fix(slack): tighten upload-file validation

obviyus · obviyus · commit 850b00367c2a · 2026-03-26T13:36:15.000+05:30
diff --git a/extensions/slack/src/message-action-dispatch.test.ts b/extensions/slack/src/message-action-dispatch.test.ts
@@ -104,6 +104,22 @@ describe("handleSlackMessageAction", () => {
     );
   });
 
+  it("requires filePath, path, or media for upload-file", async () => {
+    await expect(
+      handleSlackMessageAction({
+        providerId: "slack",
+        ctx: {
+          action: "upload-file",
+          cfg: {},
+          params: {
+            to: "channel:C1",
+          },
+        } as never,
+        invoke: createInvokeSpy() as never,
+      }),
+    ).rejects.toThrow(/upload-file requires filePath, path, or media/i);
+  });
+
   it("maps download-file to the internal downloadFile action", async () => {
     const invoke = createInvokeSpy();
 
diff --git a/extensions/slack/src/message-action-dispatch.ts b/extensions/slack/src/message-action-dispatch.ts
@@ -204,7 +204,10 @@ export async function handleSlackMessageAction(params: {
     const filePath =
       readStringParam(actionParams, "filePath", { trim: false }) ??
       readStringParam(actionParams, "path", { trim: false }) ??
-      readStringParam(actionParams, "media", { required: true, trim: false });
+      readStringParam(actionParams, "media", { trim: false });
+    if (!filePath) {
+      throw new Error("upload-file requires filePath, path, or media");
+    }
     const threadId =
       readStringParam(actionParams, "threadId") ?? readStringParam(actionParams, "replyTo");
     return await invoke(
diff --git a/extensions/slack/src/send.ts b/extensions/slack/src/send.ts
@@ -244,7 +244,7 @@ async function uploadSlackFile(params: {
     localRoots: params.mediaLocalRoots,
   });
   const uploadFileName = params.uploadFileName ?? fileName ?? "upload";
-  const uploadTitle = params.uploadTitle ?? params.uploadFileName ?? fileName ?? "upload";
+  const uploadTitle = params.uploadTitle ?? uploadFileName;
   // Use the 3-step upload flow (getUploadURLExternal -> POST -> completeUploadExternal)
   // instead of files.uploadV2 which relies on the deprecated files.upload endpoint
   // and can fail with missing_scope even when files:write is granted.
diff --git a/extensions/slack/src/send.upload.test.ts b/extensions/slack/src/send.upload.test.ts
@@ -250,4 +250,25 @@ describe("sendMessageSlack file upload with user IDs", () => {
       }),
     );
   });
+
+  it("uses uploadFileName as the title fallback when uploadTitle is omitted", async () => {
+    const client = createUploadTestClient();
+
+    await sendMessageSlack("channel:C123CHAN", "caption", {
+      token: "xoxb-test",
+      client,
+      mediaUrl: "/tmp/threaded.png",
+      uploadFileName: "custom-name.bin",
+    });
+
+    expect(client.files.getUploadURLExternal).toHaveBeenCalledWith({
+      filename: "custom-name.bin",
+      length: Buffer.from("fake-image").length,
+    });
+    expect(client.files.completeUploadExternal).toHaveBeenCalledWith(
+      expect.objectContaining({
+        files: [expect.objectContaining({ id: "F001", title: "custom-name.bin" })],
+      }),
+    );
+  });
 });
