[DRAFT] [WIP] Add in builtin listener for token revoked and app uninstalled events

[hello-ashleyintech]

Summary

This PR is a current DRAFT state that aims to solve #1203. This PR will be marked ready for review once all the pieces are in place.

Requirements (place an x in each [ ])

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[hello-ashleyintech]

@seratch wrote this while referencing the Python and Java PRs, wanted to see if these functions / this class was on the right track for what we're trying to accomplish.

I did notice that Java and Python have a delete_bot function in the installationStore that Bolt JS doesn't seem to have - does the bot get deleted automatically upon token_revoked and app_uninstalled events in Bolt JS, or will I have to manually delete the bot? (ex: https://github.com/seratch/bolt-python/blob/2ab87ee4111554d2b3d3ca517294211fdb0ce963/slack_bolt/listener/builtins.py#L26)

[seratch]

There are two approaches:

1. Aligning with bolt-java/python
2. Opting for a simpler but more inflexible approach, which differs from bolt-python/java

[Aligning with bolt-java/python]

Aligning with bolt-python/java should be the safest, most clear, and flexible approach:

1. deleteInstallation with enterprise/team_id + user_id -> delete only user tokens
2. deleteBot with enterprise/team_id -> delete only bot tokens
3. deleteAll with enterprise/team_id -> delete both bot and user tokens

Review https://github.com/slackapi/bolt-python/blob/v1.21.2/slack_bolt/listener/builtins.py to better understand why bolt-python/java have three methods.

I don't believe this can cause any confusion. If a developer has already implemented the deleteInstallation method, bolt-js never calls the method without a user_id, so adding built-in support should not break anything.

When we release this built-in listener support, we should mention the necessity of two more method implementation, though.

[Opting for a simpler but more inflexible approach]

If we try to only use deleteInstallation, the method can function in the following ways:

1. deleteInstallation with enterprise/team_id + user_id -> Deletes only user tokens
2. deleteInstallation with enterprise/team_id -> Deletes both bot and user tokens, similar to deleteAll

This approach should also work, but the downside is that when an app does not want to delete user tokens while deleting a bot token, deleteInstallation with enterprise/team_id does not behave this way.

While Bolt supports user-token-only use cases, we generally recommend having a bot token to enable many functionalities. Deleting a bot token usually means the app is no longer being used in the workspace. So, deleting all tokens when a bot token is revoked makes sense to many apps. With that being said, this inflexibility may limit developers options. Also, our platform intentionally provides two event types to differentiate the scenarios a single token revocation vs app uninstallation.

I recommend [Aligning with bolt-java/python], but am open to any alternatives including the second option here. @filmaj do you have any option on this?

[hello-ashleyintech]

When we release this built-in listener support, we should mention the necessity of two more method implementation, though.

@seratch Personally I like the first option! Does this mean to proceed with the first option, we'll need to release a new @slack/oauth version with the interface for InstallationStore updated to include a deleteBot and deleteAll optional method, similar to the Python implementation?

[filmaj]

I recommend [Aligning with bolt-java/python]

Agreed 👍

[seratch]

@hello-ashleyintech yes, you're right!

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.49%. Comparing base (7020a2e) to head (bf058dc).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2337   +/-   ##
=======================================
  Coverage   92.49%   92.49%           
=======================================
  Files          36       36           
  Lines        7472     7472           
  Branches      651      651           
=======================================
  Hits         6911     6911           
  Misses        553      553           
  Partials        8        8           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

---

🚨 Try these New Features:

• Flaky Tests Detection - Detect and resolve failed and flaky tests
• JS Bundle Analysis - Avoid shipping oversized bundles