Add slack integration

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/connector.go

@@ -31,33 +31,230 @@ import (
 
 type (
 	Connector struct {
-		ID                  gid.GID                `db:"id"`
-		OrganizationID      gid.GID                `db:"organization_id"`
-		Name                string                 `db:"name"`
-		Type                connector.ProtocolType `db:"type"`
-		Connection          connector.Connection   `db:"-"`
-		EncryptedConnection []byte                 `db:"encrypted_connection"`
-		CreatedAt           time.Time              `db:"created_at"`
-		UpdatedAt           time.Time              `db:"updated_at"`
+		ID                  gid.GID              `db:"id"`
+		OrganizationID      gid.GID              `db:"organization_id"`
+		Provider            ConnectorProvider    `db:"provider"`
+		Protocol            ConnectorProtocol    `db:"protocol"`
+		Settings            map[string]any       `db:"settings"`
+		Connection          connector.Connection `db:"-"`
+		EncryptedConnection []byte               `db:"encrypted_connection"`
+		CreatedAt           time.Time            `db:"created_at"`
+		UpdatedAt           time.Time            `db:"updated_at"`
 	}
 
 	Connectors []*Connector
 )
 
-func (c *Connectors) LoadWithoutDecryptedConnectionByOrganizationID(
+func (c *Connector) CursorKey(orderBy ConnectorOrderField) page.CursorKey {
+	switch orderBy {
+	case ConnectorOrderFieldCreatedAt:
+		return page.CursorKey{ID: c.ID, Value: c.CreatedAt}
+	case ConnectorOrderFieldProvider:
+		return page.CursorKey{ID: c.ID, Value: c.Provider}
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (c *Connectors) LoadByOrganizationID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[ConnectorOrderField],
 	encryptionKey cipher.EncryptionKey,
+	filter *ConnectorProviderFilter,
+) error {
+	if err := c.loadByOrganizationIDWithPagination(ctx, conn, scope, organizationID, cursor, filter); err != nil {
+		return fmt.Errorf("cannot load connectors by organization ID: %w", err)
+	}
+
+	if err := c.decryptConnections(encryptionKey); err != nil {
+		return fmt.Errorf("cannot decrypt connections: %w", err)
+	}
+
+	return nil
+}
+
+func (c *Connectors) LoadAllByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	if err := c.loadAllByOrganizationID(ctx, conn, scope, organizationID); err != nil {
+		return fmt.Errorf("cannot load all connectors by organization ID: %w", err)
+	}
+
+	if err := c.decryptConnections(encryptionKey); err != nil {
+		return fmt.Errorf("cannot decrypt connections: %w", err)
+	}
+
+	return nil
+}
+
+func (c *Connectors) LoadAllByOrganizationIDProtocolAndProvider(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	protocol ConnectorProtocol,
+	provider ConnectorProvider,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	if err := c.loadAllByOrganizationIDProtocolAndProvider(ctx, conn, scope, organizationID, protocol, provider); err != nil {
+		return fmt.Errorf("cannot load all connectors by organization ID, protocol and provider: %w", err)
+	}
+
+	if err := c.decryptConnections(encryptionKey); err != nil {
+		return fmt.Errorf("cannot decrypt connections: %w", err)
+	}
+
+	return nil
+}
+
+func (c *Connectors) LoadByOrganizationIDWithoutDecryptedConnection(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[ConnectorOrderField],
+	filter *ConnectorProviderFilter,
+) error {
+	return c.loadByOrganizationIDWithPagination(ctx, conn, scope, organizationID, cursor, filter)
+}
+
+func (c *Connectors) LoadAllByOrganizationIDWithoutDecryptedConnection(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	return c.loadAllByOrganizationID(ctx, conn, scope, organizationID)
+}
+
+func (c *Connector) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	q := `
+INSERT INTO connectors (
+	id,
+	tenant_id,
+	organization_id,
+	provider,
+	protocol,
+	settings,
+	encrypted_connection,
+	created_at,
+	updated_at
+) VALUES (
+	@id,
+	@tenant_id,
+	@organization_id,
+	@provider,
+	@protocol,
+	@settings,
+	@encrypted_connection,
+	@created_at,
+	@updated_at
+)
+`
+
+	if c.Connection == nil {
+		return fmt.Errorf("connection is nil")
+	}
+
+	c.extractSlackSettings()
+
+	connection, err := json.Marshal(c.Connection)
+	if err != nil {
+		return fmt.Errorf("cannot marshal connection: %w", err)
+	}
+
+	encryptedConnection, err := cipher.Encrypt(connection, encryptionKey)
+	if err != nil {
+		return fmt.Errorf("cannot encrypt connection: %w", err)
+	}
+
+	args := pgx.StrictNamedArgs{
+		"id":                   c.ID,
+		"tenant_id":            scope.GetTenantID(),
+		"organization_id":      c.OrganizationID,
+		"provider":             c.Provider,
+		"protocol":             c.Protocol,
+		"settings":             c.Settings,
+		"encrypted_connection": encryptedConnection,
+		"created_at":           c.CreatedAt,
+		"updated_at":           c.UpdatedAt,
+	}
+
+	_, err = conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert connector: %w", err)
+	}
+
+	c.EncryptedConnection = encryptedConnection
+	c.populateSlackSettings()
+
+	return nil
+}
+
+func (c *Connector) populateSlackSettings() {
+	if c.Provider != ConnectorProviderSlack {
+		return
+	}
+
+	slackConn, ok := c.Connection.(*connector.SlackConnection)
+	if !ok {
+		return
+	}
+
+	if channel, ok := c.Settings["channel"].(string); ok {
+		slackConn.Settings.Channel = channel
+	}
+	if channelID, ok := c.Settings["channel_id"].(string); ok {
+		slackConn.Settings.ChannelID = channelID
+	}
+}
+
+func (c *Connector) extractSlackSettings() {
+	if c.Provider != ConnectorProviderSlack {
+		return
+	}
+
+	slackConn, ok := c.Connection.(*connector.SlackConnection)
+	if !ok {
+		return
+	}
+
+	c.Settings = make(map[string]any)
+	if slackConn.Settings.Channel != "" {
+		c.Settings["channel"] = slackConn.Settings.Channel
+	}
+	if slackConn.Settings.ChannelID != "" {
+		c.Settings["channel_id"] = slackConn.Settings.ChannelID
+	}
+}
+
+func (c *Connectors) loadByOrganizationIDWithPagination(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[ConnectorOrderField],
+	filter *ConnectorProviderFilter,
 ) error {
 	q := `
 SELECT
     id,
     organization_id,
-    name,
-    type,
+    provider,
+    protocol,
+    settings,
     encrypted_connection,
 	created_at,
 	updated_at
@@ -67,12 +264,14 @@ WHERE
 	%s
     AND organization_id = @organization_id
 	AND %s
+	AND %s
 `
 
-	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
 
 	args := pgx.StrictNamedArgs{"organization_id": organizationID}
 	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
@@ -90,110 +289,122 @@ WHERE
 	return nil
 }
 
-func (c *Connector) CursorKey(orderBy ConnectorOrderField) page.CursorKey {
-	switch orderBy {
-	case ConnectorOrderFieldCreatedAt:
-		return page.CursorKey{ID: c.ID, Value: c.CreatedAt}
-	case ConnectorOrderFieldName:
-		return page.CursorKey{ID: c.ID, Value: c.Name}
-	}
-
-	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
-}
-
-func (c *Connector) Upsert(
+func (c *Connectors) loadAllByOrganizationID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	encryptionKey cipher.EncryptionKey,
+	organizationID gid.GID,
 ) error {
 	q := `
-INSERT INTO
-    connectors (
-        id,
-        tenant_id,
-        organization_id,
-        name,
-        type,
-        encrypted_connection,
-        created_at,
-        updated_at
-    )
-VALUES (
-    @id,
-    @tenant_id,
-    @organization_id,
-    @name,
-    @type,
-    @encrypted_connection,
-    @created_at,
-    @updated_at
-)
-ON CONFLICT (organization_id, name) DO UPDATE SET
-    tenant_id = @tenant_id,
-    organization_id = @organization_id,
-    type = @type,
-    encrypted_connection = @encrypted_connection,
-    updated_at = @updated_at
-RETURNING
+SELECT
     id,
     organization_id,
-    name,
-    type,
+    provider,
+    protocol,
+    settings,
     encrypted_connection,
 	created_at,
 	updated_at
+FROM
+    connectors
+WHERE
+	%s
+    AND organization_id = @organization_id
+ORDER BY
+	created_at ASC
 `
 
-	if c.Connection == nil {
-		return fmt.Errorf("connection is nil")
-	}
+	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	connection, err := json.Marshal(c.Connection)
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot marshal connection: %w", err)
+		return fmt.Errorf("cannot query connectors: %w", err)
 	}
 
-	encryptedConnection, err := cipher.Encrypt(connection, encryptionKey)
-	if err != nil {
-		return fmt.Errorf("cannot encrypt connection: %w", err)
-	}
-
-	rows, err := conn.Query(
-		ctx,
-		q,
-		pgx.StrictNamedArgs{
-			"id":                   c.ID,
-			"tenant_id":            scope.GetTenantID(),
-			"organization_id":      c.OrganizationID,
-			"name":                 c.Name,
-			"type":                 c.Type,
-			"encrypted_connection": encryptedConnection,
-			"created_at":           c.CreatedAt,
-			"updated_at":           c.UpdatedAt,
-		},
-	)
-	if err != nil {
-		return err
-	}
-	defer rows.Close()
-
-	cnnctr, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Connector])
+	connectors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Connector])
 	if err != nil {
 		return fmt.Errorf("cannot collect connectors: %w", err)
 	}
 
-	decryptedConnection, err := cipher.Decrypt(cnnctr.EncryptedConnection, encryptionKey)
-	if err != nil {
-		return fmt.Errorf("cannot decrypt connection: %w", err)
-	}
-
-	cnnctr.Connection, err = connector.UnmarshalConnection(cnnctr.Type, decryptedConnection)
-	if err != nil {
-		return fmt.Errorf("cannot unmarshal connection: %w", err)
-	}
-
-	*c = cnnctr
+	*c = connectors
+
+	return nil
+}
+
+func (c *Connectors) loadAllByOrganizationIDProtocolAndProvider(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	protocol ConnectorProtocol,
+	provider ConnectorProvider,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    provider,
+    protocol,
+    settings,
+    encrypted_connection,
+	created_at,
+	updated_at
+FROM
+    connectors
+WHERE
+	%s
+    AND organization_id = @organization_id
+    AND protocol = @protocol
+    AND provider = @provider
+ORDER BY
+	created_at ASC
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"organization_id": organizationID,
+		"protocol":        protocol,
+		"provider":        provider,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query connectors: %w", err)
+	}
+
+	connectors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Connector])
+	if err != nil {
+		return fmt.Errorf("cannot collect connectors: %w", err)
+	}
+
+	*c = connectors
+
+	return nil
+}
+
+func (c *Connectors) decryptConnections(encryptionKey cipher.EncryptionKey) error {
+	for _, cnnctr := range *c {
+		if len(cnnctr.EncryptedConnection) == 0 {
+			continue
+		}
+
+		decryptedConnection, err := cipher.Decrypt(cnnctr.EncryptedConnection, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt connection for %s: %w", cnnctr.Provider, err)
+		}
+
+		cnnctr.Connection, err = connector.UnmarshalConnection(cnnctr.Protocol.String(), cnnctr.Provider.String(), decryptedConnection)
+		if err != nil {
+			return fmt.Errorf("cannot unmarshal connection for %s: %w", cnnctr.Provider, err)
+		}
+
+		cnnctr.populateSlackSettings()
+	}
 
 	return nil
 }

pkg/coredata/connector_order_field.go

@@ -20,7 +20,7 @@ type (
 
 const (
 	ConnectorOrderFieldCreatedAt ConnectorOrderField = "CREATED_AT"
-	ConnectorOrderFieldName      ConnectorOrderField = "NAME"
+	ConnectorOrderFieldProvider  ConnectorOrderField = "PROVIDER"
 )
 
 func (p ConnectorOrderField) Column() string {

pkg/coredata/connector_protocol.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ConnectorProtocol string
+
+const (
+	ConnectorProtocolOAuth2 ConnectorProtocol = "OAUTH2"
+)
+
+func (cp ConnectorProtocol) String() string {
+	return string(cp)
+}
+
+func (cp *ConnectorProtocol) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ConnectorProtocol: %T", value)
+	}
+
+	switch s {
+	case "OAUTH2":
+		*cp = ConnectorProtocolOAuth2
+	default:
+		return fmt.Errorf("invalid ConnectorProtocol value: %q", s)
+	}
+	return nil
+}
+
+func (cp ConnectorProtocol) Value() (driver.Value, error) {
+	return cp.String(), nil
+}

pkg/coredata/connector_provider.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ConnectorProvider string
+
+const (
+	ConnectorProviderSlack ConnectorProvider = "SLACK"
+)
+
+func (cp ConnectorProvider) String() string {
+	return string(cp)
+}
+
+func (cp *ConnectorProvider) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ConnectorProvider: %T", value)
+	}
+
+	switch s {
+	case "SLACK":
+		*cp = ConnectorProviderSlack
+	default:
+		return fmt.Errorf("invalid ConnectorProvider value: %q", s)
+	}
+	return nil
+}
+
+func (cp ConnectorProvider) Value() (driver.Value, error) {
+	return cp.String(), nil
+}

pkg/coredata/connector_provider_filter.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"github.com/jackc/pgx/v5"
+)
+
+type (
+	ConnectorProviderFilter struct {
+		provider *ConnectorProvider
+	}
+)
+
+func NewConnectorProviderFilter(provider *ConnectorProvider) *ConnectorProviderFilter {
+	return &ConnectorProviderFilter{
+		provider: provider,
+	}
+}
+
+func (f *ConnectorProviderFilter) SQLArguments() pgx.NamedArgs {
+	args := pgx.NamedArgs{}
+
+	if f.provider != nil {
+		args["provider"] = *f.provider
+	}
+
+	return args
+}
+
+func (f *ConnectorProviderFilter) SQLFragment() string {
+	return `
+(
+	CASE
+		WHEN @provider::connector_provider IS NULL THEN
+			TRUE
+		ELSE
+			provider = @provider::connector_provider
+	END
+)
+	`
+}

pkg/coredata/entity_type_reg.go

@@ -61,4 +61,5 @@ const (
 	CustomDomainEntityType
 	InvitationEntityType
 	MembershipEntityType
+	SlackMessageEntityType
 )

pkg/coredata/migrations/20251016T174950Z.sql

@@ -0,0 +1,25 @@
+CREATE TYPE connector_protocol AS ENUM ('OAUTH2');
+CREATE TYPE connector_provider AS ENUM ('SLACK');
+
+ALTER TABLE connectors DROP COLUMN type;
+ALTER TABLE connectors DROP COLUMN name;
+
+ALTER TABLE connectors ADD COLUMN protocol connector_protocol NOT NULL;
+ALTER TABLE connectors ADD COLUMN provider connector_provider NOT NULL;
+ALTER TABLE connectors ADD COLUMN settings JSONB;
+
+DROP INDEX IF EXISTS idx_connectors_organization_id_name;
+
+CREATE TABLE slack_messages (
+	id TEXT PRIMARY KEY,
+	tenant_id TEXT NOT NULL,
+	organization_id TEXT NOT NULL,
+	body TEXT NOT NULL,
+	created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+	updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+	sent_at TIMESTAMP WITH TIME ZONE,
+	error TEXT,
+	CONSTRAINT fk_slack_messages_organization_id FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE
+);
+
+CREATE INDEX ON slack_messages (sent_at) WHERE sent_at IS NULL AND error IS NULL;

pkg/coredata/slack_message.go

@@ -0,0 +1,143 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	SlackMessage struct {
+		ID             gid.GID    `db:"id"`
+		OrganizationID gid.GID    `db:"organization_id"`
+		Body           string     `db:"body"`
+		CreatedAt      time.Time  `db:"created_at"`
+		UpdatedAt      time.Time  `db:"updated_at"`
+		SentAt         *time.Time `db:"sent_at"`
+		Error          *string    `db:"error"`
+	}
+
+	ErrNoUnsentSlackMessage struct{}
+)
+
+func (e ErrNoUnsentSlackMessage) Error() string {
+	return "no unsent slack message found"
+}
+
+func NewSlackMessage(
+	scope Scoper,
+	organizationID gid.GID,
+	body string,
+) *SlackMessage {
+	now := time.Now()
+	return &SlackMessage{
+		ID:             gid.New(scope.GetTenantID(), SlackMessageEntityType),
+		OrganizationID: organizationID,
+		Body:           body,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+}
+
+func (s *SlackMessage) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO slack_messages (id, tenant_id, organization_id, body, created_at, updated_at)
+VALUES (@id, @tenant_id, @organization_id, @body, @created_at, @updated_at)
+	`
+
+	args := pgx.StrictNamedArgs{
+		"id":              s.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": s.OrganizationID,
+		"body":            s.Body,
+		"created_at":      s.CreatedAt,
+		"updated_at":      s.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert slack message: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SlackMessage) LoadNextUnsentForUpdate(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+SELECT id, organization_id, body, created_at, updated_at, sent_at, error
+FROM slack_messages
+WHERE sent_at IS NULL AND error IS NULL
+ORDER BY created_at ASC
+LIMIT 1
+FOR UPDATE
+	`
+
+	rows, err := conn.Query(ctx, q)
+	if err != nil {
+		return fmt.Errorf("cannot query slack messages: %w", err)
+	}
+
+	message, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SlackMessage])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrNoUnsentSlackMessage{}
+		}
+
+		return fmt.Errorf("cannot collect slack message: %w", err)
+	}
+
+	*s = message
+
+	return nil
+}
+
+func (s *SlackMessage) Update(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+UPDATE slack_messages
+SET sent_at = @sent_at, updated_at = @updated_at, error = @error
+WHERE id = @id
+	`
+
+	args := pgx.StrictNamedArgs{
+		"id":         s.ID,
+		"sent_at":    s.SentAt,
+		"updated_at": s.UpdatedAt,
+		"error":      s.Error,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update slack message: %w", err)
+	}
+
+	return nil
+}