fix(slack): reject stale uninstall before revoking member grants

Author: TheodoreSpeaks

apps/sim/lib/knowledge/application/slack-search/lifecycle.test.ts

@@ -144,18 +144,44 @@ describe('Slack access revocation', () => {
     await revokeSlackSearchAccess.execute({ principal, input })
     expect(dbChainMockFns.update).not.toHaveBeenCalled()
   })
-  it('does not revoke a replacement installation because of a delayed uninstall', async () => {
+  it.each([
+    { type: 'app_uninstalled' as const },
+    { type: 'tokens_revoked' as const, tokens: { bot: ['UBOT'], oauth: ['U1'] } },
+  ])('ignores stale installation-wide revocations before any writes: %j', async (event) => {
     resetDbChainMock()
     queueTableRows(slackSearchInstallation, [
       {
         id: 'i1',
         organizationId: 'org',
         appId: 'A1',
         teamId: 'T1',
-        updatedAt: new Date(Date.now() + 1000),
+        botUserId: 'UBOT',
+        updatedAt: new Date(input.event_time * 1000 + 1000),
       },
     ])
-    await revokeSlackSearchAccess.execute({ principal, input })
-    expect(dbChainMockFns.set.mock.calls.some(([value]) => 'enabled' in value)).toBe(false)
+    await revokeSlackSearchAccess.execute({ principal, input: { ...input, event } })
+    expect(dbChainMockFns.update).not.toHaveBeenCalled()
+  })
+  it('still revokes matching personal grants when only the installation is newer', async () => {
+    resetDbChainMock()
+    queueTableRows(slackSearchInstallation, [
+      {
+        id: 'i1',
+        organizationId: 'org',
+        appId: 'A1',
+        teamId: 'T1',
+        botUserId: 'UBOT',
+        updatedAt: new Date(input.event_time * 1000 + 1000),
+      },
+    ])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ providerSubjectId: 'U1' }])
+    await revokeSlackSearchAccess.execute({
+      principal,
+      input: { ...input, event: { type: 'tokens_revoked', tokens: { oauth: ['U1'] } } },
+    })
+    expect(dbChainMockFns.update.mock.calls.map(([table]) => table)).toEqual([
+      credential,
+      slackSearchTurn,
+    ])
   })
 })

apps/sim/lib/knowledge/application/slack-search/lifecycle.ts

@@ -74,6 +74,7 @@ export const revokeSlackSearchAccess: OperationUseCase<
         uninstall ||
         (input.event.type === 'tokens_revoked' &&
           (input.event.tokens.bot ?? []).includes(installation.botUserId))
+      if (revokeBot && installation.updatedAt > occurredAt) return
       let revokedMemberIds: string[] = []
       if (uninstall || revokedUsers.length) {
         const revokeCredentials = tx
@@ -102,7 +103,6 @@ export const revokeSlackSearchAccess: OperationUseCase<
         }
       }
       if (revokeBot) {
-        if (installation.updatedAt > occurredAt) return
         await tx
           .update(slackSearchInstallation)
           .set({