Slack API message.im event is not triggered for other users

1
votes

I am trying to make my app watch for every kind of messages (public/private channels and direct messages) using event subscriptions, no bot. I made my app subscribe to message.channels, message.groups, message.im and message.mpim events.

I've setup an endpoint URL with the challenge parameter, and I've authorized and deployed my app. I'm successfully notified when :

  • A message is posted in a public channel
  • A message is posted in a private channel (even if my personal account is not invited in)
  • A direct message to/from my personal account

But, I'm not notified when there is a direct message posted between two other people.

How can it be related to my personal account as I've installed the app on the whole workspace ?

1
slackslack-api
It is not supposed to work. You should only be able to see messages of channels that the user that installed the Slack app is invited in. Including private and IM. So I doubt that your app sees other private channels. - Erik Kalkoken
@ErikKalkoken Can it be related to the fact that my user is Owner ? Maybe it has access to every private channel - bviale
It should not make a difference AFAIK. Think I need to test this :) - Erik Kalkoken
@ErikKalkoken Ok thank you for your time, anyway your comment leaded me into understanding what I was missing. I need to make each user install my application so I have an OAuth access to their private data. I thought that Slack app installation was only at workspace level. - bviale
I just tested it on my Slack. Installed an app with owner user. Still can't see messages posted to other private channels. - Erik Kalkoken

1 Answers

1
votes

It is not supposed to work. Even if you subscribe to "Workspace Events" you should only be able to see messages of conversations that the user that installed the Slack app is invited in. Including private channels and IM.

I just tested this on my Slack. Installed the Slack app with an owner user, but still can only see messages from private channels, that that user is a member of.

So this works "as designed" and according to the security architecture of Slack.