Comment REST API call not working in event handler

Forge
, ,
1

I have a comment event handler that gets the full comment from Jira using the REST API.

If I use asApp then I get the following error:

INFO    00:19:31.969  52ed13a131b2d9ca  {
  errorMessages: [
    'test-app, you do not have the permission to comment on this issue.'
  ],
  errors: {}

Which is strange because I’m just trying to do a get, not create a comment.

I also tried using asUser. If I do then I get the error

ERROR   23:22:50.397  f90a41a230bb8323  [NEEDS_AUTHENTICATION_ERR: Authentication required] {
  serviceKey: 'atlassian-token-service-key'
}

The code I’m using is:

export async function handleWebTrigger(event, context) {
	const requestUrl = `/rest/api/3/issue/${event.issue.id}/comment/${event.comment.id}`;
    const res = await api.asApp().requestJira(requestUrl);
    const data = await res.json();
	console.log(data)
}

I think the asApp version has occasionally worked with asApp but most of the time doesn’t

EDIT: I think the asApp error only occurs when the comment has security on it. Is there a scope that can do this? I just have: read:jira-work which seems to be what you need in the docs

Thanks
Paul

1 Like
2

Hi @paul, it’s possible that you’re hitting the “Update comment” endpoint instead, as the paths are the same. Can you try specifying the method as ‘GET’ in the fetch options? i.e.

const res = await api.asApp().requestJira(requestUrl, { method: 'GET' });
3

@PeterYu I have just added that and the same problem persists. It works for comments with no security but doesn’t for those with security

4

@paul It appears that asApp cannot access restricted comments in order to prevent privilege escalation. For the moment, this feature is intentional for security purposes.

2 Likes
5

Hi @PeterYu

Ok, thanks for finding that out. How does looking at restricted comments allow for privilege escalation? As you can see from the example above, we already have the comment text as part of the comment add/edit event trigger (I was getting the other fields not in the event) so I have the comment text anyway.

The app I’m developing needs to look at secure comments. Do you know when this functionality is going to be available?

Regards
Paul

6

@paul I was mistaken in my last post, apologies. It turns out that this is caused by an underlying issue with app permissions that the team is currently working to address. It is being tracked in the ticket here [FRGE-212] - Ecosystem Jira.

In the meantime, you may try the workaround documented in that ticket.

7

Thanks for finding that @PeterYu, I’ll keep a watch on the issue. I’ll use the workaround but I don’t suppose you know roughly when this will be released?

Regards
Paul

8

@paul Unfortunately I don’t have much of a timeline for you, but hopefully it is addressed soon.

9

@PeterYu , I see that [FRGE-212] - Ecosystem Jira has now been done but since the permissions have now changed I’m not sure what I need to add to the manifest. I assume to get able to load a comment with security on it I’d have needed “read:jira-work”. I checked the docs and it says that is deprecated but doesn’t say what is required to replace it. What permissions do I need to access a comment with security on it?

EDIT: Just tried read:jira-work and I still get the permissions error.
EDIT: The REST API docs say it needs: read:comment:jira, read:comment.property:jira, read:group:jira, read:project:jira, read:project-role:jira, read:user:jira ,read:avatar:jira but I already have those and that doesn’t work

Regards
Paul

10

Is there anyone from Atlassian that can answer this?

12

@Atlassian-Staff , any ideas?

13

Hi @paul ,

Apologies for the late response. I raised this to the relevant teams and we’ll get back to you once we get an answer.

Cheers,
Ian

15

Hi @paul ,

I reached out to the relevant teams for comments and we were able to replicate the issue you described when getting a restricted comment. In order to isolate the issue from FRGE-212, I created [FRGE-709] - Ecosystem Jira on your behalf.

Kindly watch the ticket to get updates on the progress and feel free to leave additional comments as you see fit.

Cheers,
Ian

2 Likes
16

Thanks @iragudo , do you have any idea of when the will be done?
Regards
Paul