feat(auth): pin the slack install to one workspace via SLACK_TEAM_ID - #202
Open
github-actions[bot] wants to merge 7 commits into
Open
feat(auth): pin the slack install to one workspace via SLACK_TEAM_ID#202github-actions[bot] wants to merge 7 commits into
github-actions[bot] wants to merge 7 commits into
Conversation
A workspace subdomain is the obvious thing to paste, and Slack then refuses the install with an error that names neither the variable nor the reason. The value is checked at boot instead, next to the pair() check that already refuses half a credential pair. Unset stays fine, because pinning the workspace is optional.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 12 files
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
The value is sent to Slack as the workspace to install into, and it is matched against the team id the callback reports. An E... enterprise id matches neither, so it refused every install at the callback rather than at boot. rememberSlackInstall also keys the workspace grant on the team id, so an enterprise id can never name a row this app writes.
SLACK_TEAM_ID only asked Slack to pick the workspace. The callback was accepted whatever workspace it reported, so an install into a second workspace stored its own SlackInstallation, and replaceSlackConnection then deleted the pinned workspace's grant and every other Slack account row. The token exchange names the workspace it installed into, so the callback is refused before rememberSlackInstall writes anything.
This branch renames slack-scope-groups.tsx to scope-groups.tsx, so the example in AGENTS.md named a file that no longer exists once it lands. The example now matches the real component and its real call site, including the caption prop that keeps the Slack wording out of a component another provider will reuse.
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Opened automatically when
refactor/provider-agnostic-connectionswas pushed.The title is written from the diff and rewritten as you push, because this is squashed onto
mainand the title becomes the commit subject and the changelog line. Retitle it yourself and it is yours — the automation stops touching it.Summary by cubic
Pins Slack installs to the optional
SLACK_TEAM_IDworkspace instead of whichever workspace the browser session has open; when unset, the existing any-workspace behavior remains. Mismatched OAuth callbacks now fail before writing or replacing Slack grants, and the Slack-only connection guard is now provider-agnostic for future providers.SLACK_TEAM_IDat boot and rejects subdomains and enterprise IDs.GUARDED_CONNECTIONSfor shared checks across connection and callback endpoints.ScopeGroups, with Slack-specific copy supplied by the page and updated examples.Written for commit a97b31e. Summary will update on new commits.