Normalize Slack-shaped OAuth token exchange payloads

[kentcdodds]

What

Two small normalizations in the host-side /connect/oauth token exchange, in oauth-token-exchange.ts + handleOAuthExchangeAction:

1. authed_user hoisting. Slack's oauth.v2.access nests user tokens under authed_user — top-level access_token is the bot token, and is absent entirely for user-scope-only apps. The exchange response now hoists access_token / refresh_token / expires_in / token_type / scope from authed_user to the standard top-level names when the top level lacks a token, never overwriting present fields. Standard OAuth payloads pass through untouched (same object identity).
2. ok: false soft failures. Slack reports token-endpoint failures as { ok: false, error } with HTTP 200; these now map to the standard exchange-failure response (502 + provider error string) instead of surfacing downstream as a confusing "payload did not include an access_token".

Why

Community data shows @kody/slack is the most-adopted integration package (4 forks, 2 stars) — each fork today means a user registering their own Slack app. This unblocks a platform (built-in) Slack app configured with user_scope via extraAuthorizeParams, keeping token persistence provider-agnostic downstream.

Testing

Unit tests for both helpers (user-scope-only hoisting, bot-token non-overwrite, standard payload passthrough, soft-failure detection). npm run validate green.

  

Summary by CodeRabbit

• Bug Fixes
  • Improved OAuth token exchange handling for Slack-style responses.
  • Preserved valid top-level tokens while recovering tokens nested in user details.
  • Correctly identifies soft failures returned with successful HTTP responses.
  • Supports standard, tokenless, and failure payloads without altering their expected structure.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c71d591d-80ed-47c3-afac-2587e51e0d46

📥 Commits

Reviewing files that changed from the base of the PR and between f3895ae and 95507e7.

📒 Files selected for processing (3)

• packages/worker/src/app/handlers/account-secrets.ts
• packages/worker/src/integrations/oauth-token-exchange.node.test.ts
• packages/worker/src/integrations/oauth-token-exchange.ts

---

📝 Walkthrough

Walkthrough

The OAuth token exchange flow now detects { ok: false } soft failures, normalizes Slack nested token payloads, and returns standardized errors or normalized provider responses.

Changes

OAuth response handling

Layer / File(s)	Summary
OAuth payload helpers and validation packages/worker/src/integrations/oauth-token-exchange.ts, packages/worker/src/integrations/oauth-token-exchange.node.test.ts	The helper hoists Slack OAuth fields from authed_user when no valid top-level token exists. It preserves existing values and detects ok: false responses. Tests cover both behaviors.
Account secrets integration packages/worker/src/app/handlers/account-secrets.ts	The handler maps OAuth soft failures to standardized errors and normalizes successful payloads before returning provider status.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OAuthProvider
  participant AccountSecretsHandler
  participant OAuthPayloadHelpers
  OAuthProvider->>AccountSecretsHandler: return token exchange payload
  AccountSecretsHandler->>OAuthPayloadHelpers: detect soft failure
  OAuthPayloadHelpers-->>AccountSecretsHandler: return classification
  AccountSecretsHandler->>OAuthPayloadHelpers: normalize successful payload
  OAuthPayloadHelpers-->>AccountSecretsHandler: return normalized payload

Loading

Possibly related PRs

• kentcdodds/kody#979: Refactors the OAuth integration used by this token exchange flow.
• kentcdodds/kody#1303: Modifies the OAuth exchange helper and account secrets handler for exchange request styles and platform integrations.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: normalization of Slack-shaped OAuth token exchange payloads.
Description check	✅ Passed	The description explains the intent, summarizes the changes, and documents testing; the optional System changes section is not required.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/slack-token-exchange-shape-c0a2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-1346.kody-a99.workers.dev

Worker: kody-pr-1346
D1: kody-pr-1346-db
KV: kody-pr-1346-oauth-kv

Mocks:

• cloudflare: https://kody-pr-1346-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1346-mock-cloudflare)