Skip to content

Commit e80faee

Browse files
committed
fix(slack): refresh stale construction-cascade comment
Post-merge review of the verifier-precedence flip caught that the multi-line comment at adapter.py:285-293 still described the pre-flip 'normalize empty-string to None then validate' cascade. After the flip, empty-string signing_secret is rejected outright by an explicit guard below, so the normalize-cascade rationale is dead code documentation. Replace with a 3-line summary pointing at the actual mechanism. Same class of bug PR #87 originally shipped with (stale 'matches upstream' comment) — caught here by the review pattern instead of letting it sit.
1 parent 0e3d78a commit e80faee

1 file changed

Lines changed: 3 additions & 9 deletions

File tree

src/chat_sdk/adapters/slack/adapter.py

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -282,15 +282,9 @@ def __init__(self, config: SlackAdapterConfig | None = None) -> None:
282282
# shadow it (mirrors upstream vercel/chat#468, which reversed the
283283
# original direction the Python port shipped in PR #87).
284284
#
285-
# Use explicit ``is not None`` checks rather than truthiness fallbacks
286-
# (per docs/UPSTREAM_SYNC.md hazard #1): an explicit empty string for
287-
# ``signing_secret`` should fail validation, not silently fall through
288-
# to ``SLACK_SIGNING_SECRET`` from the environment. *But* an empty
289-
# string is itself unusable downstream (``_verify_signature`` would
290-
# short-circuit with ``if not self._signing_secret`` and reject every
291-
# webhook with 401), so after the cascade we normalize ``""`` to
292-
# ``None`` to surface the misconfiguration here at init rather than
293-
# silently failing on every request.
285+
# Empty-string ``signing_secret`` is rejected outright below;
286+
# empty ``SLACK_SIGNING_SECRET`` env values are normalized to ``None``
287+
# so they can't masquerade as a configured secret.
294288
webhook_verifier = config.webhook_verifier
295289
# Reject an explicit empty-string ``signing_secret`` at construction —
296290
# even when a ``webhook_verifier`` is set. An explicit ``""`` is a

0 commit comments

Comments
 (0)