Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

403 forbidden for accessing any stripe object when in "external" testing mode (even if permission already in manifest) #957

Open
xinghengwang opened this issue Mar 28, 2024 · 0 comments
Labels
bug Something isn't working needs-triage

Comments

@xinghengwang
Copy link

xinghengwang commented Mar 28, 2024

Describe the bug

When I create an published app, with manifest with the correct permissions. It works fine accessing resources in my own stripe account.

But when another stripe account installs the using the "external test install link", when I try to access any resource, it failed with 403.
Screenshot 2024-03-28 at 12 31 30 PM

To Reproduce
Steps to reproduce the behavior:

in my stripe-app manifest:

    {
      "permission": "plan_read",
      "purpose": "Need to get plan and price details"
    },
    {
      "permission": "plan_write",
      "purpose": "Enable creating plan and price"
    },
    {
      "permission": "product_read",
      "purpose": "Enable creating plan and price"
    },
    {
      "permission": "product_write",
      "purpose": "Enable creating plan and price"
    },
  

// ...

  "ui_extension": {
    "views": [
      {
        "viewport": "stripe.dashboard.product.detail",
        "component": "Product"
      }
    ],


in code of UI extension:

import {
  createHttpClient,
  STRIPE_API_KEY
} from "@stripe/ui-extension-sdk/http_client";

// Initiate communication with the stripe client.
const stripe = new Stripe(STRIPE_API_KEY, {
  httpClient: createHttpClient(),
  apiVersion: "2023-08-16"
});

const Product = ({environment, userContext}) => {

  const downloadProduct = async () => {
    try {
      const product = await stripe.products.retrieve(environment.objectContext.id);
      console.log(JSON.stringify(product, null, '  '));
      showToast("downlaoded product ", { type: "success" });
    } catch (err) {
      showToast("Failed to download product", { type: "caution" });
    }
    console.log(JSON.stringify(environment));
    console.log(JSON.stringify(userContext));
  }

  const downloadPlans = async () => {
    try {
      const plans = await stripe.plans.list({ limit: 50 });
      console.log(JSON.stringify(plans, null, '  '));
      showToast("downlaoded plans ", { type: "success" });
    } catch (err) {
      showToast("Failed to download plan", { type: "caution" });
    }
  }

  return (
    <Box>
      <Box><Button  current Product</Button></Box>
      <Box><Button  Products</Button></Box>
    </Box>
  );
}

In test mode of my own account it works fine, or stripe apps start, it works fine .

  1. upload by stripe app load

  2. Set as "use for external test" and get the external test url link

  3. In a separate stripe account from original app count, click on the link and install the apps.

  4. App installs fine, but any attempt to access the resource will result in 403 error.

Expected behavior

Expect same behvavior in external testing mode vs. in "stripe app start" or in my own account.

Screenshots

Screenshot 2024-03-28 at 12 31 30 PM Screenshot 2024-03-28 at 12 46 57 PM

Desktop (please complete the following information):

  • OS: [e.g. iOS]
  • Browser [e.g. chrome, safari]
  • Version [e.g. 22]

Additional context
Add any other context about the problem here.

@xinghengwang xinghengwang added bug Something isn't working needs-triage labels Mar 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working needs-triage
Projects
None yet
Development

No branches or pull requests

2 participants
@xinghengwang and others