Receiving `reaction_added` events for channels we're not in

[nemanjastanic]

Please let me know if this is the wrong place to submit this.

We recently noticed that we are receiving events for the reaction_added event in channels where the integration wasn't added.

Here is an example of a channel where we received the event:

{
    "ok": true,
    "channel": {
        "id": "XXX",
        "name": "XXX",
        "is_channel": true,
        "is_group": false,
        "is_im": false,
        "is_mpim": false,
        "is_private": false,
        "created": 1712701802,
        "is_archived": false,
        "is_general": false,
        "unlinked": 0,
        "name_normalized": "XXX",
        "is_shared": true,
        "is_org_shared": false,
        "is_pending_ext_shared": false,
        "pending_shared": [],
        "context_team_id": "XXX",
        "updated": 1712763955954,
        "parent_conversation": null,
        "creator": "XXX",
        "is_read_only": false,
        "is_thread_only": false,
        "is_non_threadable": false,
        "is_ext_shared": true,
        "shared_team_ids": [
            "XXX"
        ],
        "internal_team_ids": [],
        "connected_team_ids": [
            "XXX",
            "XXX"
        ],
        "connected_limited_team_ids": [],
        "pending_connected_team_ids": [],
        "conversation_host_id": "XXX",
        "is_member": true,
        "last_read": "XXX",
        "topic": {
            "value": "",
            "creator": "",
            "last_set": 0
        },
        "purpose": {
            "value": "",
            "creator": "",
            "last_set": 0
        },
        "previous_names": []
    }
}

Here is the body of the event:

{
  "body": {
    "api_app_id": "XXX",
    "authorizations": [
      {
        "enterprise_id": null,
        "is_bot": false,
        "is_enterprise_install": false,
        "team_id": "XXX",
        "user_id": "XXX"
      }
    ],
    "context_enterprise_id": "null",
    "context_team_id": "XXX",
    "event_context": "XXX",
    "event_id": "XXX",
    "event_time": 1712769378,
    "event": {
      "event_ts": "1712769378.000900",
      "item_user": "XXX",
      "item": {
        "channel": "XXX",
        "ts": "1712768845.495799",
        "type": "message",
      },
      "reaction": "+1",
      "type": "reaction_added",
      "user": "XXX",
    },
    "is_ext_shared_channel": "true",
    "team_id": "XXX",
    "token": "XXX",
    "type": "event_callback"
  }
}

Let me know if you need any of the data I removed here.

Reproducible in:

The Slack SDK version

{
  "@slack/bolt": "^3.17.1",
  "@slack/oauth": "^2.6.1",
  "@slack/web-api": "^6.9.0",
  "@slack/types": "^2.8.0"
}

Node.js runtime version

v20.11.1

OS info

ProductName:            macOS
ProductVersion:         14.2.1
BuildVersion:           23C71
Darwin Kernel Version 23.2.0: Wed Nov 15 21:53:34 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T8103

Steps to reproduce:

(Share the commands to run, source code, and project settings)

1. Create an app instance like so:

export const app: Bolt.App<SlackContext> = new Bolt.App({
  receiver,
  signingSecret: process.env["SLACK_SIGNING_SECRET"],
  clientId: process.env["SLACK_CLIENT_ID"],
  clientSecret: process.env["SLACK_CLIENT_SECRET"],
  stateSecret: process.env["SLACK_STATE_SECRET"],
  authorize: async (
    { teamId, userId, enterpriseId, conversationId },
    body: any,
  ): Promise<SlackContext> => {
    // We do a lot more here, this is just for reproduction purposes.
  
    logger.log("info", "Slack Event Received", { body });

    return {
      teamId,
      userId,
      enterpriseId,
      conversationId,
    };
  },
});

2. Create a shared public channel.
3. Send a message in the channel.
4. React on the message as an external user.
5. A reaction event will be received by the SDK.

This is exactly what happened on our end, there might be other variations of this.

Expected result:

No event is received.

Actual result:

We receive an event, you can see the exact event above.

Requirements

For general questions/issues about Slack API platform or its server-side, could you submit questions at https://my.slack.com/help/requests/new instead. 🙇

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

[zimeg]

Hey @nemanjastanic 👋 This is a great place to write in! It sounds strange to be receiving these events and I cannot immediately reproduce this so I'm wondering if you could share a bit more about your app and the frequency of this strangeness?

Can you share the events and scopes your app is using? These can be found on the App Manifest page of App Config.

Does this event always happen when a reaction is added in channels not joined? And is it only happening in shared channels and for reactions from external users? I'm sure other combinations of factors might make a difference, so any more information would be helpful!

[github-actions]

👋 It looks like this issue has been open for 30 days with no activity. We'll mark this as stale for now, and wait 10 days for an update or for further comment before closing this issue out. If you think this issue needs to be prioritized, please comment to get the thread going again! Maintainers also review issues marked as stale on a regular basis and comment or adjust status if the issue needs to be reprioritized.

[github-actions]

As this issue has been inactive for more than one month, we will be closing it. Thank you to all the participants! If you would like to raise a related issue, please create a new issue which includes your specific details and references this issue number.