improvement(slack): simplify Home to a persistent connect link

Author: TheodoreSpeaks

apps/sim/lib/knowledge/application/authorized-knowledge-use-case.ts

@@ -21,10 +21,11 @@ import type { ScopedKnowledgeOperation } from '@/lib/knowledge/application/opera
 
 type KnowledgePrincipalForOperation<O extends ScopedKnowledgeOperation> =
   | PrincipalForOperation<O>
-  | Extract<
-      OrganizationDelegatedPrincipal,
-      { serviceId: NonNullable<O['organizationOperation']['delegatedServices']>[number] }
-    >
+  | ('copilot' extends NonNullable<O['delegatedServices']>[number]
+      ? O['minimumRole'] extends 'read'
+        ? OrganizationDelegatedPrincipal
+        : never
+      : never)
 
 function requireKnowledgePrincipal<O extends ScopedKnowledgeOperation>(
   principal: Principal,

apps/sim/lib/knowledge/application/operations.test.ts

@@ -7,15 +7,11 @@ import { describe, expect, it } from 'vitest'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 
 describe('knowledge operation registry', () => {
-  it('limits Slack member delegation to search and the personalized source list', () => {
+  it('limits Slack member delegation to the existing search operation', () => {
     const allowed = Object.values(knowledgeOperations).filter((operation) =>
       operation.organizationOperation.delegatedServices?.includes('slack-search')
     )
-    expect(allowed).toEqual([knowledgeOperations.search, knowledgeOperations.listSearchSources])
-    expect(knowledgeOperations.listSearchSources.organizationOperation.delegatedServices).toEqual([
-      'slack-search',
-    ])
-    expect(knowledgeOperations.listSearchSources.principalKinds).toEqual(['session'])
+    expect(allowed).toEqual([knowledgeOperations.search])
   })
   it('defines unique stable semantic operation IDs', () => {
     const ids = Object.values(knowledgeOperations).map((operation) => operation.id)
@@ -148,13 +144,12 @@ describe('knowledge operation registry', () => {
     }
   })
 
-  it('permits organization delegation only for explicitly delegated reads', () => {
+  it('permits organization delegation only for Copilot reads', () => {
     for (const operation of Object.values(knowledgeOperations)) {
       if (!operation.organizationOperation.principalKinds.includes('organization_delegated'))
         continue
       expect(operation.minimumRole).toBe('read')
-      if (operation !== knowledgeOperations.listSearchSources)
-        expect(operation.delegatedServices).toContain('copilot')
+      expect(operation.delegatedServices).toContain('copilot')
       expect(operation.organizationOperation.delegationAudience).toBe('sim:knowledge')
     }
     expect(knowledgeOperations.search.organizationOperation.principalKinds).toContain(

apps/sim/lib/knowledge/application/operations.ts

@@ -1,4 +1,3 @@
-import type { OrganizationDelegatedPrincipal } from '@sim/auth/principal'
 import {
   type ApplicationOperation,
   assertOperationCapability,
@@ -16,47 +15,19 @@ export type ScopedKnowledgeOperation<O extends WorkspaceOperation = WorkspaceOpe
   readonly organizationOperation: OrganizationOperation
 }
 
-interface KnowledgeOperationOptions<
-  Services extends readonly OrganizationDelegatedPrincipal['serviceId'][],
-> {
+interface KnowledgeOperationOptions {
   organizationDelegation?: 'deny'
-  organizationDelegatedServices?: Services
-}
-
-type DelegatingKnowledgeOperation<
-  O extends WorkspaceOperation,
-  Services extends readonly OrganizationDelegatedPrincipal['serviceId'][],
-> = ScopedKnowledgeOperation<O> & {
-  readonly organizationOperation: {
-    readonly delegatedServices?: readonly (
-      | Services[number]
-      | ('copilot' extends NonNullable<O['delegatedServices']>[number]
-          ? O['minimumRole'] extends 'read'
-            ? OrganizationDelegatedPrincipal['serviceId']
-            : never
-          : never)
-    )[]
-  }
 }
 
 /** Binds organization policy to the same semantic operation declared for workspace access. */
-function defineKnowledgeOperation<
-  const O extends WorkspaceOperation,
-  const Services extends readonly OrganizationDelegatedPrincipal['serviceId'][] = readonly [],
->(
+function defineKnowledgeOperation<const O extends WorkspaceOperation>(
   operation: O,
-  options?: KnowledgeOperationOptions<Services>
-): DelegatingKnowledgeOperation<O, Services> {
-  if (
-    options?.organizationDelegatedServices?.length &&
-    (operation.minimumRole !== 'read' || options.organizationDelegation === 'deny')
-  )
-    throw new Error(`Operation ${operation.id} cannot delegate organization writes`)
+  options?: KnowledgeOperationOptions
+): ScopedKnowledgeOperation<O> {
   const supportsOrganizationDelegation =
     options?.organizationDelegation !== 'deny' &&
     operation.minimumRole === 'read' &&
-    (operation.delegatedServices?.includes('copilot') ||
-      Boolean(options?.organizationDelegatedServices?.length))
+    operation.delegatedServices?.includes('copilot')
   const organizationOperation = defineOrganizationOperation({
     id: operation.id,
     capability: operation.capability,
@@ -73,15 +44,11 @@ function defineKnowledgeOperation<
           ],
           delegationAudience: 'sim:knowledge',
           delegatedServices:
-            options?.organizationDelegatedServices ??
-            (operation.id === 'knowledge.search' ? ['copilot', 'slack-search'] : ['copilot']),
+            operation.id === 'knowledge.search' ? ['copilot', 'slack-search'] : ['copilot'],
         } as const)
       : ({ principalKinds: ['session', 'personal_api_key', 'oauth_access_token'] } as const)),
   })
-  return Object.freeze({ ...operation, organizationOperation }) as DelegatingKnowledgeOperation<
-    O,
-    Services
-  >
+  return Object.freeze({ ...operation, organizationOperation })
 }
 
 const ALL_PRINCIPAL_POLICY = {
@@ -714,8 +681,7 @@ export const knowledgeOperations = {
       workspaceApiKey: 'deny',
       capability: 'knowledge.use',
       principalKinds: ['session'],
-    }),
-    { organizationDelegatedServices: ['slack-search'] }
+    })
   ),
   readSearchSourceOverview: defineKnowledgeOperation(
     defineWorkspaceOperation({

apps/sim/lib/knowledge/application/search-sources.test.ts

@@ -68,7 +68,6 @@ import {
 import { readSearchSourceOverview } from '@/lib/knowledge/application/search-source-overview'
 import { readSearchSourceProgress } from '@/lib/knowledge/application/search-source-progress'
 import { listSearchSources } from '@/lib/knowledge/application/search-sources'
-import { slackSearchMemberPrincipal } from '@/lib/knowledge/application/slack-search/member-principal'
 
 const principal = { kind: 'session' as const, userId: 'reader', sessionId: 'session' }
 const input = { workspaceId: 'workspace' }
@@ -372,72 +371,6 @@ describe('Search source summaries', () => {
 })
 
 describe('organization Search source summaries', () => {
-  function slackPrincipal() {
-    return slackSearchMemberPrincipal(
-      { installationId: 'i1', message: { eventId: 'Ev1' } },
-      'org-1',
-      'reader'
-    )
-  }
-  it('uses the Slack member’s ACL and includes their expired connection for Home', async () => {
-    const delegated = slackPrincipal()
-    mocks.context.mockResolvedValue({ organizationId: 'org-1' })
-    queueTableRows(member, [{ role: 'member' }])
-    mocks.memberships.mockResolvedValue(new Map([['drive', 'needs_reauth']]))
-    seed([source('drive', 'google_drive', 'members')])
-    const result = await listSearchSources.execute({
-      principal: delegated,
-      input: { organizationId: 'org-1' },
-    })
-    expect(result.sources[0]).toMatchObject({
-      viewerMembership: 'needs_reauth',
-      connectionRequired: true,
-    })
-    expect(mocks.access).toHaveBeenCalledWith(delegated, { organizationId: 'org-1' })
-    expect(mocks.memberships).toHaveBeenCalledWith(
-      expect.objectContaining({ userId: 'reader', organizationId: 'org-1' })
-    )
-  })
-  it('refuses Slack delegation into another organization', async () => {
-    mocks.context.mockResolvedValue({ organizationId: 'org-2' })
-    await expect(
-      listSearchSources.execute({ principal: slackPrincipal(), input: { organizationId: 'org-2' } })
-    ).rejects.toThrow('delegation')
-    expect(mocks.memberships).not.toHaveBeenCalled()
-  })
-  it('rechecks Slack membership and delegation expiry before listing sources', async () => {
-    mocks.context.mockResolvedValue({ organizationId: 'org-1' })
-    queueTableRows(member, [])
-    await expect(
-      listSearchSources.execute({ principal: slackPrincipal(), input: { organizationId: 'org-1' } })
-    ).rejects.toThrow('Organization not found')
-    await expect(
-      listSearchSources.execute({
-        principal: { ...slackPrincipal(), expiresAt: new Date(0) },
-        input: { organizationId: 'org-1' },
-      })
-    ).rejects.toThrow('delegation')
-    expect(mocks.memberships).not.toHaveBeenCalled()
-  })
-  it('does not make the source list available to Copilot or Slack installation authority', async () => {
-    await expect(
-      listSearchSources.execute({
-        principal: {
-          kind: 'organization_delegated',
-          serviceId: 'copilot',
-          organizationId: 'org-1',
-          subjectUserId: 'reader',
-          delegationId: 'd1',
-          audience: 'sim:knowledge',
-          issuedAt: new Date(),
-          expiresAt: new Date(Date.now() + 60_000),
-          resourceScope: { chatId: 'chat1' },
-        },
-        input: { organizationId: 'org-1' },
-      })
-    ).rejects.toThrow('delegation')
-    expect(mocks.context).not.toHaveBeenCalled()
-  })
   it.each(['member', 'admin'])(
     'returns only the current %s viewer ACL counts without a workspace membership',
     async (role) => {

apps/sim/lib/knowledge/application/search-sources.ts

@@ -1,4 +1,3 @@
-import { requirePrincipalSubjectUserId } from '@sim/auth/principal'
 import { db } from '@sim/db'
 import { document, embedding, knowledgeBase, knowledgeConnector, user } from '@sim/db/schema'
 import { and, desc, eq, exists, inArray, isNull, lt, or, sql } from 'drizzle-orm'
@@ -38,13 +37,12 @@ export const listSearchSources = defineAuthorizedKnowledgeUseCase({
   resolveContext: ({ input }: { input: ListSearchSourcesInput }) =>
     resolveKnowledgeOwnerContext(input),
   async execute({ principal, input, context }) {
-    const userId = requirePrincipalSubjectUserId(principal)
     const search = input.search?.trim().toLowerCase() ?? ''
     const connectorType = input.connectorType?.trim()
     const cursorScope = cursorScopeKey(cursorRoute(listSearchSourcesContract), {
       workspaceId: context.workspaceId,
       organizationId: context.organizationId,
-      userId,
+      userId: principal.userId,
       search,
       connectorType: connectorType ?? '',
       mine: input.mine === true,
@@ -111,15 +109,15 @@ export const listSearchSources = defineAuthorizedKnowledgeUseCase({
     const [availability, memberships, viewers, access, approvals] = await Promise.all([
       resolveKnowledgeAccessAvailability(context),
       resolveViewerConnectorMemberships({
-        userId,
+        userId: principal.userId,
         workspaceId: context.workspaceId,
         organizationId: context.organizationId,
         connectors: scanned,
       }),
       db
         .select({ emailVerified: user.emailVerified })
         .from(user)
-        .where(eq(user.id, userId))
+        .where(eq(user.id, principal.userId))
         .limit(1),
       createKnowledgeAccessProvider(principal, context).get(),
       context.organizationId ? listOrganizationSearchApprovals(context.organizationId) : null,

apps/sim/lib/knowledge/application/slack-search/assistant.ts

@@ -1,4 +1,7 @@
-import type { SlackInstallationPrincipal } from '@sim/auth/principal'
+import type {
+  OrganizationDelegatedPrincipal,
+  SlackInstallationPrincipal,
+} from '@sim/auth/principal'
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
@@ -38,7 +41,6 @@ import {
   resolveSlackSearchMember,
   SlackSearchIdentityError,
 } from '@/lib/knowledge/application/slack-search/identity'
-import { slackSearchMemberPrincipal } from '@/lib/knowledge/application/slack-search/member-principal'
 import { sendSlackSearchOnboarding } from '@/lib/knowledge/application/slack-search/onboarding'
 import { recordSlackSearchOutcome } from '@/lib/knowledge/application/slack-search/repository'
 import { getSlackSearchSourceStatus } from '@/lib/knowledge/application/slack-search/source-status'
@@ -58,6 +60,26 @@ import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secr
 
 const logger = createLogger('SlackSearchAssistant')
 
+/** Creates narrowly scoped, short-lived authority for the current verified Slack sender. */
+export function slackSearchMemberPrincipal(
+  job: SlackSearchJob,
+  organizationId: string,
+  userId: string
+): OrganizationDelegatedPrincipal {
+  const issuedAt = new Date()
+  return {
+    kind: 'organization_delegated',
+    serviceId: 'slack-search',
+    organizationId,
+    subjectUserId: userId,
+    delegationId: `${job.installationId}:${job.message.eventId}`,
+    audience: 'sim:knowledge',
+    issuedAt,
+    expiresAt: new Date(issuedAt.getTime() + 60_000),
+    resourceScope: { installationId: job.installationId, eventId: job.message.eventId },
+  }
+}
+
 /** Runs the product's organization Assistant with its ordinary tools, chat lock, billing, and persistence. */
 export async function runSlackSearchAssistant(
   principal: SlackInstallationPrincipal,