https://netsuiteprofessionals.com logo
Join Slack
Powered by
Is anyone familiar / got this segement of code wor...
# suitescript
j
Is anyone familiar / got this segement of code working before? Essentially we want to use the https.post function to decrypt the GUID in our POST body off a credential field on our Suitelet : https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_159073608341.html#Generate-Credential-Field
It can authorize successfully to the 3rd party endpoint but it’s not replacing the GUID with the decrypted value
Copy code
let tempURL = `${this.getUrl()}${resource}?password={${body.client_secret}}`;
                log.debug('BEFORE', tempURL);
              
                if (credentials) {
                  tempURL = https.createSecureString({
                   input: `${this.getUrl()}${resource}?password={${body.client_secret}}`
                   });
                } 
                 
          
                body = JSON.stringify(body);
                log.debug('PARAMETERSBODY', body);
                log.debug('POSTCREDENTIALS', credentials);
                log.debug('tempURL', tempURL)

                const response = <http://https.post|https.post>({
                    url: tempURL,
                    body: body,
                    credentials: [body.client_secret],
                    headers: {
                        'Content-Type': 'application/json',
                        'Accept':'application/json',
                        'password': body.client_secret
    
                    }
                });
body.client_secret is the GUID we get from the POST parameters of the Suitelet
b
in general, the secrets/guids are treated as templates
for example, if the id of your guid is 4cc0f6c255ad4299ad538b3b4c75580a
then references to {4cc0f6c255ad4299ad538b3b4c75580a} will be replaced with whatever password was put inside it
importantly, 4cc0f6c255ad4299ad538b3b4c75580a will not be replaced
its kinda hard to tell with the code you shared since you arent sharing the actual values
j
i see
b
but fair chance
Copy code
'password': body.client_secret
isnt actually being replaced
j
so everything needs to have brackets surrounding the GUID?
b
no, not everything, only places where you actually want them to be replaced
for example, you wouldnt want to do it
Copy code
credentials: [body.client_secret],
j
and for my POST body would need something like this?
Copy code
let postBODY = {
   client_id: "CLIENT_SCRET_VALUE",
   client_secret: "{GUID_VALUE}",
   code: "CODE_VALUE"
}
b
its honestly easier if you experiement with it yourself
make the post to an echo service like httpbin.org or postman echo
that way you can see what the request looks like
if you are using guids, you probably would need a new one since thats a new url
its a lot easier to manage secrets using Secrets Management, which actually allows edits
j
yea the issue i think is that we want to use the secret value in the POST body not in the url or headers which I think https.post will only replace in the url or headers only
b
secrets and guids function the same, they both can be used in the url/headers/body
its just that secrets actually have a ui to manage them
j
so why isn’t this part of the documentation working
options.credentials string[] optional An array of string GUIDs. These GUIDS are searched for in the options.body of the request and are replaced by the decrypted passwords before they are sent to a third-party server.
its almost like it’s not searching for the GUID in the post body and replacing it
thats my end goal
b
i recommend starting with secrets, mostly because its harder to mess up the configuration of the secret
guids means you need to also get the setup of the credential field correct
i mean, you also have to do it with secrets, but there is a prettier ui with the secrets
j
yea we have a suitelet with a credential field asking for user input - then in the POST trying to use that entered secret to call a 3rd party API
can’t use api secrets manager because the user entered secret is dynamic
b
okay
then you get to learn why they implemented secrets
what does the setup of your credential field look like
j
Copy code
form.addCredentialField({
                id: 'password',
                label: 'App Secret',
                restrictToScriptIds: ['customscript_test_script'],
                restrictToCurrentUser: false,
                restrictToDomains: ['<http://sandbox.dev.clover.com|sandbox.dev.clover.com>', '<http://api.clover.com|api.clover.com>']
            });
b
the guid will only work on the script with idcustomscript_test_script
which is not really enough for educational purposes
add an echo service to the domain list
Open in Slack
PreviousNext
Powered by