SECURITY: private category channels are not included (#36716)

We don't want the rewind report to potentially leak private channel
names.

plugins/discourse-rewind/app/services/discourse_rewind/action/chat_usage.rb

@@ -34,11 +34,15 @@ module DiscourseRewind
         total_messages = messages.count
         return if total_messages == 0
 
-        # Get favorite channels (public channels)
+        # Get favorite channels (public channels only, excluding read-restricted categories)
         channel_usage =
           messages
             .joins(:chat_channel)
+            .joins(
+              "INNER JOIN categories ON categories.id = chat_channels.chatable_id AND chat_channels.chatable_type = 'Category'",
+            )
             .where(chat_channels: { type: "CategoryChannel" })
+            .where(categories: { read_restricted: false })
             .group("chat_channels.id", "chat_channels.slug")
             .count
             .sort_by { |_, count| -count }

plugins/discourse-rewind/spec/actions/chat_usage_spec.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+RSpec.describe DiscourseRewind::Action::ChatUsage do
+  fab!(:date) { Date.new(2021).all_year }
+  fab!(:user)
+  fab!(:public_category, :category)
+  fab!(:private_category) { Fabricate(:private_category, group: Fabricate(:group)) }
+  fab!(:public_channel) { Fabricate(:category_channel, chatable: public_category) }
+  fab!(:private_channel) { Fabricate(:category_channel, chatable: private_category) }
+
+  before { SiteSetting.chat_enabled = true }
+
+  describe ".call" do
+    context "with messages in public and private channels" do
+      before do
+        5.times do
+          Fabricate(
+            :chat_message,
+            chat_channel: public_channel,
+            user: user,
+            created_at: random_datetime,
+          )
+        end
+
+        3.times do
+          Fabricate(
+            :chat_message,
+            chat_channel: private_channel,
+            user: user,
+            created_at: random_datetime,
+          )
+        end
+      end
+
+      it "only includes public channels in favorite_channels" do
+        result = call_report
+
+        expect(result[:data][:favorite_channels].length).to eq(1)
+        expect(result[:data][:favorite_channels].first[:channel_id]).to eq(public_channel.id)
+        expect(result[:data][:favorite_channels].first[:message_count]).to eq(5)
+      end
+
+      it "includes all messages in total_messages count" do
+        result = call_report
+
+        expect(result[:data][:total_messages]).to eq(8)
+      end
+    end
+  end
+end