fix(slack-work-app): Remove user scopes#3052
Conversation
🦋 Changeset detectedLatest commit: 7230aed The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Clean change. The removed user scopes (users:read, users:read.email) were unused — the app operates entirely through bot scopes, which still include both. slack-scopes.ts only exports bot scopes, so no downstream code is affected.
Claude Opus ｜ 𝕏
|
TL;DR — Removes the Key changes
Summary ｜ 2 files ｜ 1 commit ｜ base:
Requesting fewer OAuth scopes reduces the trust burden on installing workspace admins and aligns the manifest with actual usage (only bot scopes are exercised at runtime).
|
|
TL;DR — Removes the Key changes
Summary ｜ 2 files ｜ 2 commits ｜ base:
User scopes grant permissions on behalf of the installing user rather than the bot. Since the Slack Work App operates entirely through bot-token scopes, these user scopes added unnecessary permission surface without being used.
|
There was a problem hiding this comment.
PR Review Summary
(0) Total Issues | Risk: Low
Summary
This PR correctly removes unused OAuth user scopes from the Slack app manifest. The change is safe and appropriate:
What was verified:
- ✅ The
users:readandusers:read.emailscopes remain in the bot scopes section (lines 66-67), which is what the app actually uses - ✅ The codebase only exports
BOT_SCOPESviaslack-scopes.ts— user scopes were never referenced - ✅ All Slack API calls use the bot token (
tokenData.access_token), not user tokens - ✅ The
authed_user.idfrom OAuth responses is just metadata, not requiring user scopes - ✅ Changeset is properly formatted for
@inkeep/agents-work-appspatch release
Security benefit: Removing unused OAuth scopes follows the principle of least privilege — the app should only request permissions it actually needs.
✅ APPROVE
Summary: Clean, minimal change that removes unused OAuth scopes. The bot scopes (which are actually used) remain intact. Good housekeeping! 🧹
Reviewers (1)
| Reviewer | Returned | Main Findings | Consider | While You're Here | Inline Comments | Pending Recs | Discarded |
|---|---|---|---|---|---|---|---|
orchestrator-direct |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Note: Direct review by orchestrator — change too minimal to warrant sub-reviewer dispatch.
Preview URLsUse these stable preview aliases for testing this PR:
These point to the same Vercel preview deployment as the bot comment, but they stay stable and easier to find. Raw Vercel deployment URLs
|
|
This pull request has been automatically marked as stale because it has not had recent activity. If this PR is still relevant:
Thank you for your contributions! |
|
This pull request has been automatically closed due to inactivity. If you'd like to continue working on this, please:
Thank you for your understanding! |
No description provided.