Slack Notifications

Paid pluginsize Mplanned, not built

Indicative price, not an offer: €14/mo; credential: Slack workspace integration, alert customization

Generated from docs/plan/paid/slack-notifications/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Support teams get instant Slack alerts for high-value orders, returns, chargebacks, and inventory issues. The paid pack maintains Slack app publishing and custom alert rules; core owns the event-to-Slack interface.

The problem

Team misses high-priority events because alerts are buried in email. Order notifications should flow to Slack for instant visibility and team collaboration.

What it does

• Event types: new order (with amount, customer, items), refund requested, payment declined, inventory low, customer account flagged
• Alert rules: admin configures thresholds (order amount > 500 EUR, inventory < 5 units) that trigger Slack messages
• Rich formatting: Slack messages include order ID, customer name, total, product links, and action buttons (approve refund, view order)
• Channel routing: different event types route to different Slack channels (sales, support, ops)
• Mention routing: high-value orders mention @sales-manager by username
• Test mode: send test alert to a test channel
• Audit log: every alert sent, delivery status

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Slack thread responses: Slack messages are notifications only; merchant must respond in AstroBaaS admin (not via Slack).
• Two-way sync: clicking ‘approve’ in Slack does not approve in AstroBaaS (requires secondary authentication in AstroBaaS only).
• Digest reports: we send real-time alerts only; daily/weekly digests are merchant’s responsibility.
• Slack automation: merchant can use Slack workflows to escalate; AstroBaaS alerts are the trigger only.

Data model

New document type: slack_alert_config { eventType, threshold, slackChannel, mentionUser }. New document: slack_alert_sent { eventType, orderId/itemId, slackMessageId, sentAt, deliveryStatus }.

API

• POST /api/slack/alert-rules { eventType, threshold, slackChannel, mentionUser } (admin only)
• GET /api/slack/alert-rules (admin only)
• DELETE /api/slack/alert-rules/{ruleId} (admin only)
• POST /api/slack/test { slackChannel } -> { messageId, success }
• GET /api/slack/alerts?from=2026-09-01&to=2026-09-03 (admin only)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Admin sees: Slack workspace connection status (connected/disconnected), alert rules editor (event type, threshold, channel, mentions), test alert button, alert delivery log, failed alerts.

The seam — why this is paid

Core owns the event-to-Slack interface and alert rules engine. Paid pack owns: Slack app publishing (in Slack app marketplace), Slack app support relationship.

Credential: Slack API management, custom alert rules, webhook SLA

Dependencies

• event subsystem (existing; publishes order, payment, inventory events)
• webhook-management (existing; delivers alerts)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• An order for 600 EUR triggers a Slack alert in #sales channel with order ID, customer name, total
• Alert rule set to amount > 500 EUR shows only orders above threshold; 400 EUR order does not trigger alert
• A high-value order mentions @sales-manager by username in Slack message
• Alert rule for inventory < 5 units triggers a message in #ops channel when stock drops
• Admin configures rules for 3 event types; each routes to different channels
• Test alert button sends a message to #test channel with timestamp
• Alert delivery log shows ‘Sent’, ‘Failed’, or ‘Bounced’ status for each alert
• A Slack API error (rate limit, auth failure) is logged; alert is retried after 1 minute

Risks

If Slack token is logged unencrypted, it leaks to logs and allows unauthorized Slack access. If alert rules use OR logic instead of AND, too many alerts are sent. If high-value orders mention the same person in every alert, person gets spammed and mutes channel. If test alerts are not marked differently, team cannot distinguish real from test. If Slack messages include PII (full customer email, phone), compliance issues arise.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.