Still on RTM: the retired transport and the next reinstall

"""Decide whether a Slack app is still riding RTM, and what happens if it is.

Read only, and specifically without opening anything. This never calls
rtm.connect: that method mints a session, and a section whose scripts promise
never to change your workspace does not get to open a connection to prove a
point. The same fact is available earlier, in the X-OAuth-Scopes header, which
says whether this token could authorise an RTM session at all.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("slack_rtm_migration_audit")

API = "https://slack.com/api/"

# The classic vocabulary. A pre-2020 app holds bare words like these; RTM needs
# client, and no app created since the granular migration can request it.
CLASSIC_SCOPES = {"client", "bot", "read", "post", "identify", "admin"}

# Bare words that survived the migration and therefore date nothing.
NEUTRAL_SCOPES = {"commands", "incoming-webhook"}

RTM_METHODS = {"rtm.connect", "rtm.start"}
SOCKET_METHODS = {"apps.connections.open"}

# States that should fail the run. legacy-grant-idle and no-transport are real
# observations and neither is breaking anything today.
FAILING = ("cliff", "retired-transport", "dual-transport", "half-migrated",
           "mixed-grant")


def grant_era(scopes):
    """Which permission model this token was issued under. Pure. -> (state, detail)

    The vocabulary dates the app exactly, with no call to make and nothing to
    open. A bare word is the old model; a colon is the new one.
    """
    have = {str(s).strip() for s in scopes or [] if str(s).strip()}
    if not have:
        return ("unknown",
                "no scopes were read, so the permission model of this token is "
                "unknown and every conclusion below would be a guess")
    classic = sorted(have & CLASSIC_SCOPES)
    granular = sorted(s for s in have if ":" in s)
    if classic and granular:
        return ("mixed",
                "the grant holds classic scopes (%s) and namespaced ones at the "
                "same time. The two vocabularies are not supposed to coexist, so "
                "read this twice before acting on it" % ", ".join(classic))
    if classic:
        return ("rtm-capable",
                "the grant holds %s, which is the pre-2020 vocabulary. RTM is "
                "available to this token and to no token issued today"
                % ", ".join(classic))
    if granular:
        return ("granular",
                "every scope is namespaced, so this is a modern app. rtm.connect "
                "answers missing_scope with needed: client, and there is no screen "
                "on which client can be granted")
    named = ", ".join(sorted(have & NEUTRAL_SCOPES)) or "unrecognised scopes"
    return ("unknown",
            "the grant holds only %s, which survived the migration and says "
            "nothing about which model this app was created under" % named)


def client_intent(calls):
    """What the client code opens, as declared by the caller. Pure.

    No API reports which methods your code calls, and inferring it from workspace
    state would be a guess dressed as a finding. One grep in your own repository
    is the honest input.
    """
    named = {str(c).strip().lower() for c in calls or [] if str(c).strip()}
    rtm = bool(named & RTM_METHODS)
    socket = bool(named & SOCKET_METHODS)
    if rtm and socket:
        return ("both",
                "the code opens an RTM session and a Socket Mode connection")
    if rtm:
        return ("rtm", "the code opens an RTM session")
    if socket:
        return ("socket", "the code opens a Socket Mode connection")
    if named:
        return ("http",
                "none of the methods named opens a persistent connection, so "
                "events reach this app over HTTP if they reach it at all")
    return ("unknown",
            "no client methods were named. Pass --calls rtm.connect or --calls "
            "apps.connections.open for what your code actually opens")


def replacement(socket_enabled, subscribed):
    """What is configured to take over from RTM. Pure. -> (state, detail)

    RTM delivered everything the token could see, implicitly, as a stream. Both
    replacements are subscription based, so an empty event list is not a
    destination: it is a connection that will open and carry nothing.
    """
    if socket_enabled is None and subscribed is None:
        return ("unknown",
                "no manifest was read, so what is configured to receive events is "
                "unknown")
    events = [str(e).strip() for e in subscribed or [] if str(e).strip()]
    if socket_enabled and events:
        return ("socket-mode",
                "Socket Mode is on and %d event(s) are subscribed" % len(events))
    if socket_enabled:
        return ("socket-unsubscribed",
                "Socket Mode is on and no events are subscribed. The socket will "
                "connect and carry nothing, because RTM streamed everything "
                "implicitly and Socket Mode does not")
    if events:
        return ("http-events",
                "%d event(s) are subscribed for delivery over HTTP" % len(events))
    return ("none",
            "neither Socket Mode nor any event subscription is configured, so "
            "there is nothing for RTM to hand over to")


def transport_state(era, intent, repl):
    """Cross the grant, the client and the configuration. Pure. -> (state, detail)

    The state worth acting on is cliff. An old app on an old grant running RTM is
    stable and has been for years; an app whose code opens RTM against a granular
    grant is already broken or one reinstall away, and reporting those two at the
    same volume wastes the only attention this report will get.
    """
    if era == "unknown" or intent == "unknown":
        return ("unknown",
                "the grant or the client is unknown, so no transport conclusion "
                "is available")
    if era == "mixed":
        return ("mixed-grant",
                "classic and granular scopes on one token. Establish which app "
                "this token belongs to before reading anything else here")
    if intent == "rtm" and era == "granular":
        return ("cliff",
                "the code opens an RTM session and the token holds only granular "
                "scopes. rtm.connect answers missing_scope with needed: client, "
                "and no reinstall can grant client to a modern app")
    if intent == "both":
        return ("dual-transport",
                "the code opens RTM and a socket at once. Both carry the same "
                "events, so everything subscribed is handled twice for as long as "
                "the cut-over lasts")
    if repl == "socket-unsubscribed":
        return ("half-migrated",
                "the transport moved and the subscriptions did not. The socket "
                "connects, the health check passes, and no event arrives")
    if intent == "rtm" and repl in ("none", "unknown"):
        return ("retired-transport",
                "the app runs on RTM with nothing configured to take over. It "
                "works today on a grandfather clause and stops on the day the app "
                "is recreated or its scopes change")
    if intent == "rtm":
        return ("migration-ready",
                "the app still opens RTM and %s is already configured. What is "
                "left is the client, not the configuration" % repl)
    if era == "rtm-capable":
        return ("legacy-grant-idle",
                "the token still holds classic scopes and nothing here opens an "
                "RTM session. That is a grant to tidy rather than a transport to "
                "migrate")
    if repl == "none":
        return ("no-transport",
                "nothing opens a connection and nothing is subscribed, so no "
                "event reaches this app by any route")
    return ("clear",
            "the app is on %s with a granular grant, which is where RTM was "
            "going" % repl)


def get(session, method, params, label):
    """One GET, asserting on the body rather than the status line."""
    r = session.get(API + method, params=params or {}, timeout=30)
    body = r.json()
    if body.get("ok") is not True:
        log.warning("%-10s %-14s %s", label, "unavailable", body.get("error"))
        return None, r.headers.get("X-OAuth-Scopes", "")
    return body, r.headers.get("X-OAuth-Scopes", "")


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--token-env", default="SLACK_BOT_TOKEN",
                    help="environment variable holding the bot token")
    ap.add_argument("--config-token-env", default="SLACK_CONFIG_TOKEN",
                    help="environment variable holding an app configuration token")
    ap.add_argument("--app-id", default="", help="app ID, for the manifest read")
    ap.add_argument("--calls", action="append", default=[],
                    help="a method your client code calls, such as rtm.connect or "
                         "apps.connections.open; repeatable")
    args = ap.parse_args()

    token = os.environ.get(args.token_env)
    if not token:
        log.error("set %s; any read scope works, the header is what matters",
                  args.token_env)
        return 2

    s = requests.Session()
    s.headers.update({"Authorization": "Bearer " + token})
    who, header = get(s, "auth.test", {}, "auth.test")
    if not who:
        return 2
    scopes = {p.strip() for p in str(header or "").split(",") if p.strip()}
    log.info("identity   %s in %s", who.get("user_id"), who.get("team"))

    era, era_detail = grant_era(scopes)
    log.info("grant      %-14s %s", era, era_detail)
    intent, intent_detail = client_intent(args.calls)
    log.info("client     %-14s %s", intent, intent_detail)

    socket_enabled, subscribed = None, None
    config_token = os.environ.get(args.config_token_env)
    if config_token and args.app_id:
        c = requests.Session()
        c.headers.update({"Authorization": "Bearer " + config_token})
        body, _ = get(c, "apps.manifest.export", {"app_id": args.app_id}, "manifest")
        if body:
            settings = ((body or {}).get("manifest") or {}).get("settings") or {}
            socket_enabled = bool(settings.get("socket_mode_enabled"))
            subscribed = list(
                (settings.get("event_subscriptions") or {}).get("bot_events") or [])
    repl, repl_detail = replacement(socket_enabled, subscribed)
    log.info("replace    %-14s %s", repl, repl_detail)

    state, detail = transport_state(era, intent, repl)
    if state in FAILING:
        log.warning("verdict    %-14s %s", state, detail)
        log.warning("  repair: enable Socket Mode and mint an app-level token with "
                    "connections:write on the Basic Information page")
        log.warning("  repair: subscribe to the events the RTM stream was carrying "
                    "implicitly, before you swap the client. Reversing those two is "
                    "how an app arrives connected and silent")
        log.warning("  repair: then move the client to SocketModeClient, or to the "
                    "Events API with a public Request URL if you would rather not "
                    "hold a connection open")
        return 1
    log.info("verdict    %-14s %s", state, detail)
    return 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Decide whether a Slack app is still riding RTM, and what happens if it is.
 *
 * Read only, and specifically without opening anything. This never calls
 * rtm.connect: that method mints a session, and a section whose scripts promise
 * never to change your workspace does not get to open a connection to prove a
 * point. The same fact is available earlier, in the X-OAuth-Scopes header.
 */

const API = 'https://slack.com/api/';

// The classic vocabulary. A pre-2020 app holds bare words like these; RTM needs
// client, and no app created since the granular migration can request it.
const CLASSIC_SCOPES = new Set(['client', 'bot', 'read', 'post', 'identify',
  'admin']);

// Bare words that survived the migration and therefore date nothing.
const NEUTRAL_SCOPES = new Set(['commands', 'incoming-webhook']);

const RTM_METHODS = new Set(['rtm.connect', 'rtm.start']);
const SOCKET_METHODS = new Set(['apps.connections.open']);

const FAILING = ['cliff', 'retired-transport', 'dual-transport', 'half-migrated',
  'mixed-grant'];

/**
 * Which permission model this token was issued under. Pure.
 * A bare word is the old model; a colon is the new one.
 */
export function grantEra(scopes) {
  const have = new Set([...(scopes ?? [])].map((s) => String(s).trim())
    .filter(Boolean));
  if (!have.size) {
    return ['unknown',
      'no scopes were read, so the permission model of this token is unknown and ' +
      'every conclusion below would be a guess'];
  }
  const classic = [...have].filter((s) => CLASSIC_SCOPES.has(s)).sort();
  const granular = [...have].filter((s) => s.includes(':')).sort();
  if (classic.length && granular.length) {
    return ['mixed',
      `the grant holds classic scopes (${classic.join(', ')}) and namespaced ones ` +
      'at the same time. The two vocabularies are not supposed to coexist, so read ' +
      'this twice before acting on it'];
  }
  if (classic.length) {
    return ['rtm-capable',
      `the grant holds ${classic.join(', ')}, which is the pre-2020 vocabulary. ` +
      'RTM is available to this token and to no token issued today'];
  }
  if (granular.length) {
    return ['granular',
      'every scope is namespaced, so this is a modern app. rtm.connect answers ' +
      'missing_scope with needed: client, and there is no screen on which client ' +
      'can be granted'];
  }
  const neutral = [...have].filter((s) => NEUTRAL_SCOPES.has(s)).sort();
  return ['unknown',
    `the grant holds only ${neutral.join(', ') || 'unrecognised scopes'}, which ` +
    'survived the migration and says nothing about which model this app was ' +
    'created under'];
}

/**
 * What the client code opens, as declared by the caller. Pure.
 * No API reports which methods your code calls, and inferring it from workspace
 * state would be a guess dressed as a finding.
 */
export function clientIntent(calls) {
  const named = new Set((calls ?? []).map((c) => String(c).trim().toLowerCase())
    .filter(Boolean));
  const rtm = [...named].some((m) => RTM_METHODS.has(m));
  const socket = [...named].some((m) => SOCKET_METHODS.has(m));
  if (rtm && socket) {
    return ['both', 'the code opens an RTM session and a Socket Mode connection'];
  }
  if (rtm) return ['rtm', 'the code opens an RTM session'];
  if (socket) return ['socket', 'the code opens a Socket Mode connection'];
  if (named.size) {
    return ['http',
      'none of the methods named opens a persistent connection, so events reach ' +
      'this app over HTTP if they reach it at all'];
  }
  return ['unknown',
    'no client methods were named. Pass --calls rtm.connect or --calls ' +
    'apps.connections.open for what your code actually opens'];
}

/**
 * What is configured to take over from RTM. Pure.
 * RTM delivered everything the token could see, implicitly. Both replacements
 * are subscription based, so an empty event list is not a destination.
 */
export function replacement(socketEnabled, subscribed) {
  if ((socketEnabled === null || socketEnabled === undefined)
      && (subscribed === null || subscribed === undefined)) {
    return ['unknown',
      'no manifest was read, so what is configured to receive events is unknown'];
  }
  const events = (subscribed ?? []).map((e) => String(e).trim()).filter(Boolean);
  if (socketEnabled && events.length) {
    return ['socket-mode',
      `Socket Mode is on and ${events.length} event(s) are subscribed`];
  }
  if (socketEnabled) {
    return ['socket-unsubscribed',
      'Socket Mode is on and no events are subscribed. The socket will connect ' +
      'and carry nothing, because RTM streamed everything implicitly and Socket ' +
      'Mode does not'];
  }
  if (events.length) {
    return ['http-events',
      `${events.length} event(s) are subscribed for delivery over HTTP`];
  }
  return ['none',
    'neither Socket Mode nor any event subscription is configured, so there is ' +
    'nothing for RTM to hand over to'];
}

/**
 * Cross the grant, the client and the configuration. Pure.
 * The state worth acting on is cliff: an old app on an old grant running RTM is
 * stable, and an app whose code opens RTM against a granular grant is not.
 */
export function transportState(era, intent, repl) {
  if (era === 'unknown' || intent === 'unknown') {
    return ['unknown',
      'the grant or the client is unknown, so no transport conclusion is available'];
  }
  if (era === 'mixed') {
    return ['mixed-grant',
      'classic and granular scopes on one token. Establish which app this token ' +
      'belongs to before reading anything else here'];
  }
  if (intent === 'rtm' && era === 'granular') {
    return ['cliff',
      'the code opens an RTM session and the token holds only granular scopes. ' +
      'rtm.connect answers missing_scope with needed: client, and no reinstall can ' +
      'grant client to a modern app'];
  }
  if (intent === 'both') {
    return ['dual-transport',
      'the code opens RTM and a socket at once. Both carry the same events, so ' +
      'everything subscribed is handled twice for as long as the cut-over lasts'];
  }
  if (repl === 'socket-unsubscribed') {
    return ['half-migrated',
      'the transport moved and the subscriptions did not. The socket connects, ' +
      'the health check passes, and no event arrives'];
  }
  if (intent === 'rtm' && (repl === 'none' || repl === 'unknown')) {
    return ['retired-transport',
      'the app runs on RTM with nothing configured to take over. It works today ' +
      'on a grandfather clause and stops on the day the app is recreated or its ' +
      'scopes change'];
  }
  if (intent === 'rtm') {
    return ['migration-ready',
      `the app still opens RTM and ${repl} is already configured. What is left is ` +
      'the client, not the configuration'];
  }
  if (era === 'rtm-capable') {
    return ['legacy-grant-idle',
      'the token still holds classic scopes and nothing here opens an RTM session. ' +
      'That is a grant to tidy rather than a transport to migrate'];
  }
  if (repl === 'none') {
    return ['no-transport',
      'nothing opens a connection and nothing is subscribed, so no event reaches ' +
      'this app by any route'];
  }
  return ['clear',
    `the app is on ${repl} with a granular grant, which is where RTM was going`];
}

async function get(token, method, params, label) {
  const qs = new URLSearchParams(params ?? {});
  const res = await fetch(`${API}${method}?${qs}`, {
    headers: { Authorization: `Bearer ${token}` },
  });
  const body = await res.json();
  if (body.ok !== true) {
    console.warn(`${label.padEnd(10)} ${'unavailable'.padEnd(14)} ${body.error}`);
    return [null, res.headers.get('x-oauth-scopes') ?? ''];
  }
  return [body, res.headers.get('x-oauth-scopes') ?? ''];
}

function arg(args, name, fallback = null) {
  const i = args.indexOf(name);
  return i === -1 ? fallback : args[i + 1];
}

function argAll(args, name) {
  const out = [];
  for (let i = 0; i < args.length; i += 1) {
    if (args[i] === name && args[i + 1] !== undefined) out.push(args[i + 1]);
  }
  return out;
}

async function main() {
  const args = process.argv.slice(2);
  const tokenEnv = arg(args, '--token-env', 'SLACK_BOT_TOKEN');
  const token = process.env[tokenEnv];
  if (!token) {
    console.error(`set ${tokenEnv}; any read scope works, the header is what matters`);
    process.exitCode = 2;
    return;
  }
  const configTokenEnv = arg(args, '--config-token-env', 'SLACK_CONFIG_TOKEN');
  const appId = arg(args, '--app-id', '');

  const [who, header] = await get(token, 'auth.test', {}, 'auth.test');
  if (!who) { process.exitCode = 2; return; }
  const scopes = String(header ?? '').split(',').map((p) => p.trim()).filter(Boolean);
  console.log(`identity   ${who.user_id} in ${who.team}`);

  const [era, eraDetail] = grantEra(scopes);
  console.log(`grant      ${era.padEnd(14)} ${eraDetail}`);
  const [intent, intentDetail] = clientIntent(argAll(args, '--calls'));
  console.log(`client     ${intent.padEnd(14)} ${intentDetail}`);

  let socketEnabled = null;
  let subscribed = null;
  const configToken = process.env[configTokenEnv];
  if (configToken && appId) {
    const [body] = await get(configToken, 'apps.manifest.export', { app_id: appId },
      'manifest');
    if (body) {
      const settings = body?.manifest?.settings ?? {};
      socketEnabled = Boolean(settings.socket_mode_enabled);
      subscribed = settings.event_subscriptions?.bot_events ?? [];
    }
  }
  const [repl, replDetail] = replacement(socketEnabled, subscribed);
  console.log(`replace    ${repl.padEnd(14)} ${replDetail}`);

  const [state, detail] = transportState(era, intent, repl);
  if (FAILING.includes(state)) {
    console.warn(`verdict    ${state.padEnd(14)} ${detail}`);
    console.warn('  repair: enable Socket Mode and mint an app-level token with ' +
      'connections:write on the Basic Information page');
    console.warn('  repair: subscribe to the events the RTM stream was carrying ' +
      'implicitly, before you swap the client. Reversing those two is how an app ' +
      'arrives connected and silent');
    console.warn('  repair: then move the client to SocketModeClient, or to the ' +
      'Events API with a public Request URL if you would rather not hold a ' +
      'connection open');
    process.exitCode = 1;
  } else {
    console.log(`verdict    ${state.padEnd(14)} ${detail}`);
  }
}

// Only run when invoked directly, so importing this module in the tests does
// not execute main() and fail the file on a missing token.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from slack_rtm_migration_audit import (client_intent, grant_era, replacement,
                                       transport_state)


def test_a_bare_client_scope_dates_the_app_to_the_classic_model():
    state, detail = grant_era(["client", "bot"])
    assert state == "rtm-capable"
    assert "pre-2020" in detail


def test_namespaced_scopes_are_the_modern_model_and_cannot_reach_rtm():
    state, detail = grant_era(["channels:history", "chat:write"])
    assert state == "granular"
    assert "needed: client" in detail


def test_both_vocabularies_at_once_is_reported_rather_than_resolved():
    state, detail = grant_era(["client", "channels:history"])
    assert state == "mixed"
    assert "read this twice" in detail


def test_scopes_that_survived_the_migration_date_nothing():
    assert grant_era(["commands", "incoming-webhook"])[0] == "unknown"
    assert grant_era([])[0] == "unknown"


def test_the_client_is_declared_and_never_inferred():
    assert client_intent(["rtm.connect"])[0] == "rtm"
    assert client_intent(["rtm.start"])[0] == "rtm"
    assert client_intent(["apps.connections.open"])[0] == "socket"
    assert client_intent(["rtm.connect", "apps.connections.open"])[0] == "both"
    assert client_intent(["chat.postMessage"])[0] == "http"
    assert client_intent([])[0] == "unknown"


def test_socket_mode_with_subscriptions_is_a_destination():
    state, detail = replacement(True, ["app_mention", "message.channels"])
    assert state == "socket-mode"
    assert "2 event(s)" in detail


def test_socket_mode_with_no_subscriptions_is_not_a_destination():
    state, detail = replacement(True, [])
    assert state == "socket-unsubscribed"
    assert "connect and carry nothing" in detail


def test_subscriptions_without_socket_mode_are_the_http_route():
    assert replacement(False, ["app_mention"])[0] == "http-events"


def test_neither_leaves_rtm_with_nowhere_to_go():
    assert replacement(False, [])[0] == "none"
    assert replacement(None, None)[0] == "unknown"


def test_rtm_code_on_a_granular_grant_is_the_cliff():
    state, detail = transport_state("granular", "rtm", "socket-mode")
    assert state == "cliff"
    assert "no reinstall can grant client" in detail


def test_a_classic_app_on_rtm_with_no_replacement_is_a_plan_not_an_outage():
    state, detail = transport_state("rtm-capable", "rtm", "none")
    assert state == "retired-transport"
    assert "grandfather clause" in detail


def test_a_classic_app_on_rtm_with_socket_mode_ready_is_a_client_swap():
    assert transport_state("rtm-capable", "rtm", "socket-mode")[0] == "migration-ready"


def test_two_transports_at_once_deliver_everything_twice():
    state, detail = transport_state("rtm-capable", "both", "socket-mode")
    assert state == "dual-transport"
    assert "handled twice" in detail


def test_a_socket_with_no_subscriptions_beats_the_other_readings():
    assert transport_state("granular", "socket", "socket-unsubscribed")[0] == \
        "half-migrated"


def test_a_classic_grant_with_no_rtm_client_is_the_scope_note_next_door():
    state, detail = transport_state("rtm-capable", "http", "http-events")
    assert state == "legacy-grant-idle"
    assert "grant to tidy" in detail


def test_nothing_connecting_and_nothing_subscribed_receives_nothing():
    assert transport_state("granular", "http", "none")[0] == "no-transport"


def test_a_migrated_app_is_clear():
    state, detail = transport_state("granular", "socket", "socket-mode")
    assert state == "clear"
    assert "where RTM was going" in detail


def test_an_undeclared_client_produces_no_conclusion():
    assert transport_state("granular", "unknown", "socket-mode")[0] == "unknown"
    assert transport_state("unknown", "rtm", "none")[0] == "unknown"


def test_a_mixed_grant_is_settled_before_anything_else_is_read():
    assert transport_state("mixed", "rtm", "none")[0] == "mixed-grant"

import { test } from 'node:test';
import assert from 'node:assert/strict';
import {
  clientIntent, grantEra, replacement, transportState,
} from './slack-rtm-migration-audit.mjs';

test('a bare client scope dates the app to the classic model', () => {
  const [state, detail] = grantEra(['client', 'bot']);
  assert.equal(state, 'rtm-capable');
  assert.match(detail, /pre-2020/);
});

test('namespaced scopes are the modern model and cannot reach rtm', () => {
  const [state, detail] = grantEra(['channels:history', 'chat:write']);
  assert.equal(state, 'granular');
  assert.match(detail, /needed: client/);
});

test('both vocabularies at once is reported rather than resolved', () => {
  const [state, detail] = grantEra(['client', 'channels:history']);
  assert.equal(state, 'mixed');
  assert.match(detail, /read this twice/);
});

test('scopes that survived the migration date nothing', () => {
  assert.equal(grantEra(['commands', 'incoming-webhook'])[0], 'unknown');
  assert.equal(grantEra([])[0], 'unknown');
});

test('the client is declared and never inferred', () => {
  assert.equal(clientIntent(['rtm.connect'])[0], 'rtm');
  assert.equal(clientIntent(['rtm.start'])[0], 'rtm');
  assert.equal(clientIntent(['apps.connections.open'])[0], 'socket');
  assert.equal(clientIntent(['rtm.connect', 'apps.connections.open'])[0], 'both');
  assert.equal(clientIntent(['chat.postMessage'])[0], 'http');
  assert.equal(clientIntent([])[0], 'unknown');
});

test('socket mode with subscriptions is a destination', () => {
  const [state, detail] = replacement(true, ['app_mention', 'message.channels']);
  assert.equal(state, 'socket-mode');
  assert.match(detail, /2 event\(s\)/);
});

test('socket mode with no subscriptions is not a destination', () => {
  const [state, detail] = replacement(true, []);
  assert.equal(state, 'socket-unsubscribed');
  assert.match(detail, /connect and carry nothing/);
});

test('subscriptions without socket mode are the http route', () => {
  assert.equal(replacement(false, ['app_mention'])[0], 'http-events');
});

test('neither leaves rtm with nowhere to go', () => {
  assert.equal(replacement(false, [])[0], 'none');
  assert.equal(replacement(null, null)[0], 'unknown');
});

test('rtm code on a granular grant is the cliff', () => {
  const [state, detail] = transportState('granular', 'rtm', 'socket-mode');
  assert.equal(state, 'cliff');
  assert.match(detail, /no reinstall can grant client/);
});

test('a classic app on rtm with no replacement is a plan not an outage', () => {
  const [state, detail] = transportState('rtm-capable', 'rtm', 'none');
  assert.equal(state, 'retired-transport');
  assert.match(detail, /grandfather clause/);
});

test('a classic app on rtm with socket mode ready is a client swap', () => {
  assert.equal(transportState('rtm-capable', 'rtm', 'socket-mode')[0],
    'migration-ready');
});

test('two transports at once deliver everything twice', () => {
  const [state, detail] = transportState('rtm-capable', 'both', 'socket-mode');
  assert.equal(state, 'dual-transport');
  assert.match(detail, /handled twice/);
});

test('a socket with no subscriptions beats the other readings', () => {
  assert.equal(transportState('granular', 'socket', 'socket-unsubscribed')[0],
    'half-migrated');
});

test('a classic grant with no rtm client is the scope note next door', () => {
  const [state, detail] = transportState('rtm-capable', 'http', 'http-events');
  assert.equal(state, 'legacy-grant-idle');
  assert.match(detail, /grant to tidy/);
});

test('nothing connecting and nothing subscribed receives nothing', () => {
  assert.equal(transportState('granular', 'http', 'none')[0], 'no-transport');
});

test('a migrated app is clear', () => {
  const [state, detail] = transportState('granular', 'socket', 'socket-mode');
  assert.equal(state, 'clear');
  assert.match(detail, /where RTM was going/);
});

test('an undeclared client produces no conclusion', () => {
  assert.equal(transportState('granular', 'unknown', 'socket-mode')[0], 'unknown');
  assert.equal(transportState('unknown', 'rtm', 'none')[0], 'unknown');
});

test('a mixed grant is settled before anything else is read', () => {
  assert.equal(transportState('mixed', 'rtm', 'none')[0], 'mixed-grant');
});