feat(slack-search): stream enterprise answers through one Slack app (#7644)

* feat: serve organization search through Slack custom bots

* feat(slack-search): stream enterprise answers through one Slack app

* fix(slack-search): simplify setup and align source readiness

* fix(slack-search): supply query props in page gate test

* fix(slack-search): finalize failed streams and explain query limits

* fix(tests): isolate embedding provider credentials

Author: TheodoreSpeaks

apps/sim/app/api/files/uploads/purposes.ts

@@ -235,6 +235,9 @@ function requireSessionScope(value: string | null, label = 'scope'): string {
 
 async function principalUserId(principal: Principal, workspaceId?: string): Promise<string> {
   switch (principal.kind) {
+    case 'slack_app':
+    case 'slack_installation':
+      throw new UploadSessionError('forbidden', 'Slack installations cannot create uploads')
     case 'session':
     case 'personal_api_key':
     case 'oauth_access_token':

apps/sim/app/api/knowledge/slack/[installationId]/route.ts

@@ -0,0 +1,20 @@
+import { removeSlackSearchContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { removeSlackSearchInstallation } from '@/lib/knowledge/application/slack-search/installations'
+
+export const DELETE = defineInternalJsonRoute({
+  contract: removeSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.removeSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ query, params }) => ({ ...query, ...params }),
+  useCase: removeSlackSearchInstallation,
+  present: (result) => result,
+})

apps/sim/app/api/knowledge/slack/oauth/callback/route.ts

@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server'
+import { slackSearchOAuthCallbackContract } from '@/lib/api/contracts/knowledge/slack'
+import { parseRequest } from '@/lib/api/server'
+import {
+  InternalUnauthenticatedError,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { getBaseUrl } from '@/lib/core/utils/urls'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { completeSlackSearchSetup } from '@/lib/knowledge/application/slack-search/setup'
+import { organizationRoutes } from '@/lib/navigation/paths'
+
+/** OAuth is a redirect protocol; protected configuration remains in the application use case. */
+export const GET = withRouteHandler(async (request) => {
+  try {
+    const principal = await internalSessionAuth.authenticate()
+    const rateResponse = await internalRateLimits
+      .user({ bucketName: 'slack-search-settings' })
+      .enforce(request, principal)
+    if (rateResponse) return rateResponse
+    const parsed = await parseRequest(slackSearchOAuthCallbackContract, request, {})
+    if (!parsed.success) return parsed.response
+    const result = await completeSlackSearchSetup.execute({
+      principal,
+      input: parsed.data.query,
+      request,
+    })
+    const url = new URL(
+      organizationRoutes(result.organizationId).settingsSection('search-slack'),
+      getBaseUrl()
+    )
+    url.searchParams.set('slackSetup', 'complete')
+    return NextResponse.redirect(url, 303)
+  } catch (error) {
+    if (error instanceof InternalUnauthenticatedError)
+      return NextResponse.json(
+        { error: 'Sign in to Sim and restart Slack setup.' },
+        { status: 401 }
+      )
+    const projected = internalOrchestrationErrorPolicy.project(error)
+    if (projected) return NextResponse.json(projected.body, { status: projected.status })
+    throw error
+  }
+})

apps/sim/app/api/knowledge/slack/oauth/route.ts

@@ -0,0 +1,19 @@
+import { startSlackSearchOAuthContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { startSlackSearchSetup } from '@/lib/knowledge/application/slack-search/setup'
+
+export const POST = defineInternalJsonRoute({
+  contract: startSlackSearchOAuthContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.startSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: startSlackSearchSetup,
+})

apps/sim/app/api/knowledge/slack/onboarding/retry/route.ts

@@ -0,0 +1,22 @@
+import { retrySlackSearchOnboardingContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import {
+  retrySlackSearchOnboarding,
+  slackSearchOnboardingOperations,
+} from '@/lib/knowledge/application/slack-search/onboarding'
+
+export const POST = defineInternalJsonRoute({
+  contract: retrySlackSearchOnboardingContract,
+  auth: internalSessionAuth,
+  operation: slackSearchOnboardingOperations.retry,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-onboarding-retry' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store', 'Referrer-Policy': 'no-referrer' },
+  mapInput: ({ body }) => body,
+  useCase: retrySlackSearchOnboarding,
+})

apps/sim/app/api/knowledge/slack/onboarding/route.test.ts

@@ -0,0 +1,105 @@
+/** @vitest-environment node */
+import { authMockFns, createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ read: vi.fn(), retry: vi.fn() }))
+vi.mock('@/lib/knowledge/application/slack-search/onboarding', () => {
+  const read = {
+    id: 'knowledge.slack.onboarding.read',
+    capability: 'none',
+    principalKinds: ['session'],
+  }
+  const retry = {
+    id: 'knowledge.slack.onboarding.retry',
+    capability: 'knowledge.use',
+    principalKinds: ['session'],
+  }
+  return {
+    slackSearchOnboardingOperations: { read, retry },
+    getSlackSearchOnboarding: { operation: read, execute: mocks.read },
+    retrySlackSearchOnboarding: { operation: retry, execute: mocks.retry },
+  }
+})
+
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { POST } from '@/app/api/knowledge/slack/onboarding/retry/route'
+import { GET } from '@/app/api/knowledge/slack/onboarding/route'
+
+const token = '11111111-1111-4111-8111-111111111111'
+const url = `http://localhost/api/knowledge/slack/onboarding?token=${token}`
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  authMockFns.mockGetSession.mockResolvedValue({
+    user: { id: 'sender' },
+    session: { id: 'session' },
+  })
+  mocks.read.mockResolvedValue({ status: 'membership_required' })
+  mocks.retry.mockResolvedValue({ slackUrl: 'https://example.slack.com/archives/D1/p1' })
+})
+
+describe('Slack onboarding routes', () => {
+  it('authenticates both routes before parsing invalid input', async () => {
+    authMockFns.mockGetSession.mockResolvedValue(null)
+    expect((await GET(createMockRequest('GET'))).status).toBe(401)
+    expect((await POST(createMockRequest('POST', {}))).status).toBe(401)
+    expect(mocks.read).not.toHaveBeenCalled()
+    expect(mocks.retry).not.toHaveBeenCalled()
+  })
+
+  it('rejects malformed tokens before entering the application', async () => {
+    expect((await GET(createMockRequest('GET'))).status).toBe(400)
+    expect((await POST(createMockRequest('POST', { token: 'invalid' }))).status).toBe(400)
+    expect(mocks.read).not.toHaveBeenCalled()
+    expect(mocks.retry).not.toHaveBeenCalled()
+  })
+
+  it('projects only the blocked view and keeps the response private', async () => {
+    mocks.read.mockResolvedValue({
+      status: 'membership_required',
+      question: 'private question',
+      organizationId: 'private organization',
+      email: 'private@example.test',
+    })
+    const response = await GET(createMockRequest('GET', undefined, {}, url))
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ status: 'membership_required' })
+    expect(response.headers.get('Cache-Control')).toBe('private, no-store')
+    expect(response.headers.get('Referrer-Policy')).toBe('no-referrer')
+    expect(mocks.read).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal: { kind: 'session', userId: 'sender', sessionId: 'session' },
+        input: { token },
+      })
+    )
+    expect(mocks.retry).not.toHaveBeenCalled()
+  })
+
+  it('passes explicit retries to the same signed-in principal', async () => {
+    const response = await POST(createMockRequest('POST', { token }))
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({
+      slackUrl: 'https://example.slack.com/archives/D1/p1',
+    })
+    expect(mocks.retry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal: { kind: 'session', userId: 'sender', sessionId: 'session' },
+        input: { token },
+      })
+    )
+  })
+
+  it('preserves authorization denial without returning a question', async () => {
+    mocks.retry.mockRejectedValue(new OrchestrationError('forbidden', 'Complete account setup'))
+    const response = await POST(createMockRequest('POST', { token }))
+    expect(response.status).toBe(403)
+    expect(await response.json()).not.toHaveProperty('slackUrl')
+  })
+
+  it('conceals unexpected infrastructure errors', async () => {
+    mocks.read.mockRejectedValue(new Error('private database connection'))
+    const response = await GET(createMockRequest('GET', undefined, {}, url))
+    expect(response.status).toBe(500)
+    expect(await response.json()).toMatchObject({ error: 'Internal server error' })
+  })
+})

apps/sim/app/api/knowledge/slack/onboarding/route.ts

@@ -0,0 +1,22 @@
+import { getSlackSearchOnboardingContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import {
+  getSlackSearchOnboarding,
+  slackSearchOnboardingOperations,
+} from '@/lib/knowledge/application/slack-search/onboarding'
+
+export const GET = defineInternalJsonRoute({
+  contract: getSlackSearchOnboardingContract,
+  auth: internalSessionAuth,
+  operation: slackSearchOnboardingOperations.read,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-onboarding' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store', 'Referrer-Policy': 'no-referrer' },
+  mapInput: ({ query }) => query,
+  useCase: getSlackSearchOnboarding,
+})

apps/sim/app/api/knowledge/slack/route.ts

@@ -0,0 +1,43 @@
+import {
+  configureSlackSearchContract,
+  listSlackSearchContract,
+} from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import {
+  configureSlackSearchInstallation,
+  listSlackSearchInstallations,
+} from '@/lib/knowledge/application/slack-search/installations'
+
+export const GET = defineInternalJsonRoute({
+  contract: listSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.listSlackInstallations,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ query }) => query,
+  useCase: listSlackSearchInstallations,
+  present: ({ installations, bots }) => ({
+    bots,
+    installations: installations.map((row) => ({
+      ...row,
+      lastEventAt: row.lastEventAt?.toISOString() ?? null,
+    })),
+  }),
+})
+
+export const POST = defineInternalJsonRoute({
+  contract: configureSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.configureSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: configureSlackSearchInstallation,
+  present: (result) => result,
+})

apps/sim/app/api/knowledge/slack/setup/route.test.ts

@@ -0,0 +1,61 @@
+/** @vitest-environment node */
+import { authMockFns, createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ prepare: vi.fn(), start: vi.fn() }))
+vi.mock('@/lib/knowledge/application/slack-search/setup', async () => {
+  const { knowledgeOperations } = await import('@/lib/knowledge/application/operations')
+  return {
+    prepareSlackSearchSetup: {
+      operation: knowledgeOperations.prepareSlackInstallation,
+      execute: mocks.prepare,
+    },
+    startSlackSearchSetup: {
+      operation: knowledgeOperations.startSlackInstallation,
+      execute: mocks.start,
+    },
+  }
+})
+
+import { createSlackSearchManifest } from '@/lib/slack-search/manifest'
+import { POST as start } from '@/app/api/knowledge/slack/oauth/route'
+import { POST as prepare } from '@/app/api/knowledge/slack/setup/route'
+
+const input = { organizationId: 'organization-1', name: 'Sim Search', description: 'Search' }
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  authMockFns.mockGetSession.mockResolvedValue({
+    user: { id: 'admin' },
+    session: { id: 'session' },
+  })
+})
+
+describe.each([
+  ['prepare', prepare, mocks.prepare],
+  ['OAuth', start, mocks.start],
+] as const)('Slack %s route errors', (_name, route, execute) => {
+  it('returns an actionable 400 for a non-HTTPS app URL', async () => {
+    execute.mockImplementation(() =>
+      createSlackSearchManifest(input.name, input.description, 'http://localhost:3000')
+    )
+    const response = await route(createMockRequest('POST', input))
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: expect.stringContaining('public HTTPS') })
+    expect(execute).toHaveBeenCalledOnce()
+  })
+
+  it('still conceals unexpected errors', async () => {
+    execute.mockRejectedValue(new Error('private database configuration'))
+    const response = await route(createMockRequest('POST', input))
+    expect(response.status).toBe(500)
+    expect(await response.json()).toMatchObject({ error: 'Internal server error' })
+  })
+
+  it('authenticates before exposing setup configuration', async () => {
+    authMockFns.mockGetSession.mockResolvedValue(null)
+    const response = await route(createMockRequest('POST', {}))
+    expect(response.status).toBe(401)
+    expect(execute).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/knowledge/slack/setup/route.ts

@@ -0,0 +1,19 @@
+import { prepareSlackSearchContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { prepareSlackSearchSetup } from '@/lib/knowledge/application/slack-search/setup'
+
+export const POST = defineInternalJsonRoute({
+  contract: prepareSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.prepareSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: prepareSlackSearchSetup,
+})