not_in_channel: the bot was never invited to the channel

"""Report Slack channels the bot cannot post to, and why.

Read only. GET requests and nothing else: give this a bot token with
channels:read and groups:read. The repair is printed, never performed, because
this token can post into your workspace.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("slack_channel_membership")

API = "https://slack.com/api/"


def verdict(body):
    """Classify one conversations.info response. Pure, so it runs offline.

    Order matters: an archived channel refuses everyone, so it outranks
    membership, and ok: false outranks both because there is no channel object
    to read at all.
    """
    if body.get("ok") is not True:
        error = body.get("error") or "<no error field>"
        if error == "channel_not_found":
            return ("not-found",
                    "channel_not_found. Either the ID is wrong, or it is a private "
                    "channel this token cannot see. Those are indistinguishable "
                    "without groups:read.")
        if error == "missing_scope":
            return ("scope",
                    "missing_scope: needed=%s. Membership is unknown until the "
                    "token can read the channel." % (body.get("needed") or "?"))
        return ("error", "ok: false, error=%s" % error)

    channel = body.get("channel") or {}
    if channel.get("is_archived"):
        return ("archived",
                "archived. Membership is beside the point: an archived channel "
                "accepts nothing from anyone until it is unarchived.")
    if channel.get("is_member"):
        return ("member", "the bot is in this channel")
    if channel.get("is_private"):
        return ("not-member-private",
                "not a member, and private. No API call joins a private channel: "
                "a human member has to invite the app.")
    return ("not-member-public",
            "not a member. Public, so the app can join itself with channels:join, "
            "or somebody can invite it.")


def get(session, method, **params):
    r = session.get(API + method, params=params, timeout=30)
    body = r.json()
    return body


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("channels", nargs="+", help="channel IDs the app targets (C..., G...)")
    args = ap.parse_args()

    token = os.environ.get("SLACK_BOT_TOKEN")
    if not token:
        log.error("set SLACK_BOT_TOKEN (channels:read and groups:read are enough)")
        return 2

    s = requests.Session()
    s.headers.update({"Authorization": "Bearer " + token})

    me = get(s, "auth.test")
    if me.get("ok") is not True:
        log.error("auth.test answered 200 with ok: false, error=%s", me.get("error"))
        return 2
    bot = me.get("user_id")
    log.info("token acts as %s (%s) in %s", me.get("user"), bot, me.get("team"))

    bad = 0
    for cid in args.channels:
        body = get(s, "conversations.info", channel=cid)
        state, detail = verdict(body)
        name = (body.get("channel") or {}).get("name", "?")
        line = "%-19s %-12s #%s  %s" % (state, cid, name, detail)
        if state == "member":
            log.info(line)
            continue
        bad += 1
        log.warning(line)
        if state == "not-member-public":
            log.warning("  repair: /invite @YourApp in #%s, or call conversations.join "
                        "with channels:join", name)
            log.warning("  in a pipeline: conversations.invite channel=%s users=%s",
                        cid, bot)
        elif state == "not-member-private":
            log.warning("  repair: a member of the private channel runs /invite @YourApp; "
                        "the app cannot let itself in")
        elif state == "archived":
            log.warning("  repair: unarchive the channel, or point the app at a live one")
        elif state == "not-found":
            log.warning("  repair: check the ID, then add groups:read and reinstall "
                        "if the channel is private")

    log.info("%d channel(s) checked, %d the bot cannot post to", len(args.channels), bad)
    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Report Slack channels the bot cannot post to, and why.
 *
 * Read only. GET requests and nothing else: give this a bot token with
 * channels:read and groups:read. The repair is printed, never performed.
 */
const API = 'https://slack.com/api/';

/**
 * Classify one conversations.info response. Pure, so it runs offline.
 *
 * Order matters: an archived channel refuses everyone, so it outranks
 * membership, and ok: false outranks both because there is no channel object to
 * read at all.
 */
export function verdict(body) {
  if (body.ok !== true) {
    const error = body.error ?? '<no error field>';
    if (error === 'channel_not_found') {
      return ['not-found',
        'channel_not_found. Either the ID is wrong, or it is a private channel ' +
        'this token cannot see. Those are indistinguishable without groups:read.'];
    }
    if (error === 'missing_scope') {
      return ['scope',
        `missing_scope: needed=${body.needed ?? '?'}. Membership is unknown until ` +
        'the token can read the channel.'];
    }
    return ['error', `ok: false, error=${error}`];
  }

  const channel = body.channel ?? {};
  if (channel.is_archived) {
    return ['archived',
      'archived. Membership is beside the point: an archived channel accepts ' +
      'nothing from anyone until it is unarchived.'];
  }
  if (channel.is_member) return ['member', 'the bot is in this channel'];
  if (channel.is_private) {
    return ['not-member-private',
      'not a member, and private. No API call joins a private channel: a human ' +
      'member has to invite the app.'];
  }
  return ['not-member-public',
    'not a member. Public, so the app can join itself with channels:join, or ' +
    'somebody can invite it.'];
}

async function get(token, method, params = {}) {
  const url = new URL(API + method);
  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
  const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
  return res.json();
}

async function main() {
  const token = process.env.SLACK_BOT_TOKEN;
  if (!token) {
    console.error('set SLACK_BOT_TOKEN (channels:read and groups:read are enough)');
    process.exitCode = 2;
    return;
  }
  const channels = process.argv.slice(2).filter((a) => !a.startsWith('-'));
  if (channels.length === 0) {
    console.error('usage: node slack-channel-membership.mjs C0123ABCDEF [...]');
    process.exitCode = 2;
    return;
  }

  const me = await get(token, 'auth.test');
  if (me.ok !== true) {
    console.error(`auth.test answered 200 with ok: false, error=${me.error}`);
    process.exitCode = 2;
    return;
  }
  const bot = me.user_id;
  console.log(`token acts as ${me.user} (${bot}) in ${me.team}`);

  let bad = 0;
  for (const cid of channels) {
    const body = await get(token, 'conversations.info', { channel: cid });
    const [state, detail] = verdict(body);
    const name = body.channel?.name ?? '?';
    const line = `${state.padEnd(19)} ${cid.padEnd(12)} #${name}  ${detail}`;
    if (state === 'member') { console.log(line); continue; }
    bad += 1;
    console.warn(line);
    if (state === 'not-member-public') {
      console.warn(`  repair: /invite @YourApp in #${name}, or call conversations.join ` +
                   'with channels:join');
      console.warn(`  in a pipeline: conversations.invite channel=${cid} users=${bot}`);
    } else if (state === 'not-member-private') {
      console.warn('  repair: a member of the private channel runs /invite @YourApp; ' +
                   'the app cannot let itself in');
    } else if (state === 'archived') {
      console.warn('  repair: unarchive the channel, or point the app at a live one');
    } else if (state === 'not-found') {
      console.warn('  repair: check the ID, then add groups:read and reinstall if the ' +
                   'channel is private');
    }
  }

  console.log(`${channels.length} channel(s) checked, ${bad} the bot cannot post to`);
  process.exitCode = bad ? 1 : 0;
}

// Only run when invoked directly, so importing this module from the test file
// does not execute main() and fail the suite on a missing token.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from slack_channel_membership import verdict


def ok(**channel):
    return {"ok": True, "channel": channel}


def test_member_of_a_live_channel_is_fine():
    state, _ = verdict(ok(name="alerts", is_member=True))
    assert state == "member"


def test_archived_outranks_membership():
    # A member of an archived channel still cannot post to it.
    state, detail = verdict(ok(name="old-alerts", is_member=True, is_archived=True))
    assert state == "archived"
    assert "unarchived" in detail


def test_public_channel_can_be_self_joined():
    state, detail = verdict(ok(name="general", is_member=False, is_private=False))
    assert state == "not-member-public"
    assert "channels:join" in detail


def test_private_channel_needs_a_human():
    state, detail = verdict(ok(name="secrets", is_member=False, is_private=True))
    assert state == "not-member-private"
    assert "invite" in detail


def test_channel_not_found_stays_ambiguous():
    state, detail = verdict({"ok": False, "error": "channel_not_found"})
    assert state == "not-found"
    assert "groups:read" in detail


def test_missing_scope_is_not_a_membership_answer():
    body = {"ok": False, "error": "missing_scope", "needed": "channels:read"}
    state, detail = verdict(body)
    assert state == "scope"
    assert "channels:read" in detail


def test_other_errors_are_not_reported_as_membership():
    assert verdict({"ok": False, "error": "invalid_auth"})[0] == "error"

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { verdict } from './slack-channel-membership.mjs';

const ok = (channel) => ({ ok: true, channel });

test('member of a live channel is fine', () => {
  assert.equal(verdict(ok({ name: 'alerts', is_member: true }))[0], 'member');
});

test('archived outranks membership', () => {
  const [state, detail] = verdict(ok({ name: 'old', is_member: true, is_archived: true }));
  assert.equal(state, 'archived');
  assert.match(detail, /unarchived/);
});

test('public channel can be self joined', () => {
  const [state, detail] = verdict(ok({ name: 'general', is_member: false, is_private: false }));
  assert.equal(state, 'not-member-public');
  assert.match(detail, /channels:join/);
});

test('private channel needs a human', () => {
  const [state, detail] = verdict(ok({ name: 'secrets', is_member: false, is_private: true }));
  assert.equal(state, 'not-member-private');
  assert.match(detail, /invite/);
});

test('channel_not_found stays ambiguous', () => {
  const [state, detail] = verdict({ ok: false, error: 'channel_not_found' });
  assert.equal(state, 'not-found');
  assert.match(detail, /groups:read/);
});

test('missing_scope is not a membership answer', () => {
  const [state, detail] = verdict({ ok: false, error: 'missing_scope', needed: 'channels:read' });
  assert.equal(state, 'scope');
  assert.match(detail, /channels:read/);
});

test('other errors are not reported as membership', () => {
  assert.equal(verdict({ ok: false, error: 'invalid_auth' })[0], 'error');
});