Request scopes from Slack for messages - slack-api

Question

i have a Slack app and until yesterday only the primary owner could send the message. I asked the Slack team on how to solve this issue to allow all users to be able to send messages on Slack. The answer was to first use the Sign in with Slack button to log them in. Then another button but with different scopes.
My question here is, I was able to send messages as users using the button as follows :
<input type="button" value="Authenticate again to send Message" class="btn btn-warning" onclick="location.href = 'https://slack.com/oauth/authorize?scope=incoming-webhook,im:write,chat:write:user&client_id=xxyyzz'"/>
Now, I am trying to do the same extra scopes request in the background by displaying a view that says" Please wait"
Attaching the code below:
<script>
$.ajax({
method: "GET",
dataType: "json",
url: "#Url.Action(MenuItem, "SetupSlack")",
//data: { code: 'Model.Code' },
data: { code: '#Model' },
success: function(rsp) {
window.location.replace(rsp.redirect);
},
error: function() {
// Show error.
}
});
</script>
And the controller code is as follows:
public ActionResult SetupSlack(string code)
{
SlackAuthToken slackToken = slackService.GetAccessToken( clientId, clientSecret, code);
string redirectUrl;
if (slackToken.IsAuthenticated && slackToken.HasWrite)
{
Alert("Slack setup successfully!!!!", AlertLevel.Success);
redirectUrl = Url.Action(MenuItem, "Index");
}
else if (slackToken.IsAuthenticated)
{
redirectUrl = "https://slack.com/oauth/authorize?scope=incoming-webhook,im:write,chat:write:user&client_id=aabbcc";
}
else
{
Alert("Slack setup failed. Please try again, if the problem persists please contact support.", AlertLevel.Success);
redirectUrl = Url.Action(MenuItem, "Index");
}
return JsonNet(new { redirect = redirectUrl });
}
It is not leading to the post message authentication page.Also, the other error that am getting it "code already used" as one of the responses in the OAuth flow.
Can anyone help me here.
I made the button work fine, but this should work as well.

Answer 1

Let me try to give a more complete answer to your problem as I understand it.
Requirements
You have a website and you want users from your Slack team to be able to send messages to Slack from it.
Messages must be sent on behalf of the user, not from the app
Solution
To authenticate and get the slack user ID users need to log into your website using "Sign-in with Slack"
When the user wants to send a message, your website checks its database for the access token belonging to the current user (the slack user ID is the key) and then uses that token to send a the slack message via API with chat.postMessage
If the website can not find a token for the current user in its database, the token needs to be created. For that the user is presented with a button that starts an Oauth flow with Slack requesting the required permissions (e.g. "Grant permissions to website"). After the token has been created it is stored in the database of the website, so this process has to be run once per user only. The user can then sent his message.
Notes
The Oauth process in step 3 is basically the same as installing the Slack app for each individual user. It is called configurations. This only works though if the admins of your Slack team have granted all users the right to install this particular Slack app
The Oauth process in step 3 and can NOT be run the background as you suggested in your question since it requires direct user interaction. It will always require the user to first login and then approve the requested permissions for your Slack app.

Answer 2

This can not work. The button is triggering the installation of your Slack app by a user via Oauth 2.0. By definition the Oauth process can not be run in the background, but requires the user to follow the redirect to the login-page from Slack and approve the permissions requested for your Slack app.