Add privacy notice for Duo mentions in non-public Slack contexts

Jannik Lehmannrequested to merge
603712-slack-duo-privacy-notice into master

What does this MR do and why?

Add privacy notice for Duo mentions in non-public Slack contexts

Duo-from-Slack sessions are recorded in the shared duo-workspace project and visible to everyone with access to it, which may be a wider audience than a private channel or group DM in Slack.

This MR introduces a one-time ephemeral notice when the bot is mentioned in a private channel or group DM:

  • Acknowledge and continue persists the acknowledgement per user on chat_names (once per Slack workspace), removes the lock reaction from the original mention, and re-enqueues the mention so the Duo flow runs.
  • Cancel dismisses the notice without persisting anything and swaps the lock reaction for an x reaction to signal the mention was intentionally not processed; the user is asked again on the next mention.

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/603712

References

Screenshots or screen recordings

Screenshots
Screenshot_2026-07-10_at_12.15.54

How to set up and validate locally

  1. Set up the GitLab for Slack app against your GDK (tunnel + app manifest, including the new channels:read, groups:read, im:read, and mpim:read bot scopes) and link your Slack user via /gitlab or a mention.
  2. Enable the feature flag: 
    Feature.enable(:slack_duo_agent)
  3. Mention the GitLab bot in a private channel or group DM.
  4. Verify the ephemeral privacy notice appears with Acknowledge and continue and Cancel buttons, and the mention gets a 🔒 reaction.
  5. Click Cancel: the notice is replaced with a cancellation message, the 🔒 is swapped for an ❌, no flow runs, and mentioning again shows the notice again.
  6. Click Acknowledge and continue: the 🔒 is removed, the Duo flow runs, and subsequent mentions in non-public channels skip the notice.
  7. Mention the bot in a public channel: no notice, flow runs directly.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/603712

Edited by Jannik Lehmann

Merge request reports