fix(slack): harden native webhook configuration

[waleedlatif1]

Summary

• require native Slack webhook requests and verification challenges to pass signature verification
• prevent native Slack trigger deployment when the signing secret is unavailable without affecting custom bots or outbound OAuth
• fail closed for malformed legacy Slack webhook registrations that lack their required signing secret
• align self-hosted setup diagnostics with runtime handling of empty secrets and document Slack's approval-gated scopes

Type of Change

• Bug fix

Testing

• 220 targeted Vitest tests
• bun run lint
• bun run check:audits
• bun run docs-manifest:check
• app, docs, and setup type-checks
• selector boundary validation

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 7, 2026 7:56pm UTC

[greptile-apps]

Greptile Summary

This PR hardens native Slack webhook configuration and authentication while preserving custom-bot and outbound OAuth behavior.

• Verifies Slack signatures before handling URL-verification challenges or dispatching native events.
• Prevents native Slack trigger deployment when the signing secret is absent or empty.
• Makes legacy Slack webhook registrations without signing secrets fail closed.
• Aligns self-hosted diagnostics and documentation with runtime configuration requirements.

Confidence Score: 5/5

The PR appears safe to merge; the webhook authentication and configuration guards are consistently applied and covered by targeted tests.

No actionable new defects remain. The previous setup-diagnostic finding was fixed by naming both extended-scope flags in the remediation and was manually resolved after waleedlatif1 confirmed the change.

Important Files Changed

Filename	Overview
apps/sim/app/api/webhooks/slack/route.ts	Moves native Slack signing-secret and signature checks ahead of challenge handling and event dispatch.
apps/sim/lib/webhooks/deploy.ts	Rejects native Sim-app trigger deployment without a signing secret while leaving custom-bot resolution unaffected.
apps/sim/lib/webhooks/providers/slack.ts	Makes malformed legacy Slack registrations without signing secrets fail closed.
apps/sim/lib/webhooks/slack-native-config.ts	Centralizes normalization of the native Slack signing secret, treating empty and whitespace-only values as unconfigured.
packages/sim-setup/src/checks.ts	Adds configuration coherence diagnostics and complete remediation guidance for native Slack trigger flags.
apps/docs/content/docs/platform/self-hosting/integrations-oauth.mdx	Documents native Slack configuration requirements, approval-gated scopes, and outbound-only OAuth behavior.

Sequence Diagram

sequenceDiagram
  participant Slack
  participant Route as Native Slack webhook route
  participant Config as Slack native configuration
  participant Verify as Signature verifier
  participant Dispatch as Webhook dispatcher

  Slack->>Route: POST raw request
  Route->>Config: Read and trim signing secret
  alt Secret missing or empty
    Route-->>Slack: 500 Slack app not configured
  else Secret configured
    Route->>Verify: Verify timestamp, signature, and raw body
    alt Signature invalid
      Verify-->>Slack: 401 Unauthorized
    else Signature valid
      alt URL verification challenge
        Route-->>Slack: Signed challenge response
      else Slack event
        Route->>Dispatch: Resolve and dispatch webhook
        Dispatch-->>Slack: Dispatch response
      end
    end
  end

Loading

_{Reviews (5): Last reviewed commit: "fix(slack): align setup checks with runt..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}