Skip to content

upload_file: form-encode files.getUploadURLExternal (rejects JSON, seen live) #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Octember merged 1 commit into from
Jul 30, 2026
Merged

upload_file: form-encode files.getUploadURLExternal (rejects JSON, seen live) #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions src/tools/slack.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,8 +143,14 @@ export function slackRegistry(deps: SlackToolDeps): ToolRegistry {
if (!(await file.exists())) return { success: false, output: `no such file in your workspace: ${a.path}` };
const bytes = await file.bytes();
const filename = basename(a.path);
// Slack's external upload flow: reserve a URL, POST the bytes, then complete into the venue.
const ticket = await api("files.getUploadURLExternal", deps.botToken, { filename, length: bytes.length });
// Slack's external upload flow: reserve a URL, POST the bytes, then complete into the
// venue. getUploadURLExternal is form-only — a JSON body earns invalid_arguments.
const ticketRes = await doFetch("https://slack.com/api/files.getUploadURLExternal", {
method: "POST",
headers: { Authorization: `Bearer ${deps.botToken}`, "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({ filename, length: String(bytes.length) }).toString(),
});
const ticket = (await ticketRes.json()) as SlackApiResponse;
if (!ticket.ok || typeof ticket.upload_url !== "string" || typeof ticket.file_id !== "string") {
return { success: false, output: `upload failed: ${ticket.error ?? "no upload url"}${ticket.error === "missing_scope" ? " — the Slack app needs the files:write scope" : ""}` };
}
Expand Down
17 changes: 14 additions & 3 deletions test/slack-tools.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,18 @@ function makeRegistry(opts: {
adminToken?: string;
}) {
const workspace = mkdtempSync(join(tmpdir(), "earshot-slack-tools-"));
const calls: { url: string; body?: unknown }[] = [];
const calls: { url: string; body?: unknown; contentType?: string }[] = [];
const responses = new Map(Object.entries(opts.responses ?? {}));
const fakeFetch = (async (url: unknown, init?: { body?: unknown }) => {
const fakeFetch = (async (url: unknown, init?: { body?: unknown; headers?: Record<string, string> }) => {
const u = String(url);
calls.push({ url: u, body: typeof init?.body === "string" ? JSON.parse(init.body) : init?.body });
const raw = init?.body;
const body =
typeof raw === "string"
? init?.headers?.["Content-Type"]?.includes("json")
? JSON.parse(raw)
: Object.fromEntries(new URLSearchParams(raw))
: raw;
calls.push({ url: u, body, ...(init?.headers?.["Content-Type"] ? { contentType: init.headers["Content-Type"] } : {}) });
const method = u.startsWith("https://slack.com/api/") ? u.slice("https://slack.com/api/".length) : u;
const queued = responses.get(method);
const payload = queued?.shift() ?? { ok: true };
Expand Down Expand Up @@ -96,6 +103,10 @@ describe("upload_file", () => {
expect(complete.thread_ts).toBe("17.001");
expect(complete.files).toEqual([{ id: "F123", title: "cleaned" }]);
expect(calls.some((c) => c.url === "https://upload.slack.example/u1")).toBe(true);
// getUploadURLExternal is form-only: a JSON body earns invalid_arguments (bit us live 2026-07-30)
const reserve = calls.find((c) => c.url.endsWith("files.getUploadURLExternal"))!;
expect(reserve.contentType).toBe("application/x-www-form-urlencoded");
expect(reserve.body).toEqual({ filename: "out.png", length: "9" });
});

test("refuses a path outside the workspace — the daemon's filesystem is not hers to post", async () => {
Expand Down
Loading