Forge CLI 6.9.1 shows excessive and unnecessary 'egress-permission-required' warnings

Forge
,
1

This is the manifest.yml of a dummy test app:

modules:
  confluence:contentBylineItem:
    - key: test-hello-world-content-byline-item
      resource: main
      resolver:
        function: resolver
      viewportSize: medium
      title: test
      dynamicProperties:
        function: a

  function:
    - key: resolver
      handler: index.handler
    - key: a
      handler: index.a
resources:
  - key: main
    path: static/hello-world/build
app:
  id: ari:cloud:ecosystem::app/...

The index.a handler is just a dummy method returning an empty object. No icons are defined, the test code doesn’t even contain the word ‘icon’. Running forge lint shows the following warning:

0:0 warning When using dynamic content properties along with icons, make sure to add the icon URL into the external images permissions of your app manifest. Otherwise, the icon will not be rendered. egress-permission-required

To make things worse, this warning is shown for each file in the src directory of the app. The warning is gone if I remove the dynamicProperties definition.

If this warning is really just that, i.e. a general warning about limiting the usage of external images, then this should not be displayed for each build, and certainly not for each file. Either log it to the browser console when an external image is actually blocked, or do not display it at all. Especially that the documentation already warns about this issue: https://developer.atlassian.com/platform/forge/manifest-reference/modules/confluence-content-byline-item/

1 Like
2

Thanks for the feedback @GaborDicsoMidori

We have decided to go with this approach because:

As for the linter warning, we have opted to add a generic warning that gets displayed as soon as you are using a dynamic properties module. The warning cannot be fixed (via the usual lint --fix ) so it will always be displayed as a reminder.
We have opted with this approach because there was too many combinations of how to define an icon property in an app code, and the linter would have not necessarily picked all those combinations.

As explained on this thread: New permission checks for dynamic properties - #2 by XavierCaron

With your feedback, and the fact that indeed, the documentation has been updated, we can remove it in the next CLI release. The main concern we had was people not knowing that they needed to change their permissions for existing Forge apps with dynamic properties modules.

Cheers,
Xavier

1 Like