feat(slack): launch v2 triggers and backfill custom bots

Author: TheodoreSpeaks

apps/docs/components/ui/icon-mapping.ts

@@ -507,6 +507,8 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   similarweb: SimilarwebIcon,
   sixtyfour: SixtyfourIcon,
   slack: SlackIcon,
+  slack_app: SlackIcon,
+  slack_v2: SlackIcon,
   smartlead: SmartleadIcon,
   smtp: SmtpIcon,
   snowflake: SnowflakeIcon,

apps/docs/content/docs/en/integrations/slack.mdx

@@ -6,7 +6,7 @@ description: Send, update, delete messages, manage views and modals, add or remo
 import { BlockInfoCard } from "@/components/ui/block-info-card"
 
 <BlockInfoCard 
-  type="slack"
+  type="slack_v2"
   color="#611f69"
 />
 
@@ -1872,18 +1872,27 @@ Set the purpose (description) for a Slack channel (max 250 characters).
 
 A **Trigger** is a block that starts a workflow when an event happens in this service.
 
-### Slack Webhook
+### Slack
 
-Trigger workflow from Slack events like mentions, messages, and reactions
+Trigger from Slack events (mentions, messages, reactions)
 
 #### Configuration
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `signingSecret` | string | Yes | The signing secret from your Slack app to validate request authenticity. |
-| `botToken` | string | No | The bot token from your Slack app. Required for downloading files attached to messages. |
-| `includeFiles` | boolean | No | Download and include file attachments from messages. Requires a bot token with files:read scope. |
-| `setupWizard` | modal | No | Walk through manifest creation, app install, and pasting credentials. |
+| `eventType` | string | Yes | The single Slack event this trigger fires on. Add another trigger block for another event. |
+| `customBotCredential` | string | Yes | Choose a custom Slack bot you set up once and reuse across triggers. |
+| `manualBotCredential` | string | Yes | Set the custom bot credential ID directly. |
+| `source` | string | No | Restrict to direct messages, public channels, or private channels. Leave empty to match any. |
+| `channelFilter` | channel-selector | No | Restrict to specific channels. Leave empty to trigger on any channel the bot has been added to. |
+| `manualChannelFilter` | string | No | Comma-separated channel IDs to restrict to. Set IDs directly here. |
+| `threads` | string | No | Include thread replies, exclude them \(top-level only\), or fire only on thread replies. |
+| `emoji` | string | No | Comma-separated emoji names to restrict to. Leave empty to match any emoji. |
+| `nameContains` | string | No | Only fire when the created channel name contains this text. |
+| `interactionFilter` | string | No | Comma-separated action_ids \(buttons/selects\) or callback_ids \(modals\) to restrict to. Leave empty to fire on any interaction. |
+| `filterBotMessages` | boolean | No | Ignore messages sent by other bots. This app's own output is always ignored. |
+| `includeOwnMessages` | boolean | No | Also fire on this app's own messages and reactions. Can cause loops — use with care. |
+| `includeFiles` | boolean | No | Download and include file attachments from messages. Requires files:read. |
 
 #### Output
 

apps/docs/content/docs/en/platform/self-hosting/integrations-oauth.mdx

@@ -185,7 +185,7 @@ Webhook triggers receive callbacks from the provider and must be able to verify
 | Variable | Needed for |
 |---|---|
 | `SLACK_SIGNING_SECRET` | Verifying Slack event and slash-command signatures |
-| `SLACK_EXTENDED_SCOPES` / `NEXT_PUBLIC_SLACK_EXTENDED_SCOPES` | Requesting the broader Slack scope set |
+| `SLACK_EXTENDED_SCOPES` / `NEXT_PUBLIC_SLACK_EXTENDED_SCOPES` | Enabling the native Sim-app trigger and its broader Slack scope set; set both to the same value |
 
 Your deployment must also be reachable from the provider's servers for webhook triggers to fire — a Sim instance on a private network can use polling triggers but not webhook triggers. Polling triggers additionally require the scheduler; see [Background Jobs](/platform/self-hosting/background-jobs).
 

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -445,6 +445,23 @@ describe('OAuth Utils', () => {
       expect(result.accessToken).toBe('xoxb-tok')
     })
 
+    it('returns the bot token for an action-only Slack bot without a signing secret', async () => {
+      mockSelectChain([
+        {
+          type: 'service_account',
+          providerId: SLACK_CUSTOM_BOT_PROVIDER_ID,
+          encryptedServiceAccountKey: 'enc',
+        },
+      ])
+      mockDecryptSecret.mockResolvedValueOnce({
+        decrypted: JSON.stringify({ botToken: 'xoxb-action' }),
+      })
+
+      const result = await resolveServiceAccountToken('cred-1', SLACK_CUSTOM_BOT_PROVIDER_ID)
+
+      expect(result.accessToken).toBe('xoxb-action')
+    })
+
     it('throws when the Slack bot credential is missing', async () => {
       mockSelectChain([])
       await expect(

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.test.ts

@@ -99,6 +99,19 @@ describe('Slack custom-bot webhook route', () => {
     expect(mockDispatchResolvedWebhookTarget).not.toHaveBeenCalled()
   })
 
+  it('404s an action-only bot credential without a signing secret', async () => {
+    mockGetSlackBotCredential.mockResolvedValue({
+      botToken: 'xoxb-x',
+      teamId: 'T1',
+    })
+
+    const res = await POST(makeRequest(), context)
+
+    expect(res.status).toBe(404)
+    expect(mockVerifySignature).not.toHaveBeenCalled()
+    expect(mockFindWebhooksByRoutingKey).not.toHaveBeenCalled()
+  })
+
   it('verifies with the credential signing secret and rejects a bad signature', async () => {
     mockVerifySignature.mockReturnValue(new Response(null, { status: 401 }))
     const res = await POST(makeRequest(), context)

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.ts

@@ -1,14 +1,13 @@
-import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { getSlackBotCredential } from '@/lib/oauth/credential-service'
-import { findWebhooksByRoutingKey, parseWebhookBody } from '@/lib/webhooks/processor'
-import { handleSlackChallenge, verifySlackRequestSignature } from '@/lib/webhooks/providers/slack'
-import { dispatchSlackWebhooks } from '@/lib/webhooks/slack-dispatch'
-
-const logger = createLogger('SlackCustomBotWebhookAPI')
+import { parseWebhookBody } from '@/lib/webhooks/processor'
+import { handleSlackChallenge } from '@/lib/webhooks/providers/slack'
+import {
+  dispatchSlackCustomBotCredential,
+  verifySlackCustomBotCredentialRequest,
+} from '@/lib/webhooks/slack-custom-ingress'
 
 export const dynamic = 'force-dynamic'
 export const runtime = 'nodejs'
@@ -58,31 +57,17 @@ async function handleSlackCustomBotWebhook(
     return challenge
   }
 
-  const botCredential = await getSlackBotCredential(credentialId)
-  if (!botCredential) {
-    logger.warn(`[${requestId}] Unknown Slack bot credential ${credentialId}`)
-    return new NextResponse(null, { status: 404 })
-  }
-
-  const authError = verifySlackRequestSignature(
-    botCredential.signingSecret,
+  const authError = await verifySlackCustomBotCredentialRequest({
+    credentialId,
     request,
     rawBody,
-    requestId
-  )
+    requestId,
+  })
   if (authError) {
     return authError
   }
 
-  const webhooks = await findWebhooksByRoutingKey(credentialId, requestId, 'slack')
-  if (webhooks.length === 0) {
-    logger.info(
-      `[${requestId}] No active trigger for bot credential ${credentialId}; nothing to run`
-    )
-    return new NextResponse(null, { status: 200 })
-  }
-
-  await dispatchSlackWebhooks(webhooks, { body, request, requestId, receivedAt })
+  await dispatchSlackCustomBotCredential({ credentialId, body, request, requestId, receivedAt })
 
   return new NextResponse(null, { status: 200 })
 }

apps/sim/app/api/webhooks/trigger/[path]/route.test.ts

@@ -79,6 +79,7 @@ interface TestWebhook {
   path: string
   isActive: boolean
   providerConfig?: Record<string, unknown>
+  routingKey?: string | null
   workflowId: string
   blockId?: string
   rateLimitCount?: number
@@ -120,6 +121,9 @@ const {
   shouldSkipWebhookEventMock,
   admissionRejectedResponseMock,
   tryAdmitMock,
+  getLegacySlackCustomBotCredentialIdMock,
+  verifySlackCustomBotCredentialRequestMock,
+  dispatchSlackCustomBotCredentialMock,
 } = vi.hoisted(() => ({
   generateRequestHashMock: vi.fn().mockResolvedValue('test-hash-123'),
   validateSlackSignatureMock: vi.fn().mockResolvedValue(true),
@@ -179,13 +183,22 @@ const {
   shouldSkipWebhookEventMock: vi.fn().mockReturnValue(false),
   admissionRejectedResponseMock: vi.fn(),
   tryAdmitMock: vi.fn<() => { release: () => void } | null>(() => ({ release: vi.fn() })),
+  getLegacySlackCustomBotCredentialIdMock: vi.fn(),
+  verifySlackCustomBotCredentialRequestMock: vi.fn(),
+  dispatchSlackCustomBotCredentialMock: vi.fn(),
 }))
 
 vi.mock('@/lib/core/admission/gate', () => ({
   admissionRejectedResponse: admissionRejectedResponseMock,
   tryAdmit: tryAdmitMock,
 }))
 
+vi.mock('@/lib/webhooks/slack-custom-ingress', () => ({
+  getLegacySlackCustomBotCredentialId: getLegacySlackCustomBotCredentialIdMock,
+  verifySlackCustomBotCredentialRequest: verifySlackCustomBotCredentialRequestMock,
+  dispatchSlackCustomBotCredential: dispatchSlackCustomBotCredentialMock,
+}))
+
 vi.mock('@trigger.dev/sdk', () => ({
   tasks: {
     trigger: vi.fn().mockResolvedValue({ id: 'mock-task-id' }),
@@ -509,6 +522,14 @@ describe('Webhook Trigger API Route', () => {
     workflowsPersistenceUtilsMockFns.mockBlockExistsInDeployment.mockResolvedValue(true)
     handleWebhookEventFilterMock.mockResolvedValue(null)
     shouldSkipWebhookEventMock.mockReturnValue(false)
+    getLegacySlackCustomBotCredentialIdMock.mockImplementation((foundWebhook: TestWebhook) => {
+      const providerConfig = foundWebhook.providerConfig ?? {}
+      return providerConfig.ingressMode === 'legacy_custom_bot'
+        ? (providerConfig.credentialId as string)
+        : null
+    })
+    verifySlackCustomBotCredentialRequestMock.mockResolvedValue(null)
+    dispatchSlackCustomBotCredentialMock.mockResolvedValue(1)
 
     // Set up default workflow for tests
     testData.workflows.push({
@@ -683,6 +704,64 @@ describe('Webhook Trigger API Route', () => {
     })
   })
 
+  describe('Migrated legacy Slack paths', () => {
+    it('authenticates by custom-bot credential and replaces direct dispatch with fan-out', async () => {
+      testData.webhooks.push({
+        id: 'legacy-slack-webhook',
+        provider: 'slack',
+        path: 'legacy-slack-path',
+        routingKey: 'credential-1',
+        isActive: true,
+        providerConfig: {
+          triggerId: 'slack_webhook',
+          credentialId: 'credential-1',
+          ingressMode: 'legacy_custom_bot',
+        },
+        workflowId: 'test-workflow-id',
+      })
+
+      const response = await POST(createMockRequest('POST', { type: 'event_callback' }), {
+        params: Promise.resolve({ path: 'legacy-slack-path' }),
+      })
+
+      expect(response.status).toBe(200)
+      expect(verifySlackCustomBotCredentialRequestMock).toHaveBeenCalledWith(
+        expect.objectContaining({ credentialId: 'credential-1' })
+      )
+      expect(dispatchSlackCustomBotCredentialMock).toHaveBeenCalledWith(
+        expect.objectContaining({ credentialId: 'credential-1' })
+      )
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
+
+    it('rejects a legacy alias when its credential signature is invalid', async () => {
+      testData.webhooks.push({
+        id: 'legacy-slack-webhook',
+        provider: 'slack',
+        path: 'legacy-slack-path',
+        routingKey: 'credential-1',
+        isActive: true,
+        providerConfig: {
+          triggerId: 'slack_webhook',
+          credentialId: 'credential-1',
+          ingressMode: 'legacy_custom_bot',
+        },
+        workflowId: 'test-workflow-id',
+      })
+      verifySlackCustomBotCredentialRequestMock.mockResolvedValueOnce(
+        new NextResponse('Unauthorized', { status: 401 })
+      )
+
+      const response = await POST(createMockRequest('POST', { type: 'event_callback' }), {
+        params: Promise.resolve({ path: 'legacy-slack-path' }),
+      })
+
+      expect(response.status).toBe(401)
+      expect(dispatchSlackCustomBotCredentialMock).not.toHaveBeenCalled()
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
+  })
+
   describe('Reservation-free filtering', () => {
     it('skips filtered webhook events before preprocessing reserves a slot', async () => {
       testData.webhooks.push({

apps/sim/app/api/webhooks/trigger/[path]/route.ts

@@ -15,8 +15,14 @@ import {
   verifyProviderAuth,
 } from '@/lib/webhooks/processor'
 import { acceptsPathWebhookDelivery } from '@/lib/webhooks/providers'
+import {
+  dispatchSlackCustomBotCredential,
+  getLegacySlackCustomBotCredentialId,
+  verifySlackCustomBotCredentialRequest,
+} from '@/lib/webhooks/slack-custom-ingress'
 
 const logger = createLogger('WebhookTriggerAPI')
+const MAX_LEGACY_SLACK_CREDENTIALS_PER_PATH = 25
 
 export const dynamic = 'force-dynamic'
 export const runtime = 'nodejs'
@@ -123,18 +129,69 @@ async function handleWebhookPost(
     return new NextResponse('Not Found', { status: 404 })
   }
 
-  // Process each webhook matched on this path
-  const responses: NextResponse[] = []
+  const legacySlackCredentialIds = new Set<string>()
+  const directWebhooksForPath = webhooksForPath.filter(({ webhook: foundWebhook }) => {
+    const credentialId = getLegacySlackCustomBotCredentialId(foundWebhook)
+    if (!credentialId) return true
+    legacySlackCredentialIds.add(credentialId)
+    return false
+  })
+  if (legacySlackCredentialIds.size > MAX_LEGACY_SLACK_CREDENTIALS_PER_PATH) {
+    throw new Error(
+      `Webhook path resolves more than ${MAX_LEGACY_SLACK_CREDENTIALS_PER_PATH} legacy Slack credentials`
+    )
+  }
+
+  let dispatchedLegacySlackAlias = false
+  let firstLegacySlackAuthError: NextResponse | null = null
+  for (const credentialId of legacySlackCredentialIds) {
+    const authError = await verifySlackCustomBotCredentialRequest({
+      credentialId,
+      request,
+      rawBody,
+      requestId,
+    })
+    if (authError) {
+      if (authError.status === 404) return authError
+      firstLegacySlackAuthError ??= authError
+      continue
+    }
+
+    await dispatchSlackCustomBotCredential({
+      credentialId,
+      body,
+      request,
+      requestId,
+      receivedAt,
+    })
+    dispatchedLegacySlackAlias = true
+  }
+
+  if (legacySlackCredentialIds.size > 0 && !dispatchedLegacySlackAlias) {
+    return (
+      firstLegacySlackAuthError ??
+      new NextResponse('Unauthorized - Invalid Slack signature', { status: 401 })
+    )
+  }
+
+  /**
+   * Process each unmarked webhook matched on this path. Marked Slack rows were
+   * already included in the routing-key fan-out and must not run twice.
+   */
+  const responses: NextResponse[] = dispatchedLegacySlackAlias
+    ? [new NextResponse(null, { status: 200 })]
+    : []
   const failures: NextResponse[] = []
+  const dispatchTargetCount = directWebhooksForPath.length + (dispatchedLegacySlackAlias ? 1 : 0)
 
-  for (const { webhook: foundWebhook, workflow: foundWorkflow } of webhooksForPath) {
+  for (const { webhook: foundWebhook, workflow: foundWorkflow } of directWebhooksForPath) {
     const provider = foundWebhook.provider
     if (!provider) {
       const missingProviderResponse = NextResponse.json(
         { error: 'Webhook provider is missing' },
         { status: 500 }
       )
-      if (webhooksForPath.length > 1) {
+      if (dispatchTargetCount > 1) {
         logger.error(
           `[${requestId}] Webhook ${foundWebhook.id} has no provider, continuing to next`
         )
@@ -151,7 +208,7 @@ async function handleWebhookPost(
       requestId
     )
     if (authError) {
-      if (webhooksForPath.length > 1) {
+      if (dispatchTargetCount > 1) {
         logger.warn(`[${requestId}] Auth failed for webhook ${foundWebhook.id}, continuing to next`)
         continue
       }
@@ -181,7 +238,7 @@ async function handleWebhookPost(
     }
 
     if (dispatchResult.outcome === 'failed' || dispatchResult.reason === 'block-missing') {
-      if (webhooksForPath.length > 1) {
+      if (dispatchTargetCount > 1) {
         logger.warn(
           `[${requestId}] Webhook dispatch failed for ${foundWebhook.id}, continuing to next`,
           { reason: dispatchResult.reason, status: dispatchResult.response.status }