[BUG] Unable to use Google APIs in a deno slack app

[mversluys]

The deno-slack versions

    "deno-slack-sdk/": "https://deno.land/x/[email protected]/",
    "deno-slack-api/": "https://deno.land/x/[email protected]/",

Deno runtime version

deno 2.0.2 (stable, release, aarch64-apple-darwin)
v8 12.9.202.13-rusty
typescript 5.6.2

OS info

ProductName:		macOS
ProductVersion:		15.1
BuildVersion:		24B83
Darwin Kernel Version 24.1.0: Thu Oct 10 21:02:26 PDT 2024; root:xnu-11215.41.3~2/RELEASE_ARM64_T8122

Describe the bug

Unable to make use of Google deno packages.

I'm attempting to import the Google sheets API using

import { Sheets, auth as GoogleAuth } from 'https://googleapis.deno.dev/v1/sheets:v4.ts';

This was working earlier in the year and I have a deployed application that utilizes this, but now when I use slack run I get the following error

error: Uncaught (in promise) TypeError: Requires import access to "googleapis.deno.dev:443", run again with the --allow-import flag

I've searched high and low and tried add --allow-import to get-hooks in slack.json but haven't be able to find a way to convince deno to allow the import of the google APIs. I reached out to Slack support and they directed me here.

Steps to reproduce

1. Clone the deno starter template https://github.com/slack-samples/deno-starter-template
2. In functions/sample_function.ts, add

import { Sheets, auth as GoogleAuth } from 'https://googleapis.deno.dev/v1/sheets:v4.ts';

3. Run the project using slack run

Expected result

Expect that I'm able to import google deno packages.

Actual result

It fails with the following error

error: Uncaught (in promise) TypeError: Requires import access to "googleapis.deno.dev:443", run again with the --allow-import flag

Requirements

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

[filmaj]

Try adding googleapis.deno.dev to the outgoingDomains array of your app manifest.

https://api.slack.com/automation/manifest

[jphchan]

I get the same thing when attempting to follow the slack announcement bot tutorial. Running step 6 where you create the trigger it fails with the same message. I. My case it fails trying to reach cdn.skypack.dev. I checked and the demo apps manifest includes the outgoing domains section and lists the location so I don’t think that’s it.

[ledmonster]

I got same error. The error occurs here.

The error occurs even if I added --allow-import option. Here is a command triggered by slack run, and its output.

DENO_TRACE_PERMISSIONS=1 deno run -q --config=deno.jsonc --allow-read --allow-net --allow-run --allow-env --allow-import --allow-sys=osRelease https://deno.land/x/[email protected]/local-run.ts --protocol=message-boundaries --boundary=4862494874484939366ed41d8cd98f00b204e9800998ecf8427e
┏ ⚠️  Deno requests import access to "googleapis.deno.dev:443".
┠─ Requested by `import()` API.
┃  ├─ op_fs_stat_async (ext:core/00_infra.js:249:44)
┃  ├─ Object.stat (ext:deno_fs/30_fs.js:410:21)
┃  ├─ readImportedManifestFile (https://deno.land/x/[email protected]/manifest.ts:91:35)
┃  ├─ createManifest (https://deno.land/x/[email protected]/manifest.ts:19:28)
┃  ├─ eventLoopTick (ext:core/01_core.js:178:7)
┃  ├─ async runLocally (https://deno.land/x/[email protected]/local-run-function.ts:21:20)
┃  └─ async https://deno.land/x/[email protected]/local-run-function.ts:55:3
┠─ Learn more at: https://docs.deno.com/go/--allow-import
┠─ Run again with --allow-import to bypass this prompt.
┗ Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all import permissions) >

[zimeg]

@ledmonster Is this request happening while the app manifest outgoingDomains includes "googleapis.deno.dev"?

🔍 Reference: https://github.com/slack-samples/deno-github-functions/blob/f0177a63f43080c0ed1f2fb250ff1e5b4ee61c7b/manifest.ts#L16-L21

[ledmonster]

@zimeg yes, I configured outgoingDomains for "googleapis.deno.dev". here are my library versions:

• deno: 2.3.5
• deno-slack-sdk: 2.15.1
• deno_slack_api: 2.8.0

I don't know why deno-slack-runtime uses deno-slack-builder 0.0.14 (old and looks deprecated).

• https://github.com/slackapi/deno-slack-runtime/blob/main/src/deps.ts

[ledmonster]

@zimeg the difference between slack-samples/deno-github-functions and this issue is that the sample only requests to "api.github.com", while https://googleapis.deno.dev/v1/sheets:v4.ts is used as an import statement.

[zimeg]

@ledmonster Thanks so much for sharing these details - I think we're now getting to the root cause 🤖

I find a few changes to the .slack/hooks.json file let's us generate a manifest and start the app:

{
  "hooks": {
    "get-hooks": "deno run -q --allow-read --allow-net https://deno.land/x/[email protected]/mod.ts",
    "get-manifest": "deno run -q --config=deno.jsonc --allow-read --allow-net --allow-env --allow-sys=osRelease --allow-import=deno.land:443,googleapis.deno.dev:443,jsr.io:443 https://deno.land/x/[email protected]/get_manifest.ts",
    "get-trigger": "deno run -q --config=deno.jsonc --allow-read --allow-net --allow-env --allow-import=deno.land:443,googleapis.deno.dev:443,jsr.io:443 https://deno.land/x/[email protected]/get_trigger.ts",
    "start": "deno run -q --config=deno.jsonc --allow-read --allow-net --allow-run --allow-env --allow-sys=osRelease --allow-import=deno.land:443,googleapis.deno.dev,jsr.io:443 https://deno.land/x/[email protected]/local-run.ts"
  }
}

🔍 The big change above is --allow-import=deno.land:443,googleapis.deno.dev,jsr.io:443 to update network access.

Later on a function execution, this runtime error appears that points to the deno-slack-builder project as you callout:

error: Uncaught (in promise) TypeError: Requires import access to "googleapis.deno.dev:443", run again with the --allow-import flag
    at file:///private/tmp/slack/hopeful-anteater-484/functions/sample_function.ts:4:44
    const manifestJSFile = await import(`file://${manifestJSFilePath}`);
                           ^
    at async readImportedManifestFile (https://deno.land/x/[email protected]/manifest.ts:101:28)
    at async createManifest (https://deno.land/x/[email protected]/manifest.ts:19:22)
    at async runLocally (https://deno.land/x/[email protected]/local-run-function.ts:21:20)
    at async https://deno.land/x/[email protected]/local-run-function.ts:55:3

And that leads to the calling code which has a pending update to use the get-manifest hook instead of the builder. 🧱

IIRC the allowed imports should match outgoing domains, but I also think these hook customization should work. For now let's change this to a bug to investigate using the get-manifest hook for these customizations!

[ledmonster]

@zimeg thank you. The issue only affects the "slack run", and we can still deploy the code, right?

When does the team plan to fix the issue?

[bootsie123]

Running into this same issue as well. Would love a fix!