fix(slack): cancel stale-uninstall turns for this installation's revoked members

Author: waleedlatif1

apps/sim/lib/knowledge/application/slack-search/lifecycle.test.ts

@@ -39,7 +39,9 @@ beforeEach(() => {
 })
 describe('Slack access revocation', () => {
   it('cancels only affected members without rotating the shared installation revision', async () => {
-    dbChainMockFns.returning.mockResolvedValueOnce([{ providerSubjectId: 'U1' }])
+    dbChainMockFns.returning.mockResolvedValueOnce([
+      { organizationId: 'org', providerSubjectId: 'U1' },
+    ])
     await revokeSlackSearchAccess.execute({
       principal,
       input: { ...input, event: { type: 'tokens_revoked', tokens: { oauth: ['U1', 'U2'] } } },
@@ -223,6 +225,33 @@ describe('Slack access revocation', () => {
       expect.objectContaining({ left: credential.organizationId })
     )
   })
+  it('cancels stale-uninstall turns only for members revoked in the installation organization', async () => {
+    queueReinstalledBot()
+    dbChainMockFns.returning.mockResolvedValueOnce([
+      { organizationId: 'org', providerSubjectId: 'U1' },
+      { organizationId: 'other-org', providerSubjectId: 'U2' },
+    ])
+    await revokeSlackSearchAccess.execute({ principal, input })
+    expect(dbChainMockFns.update.mock.calls.map(([table]) => table)).toEqual([
+      credential,
+      slackSearchTurn,
+    ])
+    expect(dbChainMockFns.where).toHaveBeenLastCalledWith({
+      type: 'and',
+      conditions: [
+        { type: 'eq', left: slackSearchTurn.installationId, right: 'i1' },
+        { type: 'inArray', column: slackSearchTurn.status, values: ['pending', 'running'] },
+        {
+          type: 'inArray',
+          column: expect.objectContaining({
+            strings: ['', " #>> '{message,userId}'"],
+            values: [slackSearchTurn.payload],
+          }),
+          values: ['U1'],
+        },
+      ],
+    })
+  })
   it('ignores a stale custom-app uninstall before any writes', async () => {
     m.app.mockResolvedValue({
       app: { id: 'A1', kind: 'custom', revision: 'r1', organizationId: 'org' },
@@ -245,7 +274,9 @@ describe('Slack access revocation', () => {
           updatedAt: new Date(input.event_time * 1000 + 1000),
         },
       ])
-      dbChainMockFns.returning.mockResolvedValueOnce([{ providerSubjectId: 'U1' }])
+      dbChainMockFns.returning.mockResolvedValueOnce([
+        { organizationId: 'org', providerSubjectId: 'U1' },
+      ])
       await revokeSlackSearchAccess.execute({
         principal,
         input: { ...input, event: { type: 'tokens_revoked', tokens } },

apps/sim/lib/knowledge/application/slack-search/lifecycle.ts

@@ -91,11 +91,8 @@ export const revokeSlackSearchAccess: OperationUseCase<
       if (app.app.kind === 'custom' && app.app.organizationId !== installation.organizationId)
         throw new Error('Slack installation ownership is inconsistent')
       const staleInstallation = installation.updatedAt > occurredAt
-      if (uninstall && staleInstallation) {
-        /** A reinstall keeps its bot, but shared-app grants issued before the uninstall are gone. */
-        if (sharedApp) await revokeMemberGrants(tx)
-        return
-      }
+      /** A reinstall keeps its bot, but shared-app grants issued before the uninstall are gone. */
+      if (uninstall && staleInstallation && !sharedApp) return
       const revokeBot =
         !staleInstallation &&
         (uninstall ||
@@ -110,10 +107,14 @@ export const revokeSlackSearchAccess: OperationUseCase<
         if (revokeBot) await revokeCredentials
         else {
           const revokedCredentials = await revokeCredentials.returning({
+            organizationId: credential.organizationId,
             providerSubjectId: credential.providerSubjectId,
           })
-          revokedMemberIds = revokedCredentials.flatMap(({ providerSubjectId }) =>
-            providerSubjectId ? [providerSubjectId] : []
+          /** Only this installation's members have turns on its bot. */
+          revokedMemberIds = revokedCredentials.flatMap(({ organizationId, providerSubjectId }) =>
+            providerSubjectId && organizationId === installation.organizationId
+              ? [providerSubjectId]
+              : []
           )
         }
       }