{"record":{"id":"66b6e0dee28e9fee","repo":"windmill-labs/windmill","slug":"invalid-slack-token-url-e","errorCode":null,"errorMessage":"Invalid Slack token URL: {e}","messagePattern":"Invalid Slack token URL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-oauth/src/lib.rs","lineNumber":367,"sourceCode":"    }\n    client.set_client_secret(client_params.secret.clone());\n    client.set_redirect_url(\n        Url::parse(&redirect_url).map_err(|e| anyhow!(\"Invalid redirect URL: {e}\"))?,\n    );\n\n    Ok((name.to_string(), client))\n}\n\n/// Build a Slack OAuth client with custom credentials\npub async fn build_slack_client(\n    client_id: &str,\n    client_secret: &str,\n    _workspace_id: &str,\n) -> error::Result<OClient> {\n    let auth_url = Url::parse(\"https://slack.com/oauth/v2/authorize\")\n        .map_err(|e| anyhow!(\"Invalid Slack authorization URL: {e}\"))?;\n    let token_url = Url::parse(\"https://slack.com/api/oauth.v2.access\")\n        .map_err(|e| anyhow!(\"Invalid Slack token URL: {e}\"))?;\n\n    let base_url = (**BASE_URL.load()).clone();\n    let redirect_url = format!(\"{}/oauth/callback_slack\", base_url);\n\n    let mut client = OClient::new(client_id.to_string(), auth_url, token_url);\n    client.set_client_secret(client_secret.to_string());\n    client.set_redirect_url(\n        Url::parse(&redirect_url).map_err(|e| anyhow!(\"Invalid redirect URL: {e}\"))?,\n    );\n\n    Ok(client)\n}\n\n/// Build OAuth client for client credentials flow with resource-level credentials.\n///\n/// No instance-level entry is required: the provider endpoint config resolves\n/// from the instance `oauths` entry when one exists, else from the static\n/// registry, else is synthesized from the token URL override alone. Returns the","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-oauth/src/lib.rs#L349-L385","documentation":"Companion check in build_slack_client for the hardcoded Slack token endpoint https://slack.com/api/oauth.v2.access. Like the authorize-URL error, the literal is valid, so the error is effectively unreachable unless the source constant was altered.","triggerScenarios":"Only when the hardcoded token URL literal in build_slack_client has been modified to something Url::parse rejects.","commonSituations":"Fork/patch drift; not triggered by user configuration since Slack endpoints are not configurable here.","solutions":["Restore the literal https://slack.com/api/oauth.v2.access in windmill-oauth/src/lib.rs","Rebuild the backend after reverting the constant"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match build_slack_client(id, secret, workspace_id).await {\n    Ok(c) => c,\n    Err(e) if e.to_string().contains(\"Invalid Slack token URL\") => unreachable!(\"hardcoded URL corrupted\"),\n    Err(e) => return Err(e),\n}","preventionTips":["Keep the Slack endpoint literals byte-identical to upstream","Add a unit test asserting the constants parse as https URLs"],"tags":["oauth","slack","url-parsing"],"backgroundTag":"invalid-url-format","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}