How to trigger app_uninstalled / token_revoked

[TroutZen]

Description

Hi. I am trying to figure out how to trigger deleteInstallation and according to this issue #1201, I need to trigger the app_uninstalled event and the token_revoked event. I'm finding it difficult to get these events to be triggered and would appreciate some guidance.

• For app_uninstalled does this require every user to have the app removed? How / where does that actually happen?
• Is it possible to trigger token_revoked without triggering app_uninstalled or do they always happen together?

Things I have tried

Revoking token from app directory

Nothing happened when revoking the token, however 2 other users are connected to the app. Do I need to revoke their tokens as well? (It doesn't look like I have permissions to do that which might be another issue).

Removing the app from the list of apps in my workspace

Im guessing the above does nothing meaningful.

Thanks, feeling a little lost!

What type of issue is this? (place an x in one of the [ ])

• bug
• enhancement (feature request)
• question
• documentation related
• example code related
• testing related
• discussion

Requirements (place an x in each of the [ ])

• I've read and understood the Contributing guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've searched for any related issues and avoided creating a duplicate issue.

[seratch]

Hi @TroutZen, thanks for asking the question!

For app_uninstalled does this require every user to have the app removed? How / where does that actually happen?

The app_uninstalled events can happen only when all the bot and user tokens are revoked. Thus, if your app receives both bot and user tokens and then only user tokens are revoked, this event still does not occur.

Also, as for org-wide installations (for Enterprise Grid customers), even all the tokens were revoked, this event never happens until the Org admin completely disable the app in the Org-level.

Is it possible to trigger token_revoked without triggering app_uninstalled?

Yes, this is correct. As mentioned above, if your app have multiple tokens and either your end-user or your app itself revokes one token, only toke_revoked event occurs.

Nothing happened when revoking the token, however 2 other users are connected to the app. Do I need to revoke their tokens as well?

To completely uninstall your app from a workspace, all the tokens must be revoked.

(It doesn't look like I have permissions to do that which might be another issue).

As long as your app manages all the granted tokens, your app can perform auth.revoke API to revoke tokens. Another way to remove your app is to ask the workspace admin user(s) to "delete" the app from the workspace.

Lastly, I know that you've already recognized this but we are going to add a new functionality to handle these events for you: #1203 Once the feature is released, you can rely on the built-in support for this use case.

I hope this helps.

[asherbig]

@seratch I would think that my app is truly being uninstalled when I go through my process. I use this button on the slack.com app page to uninstall the app.

After that, the page shows the "add to slack" button again. The app isn't present in my workspace. However, when I do click add to slack, InstallationStore.storeInstallation gets called (which seems to confirm my belief that the app had been uninstalled previously). This errors because I still have the previous entry in my database.

If this is expected behavior, then can you tell me what the "Remove app" button actually does, and why it wouldn't trigger the app_uninstalled event?

[seratch]

@asherbig

If this is expected behavior, then can you tell me what the "Remove app" button actually does, and why it wouldn't trigger the app_uninstalled event?

The only causes that I can think of are:

• Your app does not subscribe the event in Events API (it's not automatically enabled)
• Your app is org-wide installed (refer to my above comment for more details)

[asherbig]

@seratch thank you for the quick response!

Your app does not subscribe the event in Events API (it's not automatically enabled)

I've enabled slack events, and I think I've confirmed it working by subscribing to the message event with this code

export function message(app: App) {
  app.event('message', async (args) => {
    console.log('message event!');
  });
}

relavant logs:

Your app is org-wide installed (refer to my above comment for more details)

I think I can confirm it's not an org-wide install. As far as I know I'm not part of an org, and in my storeInstallation, I can see isEnterpriseInstall: false, which I believe is how to determine if it's an org install.

My code for listening to app_uninstalled (and tokens_revoked) looks like this. When I go through the process described in my comment above, I see no logs from my server, not even a original request URL log, which happens in a pre-bolt middleware

export function uninstall(app: App) {
  app.event('app_uninstalled', async (args) => {
    console.log(JSON.stringify(args));
    console.log('uninstall');
    // await new SlackInstallationStore().deleteInstallation({})
  });

  app.event('tokens_revoked', async (args) => {
    console.log(JSON.stringify(args));
    console.log('tokens revoked');
    // await new SlackInstallationStore().deleteInstallation({})
  });
}

[seratch]

@asherbig Can you double-check whether these events are added in your Events API configuration page?

[asherbig]

@seratch That was it! Now I feel silly haha. Thank you so much!

[TroutZen]

I think this might be my issue as well, @seratch... :), but spinning up my dev environment to double check, ty!!. It didn't cross my mind strangely enough to need to register those.

@seratch - For app_uninstalled, can you confirm if that is triggered on a per workspace basis? (i.e. is the app_uninstalled even triggered when all tokens have been revoked for a given workspace or is when all tokens across all workspaces have been revoked?)

[seratch]

For app_uninstalled, can you confirm if that is triggered on a per workspace basis?

Yes, this is correct. Also, checking https://api.slack.com/events/app_uninstalled would be helpful for you. There are some information on how the event works in the page.

[TroutZen]

Closing the loop, this was my issue :) ty!

[seratch]

Thanks for checking!

[nworb999]

Hi @seratch -- I wasn't sure whether to create a new issue or not since my question is so similar to this except it is related to just the second question:

Is it possible to trigger token_revoked without triggering app_uninstalled or do they always happen together?

and I am already subscribed to those two bot events.

When I uninstall the app entirely, I get both the tokens_revoked and app_uninstalled events, so they are being received correctly. However, when I click just the individual revoke for a specific channel (see the second option below) I would expect to receive just a token_revoked event, but instead I receive nothing.

A user of our integration has the ability to initiate channel-specific token revoking through the Slack App Directory, and I want to be able to receive specifically these events, not just ones through the auth.revoke API.

Am I missing something? Is this actually expected behavior?