fix(slack): honor implicit Search approval during authorization

[waleedlatif1]

Summary

• Use the shared Search approval policy when choosing and verifying Slack OAuth scopes. Existing live sources retain implicit approval; explicit denial stays authoritative and detached sources no longer grant approval.
• Serialize OAuth completion with explicit approval decisions, source creation/removal, and index archive/restore using the existing transaction advisory-lock helper. Acquire the organization lock before resource row locks.

Type of Change

• Bug fix

Testing

• 38 real PostgreSQL/Redis integration tests pass. Regressions reproduce stale implicit approval, retained-document removal, and concurrent source/index/approval changes; independent negative controls verify the new guards. JSON reports generated.
• 172 focused tests pass across Slack authorization, connector/index lifecycle, Search approvals, and account access.
• Type-check, lint, all 54 audits, block-registry audit, and docs-manifest check pass. Committed-artifact generators completed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 1, 2026 10:53pm UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds locking around organization search approval state.

The PR appears safe to merge; no outstanding findings remain.

Summary

The PR aligns Slack authorization scopes with the shared Search approval policy and rechecks approval before saving consent. The follow-up changes exclude detached connectors and serialize consent with connector, index, and explicit-approval changes.

• Adds integration coverage for implicit approval, removal, and concurrent lifecycle changes.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Start Slack authorization] --> B[Read Search approval and choose scopes]
  B --> C[Slack consent]
  C --> D[Acquire organization approval lock]
  D --> E[Recheck approval in transaction]
  E -->|unchanged| F[Save credential group configuration]
  E -->|changed| G[Reject stale consent]
  H[Connector, index, or approval change] --> D

Loading

_{Reviews (2) · Last reviewed commit: "fix(slack): serialize Search approval ch..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}