Dear Atlassian Support Team,
I am developing a Confluence Cloud macro using Express.js and atlassian-connect-express. The macro is functioning correctly for most customers; however, I have encountered an issue where, for some customers, the client key is not retrieved correctly.
Issue Description:
When multiple customers trigger requests simultaneously, the client key appears to be overwritten by the client key of the last customer who made a request. As a result, API calls that rely on the client key for authentication and data retrieval fail for some customers.
Code Implementation:
Below is a simplified version of my implementation, where I store the client key in a global variable for use in subsequent API calls:
var Globlas_Clientkey = '';
app.get('/configure', addon.authenticate(), function (req, res) {
Globlas_Clientkey = req.context.clientKey;
addon.settings.get('configuration', req.context.clientKey).then(function (configObject) {
if (configObject && configObject.clientKey) {
if (configObject.clientKey !== req.context.clientKey) {
console.log(`Mismatch in client key: Expected ${req.context.clientKey}, Retrieved ${configObject.clientKey}`);
configObject = null;
}
}
res.render('configure', { configObject });
});
});
app.post('/configure', addon.checkValidToken(), function (req, res) {
Globlas_Clientkey = req.context.clientKey;
let configObject = req.body;
configObject.clientKey = req.context.clientKey;
addon.settings.set('configuration', configObject, req.context.clientKey).then(() => {
res.send(configObject);
});
});
app.post('/GetRepositories', async function (req, res) {
try {
let Baseurl = req.query.xdm_e;
let APIEndPoint = `/api/externalintegration/GetRepositories?EmailId=${req.body.userid}`;
const APIResponse = await AsyncProlGetAPI(APIEndPoint, req.body, Baseurl, Globlas_Clientkey, 0);
res.send(APIResponse);
} catch (e) {
console.error("Error occurred:", e);
res.status(500).json({ error: 'An error occurred' });
}
});
Concerns & Questions:
Global Variable Issue:
- The variable Globlas_Clientkey is declared globally, meaning it could be overwritten when multiple requests are processed concurrently.
- Is Globlas_Clientkey thread-safe in this scenario?
Accessing the Client Key in /GetRepositories API:
I am unable to access the correct clientKey inside the /GetRepositories API.
Since this API does not use addon.authenticate(), how can I reliably retrieve the correct clientKey for the requesting customer?
Best Practices:
What is the recommended approach for handling the clientKey in a multi-customer environment using atlassian-connect-express?
Are there library features that provide a reliable way to retrieve and manage the client key across API calls?
Request for Support:
- I would appreciate your insights on:
- Confirming whether my observations regarding the global variable causing issues are correct.
- Providing recommendations for handling the clientKey safely and efficiently.
- Suggesting best practices for ensuring reliable retrieval of the clientKey across all APIs in a multi-tenant environment.
Thank you for your assistance. I look forward to your response.
Best regards,
Prolaborate Team
