[yordis]

• Slack apps are otherwise configured by hand in the Slack UI, so scope and setting changes skip review and drift between workspaces.
• The provider can now create its own bot app, which leaves app installation as the only manual step.
• The configuration token rotates every 12 hours. Terraform cannot persist a rotated token safely during plan, so the provider accepts a short-lived token and leaves rotation to the pipeline.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

TrogonStack is on CodeRabbit Free, which includes PR summaries. Ask your admin to upgrade for code reviews.

• Ask an admin to upgrade

Open in CodeRabbit

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Free
• Run ID: c0d82e3c-fb69-445e-964e-1c1bf5cd6153

📥 Commits

Reviewing files that changed from the base of the PR and between f99ba15 and abdc2ee.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (23)

• .agents/skills/terraform-provider-dev/SKILL.md
• .agents/skills/terraform-provider-dev/references/guides/provider-configuration.md
• .agents/skills/terraform-provider-dev/references/guides/testing.md
• AGENTS.md
• CONTRIBUTING.md
• README.md
• docs/index.md
• docs/resources/app.md
• examples/provider/provider.tf
• examples/resources/slack_app/import.sh
• examples/resources/slack_app/resource.tf
• go.mod
• internal/provider/apps_client.go
• internal/provider/client.go
• internal/provider/errors.go
• internal/provider/fake_slack_test.go
• internal/provider/live_test.go
• internal/provider/provider.go
• internal/provider/provider_test.go
• internal/provider/resource_app.go
• internal/provider/resource_app_test.go
• internal/provider/resource_conversation.go
• internal/provider/resource_usergroup.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The provider adds slack_app for managing Slack app manifests. It supports separate bot and app-configuration credentials, validates and reconciles manifests, and includes app lifecycle tests, documentation, and examples.

Changes

Slack app management

Layer / File(s)	Summary
Credential configuration and API clients internal/provider/provider.go, internal/provider/client.go, internal/provider/apps_client.go, internal/provider/errors.go, internal/provider/resource_conversation.go, internal/provider/resource_usergroup.go, internal/provider/provider_test.go	The provider resolves optional bot and app-configuration tokens from configuration or environment variables, then creates the corresponding clients. Resource configuration checks for its required client. The app client sends manifest requests and formats Slack errors.
Manifest resource lifecycle and tests internal/provider/resource_app.go, internal/provider/fake_slack_test.go, internal/provider/resource_app_test.go, internal/provider/live_test.go, go.mod	The new resource validates manifests before create and update, stores creation-time app attributes, reconciles configured and exported manifests, supports import, and treats specified missing-app errors as successful deletion. Fake and live tests cover the resource lifecycle and credential handling.
Provider guidance and resource examples .agents/skills/terraform-provider-dev/*, AGENTS.md, CONTRIBUTING.md, README.md, docs/index.md, docs/resources/app.md, examples/provider/provider.tf, examples/resources/slack_app/*	Documentation describes the credentials, app lifecycle, import, and testing. Examples configure both provider credentials and add a slack_app resource with an install URL output.

Estimated code review effort: 4 (Complex) | ~50 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Terraform
  participant slack_appResource
  participant appsClient
  participant SlackManifestAPI
  Terraform->>slack_appResource: Apply manifest configuration
  slack_appResource->>appsClient: Validate manifest
  appsClient->>SlackManifestAPI: POST apps.manifest.validate
  SlackManifestAPI-->>appsClient: Validation result
  slack_appResource->>appsClient: Create or update validated manifest
  appsClient->>SlackManifestAPI: POST apps.manifest.create or update
  SlackManifestAPI-->>appsClient: App data and credentials
  appsClient-->>slack_appResource: App data
  slack_appResource-->>Terraform: Save app ID, credentials, and authorization URL

Loading

Security Architecture Review

Security architecture risk: 🔵 Low · up to abdc2

The separate credentials and resource-specific requirements preserve the intended authorization boundaries. The main concern is recovery from uncertain app creation: automatic retries could leave apps outside Terraform ownership. Creation does not automatically install an app or grant it workspace access.

Retained concerns

• Low · reliability · inferred: The new app creation path inherits automatic retries without a visible idempotency or reconciliation mechanism. If Slack creates an app but the response is lost, a retry may create another app while Terraform records only the eventual successful response, or no identity at all. This can strand app ownership and creation-only credentials outside managed state. The impact is bounded by the separate manual installation step; automatic workspace privilege activation is not established.

Security review details

Security Blast Radius

• inferred — Control of the app-configuration credential and Terraform execution can affect whichever apps Slack authorizes that credential to manage, including imported IDs. The provider does not impose a separate per-app or workspace allowlist. Exact cross-workspace reach is not established by repository evidence, and creation alone does not install the app.

Trust Boundaries and Controls

• observed — Bot and app-configuration credentials use separate configuration fields, environment variables, clients, and resource gates. The focused rejection test confirms that the simulated manifest API rejects a bot token; it does not independently prove Slack's production workspace-ownership semantics.

Resilience and Maintainability Implications

• observed — Once an app ID is persisted, refresh removes state for a missing app and deletion treats missing or invalid IDs as successful completion. These recovery controls depend on knowing the ID and do not reconcile an uncertain creation whose identity was never retained.

Hardening Proposals

• proposed — Make creation retry behavior conditional on established Slack idempotency semantics, and document a reconciliation procedure for uncertain creation before rerunning apply. This would reduce unmanaged app ownership and loss of creation-only credentials without implying those failures have been observed.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit checks the manifest lines,
Then hops where app creation shines.
Two tokens rest in separate burrows,
Slack returns the state it follows.
I nibble clover, pleased to see,
An app now blooms in Terraform’s tree.}

_{Comment @coderabbitai help to get the list of available commands.}