fix: defer SignatureVerifier construction so Socket Mode apps init without a signing secret (#1541)

Co-authored-by: William Bergamin <wbergamin@salesforce.com>

Author: zimeg

slack_bolt/middleware/request_verification/request_verification.py

@@ -1,5 +1,5 @@
 from logging import Logger
-from typing import Callable, Dict, Any, Optional
+from typing import Any, Callable, Dict, Optional
 
 from slack_sdk.signature import SignatureVerifier
 
@@ -20,9 +20,17 @@ def __init__(self, signing_secret: str, base_logger: Optional[Logger] = None):
             signing_secret: The signing secret
             base_logger: The base logger
         """
-        self.verifier = SignatureVerifier(signing_secret=signing_secret)
+        self._signing_secret = signing_secret
+        self._verifier: Optional[SignatureVerifier] = None
         self.logger = get_bolt_logger(RequestVerification, base_logger=base_logger)
 
+    @property
+    def verifier(self) -> SignatureVerifier:
+        # Defer initialization to avoid errors during start up
+        if self._verifier is None:
+            self._verifier = SignatureVerifier(signing_secret=self._signing_secret)
+        return self._verifier
+
     def process(
         self,
         *,

tests/scenario_tests/test_app.py

@@ -96,6 +96,13 @@ def test_token_verification_enabled_False(self):
 
         assert self.received_requests.get("/auth.test") is None
 
+    def test_socket_mode_app_without_signing_secret(self):
+        app = App(
+            client=self.web_client,
+            token_verification_enabled=False,
+        )
+        assert app is not None
+
     # --------------------------
     # multi teams auth
     # --------------------------

tests/slack_bolt/middleware/request_verification/test_request_verification.py

@@ -1,5 +1,6 @@
 from time import time
 
+import pytest
 from slack_sdk.signature import SignatureVerifier
 
 from slack_bolt.middleware import RequestVerification
@@ -60,3 +61,21 @@ def test_ssl_check_param_requires_valid_signature(self):
         resp = middleware.process(req=req, resp=resp, next=next)
         assert resp.status == 401
         assert resp.body == """{"error": "invalid request"}"""
+
+    def test_empty_signing_secret_does_not_raise_on_init(self):
+        RequestVerification(signing_secret="")
+
+    def test_socket_mode_request_skips_verification_without_signing_secret(self):
+        middleware = RequestVerification(signing_secret="")
+        req = BoltRequest(mode="socket_mode", body="payload={}", headers={})
+        resp = BoltResponse(status=404, body="default")
+        resp = middleware.process(req=req, resp=resp, next=next)
+        assert resp.status == 200
+        assert resp.body == "next"
+
+    def test_http_request_with_empty_signing_secret_raises(self):
+        middleware = RequestVerification(signing_secret="")
+        req = BoltRequest(body="payload={}", headers={})
+        resp = BoltResponse(status=404)
+        with pytest.raises(ValueError):
+            middleware.process(req=req, resp=resp, next=next)

tests/slack_bolt_async/middleware/request_verification/test_request_verification.py

@@ -66,3 +66,23 @@ async def test_ssl_check_param_requires_valid_signature(self):
         resp = await middleware.async_process(req=req, resp=resp, next=next)
         assert resp.status == 401
         assert resp.body == """{"error": "invalid request"}"""
+
+    def test_empty_signing_secret_does_not_raise_on_init(self):
+        AsyncRequestVerification(signing_secret="")
+
+    @pytest.mark.asyncio
+    async def test_socket_mode_request_skips_verification_without_signing_secret(self):
+        middleware = AsyncRequestVerification(signing_secret="")
+        req = AsyncBoltRequest(mode="socket_mode", body="payload={}", headers={})
+        resp = BoltResponse(status=404, body="default")
+        resp = await middleware.async_process(req=req, resp=resp, next=next)
+        assert resp.status == 200
+        assert resp.body == "next"
+
+    @pytest.mark.asyncio
+    async def test_http_request_with_empty_signing_secret_raises(self):
+        middleware = AsyncRequestVerification(signing_secret="")
+        req = AsyncBoltRequest(body="payload={}", headers={})
+        resp = BoltResponse(status=404)
+        with pytest.raises(ValueError):
+            await middleware.async_process(req=req, resp=resp, next=next)