feat(slack-search): stream enterprise answers through one Slack app

Author: TheodoreSpeaks

apps/sim/app/api/files/uploads/purposes.ts

@@ -235,6 +235,7 @@ function requireSessionScope(value: string | null, label = 'scope'): string {
 
 async function principalUserId(principal: Principal, workspaceId?: string): Promise<string> {
   switch (principal.kind) {
+    case 'slack_app':
     case 'slack_installation':
       throw new UploadSessionError('forbidden', 'Slack installations cannot create uploads')
     case 'session':

apps/sim/app/api/knowledge/slack/oauth/callback/route.ts

@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server'
+import { slackSearchOAuthCallbackContract } from '@/lib/api/contracts/knowledge/slack'
+import { parseRequest } from '@/lib/api/server'
+import {
+  InternalUnauthenticatedError,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { getBaseUrl } from '@/lib/core/utils/urls'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { completeSlackSearchSetup } from '@/lib/knowledge/application/slack-search/setup'
+import { organizationRoutes } from '@/lib/navigation/paths'
+
+/** OAuth is a redirect protocol; protected configuration remains in the application use case. */
+export const GET = withRouteHandler(async (request) => {
+  try {
+    const principal = await internalSessionAuth.authenticate()
+    const rateResponse = await internalRateLimits
+      .user({ bucketName: 'slack-search-settings' })
+      .enforce(request, principal)
+    if (rateResponse) return rateResponse
+    const parsed = await parseRequest(slackSearchOAuthCallbackContract, request, {})
+    if (!parsed.success) return parsed.response
+    const result = await completeSlackSearchSetup.execute({
+      principal,
+      input: parsed.data.query,
+      request,
+    })
+    const url = new URL(
+      organizationRoutes(result.organizationId).settingsSection('search-slack'),
+      getBaseUrl()
+    )
+    url.searchParams.set('slackSetup', 'complete')
+    return NextResponse.redirect(url, 303)
+  } catch (error) {
+    if (error instanceof InternalUnauthenticatedError)
+      return NextResponse.json(
+        { error: 'Sign in to Sim and restart Slack setup.' },
+        { status: 401 }
+      )
+    const projected = internalOrchestrationErrorPolicy.project(error)
+    if (projected) return NextResponse.json(projected.body, { status: projected.status })
+    throw error
+  }
+})

apps/sim/app/api/knowledge/slack/oauth/route.ts

@@ -0,0 +1,19 @@
+import { startSlackSearchOAuthContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { startSlackSearchSetup } from '@/lib/knowledge/application/slack-search/setup'
+
+export const POST = defineInternalJsonRoute({
+  contract: startSlackSearchOAuthContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.startSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: startSlackSearchSetup,
+})

apps/sim/app/api/knowledge/slack/onboarding/retry/route.ts

@@ -0,0 +1,22 @@
+import { retrySlackSearchOnboardingContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import {
+  retrySlackSearchOnboarding,
+  slackSearchOnboardingOperations,
+} from '@/lib/knowledge/application/slack-search/onboarding'
+
+export const POST = defineInternalJsonRoute({
+  contract: retrySlackSearchOnboardingContract,
+  auth: internalSessionAuth,
+  operation: slackSearchOnboardingOperations.retry,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-onboarding-retry' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store', 'Referrer-Policy': 'no-referrer' },
+  mapInput: ({ body }) => body,
+  useCase: retrySlackSearchOnboarding,
+})

apps/sim/app/api/knowledge/slack/onboarding/route.test.ts

@@ -0,0 +1,105 @@
+/** @vitest-environment node */
+import { authMockFns, createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ read: vi.fn(), retry: vi.fn() }))
+vi.mock('@/lib/knowledge/application/slack-search/onboarding', () => {
+  const read = {
+    id: 'knowledge.slack.onboarding.read',
+    capability: 'none',
+    principalKinds: ['session'],
+  }
+  const retry = {
+    id: 'knowledge.slack.onboarding.retry',
+    capability: 'knowledge.use',
+    principalKinds: ['session'],
+  }
+  return {
+    slackSearchOnboardingOperations: { read, retry },
+    getSlackSearchOnboarding: { operation: read, execute: mocks.read },
+    retrySlackSearchOnboarding: { operation: retry, execute: mocks.retry },
+  }
+})
+
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { POST } from '@/app/api/knowledge/slack/onboarding/retry/route'
+import { GET } from '@/app/api/knowledge/slack/onboarding/route'
+
+const token = 'bf1ff774-505b-4f2f-946d-9c54ed75de47'
+const url = `http://localhost/api/knowledge/slack/onboarding?token=${token}`
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  authMockFns.mockGetSession.mockResolvedValue({
+    user: { id: 'sender' },
+    session: { id: 'session' },
+  })
+  mocks.read.mockResolvedValue({ status: 'membership_required' })
+  mocks.retry.mockResolvedValue({ slackUrl: 'https://example.slack.com/archives/D1/p1' })
+})
+
+describe('Slack onboarding routes', () => {
+  it('authenticates both routes before parsing invalid input', async () => {
+    authMockFns.mockGetSession.mockResolvedValue(null)
+    expect((await GET(createMockRequest('GET'))).status).toBe(401)
+    expect((await POST(createMockRequest('POST', {}))).status).toBe(401)
+    expect(mocks.read).not.toHaveBeenCalled()
+    expect(mocks.retry).not.toHaveBeenCalled()
+  })
+
+  it('rejects malformed tokens before entering the application', async () => {
+    expect((await GET(createMockRequest('GET'))).status).toBe(400)
+    expect((await POST(createMockRequest('POST', { token: 'invalid' }))).status).toBe(400)
+    expect(mocks.read).not.toHaveBeenCalled()
+    expect(mocks.retry).not.toHaveBeenCalled()
+  })
+
+  it('projects only the blocked view and keeps the response private', async () => {
+    mocks.read.mockResolvedValue({
+      status: 'membership_required',
+      question: 'private question',
+      organizationId: 'private organization',
+      email: 'private@example.test',
+    })
+    const response = await GET(createMockRequest('GET', undefined, {}, url))
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ status: 'membership_required' })
+    expect(response.headers.get('Cache-Control')).toBe('private, no-store')
+    expect(response.headers.get('Referrer-Policy')).toBe('no-referrer')
+    expect(mocks.read).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal: { kind: 'session', userId: 'sender', sessionId: 'session' },
+        input: { token },
+      })
+    )
+    expect(mocks.retry).not.toHaveBeenCalled()
+  })
+
+  it('passes explicit retries to the same signed-in principal', async () => {
+    const response = await POST(createMockRequest('POST', { token }))
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({
+      slackUrl: 'https://example.slack.com/archives/D1/p1',
+    })
+    expect(mocks.retry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal: { kind: 'session', userId: 'sender', sessionId: 'session' },
+        input: { token },
+      })
+    )
+  })
+
+  it('preserves authorization denial without returning a question', async () => {
+    mocks.retry.mockRejectedValue(new OrchestrationError('forbidden', 'Complete account setup'))
+    const response = await POST(createMockRequest('POST', { token }))
+    expect(response.status).toBe(403)
+    expect(await response.json()).not.toHaveProperty('slackUrl')
+  })
+
+  it('conceals unexpected infrastructure errors', async () => {
+    mocks.read.mockRejectedValue(new Error('private database connection'))
+    const response = await GET(createMockRequest('GET', undefined, {}, url))
+    expect(response.status).toBe(500)
+    expect(await response.json()).toMatchObject({ error: 'Internal server error' })
+  })
+})

apps/sim/app/api/knowledge/slack/onboarding/route.ts

@@ -0,0 +1,22 @@
+import { getSlackSearchOnboardingContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import {
+  getSlackSearchOnboarding,
+  slackSearchOnboardingOperations,
+} from '@/lib/knowledge/application/slack-search/onboarding'
+
+export const GET = defineInternalJsonRoute({
+  contract: getSlackSearchOnboardingContract,
+  auth: internalSessionAuth,
+  operation: slackSearchOnboardingOperations.read,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-onboarding' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store', 'Referrer-Policy': 'no-referrer' },
+  mapInput: ({ query }) => query,
+  useCase: getSlackSearchOnboarding,
+})

apps/sim/app/api/knowledge/slack/setup/route.ts

@@ -0,0 +1,19 @@
+import { prepareSlackSearchContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { prepareSlackSearchSetup } from '@/lib/knowledge/application/slack-search/setup'
+
+export const POST = defineInternalJsonRoute({
+  contract: prepareSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.prepareSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: prepareSlackSearchSetup,
+})

apps/sim/app/api/webhooks/outbox/process/route.ts

@@ -13,6 +13,7 @@ import { processOutboxEvents } from '@/lib/core/outbox/service'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { directGrantOutboxHandlers } from '@/lib/invitations/direct-grant'
+import { slackSearchOutboxHandlers } from '@/lib/knowledge/application/slack-search/outbox'
 import { knowledgeDocumentProcessingOutboxHandlers } from '@/lib/knowledge/documents/processing-outbox-handler'
 import { organizationResourceCleanupOutboxHandlers } from '@/lib/organizations/resource-cleanup'
 import { workspaceFileLiveDocOutboxHandlers } from '@/lib/uploads/contexts/workspace/workspace-file-live-doc-outbox'
@@ -27,6 +28,7 @@ export const dynamic = 'force-dynamic'
 export const maxDuration = 800
 
 const handlers = {
+  ...slackSearchOutboxHandlers,
   ...adminInvitationOperationOutboxHandlers,
   ...adminMemberOperationOutboxHandlers,
   ...billingOutboxHandlers,