[QUERY] Unable to create next-generation slack app in a test workspace in an enterprise grid

[mambuganarayana]

Question

I have followed steps outlined at Granting access to specific workspaces but the request to admin always goes with a production workspace.

Please let me know if I am missing something.

Context

I have an app created using the UI at https://api.slack.com/apps into a particular test workspace. And was able to postMessage. It is all working fine. We want to use interactivity feature but do not want to expose a public URL. So we decided to store any data generated due to interactions with users. And later make use of "apps.datastore" CRUD APIs to achieve our functionality.

I.e insert some data into a Slack datastore when end user clicks on a 'Workflow button'. Unfortunately , this app cannot do that as per this.

So we wanted to create a workflow app. To create an app for a particular workspace in an enterprise grid environment, we need the workspace ID (also known as team_id ?)

To get the team ID, I did use the https://slack.com/api/team.info endpoint. This is the ID of the test workspace.

With this when we try to execute below, request always goes to production workspace.

slack run --org-workspace-grant <id of the test workspace obtained above> ? Choose a local environment lists enterprise id (starting with 'E') 🔔 Administrator approval is required to install this app Alternatively, retry on a workspace without administrator approval turned on

? Request approval to install this app? Yes ? Enter a reason for installing this app: Need this new app for pull model. Your request to install the app is pending You will receive a Slackbot message after an admin has reviewed your request Once your request is approved, complete installation by re-running slack run

Environment

"deno-slack-sdk/": "https://deno.land/x/deno_slack_sdk@2.6.0/",
"deno-slack-api/": "https://deno.land/x/deno_slack_api@2.2.0/"

deno 1.41.0 (release, aarch64-apple-darwin) v8 12.1.285.27 typescript 5.3.3

ProductName: macOS ProductVersion: 14.3.1 BuildVersion: 23D60 Darwin Kernel Version 23.3.0: Wed Dec 20 21:30:44 PST 2023; root:xnu-10002.81.5~7/RELEASE_ARM64_T6000

Requirements

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

[zimeg]

Hey @mambuganarayana 👋 I'm curious if this request is going to the admins of the enterprise grid? I believe this is where any app request to a workspace of a grid will be sent as part of the app permissions model. Maybe this app approval can be automated for your specific case? If possible I'd be interested in knowing if this requests specifies the workspace grants you provided too, but no worries if not.

I can keep you updated on any changes to testing apps on enterprise grids so will keep this open, but for now I believe this is expected behavior for workspaces that are part of a grid.

[mambuganarayana]

Hello Zimeg - Thank you for your reply.!

I am not sure if the approver is part of admins group of the enterprise grid. But to your question "I'd be interested in knowing if this requests specifies the workspace grants you provided too" - No it is not. Admin is seeing 'all workspaces'. And hence approval is getting rejected. :(

[zimeg]

Oh how interesting! Are you providing the --org-workspace-grant flag the first time you use slack run? I'm thinking a previous attempt of installing to all workspaces might be cached somewhere 🤔 If not, you might try slack delete then another slack run --org-workspace-grant <ID> to see if that changes any request details?

But if that doesn't change anything I'll share this with the team since I'd expect to only request the specified workspace with --org-workspace-grant!

[mambuganarayana]

Yes, I provided the flag --org-workspace-grant first time. It always goes to the production workspace.

I also tried without providing it. Slack asked me to choose the workspace like Choose a workspace to grant access: and listed test workspace too. After choosing test workspace, again the request was sent to the production workspace.

[mambuganarayana]

Admin gets below message

User would like to install the app on the Organization org-name.

Provides 2 buttons in the end

Approve for Organization Restrict for Organization

Is this correct behaviour? There is no test workspace mentioned.

Please help.!

[mambuganarayana]

If you see below, should admin adjust workspace after approving? If so, why do we have to provide workspace while running 'slack run' command ? The admin does not see test workspace name in the approval request. It just says entire Org :(

[zimeg]

@mambuganarayana apologies for my confusion on this! When you request an installation the app is always installed at the organization level, which is why the admin message appears that way.

However, the app's scopes are granted to just the workspace you've requested. Attempting to run an app function in another workspace will error with team_access_not_granted.

The admin messaging isn't clear about this and I've sharing this with the team so we can update it, but the admin dashboard will reflect these permissions once the app is installed.

Hopefully this clears up some questions around installation permissions! Please let me know if you have any others though.

[mambuganarayana]

Thank you @zimeg. I will inform this to our admin. !

[zimeg]

@mambuganarayana something super cool was just released that might make requesting access to a testing workspace unnecessary. This is the developer program (which also brings development sandboxes)!! 🎉

I'd recommend checking this out if getting access to your testing workspace has a few hurdles. Sandboxes are intended to make development as easy as possible without worry of cluttering a production workspace!

[mambuganarayana]

Thank you @zimeg. I really appreciate it. .!

[mambuganarayana]

Closing this ticket.