Skip to content

fix(slack): stop requesting unapproved OAuth scopes that break connect #5631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheodoreSpeaks merged 1 commit into from
Jul 13, 2026
Merged

fix(slack): stop requesting unapproved OAuth scopes that break connect #5631

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions apps/sim/lib/oauth/oauth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -735,9 +735,12 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
'groups:write',
'chat:write',
'chat:write.public',
'assistant:write',
'app_mentions:read',
'im:history',
// TODO: Re-add once Slack app review approves these. Requesting a scope
// the app is not yet approved for makes Slack reject the entire
// authorization with "unapproved permissions requested", breaking connect.
// 'assistant:write',

@greptile-apps greptile-apps Bot Jul 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Assistant Tokens Lose Required Scope

When a user connects Slack after this change, the issued token no longer includes assistant:write, but the Slack block still exposes set_status, set_title, and set_suggested_prompts. Those operations call Slack assistant.threads.* APIs, so newly connected workflows can pass OAuth and then fail at runtime with missing_scope.

@TheodoreSpeaks TheodoreSpeaks Jul 13, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is correct, our native slack app doesn't have permissions.

// 'app_mentions:read',
// 'im:history',

@greptile-apps greptile-apps Bot Jul 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 DM History Tokens Lose Scope

New Slack connections no longer request im:history, while the Slack history and thread tools still accept DM channel IDs and call conversations.history or conversations.replies. Workflows that read DM history or DM thread replies can now connect successfully but fail during execution with Slack's missing_scope response.

@TheodoreSpeaks TheodoreSpeaks Jul 13, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is correct, our current oauth app does not have permissions.

'im:write',
'im:read',
'users:read',
Expand All @@ -748,7 +751,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
'canvases:write',
'reactions:write',
'reactions:read',
'pins:read',
// TODO: Add 'pins:read' once Slack app review is approved
],
},
},
Expand Down
Loading