[MM-68497] Enables membership policies on public channels with advisory semantics (#36275)

api/v4/source/channels.yaml

@@ -995,6 +995,53 @@
           $ref: "#/components/responses/Forbidden"
         "404":
           $ref: "#/components/responses/NotFound"
+  "/api/v4/teams/{team_id}/channels/recommended":
+    get:
+      tags:
+        - channels
+      summary: Get recommended public channels for the current user
+      description: |
+        Return the public channels on a team that have a membership policy
+        assigned, where the requesting user's attributes match to the policy.
+
+        Membership policies on public channels are advisory: anyone can still join
+        these channels. This endpoint surfaces them as "Recommended channels"
+        for the requester.
+
+        Returns an empty list if the Enterprise Advanced license is not
+        active, if `AccessControlSettings.EnableAttributeBasedAccessControl`
+        is `false`, or if the user's attributes do not match any active
+        public-channel policy in the team.
+
+        __Minimum server version__: 11.8
+
+        ##### Permissions
+        Must be authenticated and have `list_team_channels` on the team.
+      operationId: GetRecommendedChannelsForTeam
+      parameters:
+        - name: team_id
+          in: path
+          description: Team GUID
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Recommended channels retrieval successful
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/Channel"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "403":
+          $ref: "#/components/responses/Forbidden"
+        "404":
+          $ref: "#/components/responses/NotFound"
   "/api/v4/teams/{team_id}/channels/deleted":
     get:
       tags:

api/v4/source/users.yaml

@@ -437,6 +437,25 @@
             group constrains.
           schema:
             type: boolean
+        - name: abac_match_only
+          in: query
+          description: >
+            When used with `not_in_channel`, restricts the result to users whose
+            attributes satisfy the channel's Attribute-Based Access Control
+            (ABAC) membership policy.
+
+
+            On private channels with an ABAC policy this filter is always
+            applied regardless of this parameter (hard gate). On public channels
+            with an advisory ABAC policy the full not_in_channel candidate list
+            is returned by default; set this to `true` to fetch only the
+            matching subset of candidates (for example to annotate recommended
+            members in the invite UI).
+
+
+            __Minimum server version__: 11.8
+          schema:
+            type: boolean
         - name: without_team
           in: query
           description: Whether or not to list users that are not on any team. This option