In our Forge app, we want to check if its companion app is also installed on the current site. With the help of this thread: Using GraphQL API: Get all installed plugins in jira cloud instance, my colleague was able to come up with the following resolver function:
import api from "@forge/api";
import { JSM_APP_ID } from "../../../../client/utils/constants";
export default async (_payload, context) => {
const query = /* GraphQL */ `
query GetInstalledJSMPlugins($contexts: [ID!]!, $appIds: [ID!]!) {
ecosystem {
appInstallationsByContext(
filter: {
appInstallations: { contexts: $contexts }
apps: { ids: $appIds }
}
after: null
) {
nodes {
id
createdAt
license {
active
type
supportEntitlementNumber
ccpEntitlementId
ccpEntitlementSlug
trialEndDate
isEvaluation
subscriptionEndDate
billingPeriod
}
app {
contactLink
createdBy {
name
}
description
id
marketplaceApp {
appKey
name
tagline
}
name
privacyPolicy
termsOfService
vendorName
}
appEnvironment {
key
type
oauthClient {
clientID
}
}
appEnvironmentVersion {
id
version
requiresLicense
isLatest
permissions {
scopes {
key
}
}
}
}
pageInfo {
endCursor
hasNextPage
}
}
}
}
`;
const variables = {
contexts: [context.installContext],
appIds: [`ari:cloud:ecosystem::app/${JSM_APP_ID}`],
};
const response = await api.asUser().requestGraph(query, variables);
if (!response.ok) {
throw new Error("Request failed");
}
console.log(JSON.stringify(await response.json(), null, 2));
};
When using the query in the GraphQL explorer on our sites it works as expected. However, when actually invoking the resolver, we get the following errors:
INFO 18:24:19.373 b6f1d4c1-e835-4271-8d02-89981b010986 {
"errors": [
{
"message": "Auth category: THIRD_PARTY_OAUTH is not allowed in service cs_apps",
"locations": [],
"extensions": {
"allowedAuth": [
"SESSION",
"API_TOKEN",
"UNAUTHENTICATED"
],
"presentedAuth": "THIRD_PARTY_OAUTH",
"errorSource": "GRAPHQL_GATEWAY",
"statusCode": 403,
"agg": {
"severity": "NORMAL",
"ugcPiiSafe": true
},
"classification": "IncorrectAuthException"
}
},
{
"message": "This request does not contain the right authorisation scopes to access this field",
"locations": [],
"path": [
"ecosystem",
"appInstallationsByContext",
"nodes",
"app",
"createdBy"
],
"extensions": {
"requiredScopes": [
"identity:atlassian-external"
],
"providedScopes": [
"manage:jira-configuration",
"read:cmdb-object:jira",
"read:jira-work",
"read:permission:jira",
"offline_access",
"write:jira-work",
"read:jira-user"
],
"errorSource": "GRAPHQL_GATEWAY",
"statusCode": 403,
"agg": {
"severity": "NORMAL",
"ugcPiiSafe": true
},
"classification": "InsufficientOAuthScopes"
}
}
],
"data": {
"ecosystem": null
},
"extensions": {
"gateway": {
"request_id": "3b79aba4439340fcb5e5a2572a85e19a",
"crossRegion": false,
"edgeCrossRegion": false
}
}
}
According to the GraphQL schema docs, the appInstallationsByContext field should be available to unauthenticated users. It mentions something about having “read permissions for each context”, though I wasn’t able to figure out what that actually means in this situation.
For the first error, I have tried sending {Authorization: UNAUTHENTICATED} as a header, but it just resulted in a different authentication error - unsurprising, as it was a complete guess.
For the second error, I have tried adding identity:atlassian-external as a scope to our manifest. This makes the app deployment fail at the linting stage, which matches what little info I was able to find about that scope elsewhere.
Could anyone share how to make this work, please?
