only handle slack events in $SLACK_CHANNELS csv

main.go

@@ -10,6 +10,8 @@ import (
 	"net"
 	"net/http"
 	"os/signal"
+	"slices"
+	"strings"
 	"syscall"
 )
 
@@ -95,15 +97,20 @@ func _newHandlerPostAPIV1EventsSlack(cfg Config) http.HandlerFunc {
 		b, _ := io.ReadAll(r.Body)
 		r.Body = io.NopCloser(bytes.NewReader(b))
 
-		var token struct {
+		var allowList struct {
 			Token string
+			Event struct {
+				Channel string
+			}
 		}
-		if err := json.Unmarshal(b, &token); err != nil {
+		if err := json.Unmarshal(b, &allowList); err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
-		} else if token.Token != cfg.SlackToken {
+		} else if allowList.Token != cfg.SlackToken {
 			http.Error(w, "invalid .token", http.StatusForbidden)
 			return
+		} else if !slices.Contains(strings.Split(cfg.SlackChannels, ","), allowList.Event.Channel) {
+			return
 		}
 
 		http.Error(w, "not impl", http.StatusNotImplemented)