fix: always attach the function bot access token to the context if available by zimeg · Pull Request #2513 · slackapi/bolt-js

zimeg · 2025-04-29T02:22:20Z

Summary

This PR adds to the refactors of #2424 to always attach the function bot access token to the context if it's available.

Changes of the linked PR now use a shared selectToken function that no longer relies on this value in context to determine which token to use - either workflow, bot, or user - and now use the attachFunctionToken argument:

bolt-js/src/App.ts

Lines 1580 to 1591 in d61f2cd

    
           // Returns either a bot token, a user token or a workflow token for client, say() 
        
           function selectToken(context: Context, attachFunctionToken: boolean): string | undefined { 
        
             if (attachFunctionToken) { 
        
               // If functionBotAccessToken exists on context, the incoming event is function-related *and* the 
        
               // user has `attachFunctionToken` enabled. In that case, subsequent calls with the client should 
        
               // use the function-related/JIT token in lieu of the botToken or userToken. 
        
               if (context.functionBotAccessToken) { 
        
                 return context.functionBotAccessToken; 
        
               } 
        
             } 
        
             return context.botToken !== undefined ? context.botToken : context.userToken; 
        
           }

Preview

Before changes we had implicit use of this value to decide which token to use in the app.function listener:

bolt-js/src/App.ts

Lines 973 to 978 in 657416f

    
           // Attach and make available the JIT/function-related token on context 
        
           if (this.attachFunctionToken) { 
        
             if (functionBotAccessToken) { 
        
               context.functionBotAccessToken = functionBotAccessToken; 
        
             } 
        
           }

bolt-js/src/App.ts

Lines 1102 to 1105 in 657416f

    
           // If functionBotAccessToken exists on context, the incoming event is function-related *and* the 
        
           // user has `attachFunctionToken` enabled. In that case, subsequent calls with the client should 
        
           // use the function-related/JIT token in lieu of the botToken or userToken. 
        
           const token = context.functionBotAccessToken ? context.functionBotAccessToken : selectToken(context);

bolt-js/src/CustomFunction.ts

Lines 185 to 188 in 657416f

    
           function selectToken(context: Context): string | undefined { 
        
             // If attachFunctionToken = false, fallback to botToken or userToken 
        
             return context.functionBotAccessToken ? context.functionBotAccessToken : context.botToken || context.userToken; 
        
           }

Notes

Including this in context gives a choice of using this token in certain circumstances, even if attachFunctionToken is false! 🤖 ✨

Requirements

I've read and understood the Contributing Guidelines and have done my best effort to follow them.
I've read and agree to the Code of Conduct.

…ck-changes

…ailable

codecov · 2025-04-29T02:23:53Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.96%. Comparing base (6eeb1df) to head (790cd9f).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2513      +/-   ##
==========================================
- Coverage   92.97%   92.96%   -0.01%     
==========================================
  Files          36       36              
  Lines        7441     7437       -4     
  Branches      652      649       -3     
==========================================
- Hits         6918     6914       -4     
  Misses        518      518              
  Partials        5        5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

WilliamBergamin

This is an awesome catch 🥇 🚀

I agree the expected behavior should be to always set the context.functionBotAccessToken as the workflow token if it is found in a payload

We only want to set it to the token for the client if this.attachFunctionToken = true

WilliamBergamin · 2025-04-29T14:38:34Z

@zimeg any chance we can add a unit tests to ensure this behavior is maintained in the future 🙏

Co-authored-by: Eden Zimbelman <[email protected]>

… into zimeg-fix-context-function-token

zimeg · 2025-04-30T16:54:44Z

@WilliamBergamin Thanks so much once again for the changes of #2424 - that unlocked this fix 👾 ✨

Before merging I agree it'd be best to add tests for this to avoid regressions. I hope to visit this soon!

WilliamBergamin · 2025-05-02T14:06:04Z

@zimeg this may be needed sooner then we expected in #2508

zimeg

@WilliamBergamin Thanks for bumping this! 🤖

I added a test to cover both the function and action listeners which brought one more question that I'm curious about before merging this, but I appreciate that this is surfaced from these tests!

zimeg · 2025-05-03T00:16:21Z

test/unit/App/middlewares/arguments.spec.ts

+        assert.strictEqual(context.functionExecutionId, functionExecutionId);
+        assert.strictEqual(context.functionBotAccessToken, functionBotAccessToken);


Suggested change

assert.strictEqual(context.functionExecutionId, functionExecutionId);

assert.strictEqual(context.functionBotAccessToken, functionBotAccessToken);

assert.strictEqual(context.functionExecutionId, functionExecutionId);

assert.strictEqual(context.functionBotAccessToken, functionBotAccessToken);

assert.deepStrictEqual(context.functionInputs, inputs);

📣 Here we are not testing that functionInputs are added to context but I'm not sure if this is something we want to change in this PR?

It's not clear to me if this should be included following L1624 from body.event.inputs for convenience:

bolt-js/src/App.ts

Lines 1616 to 1635 in 76140ed

function extractFunctionContext(body: StringIndexed) {

let functionExecutionId: string | undefined = undefined;

let functionBotAccessToken: string | undefined = undefined;

let functionInputs: FunctionInputs | undefined = undefined;

// function_executed event

if (body.event && body.event.type === 'function_executed' && body.event.function_execution_id) {

functionExecutionId = body.event.function_execution_id;

functionBotAccessToken = body.event.bot_access_token;

}

// interactivity (block_actions)

if (body.function_data) {

functionExecutionId = body.function_data.execution_id;

functionBotAccessToken = body.bot_access_token;

functionInputs = body.function_data.inputs;

}

return { functionExecutionId, functionBotAccessToken, functionInputs };

}

If adding a test for functionInputs in the context is a small change then we can do it in this PR 💯 but if it is larger then maybe we do it in another PR

Good thinking. I'm finding this change involves an update to another file which does seem outside the scope of this PR 🫡

WilliamBergamin

Nice 💯

Ship it as is or add a test for the inputs in the context 🚀

WilliamBergamin · 2025-05-05T15:27:49Z

test/unit/App/middlewares/arguments.spec.ts

+        assert.strictEqual(context.functionExecutionId, functionExecutionId);
+        assert.strictEqual(context.functionBotAccessToken, functionBotAccessToken);


If adding a test for functionInputs in the context is a small change then we can do it in this PR 💯 but if it is larger then maybe we do it in another PR

zimeg

@WilliamBergamin Thanks for both sharing thoughts on these changes and tests, and the review once again 🙏 ✨

I'll merge these changes and follow up with a few more focused PRs soon!

zimeg · 2025-05-05T16:32:15Z

test/unit/App/middlewares/arguments.spec.ts

+        assert.strictEqual(context.functionExecutionId, functionExecutionId);
+        assert.strictEqual(context.functionBotAccessToken, functionBotAccessToken);


Good thinking. I'm finding this change involves an update to another file which does seem outside the scope of this PR 🫡

WilliamBergamin and others added 5 commits February 14, 2025 16:41

fix: refactor function handler for follow up auto ack behavior

9efc199

Add more unit test to cover function scoped actions

5c5e84a

Merge branch 'main' into refactor-function-listener-for-future-auto-a…

8422fff

…ck-changes

Merge branch 'main' into refactor-function-listener-for-future-auto-a…

d61f2cd

…ck-changes

fix: always attach the function bot access token to the context if av…

24f5dbb

…ailable

zimeg added bug M-T: confirmed bug report. Issues are confirmed when the reproduction steps are documented semver:patch labels Apr 29, 2025

zimeg requested a review from WilliamBergamin April 29, 2025 02:22

zimeg self-assigned this Apr 29, 2025

This was referenced Apr 29, 2025

fix: refactor function handler for follow up auto ack behavior #2424

Merged

docs: document workflow token behaviors #2500

Open

WilliamBergamin approved these changes Apr 29, 2025

View reviewed changes

WilliamBergamin and others added 15 commits April 29, 2025 10:42

Update test/types/action.test-d.ts

6b0c3b9

Co-authored-by: Eden Zimbelman <[email protected]>

Update src/CustomFunction.ts

32f698f

Co-authored-by: Eden Zimbelman <[email protected]>

Update src/CustomFunction.ts

0d7a953

Co-authored-by: Eden Zimbelman <[email protected]>

Add a TODO for create say

46ebf61

Update src/App.ts

3b4342d

Co-authored-by: Eden Zimbelman <[email protected]>

Update src/CustomFunction.ts

28c73d8

Co-authored-by: Eden Zimbelman <[email protected]>

Update src/CustomFunction.ts

425c963

Co-authored-by: Eden Zimbelman <[email protected]>

Update src/CustomFunction.ts

07ef57a

Co-authored-by: Eden Zimbelman <[email protected]>

Update src/CustomFunction.ts

a602dc6

Co-authored-by: Eden Zimbelman <[email protected]>

fix imports

70deb4f

Update src/App.ts

f9b2fae

Co-authored-by: Eden Zimbelman <[email protected]>

Improve client pool behavior

0ba5ea8

depricate types instead of removing them

9e6ef71

Update src/CustomFunction.ts

a01e3f1

Co-authored-by: Eden Zimbelman <[email protected]>

Merge branch 'refactor-function-listener-for-future-auto-ack-changes'…

4e60cfa

… into zimeg-fix-context-function-token

Base automatically changed from refactor-function-listener-for-future-auto-ack-changes to main April 30, 2025 14:16

chore: merge w main

5d64700

zimeg added this to the 4.2.2 milestone Apr 30, 2025

zimeg added 2 commits May 2, 2025 09:36

chore: merge w main

96967f7

test: confirm function executed event details are added to the context

090a7c4

zimeg commented May 3, 2025

View reviewed changes

WilliamBergamin approved these changes May 5, 2025

View reviewed changes

chore: merge w main

790cd9f

zimeg commented May 5, 2025

View reviewed changes

zimeg merged commit cad34f5 into main May 5, 2025
18 checks passed

zimeg deleted the zimeg-fix-context-function-token branch May 5, 2025 16:35

zimeg mentioned this pull request May 5, 2025

fix: always attach the function inputs to the context if available #2517

Merged

2 tasks

	// Returns either a bot token, a user token or a workflow token for client, say()
	function selectToken(context: Context, attachFunctionToken: boolean): string \| undefined {
	if (attachFunctionToken) {
	// If functionBotAccessToken exists on context, the incoming event is function-related and the
	// user has `attachFunctionToken` enabled. In that case, subsequent calls with the client should
	// use the function-related/JIT token in lieu of the botToken or userToken.
	if (context.functionBotAccessToken) {
	return context.functionBotAccessToken;
	}
	}
	return context.botToken !== undefined ? context.botToken : context.userToken;
	}

	// Attach and make available the JIT/function-related token on context
	if (this.attachFunctionToken) {
	if (functionBotAccessToken) {
	context.functionBotAccessToken = functionBotAccessToken;
	}
	}

	function selectToken(context: Context): string \| undefined {
	// If attachFunctionToken = false, fallback to botToken or userToken
	return context.functionBotAccessToken ? context.functionBotAccessToken : context.botToken \|\| context.userToken;
	}

		assert.strictEqual(context.functionExecutionId, functionExecutionId);
		assert.strictEqual(context.functionBotAccessToken, functionBotAccessToken);

	function extractFunctionContext(body: StringIndexed) {
	let functionExecutionId: string \| undefined = undefined;
	let functionBotAccessToken: string \| undefined = undefined;
	let functionInputs: FunctionInputs \| undefined = undefined;

	// function_executed event
	if (body.event && body.event.type === 'function_executed' && body.event.function_execution_id) {
	functionExecutionId = body.event.function_execution_id;
	functionBotAccessToken = body.event.bot_access_token;
	}

	// interactivity (block_actions)
	if (body.function_data) {
	functionExecutionId = body.function_data.execution_id;
	functionBotAccessToken = body.bot_access_token;
	functionInputs = body.function_data.inputs;
	}

	return { functionExecutionId, functionBotAccessToken, functionInputs };
	}

Comments

Conversation

zimeg commented Apr 29, 2025

Summary

Preview

Notes

Requirements

Uh oh!

codecov bot commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

WilliamBergamin left a comment

Choose a reason for hiding this comment

Uh oh!

WilliamBergamin commented Apr 29, 2025

Uh oh!

zimeg commented Apr 30, 2025

Uh oh!

WilliamBergamin commented May 2, 2025

Uh oh!

zimeg left a comment

Choose a reason for hiding this comment

Uh oh!

zimeg May 3, 2025

Choose a reason for hiding this comment

Uh oh!

WilliamBergamin May 5, 2025

Choose a reason for hiding this comment

Uh oh!

zimeg May 5, 2025

Choose a reason for hiding this comment

Uh oh!

WilliamBergamin left a comment

Choose a reason for hiding this comment

Uh oh!

WilliamBergamin May 5, 2025

Choose a reason for hiding this comment

Uh oh!

zimeg left a comment

Choose a reason for hiding this comment

Uh oh!

zimeg May 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Apr 29, 2025 •

edited

Loading