fix(slack): acknowledge filtered webhook deliveries

Author: TheodoreSpeaks

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.test.ts

@@ -146,4 +146,18 @@ describe('Slack custom-bot webhook route', () => {
     expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledTimes(1)
     expect(res.status).toBe(200)
   })
+
+  it('returns the dispatch failure when no target is acknowledged', async () => {
+    mockDispatchResolvedWebhookTarget.mockResolvedValue({
+      outcome: 'failed',
+      response: new Response('Preprocessing failed', { status: 500 }),
+      reason: 'preprocessing',
+    })
+
+    const res = await POST(makeRequest(), context)
+
+    expect(mockDispatchResolvedWebhookTarget).toHaveBeenCalledTimes(1)
+    expect(res.status).toBe(500)
+    await expect(res.text()).resolves.toBe('Preprocessing failed')
+  })
 })

apps/sim/app/api/webhooks/slack/custom/[credentialId]/route.ts

@@ -67,7 +67,22 @@ async function handleSlackCustomBotWebhook(
     return authError
   }
 
-  await dispatchSlackCustomBotCredential({ credentialId, body, request, requestId, receivedAt })
+  const dispatchResults = await dispatchSlackCustomBotCredential({
+    credentialId,
+    body,
+    request,
+    requestId,
+    receivedAt,
+  })
+  const acknowledged = dispatchResults.some(
+    (result) => result.outcome !== 'failed' && result.reason !== 'block-missing'
+  )
+  if (!acknowledged) {
+    const failure = dispatchResults.find(
+      (result) => result.outcome === 'failed' || result.reason === 'block-missing'
+    )
+    if (failure) return failure.response
+  }
 
   return new NextResponse(null, { status: 200 })
 }

apps/sim/app/api/webhooks/trigger/[path]/route.test.ts

@@ -1160,6 +1160,37 @@ describe('Webhook Trigger API Route', () => {
       expect(response.status).toBe(500)
       expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
     })
+
+    it('acknowledges a legacy fan-out when every target filters the event', async () => {
+      testData.webhooks.push({
+        id: 'legacy-slack-webhook',
+        provider: 'slack',
+        path: 'legacy-slack-path',
+        routingKey: 'credential-1',
+        isActive: true,
+        providerConfig: {
+          triggerId: 'slack_webhook',
+          credentialId: 'credential-1',
+          ingressMode: 'legacy_custom_bot',
+        },
+        workflowId: 'test-workflow-id',
+      })
+      dispatchSlackCustomBotCredentialMock.mockResolvedValueOnce([
+        {
+          outcome: 'ignored',
+          reason: 'filtered',
+          response: NextResponse.json({ message: 'Webhook event ignored' }),
+        },
+      ])
+
+      const response = await POST(createMockRequest('POST', { type: 'event_callback' }), {
+        params: Promise.resolve({ path: 'legacy-slack-path' }),
+      })
+
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toEqual({ message: 'Webhook event ignored' })
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
   })
 
   describe('Reservation-free filtering', () => {

apps/sim/app/api/webhooks/trigger/[path]/route.ts

@@ -261,7 +261,6 @@ async function handleWebhookDelivery(
   const responses: NextResponse[] = []
   const failures: NextResponse[] = []
   for (const dispatchResult of legacySlackDispatchResults) {
-    if (dispatchResult.reason === 'filtered') continue
     if (dispatchResult.outcome === 'failed' || dispatchResult.reason === 'block-missing') {
       failures.push(dispatchResult.response)
       continue

packages/db/scripts/migrate-slack-custom-bots.test.ts

@@ -296,6 +296,39 @@ describe('planLegacySlackTriggerLink', () => {
 })
 
 describe('resolveSlackSourceSecrets', () => {
+  it('marks a trigger without a bot token as unresolved', () => {
+    expect(
+      resolveSlackSourceSecrets(
+        source({
+          sourceId: 'workflow-1:block-1:trigger',
+          kind: 'trigger',
+          rawBotToken: undefined,
+          rawSigningSecret: 'signing-secret',
+        }),
+        environmentLookup()
+      )
+    ).toEqual({
+      status: 'unresolved',
+      reason: 'Source workflow-1:block-1:trigger has no bot token',
+    })
+  })
+
+  it('marks a trigger without a signing secret as unresolved', () => {
+    expect(
+      resolveSlackSourceSecrets(
+        source({
+          sourceId: 'workflow-1:block-1:trigger',
+          kind: 'trigger',
+          rawSigningSecret: undefined,
+        }),
+        environmentLookup()
+      )
+    ).toEqual({
+      status: 'unresolved',
+      reason: 'Trigger source workflow-1:block-1:trigger has no signing secret',
+    })
+  })
+
   it('marks a missing environment variable as an unresolved source', () => {
     expect(
       resolveSlackSourceSecrets(source({ rawBotToken: '{{SLACK_BOT_TOKEN}}' }), environmentLookup())

packages/db/scripts/migrate-slack-custom-bots.ts

@@ -482,7 +482,9 @@ export function resolveSlackSourceSecrets(
 ): SlackSourceSecretResolution {
   try {
     const botToken = resolveStoredSecret(source.rawBotToken, source, lookup, 'botToken')
-    if (!botToken) throw new Error(`Source ${source.sourceId} has no bot token`)
+    if (!botToken) {
+      return { status: 'unresolved', reason: `Source ${source.sourceId} has no bot token` }
+    }
 
     const signingSecret = resolveStoredSecret(
       source.rawSigningSecret,
@@ -491,7 +493,10 @@ export function resolveSlackSourceSecrets(
       'signingSecret'
     )
     if (source.kind === 'trigger' && !signingSecret) {
-      throw new Error(`Trigger source ${source.sourceId} has no signing secret`)
+      return {
+        status: 'unresolved',
+        reason: `Trigger source ${source.sourceId} has no signing secret`,
+      }
     }
 
     return { status: 'ready', botToken, signingSecret }
@@ -716,7 +721,7 @@ async function prepareWorkspaceCredentials(params: {
     const resolution = resolveSlackSourceSecrets(source, environmentLookup)
     if (resolution.status === 'unresolved') {
       params.stats.skippedUnresolved++
-      logger.warn('Skipping Slack bot credential source with an unresolved environment variable', {
+      logger.warn('Skipping Slack bot credential source with unresolved secrets', {
         workspaceId: params.workspaceId,
         workflowId: source.workflowId,
         workflowName: source.workflowName,