🔒 PAZ-297 — Slack App Configuration Tokens

1. Authenticate as qa-agent@pazi.ai and obtain a session cookie
2. Send POST to /api/slack/config-tokens (or actual endpoint) with valid access and refresh tokens
3. Verify 200 response with success indicator
4. Query MongoDB directly to verify tokens are stored encrypted (not plaintext)
5. Verify tokens are associated with the authenticated user's profile

curl -X POST ${API_URL}/slack/config-tokens \
  -H 'Cookie: <session>' \
  -H 'Content-Type: application/json' \
  -d '{"accessToken":"xoxe.xoxp-VALID","refreshToken":"xoxe-VALID"}'

1. Send POST with only refreshToken field (no accessToken)
2. Verify 400 response

curl -X POST ${API_URL}/slack/config-tokens \
  -H 'Cookie: <session>' \
  -H 'Content-Type: application/json' \
  -d '{"refreshToken":"xoxe-VALID"}'

1. Send POST with only accessToken field (no refreshToken)
2. Verify 400 response

curl -X POST ${API_URL}/slack/config-tokens \
  -H 'Cookie: <session>' \
  -H 'Content-Type: application/json' \
  -d '{"accessToken":"xoxe.xoxp-VALID"}'

1. Send POST with tokens that don't match expected prefixes (xoxe.xoxp- for access, xoxe- for refresh)
2. Verify 400 response with format guidance

curl -X POST ${API_URL}/slack/config-tokens \
  -H 'Cookie: <session>' \
  -H 'Content-Type: application/json' \
  -d '{"accessToken":"invalid-format","refreshToken":"also-invalid"}'

1. Send POST without any session cookie
2. Verify 401 response
3. Verify no tokens are stored in DB

curl -X POST ${API_URL}/slack/config-tokens \
  -H 'Content-Type: application/json' \
  -d '{"accessToken":"xoxe.xoxp-VALID","refreshToken":"xoxe-VALID"}'

1. Send POST with whitespace-only values for both tokens
2. Verify 400 response

curl -X POST ${API_URL}/slack/config-tokens \
  -H 'Cookie: <session>' \
  -H 'Content-Type: application/json' \
  -d '{"accessToken":"   ","refreshToken":"  "}'

1. After storing valid tokens via API-1.1, connect to the staging MongoDB
2. Query the relevant collection for the test user's tokens
3. Inspect the stored fields — should be ciphertext, not plaintext
4. Verify encryption key is in environment variables, not in DB

mongosh --eval 'db.users.findOne({email:"qa-agent@pazi.ai"}, {slackConfigTokens:1})'
# OR check a dedicated collection:
mongosh --eval 'db.slackconfigtokens.findOne({userId: ObjectId("...")})'

1. Store tokens for User A
2. Authenticate as User B
3. Attempt to read or use User A's config tokens (via any endpoint)
4. Verify isolation

curl -X GET ${API_URL}/slack/config-tokens -H 'Cookie: <session_user_B>'

1. Store initial tokens
2. Store new tokens for the same user
3. Verify DB has only the new tokens (upsert behavior)
4. Verify old tokens no longer work for app creation

1. Send 20 rapid POST requests to the token storage endpoint
2. Check for 429 responses
3. Verify no duplicate entries in DB

for i in $(seq 1 20); do
  curl -s -o /dev/null -w '%{http_code}\n' -X POST ${API_URL}/slack/config-tokens \
    -H 'Cookie: <session>' -H 'Content-Type: application/json' \
    -d '{"accessToken":"xoxe.xoxp-TOKEN","refreshToken":"xoxe-REFRESH"}'
done

1. Ensure valid config tokens are stored for the user
2. Send POST to create a Slack app for a specific agent
3. Verify response contains app_id, credentials, and oauth_authorize_url
4. Verify the app appears at api.slack.com/apps
5. Verify the app name matches the agent's display name
6. Verify manifest includes required scopes and event subscriptions

curl -X POST ${API_URL}/slack/create-app \
  -H 'Cookie: <session>' \
  -H 'Content-Type: application/json' \
  -d '{"agentId":"<agent_id>"}'

1. Authenticate as a user who has NOT stored config tokens
2. Attempt to create a Slack app
3. Verify clear error directing user to set up tokens first

curl -X POST ${API_URL}/slack/create-app \
  -H 'Cookie: <session_without_tokens>' \
  -H 'Content-Type: application/json' \
  -d '{"agentId":"<agent_id>"}'

1. Store valid config tokens
2. Wait >12 hours OR manually expire the access token in DB
3. Attempt to create a Slack app
4. Verify the API transparently calls tooling.tokens.rotate
5. Verify both new access and refresh tokens are stored in DB
6. Verify app creation succeeds with the refreshed token

# Simulate expired token in DB:
mongosh --eval 'db.users.updateOne(
  {email:"qa-agent@pazi.ai"},
  {$set:{"slackConfigTokens.expiresAt": new Date("2020-01-01")}}
)'
# Then try app creation — should auto-refresh

1. Store tokens with an intentionally invalid/expired refresh token
2. Expire the access token
3. Attempt to create a Slack app
4. Verify clear error message and no partial state

1. Create an agent named "🤖 My Super Agent With A Very Long Name!!!"
2. Attempt to create a Slack app for it
3. Verify the manifest name is sanitized (max 35 chars) and the slash command is valid

1. Authenticate as User A
2. Attempt to create a Slack app for an agent belonging to User B
3. Verify 403 Forbidden

curl -X POST ${API_URL}/slack/create-app \
  -H 'Cookie: <session_user_A>' \
  -H 'Content-Type: application/json' \
  -d '{"agentId":"<user_B_agent_id>"}'

1. Complete Slack app creation and installation
2. Verify a webhook endpoint exists that handles Slack events for this user
3. Send a Slack verification challenge to the webhook
4. Verify the webhook responds correctly
5. Verify the webhook rejects events from other users' workspaces

curl -X POST ${API_URL}/slack/webhook \
  -H 'Content-Type: application/json' \
  -d '{"type":"url_verification","challenge":"test_challenge_string"}'

1. Set up a channel where the agent bot is present
2. A new user joins the channel
3. Verify member_joined_channel event is received by webhook
4. Verify the new user is added to the agent's authorized users list
5. Verify the user can now DM the agent
6. Verify the authorization list persists across agent restarts

curl -X POST ${API_URL}/slack/webhook \
  -H 'Content-Type: application/json' \
  -d '{"type":"event_callback","event":{"type":"member_joined_channel","user":"U_NEW","channel":"C_AGENT"}}'

1. Have an authorized user (from channel join) leave the channel
2. Attempt to DM the agent from that user
3. Document the behavior: is authorization revoked or preserved?

1. From a Slack user who is NOT authorized (not the creator, not in any shared channel), send a DM to the agent
2. Verify the rejection message is sent
3. Verify the message is NOT processed by the agent
4. Check agent logs for the rejection

1. From the agent creator's Slack account, DM the agent
2. Verify the agent processes the message and responds normally
3. Verify no rejection message is shown

1. Check the agent's registered tools via API or agent config
2. Verify "Connect Slack" (or equivalent) is in the list
3. Verify the tool can be invoked

curl -X GET ${API_URL}/agents/<agentId>/tools -H 'Cookie: <session>'

1. Navigate to /login
2. Log in with qa-agent@pazi.ai / PaziQA2026!
3. Create a new agent or select an existing one
4. Click "Agent setup" in the left sidebar (gear icon)
5. Find the Slack section and click "Connect Slack"
6. Observe the setup instructions

1. Navigate to Slack connection setup
2. Enter a valid App Configuration Access Token
3. Enter a valid Refresh Token
4. Click submit/save
5. Observe the response: tokens saved, app created, authorize URL presented

1. Complete PW-1.2 (tokens submitted, app created)
2. Look for an authorization button/link
3. Click it
4. Verify Slack OAuth consent screen loads at slack.com/oauth/v2/authorize?...

1. Log in with account that already has stored config tokens
2. Create a second agent named "Support Bot"
3. Click "Connect Slack" for the new agent
4. Observe: should NOT ask for tokens again

1. After PW-2.1, go to api.slack.com/apps
2. Find the newly created app
3. Verify name and icon

1. Navigate to Slack config token setup
2. Leave both fields empty → observe submit button (should be disabled)
3. Fill access token only → observe (should be disabled)
4. Fill refresh token only → observe (should be disabled)
5. Fill both → observe (should be enabled)

1. Navigate to the token setup form
2. Type a token value in the access token field
3. Observe: field should show dots/bullets, not plaintext

1. Fill in valid config tokens
2. Rapidly double-click the submit button
3. Observe: only 1 request, button shows "Connecting..." and is disabled

1. Complete Slack app setup and installation
2. From creator's Slack: DM the agent with "Hello, are you working?"
3. Verify normal agent response
4. From unauthorized Slack user: DM the agent with "Hey can you help me?"
5. Verify rejection message

1. Create channel #test-agent-channel
2. Invite the agent bot to the channel
3. Invite a second user (previously unauthorized)
4. From the second user, DM the agent
5. Verify normal response (no rejection)

1. From unauthorized Slack user, send 5 DMs within 10 seconds
2. Count rejection messages received

1. Store invalid/expired config tokens
2. Trigger app creation
3. Observe error message

1. Start Connect Slack flow
2. Simulate network issue during API call
3. Observe: should not hang forever

1. Open dashboard chat with an agent
2. Type "Connect to Slack"
3. Observe: agent should invoke the Connect Slack tool
4. If tokens exist: proceeds to app creation
5. If no tokens: guides user through token setup

1. Log in with account that has existing old-style Slack connection (bot + app tokens)
2. Navigate to Slack config / Agent setup
3. Verify existing connection still works
4. Verify edit flow still shows bot/app token fields
5. Send a Slack message to the agent and confirm it responds

1. Before deploying, snapshot existing user's Slack config in DB
2. Deploy PAZ-297
3. Re-check the same user's DB record
4. Verify no token fields were deleted or overwritten

1. Set viewport to 375×812 (iPhone)
2. Navigate to Slack connection setup
3. Verify all elements visible and usable

1. Enter tokens in the setup form (don't submit)
2. Refresh the page (F5)
3. Observe: fields should be empty

1. Complete full Slack setup (tokens → app → install → working DMs)
2. Restart the agent via gateway restart or settings
3. Send a DM to the agent via Slack
4. Verify response