Skip to content

fix(oauth): forget a deleted user's token in the latest installation - #2784

Draft
WilliamBergamin wants to merge 1 commit into
mainfrom
fix-file-store-delete-user-token
Draft

WilliamBergamin wants to merge 1 commit into
mainfrom
fix-file-store-delete-user-token

Conversation

@WilliamBergamin

Copy link
Copy Markdown
Contributor

Summary

This pull request makes FileInstallationStore.deleteInstallation({ userId }) forget that user's token in the latest installation.

  • Before, deleting a user removed only the user-<id>-* files. When that user was also the latest installer, app-latest kept their token, so fetchInstallation({ userId }) still returned it.
  • Now the user in app-latest is reduced to { id } when it matches; the bot and other users are untouched.
  • Historical app-<timestamp> copies are unchanged, since fetchInstallation never reads them.

Testing

  1. Install an app with user scopes through the OAuth flow, so you are the latest installer.
  2. Call installationStore.deleteInstallation({ teamId, userId }) with your user ID.
  3. Confirm fetchInstallation({ teamId, userId }) returns no user token (before this change it still did).

Requirements

🤖 Generated with Claude Code

FileInstallationStore.deleteInstallation with a userId removed only the
user-<id>-* files. When that user was also the latest installer,
app-latest kept their user token, so fetchInstallation for them still
returned it. Deleting a user now clears their credentials from
app-latest and keeps the bot.
@changeset-bot

changeset-bot Bot commented Oct 16, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2423818

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@slack/oauth Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@codecov

codecov Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 89.46%. Comparing base (1fabb45) to head (2423818).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2784      +/-   ##
==========================================
+ Coverage   89.40%   89.46%   +0.05%     
==========================================
  Files          65       65              
  Lines       10545    10548       +3     
  Branches      478      478              
==========================================
+ Hits         9428     9437       +9     
+ Misses       1086     1080       -6     
  Partials       31       31              
Flag Coverage Δ
cli-hooks 89.31% <91.66%> (-0.04%) ⬇️
cli-test 89.31% <91.66%> (-0.04%) ⬇️
logger 89.31% <91.66%> (-0.04%) ⬇️
oauth 89.31% <91.66%> (-0.04%) ⬇️
socket-mode 89.31% <91.66%> (-0.04%) ⬇️
web-api 89.31% <91.66%> (-0.04%) ⬇️
webhook 89.31% <91.66%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant