RFC-29: App Access Rule - Revised followup to New Data Access APIs

[remie]

@JustinThirkell

This RFC mentions ARIs and these may be unfamiliar to readers. An ARI (Atlassian resource identifier) is a globally unique identifier.

@JustinThirkell you are now again mentioning ARI, but you have not responded to any of the questions with regard to ARI in the previous RFC

RFC-25: [Superseded by RFC-29] App Access Rule - followup to New App Data Access APIs

Hi @JustinThirkell, Thank you for the RFC. Would it be possible for Atlassian to pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty pretty please not introduce Yet Another Shiny New Technology? Why does Atlassian think that partners are happy with having to support a different type of format for events compared to Connect install hooks or product events specifically for App permissions? Does Atlassian really t…

RFC-25: [Superseded by RFC-29] App Access Rule - followup to New App Data Access APIs

Hi @JustinThirkell , Thanks for sharing the proposal. I have one quick question: The proposal introduces ARI. This is new for us, and I see it as a big problem. At this moment we vendors are required to move our code to the new Confluence Rest API-v2, and this API uses a new route scheme based on content IDs, not ARIs. Does this imply we will have to handle two naming schemes for the same content?

RFC-25: [Superseded by RFC-29] App Access Rule - followup to New App Data Access APIs

Agree with @remie - this is not great, especially having logic to handle binary formats, for payloads that a re <2kb? Why not just use normal webhooks. Also, what are we supposed to do with ARIs? We currently only work with projectIds/projectKeys, since the REST APIs only work with those, how are we supposed to map those ids to the one we store on our side? I understand that internally GraphQL is the way forward, but almost no one, besides a few Forge apps, will be able to work with this.

RFC-25: [Superseded by RFC-29] App Access Rule - followup to New App Data Access APIs

Hi @JustinThirkell This proposal contains huge divergence from the previous RFC and massive scope creep from a vendor implementation perspective. How do we map ARIs from an event back to other Atlassian entities? What factors did Atlassian include in its determination that “this is an opportune time” for app vendors to adopt CloudEvents? I’d contest your comment about CloudEvents being a mature standard by quoting their own website: CloudEvents is a new effort and it’s still under active d…

RFC-25: [Superseded by RFC-29] App Access Rule - followup to New App Data Access APIs

Hi @JustinThirkell , I’ve got a question about ARIs: some of your examples contain a / (forward slash). This is also a path delimiter in urls. This in turn means if we escape (encodeURIComponent) the ARI, we will get a different string. This in turn leads to issues in the qsh calculation in Atlassian’s library ACE. Is it possible to design ARIs such that they are url-safe? We app developers often need to handle possibly tainted variables, and need to escape them before adding them to a ur…

Can you please make sure that you address these questions in this RFC?