fix(slack): refuse binding a Search bot to a different app or workspace than members

[waleedlatif1]

Summary

• Binding Sim Search to an existing bot credential (configureSlackSearchInstallation) created a new installation without checking the organization's member Slack app, so a bot left over from an earlier install could be bound to a different app or workspace than the members' accounts — a state the install flow already refuses, and one that leaves member setup stuck
• The new-installation path now runs the same check as setup, inside its transaction under the organization Slack app lock; enabling, disabling and re-validating an existing installation are unchanged (an update is already pinned to its app and workspace)
• The member-app resolution and the bot-vs-members rule move from setup.ts into organization-slack-app.ts, so both paths share one implementation and one message
• requireSlackSearchAppAvailable takes the caller's transaction: enabling a custom bot and completing member setup looked up the Slack app kind on a second pooled connection while holding the transaction's, which can deadlock the pool at saturation (the new integration test is the first to reach that path)

Type of Change

• Bug fix

Testing

• Integration (slack-shared-member-accounts.integration.ts, real Postgres): members on the shared app, then binding a leftover custom bot in another workspace is refused with no installation written (inserts one on the current code); binding a leftover shared-app bot in the members' workspace still succeeds
• setup.test.ts updated for the moved helper; it still exercises the real rule
• Ran biome on changed files; lint, check:audits, type-check, unit and integration suites run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 16, 2026 4:58am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This PR appears safe to merge.

Summary

New Slack Search bindings now check the bot against the organization's member app and workspace before saving.

• Saved Slack bots must match the members’ app and workspace.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Verify bot with Slack] --> B[Begin transaction and lock organization]
  B --> C{Installation exists?}
  C -->|Yes| D[Keep existing update behavior]
  C -->|No| E[Read member app and workspace]
  E --> F{Bot matches member settings?}
  F -->|No| G[Reject without saving]
  F -->|Yes| H[Create installation]

Loading

_{Reviews (1) · Last reviewed commit: "fix(slack): refuse binding a Search bot ..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}