Skip to content

Fail explicitly when multiple owners found for Slack/Discord bot messages#758

Open
kilo-code-bot[bot] wants to merge 1 commit intomainfrom
fix/reject-duplicate-bot-integrations
Open

Fail explicitly when multiple owners found for Slack/Discord bot messages#758
kilo-code-bot[bot] wants to merge 1 commit intomainfrom
fix/reject-duplicate-bot-integrations

Conversation

@kilo-code-bot
Copy link
Contributor

@kilo-code-bot kilo-code-bot bot commented Mar 3, 2026

Summary

  • Adds duplicate integration detection for both Slack and Discord bot message processing, preventing non-deterministic owner selection when multiple integrations exist for the same workspace/server.
  • When duplicates are found, returns a clear error message to the user and logs a warning with the affected owner IDs, instead of silently picking one.
  • Adds getAllInstallationsByTeamId and getAllInstallationsByGuildId query functions to support the duplicate detection.

Changes

File Change
src/lib/integrations/slack-service.ts Added getAllInstallationsByTeamId()
src/lib/integrations/discord-service.ts Added getAllInstallationsByGuildId()
src/lib/slack-bot.ts Detect and reject duplicate Slack integrations in processKiloBotMessage()
src/lib/discord-bot.ts Detect and reject duplicate Discord integrations in processDiscordBotMessage()

Built for Remon Oldenbeuving by Kilo for Slack

…ages

Previously, if multiple integrations existed for the same Slack workspace
or Discord server (e.g. installed on both a personal account and an org),
the bot would non-deterministically pick one, causing unpredictable failures.

Now the bot detects duplicate integrations and returns a clear error message
to the user asking them to remove the duplicate, instead of proceeding with
an arbitrary installation.
return db
.select()
.from(platform_integrations)
.where(
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[WARNING]: This query does not filter by integration_status. A suspended or pending integration would count toward the duplicate check, potentially blocking a valid active integration from being used.

Consider adding eq(platform_integrations.integration_status, INTEGRATION_STATUS.ACTIVE) to the and(...) clause. The same applies to the Slack counterpart getAllInstallationsByTeamId.

return db
.select()
.from(platform_integrations)
.where(
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[WARNING]: Same as the Discord counterpart — this query does not filter by integration_status. A suspended integration would be counted as a duplicate, causing the bot to reject messages even if only one integration is actually active.

@kilo-code-bot
Copy link
Contributor Author

kilo-code-bot bot commented Mar 3, 2026

Code Review Summary

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 3
SUGGESTION 1
Issue Details (click to expand)

WARNING

File Line Issue
src/lib/integrations/discord-service.ts 163 getAllInstallationsByGuildId does not filter by integration_status — suspended/pending integrations count as duplicates, potentially blocking a valid active integration
src/lib/integrations/slack-service.ts 170 getAllInstallationsByTeamId has the same missing integration_status filter issue
Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File Line Severity Issue
src/app/slack/webhook/route.ts 188 WARNING Still uses getInstallationByTeamId (which picks the first result via .limit(1)). When duplicates exist, the webhook handler will proceed with an arbitrary installation (adding reactions, typing indicators) while processKiloBotMessage will reject with a duplicate error. This creates an inconsistent user experience — the bot appears to start processing but then returns an error. Consider using getAllInstallationsByTeamId here too, or at minimum handling the duplicate case before adding reactions.
src/lib/integrations/discord-service.ts 136 SUGGESTION getInstallationByGuildId is now dead code — no file imports it after this PR. Consider removing it to avoid confusion.
Files Reviewed (4 files)
  • src/lib/discord-bot.ts - 0 issues
  • src/lib/integrations/discord-service.ts - 1 issue
  • src/lib/integrations/slack-service.ts - 1 issue
  • src/lib/slack-bot.ts - 0 issues

Fix these issues in Kilo Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants