fix(slack): surface selector authentication failures

Author: Bill Leoutsakos

apps/sim/app/api/tools/slack/server-resolved-selectors.test.ts

@@ -218,4 +218,38 @@ describe('server-resolved Slack selectors', () => {
       users: [{ id: 'U111', name: 'bill', real_name: 'Bill' }],
     })
   })
+
+  it.each([
+    [
+      'stored credential',
+      {
+        ok: true,
+        accessToken: 'xoxb-stored',
+        isBotToken: false,
+        credentialAccess: { credentialType: 'oauth' },
+      },
+      { error: 'Slack authentication failed', authRequired: true },
+    ],
+    [
+      'direct token',
+      { ok: true, accessToken: 'xoxb-direct', isBotToken: true },
+      { error: 'Slack authentication failed' },
+    ],
+  ])('sanitizes invalid_auth for a %s', async (_name, credentialResult, expectedBody) => {
+    mocks.resolveSlackCredential.mockResolvedValue(credentialResult)
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue(Response.json({ ok: false, error: 'invalid_auth' }))
+    )
+
+    const response = await listUsers(
+      request('/api/tools/slack/users', {
+        credential: 'credential-or-token',
+        workflowId: 'workflow-1',
+      })
+    )
+
+    expect(response.status).toBe(401)
+    expect(await response.json()).toEqual(expectedBody)
+  })
 })

apps/sim/app/api/tools/slack/users/route.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { slackUsersListOrDetailContract } from '@/lib/api/contracts/selectors/slack'
 import { parseRequest } from '@/lib/api/server'
@@ -29,6 +30,9 @@ interface SlackUsersResult {
 }
 
 export const POST = withRouteHandler(async (request: NextRequest) => {
+  let providerRequestStarted = false
+  let reauthorizationAvailable = false
+
   try {
     const requestId = generateRequestId()
     const authentication = await authenticateSelectorRequest(request)
@@ -64,7 +68,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         { status: resolvedCredential.status }
       )
     }
-    const { accessToken, isBotToken } = resolvedCredential
+    const { accessToken, isBotToken, credentialAccess } = resolvedCredential
+    reauthorizationAvailable = credentialAccess !== undefined
+    providerRequestStarted = true
 
     if (userId) {
       const userData = await fetchSlackUser(accessToken, userId)
@@ -95,7 +101,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       tokenType: isBotToken ? 'bot_token' : 'oauth',
     })
     return NextResponse.json({ users })
-  } catch {
+  } catch (error) {
+    if (providerRequestStarted && getErrorMessage(error) === 'invalid_auth') {
+      logger.warn('Slack rejected selector authentication')
+      return NextResponse.json(
+        {
+          error: 'Slack authentication failed',
+          ...(reauthorizationAvailable ? { authRequired: true } : {}),
+        },
+        { status: 401 }
+      )
+    }
     logger.error('Error processing Slack users request')
     return NextResponse.json({ error: 'Failed to retrieve Slack users' }, { status: 500 })
   }