installs keyed on team_id alone collide on Enterprise Grid

"""Audit a Slack installation store for keys that collide on Enterprise Grid.

Read only. GET requests and nothing else, because this script is handed one
token per tenant and a mistake here is a cross-tenant one. The repair is a store
migration; it is printed for a human to run.
"""
import argparse
import json
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("slack_install_key_audit")

API = "https://slack.com/api/"


def verdict(stored, identity):
    """Compare one stored installation row against what its token says it is.

    `stored` is the row as your store holds it: a `key`, and whatever else was
    persisted (`enterprise_id`, `is_enterprise_install`). `identity` is the
    parsed auth.test body for that row's token. Pure, so the whole truth table
    runs offline.
    """
    if identity.get("ok") is not True:
        return ("unusable",
                "auth.test answered ok: false, error=%s. The row cannot be "
                "checked, and a token that no longer authenticates is its own "
                "finding." % (identity.get("error") or "<no error field>"))

    live_team = identity.get("team_id")
    live_ent = identity.get("enterprise_id")
    org_install = identity.get("is_enterprise_install") is True
    key = str(stored.get("key", ""))
    stored_ent = stored.get("enterprise_id")
    stored_org = stored.get("is_enterprise_install") is True

    if live_ent and not stored_ent:
        return ("enterprise-id-dropped",
                "live install is in org %s and the row kept no enterprise_id. "
                "Two workspaces in different orgs can now be filed under one "
                "key, and the second write wins." % live_ent)
    if live_ent and stored_ent != live_ent:
        return ("enterprise-id-wrong",
                "row says org %s, the token says %s. A lookup on this row hands "
                "out a credential belonging to another organisation."
                % (stored_ent, live_ent))
    if org_install and not stored_org:
        return ("org-install-under-team-key",
                "is_enterprise_install is true but the row is filed as a "
                "workspace install under %r. The grant covers every workspace "
                "in the org, including ones with no row at all." % key)
    if stored_org and not org_install:
        return ("workspace-install-flagged-org",
                "the row claims an org-wide install and the token is scoped to "
                "workspace %s. Lookups for sibling workspaces will match this "
                "row and use a token that cannot serve them." % live_team)
    if live_team and key not in (live_team, "%s.%s" % (live_ent, live_team)):
        return ("key-drift",
                "row is filed under %r and the token reports team %s. The key "
                "does not round-trip, so whatever wrote it is not what reads it."
                % (key, live_team))
    if live_ent:
        return ("grid-keyed",
                "org %s, team %s, org-wide=%s, all three persisted"
                % (live_ent, live_team, org_install))
    return ("single-workspace",
            "team %s, not on Grid. team_id alone is adequate today and stops "
            "being adequate the day this customer migrates to an org."
            % live_team)


def collisions(seen):
    """Find cross-row collisions. Pure.

    `seen` is a list of dicts with `key`, `team_id` and `enterprise_id`. Returns
    (team_collisions, key_collisions): team ids that appear under more than one
    organisation, and store keys that resolve to more than one live identity.
    Neither is visible from a single row, and both are leakage in progress.
    """
    by_team = {}
    by_key = {}
    for row in seen:
        team = row.get("team_id")
        if team:
            by_team.setdefault(team, set()).add(row.get("enterprise_id") or "")
        by_key.setdefault(str(row.get("key", "")), set()).add(
            (row.get("enterprise_id") or "", team or ""))
    team_collisions = sorted(t for t, orgs in by_team.items() if len(orgs) > 1)
    key_collisions = sorted(k for k, ids in by_key.items() if len(ids) > 1)
    return team_collisions, key_collisions


def auth_test(session, token):
    r = session.get(API + "auth.test", headers={"Authorization": "Bearer " + token},
                    timeout=30)
    try:
        return r.json()
    except ValueError:
        return {"ok": False, "error": "unparseable_body"}


def load_rows(path):
    """Rows as the store holds them, not as it wishes it held them."""
    if path:
        return json.loads(open(path, encoding="utf-8").read())
    return [{"key": os.environ.get("SLACK_TEAM_ID", "<the only row>"),
             "token_env": "SLACK_BOT_TOKEN"}]


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--store", help="JSON array of installation rows; each row needs "
                                    "key and token_env, plus whatever else you persist")
    args = ap.parse_args()

    if not args.store and not os.environ.get("SLACK_BOT_TOKEN"):
        log.error("set SLACK_BOT_TOKEN, or pass --store with one token_env per row")
        return 2

    rows = load_rows(args.store)
    s = requests.Session()

    seen = []
    bad = 0
    for row in rows:
        token = os.environ.get(row.get("token_env") or "SLACK_BOT_TOKEN")
        if not token:
            log.warning("%-28s %s", "no-token", "row %r names %s and it is unset"
                        % (row.get("key"), row.get("token_env")))
            bad += 1
            continue
        identity = auth_test(s, token)
        state, detail = verdict(row, identity)
        line = "%-28s %-18s %s" % (state, row.get("key"), detail)
        if state in ("grid-keyed", "single-workspace"):
            log.info(line)
        else:
            bad += 1
            log.warning(line)
            log.warning("  repair: key this store on (enterprise_id, team_id, "
                        "is_enterprise_install), enterprise_id nullable")
        if identity.get("ok") is True:
            seen.append({"key": row.get("key"),
                         "team_id": identity.get("team_id"),
                         "enterprise_id": identity.get("enterprise_id")})

    team_collisions, key_collisions = collisions(seen)
    for team in team_collisions:
        bad += 1
        log.warning("%-28s %s", "team-id-in-two-orgs",
                    "team %s is filed under more than one enterprise_id" % team)
    for key in key_collisions:
        bad += 1
        log.warning("%-28s %s", "key-serves-two-installs",
                    "store key %r resolves to more than one live identity" % key)
    if team_collisions or key_collisions:
        log.warning("  repair: migrate before the next uninstall. A delete keyed on "
                    "team_id alone removes another tenant's row")

    log.info("%d install(s) checked, %d keyed in a way that can collide",
             len(rows), bad)
    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Audit a Slack installation store for keys that collide on Enterprise Grid.
 *
 * Read only. GET requests and nothing else, because this script is handed one
 * token per tenant and a mistake here is a cross-tenant one. The repair is a
 * store migration; it is printed for a human to run.
 */
import { readFile } from 'node:fs/promises';

const API = 'https://slack.com/api/';

/**
 * Compare one stored installation row against what its token says it is.
 * Pure, so the whole truth table runs offline.
 */
export function verdict(stored, identity) {
  if (identity?.ok !== true) {
    return ['unusable',
      `auth.test answered ok: false, error=${identity?.error ?? '<no error field>'}. ` +
      'The row cannot be checked, and a token that no longer authenticates is its ' +
      'own finding.'];
  }

  const liveTeam = identity.team_id;
  const liveEnt = identity.enterprise_id;
  const orgInstall = identity.is_enterprise_install === true;
  const key = String(stored.key ?? '');
  const storedEnt = stored.enterprise_id;
  const storedOrg = stored.is_enterprise_install === true;

  if (liveEnt && !storedEnt) {
    return ['enterprise-id-dropped',
      `live install is in org ${liveEnt} and the row kept no enterprise_id. Two ` +
      'workspaces in different orgs can now be filed under one key, and the ' +
      'second write wins.'];
  }
  if (liveEnt && storedEnt !== liveEnt) {
    return ['enterprise-id-wrong',
      `row says org ${storedEnt}, the token says ${liveEnt}. A lookup on this row ` +
      'hands out a credential belonging to another organisation.'];
  }
  if (orgInstall && !storedOrg) {
    return ['org-install-under-team-key',
      `is_enterprise_install is true but the row is filed as a workspace install ` +
      `under ${JSON.stringify(key)}. The grant covers every workspace in the org, ` +
      'including ones with no row at all.'];
  }
  if (storedOrg && !orgInstall) {
    return ['workspace-install-flagged-org',
      `the row claims an org-wide install and the token is scoped to workspace ` +
      `${liveTeam}. Lookups for sibling workspaces will match this row and use a ` +
      'token that cannot serve them.'];
  }
  if (liveTeam && key !== liveTeam && key !== `${liveEnt}.${liveTeam}`) {
    return ['key-drift',
      `row is filed under ${JSON.stringify(key)} and the token reports team ` +
      `${liveTeam}. The key does not round-trip, so whatever wrote it is not what ` +
      'reads it.'];
  }
  if (liveEnt) {
    return ['grid-keyed',
      `org ${liveEnt}, team ${liveTeam}, org-wide=${orgInstall}, all three persisted`];
  }
  return ['single-workspace',
    `team ${liveTeam}, not on Grid. team_id alone is adequate today and stops being ` +
    'adequate the day this customer migrates to an org.'];
}

/**
 * Find cross-row collisions. Pure. Returns [teamCollisions, keyCollisions]:
 * team ids filed under more than one organisation, and store keys that resolve
 * to more than one live identity.
 */
export function collisions(seen) {
  const byTeam = new Map();
  const byKey = new Map();
  for (const row of seen) {
    const team = row.team_id;
    if (team) {
      if (!byTeam.has(team)) byTeam.set(team, new Set());
      byTeam.get(team).add(row.enterprise_id ?? '');
    }
    const key = String(row.key ?? '');
    if (!byKey.has(key)) byKey.set(key, new Set());
    byKey.get(key).add(`${row.enterprise_id ?? ''}|${team ?? ''}`);
  }
  const teamCollisions = [...byTeam.entries()]
    .filter(([, orgs]) => orgs.size > 1).map(([t]) => t).sort();
  const keyCollisions = [...byKey.entries()]
    .filter(([, ids]) => ids.size > 1).map(([k]) => k).sort();
  return [teamCollisions, keyCollisions];
}

async function authTest(token) {
  const res = await fetch(API + 'auth.test', {
    headers: { Authorization: `Bearer ${token}` },
  });
  try {
    return await res.json();
  } catch {
    return { ok: false, error: 'unparseable_body' };
  }
}

async function loadRows(path) {
  if (path) return JSON.parse(await readFile(path, 'utf8'));
  return [{ key: process.env.SLACK_TEAM_ID ?? '<the only row>', token_env: 'SLACK_BOT_TOKEN' }];
}

async function main() {
  const args = process.argv.slice(2);
  const i = args.indexOf('--store');
  const store = i === -1 ? null : args[i + 1];

  if (!store && !process.env.SLACK_BOT_TOKEN) {
    console.error('set SLACK_BOT_TOKEN, or pass --store with one token_env per row');
    process.exitCode = 2;
    return;
  }

  const rows = await loadRows(store);
  const seen = [];
  let bad = 0;

  for (const row of rows) {
    const token = process.env[row.token_env ?? 'SLACK_BOT_TOKEN'];
    if (!token) {
      console.warn(`${'no-token'.padEnd(28)} row ${JSON.stringify(row.key)} names ` +
                   `${row.token_env} and it is unset`);
      bad += 1;
      continue;
    }
    const identity = await authTest(token);
    const [state, detail] = verdict(row, identity);
    const line = `${state.padEnd(28)} ${String(row.key).padEnd(18)} ${detail}`;
    if (state === 'grid-keyed' || state === 'single-workspace') {
      console.log(line);
    } else {
      bad += 1;
      console.warn(line);
      console.warn('  repair: key this store on (enterprise_id, team_id, ' +
                   'is_enterprise_install), enterprise_id nullable');
    }
    if (identity?.ok === true) {
      seen.push({ key: row.key, team_id: identity.team_id, enterprise_id: identity.enterprise_id });
    }
  }

  const [teamCollisions, keyCollisions] = collisions(seen);
  for (const team of teamCollisions) {
    bad += 1;
    console.warn(`${'team-id-in-two-orgs'.padEnd(28)} team ${team} is filed under ` +
                 'more than one enterprise_id');
  }
  for (const key of keyCollisions) {
    bad += 1;
    console.warn(`${'key-serves-two-installs'.padEnd(28)} store key ` +
                 `${JSON.stringify(key)} resolves to more than one live identity`);
  }
  if (teamCollisions.length || keyCollisions.length) {
    console.warn('  repair: migrate before the next uninstall. A delete keyed on ' +
                 'team_id alone removes another tenant\'s row');
  }

  console.log(`${rows.length} install(s) checked, ${bad} keyed in a way that can collide`);
  process.exitCode = bad ? 1 : 0;
}

// Only run when invoked directly, so importing this module in the tests does not
// execute main() and fail the file on a missing token.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from slack_install_key_audit import collisions, verdict


def test_grid_install_with_no_stored_enterprise_id_is_the_finding():
    stored = {"key": "T111"}
    live = {"ok": True, "team_id": "T111", "enterprise_id": "E999",
            "is_enterprise_install": False}
    state, detail = verdict(stored, live)
    assert state == "enterprise-id-dropped"
    assert "E999" in detail


def test_org_wide_install_filed_under_a_workspace_key():
    stored = {"key": "T111", "enterprise_id": "E999"}
    live = {"ok": True, "team_id": None, "enterprise_id": "E999",
            "is_enterprise_install": True}
    assert verdict(stored, live)[0] == "org-install-under-team-key"


def test_row_pointing_at_another_org_is_a_credential_handout():
    stored = {"key": "E1.T111", "enterprise_id": "E1"}
    live = {"ok": True, "team_id": "T111", "enterprise_id": "E2",
            "is_enterprise_install": False}
    state, detail = verdict(stored, live)
    assert state == "enterprise-id-wrong"
    assert "another organisation" in detail


def test_plain_workspace_install_is_not_reported():
    stored = {"key": "T111"}
    live = {"ok": True, "team_id": "T111", "enterprise_id": None,
            "is_enterprise_install": False}
    state, detail = verdict(stored, live)
    assert state == "single-workspace"
    assert "migrates to an org" in detail


def test_key_that_does_not_round_trip():
    stored = {"key": "T222"}
    live = {"ok": True, "team_id": "T111", "enterprise_id": None,
            "is_enterprise_install": False}
    assert verdict(stored, live)[0] == "key-drift"


def test_dead_token_is_reported_rather_than_guessed_at():
    assert verdict({"key": "T111"}, {"ok": False, "error": "token_revoked"})[0] == "unusable"


def test_same_team_under_two_orgs_is_a_cross_row_finding():
    seen = [{"key": "T111", "team_id": "T111", "enterprise_id": "E1"},
            {"key": "T111", "team_id": "T111", "enterprise_id": "E2"}]
    teams, keys = collisions(seen)
    assert teams == ["T111"]
    assert keys == ["T111"]


def test_distinct_installs_do_not_collide():
    seen = [{"key": "E1.T111", "team_id": "T111", "enterprise_id": "E1"},
            {"key": "E2.T222", "team_id": "T222", "enterprise_id": "E2"}]
    assert collisions(seen) == ([], [])

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { collisions, verdict } from './slack-install-key-audit.mjs';

test('grid install with no stored enterprise_id is the finding', () => {
  const [state, detail] = verdict(
    { key: 'T111' },
    { ok: true, team_id: 'T111', enterprise_id: 'E999', is_enterprise_install: false },
  );
  assert.equal(state, 'enterprise-id-dropped');
  assert.match(detail, /E999/);
});

test('org wide install filed under a workspace key', () => {
  const [state] = verdict(
    { key: 'T111', enterprise_id: 'E999' },
    { ok: true, team_id: null, enterprise_id: 'E999', is_enterprise_install: true },
  );
  assert.equal(state, 'org-install-under-team-key');
});

test('row pointing at another org is a credential handout', () => {
  const [state, detail] = verdict(
    { key: 'E1.T111', enterprise_id: 'E1' },
    { ok: true, team_id: 'T111', enterprise_id: 'E2', is_enterprise_install: false },
  );
  assert.equal(state, 'enterprise-id-wrong');
  assert.match(detail, /another organisation/);
});

test('plain workspace install is not reported', () => {
  const [state, detail] = verdict(
    { key: 'T111' },
    { ok: true, team_id: 'T111', enterprise_id: null, is_enterprise_install: false },
  );
  assert.equal(state, 'single-workspace');
  assert.match(detail, /migrates to an org/);
});

test('key that does not round trip', () => {
  const [state] = verdict(
    { key: 'T222' },
    { ok: true, team_id: 'T111', enterprise_id: null, is_enterprise_install: false },
  );
  assert.equal(state, 'key-drift');
});

test('dead token is reported rather than guessed at', () => {
  assert.equal(verdict({ key: 'T111' }, { ok: false, error: 'token_revoked' })[0], 'unusable');
});

test('same team under two orgs is a cross row finding', () => {
  const [teams, keys] = collisions([
    { key: 'T111', team_id: 'T111', enterprise_id: 'E1' },
    { key: 'T111', team_id: 'T111', enterprise_id: 'E2' },
  ]);
  assert.deepEqual(teams, ['T111']);
  assert.deepEqual(keys, ['T111']);
});

test('distinct installs do not collide', () => {
  const [teams, keys] = collisions([
    { key: 'E1.T111', team_id: 'T111', enterprise_id: 'E1' },
    { key: 'E2.T222', team_id: 'T222', enterprise_id: 'E2' },
  ]);
  assert.deepEqual(teams, []);
  assert.deepEqual(keys, []);
});