PipedreamHQ / PipedreamHQ/pipedream

[BUG] Confluence delete-post action fails with 401

Open
#20,100 4 comments 0 reactions 1 assignee Claimed by @s0s0physm View on GitHub
bug HIGH PRIORITY OAuth triaged
Dominant language
JavaScript
Stars
11.7k
Forks
5.8k
Avg merge
3d 10h
Merged PRs (30d)
102

Description

**Describe the bug**
To rule out a scope misconfiguration, the following was verified:
* Decoded the JWT from the failed request and confirmed delete:blogpost:confluence is present
in the token's scope claim
* Updated the OAuth app permissions in the Atlassian developer console to ensure the scope is
registered at the app level
* Reconnected the Confluence OAuth account in Pipedream to force a fresh token issuance
* Had a second user independently retest with their own fresh token - same 401 result

Since the error persists across multiple users and fresh tokens with the correct scope present, a scope misconfiguration has been ruled out as the root cause.

I suspect that a URL construction bug in [confluence.app.mjs](https://github.com/PipedreamHQ/pipedream/blob/master/components/confluence/confluence.app.mjs) causes a double slash (//) in the request path. The _baseUrl() method returns a trailing slash and all method paths include a leading slash, resulting in:
`DELETE .../wiki/api/v2//blogposts/{id}`
instead of:
` DELETE .../wiki/api/v2/blogposts/{id}`

Atlassian's backend does not normalize the double slash for DELETE requests, causing the scope pattern match for `delete:blogpost:confluence` to fail even though the scope is present in the token.

**To Reproduce**
Steps to reproduce the behavior:

1. Go to the builder or SDK demo
2. Try to delete a post
4. You'll see the error

**Expected Bahavior**
Blog post is deleted successfully and returns a 200 response.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.