Forge app can't call backend when a customer views a request in Jira Service Management

Question

I'm developing a Forge app to list all the remote links on the customer portal request UI. I think I managed to give the app the correct scope and unlicensed access permissions, correct me if I'm wrong here are relevant parts of the manifest (some scopes are likely redundant):

modules:

jiraServiceManagement:portalRequestDetailPanel:

- key: issuelink-details-hello-world-portal-request-detail-panel

resource: main

resolver:

function: resolver

render: native

title: Linked Issues

unlicensedAccess:

- customer

- unlicensed

permissions:

scopes:

- read:jira-work

- read:issue.remote-link:jira

- read:issue:jira

- read:servicedesk-request

The problem is most likely with the permissions, because when I view the request with an agent user I can see the results and everything works fine, but when I view the request with a customer account I get this error in the browser's developer console (This is before the app runs):
POST https://MYCOMPANY.atlassian.net/rest/atlassian-connect/latest/addon-access 403 (Forbidden)And this error when the app runs: GET https://api.atlassian.com/ex/jira/SOMENUMBERS/rest/api/3/issue/MYISSUEKEY/remotelink 403 (Forbidden)

The second error is because of the request I try to make to get the data from the REST API:

const res = await requestJira(`/rest/api/3/issue/${issueKey}/remotelink`);

I imported @Forge/bridge requestJira and I use UI Kit for displaying the data.I'm new to forge app development, please help me resolve my issue.

David Franc · Answer

Hi a have similar problem witf my forge Apps. I use frontend API call via forge/bridge. For logged  agent is everfing correct, but for logged customer (or unlicenced user) is api without results. My example Apps is created via oficial example: src / frontend / index.jsx — Forge UI Kit JSM Recent Requests - Bitbucket Have You some experience with tis problem?

Illés Ákos · Answer

I managed to resolve the second issue. The problem was that I was missing a scope, namely:

read:status:jira, also I realized, that the REST API documentation lists all of the scopes needed for a call, and also I switched to the forge/api requestJira method, because it can be called with app privileges. The first error is still a mystery.