fix: source events' userId from the authorizations array in buildSource - #3050
Open
Agi-Asi wants to merge 2 commits into
Open
fix: source events' userId from the authorizations array in buildSource#3050Agi-Asi wants to merge 2 commits into
Agi-Asi wants to merge 2 commits into
Conversation
For event payloads, buildSource extracted userId from event fields (event.user, channel.creator, subteam.created_by). Those name whoever *triggered* the event — e.g. the invitee in member_joined_channel — who may never have installed the app. authorize()/fetchInstallation() then look up an installation for the wrong user, which breaks multi-user-token installs: the store can't know which installation the event was actually delivered for (slackapi#2271). The envelope's authorizations array names the installing user the event was delivered for, and buildSource already prefers it for teamId and enterpriseId — userId was the odd one out. Do the same: prefer authorizations[0].user_id, falling back to the existing event field extraction when the array is absent (URL-verification and other non-enveloped shapes). Tests cover both paths: authorizations present (installer id wins over event.user) and absent (event.user fallback unchanged). Fixes slackapi#2271
🦋 Changeset detectedLatest commit: d264a6b The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Thanks for the contribution! Before we can merge this, we need @Agi-Asi to sign the Salesforce Inc. Contributor License Agreement. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2271 — the bug @filmaj confirmed there: for event payloads,
buildSourceextractsuserIdfrom event fields (event.user,channel.creator,subteam.created_by). Those name whoever triggered the event — e.g. the invitee inmember_joined_channel— who may never have installed the app.authorize()/fetchInstallation()then look up an installation keyed on the wrong user, which breaks apps with multiple user-token installations per team: the installation store cannot know which installation the event was actually delivered for.The envelope's
authorizationsarray names the installing user the event was delivered for, andbuildSourcealready prefers it forteamIdandenterpriseId(the asymmetry called out in the issue) —userIdwas the odd one out. This PR applies the same pattern: preferauthorizations[0].user_id, falling back to the existing event-field extraction when the array is absent (URL-verification and other non-enveloped shapes are unaffected).Behavior notes:
authorizations[0].user_idis the installing user, which is what a single-installauthorizekeys on (team/enterprise), and the built-in authorize ignoresuserIdentirely.authorizationsis missing.Tests: new
test/unit/App/build-source.spec.tscovers both paths — authorizations present (installer id wins overevent.user) and absent (event.userfallback unchanged). Full run: 479 passing;npm run build,npm run lint(biome), andnpm run test:types(tsd) all clean.Requirements