fix(slack): harden native webhook configuration

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx

@@ -196,6 +196,8 @@ Webhook triggers receive callbacks from the provider and must be able to verify
 | `SLACK_SIGNING_SECRET` | Verifying Slack event and slash-command signatures |
 | `SLACK_EXTENDED_SCOPES` / `NEXT_PUBLIC_SLACK_EXTENDED_SCOPES` | Enabling the native Sim-app trigger and its broader Slack scope set; set both to the same value |
 
+When enabling the native Sim Slack trigger, configure all three variables together. Slack OAuth actions can use `SLACK_CLIENT_ID` and `SLACK_CLIENT_SECRET` without enabling the native trigger or supplying a signing secret.
+
 Your deployment must also be reachable from the provider's servers for webhook triggers to fire — a Sim instance on a private network can use polling triggers but not webhook triggers. Polling triggers additionally require the scheduler; see [Background Jobs](/platform/self-hosting/background-jobs).
 
 <FAQ items={[

apps/sim/app/api/webhooks/slack/route.test.ts

@@ -4,12 +4,19 @@
 import { resetEnvMock, setEnv } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockParseWebhookBody, mockFindWebhooksByRoutingKey, mockDispatchResolvedWebhookTarget } =
-  vi.hoisted(() => ({
-    mockParseWebhookBody: vi.fn(),
-    mockFindWebhooksByRoutingKey: vi.fn(),
-    mockDispatchResolvedWebhookTarget: vi.fn(),
-  }))
+const {
+  mockParseWebhookBody,
+  mockFindWebhooksByRoutingKey,
+  mockDispatchResolvedWebhookTarget,
+  mockHandleSlackChallenge,
+  mockVerifySlackRequestSignature,
+} = vi.hoisted(() => ({
+  mockParseWebhookBody: vi.fn(),
+  mockFindWebhooksByRoutingKey: vi.fn(),
+  mockDispatchResolvedWebhookTarget: vi.fn(),
+  mockHandleSlackChallenge: vi.fn(),
+  mockVerifySlackRequestSignature: vi.fn(),
+}))
 
 vi.mock('@/lib/core/admission/gate', () => ({
   tryAdmit: () => ({ release: vi.fn() }),
@@ -23,8 +30,8 @@ vi.mock('@/lib/webhooks/processor', () => ({
 }))
 
 vi.mock('@/lib/webhooks/providers/slack', () => ({
-  handleSlackChallenge: () => null,
-  verifySlackRequestSignature: () => null,
+  handleSlackChallenge: mockHandleSlackChallenge,
+  verifySlackRequestSignature: mockVerifySlackRequestSignature,
   resolveSlackEventKey: () => null,
 }))
 
@@ -60,6 +67,8 @@ describe('Slack app webhook route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     setEnv({ SLACK_SIGNING_SECRET: 'test-secret' })
+    mockHandleSlackChallenge.mockReturnValue(null)
+    mockVerifySlackRequestSignature.mockReturnValue(null)
     mockFindWebhooksByRoutingKey.mockResolvedValue([webhook('wh1')])
     mockDispatchResolvedWebhookTarget.mockResolvedValue({
       outcome: 'queued',
@@ -70,9 +79,53 @@ describe('Slack app webhook route', () => {
 
   it('dispatches each webhook resolved for the event team', async () => {
     await run(messageBody)
+    expect(mockVerifySlackRequestSignature).toHaveBeenCalledWith(
+      'test-secret',
+      expect.anything(),
+      JSON.stringify(messageBody),
+      expect.any(String)
+    )
     expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledTimes(1)
   })
 
+  it('rejects a verification challenge when the native app is not configured', async () => {
+    setEnv({ SLACK_SIGNING_SECRET: undefined })
+    mockHandleSlackChallenge.mockReturnValue(new Response('challenge', { status: 200 }))
+
+    const response = await run({ type: 'url_verification', challenge: 'challenge' })
+
+    expect(response.status).toBe(500)
+    expect(mockVerifySlackRequestSignature).not.toHaveBeenCalled()
+    expect(mockHandleSlackChallenge).not.toHaveBeenCalled()
+  })
+
+  it('verifies a signed request before answering the verification challenge', async () => {
+    const body = { type: 'url_verification', challenge: 'challenge' }
+    mockHandleSlackChallenge.mockReturnValue(new Response('challenge', { status: 200 }))
+
+    const response = await run(body)
+
+    expect(mockVerifySlackRequestSignature).toHaveBeenCalledWith(
+      'test-secret',
+      expect.anything(),
+      JSON.stringify(body),
+      expect.any(String)
+    )
+    expect(mockHandleSlackChallenge).toHaveBeenCalledWith(body)
+    expect(response.status).toBe(200)
+    expect(mockFindWebhooksByRoutingKey).not.toHaveBeenCalled()
+  })
+
+  it('does not answer a verification challenge with an invalid signature', async () => {
+    mockVerifySlackRequestSignature.mockReturnValue(new Response(null, { status: 401 }))
+    mockHandleSlackChallenge.mockReturnValue(new Response('challenge', { status: 200 }))
+
+    const response = await run({ type: 'url_verification', challenge: 'challenge' })
+
+    expect(response.status).toBe(401)
+    expect(mockHandleSlackChallenge).not.toHaveBeenCalled()
+  })
+
   it('continues cleanly when the dispatcher filters the event', async () => {
     mockDispatchResolvedWebhookTarget.mockResolvedValue({
       outcome: 'ignored',

apps/sim/app/api/webhooks/slack/route.ts

@@ -1,12 +1,12 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
-import { env } from '@/lib/core/config/env'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { findWebhooksByRoutingKey, parseWebhookBody } from '@/lib/webhooks/processor'
 import { handleSlackChallenge, verifySlackRequestSignature } from '@/lib/webhooks/providers/slack'
 import { dispatchSlackWebhooks, getSlackDispatchResponse } from '@/lib/webhooks/slack-dispatch'
+import { getSlackNativeSigningSecret } from '@/lib/webhooks/slack-native-config'
 
 const logger = createLogger('SlackAppWebhookAPI')
 
@@ -44,13 +44,7 @@ async function handleSlackAppWebhook(request: NextRequest): Promise<NextResponse
   }
   const { body, rawBody } = parseResult
 
-  // Slack's endpoint verification handshake — echo the challenge back.
-  const challenge = handleSlackChallenge(body)
-  if (challenge) {
-    return challenge
-  }
-
-  const signingSecret = env.SLACK_SIGNING_SECRET
+  const signingSecret = getSlackNativeSigningSecret()
   if (!signingSecret) {
     logger.error(`[${requestId}] SLACK_SIGNING_SECRET is not configured`)
     return new NextResponse('Slack app not configured', { status: 500 })
@@ -61,6 +55,11 @@ async function handleSlackAppWebhook(request: NextRequest): Promise<NextResponse
     return authError
   }
 
+  const challenge = handleSlackChallenge(body)
+  if (challenge) {
+    return challenge
+  }
+
   const payload = body as Record<string, unknown>
 
   // Route by the installed workspace(s). For Slack Connect the outer `team_id`

apps/sim/lib/webhooks/deploy.test.ts

@@ -7,6 +7,8 @@ import {
   queueTableRows,
   resetDbChainMock,
   resetEnvFlagsMock,
+  resetEnvMock,
+  setEnv,
   setEnvFlags,
 } from '@sim/testing'
 import { eq, ne } from 'drizzle-orm'
@@ -84,6 +86,7 @@ import { getTrigger } from '@/triggers'
 
 afterAll(() => {
   resetDbChainMock()
+  resetEnvMock()
   resetEnvFlagsMock()
 })
 
@@ -151,6 +154,7 @@ function makeBlock(
 beforeEach(() => {
   vi.clearAllMocks()
   resetDbChainMock()
+  setEnv({ SLACK_SIGNING_SECRET: 'test-secret' })
   setEnvFlags({ isSlackExtendedScopesEnabled: true })
   ;(getProviderHandler as unknown as Mock).mockImplementation((provider: string) =>
     provider === 'quickbooks' ? quickBooksHandler : {}
@@ -301,8 +305,9 @@ describe('resolveWebhookConfigForBlock — slack_oauth routing', () => {
     })
   }
 
-  it('routes a custom bot credential by credential id on the slack provider', async () => {
+  it('routes a custom bot credential without the native app signing secret', async () => {
     setEnvFlags({ isSlackExtendedScopesEnabled: false })
+    setEnv({ SLACK_SIGNING_SECRET: undefined })
     mockGetSlackBotCredential.mockResolvedValue({
       workspaceId: 'ws-1',
       botToken: 'xoxb-token',
@@ -403,6 +408,24 @@ describe('resolveWebhookConfigForBlock — slack_oauth routing', () => {
     expect(mockFetchSlackTeamId).not.toHaveBeenCalled()
   })
 
+  it('rejects a Sim-app credential when its signing secret is not configured', async () => {
+    setEnv({ SLACK_SIGNING_SECRET: undefined })
+    mockGetSlackBotCredential.mockResolvedValue(null)
+    mockResolveOAuthAccountId.mockResolvedValue({ accountId: 'acct-1' })
+
+    const result = await resolveSlack({ eventType: 'message', customBotCredential: 'cred_oauth_1' })
+
+    expect(result?.success).toBe(false)
+    if (result?.success) throw new Error('expected failure')
+    expect(result?.error).toEqual({
+      message:
+        'The Sim Slack app trigger is not configured for this deployment. Configure its signing secret or select a custom bot.',
+      status: 400,
+    })
+    expect(mockRefreshAccessTokenIfNeeded).not.toHaveBeenCalled()
+    expect(mockFetchSlackTeamId).not.toHaveBeenCalled()
+  })
+
   it('rejects a custom bot credential from another workspace', async () => {
     mockGetSlackBotCredential.mockResolvedValue({
       workspaceId: 'other-ws',

apps/sim/lib/webhooks/deploy.ts

@@ -28,6 +28,7 @@ import {
   type StableDesiredWebhookRegistration,
 } from '@/lib/webhooks/registration-service'
 import { LEGACY_SLACK_CUSTOM_BOT_INGRESS_MODE } from '@/lib/webhooks/slack-custom-ingress-constants'
+import { getSlackNativeSigningSecret } from '@/lib/webhooks/slack-native-config'
 import {
   isSlackStreamResponseRequested,
   normalizeSlackStreamResponseConfig,
@@ -517,6 +518,16 @@ export async function resolveWebhookConfigForBlock(input: {
           },
         }
       }
+      if (!getSlackNativeSigningSecret()) {
+        return {
+          success: false,
+          error: {
+            message:
+              'The Sim Slack app trigger is not configured for this deployment. Configure its signing secret or select a custom bot.',
+            status: 400,
+          },
+        }
+      }
       if (isSlackStreamResponseRequested(providerConfig)) {
         return {
           success: false,

apps/sim/lib/webhooks/slack-native-config.ts

@@ -0,0 +1,7 @@
+import { env } from '@/lib/core/config/env'
+
+/** Returns the signing secret for the native Sim Slack app when it is configured. */
+export function getSlackNativeSigningSecret(): string | null {
+  const signingSecret = env.SLACK_SIGNING_SECRET?.trim()
+  return signingSecret || null
+}

packages/sim-setup/src/checks.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from 'vitest'
+import { type CheckContext, runChecks } from './checks'
+import type { EnvFile, EnvTarget } from './env-files'
+
+function envFile(target: EnvTarget, values: Record<string, string> = {}): EnvFile {
+  return {
+    target,
+    path: `${target}.env`,
+    exists: target === 'root',
+    content: '',
+    vars: new Map(Object.entries(values)),
+  }
+}
+
+function rootContext(values: Record<string, string>): CheckContext {
+  const root = envFile('root', values)
+  return {
+    layout: 'root',
+    primary: root,
+    live: false,
+    env: {
+      root,
+      sim: envFile('sim'),
+      realtime: envFile('realtime'),
+      db: envFile('db'),
+    },
+  }
+}
+
+describe('setup coherence checks', () => {
+  it('requires a signing secret when native Slack triggers are enabled', async () => {
+    const findings = await runChecks(
+      rootContext({
+        SLACK_EXTENDED_SCOPES: 'true',
+        NEXT_PUBLIC_SLACK_EXTENDED_SCOPES: 'true',
+      }),
+      ['coherence']
+    )
+
+    expect(findings).toContainEqual({
+      group: 'coherence',
+      status: 'fail',
+      message:
+        'SLACK_EXTENDED_SCOPES is on but SLACK_SIGNING_SECRET is not set — native Slack triggers will fail at runtime',
+      fix: 'set SLACK_SIGNING_SECRET or remove SLACK_EXTENDED_SCOPES',
+    })
+  })
+
+  it('does not require a signing secret for outbound-only Slack OAuth', async () => {
+    const findings = await runChecks(
+      rootContext({
+        SLACK_CLIENT_ID: 'client-id',
+        SLACK_CLIENT_SECRET: 'client-secret',
+      }),
+      ['coherence']
+    )
+
+    expect(findings.some((finding) => finding.message.includes('SLACK_SIGNING_SECRET'))).toBe(false)
+  })
+})

packages/sim-setup/src/checks.ts

@@ -467,6 +467,11 @@ function checkCoherence(ctx: CheckContext): Finding[] {
       needs: ['STRIPE_SECRET_KEY'],
       label: 'billing',
     },
+    {
+      flag: 'SLACK_EXTENDED_SCOPES',
+      needs: ['SLACK_SIGNING_SECRET'],
+      label: 'native Slack triggers',
+    },
     { flag: 'SSO_ENABLED', needs: ['SSO_ISSUER'], label: 'SSO' },
   ]
   for (const rule of featureRules) {