fix(sim-search): keep Slack searchable when it is the only source, and tell a member to reconnect

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx

@@ -226,28 +226,28 @@ export function KnowledgeSearchResults({
   }, [documents, filtersActive, filters.source, filters.updated])
 
   const failure = basesError ?? error
-  if (failure) {
-    return <p className='px-2 py-2 text-[var(--text-error)] text-caption'>{failure.message}</p>
-  }
-  if (!basesPending && knowledgeBaseIds.length === 0) {
-    return (
-      <p className='px-2 py-2 text-[var(--text-muted)] text-caption'>
-        Nothing to search yet. Clear the query and connect a source to index what you can open.
-      </p>
-    )
-  }
-  /** Kept results belong to the previous query; a new query shows its own state. */
-  if (isPending || isPlaceholderData || (isFetching && !results)) {
-    return <p className='px-2 py-2 text-[var(--text-muted)] text-caption'>Searching…</p>
-  }
-
   const indexingNote =
     indexing.length > 0
       ? `Still indexing ${indexing.join(', ')}; results grow as documents land.`
       : null
 
-  return (
-    <div className='flex flex-col'>
+  /**
+   * The indexed half of the page, in whatever state it is in. It is a branch
+   * rather than an early return because a federated source is searched even
+   * where there is nothing indexed at all — a workspace whose only source is
+   * Slack has no knowledge base, and its failures are not Slack's.
+   */
+  const knowledgeSection = failure ? (
+    <p className='px-2 py-2 text-[var(--text-error)] text-caption'>{failure.message}</p>
+  ) : !basesPending && knowledgeBaseIds.length === 0 ? (
+    <p className='px-2 py-2 text-[var(--text-muted)] text-caption'>
+      No indexed sources yet. Connect one to index what you can open.
+    </p>
+  ) : /** Kept results belong to the previous query; a new query shows its own state. */
+  isPending || isPlaceholderData || (isFetching && !results) ? (
+    <p className='px-2 py-2 text-[var(--text-muted)] text-caption'>Searching…</p>
+  ) : (
+    <>
       <div className='flex items-center gap-2 px-2 py-2'>
         <span className='min-w-0 flex-1 text-[var(--text-muted)] text-caption'>
           <span className='tabular-nums'>
@@ -299,7 +299,7 @@ export function KnowledgeSearchResults({
             : 'No documents match these filters.'}
         </p>
       ) : (
-        <div className='flex flex-col' onKeyDown={handleResultsKeyDown}>
+        <div className='flex flex-col'>
           {visible.map((result) => {
             const source = toSource(result, query)
             return source ? (
@@ -317,6 +317,13 @@ export function KnowledgeSearchResults({
           })}
         </div>
       )}
+    </>
+  )
+
+  /** One keyboard container over both groups, so the arrows walk every result. */
+  return (
+    <div className='flex flex-col' onKeyDown={handleResultsKeyDown}>
+      {knowledgeSection}
       <SlackSearchResults workspaceId={workspaceId} query={query} onSummarize={onSummarize} />
     </div>
   )

apps/sim/hooks/queries/kb/knowledge.ts

@@ -54,6 +54,7 @@ import {
   type WorkspaceKnowledgeSearchBody,
   type WorkspaceKnowledgeSearchResult,
 } from '@/lib/api/contracts/knowledge'
+import { useSession } from '@/lib/auth/auth-client'
 import type { ChunkingStrategy, StrategyOptions } from '@/lib/chunkers/types'
 import type { DocumentSortField, SortOrder } from '@/lib/knowledge/documents/types'
 import { folderKeys } from '@/hooks/queries/utils/folder-keys'
@@ -1212,11 +1213,14 @@ async function searchSlack(body: SearchSimSearchSlackBody, signal?: AbortSignal)
  */
 export function useSimSearchSlack(workspaceId: string | undefined, query: string) {
   const trimmed = query.trim()
+  const { data: session } = useSession()
+  const viewerId = session?.user?.id
   return useQuery({
-    queryKey: knowledgeKeys.slackSearch(workspaceId, trimmed),
+    queryKey: knowledgeKeys.slackSearch(workspaceId, viewerId, trimmed),
     queryFn: ({ signal }) =>
       searchSlack({ workspaceId: workspaceId as string, query: trimmed }, signal),
-    enabled: Boolean(workspaceId) && trimmed.length > 0,
+    /** Held until the viewer is known, so no answer is ever cached under an empty identity. */
+    enabled: Boolean(workspaceId) && Boolean(viewerId) && trimmed.length > 0,
     staleTime: SIM_SEARCH_SLACK_STALE_TIME,
     placeholderData: keepPreviousData,
   })

apps/sim/hooks/queries/utils/knowledge-keys.ts

@@ -32,8 +32,13 @@ export const knowledgeKeys = {
     [...knowledgeKeys.details(), knowledgeBaseId ?? ''] as const,
   searches: () => [...knowledgeKeys.all, 'search'] as const,
   slackSearches: () => [...knowledgeKeys.all, 'slackSearch'] as const,
-  slackSearch: (workspaceId: string | undefined, query: string) =>
-    [...knowledgeKeys.slackSearches(), workspaceId ?? '', query] as const,
+  /**
+   * Keyed by viewer as well as workspace: the answer is one person's own Slack,
+   * including their direct messages, so a session change in an open tab must
+   * never be served another person's cached results.
+   */
+  slackSearch: (workspaceId: string | undefined, userId: string | undefined, query: string) =>
+    [...knowledgeKeys.slackSearches(), workspaceId ?? '', userId ?? '', query] as const,
   search: (workspaceId: string | undefined, knowledgeBaseIds: readonly string[], query: string) =>
     [
       ...knowledgeKeys.searches(),

apps/sim/lib/slack-search/client.test.ts

@@ -133,8 +133,12 @@ describe('searchSlack', () => {
     )
   })
 
-  it('raises for a transport failure', async () => {
-    fetchMock.mockResolvedValue(new Response('nope', { status: 429 }))
+  it('raises for a transport failure, releasing the unread body', async () => {
+    const response = new Response('nope', { status: 429 })
+    const cancel = vi.spyOn(response.body as ReadableStream, 'cancel')
+    fetchMock.mockResolvedValue(response)
+
     await expect(searchSlack({ accessToken: 'token', query: 'deploy' })).rejects.toThrow('http_429')
+    expect(cancel).toHaveBeenCalled()
   })
 })

apps/sim/lib/slack-search/client.ts

@@ -153,6 +153,8 @@ export async function searchSlack({
   })
 
   if (!response.ok) {
+    /** Nothing here reads the body, and an uncancelled one holds the connection open. */
+    await response.body?.cancel().catch(() => {})
     throw new SlackSearchError(`http_${response.status}`)
   }
 

apps/sim/lib/slack-search/credentials.ts

@@ -8,11 +8,17 @@ import { getCredentialGroupProviderId } from '@/lib/credential-groups/providers'
  * The Slack account a federated search runs as: the asking person's own,
  * enrolled through a Credential Group in this workspace.
  *
- * The joins mirror the knowledge access scope exactly — verified email, live
- * enrollment, active group, active managed credential, active option — because
- * both answer the same question about the same rows, and a search that used a
- * looser rule than the one governing document access would be the odd one out.
- * Nothing is cached: revoking a credential takes effect on the next search.
+ * Deliberately does not filter on `managedOauthStatus`. A credential that needs
+ * authorizing again is still a connection the person made, and the difference
+ * between "you never connected Slack" and "reconnect Slack" is the whole of
+ * what the surface can tell them to do. Excluding it here would collapse the
+ * second into the first — which is exactly what a scope-policy change does to
+ * every enrolled credential at once. `resolveManagedOAuthToken` classifies it,
+ * and an active credential is preferred when a person somehow holds several.
+ *
+ * The group must belong to this workspace as well as the credential: the two
+ * are set together today, and requiring both keeps a workspace's search inside
+ * its own groups even if they ever diverge.
  */
 export async function findViewerSlackCredentialId(params: {
   workspaceId: string
@@ -35,6 +41,7 @@ export async function findViewerSlackCredentialId(params: {
       credentialGroup,
       and(
         eq(credentialGroup.id, credentialGroupEnrollment.credentialGroupId),
+        eq(credentialGroup.workspaceId, params.workspaceId),
         eq(credentialGroup.status, 'active')
       )
     )
@@ -44,7 +51,6 @@ export async function findViewerSlackCredentialId(params: {
         eq(credential.credentialGroupEnrollmentId, credentialGroupEnrollment.id),
         eq(credential.workspaceId, params.workspaceId),
         eq(credential.type, 'managed_oauth'),
-        eq(credential.managedOauthStatus, 'active'),
         eq(credential.providerId, getCredentialGroupProviderId('slack')),
         sql`EXISTS (
           SELECT 1 FROM jsonb_array_elements(${credentialGroup.options}) AS option
@@ -54,6 +60,7 @@ export async function findViewerSlackCredentialId(params: {
       )
     )
     .where(and(eq(user.id, params.userId), eq(user.emailVerified, true)))
+    .orderBy(sql`CASE WHEN ${credential.managedOauthStatus} = 'active' THEN 0 ELSE 1 END`)
     .limit(1)
 
   return row?.credentialId ?? null

apps/sim/lib/slack-search/search.test.ts

@@ -95,4 +95,10 @@ describe('searchSlackForViewer', () => {
     mocks.resolveManagedOAuthToken.mockRejectedValue(new Error('pool exhausted'))
     await expect(searchSlackForViewer(params)).resolves.toEqual({ status: 'unavailable' })
   })
+
+  it('absorbs a failure looking the credential up at all', async () => {
+    mocks.findViewerSlackCredentialId.mockRejectedValue(new Error('connection terminated'))
+    await expect(searchSlackForViewer(params)).resolves.toEqual({ status: 'unavailable' })
+    expect(mocks.searchSlack).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/slack-search/search.ts

@@ -69,10 +69,18 @@ export interface SearchSlackForViewerParams {
 export async function searchSlackForViewer(
   params: SearchSlackForViewerParams
 ): Promise<SlackSearchOutcome> {
-  const credentialId = await findViewerSlackCredentialId({
-    workspaceId: params.workspaceId,
-    userId: params.userId,
-  })
+  let credentialId: string | null
+  try {
+    credentialId = await findViewerSlackCredentialId({
+      workspaceId: params.workspaceId,
+      userId: params.userId,
+    })
+  } catch (error) {
+    logger.error('Failed to look up a Slack search credential', {
+      error: getErrorMessage(error),
+    })
+    return { status: 'unavailable' }
+  }
   if (!credentialId) return { status: 'not_connected' }
 
   let accessToken: string