    appToken?: string;
+    userToken?: string;
+  };
+  const result = await setSlackChannelConfig(
+    body.botToken,
+    body.appToken,
+    body.userToken,
+  );
   const status = result.success ? 200 : 400;
   return Response.json(result, { status });
 }
@@ -47,6 +57,21 @@ export async function handleClearSlackChannelConfig(): Promise<Response> {
   return Response.json(result);
 }
 
+/**
+ * POST /v1/integrations/slack/channel/oauth-install
+ *
+ * Runs an OAuth2 loopback flow to install the Slack app and capture
+ * bot + user tokens. Requires client_id, client_secret, and app_token
+ * to be pre-stored in the credential vault.
+ *
+ * Blocks until the user completes the OAuth flow or the 5-minute timeout.
+ */
+export async function handleSlackChannelOAuthInstall(): Promise<Response> {
+  const result = await runSlackChannelOAuthInstall();
+  const status = result.success ? 200 : 400;
+  return Response.json(result, { status });
+}
+
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -68,5 +93,10 @@ export function slackChannelRouteDefinitions(): RouteDefinition[] {
       method: "DELETE",
       handler: () => handleClearSlackChannelConfig(),
     },
+    {
+      endpoint: "integrations/slack/channel/oauth-install",
+      method: "POST",
+      handler: () => handleSlackChannelOAuthInstall(),
+    },
   ];
 }

package/src/runtime/routes/integrations/slack/share.ts

@@ -13,6 +13,7 @@ import {
 } from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
 import { getConnectionByProvider } from "../../../../oauth/oauth-store.js";
+import { credentialKey } from "../../../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../../../security/secure-keys.js";
 import { getLogger } from "../../../../util/logger.js";
 import { httpError } from "../../../http-errors.js";
@@ -25,13 +26,46 @@ const log = getLogger("slack-share");
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve the Slack bot token from the OAuth connection store.
+ * Resolve a Slack token for the Share UI, mirroring the read/write auth split
+ * in `messaging/providers/slack/adapter.ts`.
+ *
+ * For Socket Mode installs (tokens stored under `credential/slack_channel/*`),
+ * prefer the user OAuth token (xoxp-) for reads when present — this lets the
+ * channel picker surface channels the user belongs to but the bot doesn't.
+ * Fall back to the bot token (xoxb-) otherwise.
+ *
+ * Writes MUST always use the bot token so posted messages come from the bot
+ * identity, never the user. Passing `user_token` to chat.postMessage would
+ * post as the user — unambiguously wrong for Share UI behavior.
+ *
+ * For legacy OAuth installs (no Socket Mode tokens), fall back to the OAuth
+ * connection's access_token, which is the bot token in Slack's OAuth v2 flow.
  */
-async function resolveSlackToken(): Promise<string | undefined> {
+async function resolveSlackToken(
+  mode: "read" | "write",
+): Promise<string | undefined> {
+  // Socket Mode path — tokens stored directly in the credential vault.
+  const botToken = await getSecureKeyAsync(
+    credentialKey("slack_channel", "bot_token"),
+  );
+  if (botToken) {
+    if (mode === "read") {
+      const userToken = await getSecureKeyAsync(
+        credentialKey("slack_channel", "user_token"),
+      );
+      return userToken ?? botToken;
+    }
+    // SAFETY: writes must use the bot token. Using the user token here would
+    // post as the user rather than the bot.
+    return botToken;
+  }
+
+  // Legacy OAuth path. Slack's OAuth v2 access_token is the bot token; there
+  // is no separate user token stored for this install, so reads and writes
+  // both use access_token.
   const conn = getConnectionByProvider("slack");
-  return conn
-    ? await getSecureKeyAsync(`oauth_connection/${conn.id}/access_token`)
-    : undefined;
+  if (!conn) return undefined;
+  return await getSecureKeyAsync(`oauth_connection/${conn.id}/access_token`);
 }
 
 // ---------------------------------------------------------------------------
@@ -61,7 +95,9 @@ const TYPE_SORT_ORDER: Record<string, number> = {
 };
 
 export async function handleListSlackChannels(): Promise<Response> {
-  const token = await resolveSlackToken();
+  // Channel enumeration is a read path — prefer user_token when present so
+  // the picker surfaces channels the user is in but the bot isn't.
+  const token = await resolveSlackToken("read");
   if (!token) {
     return httpError("SERVICE_UNAVAILABLE", "No Slack token configured", 503);
   }
@@ -137,7 +173,9 @@ export async function handleListSlackChannels(): Promise<Response> {
 export async function handleShareToSlackChannel(
   req: Request,
 ): Promise<Response> {
-  const token = await resolveSlackToken();
+  // Posting a message is a write path — must use the bot token so the message
+  // comes from the bot identity, never the user.
+  const token = await resolveSlackToken("write");
   if (!token) {
     return httpError("SERVICE_UNAVAILABLE", "No Slack token configured", 503);
   }