') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(slack): declare files:write and handle deauthorization events by KrisBraun · Pull Request #276 · plotday/plot · GitHub
Skip to content

fix(slack): declare files:write and handle deauthorization events - #276

Merged
KrisBraun merged 1 commit into
mainfrom
slack-marketplace-review
Jul 9, 2026
Merged

fix(slack): declare files:write and handle deauthorization events#276
KrisBraun merged 1 commit into
mainfrom
slack-marketplace-review

Conversation

@KrisBraun

@KrisBraunKrisBraun commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

What

Three fixes to the Slack connector, surfaced while reviewing it against the Slack Marketplace app guidelines.

files:write scope was missing

Both Slack link types advertise supportsFileAttachments, and onNoteCreated uploads attachments via files.getUploadURLExternal / files.completeUploadExternal — but files:write was never in the connector's declared scopes. So attachment uploads failed with missing_scope and the file was silently dropped (the text of the message still sent). This declares the scope.

Note: existing connections must reconnect to grant the new scope. The upload path already degrades gracefully (logs and continues) when the scope is absent.

Deauthorization events were ignored

onSlackWebhook now handles app_uninstalled (workspace admin removes the app) and tokens_revoked (a user revokes their token from Slack). Both flag the affected connection for re-authentication immediately, instead of the connection only discovering the dead token lazily on its next API call.

tokens_revoked fans out to every callback registered for the workspace, so it is gated on the connection's own Slack user id — a teammate revoking their token never tears down another user's still-valid connection.

Delivery requires enabling app_uninstalled / tokens_revoked in the Slack app's Event Subscriptions.

Scope JSDoc was stale

The class doc comment listing scopes had drifted from the authoritative SCOPES array (missing im:write, mpim:write, reactions:read/reactions:write). Updated to match, with a one-line justification per scope.

Testing

  • tsc + build clean.
  • Added onSlackWebhook deauthorization tests (app_uninstalled, own-user tokens_revoked, and the teammate-revoke no-op). Full connector suite passes (31 tests).

🤖 Generated with Claude Code

@KrisBraun@claude
fix(slack): declare files:write and handle deauthorization events
eca528c
Declare the `files:write` user scope. Both link types advertise
`supportsFileAttachments` and onNoteCreated uploads attachments via
files.getUploadURLExternal / files.completeUploadExternal, but the scope was
never declared — so those uploads failed with `missing_scope` and the
attachment was silently dropped (the text message still sent). Existing
connections must reconnect to grant the scope; the upload path already degrades
gracefully when it is absent.
Handle Slack `app_uninstalled` and `tokens_revoked` events in onSlackWebhook by
flagging the connection for re-authentication, so a workspace uninstall or a
user revoking their token from Slack is reflected right away instead of only on
the next failing API call. `tokens_revoked` is gated on the connection's own
Slack user id, so an event that fans out to every callback for the team never
tears down other users who are still connected. Delivery requires enabling
these events in the Slack app's Event Subscriptions.
Correct the class JSDoc scope list to match the authoritative SCOPES array
(it had omitted im:write, mpim:write, and reactions:read/write) and add a
one-line justification per scope.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@KrisBraun
KrisBraun merged commit 4f86c3c into mainJul 9, 2026
1 check passed
@KrisBraun
KrisBraun deleted the slack-marketplace-review branch July 9, 2026 03:11
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KrisBraun