feat(core): Allow dynamic credentials to be used via slack

[phyllis-noester]

Summary

Adds Slack integration for the dynamic credentials system, enabling n8n to dynamically resolve
credentials from incoming Slack webhook requests.

• Slack signature extractor: A context establishment hook that detects Slack webhook requests (via
  x-slack-request-timestamp / x-slack-signature headers) and extracts identifying signatures (team_id,
  user_id) from the payload.
• Slack signature identifier: Maps extracted Slack signatures to the appropriate credential type
  (slackOAuth2Api), enabling the system to know which kind of credential to look up.
• Slack credential resolver: Resolves the actual credential to use by matching the team_id from the
  incoming request against stored Slack OAuth credentials accessible to the user.
• SlackTrigger node update: Minor change to support the dynamic credentials hook integration.
• Test fix: Updated SlackTrigger.test.ts to align with the node changes.

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/IAM-211/spike-slack-integration-for-dynamic-credentials

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

[codecov]

Bundle Report

Bundle size has no change ✅

Affected Assets, Files, and Routes:

view changes for bundle: editor-ui-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
assets/worker-*.js	-2.93MB	13.37kB	-99.55%
assets/worker-*.js	2.93MB	2.95MB	21924.33% ⚠️
assets/expression-*.js	-17 bytes	209 bytes	-7.52%
assets/expression-*.js	11 bytes	220 bytes	5.26% ⚠️
assets/expression-*.js	6 bytes	226 bytes	2.73%

[codecov]

Codecov Report

❌ Patch coverage is 95.78313% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...t-establishment-hooks/slack-signature-extractor.ts	93.33%	4 Missing ⚠️
.../credential-resolvers/slack-credential-resolver.ts	93.87%	0 Missing and 3 partials ⚠️

📢 Thoughts on this report? Let us know!

[phyllis-noester]

@cubic-dev-ai

[cubic-dev-ai]

@cubic-dev-ai

@phyllis-noester I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

2 issues found across 25 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/cli/src/modules/dynamic-credentials.ee/credential-resolvers/slack-credential-resolver.ts">

<violation number="1" location="packages/cli/src/modules/dynamic-credentials.ee/credential-resolvers/slack-credential-resolver.ts:103">
P2: `cipher.decrypt(data)` is outside the try-catch block. If stored credential data is corrupted or was encrypted with a different key, the crypto layer will throw an opaque `ERR_OSSL_BAD_DECRYPT` instead of the intended `CredentialResolverDataNotFoundError`. Move the decrypt call inside the try-catch so callers get a consistent error.</violation>

<violation number="2" location="packages/cli/src/modules/dynamic-credentials.ee/credential-resolvers/slack-credential-resolver.ts:107">
P1: Custom agent: **Security Review**

Logging the `error` from `jsonParse` of decrypted credential plaintext risks leaking credential fragments into application logs. `JSON.parse` `SyntaxError` messages can include portions of the input string. Replace the raw error with a generic message or redact the error details.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant Slack as Slack API
    participant Webhook as Webhook Node
    participant Extractor as NEW: SlackSignatureExtractor
    participant CheckNode as NEW: DynamicCredentialCheck Node
    participant Proxy as NEW: CredentialCheckProxyService
    participant Resolver as NEW: SlackCredentialResolver
    participant Identifier as NEW: SlackSignatureIdentifier
    participant DB as Dynamic Credential Storage

    Note over Slack, Extractor: Webhook Context Establishment
    Slack->>Webhook: POST Webhook Request (Signature + Body)
    Webhook->>Extractor: execute(triggerItems)
    Extractor->>Extractor: Extract identity (user_id/team_id)
    Extractor->>Extractor: NEW: Mask signature headers in items
    Extractor-->>Webhook: Return CredentialContext (Identity + Unverified Metadata)

    Note over Webhook, DB: Workflow Execution Flow
    Webhook->>CheckNode: Flow continues to check node
    CheckNode->>Proxy: NEW: checkCredentialStatus(workflowId, context)
    
    Proxy->>Resolver: getWorkflowStatus(workflowId, context)
    
    Resolver->>Identifier: NEW: resolve(context, options)
    Identifier->>Identifier: RE-VERIFY Slack Signature (HMAC-SHA256)
    alt Signature Valid
        Identifier-->>Resolver: Return derived Storage Key (user_id)
        Resolver->>DB: getCredentialData(key, resolverId)
        DB-->>Resolver: data / null
    else Signature Invalid / Expired
        Identifier-->>Resolver: Throw IdentifierValidationError
    end

    alt Credential Configured
        Resolver-->>Proxy: status: 'configured'
        Proxy-->>CheckNode: readyToExecute: true
        CheckNode->>CheckNode: Route to 'Ready' output
    else Credential Missing
        Resolver-->>Proxy: status: 'missing'
        Proxy->>Proxy: NEW: generateAuthorizationUrl()
        Proxy-->>CheckNode: readyToExecute: false + authorizationUrl
        CheckNode->>CheckNode: Route to 'Not Ready' output
    end

    Note over CheckNode, Proxy: Security & Redaction
    alt Execution Finished
        CheckNode->>CheckNode: CHANGED: apply redaction strategy
        Note right of CheckNode: Wildcard [*] traverses array<br/>to hide authorizationUrl in logs
    end

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}