From 1c0c562f645485b5de10cd560183d636651c44d8 Mon Sep 17 00:00:00 2001
From: Eden Zimbelman <eden.zimbelman@salesforce.com>
Date: Thu, 1 Oct 2026 14:07:32 -0700
Subject: [PATCH] feat: add app_level_token_rotation_enabled setting to app
 manifest

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>
---
 internal/shared/types/app_manifest.go      | 21 ++++++-------
 internal/shared/types/app_manifest_test.go | 35 ++++++++++++++++++++++
 2 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/internal/shared/types/app_manifest.go b/internal/shared/types/app_manifest.go
index 743d0feb..4af726cd 100644
--- a/internal/shared/types/app_manifest.go
+++ b/internal/shared/types/app_manifest.go
@@ -115,16 +115,17 @@ type OAuthConfig struct {
 }
 
 type AppSettings struct {
-	SocketModeEnabled      *bool                       `json:"socket_mode_enabled,omitempty" yaml:"socket_mode_enabled,omitempty"`
-	OrgDeployEnabled       *bool                       `json:"org_deploy_enabled,omitempty" yaml:"org_deploy_enabled,omitempty"`
-	Interactivity          *ManifestInteractivity      `json:"interactivity,omitempty" yaml:"interactivity,omitempty"`
-	IncomingWebhooks       *IncomingWebhooks           `json:"incoming_webhooks,omitempty" yaml:"incoming_webhooks,flow,omitempty"`
-	EventSubscriptions     *ManifestEventSubscriptions `json:"event_subscriptions,omitempty" yaml:"event_subscriptions,flow,omitempty"`
-	AllowedIPAddressRanges []string                    `json:"allowed_ip_address_ranges,omitempty" yaml:"allowed_ip_address_ranges,flow,omitempty"`
-	FunctionRuntime        FunctionRuntime             `json:"function_runtime,omitempty" yaml:"function_runtime,flow,omitempty"`
-	TokenRotationEnabled   *bool                       `json:"token_rotation_enabled,omitempty" yaml:"token_rotation_enabled,omitempty"`
-	SiwsLinks              *SiwsLinks                  `json:"siws_links,omitempty" yaml:"siws_links,flow,omitempty"`
-	IsMCPEnabled           *bool                       `json:"is_mcp_enabled,omitempty" yaml:"is_mcp_enabled,omitempty"`
+	SocketModeEnabled            *bool                       `json:"socket_mode_enabled,omitempty" yaml:"socket_mode_enabled,omitempty"`
+	OrgDeployEnabled             *bool                       `json:"org_deploy_enabled,omitempty" yaml:"org_deploy_enabled,omitempty"`
+	Interactivity                *ManifestInteractivity      `json:"interactivity,omitempty" yaml:"interactivity,omitempty"`
+	IncomingWebhooks             *IncomingWebhooks           `json:"incoming_webhooks,omitempty" yaml:"incoming_webhooks,flow,omitempty"`
+	EventSubscriptions           *ManifestEventSubscriptions `json:"event_subscriptions,omitempty" yaml:"event_subscriptions,flow,omitempty"`
+	AllowedIPAddressRanges       []string                    `json:"allowed_ip_address_ranges,omitempty" yaml:"allowed_ip_address_ranges,flow,omitempty"`
+	FunctionRuntime              FunctionRuntime             `json:"function_runtime,omitempty" yaml:"function_runtime,flow,omitempty"`
+	TokenRotationEnabled         *bool                       `json:"token_rotation_enabled,omitempty" yaml:"token_rotation_enabled,omitempty"`
+	AppLevelTokenRotationEnabled *bool                       `json:"app_level_token_rotation_enabled,omitempty" yaml:"app_level_token_rotation_enabled,omitempty"`
+	SiwsLinks                    *SiwsLinks                  `json:"siws_links,omitempty" yaml:"siws_links,flow,omitempty"`
+	IsMCPEnabled                 *bool                       `json:"is_mcp_enabled,omitempty" yaml:"is_mcp_enabled,omitempty"`
 }
 
 type WorkflowStep struct {
diff --git a/internal/shared/types/app_manifest_test.go b/internal/shared/types/app_manifest_test.go
index cb372c5d..75fe80dc 100644
--- a/internal/shared/types/app_manifest_test.go
+++ b/internal/shared/types/app_manifest_test.go
@@ -355,6 +355,41 @@ func Test_AppManifest_AppSettings_IsMCPEnabled(t *testing.T) {
 	}
 }
 
+func Test_AppManifest_AppSettings_AppLevelTokenRotationEnabled(t *testing.T) {
+	truth := true
+	tests := map[string]struct {
+		settings              *AppSettings
+		expectedRotationValue *bool
+		expectedJSON          string
+	}{
+		"undefined setting has no value": {
+			settings:              &AppSettings{},
+			expectedRotationValue: nil,
+			expectedJSON:          `{}`,
+		},
+		"defined setting has a value": {
+			settings:              &AppSettings{AppLevelTokenRotationEnabled: &truth},
+			expectedRotationValue: &truth,
+			expectedJSON:          `{"app_level_token_rotation_enabled":true}`,
+		},
+	}
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			manifest := AppManifest{
+				Settings: tc.settings,
+			}
+			if tc.settings != nil {
+				actualJSON, err := json.Marshal(tc.settings)
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedJSON, string(actualJSON))
+				assert.Equal(t, tc.expectedRotationValue, manifest.Settings.AppLevelTokenRotationEnabled)
+			} else {
+				assert.Nil(t, manifest.Settings)
+			}
+		})
+	}
+}
+
 func Test_AppManifest_AppSettings_IncomingWebhooks(t *testing.T) {
 	falsity := false
 	expectedIncomingWebhooks := IncomingWebhooks{