fix(slack): require bot name; propagate rotated bot_user_id to webhooks on reconnect

- the setup wizard now requires a bot name (canAdvance), so the credential name,
  manifest app name, and uniqueness key all use the user's choice instead of the
  shared Slack team-name fallback that collided for a second bot in one workspace
- reconnect that changes the bot user id (recreated Slack app) now updates the
  bot_user_id cached in each bound webhook's providerConfig, so reaction
  self-drop keeps working instead of letting the bot's own reactions re-enter

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal.tsx

@@ -200,7 +200,10 @@ export function ConnectSlackBotModal({
       title={isReconnect ? 'Reconnect a custom Slack bot' : 'Create a custom Slack bot'}
       doneLabel='Done'
     >
-      <Wizard.Step title='Configure your bot'>
+      {/* Bot name is required so the credential name, the manifest app name, and
+          uniqueness all use the user's choice — never the shared Slack team name
+          fallback, which collides for a second bot in the same workspace. */}
+      <Wizard.Step title='Configure your bot' canAdvance={appName.trim().length > 0}>
         <StepConfigure
           appName={appName}
           onAppNameChange={setAppName}

apps/sim/lib/credentials/orchestration/index.ts

@@ -1,9 +1,9 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { credential, environment, workspaceEnvironment } from '@sim/db/schema'
+import { credential, environment, webhook, workspaceEnvironment } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { eq } from 'drizzle-orm'
+import { and, eq, sql } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { getCredentialActorContext } from '@/lib/credentials/access'
@@ -124,6 +124,7 @@ export async function performUpdateCredential(
       params.botToken !== undefined ||
       params.apiToken !== undefined ||
       params.domain !== undefined
+    let rotatedSlackBotUserId: string | undefined
     if (hasRotationSecret && access.credential.type === 'service_account') {
       try {
         const secret = await verifyAndBuildServiceAccountSecret(
@@ -136,6 +137,7 @@ export async function performUpdateCredential(
           }
         )
         updates.encryptedServiceAccountKey = secret.encryptedServiceAccountKey
+        rotatedSlackBotUserId = secret.botUserId
       } catch (error) {
         if (error instanceof ServiceAccountSecretError) {
           return { success: false, error: error.message, errorCode: 'validation' }
@@ -169,6 +171,20 @@ export async function performUpdateCredential(
     updates.updatedAt = new Date()
     await db.update(credential).set(updates).where(eq(credential.id, params.credentialId))
 
+    // Reconnecting to a recreated Slack app changes the bot user id, but each
+    // deployed webhook cached the old one at deploy for reaction self-drop.
+    // Propagate the rotated id to the credential's live custom-bot webhooks so
+    // the bot's own reactions keep being dropped (a stale id lets them re-enter).
+    if (rotatedSlackBotUserId) {
+      await db
+        .update(webhook)
+        .set({
+          providerConfig: sql`jsonb_set((${webhook.providerConfig})::jsonb, '{bot_user_id}', to_jsonb(${rotatedSlackBotUserId}::text))::json`,
+          updatedAt: new Date(),
+        })
+        .where(and(eq(webhook.provider, 'slack'), eq(webhook.routingKey, params.credentialId)))
+    }
+
     const updatedFields = Object.keys(updates).filter((key) => key !== 'updatedAt')
     recordAudit({
       workspaceId: access.credential.workspaceId,

apps/sim/lib/credentials/service-account-secret.test.ts

@@ -59,6 +59,7 @@ describe('verifyAndBuildServiceAccountSecret', () => {
     expect(result.providerId).toBe(SLACK_CUSTOM_BOT_PROVIDER_ID)
     expect(result.displayName).toBe('Acme')
     expect(result.auditMetadata.slackTeamId).toBe('T1')
+    expect(result.botUserId).toBe('U_BOT')
     const blob = JSON.parse(result.encryptedServiceAccountKey)
     expect(blob).toMatchObject({
       signingSecret: 'sec',

apps/sim/lib/credentials/service-account-secret.ts

@@ -29,6 +29,8 @@ export interface ServiceAccountSecretResult {
   encryptedServiceAccountKey: string
   displayName: string
   auditMetadata: Record<string, string>
+  /** Slack custom bot: the derived bot user id (for reaction self-drop). */
+  botUserId?: string
 }
 
 /** Thrown when a service-account secret is missing or fails provider verification. */
@@ -114,6 +116,7 @@ export async function verifyAndBuildServiceAccountSecret(
       encryptedServiceAccountKey: encrypted,
       displayName: teamName || 'Slack bot',
       auditMetadata: { slackTeamId: teamId },
+      botUserId,
     }
   }