fix(slack): honor implicit Search approval during authorization

Author: waleedlatif1

apps/sim/lib/credential-groups/slack-managed-users.ts

@@ -33,6 +33,7 @@ import {
 } from '@/lib/credential-groups/slack-managed-user-scopes'
 import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
 import type { DbOrTx } from '@/lib/db/types'
+import { listOrganizationSearchApprovals } from '@/lib/knowledge/search/integration-policy'
 import { SLACK_CUSTOM_BOT_PROVIDER_ID, SLACK_CUSTOM_BOT_SECRET_TYPE } from '@/lib/oauth/types'
 import { resolveSlackAppCredentials } from '@/lib/slack-search/app-configuration'
 import { requireSlackSearchAppAvailable } from '@/lib/slack-search/shared-app'
@@ -579,7 +580,10 @@ export async function createSlackManagedUsersAttempt(params: {
       )
       .limit(1)
     searchApproval = {
-      approved: approval?.approved ?? false,
+      approved:
+        approval?.approved ??
+        (await listOrganizationSearchApprovals(scope.organizationId)).get('slack') ??
+        false,
       updatedAt: approval?.updatedAt.getTime() ?? null,
     }
     if (searchApproval.approved)
@@ -837,9 +841,13 @@ export async function exchangeAndConfigureSlackManagedUsers(params: {
         )
         .limit(1)
         .for('share')
+      const approved =
+        approval?.approved ??
+        (await listOrganizationSearchApprovals(params.attempt.organizationId, tx)).get('slack') ??
+        false
       if (
         !params.attempt.searchApproval ||
-        (approval?.approved ?? false) !== params.attempt.searchApproval.approved ||
+        approved !== params.attempt.searchApproval.approved ||
         (approval?.updatedAt.getTime() ?? null) !== params.attempt.searchApproval.updatedAt
       )
         throw new SlackManagedUsersError(

apps/sim/lib/knowledge/__integration__/search-mcp-setup.integration.ts

@@ -332,6 +332,78 @@ describe('atomic organization live Search MCP setup', () => {
     restoreSlackHttp = () => spy.mockRestore()
   }
 
+  async function seedImplicitSlackApproval() {
+    const knowledgeBaseId = generateId()
+    const connectorId = generateId()
+    await db.insert(knowledgeBase).values({
+      id: knowledgeBaseId,
+      userId: ids.owner,
+      organizationId: ids.organization,
+      isSearchIndex: true,
+      name: 'Slack Search fixture',
+    })
+    await db.insert(knowledgeConnector).values({
+      id: connectorId,
+      knowledgeBaseId,
+      connectorType: 'slack',
+      status: 'active',
+      sourceConfig: {},
+    })
+    return connectorId
+  }
+
+  it.each([false, true])(
+    'verifies implicitly approved Search permissions unless explicitly disabled (disabled: %s)',
+    async (disabled) => {
+      const setup = await seedSlackAuthorization()
+      await seedImplicitSlackApproval()
+      if (disabled)
+        await approveSearchIntegration.execute({
+          principal: createSessionPrincipal({ userId: ids.owner, sessionId: generateId() }),
+          input: { organizationId: ids.organization, connectorType: 'slack', approved: false },
+        })
+      expect(await integrationStatus('slack')).toMatchObject({ approved: !disabled })
+      const pending = await setup.start()
+      const scopes = disabled
+        ? [...SLACK_MANAGED_USER_SCOPES]
+        : [...new Set([...SLACK_MANAGED_USER_SCOPES, ...SLACK_SEARCH_USER_SCOPES])]
+      expect(new URL(pending.authorizationUrl).searchParams.get('user_scope')!.split(',')).toEqual(
+        expect.arrayContaining(scopes)
+      )
+      if (disabled)
+        expect(new URL(pending.authorizationUrl).searchParams.get('user_scope')).not.toContain(
+          'search:read.public'
+        )
+      provideSlackConsent(scopes)
+      await expect(setup.complete(pending.state)).resolves.toMatchObject({ ok: true })
+      const state = await snapshot()
+      expect(
+        state.groups[0].options.find((entry) => entry.id === setup.optionId)?.requiredScopes
+      ).toEqual(expect.arrayContaining(scopes))
+      if (disabled)
+        await expect(setup.resolveToken()).resolves.toMatchObject({ accessToken: 'fixture-token' })
+    }
+  )
+
+  it.each(['added', 'removed'] as const)(
+    'rejects pending authorization when implicit Search approval is %s',
+    async (change) => {
+      const setup = await seedSlackAuthorization()
+      const connectorId = change === 'removed' ? await seedImplicitSlackApproval() : null
+      const pending = await setup.start()
+      if (connectorId)
+        await db
+          .update(knowledgeConnector)
+          .set({ archivedAt: new Date() })
+          .where(eq(knowledgeConnector.id, connectorId))
+      else await seedImplicitSlackApproval()
+      provideSlackConsent([...SLACK_MANAGED_USER_SCOPES, ...SLACK_SEARCH_USER_SCOPES])
+      await expect(setup.complete(pending.state)).rejects.toThrow('Search approval changed')
+      expect((await snapshot()).groups).toEqual(setup.before.groups)
+      await expect(setup.resolveToken()).resolves.toMatchObject({ accessToken: 'fixture-token' })
+    }
+  )
+
   it.each([
     { name: 'workflow policy', scopes: SLACK_MANAGED_USER_SCOPES },
     { name: 'custom policy', scopes: ['chat:write', 'users:read', 'users:read.email'] },

apps/sim/lib/knowledge/search/integration-policy.ts

@@ -2,18 +2,22 @@ import { db } from '@sim/db'
 import { knowledgeBase, knowledgeConnector, organizationSearchIntegration } from '@sim/db/schema'
 import { and, eq, isNull, sql } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import type { DbOrTx } from '@/lib/db/types'
 
 /** Existing configured sources retain approval until an admin records an explicit decision. */
-export async function listOrganizationSearchApprovals(organizationId: string) {
+export async function listOrganizationSearchApprovals(
+  organizationId: string,
+  executor: DbOrTx = db
+) {
   const [decisions, configured] = await Promise.all([
-    db
+    executor
       .select({
         connectorType: organizationSearchIntegration.connectorType,
         approved: organizationSearchIntegration.approved,
       })
       .from(organizationSearchIntegration)
       .where(eq(organizationSearchIntegration.organizationId, organizationId)),
-    db
+    executor
       .selectDistinct({ connectorType: knowledgeConnector.connectorType })
       .from(knowledgeConnector)
       .innerJoin(knowledgeBase, eq(knowledgeBase.id, knowledgeConnector.knowledgeBaseId))