Private Channels

[vdavez]

Currently standup-bot only works in public channels, which is generally ok. But there are times when a private channel might be needed.

[stvnrlly]

This is possible, with one big challenge:

When you say a channel name on Slack and it linkifies it, it's using a custom markup to keep that link even if the channel name changes. The bot uses that special format as well, both because of (1) that same persistence across name changes and (2) that's how the channel name is actually reported to the bot.

If you create a standup in a private channel, the bot sees that same formatted name and can record it. However, Slack doesn't linkify private channel names (probably to avoid leaking their existence), so users can't actually identify the channel to the bot. That means that the only real way to interact with the bot about a private channel is to do something in that private channel. Our emoji response method makes that possible, but none of the other functions that require saying a channel name would work, which might be confusing for users.

---

Two smaller issues:

1. We'd have to scope the forthcoming API access appropriately, which makes that more challenging.
2. Anybody with DB access would be able to see content that was intended for a private channel, which could be a security issue.

[mgwalker]

Thought about the smaller issue 2: When someone creates a standup in a private channel, the bot could generate a key and post it into the private channel and then star that message for itself. Then it could use that key to encrypt/decrypt standups for that channel, using the stars.list method to quickly find the key. No major concerns about the key being in Slack since it'll be restricted to the members of the channel, who can see the standups anyway.

We might also be able to accept private channels in non-link form in a DM, as long as the standup has been created from within the channel, by putting the readable-name in the database. We can get that either from the link itself (since they come in the form <#channel_id|channel_name>) or from the channels.info API method, which has the advantage of being something we could check periodically to make sure the name hasn't changed.

[stvnrlly]

That key is a cool idea. Do we know what the level of demand is for this, though? I kind of like the way that the current approach uses the "real" channel IDs and such.

[cromulus]

My use case needs a private channel.

Thanks!

[EvAlex]

What a mess. Of course private channels should be accesible by bots.