RSC access lost after a while

[jerbob92]

I regularly have the issue that my bot can't fetch messages through the Graph API anymore, after a while I get the following error:

Missing role permissions on the request. API requires one of 'ChannelMessage.Read.All, ChannelMessage.Read.Group'. Roles on the request 'Sites.Selected, GroupMember.Read.All, Group.Selected'. Resource specific consent grants on the request ''.

When I then reinstall the app into the team, the access is restored. Is there any known issue here, or am I doing something wrong?

[heyitsaamir]

Hmm. Are you using a cached token, or fetching the token? Wonder if it's just an expired token.

Reinstalling the app seems like, the token is just not refreshing correctly, or somehow the app is being revoked. Do you see any patterns in when it gets revoked?

[jerbob92]

@heyitsaamir I'm using what's described here: microsoft/teams.py#345
I assume that the token manager automatically caches and refreshes the tokens. I also expect the error to be different when the token has actually expired.

I sadly don't have the logs anymore, next time I'll make sure to look into those, I don't know how long it takes before it breaks again.
But what I do know is that I didn't do anything else besides reinstalling the Teams app, I did not restart the bot application or refresh the token.

Next time I'll also use these to check what they return:
https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/grant-resource-specific-consent#verify-app-rsc-permission-granted-to-your-app

The code that failed is something like this:

parent_message = (
    await client.teams.by_team_id(team_aad_group_id)
      .channels.by_channel_id(thread_id)
      .messages.by_chat_message_id(message_id)
      .get()
)

replies = (
  await client.teams.by_team_id(team_aad_group_id)
    .channels.by_channel_id(thread_id)
    .messages.by_chat_message_id(message_id)
    .replies.get(request_configuration)
)

This also sounds a bit similar: OfficeDev/microsoft-teams-library-js#2341

[AkJo]

@jerbob92, thanks for flagging the issue. We would like to take a closer look.

1. Is this a bot that has been packaged into an app that is used by only you, or has it been published for use by multiple users?
2. Is this a sideloaded app, or is this a custom app published to a specific tenant, or is this an app published to the global marketplace?
3. Can you please share your bot's id and well as your app's id?
4. Does the issue happen when you publish an update to your app, and an end-user hits upgrade in the Teams client?

[jerbob92]

@jerbob92, thanks for flagging the issue. We would like to take a closer look.

1. Is this a bot that has been packaged into an app that is used by only you, or has it been published for use by multiple users?
2. Is this a sideloaded app, or is this a custom app published to a specific tenant, or is this an app published to the global marketplace?
3. Can you please share your bot's id and well as your app's id?
4. Does the issue happen when you publish an update to your app, and an end-user hits upgrade in the Teams client?

1. If by users you mean tenants, then its currently only used by one tenant, but I believe the app had been registered as multitenant for future purposes.

2. It is installed through the Teams Admin portal, but not published through the marketplace, not sure if this counts as sideloading.

3. Bot ID: 7eaed8ad-f160-4549-b241-fcd01641b2cf, App ID: 2237f8f9-288f-4c17-8a95-c96fbcfa4924

4. No, it seems to happen randomly

[jerbob92]

@AkJo I have checked the audit logs in Azure Portal and we see the same thing as in OfficeDev/microsoft-teams-library-js#2341
The consent gets removed by Microsoft Teams Graph Service.

However, not sure if this gets triggered by me doing the reinstall or if this is something else.
Edit: don't think this was triggered by me because I only did the reinstall a few days after.

[AkJo]

Thanks @jerbob92 , can you please provide the following additional information:

1. tenant id
2. group id / team id / chat id where the issue is happening.
3. webApplicationInfo.id provided in the manifest
4. System generated id of the Teams App. This is can be inferred by -- find the app in the Teams client and then copy a link to the app. The generated link would have the id of the app in a guid format.

[jerbob92]

@AkJo

1. fe825b32-d3da-4bf2-9880-fedfe66fd3b9
2. Team ID: 19:_GajA0vnfkIwh7bnbYeYaPNBMiU05Cue7SbuOG8meX41@thread.tacv2, Group ID (AAD): d2b9b031-0b44-40fd-a117-f26583ecbb02, chat ID: 19:4cc6780209d64f6c9db4c5c4cd4ddf76@thread.tacv2
3. 2237f8f9-288f-4c17-8a95-c96fbcfa4924
4. 3ae8886a-cd26-4b31-9556-89b89f49bc8b