improvement(slack): request the approved mention/assistant/DM scopes, advertised on v2 only by TheodoreSpeaks · Pull Request #5898 · simstudioai/sim

TheodoreSpeaks · 2026-07-23T20:32:23Z

What

Slack app review has since approved app_mentions:read, assistant:write, and im:history — they're live in the prod app manifest under oauth_config.scopes.bot — but the repo still had them commented out behind a stale "TODO: Re-add once Slack app review approves these".

So Sim was requesting a narrower grant than the app is entitled to. Newly connected accounts got tokens missing exactly the scopes that back three simSubscribed events on the native Sim app trigger (#5892):

Event	Scope it needs
`app_mention`	`app_mentions:read`
`assistant_thread_started` / `_context_changed`	`assistant:write`
`message.im` (DMs)	`im:history`

The requested set now matches the manifest's 20 approved bot scopes exactly (verified at runtime).

Why v1 keeps the narrow list

Scopes are per-credential, not per-block — one Slack app → one slack provider → one shared token, requested server-side via getCanonicalScopesForProvider('slack') (lib/auth/auth.ts:2805). The grant itself can't be scoped to v2.

What is per-block is what each picker advertises and treats as missing. So:

slack_v2 + the slack_oauth trigger advertise the full 20 — they host the native Sim app trigger that needs them.
The legacy v1 block stays pinned to the pre-expansion 17. It has no feature needing the new three, and advertising them there would flag every existing Slack credential as "missing scopes" and prompt a needless reconnect.

A reconnect still grants the full set regardless of which block started it — this only controls the nag and the displayed permission list. Verified that the integrations/connections surface keys isConnected off a direct providerId match, not scope completeness, so existing Slack connections are not marked incomplete.

Not included

The Home tab (app_home_opened) is still custom-bot-only and correctly gated. It is absent from the manifest's event_subscriptions.bot_events, so Slack does not deliver it to the shared app. Flipping its simSubscribed flag would make deploys pass while the trigger silently never fires. Enabling it is a manifest change first (add app_home_opened to bot_events; no new scope required), then a one-line catalog flip.

Checks

bunx vitest run lib/webhooks triggers/slack blocks tools/slack — 886 passed (79 files)
bun run type-check — no new errors (5 pre-existing better-auth errors unchanged)
bun run lint:check — clean
check-block-registry.ts — pass
Runtime-verified: full=20, v1=17, zero leakage of the three into v1

🤖 Generated with Claude Code

https://claude.ai/code/session_018asmKsWQ5Vi7T7wD9uHofz

… advertised on v2 only Slack app review has since approved `app_mentions:read`, `assistant:write`, and `im:history` — they are live in the prod app manifest's `oauth_config.scopes.bot` — but the repo still had them commented out behind a stale "re-add once approved" TODO. Sim was therefore requesting a narrower grant than the app is entitled to, so newly connected accounts got tokens missing exactly the scopes backing three `simSubscribed` events on the native Sim app trigger: `app_mention` (app_mentions:read), assistant threads (assistant:write), and DMs (im:history). The requested scope set now matches the manifest's 20 approved bot scopes exactly. Scopes are per-credential, not per-block (one Slack app -> one `slack` provider -> one shared token, requested server-side via getCanonicalScopesForProvider), so the grant itself cannot be scoped to v2. What is per-block is what each picker advertises and treats as missing, so: - slack_v2 + the slack_oauth trigger advertise the full set (they host the native Sim app trigger that needs it). - The legacy v1 block stays pinned to the pre-expansion 17 scopes. It has no feature needing the new three, and advertising them there would flag every existing Slack credential as missing scopes and prompt a needless reconnect. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018asmKsWQ5Vi7T7wD9uHofz

vercel · 2026-07-23T20:32:30Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 23, 2026 8:32pm

cursor · 2026-07-23T20:32:34Z

PR Summary

Medium Risk
Changes OAuth scope requests for Slack (auth/integration surface); mis-split advertising could cause unnecessary reconnect prompts or missing-scope UX, but v1 is intentionally narrowed to avoid that.

Overview
Slack OAuth again requests app_mentions:read, assistant:write, and im:history in the shared provider config (matching the approved app manifest), so new connects get tokens that support native Sim app trigger events (mentions, assistant threads, DMs).

Block UI scope advertising is split: the legacy slack credential picker keeps the pre-expansion 17 advertised scopes so existing workspaces aren’t nagged to reconnect; slack_v2 (via adaptSubBlockForV2) advertises the full 20 because it hosts the slack_oauth trigger. Actual authorization still uses the provider-wide canonical scope list on reconnect.

^{Reviewed by Cursor Bugbot for commit 98fa2ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-07-23T20:34:35Z

Greptile Summary

This PR expands the canonical Slack OAuth grant while preserving narrower scope-completeness checks for legacy blocks.

Adds app_mentions:read, assistant:write, and im:history to the provider-wide Slack OAuth scope list.
Keeps the legacy Slack block’s advertised requirements pinned to the prior scope set.
Advertises the complete scope set for slack_v2 and the native slack_oauth trigger.

Confidence Score: 5/5

The PR appears safe to merge, with the OAuth grant and version-specific scope advertisements consistently wired to their intended consumers.

The canonical provider list supplies all three new scopes to authorization, slack_v2, and the native trigger, while the legacy picker explicitly filters only those scopes to avoid unnecessary reconnect warnings.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/oauth.ts	Adds the three approved event-delivery scopes to the canonical Slack OAuth grant used for new connections and reconnects.
apps/sim/blocks/blocks/slack.ts	Separates legacy and v2 advertised scope requirements while leaving v2 and native-trigger credentials on the full canonical set.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Provider[Canonical Slack scopes: 20] --> OAuth[OAuth authorization request]
  Provider --> V2[slack_v2 picker: 20 required]
  Provider --> Trigger[slack_oauth trigger: 20 required]
  Provider --> Filter[Remove mention, assistant, and DM scopes]
  Filter --> V1[Legacy Slack picker: 17 required]
  OAuth --> Token[Connected Slack credential]

_{Reviews (1): Last reviewed commit: "improvement(slack): request the approved..." | Re-trigger Greptile}

TheodoreSpeaks merged commit 84e7aad into staging Jul 23, 2026
19 checks passed

TheodoreSpeaks deleted the improvement/slack-approved-scopes branch July 23, 2026 20:44

waleedlatif1 mentioned this pull request Jul 23, 2026

v0.7.44: nextjs upgrade, CSV imports to tables fixes, tombstone for KB docs, mcp fixes #5903

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

improvement(slack): request the approved mention/assistant/DM scopes, advertised on v2 only#5898

improvement(slack): request the approved mention/assistant/DM scopes, advertised on v2 only#5898
TheodoreSpeaks merged 1 commit into
stagingfrom
improvement/slack-approved-scopes

TheodoreSpeaks commented Jul 23, 2026

Uh oh!

vercel Bot commented Jul 23, 2026

Uh oh!

cursor Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

TheodoreSpeaks commented Jul 23, 2026

What

Why v1 keeps the narrow list

Not included

Checks

Uh oh!

vercel Bot commented Jul 23, 2026

Uh oh!

cursor Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 23, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor Bot commented Jul 23, 2026 •

edited

Loading