[BUG] PermissionDenied to sys for required access to "osRelease" when deploying an app

[MitchDevLissi]

Hello,
so I get this wired error when I deploy the app

Caught error from user supplied module: PermissionDenied: Requires sys access to "osRelease", run again with the --allow-sys flag

I don t fully get the meaning since when I run locally, I don t have this issue, what could it be?
Thanks!

[zimeg]

Hey @MitchDevLissi 👋 I haven't seen this error before but was wondering if you could share a bit more info to help troubleshoot?

I'd be interested in knowing:

• Which packages you might be importing
• The version of Slack CLI you're using
• The version of deno you have installed

I'm not finding this error when deploying a new copy of the slack-samples/deno-starter-template app with these versions:

• slack: 2.31.0
• deno: 2.0.2

Let me know if something seems off between versions - I'd expect deno 1 to still work too - or of other details about your project setup! 🙏 📚

[MitchDevLissi]

Using:
slack v2.30.1
deno 1.46.3 (stable, release, aarch64-apple-darwin)
v8 12.9.202.5-rusty
typescript 5.5.2
Basically the problem here I am using the google API for automatically sending email. In this process, a file is read, so maybe it could be a problem of permissions, which are the correct scopes for reading and writing file?

[filmaj]

When running locally, the CLI does not bundle or process your app code in any way. When deploying, the CLI executes a bundling process, which transpiles your code into a single .js file and sends it up to Slack for deployment.

For whatever reason, during this bundling process, there is a need for the code being bundled to access the osRelease system API.

Which Google dependency for emails are you using? Can you share it with us? If you comment out / don't include this dependency, does slack deploy work? If so, then this is a known issue with the bundling system at play for deploy - see other similar such issues here: https://github.com/slackapi/deno-slack-sdk/issues?q=is%3Aopen+is%3Aissue+label%3Abundling

[MitchDevLissi]

Basically I am using this the GMAIL API for sending the email.
I upload the token as a json file and that should be read by my application.
I think that maybe when it is deployed, there is an error reading a the JSON file, maybe it is deployed as well as the application. Maybe remote_file scope can help me, what do u think?
When I comment the code involving email sending, keeping the dependency, the deployed application is working properly
This is the dependency
"googleapis": "https://esm.sh/[email protected]"
Thanks a lot for ur time and support!

[filmaj]

I am unfamiliar with this external dependency. Deployed applications are allowed to read from the file system. I do not think this is a scope problem. The problem is the code for your app is trying to access a system API, which deno gates access to via the --allow-sys flag.

However, the most recent version of our tooling supports access to this API. Can you share the contents of the slack.json file? Also, please share the logs from running slack -v deploy (verbose deploy logs).

[MitchDevLissi]

Here is the slack.json

{
  "hooks": {
    "get-hooks": "deno run --allow-all https://deno.land/x/deno_slack_hooks/mod.ts"
  }
}

With deploy I checked and does not give me any hints. I think it s a matter of permission.
If it reads a file, it breaks some dependencies, how would u suggest to tackle this?

[blicksky]

I have a similar issue where I'm trying to use the AWS API to invoke a function. When I run my app locally with slack run, and then use a Slack workflow to execute my custom Slack function , it throws this error:

Error: Requires sys access to "osRelease", run again with the --allow-sys flag

I haven't been able to figure out how to pass the --allow-sys flag. I've tried adding it in slack.json and in dev.env with a DENO_FLAGS environment variable, but nothing seems to help.

[blicksky]

I was able to work around my issue by setting defaultUserAgentProvider: () => ([["custom-user-agent"]] as UserAgent) in the AWS client config. The issue was that the default defaultUserAgentProvider calls os.release() to build the user agent string, and that requires the --allow-sys flag. Perhaps there's a similar configuration in the googleapis client you're using that allows you to work around it the same way.