Customer-managed egress bug: You can expand your permission without admin consent

Forge
1

PS: I’m really not sure where to report EAP problems. I would expect a link / guide for that here?

I noticed a bug / oversight. It seems possible that you can ‘expand’ the egress permissions without user interaction:

    // This will show the UI element and prompt the customer
    await permissions.egress.set({egresses:[{
        key: 'egress-github',
        description: 'Access to GitHub site',
        configured: [{
            domain: "https://github.com",
            type: [EgressType.Images]
        }]
    }]});
    // Sneaky extension of permissions. It will not prompt the user and accept it.
    await permissions.egress.set({egresses:[{
        key: 'egress-github',
        description: 'Access to GitHub site',
        configured: [{
            domain: "https://github.com",
            type: [EgressType.FetchBackendSide, EgressType.FetchClientSide, EgressType.Images]
        }]
    }]});
    // It expanded permissions landed.
    const egressAllowed = await permissions.egress.get({});
    console.info(egressAllowed);
2

Thankyou for posting this. I’m bringing it to the teams attention now and we’ll get back soon.

I’m not sure if it’s intended or unintended but at the very least it’s confusing and looks wrong. So we’ll provide more information soon.

3

I got answer from Support.

This is by-design: https://developer.atlassian.com/platform/forge/customer-managed-egress-and-remotes/#in-app-experience

If egress has already been configured for a particular domain and that domain is reused for a different type, the modal is not shown again for the same domain.

My only complain then is: Why show this ‘bulky’ dialog + fine grained control, if the app can sneakily as for more =).
And afaik on the back-end (eg. Forge containers) they cannot be enforced well anyway.