Forge hello-world application is not working for any user than the developer - when impersonating

[Petru Simion _Simitech Ltd__]

We created a forge application using the template provided by the Atlassian Forge documentation.

A simple Hello World application for Jira.

The frontend index file makes an invoke call to the backend index file that returns a Hello World string.  We did not modify anything. Files are all generated by the forge create command.

If the developer executes it, it works fine.

If any other user executes it, even if it is a jira admin, when the frontend makes the invoke call the followint error is thrown -> User does not have access to resource(s).

How is it possible that a tutorial example, with a template, results in something that does not work.

Also there is no clear documentation, or details in the error message, to understand what is it that the user does have no access to.

The application was deployed in production (forge deploy -e production followed by forge install -e production), and the problem persists.

We also tried sharing the application and then installing via shared link, same problem.

Here is the installation link

https://developer.atlassian.com/console/install/0e151d1e-44f0-4655-ab47-364d97fed477?signature=AYABeAIYUiVvORQZxmj7a7Of0EAAAAADAAdhd3Mta21zAEthcm46YXdzOmttczp1cy1lYXN0LTE6NzA5NTg3ODM1MjQzOmtleS83ZjcxNzcxZC02OWM4LTRlOWItYWU5Ny05MzJkMmNhZjM0NDIAuAECAQB4KVgoNesMySI2pXEz4J5S%2B4but%2FgpPvEEG0vL8V0Jz5cBstIDu4wMsgZNR8BcToz0kwAAAH4wfAYJKoZIhvcNAQcGoG8wbQIBADBoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHEVoG8ItQ9hZWiAwQIBEIA7z8zLK3k8KsxIotjH1bLxWadkg4Ye8%2BTVqNzwDNw8IVWQib7dx23L%2F%2BI8KARkRk2AUdpTNkpPNLu%2FB...

Looks like other people reported recently the same problem

https://community.atlassian.com/forums/Jira-questions/Custom-Forge-App-Invoke-Function-Fails-with-Non-Development/qaq-p/2980334?utm_source=dm&utm_medium=unpaid-social&utm_campaign=P:online*O:community*I:social_share*

[Petru Simion _Simitech Ltd__ · Accepted solution]

New findings.

The problem only manifests when, as a site admin, I loged in as another user.

I created a test user account.

When I log in as that user all works fine.

When I log in as an admin(developer) and I use the Log in as user feature, and I impersonate the same user  the user does not have access to resources error manifests.

This is making this log in as feature useless.

Because when developing an app, the developer needs to test the app as any other user.

Also if a user reports any problems, the log in as user method should allow the developer to reproduce the problem reported by a user.

Seems like the log in as feature is buggy.

As I answered my own question I will accept my answer :-D

[Ramchandra Kudtarkar]

Hi @Petru Simion _Simitech Ltd__ , 

The Forge application does not work when admin is logged in using the Log in as user is an expected behaviour and there is an suggestion request in place for the same https://jira.atlassian.com/browse/ECO-244.

Thanks

[Petru Simion _Simitech Ltd__]

@Ramchandra Kudtarkar 

Stating that this is "expected behaviour" not correct.

Expected behavior is that when the impersonator impersonates a user, the impersonator will act 100% like the user in all aspects. Any deviation is not allowing the impersonator to have the same experience as the impersonated.

As a result the impersonator can not reproduce a problem that the impersonated has.

The link you provided is about another bug in the impersonation. For your info this is what the link talks about.

"

1. When an admin impersonates a normal user using the "Log in as another user" feature in Jira Premium and interacts with the Forge app, the app's requests using request.asUser() method are not impersonating the user as intended.
2. The /rest/api/3/myself endpoint, when called by the Forge app in the context of an impersonated session, still returns the details of the admin user (who initiated the impersonation) instead of the impersonated user's details."

The problem I raised is that the invoke method from frontend to backend is not even executing at all.

Regards, 

Petru

[Ramchandra Kudtarkar]

Hi @Petru Simion _Simitech Ltd__

The Log in as user feature is used for the core Jira/Confluence products. The Forge framework is not designed to work with the impersonated user, as the Forge application runs outside the core product and does not get the impersonated user context from the core product. The application may be calling some of the functionality asUser.

The suggestion request has a specific scenario described, but it includes your scenario as well.

Thanks,

Ram

[Tuncay Senturk _Snapbytes_]

Hi @Petru Simion _Simitech Ltd__ 

You're right to be frustrated, as the situation is weird.

I am not sure, but have you checked the permissions in the app's manifest.yml file? There should be scopes/functions that allow your app's users to perform specific functions. 

permissions:
  scopes:
     -rea:jira...
  function:
     - read
     - write

[Petru Simion _Simitech Ltd__]

When creating the Hello World app using forge create, the resulting manifest file does not contain any scopes. If these scopes would be required the generated manifest should contain the correct scopes for the app to work.

Tried with a few scopes like read:jira-work and read:issue-details:jira but same result. 

Bottom line is how can Atlassian provide a template application generated by forge create that does not work and there is no clear reason why and how to fix it.

[Akash Singh]

@Petru Simion _Simitech Ltd__ 

If your app is deployed in the Development environment (indicated by the "Dev" badge in its name), only users listed as Contributors in the Developer Console will have access to it.

To allow broader access, you’ll need to deploy and install the app in the Production environment.

Staging and Production environments in Forge

[Petru Simion _Simitech Ltd__]

We deployed to production, same problem.

We also tried to share the app and deploy vial shared link, same problem.

[Akash Singh]

@Petru Simion _Simitech Ltd__ Apologies for overlooking that detail in your post. Could you let me know which template app you're using? I can try deploying and installing it on my end as well. Also, does it work only when the developer is tunneling, or does it run even without an active tunnel?

[Petru Simion _Simitech Ltd__]

No needs to appoligise :-) I added the details after your reponse.

I just used the forge create, followed by selecting Jira and issue panel. 

The issue panel displays first Loading, which comes from the frontend file.

The invoke function calls the backend, which returns a "Hello world " string that replaces the Loading. 

This only when the user is the developer.

When I impersonate another user, the Loading message stays forever, and the Developer Tools shows -> User does not have access to resource(s).

you can try deploing using the link I provided

[Petru Simion _Simitech Ltd__]

I did not even use tunneling.

Just deployed and installed.

Works for the developer.

Not for any other user.

[Petru Simion _Simitech Ltd__]

The problem is that we have developed an app, based of the template.

All works fine, and the final tests revealed the problem.

In order to eliminate any issue we could have created, we tested with a simple Hello World app. Same problem.

[Akash Singh]

@Petru Simion _Simitech Ltd__

Your app appears to be working fine on my end as well. Have you tried using a different browser to see if that makes any difference?

Also, you might want to switch your network or enable a VPN and try accessing the app again. In my experience, some local ISPs fail to resolve the DNS for Forge app resources. Switching to a DNS provider like Cloudflare or Google DNS has usually resolved the issue for me.

[Petru Simion _Simitech Ltd__]

The problem manifests on two different sites (Work and Personal).

They have total different DNS so this could not be the issue.