feat: Add OAuth 2.0 multi-user support

[wentaoyang-moloco]

Add OAuth 2.0 authentication flow for multi-user support with the following features:

Core OAuth Implementation:

• OAuth 2.0 authorization flow with Slack API
• CSRF protection via state parameter validation
• In-memory token storage with automatic cleanup
• Per-request Slack client creation for token isolation
• Support for both user tokens (xoxp) and bot tokens (xoxb)

Dual-Mode Architecture:

• Legacy mode: Single-user with browser tokens (xoxc/xoxd/xoxp)
• OAuth mode: Multi-user with OAuth tokens
• Backward compatible with existing configurations

OAuth Handlers:

• /oauth/authorize endpoint for initiating OAuth flow
• /oauth/callback endpoint for processing OAuth callbacks
• OAuth middleware for token validation and user context injection

Multi-User Features:

• Per-user token isolation and validation
• User context propagation through request chain
• Separate user and bot token support
• Option to post as bot or user via post_as_bot parameter

Security Enhancements:

• Secure state generation using crypto/rand
• Token validation on each request
• HTTPS requirement for OAuth callbacks (Slack requirement)
• Security headers on OAuth endpoints
• Credentials removed from example files

Documentation:

• Comprehensive OAuth setup guide (docs/04-oauth-setup.md)
• ngrok setup instructions for local development
• OAuth configuration examples
• Architecture and troubleshooting sections

Developer Tools:

• OAuth testing script (scripts/test-oauth.sh)
• OAuth server startup script (start-oauth-server.sh)
• Example configuration file (oauth.env.example)

Modified Components:

• main.go: Added OAuth mode detection and initialization
• channels.go: OAuth support with per-request client
• conversations.go: OAuth support with user/bot token selection
• server.go: OAuth-enabled SSE and HTTP server methods
• sse_auth.go: Exported WithAuthKey for OAuth middleware
• .gitignore: Added oauth.env and binary exclusions

New Components:

• pkg/oauth/: OAuth manager, storage, and types
• pkg/server/auth/: OAuth middleware and user context
• pkg/server/oauth_handler.go: OAuth HTTP handlers

Breaking Changes: None (fully backward compatible)

Environment Variables:

• SLACK_MCP_OAUTH_ENABLED: Enable OAuth mode
• SLACK_MCP_OAUTH_CLIENT_ID: Slack app client ID
• SLACK_MCP_OAUTH_CLIENT_SECRET: Slack app client secret
• SLACK_MCP_OAUTH_REDIRECT_URI: OAuth callback URL (requires HTTPS)

[mrfelton]

Thanks for working on this. Curious if the maintainers plan in pushing this forwards? Thanks.

[korotovsky]

I'd be happy to prioritize this if someone could pick this up

[wentaoyang-moloco]

@mrfelton @korotovsky this branch is in our internal fork. People have tested and deployed it so it should be working, I am fine if you guys want to merge and use it, but I am hesitant to be the maintainer in the public repo, so you guys need to take over it.

[korotovsky]

Hi @wentaoyang-moloco, this is amazing work, thank you. Due to the size of the PR it must be carefully checked, there might be a couple of more comments what we must improve to make it part of this repo. I'll get back later during the weekend since I'm quite busy with #150

[aron-muon]

Pretty exciting work. I've brought the changes into my fork, and tested them. It works as intended.
However, there were a few changes I needed to introduce on top to make sure #165 works - I can submit a PR for those after this gets merged.

One thing I noticed is that when using oauth user tokens, the channel/user caching doesn't work as intended. Basically, raw user/channel IDs are returned rather than looking up their readable names.

[aron-muon]

Introduced PR here to fix all the bugs I found in this oauth implementation.
https://github.com/moloco/slack-mcp-server/pull/2

[korotovsky]

Hi @aron-muon, I merged GovSlack to master, could you cherry-pick changes from this PR into a separate PR + add your own fixes and we give it a go? Then later I will close this PR.

[korotovsky]

Closed in favor of #166