From 856b604b4ac23d7eaf2aec4635033e120c7576f6 Mon Sep 17 00:00:00 2001
From: dsad <sswdarius@gmail.com>
Date: Tue, 30 Jun 2026 02:34:46 +0300
Subject: [PATCH] fix(slack): reject unauthorized users before event
 construction

Add early auth check in _handle_slack_message() that runs BEFORE any
API calls (thread context fetch, user name resolution, file downloads)
or file processing. Unauthorized users could previously trigger Slack
API calls and file downloads before the runner's _is_user_authorized
gate rejected them.

Same pattern as Telegram fix #54164: build a SessionSource and check
the runner's _is_user_authorized at the adapter level before event
construction consumes resources.

Fixes the gap where Slack has no adapter-level auth gate while Discord
and Telegram have adapter-level allowlists.
---
 plugins/platforms/slack/adapter.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/plugins/platforms/slack/adapter.py b/plugins/platforms/slack/adapter.py
index 51fe2c885d53..dab05f8bfd4e 100644
--- a/plugins/platforms/slack/adapter.py
+++ b/plugins/platforms/slack/adapter.py
@@ -3942,6 +3942,25 @@ class SlackAdapter(BasePlatformAdapter):
         # both as DM-style persistent conversations.
         is_one_to_one_dm = channel_type == "im"
 
+        # Early auth check: reject unauthorized users before any API calls
+        # (thread context fetch, user name resolution, file downloads).
+        # Pattern matches Telegram fix #54164 — gate at the adapter level
+        # BEFORE event construction consumes resources.
+        if user_id:
+            _source = self.build_source(
+                chat_id=channel_id, chat_name="",
+                chat_type="dm" if is_dm else "group",
+                user_id=user_id, user_name="",
+            )
+            _runner = getattr(getattr(self, "_message_handler", None), "__self__", None)
+            _auth_fn = getattr(_runner, "_is_user_authorized", None)
+            if callable(_auth_fn) and not _auth_fn(_source):
+                logger.warning(
+                    "[Slack] Early reject of unauthorized user %s in channel %s",
+                    user_id, channel_id,
+                )
+                return
+
         # Build thread_ts for session keying.
         # In channels: fall back to ts so each top-level @mention starts a
         #   new thread/session (the bot always replies in a thread).