SslCheck returns 401 for a matching verification_token and 200 for a wrong one #1595

Reproducible in:

The slack_bolt version

slack_bolt==1.30.0
slack_sdk==3.45.0

Python runtime version

Python 3.12.5

OS info

macOS 27.0

Steps to reproduce:

Set a verification token on the app and send Slack's SSL check request to it.

from slack_bolt import App
from slack_bolt.request import BoltRequest

app = App(signing_secret="secret", token="xoxb-...", verification_token="my-token")

req = BoltRequest(
    body="ssl_check=1&token=my-token",
    headers={"content-type": ["application/x-www-form-urlencoded"]},
)
print(app.dispatch(req).status)

1. Run the snippet above with the correct token. Status is 401.
2. Change the body token to wrong-token. Status is 200.
3. Remove the token field from the body. KeyError: 'token' is raised.

Expected result:

Matching token returns 200. Wrong or missing token returns 401.

Actual result:

The check is inverted in slack_bolt/middleware/ssl_check/ssl_check.py (SslCheck.process) and async_ssl_check.py:

if self._verify_token_if_needed(req.body):
    return self._build_error_response()
return self._build_success_response()

_verify_token_if_needed returns True when the token matches, so a matching token produces the error response. It also reads body["token"] directly, which raises when the field is missing.

I have a fix with sync and async tests in #1589.

Requirements

I have read the Contributing guidelines and Code of Conduct.