How to use metadata for Org-wide app

[RomainCscn]

Hello,

I'm using metadata in my installer, during the url generation, to make the link between Slack installation data and my own data.

I would like to allow Org-wide installation, but as I understand, I need to disable the state verification. When I do this, I'm not able to retrieve any metadata.

How could I handle this?

Packages:

Select all that apply:

• @slack/web-api
• @slack/rtm-api
• @slack/webhooks
• @slack/oauth
• @slack/socket-mode
• I don't know

Reproducible in:

The Slack SDK version

"slack/oauth": "^2.4.0",

Node runtime version

v16.13.1

OS info

ProductName: macOS
ProductVersion: 11.6.2
BuildVersion: 20G314
Darwin Kernel Version 20.6.0: Wed Nov 10 22:23:07 PST 2021; root:xnu-7195.141.14~1/RELEASE_X86_64

Steps to reproduce:

Disable state verification for Org-wide app

const installer = new InstallProvider({
  clientId: process.env.SLACK_CLIENT_ID,
  clientSecret: process.env.SLACK_CLIENT_SECRET,
  stateVerification: false,
 ...
});

Add some metadata when generating url

const url = await installer.generateInstallUrl({
    scopes: ['users:read', 'users:write', 'channels:read', 'chat:write'],
    metadata: JSON.stringify({ organisation_id }),
  })

When retrieving the installation, there is no metadata:

installationStore: {
    storeInstallation: async (installation: Installation) => {
      const { metadata, ...authentificationData } = installation

      if (!metadata) {
        throw new Error('No metadata found')
      }
...
'No metadata found'

Expected result:

Find a way to retrieve metadata even when state verification is disable.

[seratch]

Hi @RomainCscn, thanks for writing in!

Perhaps, my answer at slackapi/bolt-js#1211 (comment) should answer your question here.

I'm sorry for the lack of sufficient functionalities in the Node SDK and bolt-js. If you're in the beginning of a new app development plus you're comfortable with either Python or Java, our SDKs in those languages already have great supports for your use case. Otherwise, as I suggested at slackapi/bolt-js#1211 (comment), please consider going with your own solution or waiting for our upcoming release including a solution for you.

[seratch]

Hi @RomainCscn, for your use case, we are going to add new callbacks, which enable more flexible ways to transfer user state to Redirect URL handler: #1438

With the new functionalities in v2.5, you don't need to use metadata for Org-wide installation flows. You can use 1st party cookies to transfer any user state by utilizing InstallPathOptions.beforeRedirection() and CallbackOptions.beforeInstallation() callbacks.

We will update the documents once the v2.5 is released but let us know whenever you have feedback or suggestions!

[filmaj]

FYI we have put together a release candidate with these features; more info here: https://github.com/slackapi/node-slack-sdk/releases/tag/%40slack%2Foauth%402.5.0-rc.1 and you can install it via npm here: https://www.npmjs.com/package/@slack/oauth/v/2.5.0-rc.1

[mrowles]

@filmaj @seratch Hey, I still see the metadata option in the installer URI generator: https://www.npmjs.com/package/@slack/oauth/v/2.5.0-rc.1#generating-an-installation-url

As per original request, I still cannot retrieve metadata from exchange response.

[seratch]

Just in case, I verified the metadata is passed as a property of installation data in storeInstallation etc. Please double-check if you're using the latest version of bolt-js and the underlying OAuth module. Also, if you have further to ask on this, please create a new issue for it as this thread is already closed.

[mrowles]

Yes it is passed in during the OAuth link generation, but when we do the exchange with the code, metadata does not exist. I'll raise a new issue. In fact, the OAuthV2Response type does not have metadata on this. It's cool, there is an easy work around, but will raise a ticket nevertheless.