fix(slack): verify Search permissions before changing active grants by waleedlatif1 · Pull Request #8545 · simstudioai/sim

waleedlatif1 · 2026-10-01T21:27:48Z

Summary

Preserve active Slack connections while Search permissions await verification, including cancellation and incomplete consent.
Commit verified permissions atomically and reject callbacks after approval changes in either direction without dropping existing workflow or custom scopes.
Show when Search permissions still need verification and keep workflow-only setup usable.

Type of Change

Bug fix

Testing

search-mcp-setup.integration.ts: 29 tests passed against disposable PostgreSQL and Redis with Slack HTTP fixtures; JSON integration report generated. Regression cases fail before the fix, and each new guard was independently disabled to verify its regression.
75 tests passed across service.test.ts, slack-managed-users.test.ts (manager and application), organization-provider-setup.test.ts, slack-provider.test.ts, live-search-settings.test.tsx, and live-member-integrations.test.tsx.
bun run type-check, bun run lint, all 54 check:audits, block registry audit, and docs-manifest:check passed. Committed-artifact generators ran successfully.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-01T21:27:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 1, 2026 10:06pm UTC

waleedlatif1 · 2026-10-01T21:28:30Z

@greptile

waleedlatif1 · 2026-10-01T21:28:31Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T21:28:37Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

greptile-apps · 2026-10-01T21:33:15Z

Confidence Score: 4/5

[Critical risk] Adds permission checks to Slack Search credential grants.

The PR should not merge until verification requests Search scopes for organizations whose existing Slack connector supplies implicit approval.

Findings

Implicit approval omits Search scopes ▶

Summary

This PR preserves existing Slack connections while Search permissions await verified consent, then updates the scope policy after verification. It also adds approval-state checks, setup indicators, and integration coverage.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Start Slack authorization] --> B[Read approval and request scopes]
  B --> C[Slack consent]
  C --> D{Consent verified and approval unchanged?}
  D -- No --> E[Keep existing grants]
  D -- Yes --> F[Commit scopes and mark affected grants for reauthorization]

_{Reviews (4) · Last reviewed commit: "chore(tests): require Redis for Slack au..."}

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 · 2026-10-01T21:41:04Z

@greptile

waleedlatif1 · 2026-10-01T21:41:07Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T21:41:12Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 9 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

waleedlatif1 · 2026-10-01T21:58:38Z

@greptile

waleedlatif1 · 2026-10-01T21:58:39Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T21:58:44Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 · 2026-10-01T22:07:01Z

@greptile

waleedlatif1 · 2026-10-01T22:07:02Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T22:07:08Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 mentioned this pull request Oct 1, 2026

v0.9.10: geo, chat fixes, sandbox fixes #8539

Merged

greptile-apps Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/slack-managed-users.ts Outdated

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview October 1, 2026 21:40 Inactive

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/slack-managed-users.ts

Comment thread apps/sim/lib/knowledge/__integration__/search-mcp-setup.integration.ts Outdated

waleedlatif1 force-pushed the codex/fix-slack-search-permission-upgrade branch from e93c56c to 6d51c0e Compare October 1, 2026 21:58

vercel Bot temporarily deployed to Preview October 1, 2026 21:58 Inactive

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

waleedlatif1 added 3 commits October 1, 2026 15:03

fix(slack): verify Search permissions before changing active grants

328a37b

fix(slack): bind authorization to every Search approval state

c765a57

chore(tests): require Redis for Slack authorization integration

f66dd3f

waleedlatif1 force-pushed the codex/fix-slack-search-permission-upgrade branch from 6d51c0e to f66dd3f Compare October 1, 2026 22:06

vercel Bot temporarily deployed to Preview October 1, 2026 22:06 Inactive

waleedlatif1 merged commit a1ef625 into staging Oct 1, 2026
4 of 5 checks passed

waleedlatif1 deleted the codex/fix-slack-search-permission-upgrade branch October 1, 2026 22:07

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/slack-managed-users.ts

Conversation

waleedlatif1 commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

greptile-apps Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 1, 2026 •

edited

Loading

vercel Bot commented Oct 1, 2026 •

edited

Loading

greptile-apps Bot commented Oct 1, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading