feat(slack): support organization-scoped shared app rollout (#7833)

Author: TheodoreSpeaks

apps/sim/lib/core/config/feature-flags.test.ts

@@ -15,6 +15,7 @@ const { mockFetch, mockIsPlatformAdmin, envRef } = vi.hoisted(() => ({
     TABLE_ROW_TTL: undefined as boolean | undefined,
     CREDENTIAL_GROUPS: undefined as boolean | undefined,
     KNOWLEDGE_MEMBER_ACCESS: undefined as boolean | undefined,
+    SLACK_SEARCH_SHARED_APP: undefined as boolean | undefined,
   },
 }))
 
@@ -125,6 +126,40 @@ describe('isFeatureEnabled', () => {
     setEnvFlags({ isAppConfigEnabled: false })
     envRef.CREDENTIAL_GROUPS = undefined
     envRef.KNOWLEDGE_MEMBER_ACCESS = undefined
+    envRef.SLACK_SEARCH_SHARED_APP = undefined
+  })
+
+  describe('slack-search-shared-app flag', () => {
+    it('enables only the allowlisted organization', async () => {
+      withAppConfig({ 'slack-search-shared-app': { enabled: false, orgIds: ['review-org'] } })
+      expect(await isFeatureEnabled('slack-search-shared-app', { orgId: 'review-org' })).toBe(true)
+      expect(await isFeatureEnabled('slack-search-shared-app', { orgId: 'other-org' })).toBe(false)
+      expect(await isFeatureEnabled('slack-search-shared-app')).toBe(false)
+      expect(mockIsPlatformAdmin).not.toHaveBeenCalled()
+    })
+
+    it('does not grant organization access from user or workspace targeting', async () => {
+      withAppConfig({
+        'slack-search-shared-app': {
+          userIds: ['review-org'],
+          workspaceIds: ['review-org'],
+          adminEnabled: true,
+        },
+      })
+      expect(await isFeatureEnabled('slack-search-shared-app', { orgId: 'review-org' })).toBe(false)
+      expect(mockIsPlatformAdmin).not.toHaveBeenCalled()
+    })
+
+    it('preserves the global AppConfig switch', async () => {
+      withAppConfig({ 'slack-search-shared-app': { enabled: true } })
+      expect(await isFeatureEnabled('slack-search-shared-app', { orgId: 'any-org' })).toBe(true)
+    })
+
+    it('preserves the global fallback switch off AppConfig', async () => {
+      expect(await isFeatureEnabled('slack-search-shared-app', { orgId: 'review-org' })).toBe(false)
+      envRef.SLACK_SEARCH_SHARED_APP = true
+      expect(await isFeatureEnabled('slack-search-shared-app', { orgId: 'review-org' })).toBe(true)
+    })
   })
 
   describe('knowledge-member-access flag', () => {

apps/sim/lib/core/config/feature-flags.ts

@@ -48,7 +48,9 @@ interface FeatureFlagDefinition {
 const FEATURE_FLAGS = {
   'slack-search-shared-app': {
     description:
-      'Enable the official shared Slack app for existing Search customers. Global on/off only.',
+      'Enable the official shared Slack app for existing Search customers. Supports orgId ' +
+      'targeting for setup, personal connections, and bot execution. Off-AppConfig falls back ' +
+      'to SLACK_SEARCH_SHARED_APP.',
     fallback: 'SLACK_SEARCH_SHARED_APP',
   },
   'trigger-eu-region': {

apps/sim/lib/credential-groups/provider-configuration.test.ts

@@ -70,10 +70,17 @@ describe('organization Slack app references', () => {
       clientSecret: 'current-secret',
     })
   })
-  it.each([true, false])(
-    'resolves environment credentials only for an active shared installation (active=%s)',
-    async (active) => {
+  it.each([
+    [true, true],
+    [false, true],
+    [true, false],
+  ])(
+    'resolves shared credentials only for an active installation and enabled organization (active=%s, enabled=%s)',
+    async (active, enabled) => {
       shared.env.SLACK_SEARCH_APP_ID = 'A1'
+      shared.flag.mockImplementation(
+        async (_flag, context) => enabled && context?.orgId === 'org-1'
+      )
       dbChainMockFns.limit
         .mockResolvedValueOnce([
           {
@@ -96,14 +103,16 @@ describe('organization Slack app references', () => {
         organizationId: 'org-1',
         credentialGroupId: 'group-1',
       })
-      if (active)
+      if (!enabled) await expect(result).rejects.toThrow('unavailable')
+      else if (active)
         await expect(result).resolves.toMatchObject({
           clientId: 'environment-client',
           clientSecret: 'environment-secret',
           appId: 'A1',
           teamId: 'T1',
         })
       else await expect(result).rejects.toThrow('disabled or removed')
+      expect(shared.flag).toHaveBeenCalledWith('slack-search-shared-app', { orgId: 'org-1' })
     }
   )
   it('keeps using the custom app for personal sources after a different native app is installed', async () => {

apps/sim/lib/credential-groups/provider-configuration.ts

@@ -159,7 +159,7 @@ async function resolveSlackConfiguration(
     .limit(1)
   if (!app) throw new Error('Organization Slack app configuration is missing')
   if (app.kind === 'shared') {
-    await requireSlackSearchAppAvailable(app.id)
+    await requireSlackSearchAppAvailable(app.id, params.organizationId)
     const [installation] = await (params.executor ?? db)
       .select({ id: slackSearchInstallation.id })
       .from(slackSearchInstallation)

apps/sim/lib/credential-groups/slack-managed-users.test.ts

@@ -146,6 +146,7 @@ describe('Slack managed-user authorization', () => {
     'keeps shared setup state secret-free and rechecks configuration on %s',
     async (outcome) => {
       shared.env.SLACK_SEARCH_APP_ID = 'ASHARED'
+      shared.flag.mockImplementation(async (_flag, context) => context?.orgId === 'org-1')
       dbChainMockFns.limit
         .mockResolvedValueOnce([{ id: 'group-1', updatedAt: new Date(1), options: [] }])
         .mockResolvedValueOnce([
@@ -173,6 +174,7 @@ describe('Slack managed-user authorization', () => {
       expect(stored).toMatchObject({ credentialSource: 'environment', expectedAppId: 'ASHARED' })
       expect(stored).not.toHaveProperty('encryptedClientSecret')
       expect(JSON.stringify(stored)).not.toContain('environment-secret')
+      expect(shared.flag).toHaveBeenCalledWith('slack-search-shared-app', { orgId: 'org-1' })
       if (outcome === 'rotation') {
         shared.env.SLACK_SEARCH_CLIENT_SECRET = 'rotated'
         await expect(consumeSlackManagedUsersAttempt(created.state)).rejects.toThrow('changed')
@@ -185,6 +187,7 @@ describe('Slack managed-user authorization', () => {
           clientSecret: 'environment-secret',
           organizationId: 'org-1',
         })
+        expect(shared.flag).toHaveBeenLastCalledWith('slack-search-shared-app', { orgId: 'org-1' })
         await expect(consumeSlackManagedUsersAttempt(created.state)).resolves.toBeNull()
       }
     }

apps/sim/lib/credential-groups/slack-managed-users.ts

@@ -73,7 +73,7 @@ type StoredSlackManagedUsersAttempt = {
   requiredScopes: string[]
   createdAt: number
 } & (
-  | { credentialSource: 'environment'; encryptedClientSecret?: never }
+  | { credentialSource: 'environment'; organizationId: string; encryptedClientSecret?: never }
   | { credentialSource?: undefined; encryptedClientSecret: string }
 )
 
@@ -525,7 +525,7 @@ export async function createSlackManagedUsersAttempt(params: {
         'Set up this organization’s Slack app first.',
         'invalid_response'
       )
-    await requireSlackSearchAppAvailable(configured.app.id)
+    await requireSlackSearchAppAvailable(configured.app.id, scope.organizationId)
     const app = await resolveSlackAppCredentials(configured.app)
     identity = { appId: configured.app.id, teamId: configured.teamId }
     clientId = app.clientId
@@ -569,8 +569,8 @@ export async function createSlackManagedUsersAttempt(params: {
     expectedTeamId: identity.teamId,
     clientId,
     ...(appRevision ? { appRevision } : {}),
-    ...(sharedApp
-      ? { credentialSource: 'environment' as const }
+    ...(sharedApp && scope.kind === 'organization'
+      ? { credentialSource: 'environment' as const, organizationId: scope.organizationId }
       : { encryptedClientSecret: (await encryptSecret(clientSecret)).encrypted }),
     requiredScopes,
     redirectUri,
@@ -626,7 +626,7 @@ async function parseSlackManagedUsersAttempt(
         'The shared Slack app changed. Start again.',
         'invalid_state'
       )
-    await requireSlackSearchAppAvailable(app.id)
+    await requireSlackSearchAppAvailable(app.id, parsed.organizationId)
     clientSecret = app.clientSecret
   } else {
     clientSecret = (await decryptSecret(parsed.encryptedClientSecret)).decrypted
@@ -729,7 +729,8 @@ export async function exchangeAndConfigureSlackManagedUsers(params: {
         )
         .limit(1)
         .for('update')
-      if (app?.kind === 'shared') await requireSlackSearchAppAvailable(app.id)
+      if (app?.kind === 'shared')
+        await requireSlackSearchAppAvailable(app.id, params.attempt.organizationId)
       const resolved = app ? await resolveSlackAppCredentials(app) : null
       if (
         !resolved ||

apps/sim/lib/knowledge/application/slack-search/authorization.test.ts

@@ -7,6 +7,7 @@ const mocks = vi.hoisted(() => ({
   credential: vi.fn(),
   availability: vi.fn(),
   replacement: vi.fn(),
+  appAvailable: vi.fn(),
 }))
 vi.mock('@/lib/knowledge/application/slack-search/repository', () => ({
   findSlackSearchInstallation: mocks.installation,
@@ -16,7 +17,7 @@ vi.mock('@/lib/knowledge/access/availability', () => ({
   requireOrganizationSearchAvailable: mocks.availability,
 }))
 vi.mock('@/lib/slack-search/shared-app', () => ({
-  requireSlackSearchAppAvailable: vi.fn(),
+  requireSlackSearchAppAvailable: mocks.appAvailable,
   findSharedSlackSearchInstallation: mocks.replacement,
 }))
 
@@ -49,6 +50,7 @@ beforeEach(() => {
   mocks.installation.mockResolvedValue(installation)
   mocks.credential.mockResolvedValue({ version: 'version1', botToken: 'secret' })
   mocks.availability.mockResolvedValue(undefined)
+  mocks.appAvailable.mockResolvedValue(undefined)
   mocks.replacement.mockResolvedValue(null)
 })
 
@@ -154,6 +156,22 @@ describe('Slack Search installation authorization', () => {
       installation,
     })
     expect(mocks.credential).toHaveBeenCalledWith('cred1', 'org1')
+    expect(mocks.appAvailable).toHaveBeenCalledWith('A1', 'org1')
+  })
+  it('rejects the next lifecycle check when the organization loses shared app access', async () => {
+    await expect(authorizeSlackSearchInstallation(principal)).resolves.toMatchObject({
+      installation,
+    })
+    mocks.credential.mockClear()
+    mocks.appAvailable.mockRejectedValueOnce(new Error('unavailable'))
+    await expect(
+      authorizeSlackSearchInstallation(principal, {
+        installationId: installation.id,
+        revision: installation.revision,
+      })
+    ).rejects.toThrow('unavailable')
+    expect(mocks.appAvailable).toHaveBeenLastCalledWith('A1', 'org1')
+    expect(mocks.credential).not.toHaveBeenCalled()
   })
   it.each([null, { ...installation, enabled: false }])(
     'does no work for removed or disabled installations',

apps/sim/lib/knowledge/application/slack-search/authorization.ts

@@ -51,7 +51,7 @@ async function authorizeSlackSearchBinding(
     throw new OrchestrationError('forbidden', 'Slack Search binding is no longer valid')
   }
   await requireOrganizationSearchAvailable(installation.organizationId)
-  await requireSlackSearchAppAvailable(installation.appId)
+  await requireSlackSearchAppAvailable(installation.appId, installation.organizationId)
   const secret = await loadSlackSearchCredential(
     installation.credentialId,
     installation.organizationId

apps/sim/lib/knowledge/application/slack-search/installations.ts

@@ -77,7 +77,7 @@ export const listSlackSearchInstallations = defineAuthorizedKnowledgeUseCase({
           )
         )
         .limit(101),
-      readSharedSlackSearchApp(),
+      readSharedSlackSearchApp(context.organizationId),
     ])
     if (installations.length > 100 || bots.length > 100)
       throw new OrchestrationError(
@@ -158,7 +158,7 @@ export const configureSlackSearchInstallation = defineAuthorizedKnowledgeUseCase
         ? await tx.select().from(slackApp).where(eq(slackApp.id, current.slackAppId)).limit(1)
         : []
       if (input.enabled && current.slackAppId)
-        await requireSlackSearchAppAvailable(current.slackAppId)
+        await requireSlackSearchAppAvailable(current.slackAppId, context.organizationId)
       if (current.slackAppId && !app) throw new Error('Slack app configuration is missing')
       const appRevision =
         app && secret ? (await resolveSlackAppCredentials(app)).revision : undefined

apps/sim/lib/knowledge/application/slack-search/setup.test.ts

@@ -300,9 +300,10 @@ describe('Search OAuth installation', () => {
   })
 })
 
-it('rejects a shared-app callback if the global configuration was disabled or rotated', async () => {
+it('rejects a shared-app callback if organization access was disabled or configuration rotated', async () => {
   m.consume.mockResolvedValue({ ...attempt, sharedApp: { id: 'ASHARED', revision: 'app-rev' } })
   await expect(complete()).rejects.toThrow('configuration changed')
+  expect(m.shared).toHaveBeenCalledWith('org1')
   expect(m.exchange).not.toHaveBeenCalled()
   m.shared.mockResolvedValue({ id: 'ASHARED', revision: 'new-rev' })
   await expect(complete()).rejects.toThrow()
@@ -327,6 +328,24 @@ describe('shared app completion', () => {
     })
   })
 
+  it('only offers and starts shared OAuth for the enabled organization', async () => {
+    m.shared.mockImplementation(async (orgId) => (orgId === 'org1' ? sharedApp : null))
+    const details = { name: 'Sim Search', description: 'Search with sources' }
+    await expect(
+      prepareSlackSearchSetup.execute({ principal, input: { ...details, organizationId: 'org1' } })
+    ).resolves.toHaveProperty('sharedAppId', 'A1')
+    await expect(
+      prepareSlackSearchSetup.execute({ principal, input: { ...details, organizationId: 'org2' } })
+    ).resolves.toHaveProperty('sharedAppId', null)
+    await expect(
+      startSlackSearchSetup.execute({
+        principal,
+        input: { ...details, organizationId: 'org2', mode: 'shared' },
+      })
+    ).rejects.toThrow('unavailable')
+    expect(m.store).not.toHaveBeenCalled()
+  })
+
   it('starts shared OAuth without storing deployment secrets in the attempt', async () => {
     const result = await startSlackSearchSetup.execute({
       principal,
@@ -338,6 +357,7 @@ describe('shared app completion', () => {
       },
     })
     expect(new URL(result.authorizationUrl).searchParams.get('client_id')).toBe('client')
+    expect(m.shared).toHaveBeenCalledWith('org1')
     const stored = m.store.mock.calls[0][0]
     expect(stored.sharedApp).toEqual({ id: 'A1', revision: 'shared-revision' })
     expect(stored).not.toHaveProperty('encryptedClientSecret')
@@ -468,6 +488,7 @@ describe('shared app completion', () => {
       queueTransitionRows()
       m.shared.mockResolvedValueOnce(sharedApp).mockResolvedValueOnce(null)
       await expect(complete()).rejects.toThrow('configuration changed')
+      expect(m.shared.mock.calls).toEqual([['org1'], ['org1']])
       expect(m.update).not.toHaveBeenCalled()
       expect(m.values).not.toHaveBeenCalled()
     })