You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
pass through as_user unless false and a bot token is available
This allows us to support both existing and new Slack connections
created with Slack's v2 OAuth flow, with or without the deprecated
perspectival chat:write:user and chat:write:bot scopes:
| Slack auth | Token Types | Scopes | as_user Values |
|------------|-------------|-----------------------|-----------------|
| v1 | user | chat:write:bot, :user | true, false |
| v2 | user, bot | chat:write:bot, :user | true, false |
| v2 | user, bot | chat:write | true |
In v2, when the chat:write scope is requested, it replaces
chat:write:bot and chat:write:user. Without the chat:write:bot scope,
as_user cannot be false; user tokens always post as the user, and bot
tokens always post as the bot. In v2, with or without the chat:write:bot
scope, we can use the bot token if as_user is false since it will have
permission to post as itself. And we MAY pass through as_user if it's
true since Slack allows it even when it's superfluous. However, we MUST
pass through as_user if it's true AND the user token still has the
chat:write:bot scope since otherwise the message will post as the bot
user instead of the user.
See:
https://docs.slack.dev/reference/methods/chat.postMessage/#legacy_as_user
0 commit comments