Fix Slack shared workspace returning wrong user's token

[damianloch]

Summary

• When multiple Aurora orgs share a Slack workspace, _lookup_slack_token was short-circuiting on the first org with a match
• If user A (org 1) and user B (org 2) both connected the same Slack workspace, and the iteration found org 1 first, user B would always get "not authenticated"
• Fix: collect all matching tokens across all orgs instead of returning the first match

Root Cause

_lookup_slack_token had if results: return results inside the org loop, so it never checked subsequent orgs for the same team_id.

Test plan

• Deploy and verify @aurora mention works for users in shared workspaces

Summary by CodeRabbit

Release Notes

Bug Fixes

• Enhanced Slack integration's token lookup functionality to properly aggregate matching tokens across all organizations instead of stopping at the first result, significantly improving support for users managing multi-organization environments.
• Improved error handling to return accumulated results when available, rather than discarding partial matches.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 32c92fb7-559e-4409-90ea-39a7d95ac263

📥 Commits

Reviewing files that changed from the base of the PR and between ec11e5c and 202328a.

📒 Files selected for processing (1)

• server/routes/slack/slack_events_helpers.py

---

Walkthrough

_lookup_slack_token in slack_events_helpers.py is modified to aggregate Slack token query results across all organizations rather than returning on the first non-empty result. An all_results accumulator is introduced, each org's results are extended into it, and the function returns all_results instead of [] when all lookups fail.

Changes

Cross-org Slack token aggregation

Layer / File(s)	Summary
Cross-org result accumulation in _lookup_slack_token server/routes/slack/slack_events_helpers.py	Docstring updated to reflect cross-org behavior; all_results list initialized after org_ids resolution; per-org results accumulated via extend instead of early return; final return changed from [] to all_results, with warning still logged when every org lookup fails.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related PRs

• Arvo-AI/aurora#510: Modifies the same _lookup_slack_token function in slack_events_helpers.py, changing how Slack token lookups are performed across organizations.

Poem

🐇 Hopping org to org, I gather every clue,
No longer stop at one — I search the whole queue!
all_results grows long as I extend my list,
Not a single token from any org gets missed.
The warning still rings out when every lookup fails,
But now I return what I found before the trail goes stale! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly addresses the main bug fix: enabling proper token lookup for users in shared Slack workspaces by aggregating tokens across organizations instead of returning on first match.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/slack-events-rls-bypass-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[aurora-test-app1]

Superseded by updated review

Aurora Risk Review

Verdict: RISKY

The fix correctly resolves the multi-org token lookup bug, but the implementation introduces an unbounded per-org DB fan-out and per-user Vault secret read on every Slack webhook event. In a multi-tenant SaaS deployment with many orgs, this will cause Slack's 3-second response deadline to be breached under load, triggering retries and duplicate event processing. The Vault read amplification also risks exhausting secret-backend rate limits.

Findings

#	Severity	File	Finding
1	HIGH	server/routes/slack/slack_events_helpers.py:83	Unbounded per-org DB fan-out on every Slack webhook event risks 3-second timeout and retry storm
2	HIGH	server/routes/slack/slack_events_helpers.py:170	Per-user Vault secret read for every org's tokens amplifies secret-backend load on the authentication hot path
3	MEDIUM	server/routes/slack/slack_events_helpers.py:155	Non-deterministic workspace credential selection in `get_user_id_from_slack_team` after aggregation

---

Aurora reviews PRs for incident prevention. This is advisory only and does not block merge.

[aurora-test-app1]

🔍 Aurora is reviewing this PR for incident risk. This usually takes a minute or two — findings will appear as a review when it's done.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[aurora-test-app1]

Aurora Risk Review

Verdict: RISKY

This PR correctly fixes the multi-org token aggregation bug, but all three prior HIGH/MEDIUM infrastructure findings remain unaddressed. The per-org DB fan-out on every Slack webhook event still risks Slack's 3-second timeout and a retry storm, and the Vault secret read loop in get_user_id_from_slack_user is now exercised over a larger result set (all orgs, not just the first matching one), amplifying secret-backend load on the authentication hot path.

Findings

#	Severity	File	Finding
1	HIGH	server/routes/slack/slack_events_helpers.py:83	Unbounded per-org DB fan-out on every Slack webhook event risks 3-second timeout and retry storm
2	HIGH	server/routes/slack/slack_events_helpers.py:170	Per-user Vault secret read for every org's tokens amplifies secret-backend load — now worse after aggregation
3	MEDIUM	server/routes/slack/slack_events_helpers.py:155	Non-deterministic workspace credential selection in get_user_id_from_slack_team after aggregation

---

Aurora reviews PRs for incident prevention. This is advisory only and does not block merge.

[aurora-test-app1]

[HIGH] Unbounded per-org DB fan-out on every Slack webhook event risks 3-second timeout and retry storm

_lookup_slack_token still opens one DB admin connection per org (via _get_all_org_ids() → SELECT DISTINCT org_id FROM users) on every @aurora mention and every button click. With N orgs, each Slack event triggers N+1 sequential DB round-trips before a response is returned. Slack requires a 200 OK within 3 seconds or it retries — repeated retries under load will compound the fan-out. This PR's fix does not change the loop structure; it only changes what is done with results inside the loop, leaving the fan-out fully intact.