@oneuptime/common 11.7.0 → 11.7.2

package/Models/DatabaseModels/DashboardDomain.ts

@@ -379,6 +379,7 @@ export default class DashboardDomain extends BaseModel {
       "Full domain of your dashboard (like dashboard.acmeinc.com). This is autogenerated and is derived from subdomain and domain.",
     example: "dashboard.acmeinc.com",
   })
+  @Index()
   @Column({
     nullable: false,
     type: ColumnType.ShortText,

package/Models/DatabaseModels/Incident.ts

@@ -1678,6 +1678,7 @@ export default class Incident extends BaseModel {
       "Status of notification sent to subscribers about this incident",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,
@@ -1764,6 +1765,7 @@ export default class Incident extends BaseModel {
       "Status of notification sent to subscribers about this incident postmortem",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/IncidentEpisode.ts

@@ -1657,6 +1657,7 @@ export default class IncidentEpisode extends BaseModel {
       "Status of notification sent to subscribers when this episode was created",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/IncidentEpisodePublicNote.ts

@@ -504,6 +504,7 @@ export default class IncidentEpisodePublicNote extends BaseModel {
     description: "Status of notification sent to subscribers about this note",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/IncidentEpisodeStateTimeline.ts

@@ -671,6 +671,7 @@ export default class IncidentEpisodeStateTimeline extends BaseModel {
       "Status of notification sent to subscribers about this state change",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/IncidentPublicNote.ts

@@ -507,6 +507,7 @@ export default class IncidentPublicNote extends BaseModel {
     description: "Status of notification sent to subscribers about this note",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/IncidentStateTimeline.ts

@@ -506,6 +506,7 @@ export default class IncidentStateTimeline extends BaseModel {
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
     example: "Sent",
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/Monitor.ts

@@ -595,6 +595,7 @@ export default class Monitor extends BaseModel {
     example: "API",
     canReadOnRelationQuery: true,
   })
+  @Index()
   @Column({
     nullable: false,
     type: ColumnType.ShortText,

package/Models/DatabaseModels/MonitorStatusTimeline.ts

@@ -418,6 +418,7 @@ export default class MonitorStatusTimeline extends BaseModel {
     {
       eager: false,
       nullable: true,
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )

package/Models/DatabaseModels/NetworkSite.ts

@@ -839,6 +839,7 @@ export default class NetworkSite extends BaseModel {
     title: "Last Rollup At",
     description: "When the health rollup for this site was last computed",
   })
+  @Index()
   @Column({
     nullable: true,
     type: ColumnType.Date,

package/Models/DatabaseModels/NetworkSiteStatusTimeline.ts

@@ -276,6 +276,7 @@ export default class NetworkSiteStatusTimeline extends BaseModel {
     {
       eager: false,
       nullable: true,
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )

package/Models/DatabaseModels/OnCallDutyPolicyExecutionLog.ts

@@ -593,6 +593,7 @@ export default class OnCallDutyPolicyExecutionLog extends BaseModel {
     canReadOnRelationQuery: false,
     example: "Executing",
   })
+  @Index()
   @Column({
     nullable: false,
     type: ColumnType.ShortText,

package/Models/DatabaseModels/OnCallDutyPolicySchedule.ts

@@ -690,6 +690,7 @@ export default class OnCallDutyPolicySchedule extends BaseModel {
       "When does the roster handoff occur for this schedule for the current user?",
     example: "2024-01-15T18:00:00.000Z",
   })
+  @Index()
   @Column({
     type: ColumnType.Date,
     nullable: true,
@@ -744,6 +745,7 @@ export default class OnCallDutyPolicySchedule extends BaseModel {
       "When does the next event start for this schedule for the next user?",
     example: "2024-01-22T09:00:00.000Z",
   })
+  @Index()
   @Column({
     type: ColumnType.Date,
     nullable: true,

package/Models/DatabaseModels/Probe.ts

@@ -285,7 +285,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.CreateProjectStatusPage,
+      Permission.CreateProjectProbe,
     ],
     read: [
       Permission.ProjectOwner,
@@ -295,7 +295,7 @@ export default class Probe extends BaseModel {
       Permission.SettingsAdmin,
       Permission.SettingsMember,
       Permission.SettingsViewer,
-      Permission.ReadProjectStatusPage,
+      Permission.ReadProjectProbe,
     ],
     update: [
       Permission.ProjectOwner,
@@ -303,7 +303,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.EditProjectStatusPage,
+      Permission.EditProjectProbe,
     ],
   })
   @TableColumn({
@@ -334,7 +334,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.CreateProjectStatusPage,
+      Permission.CreateProjectProbe,
     ],
     read: [
       Permission.ProjectOwner,
@@ -344,7 +344,7 @@ export default class Probe extends BaseModel {
       Permission.SettingsAdmin,
       Permission.SettingsMember,
       Permission.SettingsViewer,
-      Permission.ReadProjectStatusPage,
+      Permission.ReadProjectProbe,
     ],
     update: [
       Permission.ProjectOwner,
@@ -352,7 +352,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.EditProjectStatusPage,
+      Permission.EditProjectProbe,
     ],
   })
   @TableColumn({
@@ -546,7 +546,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.CreateProjectStatusPage,
+      Permission.CreateProjectProbe,
     ],
     read: [
       Permission.ProjectOwner,
@@ -556,7 +556,7 @@ export default class Probe extends BaseModel {
       Permission.SettingsAdmin,
       Permission.SettingsMember,
       Permission.SettingsViewer,
-      Permission.ReadProjectStatusPage,
+      Permission.ReadProjectProbe,
     ],
     update: [
       Permission.ProjectOwner,
@@ -564,7 +564,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.EditProjectStatusPage,
+      Permission.EditProjectProbe,
     ],
   })
   @TableColumn({
@@ -592,7 +592,7 @@ export default class Probe extends BaseModel {
       Permission.SettingsAdmin,
       Permission.SettingsMember,
       Permission.SettingsViewer,
-      Permission.ReadProjectStatusPage,
+      Permission.ReadProjectProbe,
     ],
     update: [],
   })
@@ -618,7 +618,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.CreateProjectStatusPage,
+      Permission.CreateProjectProbe,
     ],
     read: [
       Permission.ProjectOwner,
@@ -628,7 +628,7 @@ export default class Probe extends BaseModel {
       Permission.SettingsAdmin,
       Permission.SettingsMember,
       Permission.SettingsViewer,
-      Permission.ReadProjectStatusPage,
+      Permission.ReadProjectProbe,
     ],
     update: [
       Permission.ProjectOwner,
@@ -636,7 +636,7 @@ export default class Probe extends BaseModel {
       Permission.ProjectMember,
       Permission.SettingsAdmin,
       Permission.SettingsMember,
-      Permission.EditProjectStatusPage,
+      Permission.EditProjectProbe,
     ],
   })
   @TableColumn({

package/Models/DatabaseModels/ScheduledMaintenance.ts

@@ -1389,6 +1389,7 @@ export default class ScheduledMaintenance extends BaseModel {
       "Status of notification sent to subscribers when event was scheduled",
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/ScheduledMaintenancePublicNote.ts

@@ -507,6 +507,7 @@ export default class ScheduledMaintenancePublicNote extends BaseModel {
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
     example: "Sent",
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/ScheduledMaintenanceStateTimeline.ts

@@ -503,6 +503,7 @@ export default class ScheduledMaintenanceStateTimeline extends BaseModel {
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
     example: "Sent",
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/ScheduledMaintenanceTemplate.ts

@@ -1285,6 +1285,7 @@ export default class ScheduledMaintenanceTemplate extends BaseModel {
     description: "When is the next event scheduled?",
     example: "2024-03-29T02:00:00.000Z",
   })
+  @Index()
   @Column({
     type: ColumnType.Date,
     nullable: true,

package/Models/DatabaseModels/StatusPage.ts

@@ -2575,6 +2575,7 @@ export default class StatusPage extends BaseModel {
     title: "Send Next Report By",
     description: "When should the next report be sent?",
   })
+  @Index()
   @Column({
     type: ColumnType.Date,
     nullable: true,

package/Models/DatabaseModels/StatusPageAnnouncement.ts

@@ -676,6 +676,7 @@ export default class StatusPageAnnouncement extends BaseModel {
     type: TableColumnType.ShortText,
     defaultValue: StatusPageSubscriberNotificationStatus.Pending,
   })
+  @Index()
   @Column({
     type: ColumnType.ShortText,
     default: StatusPageSubscriberNotificationStatus.Pending,

package/Models/DatabaseModels/StatusPageDomain.ts

@@ -380,6 +380,7 @@ export default class StatusPageDomain extends BaseModel {
       "Full domain of your status page (like status.acmeinc.com). This is autogenerated and is derived from subdomain and domain.",
     example: "status.acmeinc.com",
   })
+  @Index()
   @Column({
     nullable: false,
     type: ColumnType.ShortText,

package/Models/DatabaseModels/WorkspaceNotificationSummary.ts

@@ -698,6 +698,7 @@ class WorkspaceNotificationSummary extends BaseModel {
     title: "Next Send At",
     description: "When the next summary should be sent",
   })
+  @Index()
   @Column({
     type: ColumnType.Date,
     nullable: true,

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -26,6 +26,16 @@ export interface MicrosoftTeamsTeam {
   name: string;
 }
 
+export type MicrosoftTeamsChatType = "personal" | "groupChat";
+
+export interface MicrosoftTeamsChat {
+  id: string; // Teams conversation id (e.g. 19:...@thread.v2)
+  name: string;
+  chatType: MicrosoftTeamsChatType;
+  serviceUrl?: string | undefined; // Bot Framework service URL captured when the bot was added.
+  addedAt?: string | undefined;
+}
+
 export interface SlackMiscData extends MiscData {
   teamId: string;
   teamName: string;
@@ -51,6 +61,7 @@ export interface MicrosoftTeamsMiscData extends MiscData {
   adminConsentGrantedBy?: string;
   availableTeams?: Record<string, MicrosoftTeamsTeam>;
   appAccessTokenExpiresAt?: string;
+  availableChats?: Record<string, MicrosoftTeamsChat>; // keyed by chat id. Chats the OneUptime app has been added to.
 }
 
 export type WorkspaceMiscData = SlackMiscData | MicrosoftTeamsMiscData;

package/Server/API/BaseAPI.ts

@@ -23,6 +23,7 @@ import {
 } from "../../Types/Database/LimitMax";
 import PartialEntity from "../../Types/Database/PartialEntity";
 import BadRequestException from "../../Types/Exception/BadRequestException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import { JSONObject } from "../../Types/JSON";
 import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
@@ -406,12 +407,27 @@ export default class BaseAPI<
     delete (item as any)["createdAt"];
     delete (item as any)["updatedAt"];
 
-    await this.service.updateOneById({
+    const numberOfDocsAffected: number = await this.service.updateOneById({
       id: new ObjectID(objectIdString),
       data: item,
       props: await CommonAPI.getDatabaseCommonInteractionProps(req),
     });
 
+    /*
+     * The permission layer narrows the update query after we build it (tenant
+     * scope, access-control labels, owned scope), so it is possible to match
+     * no rows at all. Reporting 200 for that told the client the edit was
+     * saved when nothing was written - the change then "disappeared" on the
+     * next page load with no error anywhere.
+     */
+    if (numberOfDocsAffected === 0) {
+      throw new NotAuthorizedException(
+        `Unable to update this ${(
+          new this.entityType().singularName || "item"
+        ).toLowerCase()}. It either does not exist, has been deleted, or you do not have permission to update it.`,
+      );
+    }
+
     return Response.sendEmptySuccessResponse(req, res);
   }
 

package/Server/API/CommonAPI.ts

@@ -6,8 +6,40 @@ import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import UserType from "../../Types/UserType";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import SpanUtil from "../Utils/Telemetry/SpanUtil";
+import ObjectID from "../../Types/ObjectID";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 
 export default class CommonAPI {
+  /*
+   * getUserMiddleware lets unauthenticated requests through as "public" and
+   * takes the tenant id from a caller-supplied header — custom endpoints
+   * that disclose project data must require an authenticated member of the
+   * project themselves. Returns the project id when authorized, throws
+   * otherwise.
+   */
+  public static assertAuthenticatedProjectMember(
+    databaseProps: DatabaseCommonInteractionProps,
+  ): ObjectID {
+    const projectId: ObjectID | undefined = databaseProps.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("Project ID is required");
+    }
+
+    if (
+      !databaseProps.userId ||
+      !databaseProps.userTenantAccessPermission ||
+      !databaseProps.userTenantAccessPermission[projectId.toString()]
+    ) {
+      throw new NotAuthorizedException(
+        "You are not authorized to access this project's data.",
+      );
+    }
+
+    return projectId;
+  }
+
   @CaptureSpan()
   public static async getDatabaseCommonInteractionProps(
     req: ExpressRequest,

package/Server/API/MicrosoftTeamsAPI.ts

@@ -24,6 +24,7 @@ import HTTPResponse from "../../Types/API/HTTPResponse";
 import API from "../../Utils/API";
 import WorkspaceProjectAuthTokenService from "../Services/WorkspaceProjectAuthTokenService";
 import WorkspaceProjectAuthToken, {
+  MicrosoftTeamsChat,
   MicrosoftTeamsMiscData,
   MicrosoftTeamsTeam,
 } from "../../Models/DatabaseModels/WorkspaceProjectAuthToken";
@@ -46,6 +47,8 @@ import path from "path";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../Types/Dictionary";
+import { WorkspaceChannel } from "../Utils/Workspace/WorkspaceBase";
 
 export default class MicrosoftTeamsAPI {
   private static getTeamsAppManifest(): JSONObject {
@@ -166,6 +169,14 @@ export default class MicrosoftTeamsAPI {
               type: "Application",
               name: "Channel.Create.Group",
             },
+            {
+              type: "Application",
+              name: "ChatMessage.Read.Chat",
+            },
+            {
+              type: "Application",
+              name: "ChatMember.Read.Chat",
+            },
           ],
         },
       },
@@ -1035,7 +1046,8 @@ export default class MicrosoftTeamsAPI {
           const databaseProps: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-          const projectId: ObjectID = databaseProps.tenantId!;
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
 
           // Use the refreshTeams method to get fresh teams data
           const availableTeams: Record<string, MicrosoftTeamsTeam> =
@@ -1069,7 +1081,8 @@ export default class MicrosoftTeamsAPI {
           const databaseProps: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-          const projectId: ObjectID = databaseProps.tenantId!;
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
 
           // Call MicrosoftTeamsUtil to refresh teams
           const availableTeams: Record<string, MicrosoftTeamsTeam> =
@@ -1094,6 +1107,90 @@ export default class MicrosoftTeamsAPI {
       },
     );
 
+    // List channels of a team (app-only Graph; Channel.ReadBasic.All).
+    router.get(
+      "/microsoft-teams/channels",
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse) => {
+        try {
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+
+          const teamId: string = (req.query["teamId"] as string) || "";
+
+          if (!teamId) {
+            throw new BadDataException("teamId is required");
+          }
+
+          const channels: Dictionary<WorkspaceChannel> =
+            await MicrosoftTeamsUtil.getAllWorkspaceChannels({
+              authToken: "", // Graph calls use the app token from miscData.
+              projectId: projectId,
+              teamId: teamId,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            channels: Object.values(channels)
+              .sort((a: WorkspaceChannel, b: WorkspaceChannel) => {
+                return (a.name || "").localeCompare(b.name || "");
+              })
+              .map((channel: WorkspaceChannel) => {
+                return {
+                  id: channel.id,
+                  name: channel.name,
+                };
+              }),
+          });
+        } catch (err) {
+          return Response.sendErrorResponse(req, res, err as Exception);
+        }
+      },
+    );
+
+    /*
+     * Get chats (group / personal chats) the OneUptime app has been added to.
+     * Chats cannot be listed via app-only Graph permissions, so this returns
+     * the chats captured from bot installation events.
+     */
+    router.get(
+      "/microsoft-teams/chats",
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse) => {
+        try {
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+
+          const availableChats: Record<string, MicrosoftTeamsChat> =
+            await MicrosoftTeamsUtil.getChatsForProject({
+              projectId: projectId,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            chats: Object.values(availableChats)
+              .sort((a: MicrosoftTeamsChat, b: MicrosoftTeamsChat) => {
+                return a.name.localeCompare(b.name);
+              })
+              .map((chat: MicrosoftTeamsChat) => {
+                return {
+                  id: chat.id,
+                  name: chat.name,
+                  chatType: chat.chatType,
+                  addedAt: chat.addedAt || null,
+                };
+              }),
+          });
+        } catch (err) {
+          return Response.sendErrorResponse(req, res, err as Exception);
+        }
+      },
+    );
+
     return router;
   }
 

package/Server/API/ProbeAPI.ts

@@ -32,6 +32,8 @@ export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
               lastAlive: true,
               iconFileId: true,
               connectionStatus: true,
+              // The monitor create form pre-selects the auto-enabled probes.
+              shouldAutoEnableProbeOnNewMonitors: true,
             },
             props: {
               isRoot: true,

package/Server/API/SlackAPI.ts

@@ -44,6 +44,9 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import CommonAPI from "./CommonAPI";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../Types/Dictionary";
+import Exception from "../../Types/Exception/Exception";
+import { WorkspaceChannel } from "../Utils/Workspace/WorkspaceBase";
 import {
   PrivateNoteEmojis,
   PublicNoteEmojis,
@@ -747,6 +750,54 @@ export default class SlackAPI {
       },
     );
 
+    // List all Slack channels for the current project (live fetch, refreshes the cache).
+    router.get(
+      "/slack/channels",
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+
+          const projectAuth: WorkspaceProjectAuthToken | null =
+            await WorkspaceProjectAuthTokenService.getProjectAuth({
+              projectId: projectId,
+              workspaceType: WorkspaceType.Slack,
+            });
+
+          if (!projectAuth || !projectAuth.authToken) {
+            throw new BadRequestException(
+              "Slack is not connected for this project. Please connect Slack first.",
+            );
+          }
+
+          const channels: Dictionary<WorkspaceChannel> =
+            await SlackUtil.getAllWorkspaceChannels({
+              authToken: projectAuth.authToken,
+              projectId: projectId,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            channels: Object.values(channels)
+              .sort((a: WorkspaceChannel, b: WorkspaceChannel) => {
+                return (a.name || "").localeCompare(b.name || "");
+              })
+              .map((channel: WorkspaceChannel) => {
+                return {
+                  id: channel.id,
+                  name: channel.name,
+                };
+              }),
+          });
+        } catch (err) {
+          return Response.sendErrorResponse(req, res, err as Exception);
+        }
+      },
+    );
+
     // Fetch and cache all Slack channels for current tenant's project
     router.get(
       "/slack/get-all-channels",
@@ -755,6 +806,17 @@ export default class SlackAPI {
         const props: DatabaseCommonInteractionProps =
           await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+        /*
+         * getUserMiddleware lets unauthenticated requests through as
+         * "public" — require an authenticated project member before
+         * disclosing channel names.
+         */
+        try {
+          CommonAPI.assertAuthenticatedProjectMember(props);
+        } catch (err) {
+          return Response.sendErrorResponse(req, res, err as Exception);
+        }
+
         if (!props.tenantId) {
           return Response.sendErrorResponse(
             req,