the scope was granted to the user token, not the bot

"""Compare a Slack app's two tokens and find scopes granted to the wrong one.

Read only. Two GET requests and nothing else. This script holds both halves of
an app's install at once, so it must not be able to act with either; the repair
is printed for a human to run.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("slack_token_identity_split")

API = "https://slack.com/api/"

# Scopes Slack offers on one list only. When the scope you need is one of these,
# "move it to the other list" is not an available repair and the calling code has
# to change instead. Not exhaustive; it is the set that shows up in this bug.
USER_ONLY = {
    "search:read", "search:read.files", "search:read.messages",
    "users.profile:write", "identity.basic", "identity.email",
    "identity.avatar", "identity.team", "stars:read", "dnd:write:user",
}
BOT_ONLY = {
    "app_mentions:read", "commands", "incoming-webhook", "workflow.steps:execute",
}


def scope_set(header):
    """X-OAuth-Scopes as a frozenset. Pure.

    Slack returns one comma-joined string on every response. Some proxies strip
    it, so an absent header means "unknown" and must never be read as "none" --
    that reading turns a missing header into a full sheet of false findings.
    """
    if not header:
        return frozenset()
    return frozenset(s.strip() for s in header.split(",") if s.strip())


def identity_kind(body):
    """Which of the two token classes answered auth.test. Pure.

    A bot token's response carries bot_id; a user token's does not. Both carry a
    user_id beginning U or W, and on a bot token that id is the bot user, which
    is why the id alone cannot tell them apart.
    """
    if body.get("ok") is not True:
        return "unusable"
    return "bot" if body.get("bot_id") else "user"


def split(bot_scopes, user_scopes):
    """The three-way comparison this whole audit rests on. Pure.

    Returns (both, bot_only, user_only). The last two are where every instance
    of this bug lives, and printing them usually ends the investigation.
    """
    return (tuple(sorted(bot_scopes & user_scopes)),
            tuple(sorted(bot_scopes - user_scopes)),
            tuple(sorted(user_scopes - bot_scopes)))


def side(scope):
    """Which of the two lists this scope can appear on at all. Pure."""
    if scope in USER_ONLY:
        return "user-only"
    if scope in BOT_ONLY:
        return "bot-only"
    return "either"


def verdict(scope, caller, caller_scopes, other_scopes):
    """Answer one question: is this scope on the token the failing code uses?

    `caller` is "bot" or "user" -- the identity the runtime code path
    authenticates as. Pure, so the whole truth table runs offline.
    """
    other = "user" if caller == "bot" else "bot"
    where = side(scope)
    held = scope in caller_scopes
    elsewhere = scope in other_scopes

    if held and elsewhere:
        return ("granted-twice",
                "both tokens hold %s. Nothing is broken, but the call site "
                "decides which identity acts, so make that choice explicit "
                "rather than leaving it to whichever variable was in scope."
                % scope)
    if held:
        return ("correct",
                "held by the %s token this code path calls with" % caller)
    if elsewhere:
        if where != "either":
            return ("wrong-side",
                    "%s is granted to the %s token, and it is a %s scope: it "
                    "cannot be moved. The %s code path has to authenticate "
                    "with the %s token instead." % (scope, other, where, caller, other))
        return ("wrong-side",
                "%s is granted to the %s token and this code path calls with "
                "the %s token. Reinstalling re-grants it to the same side, "
                "which is why the error never changed." % (scope, other, caller))
    if where != "either" and where != caller + "-only":
        return ("unobtainable",
                "%s is a %s scope and this code path calls with the %s token. "
                "It is not offered on the %s list, so request it on the %s "
                "side and switch the call." % (scope, where, caller, caller, other))
    return ("granted-nowhere",
            "neither token holds %s. This is an ordinary missing scope: add it "
            "to the %s list, reinstall, and replace the stored token." % (scope, caller))


def probe(session, token):
    """auth.test for one token. Returns (X-OAuth-Scopes, parsed body)."""
    r = session.get(API + "auth.test", headers={"Authorization": "Bearer " + token},
                    timeout=30)
    try:
        return r.headers.get("X-OAuth-Scopes"), r.json()
    except ValueError:
        return r.headers.get("X-OAuth-Scopes"), {"ok": False, "error": "unparseable_body"}


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--need", action="append", default=[],
                    help="a scope the failing call requires; repeatable")
    ap.add_argument("--caller", choices=("bot", "user"), default="bot",
                    help="which token the failing code path authenticates with")
    args = ap.parse_args()

    tokens = {"bot": os.environ.get("SLACK_BOT_TOKEN"),
              "user": os.environ.get("SLACK_USER_TOKEN")}
    if not tokens["bot"] and not tokens["user"]:
        log.error("set SLACK_BOT_TOKEN and SLACK_USER_TOKEN to the two halves of "
                  "one install (OAuth & Permissions shows both)")
        return 2

    s = requests.Session()
    scopes = {"bot": frozenset(), "user": frozenset()}
    bad = 0

    for role in ("bot", "user"):
        token = tokens[role]
        if not token:
            log.warning("%-16s %s", "token-absent",
                        "SLACK_%s_TOKEN is unset, so that side of the grant "
                        "cannot be read and findings about it are provisional"
                        % role.upper())
            bad += 1
            continue
        header, body = probe(s, token)
        kind = identity_kind(body)
        scopes[role] = scope_set(header)
        if kind == "unusable":
            log.warning("%-16s %s token: auth.test answered ok: false, error=%s",
                        "unusable", role, body.get("error") or "<no error field>")
            bad += 1
            continue
        if kind != role:
            bad += 1
            log.warning("%-16s SLACK_%s_TOKEN holds a %s token: auth.test %s a "
                        "bot_id. Half of this bug is a mislabelled variable.",
                        "mislabelled", role.upper(), kind,
                        "returned" if kind == "bot" else "returned no")
        log.info("%-16s %s token, team=%s, %d scope(s)%s", "identity", kind,
                 body.get("team_id"), len(scopes[role]),
                 "" if scopes[role] else " (X-OAuth-Scopes absent from the response)")

    both, bot_only, user_only = split(scopes["bot"], scopes["user"])
    log.info("%-16s %s", "on both", ", ".join(both) or "<none>")
    log.info("%-16s %s", "bot only", ", ".join(bot_only) or "<none>")
    log.info("%-16s %s", "user only", ", ".join(user_only) or "<none>")

    other = "user" if args.caller == "bot" else "bot"
    for scope in args.need:
        state, detail = verdict(scope, args.caller, scopes[args.caller], scopes[other])
        line = "%-16s %-22s %s" % (state, scope, detail)
        if state in ("correct", "granted-twice"):
            log.info(line)
            continue
        bad += 1
        log.warning(line)
        if state == "wrong-side":
            log.warning("  repair: decide which identity should act, then either move "
                        "the scope between the two lists and reinstall, or call with "
                        "the token that already holds it")
        else:
            log.warning("  repair: OAuth & Permissions -> %s Token Scopes, add the "
                        "scope, reinstall, replace the stored token",
                        "Bot" if args.caller == "bot" else "User")

    log.info("%d scope(s) checked, %d on the wrong token or unreadable",
             len(args.need), bad)
    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Compare a Slack app's two tokens and find scopes granted to the wrong one.
 *
 * Read only. Two GET requests and nothing else. This script holds both halves
 * of an app's install at once, so it must not be able to act with either; the
 * repair is printed for a human to run.
 */
const API = 'https://slack.com/api/';

// Scopes Slack offers on one list only. When the scope you need is one of
// these, "move it to the other list" is not an available repair and the calling
// code has to change instead. Not exhaustive; it is the set that shows up here.
export const USER_ONLY = new Set([
  'search:read', 'search:read.files', 'search:read.messages',
  'users.profile:write', 'identity.basic', 'identity.email',
  'identity.avatar', 'identity.team', 'stars:read', 'dnd:write:user',
]);
export const BOT_ONLY = new Set([
  'app_mentions:read', 'commands', 'incoming-webhook', 'workflow.steps:execute',
]);

/**
 * X-OAuth-Scopes as a Set. Pure. An absent header means "unknown" and must
 * never be read as "none": that reading turns a stripped header into a full
 * sheet of false findings.
 */
export function scopeSet(header) {
  if (!header) return new Set();
  return new Set(header.split(',').map((s) => s.trim()).filter(Boolean));
}

/**
 * Which of the two token classes answered auth.test. Pure. A bot token's
 * response carries bot_id; a user token's does not. Both carry a user_id, and
 * on a bot token that id is the bot user, so the id alone proves nothing.
 */
export function identityKind(body) {
  if (body?.ok !== true) return 'unusable';
  return body.bot_id ? 'bot' : 'user';
}

/**
 * The three-way comparison this whole audit rests on. Pure.
 * Returns [both, botOnly, userOnly].
 */
export function split(botScopes, userScopes) {
  const both = [...botScopes].filter((s) => userScopes.has(s)).sort();
  const botOnly = [...botScopes].filter((s) => !userScopes.has(s)).sort();
  const userOnly = [...userScopes].filter((s) => !botScopes.has(s)).sort();
  return [both, botOnly, userOnly];
}

/** Which of the two lists this scope can appear on at all. Pure. */
export function side(scope) {
  if (USER_ONLY.has(scope)) return 'user-only';
  if (BOT_ONLY.has(scope)) return 'bot-only';
  return 'either';
}

/**
 * Answer one question: is this scope on the token the failing code uses?
 * `caller` is "bot" or "user". Pure, so the truth table runs offline.
 */
export function verdict(scope, caller, callerScopes, otherScopes) {
  const other = caller === 'bot' ? 'user' : 'bot';
  const where = side(scope);
  const held = callerScopes.has(scope);
  const elsewhere = otherScopes.has(scope);

  if (held && elsewhere) {
    return ['granted-twice',
      `both tokens hold ${scope}. Nothing is broken, but the call site decides ` +
      'which identity acts, so make that choice explicit rather than leaving it ' +
      'to whichever variable was in scope.'];
  }
  if (held) {
    return ['correct', `held by the ${caller} token this code path calls with`];
  }
  if (elsewhere) {
    if (where !== 'either') {
      return ['wrong-side',
        `${scope} is granted to the ${other} token, and it is a ${where} scope: ` +
        `it cannot be moved. The ${caller} code path has to authenticate with ` +
        `the ${other} token instead.`];
    }
    return ['wrong-side',
      `${scope} is granted to the ${other} token and this code path calls with ` +
      `the ${caller} token. Reinstalling re-grants it to the same side, which is ` +
      'why the error never changed.'];
  }
  if (where !== 'either' && where !== `${caller}-only`) {
    return ['unobtainable',
      `${scope} is a ${where} scope and this code path calls with the ${caller} ` +
      `token. It is not offered on the ${caller} list, so request it on the ` +
      `${other} side and switch the call.`];
  }
  return ['granted-nowhere',
    `neither token holds ${scope}. This is an ordinary missing scope: add it to ` +
    `the ${caller} list, reinstall, and replace the stored token.`];
}

async function probe(token) {
  const res = await fetch(API + 'auth.test', {
    headers: { Authorization: `Bearer ${token}` },
  });
  const header = res.headers.get('x-oauth-scopes');
  try {
    return [header, await res.json()];
  } catch {
    return [header, { ok: false, error: 'unparseable_body' }];
  }
}

async function main() {
  const argv = process.argv.slice(2);
  const need = [];
  let caller = 'bot';
  for (let i = 0; i < argv.length; i += 1) {
    if (argv[i] === '--need') need.push(argv[i + 1]);
    if (argv[i] === '--caller') caller = argv[i + 1] === 'user' ? 'user' : 'bot';
  }

  const tokens = { bot: process.env.SLACK_BOT_TOKEN, user: process.env.SLACK_USER_TOKEN };
  if (!tokens.bot && !tokens.user) {
    console.error('set SLACK_BOT_TOKEN and SLACK_USER_TOKEN to the two halves of ' +
                  'one install (OAuth & Permissions shows both)');
    process.exitCode = 2;
    return;
  }

  const scopes = { bot: new Set(), user: new Set() };
  let bad = 0;

  for (const role of ['bot', 'user']) {
    const token = tokens[role];
    if (!token) {
      console.warn(`${'token-absent'.padEnd(16)} SLACK_${role.toUpperCase()}_TOKEN is ` +
        'unset, so that side of the grant cannot be read and findings about it ' +
        'are provisional');
      bad += 1;
      continue;
    }
    const [header, body] = await probe(token);
    const kind = identityKind(body);
    scopes[role] = scopeSet(header);
    if (kind === 'unusable') {
      console.warn(`${'unusable'.padEnd(16)} ${role} token: auth.test answered ` +
        `ok: false, error=${body?.error ?? '<no error field>'}`);
      bad += 1;
      continue;
    }
    if (kind !== role) {
      bad += 1;
      console.warn(`${'mislabelled'.padEnd(16)} SLACK_${role.toUpperCase()}_TOKEN holds ` +
        `a ${kind} token: auth.test ${kind === 'bot' ? 'returned' : 'returned no'} a ` +
        'bot_id. Half of this bug is a mislabelled variable.');
    }
    console.log(`${'identity'.padEnd(16)} ${kind} token, team=${body.team_id}, ` +
      `${scopes[role].size} scope(s)` +
      (scopes[role].size ? '' : ' (X-OAuth-Scopes absent from the response)'));
  }

  const [both, botOnly, userOnly] = split(scopes.bot, scopes.user);
  console.log(`${'on both'.padEnd(16)} ${both.join(', ') || '<none>'}`);
  console.log(`${'bot only'.padEnd(16)} ${botOnly.join(', ') || '<none>'}`);
  console.log(`${'user only'.padEnd(16)} ${userOnly.join(', ') || '<none>'}`);

  const other = caller === 'bot' ? 'user' : 'bot';
  for (const scope of need) {
    const [state, detail] = verdict(scope, caller, scopes[caller], scopes[other]);
    const line = `${state.padEnd(16)} ${String(scope).padEnd(22)} ${detail}`;
    if (state === 'correct' || state === 'granted-twice') {
      console.log(line);
      continue;
    }
    bad += 1;
    console.warn(line);
    if (state === 'wrong-side') {
      console.warn('  repair: decide which identity should act, then either move the ' +
        'scope between the two lists and reinstall, or call with the token that ' +
        'already holds it');
    } else {
      console.warn('  repair: OAuth & Permissions -> ' +
        `${caller === 'bot' ? 'Bot' : 'User'} Token Scopes, add the scope, ` +
        'reinstall, replace the stored token');
    }
  }

  console.log(`${need.length} scope(s) checked, ${bad} on the wrong token or unreadable`);
  process.exitCode = bad ? 1 : 0;
}

// Only run when invoked directly, so importing this module in the tests does not
// execute main() and fail the file on a missing token.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from slack_token_identity_split import identity_kind, scope_set, side, split, verdict


def test_scope_header_absent_is_unknown_not_empty():
    assert scope_set(None) == frozenset()
    assert scope_set("channels:read, users:read ,") == frozenset(
        {"channels:read", "users:read"})


def test_bot_id_is_the_only_discriminator():
    assert identity_kind({"ok": True, "user_id": "U1", "bot_id": "B1"}) == "bot"
    assert identity_kind({"ok": True, "user_id": "U1"}) == "user"
    assert identity_kind({"ok": False, "error": "invalid_auth"}) == "unusable"


def test_split_reports_the_exclusive_halves():
    both, bot_only, user_only = split(frozenset({"a", "b"}), frozenset({"b", "c"}))
    assert (both, bot_only, user_only) == (("b",), ("a",), ("c",))


def test_scope_on_the_other_token_is_the_finding():
    state, detail = verdict("channels:history", "bot",
                            frozenset(), frozenset({"channels:history"}))
    assert state == "wrong-side"
    assert "never changed" in detail


def test_user_only_scope_cannot_be_moved_to_the_bot_list():
    assert side("search:read") == "user-only"
    state, detail = verdict("search:read", "bot", frozenset(), frozenset())
    assert state == "unobtainable"
    assert "not offered on the bot list" in detail


def test_user_only_scope_held_by_the_user_token_says_switch_the_call():
    state, detail = verdict("search:read", "bot", frozenset(),
                            frozenset({"search:read"}))
    assert state == "wrong-side"
    assert "cannot be moved" in detail


def test_scope_on_the_calling_token_is_not_reported():
    assert verdict("users:read", "bot", frozenset({"users:read"}), frozenset())[0] == "correct"


def test_scope_on_neither_token_is_an_ordinary_missing_scope():
    state, detail = verdict("users:read", "user", frozenset(), frozenset())
    assert state == "granted-nowhere"
    assert "add it to the user list" in detail


def test_both_tokens_holding_it_is_ambiguity_rather_than_a_fault():
    assert verdict("users:read", "bot", frozenset({"users:read"}),
                   frozenset({"users:read"}))[0] == "granted-twice"

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { identityKind, scopeSet, side, split, verdict } from './slack-token-identity-split.mjs';

test('scope header absent is unknown not empty', () => {
  assert.equal(scopeSet(null).size, 0);
  assert.deepEqual([...scopeSet('channels:read, users:read ,')].sort(),
    ['channels:read', 'users:read']);
});

test('bot_id is the only discriminator', () => {
  assert.equal(identityKind({ ok: true, user_id: 'U1', bot_id: 'B1' }), 'bot');
  assert.equal(identityKind({ ok: true, user_id: 'U1' }), 'user');
  assert.equal(identityKind({ ok: false, error: 'invalid_auth' }), 'unusable');
});

test('split reports the exclusive halves', () => {
  const [both, botOnly, userOnly] = split(new Set(['a', 'b']), new Set(['b', 'c']));
  assert.deepEqual([both, botOnly, userOnly], [['b'], ['a'], ['c']]);
});

test('scope on the other token is the finding', () => {
  const [state, detail] = verdict('channels:history', 'bot',
    new Set(), new Set(['channels:history']));
  assert.equal(state, 'wrong-side');
  assert.match(detail, /never changed/);
});

test('user only scope cannot be moved to the bot list', () => {
  assert.equal(side('search:read'), 'user-only');
  const [state, detail] = verdict('search:read', 'bot', new Set(), new Set());
  assert.equal(state, 'unobtainable');
  assert.match(detail, /not offered on the bot list/);
});

test('user only scope held by the user token says switch the call', () => {
  const [state, detail] = verdict('search:read', 'bot', new Set(), new Set(['search:read']));
  assert.equal(state, 'wrong-side');
  assert.match(detail, /cannot be moved/);
});

test('scope on the calling token is not reported', () => {
  assert.equal(verdict('users:read', 'bot', new Set(['users:read']), new Set())[0], 'correct');
});

test('scope on neither token is an ordinary missing scope', () => {
  const [state, detail] = verdict('users:read', 'user', new Set(), new Set());
  assert.equal(state, 'granted-nowhere');
  assert.match(detail, /add it to the user list/);
});

test('both tokens holding it is ambiguity rather than a fault', () => {
  assert.equal(verdict('users:read', 'bot', new Set(['users:read']),
    new Set(['users:read']))[0], 'granted-twice');
});