improvement(webhooks): resolve the webhook credential once, off the critical path

The worker starts resolveCredentialAccountUserId before the state/webhook
loads and awaits it only where the owner id is first consumed, so its two
serial reads overlap the deployment-state load and provider-config
resolution. The resolved owner rides into formatInput as
credentialOwnerUserId (when the provider config names the same credential),
letting the Slack handler skip re-running the identical
resolveOAuthAccountId + account owner chain before refreshing the token.
The Slack token resolution is extracted into resolveSlackWebhookBotToken,
shared and behavior-identical when no owner id is provided.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: icecrasher321

apps/sim/background/webhook-execution.test.ts

@@ -389,6 +389,40 @@ describe('executeWebhookJob fault vs error handling', () => {
     )
   })
 
+  it('forwards the resolved credential owner into formatInput when the credential matches', async () => {
+    const formatInput = vi.fn().mockResolvedValue({ input: { event: {} } })
+    mockGetProviderHandler.mockReturnValue({ formatInput })
+    const { resolveOAuthAccountId } = await import('@/lib/oauth/credential-service')
+    vi.mocked(resolveOAuthAccountId).mockResolvedValue({
+      accountId: 'account-1',
+    } as never)
+    dbChainMockFns.limit.mockResolvedValue([{ userId: 'owner-1' }])
+    mockExecuteWorkflowCore.mockResolvedValue({
+      success: true,
+      status: 'completed',
+      output: {},
+      logs: [],
+      executionState: {
+        blockStates: {},
+        executedBlocks: [],
+        blockLogs: [],
+        decisions: {},
+        completedLoops: [],
+        activeExecutionPath: [],
+      },
+    })
+    const warmContext = {
+      workflowRecord: { id: 'workflow-1', workspaceId: 'workspace-1', userId: 'user-1' },
+      webhookRecord: { id: 'webhook-1', providerConfig: { credentialId: 'credential-1' } },
+    } as unknown as NonNullable<Parameters<typeof executeWebhookJob>[2]>
+
+    await executeWebhookJob({ ...payload, credentialId: 'credential-1' }, undefined, warmContext)
+
+    expect(formatInput).toHaveBeenCalledWith(
+      expect.objectContaining({ credentialOwnerUserId: 'owner-1' })
+    )
+  })
+
   it('loads rows and keeps account checks without warm context', async () => {
     mockExecuteWorkflowCore.mockResolvedValue({
       success: true,

apps/sim/background/webhook-execution.ts

@@ -580,22 +580,23 @@ async function executeWebhookJobInternal(
       : loadDeployedWorkflowState(payload.workflowId, workspaceId)
     const warmWebhookRecord =
       warmContext?.webhookRecord?.id === payload.webhookId ? warmContext.webhookRecord : undefined
-    const [workflowData, webhookRows, resolvedCredentialUserId] = await Promise.all([
+    /**
+     * Started here, awaited only where the owner id is first needed (formatInput),
+     * so its two serial reads overlap the state load and provider-config
+     * resolution instead of gating them. The empty catch marks the chain observed
+     * for the gap; the later await still surfaces the real error.
+     */
+    const credentialAccountUserIdPromise = payload.credentialId
+      ? resolveCredentialAccountUserId(payload.credentialId)
+      : Promise.resolve(undefined)
+    credentialAccountUserIdPromise.catch(() => {})
+    const [workflowData, webhookRows] = await Promise.all([
       workflowStatePromise,
       warmWebhookRecord
         ? Promise.resolve([warmWebhookRecord])
         : db.select().from(webhook).where(eq(webhook.id, payload.webhookId)).limit(1),
-      payload.credentialId
-        ? resolveCredentialAccountUserId(payload.credentialId)
-        : Promise.resolve(undefined),
     ])
     const loadsEndedAt = Date.now()
-    const credentialAccountUserId = resolvedCredentialUserId
-    if (payload.credentialId && !credentialAccountUserId) {
-      logger.warn(
-        `[${requestId}] Failed to resolve credential account for credential ${payload.credentialId}`
-      )
-    }
 
     if (!workflowData) {
       throw new Error(
@@ -654,6 +655,20 @@ async function executeWebhookJobInternal(
     )
     const providerConfigEndedAt = Date.now()
 
+    const credentialAccountUserId = await credentialAccountUserIdPromise
+    if (payload.credentialId && !credentialAccountUserId) {
+      logger.warn(
+        `[${requestId}] Failed to resolve credential account for credential ${payload.credentialId}`
+      )
+    }
+    const resolvedProviderConfig = resolvedWebhookRecord.providerConfig
+    const formatInputCredentialOwnerUserId =
+      credentialAccountUserId &&
+      payload.credentialId &&
+      resolvedProviderConfig.credentialId === payload.credentialId
+        ? credentialAccountUserId
+        : undefined
+
     if (handler.formatInput) {
       const result = await handler.formatInput({
         webhook: resolvedWebhookRecord,
@@ -663,6 +678,9 @@ async function executeWebhookJobInternal(
         query: payload.query ?? {},
         method: payload.method ?? '',
         requestId,
+        ...(formatInputCredentialOwnerUserId
+          ? { credentialOwnerUserId: formatInputCredentialOwnerUserId }
+          : {}),
       })
       input = result.input as Record<string, unknown> | null
       skipMessage = result.skip?.message

apps/sim/lib/webhooks/providers/slack.ts

@@ -808,6 +808,50 @@ export function shouldSkipSlackTriggerEvent(
   return false
 }
 
+/**
+ * Resolves the bot token a Slack webhook can act with, across the three trigger
+ * backends: a pasted bot token (legacy `slack_webhook`), a reusable custom-bot
+ * credential's stored token, and a native `slack_app` OAuth credential. The
+ * OAuth credential resolves via its OWNER (not the execution actor in
+ * `workflow.userId`, who may not own the credential) so reaction-message text
+ * and file downloads work. `credentialOwnerUserId` short-circuits the
+ * credential → account → owner chain when the caller already resolved it.
+ */
+async function resolveSlackWebhookBotToken(
+  providerConfig: Record<string, unknown>,
+  requestId: string,
+  credentialOwnerUserId?: string
+): Promise<string | undefined> {
+  const pastedToken = providerConfig.botToken as string | undefined
+  if (pastedToken || typeof providerConfig.credentialId !== 'string') {
+    return pastedToken
+  }
+  const credentialId = providerConfig.credentialId
+
+  const botCredential = await getSlackBotCredential(credentialId)
+  if (botCredential?.botToken) {
+    return botCredential.botToken
+  }
+
+  let ownerUserId = credentialOwnerUserId
+  if (!ownerUserId) {
+    const resolved = await resolveOAuthAccountId(credentialId)
+    if (!resolved?.accountId) {
+      return undefined
+    }
+    const [owner] = await db
+      .select({ userId: account.userId })
+      .from(account)
+      .where(eq(account.id, resolved.accountId))
+      .limit(1)
+    ownerUserId = owner?.userId
+  }
+  if (!ownerUserId) {
+    return undefined
+  }
+  return (await refreshAccessTokenIfNeeded(credentialId, ownerUserId, requestId)) ?? undefined
+}
+
 export const slackHandler: WebhookProviderHandler = {
   verifyAuth({ request, rawBody, requestId, providerConfig }: AuthContext) {
     const signingSecret = providerConfig.signingSecret as string | undefined
@@ -870,34 +914,19 @@ export const slackHandler: WebhookProviderHandler = {
    * `actions[]` and no Events-API `event` envelope), and the Events API
    * (app_mention, message, reaction_added, ... nested under `event`).
    */
-  async formatInput({ body, webhook, requestId }: FormatInputContext): Promise<FormatInputResult> {
+  async formatInput({
+    body,
+    webhook,
+    requestId,
+    credentialOwnerUserId,
+  }: FormatInputContext): Promise<FormatInputResult> {
     const b = isRecordLike(body) ? body : {}
     const providerConfig = (webhook.providerConfig as Record<string, unknown>) || {}
-    let botToken = providerConfig.botToken as string | undefined
-    // Reusable custom Slack bot credential: use its stored bot token directly.
-    if (!botToken && typeof providerConfig.credentialId === 'string') {
-      const botCredential = await getSlackBotCredential(providerConfig.credentialId)
-      if (botCredential) botToken = botCredential.botToken
-    }
-    // Native (slack_app) triggers carry an OAuth credential rather than a pasted
-    // bot token; resolve it via the credential's OWNER (not the execution actor
-    // in workflow.userId, who may not own the credential) so reaction-message
-    // text and file downloads work.
-    if (!botToken && typeof providerConfig.credentialId === 'string') {
-      const credentialId = providerConfig.credentialId
-      const resolved = await resolveOAuthAccountId(credentialId)
-      if (resolved?.accountId) {
-        const [owner] = await db
-          .select({ userId: account.userId })
-          .from(account)
-          .where(eq(account.id, resolved.accountId))
-          .limit(1)
-        if (owner?.userId) {
-          botToken =
-            (await refreshAccessTokenIfNeeded(credentialId, owner.userId, requestId)) ?? undefined
-        }
-      }
-    }
+    const botToken = await resolveSlackWebhookBotToken(
+      providerConfig,
+      requestId,
+      credentialOwnerUserId
+    )
     const includeFiles = Boolean(providerConfig.includeFiles)
 
     if (typeof b?.command === 'string' && b.command.startsWith('/')) {

apps/sim/lib/webhooks/providers/types.ts

@@ -38,6 +38,12 @@ export interface FormatInputContext {
   /** HTTP method of the delivering request. Empty on legacy queued jobs. */
   method: string
   requestId: string
+  /**
+   * Owner of the webhook's OAuth credential, when the worker already resolved
+   * it for execution metadata. Lets a provider skip re-resolving the same
+   * credential → account → owner chain; absent on paths that never resolved it.
+   */
+  credentialOwnerUserId?: string
 }
 
 /** Result of custom input preparation. */