Skip to content

[DRAFT] [WIP] Add in builtin listener for token revoked and app uninstalled events #2337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
hello-ashleyintech wants to merge 7 commits into
base: main
Choose a base branch
from
+67 −0
Draft

[DRAFT] [WIP] Add in builtin listener for token revoked and app uninstalled events #2337

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
011fcd4
Add in builtin listener for token revoked and app uninstalled events
hello-ashleyintech Nov 18, 2024
a6491ac
add logger
hello-ashleyintech Nov 18, 2024
f4fa2d3
update install query
hello-ashleyintech Nov 18, 2024
7f70036
Merge branch 'ah-fix-issue-1204' of https://github.com/slackapi/bolt-…
hello-ashleyintech Nov 18, 2024
6b549f0
update other installquery
hello-ashleyintech Nov 18, 2024
d19f686
update based on feedback
hello-ashleyintech Nov 19, 2024
bf058dc
string literal
hello-ashleyintech Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions src/listener/builtin.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
import { InstallationStore, InstallationQuery } from "@slack/oauth";
import { Logger } from '@slack/logger';
import { Context } from "../types";

export class TokenRevocationListeners {
private installationStore: InstallationStore;
private logger: Logger;

public constructor(installationStore: InstallationStore, logger: Logger) {
this.installationStore = installationStore;
this.logger = logger;
}

public handleTokensRevokedEvents(context: Context) {
const isEnterpriseInstall = context.isEnterpriseInstall;

const installQuery: InstallationQuery<typeof isEnterpriseInstall> = {
isEnterpriseInstall: isEnterpriseInstall,
teamId: isEnterpriseInstall ? context.teamId : undefined,
enterpriseId: isEnterpriseInstall ? context.enterpriseId : undefined
};

this.installationStore.deleteInstallation(installQuery, this.logger);
Comment thread
hello-ashleyintech marked this conversation as resolved.
Outdated

// add logic to delete bot?
Copy link
Copy Markdown
Contributor Author

@hello-ashleyintech hello-ashleyintech Nov 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@seratch wrote this while referencing the Python and Java PRs, wanted to see if these functions / this class was on the right track for what we're trying to accomplish.

I did notice that Java and Python have a delete_bot function in the installationStore that Bolt JS doesn't seem to have - does the bot get deleted automatically upon token_revoked and app_uninstalled events in Bolt JS, or will I have to manually delete the bot? (ex: https://github.com/seratch/bolt-python/blob/2ab87ee4111554d2b3d3ca517294211fdb0ce963/slack_bolt/listener/builtins.py#L26)

Copy link
Copy Markdown
Contributor

@seratch seratch Nov 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are two approaches:

  1. Aligning with bolt-java/python
  2. Opting for a simpler but more inflexible approach, which differs from bolt-python/java

[Aligning with bolt-java/python]

Aligning with bolt-python/java should be the safest, most clear, and flexible approach:

  1. deleteInstallation with enterprise/team_id + user_id -> delete only user tokens
  2. deleteBot with enterprise/team_id -> delete only bot tokens
  3. deleteAll with enterprise/team_id -> delete both bot and user tokens

Review https://github.com/slackapi/bolt-python/blob/v1.21.2/slack_bolt/listener/builtins.py to better understand why bolt-python/java have three methods.

I don't believe this can cause any confusion. If a developer has already implemented the deleteInstallation method, bolt-js never calls the method without a user_id, so adding built-in support should not break anything.

When we release this built-in listener support, we should mention the necessity of two more method implementation, though.

[Opting for a simpler but more inflexible approach]

If we try to only use deleteInstallation, the method can function in the following ways:

  1. deleteInstallation with enterprise/team_id + user_id -> Deletes only user tokens
  2. deleteInstallation with enterprise/team_id -> Deletes both bot and user tokens, similar to deleteAll

This approach should also work, but the downside is that when an app does not want to delete user tokens while deleting a bot token, deleteInstallation with enterprise/team_id does not behave this way.

While Bolt supports user-token-only use cases, we generally recommend having a bot token to enable many functionalities. Deleting a bot token usually means the app is no longer being used in the workspace. So, deleting all tokens when a bot token is revoked makes sense to many apps. With that being said, this inflexibility may limit developers options. Also, our platform intentionally provides two event types to differentiate the scenarios a single token revocation vs app uninstallation.

I recommend [Aligning with bolt-java/python], but am open to any alternatives including the second option here. @filmaj do you have any option on this?

Copy link
Copy Markdown
Contributor Author

@hello-ashleyintech hello-ashleyintech Nov 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we release this built-in listener support, we should mention the necessity of two more method implementation, though.

@seratch Personally I like the first option! Does this mean to proceed with the first option, we'll need to release a new @slack/oauth version with the interface for InstallationStore updated to include a deleteBot and deleteAll optional method, similar to the Python implementation?

Copy link
Copy Markdown
Contributor

@filmaj filmaj Nov 20, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend [Aligning with bolt-java/python]

Agreed 👍

Copy link
Copy Markdown
Contributor

@seratch seratch Nov 21, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hello-ashleyintech yes, you're right!

}

public handleAppUninstalledEvents(context: Context) {
const isEnterpriseInstall = context.isEnterpriseInstall;

const installQuery: InstallationQuery<typeof isEnterpriseInstall> = {
isEnterpriseInstall: isEnterpriseInstall,
teamId: isEnterpriseInstall ? context.teamId : undefined,
enterpriseId: isEnterpriseInstall ? context.enterpriseId : undefined
};

this.installationStore.deleteInstallation(installQuery, this.logger);

// add logic to delete bot?
}
}