Tom Moor a1b9f900c7 perf: Avoid correlated subquery in Slack hooks user lookup (#12432) ...

* perf: Avoid correlated subquery in Slack hooks user lookup

Query UserAuthentication directly by indexed providerId and load the
associated User and Team, instead of driving from User.findOne with a
required hasMany include — which Sequelize translates into a correlated
subquery that scans the users table.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix: Scope Slack fallback user lookup to matching AuthenticationProvider

The fallback in findUserForRequest matched any UserAuthentication with
the same providerId, which is only unique per (providerId, userId).
A colliding external user id from another workspace or provider could
resolve a user from the wrong team. Constrain via the AuthenticationProvider
join (name = "slack", providerId = serviceTeamId).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* test

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-23 14:15:22 -04:00

..

client

chore: Replace lodash with es-toolkit (#12281)

2026-05-06 21:03:47 -04:00

server

perf: Avoid correlated subquery in Slack hooks user lookup (#12432)

2026-05-23 14:15:22 -04:00

shared

Refactor of OAuth account linking flows (#12246)

2026-05-02 18:54:38 -04:00

plugin.json

Changes plugin interface from 'roles' to 'enabled' method for more flexibility

2024-06-24 08:33:48 -04:00