From 91eb41bd15e8b3efcf75bf01b412293400826546 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?= <81782+aureliensibiril@users.noreply.github.com> Date: Wed, 8 Apr 2026 16:51:32 +0200 Subject: [PATCH] Add Slack access review scopes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Slack has two OAuth2 use cases in the app: the compliance page integration (chat:write, channels:join, incoming-webhook) and the access review driver that lists workspace members via users.list (users:read, users:read.email). The per-caller scope refactor already handled the compliance page but missed the access review path, leaving it silently broken (zero scopes → missing_scope from Slack API). Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com> --- pkg/accessreview/drivers/oauth2_scopes.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/accessreview/drivers/oauth2_scopes.go b/pkg/accessreview/drivers/oauth2_scopes.go index 84031c8c3..b77b973f1 100644 --- a/pkg/accessreview/drivers/oauth2_scopes.go +++ b/pkg/accessreview/drivers/oauth2_scopes.go @@ -27,6 +27,7 @@ var providerOAuth2Scopes = map[coredata.ConnectorProvider][]string{ coredata.ConnectorProviderBrex: {"openid", "offline_access"}, coredata.ConnectorProviderDocuSign: {"signature"}, coredata.ConnectorProviderLinear: {"read"}, + coredata.ConnectorProviderSlack: {"users:read", "users:read.email"}, coredata.ConnectorProviderGoogleWorkspace: { "https://www.googleapis.com/auth/admin.directory.user.readonly", "https://www.googleapis.com/auth/admin.directory.group.member.readonly",