feat: serve organization search through Slack custom bots

Author: TheodoreSpeaks

apps/sim/app/api/files/uploads/purposes.ts

@@ -235,6 +235,8 @@ function requireSessionScope(value: string | null, label = 'scope'): string {
 
 async function principalUserId(principal: Principal, workspaceId?: string): Promise<string> {
   switch (principal.kind) {
+    case 'slack_installation':
+      throw new UploadSessionError('forbidden', 'Slack installations cannot create uploads')
     case 'session':
     case 'personal_api_key':
     case 'oauth_access_token':

apps/sim/app/api/knowledge/slack/[installationId]/route.ts

@@ -0,0 +1,20 @@
+import { removeSlackSearchContract } from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { removeSlackSearchInstallation } from '@/lib/knowledge/application/slack-search/installations'
+
+export const DELETE = defineInternalJsonRoute({
+  contract: removeSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.removeSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ query, params }) => ({ ...query, ...params }),
+  useCase: removeSlackSearchInstallation,
+  present: (result) => result,
+})

apps/sim/app/api/knowledge/slack/route.ts

@@ -0,0 +1,43 @@
+import {
+  configureSlackSearchContract,
+  listSlackSearchContract,
+} from '@/lib/api/contracts/knowledge/slack'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import {
+  configureSlackSearchInstallation,
+  listSlackSearchInstallations,
+} from '@/lib/knowledge/application/slack-search/installations'
+
+export const GET = defineInternalJsonRoute({
+  contract: listSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.listSlackInstallations,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ query }) => query,
+  useCase: listSlackSearchInstallations,
+  present: ({ installations, bots }) => ({
+    bots,
+    installations: installations.map((row) => ({
+      ...row,
+      lastEventAt: row.lastEventAt?.toISOString() ?? null,
+    })),
+  }),
+})
+
+export const POST = defineInternalJsonRoute({
+  contract: configureSlackSearchContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.configureSlackInstallation,
+  rateLimit: internalRateLimits.user({ bucketName: 'slack-search-settings' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: configureSlackSearchInstallation,
+  present: (result) => result,
+})

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.test.ts

@@ -10,15 +10,19 @@ const {
   mockGetSlackBotCredential,
   mockHandleChallenge,
   mockVerifySignature,
+  mockDispatchSearch,
 } = vi.hoisted(() => ({
   mockParseWebhookBody: vi.fn(),
   mockFindWebhooksByRoutingKey: vi.fn(),
   mockDispatchResolvedWebhookTarget: vi.fn(),
   mockGetSlackBotCredential: vi.fn(),
   mockHandleChallenge: vi.fn(),
   mockVerifySignature: vi.fn(),
+  mockDispatchSearch: vi.fn(),
 }))
 
+vi.mock('@/lib/slack-search/dispatcher', () => ({ dispatchSlackSearch: mockDispatchSearch }))
+
 vi.mock('@/lib/core/admission/gate', () => ({
   tryAdmit: () => ({ release: vi.fn() }),
   admissionRejectedResponse: () => new Response(null, { status: 503 }),
@@ -66,6 +70,7 @@ function webhook(id: string) {
 describe('Slack custom-bot webhook route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockDispatchSearch.mockResolvedValue(undefined)
     mockHandleChallenge.mockReturnValue(null)
     mockVerifySignature.mockReturnValue(null)
     mockParseWebhookBody.mockResolvedValue({
@@ -74,6 +79,7 @@ describe('Slack custom-bot webhook route', () => {
     })
     mockGetSlackBotCredential.mockResolvedValue({
       signingSecret: 'sec',
+      credentialVersion: 'version',
       botToken: 'xoxb-x',
       teamId: 'T1',
     })
@@ -134,6 +140,20 @@ describe('Slack custom-bot webhook route', () => {
     )
     expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledTimes(1)
     expect(res.status).toBe(200)
+    expect(mockDispatchSearch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        credentialId: CREDENTIAL_ID,
+        credentialVersion: 'version',
+        body: messageBody,
+      })
+    )
+  })
+
+  it('returns a retryable failure when Search enqueue fails beside a successful workflow', async () => {
+    mockDispatchSearch.mockRejectedValue(new Error('Queue unavailable'))
+    const response = await POST(makeRequest(), context)
+    expect(response.status).toBeGreaterThanOrEqual(500)
+    expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledOnce()
   })
 
   it('still returns 200 when the dispatcher filters the event', async () => {

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.ts

@@ -2,12 +2,13 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { dispatchSlackSearch } from '@/lib/slack-search/dispatcher'
 import { parseWebhookBody } from '@/lib/webhooks/processor'
 import { handleSlackChallenge } from '@/lib/webhooks/providers/slack'
 import {
+  authenticateSlackCustomBotRequest,
   dispatchSlackCustomBotCredential,
   handleSlackAgentSessionStopped,
-  verifySlackCustomBotCredentialRequest,
 } from '@/lib/webhooks/slack-custom-ingress'
 import { getSlackDispatchResponse } from '@/lib/webhooks/slack-dispatch'
 
@@ -59,14 +60,14 @@ async function handleSlackCustomBotWebhook(
     return challenge
   }
 
-  const authError = await verifySlackCustomBotCredentialRequest({
+  const authentication = await authenticateSlackCustomBotRequest({
     credentialId,
     request,
     rawBody,
     requestId,
   })
-  if (authError) {
-    return authError
+  if (authentication instanceof Response) {
+    return authentication
   }
 
   const [, dispatchResults] = await Promise.all([
@@ -78,6 +79,12 @@ async function handleSlackCustomBotWebhook(
       requestId,
       receivedAt,
     }),
+    dispatchSlackSearch({
+      credentialId,
+      credentialVersion: authentication.credentialVersion,
+      body,
+      receivedAt,
+    }),
   ])
   return getSlackDispatchResponse(dispatchResults)
 }

apps/sim/app/o/[organizationId]/settings/[section]/settings.tsx

@@ -24,6 +24,9 @@ const OrganizationConnectedAccounts = dynamic(() =>
     (m) => m.OrganizationConnectedAccounts
   )
 )
+const OrganizationSearchSlack = dynamic(() =>
+  import('@/app/o/[organizationId]/settings/components/organization-search-slack').then((m) => m.OrganizationSearchSlack)
+)
 
 const TeamManagement = dynamic(() =>
   import('@/app/workspace/[workspaceId]/settings/components/team-management/team-management').then(
@@ -78,6 +81,7 @@ export function OrganizationSettings({ section }: OrganizationSettingsProps) {
         <OrganizationConnectedAccounts organizationId={organizationId} />
       )}
       {section === 'search-mcp' && <OrganizationSearchMcp />}
+      {section === 'search-slack' && <OrganizationSearchSlack />}
       {section === 'members' && (
         <TeamManagement
           organizationId={organizationId}

apps/sim/app/o/[organizationId]/settings/components/organization-search-slack.tsx

@@ -0,0 +1,202 @@
+'use client'
+
+import { useState } from 'react'
+import { Chip, ChipDropdown, ChipSwitch } from '@sim/emcn'
+import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
+import { ConnectSlackBotModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal'
+import { SettingsQueryErrorState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
+import {
+  useConfigureSlackSearch,
+  useRemoveSlackSearch,
+  useSlackSearchInstallations,
+} from '@/hooks/queries/slack-search'
+
+/** Organization admins bind an existing custom bot or create one using the DM Search manifest. */
+export function OrganizationSearchSlack() {
+  const { organization, viewer } = useOrganizationContext()
+  const installations = useSlackSearchInstallations(viewer.isAdmin ? organization.id : undefined)
+  const configure = useConfigureSlackSearch()
+  const remove = useRemoveSlackSearch()
+  const [selectedBot, setSelectedBot] = useState('')
+  const [modal, setModal] = useState<{ credentialId?: string; displayName?: string } | null>(null)
+  if (!viewer.isAdmin) return null
+  const busy = configure.isPending || remove.isPending
+  const error = configure.error ?? remove.error
+  const bots = installations.data?.bots ?? []
+  const availableBots = bots.filter(
+    (bot) =>
+      !installations.data?.installations.some(
+        (installation) => installation.credentialId === bot.id
+      )
+  )
+
+  return (
+    <div className='flex max-w-2xl flex-col gap-6'>
+      <p className='text-[var(--text-secondary)] text-sm'>
+        Members can DM the bot to find documents they can access in Sim Search. Their Slack email
+        must match their verified Sim account in this organization.
+      </p>
+      {installations.error ? (
+        <SettingsQueryErrorState
+          error={installations.error}
+          fallback='Could not load Slack bots'
+          isRetrying={installations.isFetching}
+          onRetry={() => void installations.refetch()}
+          variant='inline'
+        />
+      ) : !installations.data ? (
+        <p className='text-[var(--text-muted)] text-sm'>Loading Slack bots…</p>
+      ) : (
+        <>
+          {installations.data.installations.map((installation) => (
+            <div
+              key={installation.id}
+              className='flex flex-col gap-3 border-[var(--border-1)] border-b pb-4'
+            >
+              <div className='flex items-center justify-between gap-4'>
+                <div className='min-w-0'>
+                  <p className='truncate text-[var(--text-primary)] text-sm'>
+                    {bots.find((bot) => bot.id === installation.credentialId)?.displayName ??
+                      installation.teamName}
+                  </p>
+                  <p className='text-[var(--text-muted)] text-caption'>{installation.teamName}</p>
+                </div>
+                <fieldset disabled={busy}>
+                  <ChipSwitch
+                    aria-label={`Search in ${installation.teamName}`}
+                    value={installation.enabled ? 'enabled' : 'disabled'}
+                    options={[
+                      { value: 'disabled', label: 'Off' },
+                      { value: 'enabled', label: 'On' },
+                    ]}
+                    onChange={(value) =>
+                      configure.mutate({
+                        organizationId: organization.id,
+                        credentialId: installation.credentialId,
+                        enabled: value === 'enabled',
+                      })
+                    }
+                  />
+                </fieldset>
+              </div>
+              {installation.needsValidation && (
+                <p className='text-[var(--text-error)] text-caption'>
+                  The bot credential changed. Validate it to resume Search.
+                </p>
+              )}
+              {installation.lastOutcome === 'delivery_failed' && (
+                <p className='text-[var(--text-error)] text-caption'>
+                  The last reply could not be delivered. Check the Slack connection.
+                </p>
+              )}
+              <div className='flex flex-wrap gap-2'>
+                {installation.needsValidation && (
+                  <Chip
+                    disabled={busy}
+                    onClick={() =>
+                      configure.mutate({
+                        organizationId: organization.id,
+                        credentialId: installation.credentialId,
+                        enabled: true,
+                      })
+                    }
+                  >
+                    Validate and enable
+                  </Chip>
+                )}
+                <Chip
+                  disabled={busy}
+                  onClick={() =>
+                    setModal({
+                      credentialId: installation.credentialId,
+                      displayName: bots.find((bot) => bot.id === installation.credentialId)
+                        ?.displayName,
+                    })
+                  }
+                >
+                  Reconnect
+                </Chip>
+                <Chip
+                  disabled={busy}
+                  onClick={() =>
+                    remove.mutate({
+                      organizationId: organization.id,
+                      installationId: installation.id,
+                    })
+                  }
+                >
+                  Remove from Search
+                </Chip>
+              </div>
+            </div>
+          ))}
+          {availableBots.length > 0 && (
+            <div className='flex flex-wrap items-center gap-2'>
+              <ChipDropdown
+                value={selectedBot}
+                onChange={setSelectedBot}
+                options={availableBots.map((bot) => ({ value: bot.id, label: bot.displayName }))}
+                placeholder='Choose a connected bot'
+              />
+              <Chip
+                disabled={!selectedBot || busy}
+                onClick={() =>
+                  configure.mutate({
+                    organizationId: organization.id,
+                    credentialId: selectedBot,
+                    enabled: true,
+                  })
+                }
+              >
+                Connect to Search
+              </Chip>
+              <Chip
+                disabled={!selectedBot || busy}
+                onClick={() =>
+                  setModal({
+                    credentialId: selectedBot,
+                    displayName: bots.find((bot) => bot.id === selectedBot)?.displayName,
+                  })
+                }
+              >
+                Update bot permissions
+              </Chip>
+            </div>
+          )}
+          <div>
+            <Chip disabled={busy} onClick={() => setModal({})}>
+              Create a custom Slack bot
+            </Chip>
+          </div>
+        </>
+      )}
+      {error && (
+        <p role='alert' className='text-[var(--text-error)] text-sm'>
+          {error.message}
+        </p>
+      )}
+      {configure.isPending && (
+        <p role='status' className='text-[var(--text-muted)] text-caption'>
+          Validating the Slack connection…
+        </p>
+      )}
+      {modal && (
+        <ConnectSlackBotModal
+          key={modal.credentialId ?? 'new'}
+          open
+          purpose='search'
+          organizationId={organization.id}
+          credentialId={modal.credentialId}
+          initialDisplayName={modal.displayName}
+          onOpenChange={(open) => {
+            if (!open) setModal(null)
+          }}
+          onCreated={(credentialId) => {
+            setModal(null)
+            configure.mutate({ organizationId: organization.id, credentialId, enabled: true })
+          }}
+        />
+      )}
+    </div>
+  )
+}