When is deleteInstallation called?

[acerbisgianluca]

Hey there, I was looking at the source code and I couldn't find where deleteInstallation is being called. Should I call it manually?

I'm building an app the requires account linking for a third party service. What I'm doing now is:

• when the user types /xx login, I send a button which opens an URL on my backend
• the backend uses installer.handleInstallPath(...) to redirect the user to the Slack consent page
• once the user gives the consent and lands back to the callback url, I redirect the user to the third party login page
• once the user logs in and lands back to the callback url, I redirect him to Slack app home
• at this point I'm sure that the user granted the permissions to the Slack app and that I've access to the third party service

Now, if the user revokes the consent to the Slack app, when is deleteInstallation being called? Should I listen to the tokens_revoked event and call deleteInstallation manually?

If you have any suggestion for the flow above, feel free to comment,
Thanks!

Packages:

Select all that apply:

• @slack/web-api
• @slack/rtm-api
• @slack/webhooks
• @slack/oauth
• @slack/socket-mode
• @slack/types
• I don't know

Requirements

For general questions/issues about Slack API platform or its server-side, could you submit questions at https://my.slack.com/help/requests/new instead. 🙇

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

[seratch]

Hi @acerbisgianluca, thanks for writing in!

I was looking at the source code and I couldn't find where deleteInstallation is being called. Should I call it manually?

The method is supposed to be called when receiving the following events:

• https://api.slack.com/events/tokens_revoked
• https://api.slack.com/events/app_uninstalled

Your app can subscribe these events to maintain installation data. If you're using bolt-js too, the framework may add built-in listeners for the above event handling. Check slackapi/bolt-js#1203 for the progress.

An alternative approach is to perform regular validations on the tokens stored in your database by utilizing https://api.slack.com/methods/auth.test API. If a token receives an error in response to the API call, the token might be revoked for some reason. You can safely delete the data for safety.

I hope this helps.

[acerbisgianluca]

Thanks for your hints @seratch!