@kaavee315checks…codex/propose-fix-for-slackbot-revocation-vulnerability → master3 files · +24 −24review: @rohanprabhureview: @sarthakreview: @acsrujanreview: @anshugarg15updated 1w agoxoxb-*) to the provider, which would revoke the bot for the entire workspace and impact other users/projects.slackbot guard in resolveRevokeToken that returns a 400 Bad Request for public revoke flows instead of resolving and returning the top-level workspace bot token via access_token.resolveRevokeToken comments to document that slackbot revocation must use dedicated admin cleanup paths and must not dispatch workspace-wide xoxb-* tokens from public endpoints.resolveRevokeToken.unit.test.ts to expect a 400 when toolkitSlug === 'slackbot' and in oAuth2.revoke.unit.test.ts to assert that OAuth2.revoke returns 400 and does not call upstream revoke for slackbot connections.pnpm vitest src/lib/connected_accounts/revoke/resolveRevokeToken.unit.test.ts src/lib/connected_accounts/oAuth2.revoke.unit.test.ts, which attempted to execute the modified suites but failed early due to missing required environment variables/secrets in the runner (for example DATABASE_URL, JWT_SECRET, THERMOS_URL, and related secrets), so the test runner did not complete.400 for slackbot) and are ready to run successfully in a properly provisioned environment.Based on git blame analysis of 3 file(s):
| Contributor | Contribution | Files |
|---|---|---|
| sarthak | 100% | 3 |
Based on git history, sarthak would be good reviewer(s) for this PR.
🤖 Based on git blame with recency weighting (recent edits count more).