Use bot & user token for full functionality with newer bots #211
Conversation
Slack stopped allowing tokens in query strings. See https://api.slack.com/changelog/2020-11-no-more-tokens-in-querystrings-for-newly-created-apps This moves the token handling into the request sessions object, which also cleans up the code a bit. Fixes randsleadershipslack#209
This makes it a bit easier if you have a modified configuration in the workspace your are testing.
It wouldn't ignore my destalinator bot otherwise, which was preventing the archiver from doing the archiving.
Allow passing both the bot and user token to the scripts via the environment variables DESTALINATOR_API_BOT_TOKEN and DESTALINATOR_API_USER_TOKEN. They have different permissions and the bot token is only used to post messags, all other calls use the user token. Fixes randsleadershipslack#194. This also includes randsleadershipslack#210 and fixes randsleadershipslack#209 by moving the tokens into the header instead of using query parameters. Don't pass `as_user` to Slack, as this has been removed.
This is the version I am testing locally with.
|
From Slack's expectations, user API tokens shouldn't be generated for the use by the bot, they should be collected as part of user logged in. As I understand it dstalinator has no db, which means adding this in doesn't really make sense. The fixes to the other issues is great, I recommend splitting those off into their own PR, so that debate on whether "this" is the right approach doesn't block the improvement on closing those issues. |
|
@wparad That makes sense, but the permissions required for destalinator currently require a bot and a user account. |
If it really is the case that a dev needs to fork over their personal access token, then I think it makes sense to make that functionality optional based on it, rather than required. Having built a bunch of these, in most cases a user PAT isn't necessary, maybe we are just going about that functionality in the wrong way. Explicitly calling out what doesn't work based on it, is probably the better approach. |
Allow passing both the bot and user token to the scripts via the environment
variables DESTALINATOR_API_BOT_TOKEN and DESTALINATOR_API_USER_TOKEN. They have
different permissions and the bot token is only used to post messages, all other
calls use the user token. Fixes #194.
This also includes #210 and fixes #209 by moving the tokens into the header
instead of using query parameters.
Don't pass
as_userto Slack, as this has been removed.Removed encoding option for current Python versions, fixes #161
Look into the bot_profile for ignored users too
It wouldn't ignore my destalinator bot otherwise, which was preventing the archiver from doing the archiving.
Sorry for including all of this, but destalinator wasn't working at all for me without these changes.