fix(slack): Slack channel fixes, DM filtering, emoji sanitization, and TLS

Fixes several Slack adapter issues and restores the build after #117.

Build fixes:
- Restore compile after security middleware changes (Axum State extractor
  pattern in api_auth_middleware, url::Url → reqwest::Url in browser tool)
(this is from unmerged pr #125)

Slack DM filtering:
- DMs now bypass workspace/channel filters when sender is in dm_allowed_users
- dm_allowed_users is merged from both SlackConfig and per-binding configs
- Added debug logging for DM permission decisions

Emoji reactions:
- Sanitize Slack emoji reactions to use shortcodes via the `emojis` crate
- Handle edge case where emoji has no shortcode (falls back to name)
- Strip colons, normalize whitespace and casing

TLS connectivity:
- Add tokio-tungstenite with rustls-tls-native-roots feature to fix wss://
  connections that broke after the tungstenite 0.28 TLS feature restructure

Logging:
- Downgrade per-message Slack log from info to debug, matching Discord,
  Telegram, and Twitch adapters which only use info for lifecycle events

Style:
- Rename abbreviated `uid` to `sender_id` per style guide
- Remove section-divider comments and extra blank lines in imports

Tests:
- 9 unit tests for sanitize_reaction_name (unicode, shortcodes, fallbacks)
- 7 unit tests for SlackPermissions::from_config (merging, dedup, filtering)

Author: sra

Cargo.lock

@@ -91,9 +91,13 @@ async-trait = "0.1"
 
 # Slack
 slack-morphism = { version = "2.17", features = ["hyper"] }
+emojis = "0.8"
 
 # TLS (shared crypto backend for slack-morphism, reqwest, teloxide)
 rustls = { version = "0.23", default-features = false, features = ["ring"] }
+# slack-morphism enables tokio-tungstenite/rustls-native-certs, but tokio-tungstenite 0.28
+# restructured features — rustls-tls-native-roots is now needed to activate actual TLS.
+tokio-tungstenite = { version = "0.28", features = ["rustls-tls-native-roots"] }
 
 # Telegram
 teloxide = { version = "0.17", default-features = false, features = ["rustls"] }

Cargo.toml

@@ -7,8 +7,8 @@ use super::{
 };
 
 use axum::Json;
-use axum::extract::Request;
 use axum::Router;
+use axum::extract::{Request, State};
 use axum::http::{StatusCode, Uri, header};
 use axum::middleware::{self, Next};
 use axum::response::{Html, IntoResponse, Response};
@@ -177,7 +177,11 @@ pub async fn start_http_server(
     Ok(handle)
 }
 
-async fn api_auth_middleware(state: Arc<ApiState>, request: Request, next: Next) -> Response {
+async fn api_auth_middleware(
+    State(state): State<Arc<ApiState>>,
+    request: Request,
+    next: Next,
+) -> Response {
     let Some(expected_token) = state.auth_token.as_deref() else {
         return next.run(request).await;
     };
@@ -197,7 +201,11 @@ async fn api_auth_middleware(state: Arc<ApiState>, request: Request, next: Next)
     if is_authorized {
         next.run(request).await
     } else {
-        (StatusCode::UNAUTHORIZED, Json(json!({"error": "unauthorized"}))).into_response()
+        (
+            StatusCode::UNAUTHORIZED,
+            Json(json!({"error": "unauthorized"})),
+        )
+            .into_response()
     }
 }
 

src/api/server.rs

@@ -877,7 +877,15 @@ impl SlackPermissions {
             filter
         };
 
-        let dm_allowed_users = slack.dm_allowed_users.clone();
+        let mut dm_allowed_users = slack.dm_allowed_users.clone();
+
+        for binding in &slack_bindings {
+            for id in &binding.dm_allowed_users {
+                if !dm_allowed_users.contains(id) {
+                    dm_allowed_users.push(id.clone());
+                }
+            }
+        }
 
         Self {
             workspace_filter,
@@ -3985,4 +3993,104 @@ bind = "127.0.0.1"
 
         assert_eq!(config.api.bind, "[::]");
     }
+
+
+    /// Helper to build a minimal `SlackConfig` for permission tests.
+    fn slack_config_with_dm_users(dm_allowed_users: Vec<String>) -> SlackConfig {
+        SlackConfig {
+            enabled: true,
+            bot_token: "xoxb-test".into(),
+            app_token: "xapp-test".into(),
+            dm_allowed_users,
+            commands: vec![],
+        }
+    }
+
+    /// Helper to build a Slack binding with optional dm_allowed_users.
+    fn slack_binding(workspace_id: Option<&str>, dm_allowed_users: Vec<String>) -> Binding {
+        Binding {
+            agent_id: "test-agent".into(),
+            channel: "slack".into(),
+            guild_id: None,
+            workspace_id: workspace_id.map(String::from),
+            chat_id: None,
+            channel_ids: vec![],
+            require_mention: false,
+            dm_allowed_users,
+        }
+    }
+
+    #[test]
+    fn slack_permissions_merges_dm_users_from_config_and_bindings() {
+        let config = slack_config_with_dm_users(vec!["U001".into(), "U002".into()]);
+        let bindings = vec![slack_binding(
+            Some("T1"),
+            vec!["U003".into(), "U004".into()],
+        )];
+        let perms = SlackPermissions::from_config(&config, &bindings);
+        assert_eq!(perms.dm_allowed_users, vec!["U001", "U002", "U003", "U004"]);
+    }
+
+    #[test]
+    fn slack_permissions_deduplicates_dm_users() {
+        let config = slack_config_with_dm_users(vec!["U001".into(), "U002".into()]);
+        let bindings = vec![slack_binding(
+            Some("T1"),
+            vec!["U002".into(), "U003".into()],
+        )];
+        let perms = SlackPermissions::from_config(&config, &bindings);
+        // U002 appears in both config and binding — should appear only once
+        assert_eq!(perms.dm_allowed_users, vec!["U001", "U002", "U003"]);
+    }
+
+    #[test]
+    fn slack_permissions_empty_dm_users_stays_empty() {
+        let config = slack_config_with_dm_users(vec![]);
+        let bindings = vec![slack_binding(Some("T1"), vec![])];
+        let perms = SlackPermissions::from_config(&config, &bindings);
+        assert!(perms.dm_allowed_users.is_empty());
+    }
+
+    #[test]
+    fn slack_permissions_merges_dm_users_from_multiple_bindings() {
+        let config = slack_config_with_dm_users(vec!["U001".into()]);
+        let bindings = vec![
+            slack_binding(Some("T1"), vec!["U002".into()]),
+            slack_binding(Some("T2"), vec!["U003".into()]),
+        ];
+        let perms = SlackPermissions::from_config(&config, &bindings);
+        assert_eq!(perms.dm_allowed_users, vec!["U001", "U002", "U003"]);
+    }
+
+    #[test]
+    fn slack_permissions_ignores_non_slack_bindings() {
+        let config = slack_config_with_dm_users(vec!["U001".into()]);
+        let mut discord_binding = slack_binding(Some("T1"), vec!["U099".into()]);
+        discord_binding.channel = "discord".into();
+        let perms = SlackPermissions::from_config(&config, &[discord_binding]);
+        // U099 should not appear — that binding is for discord, not slack
+        assert_eq!(perms.dm_allowed_users, vec!["U001"]);
+    }
+
+    #[test]
+    fn slack_permissions_workspace_filter_from_bindings() {
+        let config = slack_config_with_dm_users(vec![]);
+        let bindings = vec![
+            slack_binding(Some("T1"), vec![]),
+            slack_binding(Some("T2"), vec![]),
+        ];
+        let perms = SlackPermissions::from_config(&config, &bindings);
+        assert_eq!(
+            perms.workspace_filter,
+            Some(vec!["T1".to_string(), "T2".to_string()])
+        );
+    }
+
+    #[test]
+    fn slack_permissions_no_workspace_filter_when_none_specified() {
+        let config = slack_config_with_dm_users(vec![]);
+        let bindings = vec![slack_binding(None, vec![])];
+        let perms = SlackPermissions::from_config(&config, &bindings);
+        assert!(perms.workspace_filter.is_none());
+    }
 }