From ff74f6a1c5a5692cd61daefeefe70a0a371e2c07 Mon Sep 17 00:00:00 2001
From: Sarah Fortune <sarah.fortune@gmail.com>
Date: Wed, 12 Aug 2026 19:48:06 -0700
Subject: [PATCH] test(slack): preserve enterprise user identity scope

---
 extensions/slack/src/monitor/allow-list.test.ts | 10 ++++++++++
 extensions/slack/src/monitor/auth.test.ts       |  6 +++---
 extensions/slack/src/monitor/monitor.test.ts    |  6 +++---
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/extensions/slack/src/monitor/allow-list.test.ts b/extensions/slack/src/monitor/allow-list.test.ts
index 809792b93f1c..60adf9870fdb 100644
--- a/extensions/slack/src/monitor/allow-list.test.ts
+++ b/extensions/slack/src/monitor/allow-list.test.ts
@@ -5,6 +5,7 @@ import {
   normalizeAllowListLower,
   normalizeSlackSlug,
   resolveSlackAllowListMatch,
+  resolveSlackUserAllowListForTeam,
   resolveSlackUserAllowed,
 } from "./allow-list.js";
 
@@ -116,4 +117,13 @@ describe("slack/allow-list", () => {
       }),
     ).toEqual({ allowed: false });
   });
+
+  it("preserves org-wide IDs and workspace-qualified user identities", () => {
+    expect(
+      resolveSlackUserAllowListForTeam({
+        allowList: ["W01234567", "team:T11111111:user:U01234567", "team:T22222222:user:U01234567"],
+        teamId: "T11111111",
+      }),
+    ).toEqual(["w01234567", "team:t11111111:user:u01234567"]);
+  });
 });
diff --git a/extensions/slack/src/monitor/auth.test.ts b/extensions/slack/src/monitor/auth.test.ts
index ab22cc85d4fe..58d86d89a258 100644
--- a/extensions/slack/src/monitor/auth.test.ts
+++ b/extensions/slack/src/monitor/auth.test.ts
@@ -195,13 +195,13 @@ describe("resolveSlackEffectiveAllowFrom", () => {
         includePairingStore: true,
         eventScope: { teamId: "T11111111", client: {} as never },
       }),
-    ).resolves.toEqual(["uconfig123", "ulegacy123", "u11111111"]);
+    ).resolves.toEqual(["uconfig123", "ulegacy123", "team:t11111111:user:u11111111"]);
     await expect(
       resolveSlackEffectiveAllowFrom(ctx, {
         includePairingStore: true,
         eventScope: { teamId: "T22222222", client: {} as never },
       }),
-    ).resolves.toEqual(["uconfig123", "ulegacy123", "u22222222"]);
+    ).resolves.toEqual(["uconfig123", "ulegacy123", "team:t22222222:user:u22222222"]);
     await expect(
       resolveSlackEffectiveAllowFrom(ctx, { includePairingStore: true }),
     ).resolves.toEqual(["uconfig123", "ulegacy123"]);
@@ -215,7 +215,7 @@ describe("resolveSlackEffectiveAllowFrom", () => {
       resolveSlackEffectiveAllowFrom(ctx, {
         eventScope: { teamId: "T11111111", client: {} as never },
       }),
-    ).resolves.toEqual(["u01234567"]);
+    ).resolves.toEqual(["team:t11111111:user:u01234567"]);
     await expect(
       resolveSlackEffectiveAllowFrom(ctx, {
         eventScope: { teamId: "T22222222", client: {} as never },
diff --git a/extensions/slack/src/monitor/monitor.test.ts b/extensions/slack/src/monitor/monitor.test.ts
index 227b0a8500c7..c73d79824d08 100644
--- a/extensions/slack/src/monitor/monitor.test.ts
+++ b/extensions/slack/src/monitor/monitor.test.ts
@@ -223,7 +223,7 @@ describe("resolveSlackChannelConfig", () => {
     );
   });
 
-  it("matches per-channel users only in their selected workspace", () => {
+  it("preserves org-wide and workspace-qualified per-channel user identities", () => {
     const channels = {
       "team:T11111111:channel:C01234567": {
         users: ["team:T11111111:user:U01234567", "team:T22222222:user:U12345678", "U23456789"],
@@ -239,14 +239,14 @@ describe("resolveSlackChannelConfig", () => {
         channelId: "C01234567",
         channels,
       })?.users,
-    ).toEqual(["u01234567", "team:t22222222:user:u12345678", "u23456789"]);
+    ).toEqual(["team:t11111111:user:u01234567", "team:t22222222:user:u12345678", "u23456789"]);
     expect(
       resolveSlackChannelConfig({
         teamId: "T22222222",
         channelId: "C01234567",
         channels,
       })?.users,
-    ).toEqual(["team:t11111111:user:u01234567", "u12345678", "u23456789"]);
+    ).toEqual(["team:t11111111:user:u01234567", "team:t22222222:user:u12345678", "u23456789"]);
   });
 
   it("blocks channel-name route matches by default", () => {