Skip to content

Comments

fix: all oauth bugs fixed, manually tested#2

Closed
aron-muon wants to merge 31 commits intomoloco:multi-user-supportfrom
aron-muon:aron/oauth-improvements
Closed

fix: all oauth bugs fixed, manually tested#2
aron-muon wants to merge 31 commits intomoloco:multi-user-supportfrom
aron-muon:aron/oauth-improvements

Conversation

@aron-muon
Copy link

@aron-muon aron-muon commented Jan 28, 2026

External OAuth Token Support

Summary

This PR adds support for external OAuth token providers, enabling the Slack MCP server to work with bearer tokens that weren't initiated by the application itself. This is useful for integrating with external identity providers or using pre-existing Slack tokens.

Changes

1. Workspace URL Capture and Usage

Problem: External tokens validated successfully via auth.test but subsequent API calls failed with invalid_auth because the Slack client was pointing to the wrong API endpoint (default https://slack.com/api/ instead of the workspace-specific URL like GovSlack or Enterprise Grid).

Solution:

  • Added URL field to TokenInfo struct (pkg/oauth/types.go)
  • Updated ValidateToken to capture the workspace URL from auth.test response (pkg/oauth/manager.go)
  • Added URL field to UserContext (pkg/server/auth/context.go)
  • Updated OAuth middleware to pass URL to context (pkg/server/auth/oauth_middleware.go)
  • Updated all handlers to use slack.OptionAPIURL() when creating Slack clients (pkg/handler/channels.go, pkg/handler/conversations.go)

2. User Name Resolution in OAuth Mode

Problem: Messages displayed user IDs instead of usernames/display names in OAuth mode because the usersMap was always empty.

Solution:

  • Added fetchUsersForMessages() helper function to fetch user info from Slack API
  • Updated convertMessagesFromHistory and convertMessagesFromSearch to accept context and Slack client parameters
  • Messages now show proper display names instead of user IDs

3. Channel Name to ID Resolution

Problem: Users couldn't use channel names like #general - they had to know the internal channel ID. In OAuth mode, this was especially problematic as the channel cache wasn't available.

Solution:

  • Added resolveChannelName() helper function that:
    • Handles channel names with or without # prefix
    • Handles usernames with or without @ prefix for DM lookups
    • Falls back to Slack API for name resolution in OAuth mode
  • Updated parseParamsToolConversations to accept context and Slack client
  • Updated parseParamsToolSearch to resolve names for filter_users_from and filter_in_channel parameters

4. DM Channel Display Improvements

Problem: DM channels showed # instead of the username, and member counts were 0.

Solution:

  • Updated channelsHandlerOAuth to detect DM channels (IsIM flag)
  • Fetch user info via GetUserInfo API to display @username format
  • Use GetUsersInConversation for group DMs (MPIMs) to get actual member count
  • 1:1 DMs correctly show member count of 2

5. Search Results Channel Display

Problem: Search results showed channel IDs like #U1234567 for DMs instead of usernames.

Solution:

  • Updated convertMessagesFromSearch to detect DM channel IDs (starting with 'D')
  • Fetch user info when available to display @username format
  • Fallback gracefully if user lookup fails

6. Slack Mention Text Processing

Problem: User mentions in message text showed concatenated text like U1UEU5QF0Ava Kopp without proper formatting.

Solution:

  • Added regex handlers in filterSpecialChars() for Slack mention formats:
    • <@U1234567>@U1234567
    • <@U1234567|displayname>@displayname
    • <#C1234567>#C1234567
    • <#C1234567|channel-name>#channel-name

7. Defensive Programming

Problem: Nil pointer dereference when using channel names in OAuth mode because apiProvider was nil.

Solution:

  • Added nil checks before accessing apiProvider in OAuth mode
  • Clear error messages when channel/user resolution fails
  • Graceful fallbacks throughout the codebase

Files Modified

  • pkg/oauth/types.go - Added URL field to TokenInfo
  • pkg/oauth/manager.go - Capture URL from auth.test response
  • pkg/server/auth/context.go - Added URL field to UserContext
  • pkg/server/auth/oauth_middleware.go - Pass URL to user context
  • pkg/handler/channels.go - Use API URL, DM display improvements
  • pkg/handler/conversations.go - User/channel resolution, name lookups
  • pkg/text/text_processor.go - Slack mention formatting

Testing

  • All existing unit tests pass
  • Integration tests require Slack credentials (skipped in CI without tokens)
  • Manual testing with external OAuth tokens confirmed working

Breaking Changes

None. All changes are backward compatible with existing token flow.

korotovsky and others added 29 commits January 8, 2026 22:14
…it-for-cache

fix: wait for cache to be ready before serving stdio requests
feat(docker): Set mcp-server as ENTRYPOINT for improved usability
ci: add Dependabot for Go modules and GitHub Actions
Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-go](https://github.com/actions/setup-go).


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps the go-dependencies group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `0.40.0` | `0.43.2` |
| [github.com/openai/openai-go](https://github.com/openai/openai-go) | `1.11.0` | `1.12.0` |
| [github.com/refraction-networking/utls](https://github.com/refraction-networking/utls) | `1.8.0` | `1.8.2` |
| [github.com/rusq/slackauth](https://github.com/rusq/slackauth) | `0.6.1` | `0.7.1` |
| [github.com/rusq/slackdump/v3](https://github.com/rusq/slackdump) | `3.1.6` | `3.1.11` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.10.0` | `1.11.1` |
| [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.27.1` |
| [golang.ngrok.com/ngrok/v2](https://github.com/ngrok/ngrok-go) | `2.0.0` | `2.1.1` |
| [golang.org/x/net](https://github.com/golang/net) | `0.40.0` | `0.47.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.14.0` | `0.18.0` |
| [golang.org/x/time](https://github.com/golang/time) | `0.12.0` | `0.14.0` |


Updates `github.com/mark3labs/mcp-go` from 0.40.0 to 0.43.2
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v0.40.0...v0.43.2)

Updates `github.com/openai/openai-go` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/openai/openai-go/releases)
- [Changelog](https://github.com/openai/openai-go/blob/main/CHANGELOG.md)
- [Commits](openai/openai-go@v1.11.0...v1.12.0)

Updates `github.com/refraction-networking/utls` from 1.8.0 to 1.8.2
- [Release notes](https://github.com/refraction-networking/utls/releases)
- [Commits](refraction-networking/utls@v1.8.0...v1.8.2)

Updates `github.com/rusq/slackauth` from 0.6.1 to 0.7.1
- [Commits](rusq/slackauth@v0.6.1...v0.7.1)

Updates `github.com/rusq/slackdump/v3` from 3.1.6 to 3.1.11
- [Release notes](https://github.com/rusq/slackdump/releases)
- [Commits](rusq/slackdump@v3.1.6...v3.1.11)

Updates `github.com/stretchr/testify` from 1.10.0 to 1.11.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.10.0...v1.11.1)

Updates `go.uber.org/zap` from 1.27.0 to 1.27.1
- [Release notes](https://github.com/uber-go/zap/releases)
- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)
- [Commits](uber-go/zap@v1.27.0...v1.27.1)

Updates `golang.ngrok.com/ngrok/v2` from 2.0.0 to 2.1.1
- [Release notes](https://github.com/ngrok/ngrok-go/releases)
- [Changelog](https://github.com/ngrok/ngrok-go/blob/main/CHANGELOG.md)
- [Commits](ngrok/ngrok-go@v2.0.0...v2.1.1)

Updates `golang.org/x/net` from 0.40.0 to 0.47.0
- [Commits](golang/net@v0.40.0...v0.47.0)

Updates `golang.org/x/sync` from 0.14.0 to 0.18.0
- [Commits](golang/sync@v0.14.0...v0.18.0)

Updates `golang.org/x/time` from 0.12.0 to 0.14.0
- [Commits](golang/time@v0.12.0...v0.14.0)

---
updated-dependencies:
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 0.43.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/openai/openai-go
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/refraction-networking/utls
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/rusq/slackauth
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/rusq/slackdump/v3
  dependency-version: 3.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.uber.org/zap
  dependency-version: 1.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.ngrok.com/ngrok/v2
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/time
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
ci: add Trivy scan for Go dependencies
…es/go-dependencies-f6cb5527c4

deps(go): bump the go-dependencies group with 11 updates
…ctions/github-actions-3a1c37d3b7

deps(gha): bump the github-actions group with 2 updates
@aron-muon aron-muon marked this pull request as ready for review January 28, 2026 08:57
@aron-muon aron-muon closed this Jan 28, 2026
@aron-muon
Copy link
Author

Closed for korotovsky#166 instead

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants