fix(slack): verify Search permissions before changing active grants

Author: waleedlatif1

apps/sim/app/o/[organizationId]/integrations/live-member-integrations.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import { Chip, toast } from '@sim/emcn'
+import { hasSlackSearchUserScopes } from '@/lib/credential-groups/slack-managed-user-scopes'
 import { LIVE_SEARCH_SCOPE_FIELDS } from '@/lib/sim-search/live/policy-schema'
 import { liveSearchProviderForCredential } from '@/lib/sim-search/live/provider-catalog'
 import {
@@ -133,6 +134,8 @@ export function LiveMemberIntegrations({ organizationId, search }: LiveMemberInt
           Boolean(option || server) &&
           approved &&
           (!option || option.configurationStatus === 'ready') &&
+          (provider !== 'slack' ||
+            (option?.provider === 'slack' && hasSlackSearchUserScopes(option.requiredScopes))) &&
           ((provider !== 'hubspot' && provider !== 'zoom') ||
             data.availableMcpConnectors.includes(provider))
         const scope =

apps/sim/app/o/[organizationId]/settings/components/integrations/live-search-settings.test.tsx

@@ -261,7 +261,7 @@ describe('live search administration', () => {
   it('opens Slack setup in Sources instead of its redirected service-account page', async () => {
     mocks.policies.mockReturnValue({ data: [{ connectorType: 'slack', approved: true }] })
     await render()
-    await act(async () => button('Slack app')!.click())
+    await act(async () => button('Verify permissions')!.click())
     expect(mockPush).not.toHaveBeenCalled()
     expect(container.querySelector('a[href*="providers/slack"]')).toBeNull()
     await act(async () =>

apps/sim/app/o/[organizationId]/settings/components/integrations/live-search-settings.tsx

@@ -7,6 +7,7 @@ import { useRouter } from 'next/navigation'
 import { useQueryState } from 'nuqs'
 import { SettingsPanel } from '@/components/settings/settings-panel'
 import type { SearchIntegrationApproval } from '@/lib/api/contracts/knowledge/search-integrations'
+import { hasSlackSearchUserScopes } from '@/lib/credential-groups/slack-managed-user-scopes'
 import { organizationRoutes } from '@/lib/navigation/paths'
 import {
   defaultLiveSearchPolicy,
@@ -163,6 +164,14 @@ export function LiveSearchSettings() {
               const memberProvider = liveSearchMemberAccountProvider(type)
               const mcpProvider = liveSearchMcpConnector(type)
               const group = accounts.data?.credentialGroup
+              const slackOption = group?.options.find((option) => option.provider === 'slack')
+              const needsSlackSetup =
+                type === 'slack' &&
+                accounts.data &&
+                (group?.status !== 'active' ||
+                  slackOption?.status !== 'active' ||
+                  slackOption.configurationStatus !== 'ready' ||
+                  !hasSlackSearchUserScopes(slackOption.requiredScopes))
               const needsMemberSetup =
                 integration.available !== false &&
                 accounts.data &&
@@ -193,7 +202,13 @@ export function LiveSearchSettings() {
                   iconVariant='custom'
                   icon={<IntegrationTile blockType={type} icon={meta.icon} />}
                   title={meta.name}
-                  description={integration.available === false ? 'Currently unavailable' : scope}
+                  description={
+                    integration.available === false
+                      ? 'Currently unavailable'
+                      : needsSlackSetup
+                        ? 'Member accounts · Verify Search permissions'
+                        : scope
+                  }
                   trailing={
                     <div className='flex gap-2'>
                       {serviceAccount && (
@@ -206,7 +221,9 @@ export function LiveSearchSettings() {
                         </ChipLink>
                       )}
                       {type === 'slack' && (
-                        <Chip onClick={() => void setConnectedAccounts('slack')}>Slack app</Chip>
+                        <Chip onClick={() => void setConnectedAccounts('slack')}>
+                          {needsSlackSetup ? 'Verify permissions' : 'Slack app'}
+                        </Chip>
                       )}
                       {needsMemberSetup && (
                         <Chip

apps/sim/ee/credential-groups/components/slack-managed-users-modal.tsx

@@ -20,6 +20,7 @@ import type { WorkspaceCredential } from '@/lib/api/contracts'
 import type { OrganizationCredential } from '@/lib/api/contracts/organization-credentials'
 import { resourceScopeFields, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import {
+  hasSlackSearchUserScopes,
   resolveSlackManagedUserScopes,
   SLACK_MANAGED_USER_SCOPES,
   SLACK_SEARCH_USER_SCOPES,
@@ -32,6 +33,7 @@ import {
   organizationAccountsKeys,
   useOrganizationAccounts,
 } from '@/hooks/queries/organization-accounts'
+import { useSearchIntegrations } from '@/hooks/queries/search-integrations'
 import { useSlackSearchInstallations } from '@/hooks/queries/slack-search'
 import { credentialGroupKeys } from '@/hooks/queries/utils/credential-group-queries'
 
@@ -107,11 +109,15 @@ export function SlackManagedUsersModal({
     availableApps.find((app) => app.appId === appId) ??
     (availableApps.length === 1 && !appId ? availableApps[0] : undefined)
   const sharedAppInstalled = organizationSetup && selectedApp?.appKind === 'shared'
+  const searchPolicies = useSearchIntegrations(organizationId ?? '', {
+    enabled: open && sharedAppInstalled,
+  })
+  const searchApproved = searchPolicies.data?.some(
+    (policy) => policy.connectorType === 'slack' && policy.approved
+  )
   const accounts = useOrganizationAccounts(open && sharedAppInstalled ? organizationId : undefined)
   const memberGroup = accounts.data?.credentialGroup
-  const memberOption = memberGroup?.options.find(
-    (option) => option.provider === 'slack' && option.status === 'active'
-  )
+  const memberOption = memberGroup?.options.find((option) => option.provider === 'slack')
   const sharedAppCanAuthorize = Boolean(
     sharedAppInstalled &&
       apps.isSuccess &&
@@ -123,11 +129,22 @@ export function SlackManagedUsersModal({
       accounts.isSuccess &&
       !accounts.isFetching &&
       !accounts.error &&
-      memberGroup?.id === credentialGroupId
+      searchPolicies.isSuccess &&
+      !searchPolicies.isFetching &&
+      !searchPolicies.error &&
+      memberGroup?.id === credentialGroupId &&
+      memberOption?.status === 'active'
   )
-  const sharedAppReady = sharedAppCanAuthorize && memberOption?.configurationStatus === 'ready'
+  const searchPermissionsMissing =
+    searchApproved && !hasSlackSearchUserScopes(memberOption?.requiredScopes)
+  const sharedAppReady =
+    sharedAppCanAuthorize &&
+    memberOption?.configurationStatus === 'ready' &&
+    !searchPermissionsMissing
   const sharedAppNeedsUpdate =
-    sharedAppCanAuthorize && memberOption?.configurationStatus === 'needs_update'
+    sharedAppCanAuthorize &&
+    (memberOption?.configurationStatus === 'needs_update' ||
+      (memberOption?.configurationStatus === 'ready' && searchPermissionsMissing))
   const [clientId, setClientId] = useState('')
   const [clientSecret, setClientSecret] = useState('')
   const [pending, setPending] = useState(false)
@@ -389,8 +406,19 @@ export function SlackManagedUsersModal({
   const needsApp = organizationSetup && apps.isSuccess && availableApps.length === 0
   const checkingSetup =
     apps.isPending ||
-    (sharedAppInstalled && (apps.isFetching || accounts.isPending || accounts.isFetching))
-  const failedSetup = apps.error ? apps : sharedAppInstalled && accounts.error ? accounts : null
+    (sharedAppInstalled &&
+      (apps.isFetching ||
+        accounts.isPending ||
+        accounts.isFetching ||
+        searchPolicies.isPending ||
+        searchPolicies.isFetching))
+  const failedSetup = apps.error
+    ? apps
+    : sharedAppInstalled && searchPolicies.error
+      ? searchPolicies
+      : sharedAppInstalled && accounts.error
+        ? accounts
+        : null
   const title = organizationSetup ? 'Set up Slack app' : 'Set up Slack'
   const primaryLabel = isLoading
     ? 'Loading...'
@@ -405,7 +433,7 @@ export function SlackManagedUsersModal({
     (!organizationSetup && !selectedBot) ||
     pending ||
     (organizationSetup
-      ? apps.isPending || Boolean(apps.error) || !selectedApp || !requiredScopes.length
+      ? checkingSetup || Boolean(failedSetup) || !selectedApp || !requiredScopes.length
       : !clientId.trim() || !clientSecret.trim())
 
   return (
@@ -472,9 +500,9 @@ export function SlackManagedUsersModal({
                   <p className='text-[var(--text-secondary)] text-sm'>
                     {sharedAppInstalled
                       ? sharedAppNeedsUpdate
-                        ? 'Member access is outdated. Update it so members can reconnect their Slack accounts.'
+                        ? 'Verify member permissions. Members will need to reconnect if their app or permissions change.'
                         : 'The Sim Search installation needs attention. Manage the app to finish setup.'
-                      : 'Verify member authorization for the installed app. Members can then search the Slack conversations they can access.'}
+                      : 'Verify member permissions. Members will need to reconnect if their app or permissions change.'}
                   </p>
                   {selectedApp && (
                     <Chip onClick={() => setAppSetupOpen(true)} disabled={pending}>

apps/sim/lib/credential-groups/application/slack-managed-users.ts

@@ -169,6 +169,7 @@ export const completeSlackCredentialGroupConfiguration: OperationUseCase<
       attempt.expectedAppId !== pending.expectedAppId ||
       attempt.expectedTeamId !== pending.expectedTeamId ||
       attempt.appRevision !== pending.appRevision ||
+      attempt.searchApprovalUpdatedAt !== pending.searchApprovalUpdatedAt ||
       attempt.clientId !== pending.clientId ||
       attempt.redirectUri !== pending.redirectUri ||
       credentialGroupScopePolicyVersion(attempt.requiredScopes) !==

apps/sim/lib/credential-groups/service.ts

@@ -401,7 +401,7 @@ export async function ensureWorkspaceAccountsGroup(
   }
 }
 
-/** Adds a provider or extends its required consent during an explicit administrator action. */
+/** Adds a provider without changing the verified consent policy of existing connections. */
 export async function addOrganizationAccountProvider(
   organizationId: string,
   userId: string,
@@ -430,31 +430,6 @@ export async function addOrganizationAccountProvider(
         'validation',
         `Enable ${option.label} in Connected accounts first`
       )
-    if (option.requiredScopes) {
-      const previousScopes =
-        current.provider === 'slack'
-          ? resolveSlackManagedUserScopes(current.requiredScopes)
-          : current.requiredScopes
-      const requiredScopes = [...new Set([...previousScopes, ...option.requiredScopes])]
-      const scopeVersion = credentialGroupScopePolicyVersion(requiredScopes)
-      if (!scopesEqual(requiredScopes, previousScopes) || scopeVersion !== current.scopeVersion) {
-        const [updated] = await executor
-          .update(credentialGroup)
-          .set({
-            options: existing.options.map((entry) =>
-              entry.id === current.id ? { ...entry, requiredScopes, scopeVersion } : entry
-            ),
-            updatedAt: new Date(),
-          })
-          .where(
-            and(eq(credentialGroup.id, group.id), resourceScopeCondition(credentialGroup, scope))
-          )
-          .returning({ id: credentialGroup.id })
-        if (!updated) throw new Error('Connected accounts policy update returned no row')
-        await invalidateOptionGrants(executor, group.id, [current.id])
-        return { groupId: group.id, changed: true }
-      }
-    }
     return { groupId: group.id, changed: group.created }
   }
   if (

apps/sim/lib/credential-groups/slack-managed-user-scopes.ts

@@ -59,6 +59,11 @@ export const SLACK_SEARCH_USER_SCOPES = [
   ...SLACK_RTS_USER_SCOPES,
 ] as const
 
+/** Search readiness is separate from a connection's existing workflow permissions. */
+export function hasSlackSearchUserScopes(scopes: readonly string[] | undefined): boolean {
+  return SLACK_SEARCH_USER_SCOPES.every((scope) => scopes?.includes(scope))
+}
+
 /** Existing workflow options retain their scope policy; every user grant must attest identity. */
 export function resolveSlackManagedUserScopes(requiredScopes?: readonly string[]): string[] {
   return [

apps/sim/lib/credential-groups/slack-managed-users.ts

@@ -4,6 +4,7 @@ import {
   credential,
   credentialGroup,
   credentialGroupEnrollment,
+  organizationSearchIntegration,
   slackApp,
   slackSearchInstallation,
 } from '@sim/db/schema'
@@ -38,7 +39,7 @@ import { getSharedSlackSearchAppConfiguration } from '@/lib/slack-search/shared-
 
 const logger = createLogger('SlackManagedUsers')
 const SLACK_MANAGED_USERS_ATTEMPT_TTL_MS = 10 * 60 * 1000
-const SLACK_MANAGED_USERS_ATTEMPT_VERSION = 4 as const
+const SLACK_MANAGED_USERS_ATTEMPT_VERSION = 5 as const
 const MAX_SLACK_RESPONSE_BYTES = 64 * 1024
 const CONSUME_SCRIPT = `
 local value = redis.call('GET', KEYS[1])
@@ -61,6 +62,7 @@ interface SlackCustomBotSecret {
 
 type StoredSlackManagedUsersAttempt = {
   appRevision?: string
+  searchApprovalUpdatedAt?: number
   version: typeof SLACK_MANAGED_USERS_ATTEMPT_VERSION
   workspaceId?: string
   organizationId?: string
@@ -82,6 +84,7 @@ type StoredSlackManagedUsersAttempt = {
 
 export interface SlackManagedUsersAttempt {
   appRevision?: string
+  searchApprovalUpdatedAt?: number
   workspaceId?: string
   organizationId?: string
   userId: string
@@ -161,6 +164,10 @@ function isStoredAttempt(value: unknown): value is StoredSlackManagedUsersAttemp
     typeof candidate.credentialGroupId === 'string' &&
     typeof candidate.credentialGroupUpdatedAt === 'number' &&
     (candidate.appRevision === undefined || typeof candidate.appRevision === 'string') &&
+    (candidate.searchApprovalUpdatedAt === undefined ||
+      (candidate.organizationId !== undefined &&
+        typeof candidate.searchApprovalUpdatedAt === 'number' &&
+        Number.isFinite(candidate.searchApprovalUpdatedAt))) &&
     (candidate.organizationId !== undefined
       ? candidate.slackBotCredentialId === undefined &&
         candidate.slackBotCredentialUpdatedAt === undefined
@@ -497,6 +504,7 @@ export async function createSlackManagedUsersAttempt(params: {
   let clientId = params.clientId
   let clientSecret = params.clientSecret
   let appRevision: string | undefined
+  let searchApprovalUpdatedAt: number | undefined
   if (scope.kind === 'organization') {
     if (params.slackBotCredentialId || !params.appId || params.clientId || params.clientSecret)
       throw new SlackManagedUsersError(
@@ -548,6 +556,23 @@ export async function createSlackManagedUsersAttempt(params: {
         ? SLACK_SEARCH_USER_SCOPES
         : existingOption.requiredScopes
     )
+    const [searchApproval] = await db
+      .select({
+        approved: organizationSearchIntegration.approved,
+        updatedAt: organizationSearchIntegration.updatedAt,
+      })
+      .from(organizationSearchIntegration)
+      .where(
+        and(
+          eq(organizationSearchIntegration.organizationId, scope.organizationId),
+          eq(organizationSearchIntegration.connectorType, 'slack')
+        )
+      )
+      .limit(1)
+    if (searchApproval?.approved) {
+      requiredScopes = [...new Set([...requiredScopes, ...SLACK_SEARCH_USER_SCOPES])]
+      searchApprovalUpdatedAt = searchApproval.updatedAt.getTime()
+    }
   } else {
     if (!params.slackBotCredentialId)
       throw new SlackManagedUsersError('Select a custom Slack bot.', 'invalid_response')
@@ -565,6 +590,11 @@ export async function createSlackManagedUsersAttempt(params: {
   }
   if (!clientId || !clientSecret)
     throw new SlackManagedUsersError('Slack client credentials are required.', 'invalid_client')
+  if (requiredScopes.length > 100)
+    throw new SlackManagedUsersError(
+      'The combined Slack request has too many permissions.',
+      'invalid_response'
+    )
   const redis = requireRedis()
   const state = generateId()
   const redirectUri = getSlackManagedUsersRedirectUri()
@@ -583,6 +613,7 @@ export async function createSlackManagedUsersAttempt(params: {
     expectedTeamId: identity.teamId,
     clientId,
     ...(appRevision ? { appRevision } : {}),
+    ...(searchApprovalUpdatedAt !== undefined ? { searchApprovalUpdatedAt } : {}),
     ...(sharedApp && scope.kind === 'organization'
       ? { credentialSource: 'environment' as const, organizationId: scope.organizationId }
       : { encryptedClientSecret: (await encryptSecret(clientSecret)).encrypted }),
@@ -660,6 +691,9 @@ async function parseSlackManagedUsersAttempt(
     expectedTeamId: parsed.expectedTeamId,
     clientId: parsed.clientId,
     ...(parsed.appRevision ? { appRevision: parsed.appRevision } : {}),
+    ...(parsed.searchApprovalUpdatedAt !== undefined
+      ? { searchApprovalUpdatedAt: parsed.searchApprovalUpdatedAt }
+      : {}),
     clientSecret,
     redirectUri: parsed.redirectUri,
     requiredScopes: parsed.requiredScopes,
@@ -779,6 +813,30 @@ export async function exchangeAndConfigureSlackManagedUsers(params: {
         'invalid_state'
       )
     }
+    if (params.attempt.organizationId && params.attempt.searchApprovalUpdatedAt !== undefined) {
+      const [approval] = await tx
+        .select({
+          approved: organizationSearchIntegration.approved,
+          updatedAt: organizationSearchIntegration.updatedAt,
+        })
+        .from(organizationSearchIntegration)
+        .where(
+          and(
+            eq(organizationSearchIntegration.organizationId, params.attempt.organizationId),
+            eq(organizationSearchIntegration.connectorType, 'slack')
+          )
+        )
+        .limit(1)
+        .for('share')
+      if (
+        !approval?.approved ||
+        approval.updatedAt.getTime() !== params.attempt.searchApprovalUpdatedAt
+      )
+        throw new SlackManagedUsersError(
+          'Search approval changed during authorization. Start again.',
+          'invalid_state'
+        )
+    }
     if (params.attempt.workspaceId) {
       if (!params.attempt.slackBotCredentialId)
         throw new SlackManagedUsersError('Workspace Slack bot is missing.', 'invalid_state')