fix: defer SignatureVerifier construction so Socket Mode apps init without a signing secret

slack_sdk>=3.43.0 validates the signing secret when a SignatureVerifier is
constructed, raising "ValueError: signing_secret must not be empty." App.__init__
eagerly builds the RequestVerification middleware (and thus a SignatureVerifier)
for every app, including Socket Mode apps that have no signing secret, so those
apps now fail to initialize.

Construct the SignatureVerifier lazily on first use instead. Request verification
is already skipped for Socket Mode requests, so the verifier is never built for
them. HTTP requests still require a valid signing secret as before.

Fixes #1535

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Author: zimeg

slack_bolt/middleware/request_verification/request_verification.py

@@ -20,9 +20,20 @@ def __init__(self, signing_secret: str, base_logger: Optional[Logger] = None):
             signing_secret: The signing secret
             base_logger: The base logger
         """
-        self.verifier = SignatureVerifier(signing_secret=signing_secret)
+        # The verifier is created lazily so that apps without a signing secret
+        # (e.g. Socket Mode) can be initialized. slack_sdk>=3.43.0 rejects an
+        # empty signing secret on construction, but request verification is
+        # skipped for those requests anyway (see `_can_skip`).
+        self._signing_secret = signing_secret
+        self._verifier: Optional[SignatureVerifier] = None
         self.logger = get_bolt_logger(RequestVerification, base_logger=base_logger)
 
+    @property
+    def verifier(self) -> SignatureVerifier:
+        if self._verifier is None:
+            self._verifier = SignatureVerifier(signing_secret=self._signing_secret)
+        return self._verifier
+
     def process(
         self,
         *,

tests/scenario_tests/test_app.py

@@ -96,6 +96,16 @@ def test_token_verification_enabled_False(self):
 
         assert self.received_requests.get("/auth.test") is None
 
+    def test_socket_mode_app_without_signing_secret(self):
+        # A Socket Mode app has no signing secret. Initializing the app must not
+        # raise, even though slack_sdk>=3.43.0 rejects an empty signing secret
+        # when the request verification middleware builds its SignatureVerifier.
+        app = App(
+            client=self.web_client,
+            token_verification_enabled=False,
+        )
+        assert app is not None
+
     # --------------------------
     # multi teams auth
     # --------------------------

tests/slack_bolt/middleware/request_verification/test_request_verification.py

@@ -60,3 +60,17 @@ def test_ssl_check_param_requires_valid_signature(self):
         resp = middleware.process(req=req, resp=resp, next=next)
         assert resp.status == 401
         assert resp.body == """{"error": "invalid request"}"""
+
+    def test_empty_signing_secret_does_not_raise_on_init(self):
+        # A Socket Mode app has no signing secret. Constructing the middleware
+        # must not raise, even though slack_sdk>=3.43.0 rejects an empty
+        # signing secret when the SignatureVerifier is created.
+        RequestVerification(signing_secret="")
+
+    def test_socket_mode_request_skips_verification_without_signing_secret(self):
+        middleware = RequestVerification(signing_secret="")
+        req = BoltRequest(mode="socket_mode", body="payload={}", headers={})
+        resp = BoltResponse(status=404, body="default")
+        resp = middleware.process(req=req, resp=resp, next=next)
+        assert resp.status == 200
+        assert resp.body == "next"

tests/slack_bolt_async/middleware/request_verification/test_request_verification.py

@@ -66,3 +66,18 @@ async def test_ssl_check_param_requires_valid_signature(self):
         resp = await middleware.async_process(req=req, resp=resp, next=next)
         assert resp.status == 401
         assert resp.body == """{"error": "invalid request"}"""
+
+    def test_empty_signing_secret_does_not_raise_on_init(self):
+        # A Socket Mode app has no signing secret. Constructing the middleware
+        # must not raise, even though slack_sdk>=3.43.0 rejects an empty
+        # signing secret when the SignatureVerifier is created.
+        AsyncRequestVerification(signing_secret="")
+
+    @pytest.mark.asyncio
+    async def test_socket_mode_request_skips_verification_without_signing_secret(self):
+        middleware = AsyncRequestVerification(signing_secret="")
+        req = AsyncBoltRequest(mode="socket_mode", body="payload={}", headers={})
+        resp = BoltResponse(status=404, body="default")
+        resp = await middleware.async_process(req=req, resp=resp, next=next)
+        assert resp.status == 200
+        assert resp.body == "next"