Sourced from slack-sdk's releases.

version 3.8.0

New Features

Token Rotation Support

This version includes the token rotation feature support for better security. Refer to the API document for the general information about the feature.

How to enable token rotation with this SDK

Apart from the column additions for the feature (specifically, refresh token + expiration date time) and the corresponding changes in your app code, no significant code is needed. Checking the example apps using Flask, Sanic in this directory can be helpful to learn what to do.

In a nutshell, you can call the following rotate_tokens method before handling every single incoming request from Slack. As long as your InstallationStore support the token rotation patterns, the code below should work as-is.

from slack_sdk.oauth.token_rotation import TokenRotator
from slack_sdk.oauth.installation_store import FileInstallationStore
This instance can be singleton; thread-safe
token_rotator = TokenRotator(
# These are required for refreshing tokens
client_id=client_id,
client_secret=client_secret,
)
Your own InstallationStore here
installation_store = FileInstallationStore()
def rotate_tokens(
enterprise_id: Optional[str] = None,
team_id: Optional[str] = None,
user_id: Optional[str] = None,
is_enterprise_install: Optional[bool] = None,
):
installation = installation_store.find_installation(
enterprise_id=enterprise_id,
team_id=team_id,
user_id=user_id,
is_enterprise_install=is_enterprise_install,
)
if installation is not None:
# If rotation does not occur, refreshed_installation is None
refreshed_installation = token_rotator.perform_token_rotation(installation=installation)
if refreshed_installation is not None:
# Save the new access token for the following processes
installation_store.save(refreshed_installation)

Migration guide for SQLAlchemyInstallationStore users

If your app uses the built-in SQLAlchemyInstallationStore for managing Slack app installations, adding the following database columns is required for this version upgrade. Refer to the code to check the complete ones.

... (truncated)

• 8bbb5d4 version 3.8.0 (#1064)
• dcf1c7c Tweak comments and code format
• af9a8c9 version 3.8.0rc2
• bc364f2 Add save_bot methods
• 96ba35f version 3.8.0rc1
• 8f606a2 Fix issue #1059 token rotation support
• df9d71b Fix #1049 by correcting request body format and next_cursor extraction (#1061)
• 44e5554 Fix #1053 by changing request body format to params (#1054)
• 3422a23 Make WebhookClient (sync/async) #send method accept link unfurl params (#1047)
• a087d71 Update command in docs (#1048)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)