Slack SSO with Auth0

// Replace with your community's login page URL
const LOGIN_PAGE_URL = "https://your-community.tightknit.ai/login";

exports.onExecutePostLogin = async (event, api) => {
  // ---------------------------------------------------------------
  // Check membership via the Tightknit API.
  // The endpoint returns is_member, is_deactivated, and is_forgotten
  // for the given email address.
  // ---------------------------------------------------------------
  const response = await fetch("https://api.tightknit.ai/admin/v0/members/check", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      // Customer API key, scoped to your community (no tenant header needed)
      "Authorization": `Bearer ${event.secrets.TIGHTKNIT_API_KEY}`,
    },
    body: JSON.stringify({ email: event.user.email }),
  });

  // ---------------------------------------------------------------
  // Fail closed: if the API is unreachable, block the login.
  // ---------------------------------------------------------------
  if (!response.ok) {
    console.log(`Member check failed with status ${response.status}`);
    api.redirect.sendUserTo(LOGIN_PAGE_URL, {
      query: { error: "service_unavailable" },
    });
    return;
  }

  const result = await response.json();
  const isMember = result.data?.is_member === true;
  const isDeactivated = result.data?.is_deactivated === true;
  const isForgotten = result.data?.is_forgotten === true;

  // ---------------------------------------------------------------
  // Not a member: redirect to error page.
  // We use api.redirect.sendUserTo() instead of api.access.deny()
  // because deny() produces a broken SAML response that Slack
  // can't display cleanly. The redirect gives the user a clear,
  // branded error message on the community login page.
  // ---------------------------------------------------------------
  if (!isMember) {
    api.redirect.sendUserTo(LOGIN_PAGE_URL, {
      query: { error: "member_not_found" },
    });

    // Clean up the Auth0 user if it was just auto-created.
    // logins_count === 0 means this is their first attempt.
    if (event.stats.logins_count === 0) {
      try {
        const ManagementClient = require("auth0").ManagementClient;
        const management = new ManagementClient({
          domain: event.secrets.domain,
          clientId: event.secrets.clientId,
          clientSecret: event.secrets.clientSecret,
        });
        await management.users.delete({ id: event.user.user_id });
      } catch (e) {
        console.log(`Failed to delete non-member user: ${e.message}`);
      }
    }
    return;
  }

  // ---------------------------------------------------------------
  // Member exists but account is deactivated or forgotten (GDPR).
  // ---------------------------------------------------------------
  if (isDeactivated) {
    api.redirect.sendUserTo(LOGIN_PAGE_URL, {
      query: { error: "account_deactivated" },
    });
    return;
  }

  if (isForgotten) {
    api.redirect.sendUserTo(LOGIN_PAGE_URL, {
      query: { error: "account_forgotten" },
    });
    return;
  }

  // ---------------------------------------------------------------
  // Active member: allow the login to complete.
  // Auth0 sends the SAML response to Slack and the user is logged in.
  // ---------------------------------------------------------------
};