Function checkChannelAccess

server/src/slack/client.ts:747–796

(
  channelId: string,
  slackUserId: string
)

 * so we use local working group membership for access control (fast, no API calls).
 */
export async function checkChannelAccess(
  channelId: string,
  slackUserId: string
): Promise<{ hasAccess: boolean; isPrivate: boolean; reason?: string }> {
  try {
    const channelInfo = await getChannelInfo(channelId);
    if (!channelInfo) {
      return { hasAccess: false, isPrivate: false, reason: 'Channel not found' };
    }

    // Public channels are accessible to all workspace members
    if (!channelInfo.is_private) {
      return { hasAccess: true, isPrivate: false };
    }

    // Private channel - check local working group membership
    const wgDb = getWorkingGroupDb();
    const workingGroup = await wgDb.getWorkingGroupBySlackChannelId(channelId);

    if (!workingGroup) {
      // Private channel without a working group is not indexed
      return {
        hasAccess: false,
        isPrivate: true,
        reason: 'This private channel is not indexed (no linked working group)',
      };
    }

    // Check local membership
    const slackDb = getSlackDb();
    const mapping = await slackDb.getBySlackUserId(slackUserId);

    if (mapping?.workos_user_id) {
      const isMember = await wgDb.isMember(workingGroup.id, mapping.workos_user_id);
      if (isMember) {
        return { hasAccess: true, isPrivate: true };
      }
    }

    return {
      hasAccess: false,
      isPrivate: true,
      reason: 'You are not a member of this private channel',
    };
  } catch (error) {
    logger.warn({ error, channelId, slackUserId }, 'Failed to check channel access');
    // Fail closed - deny access on error
    return { hasAccess: false, isPrivate: false, reason: 'Failed to verify access' };
  }
}

/**
 * Find a channel by name (partial match) and check user access