[ForeignKeyCN]

Summary

Confluence 1.0.0 adds OAuth and Each user signs in (Atlassian OAuth 2.0 3LO) next to the existing API token, adds the common Confluence operations that were missing, and fixes create_page on Confluence Cloud. It follows the same design as Jira (#4169) and the reworked Microsoft plugins (#4163–#4168).

Existing API-token credentials keep working unchanged, and the six original tools keep their names and parameters.

Fix: create_page returned 500 on Confluence Cloud

• atlassian-python-api sends the v2 page body as {"storage": {"value": …}}. Confluence Cloud answers that with 500 INTERNAL_SERVER_ERROR.
• The v2 API expects {"representation": "storage", "value": …}, which works (verified against a real site with both shapes).
• create_page now posts the correct body itself.
• create_page also gains an optional parent page and Markdown input (default stays storage format), and returns the new page's ID.

Auth

• API token (unchanged):
  • URL + username + API token.
  • On Server / Data Center, an empty username sends the token as a Bearer personal access token.
• OAuth: Atlassian 3LO from the Dify console.
  • Optional Site URL, for accounts that reach several sites.
  • The cloud ID comes from accessible-resources.
  • Rotating refresh tokens are handled.
• Each user signs in: the first time a chat user needs Confluence, the tool returns an Atlassian sign-in link.
  • A plugin endpoint (GET /confluence/callback) only stores the one-time code; the tool redeems it with the client secret.
  • Per-user tokens are Fernet-encrypted in plugin storage, keyed by a hash of client_id | Dify user ID, and never appear in tool output.
  • The callback page warns about forwarded links and offers a cancel link.
  • confluence_sign_out forgets the sign-in.
  • The mode is also inferred when the app fields are filled in and no token is given.
• Scopes: granular Confluence scopes by default. They cover both the v2 API and the v1 endpoints still needed (CQL search, label and attachment writes). They can be overridden in a Scopes field.
• Where tokens are sent: OAuth tokens only to api.atlassian.com/ex/confluence/<cloud id>.
  • For the original tools, the base passed to atlassian-python-api includes /wiki on gateway URLs, which the library does not add itself.
  • On Server, attachment downloads follow only relative links on the configured host.

New tools (prefixed confluence_: the new Agent rejects duplicate tool names across plugins)

Operation	Tool
Search (CQL), Get pages by label	confluence_search: free text / space / label / content type, or any CQL; follows the search cursor
Page: Get	confluence_read_page (readable text, storage body, version, link); get_page stays
Page: Update / Append	confluence_update_page: replace, append or prepend content (Markdown or storage), rename, version comment
Page children	confluence_list_child_pages
Comments	confluence_list_comments, confluence_add_comment (Markdown), confluence_delete_comment
Labels	confluence_get_labels, confluence_add_labels, confluence_remove_label
Attachments	confluence_list_attachments, confluence_upload_attachment (a file, or text + file name), confluence_get_attachment (returns the file, up to 50 MB), confluence_delete_attachment

• Cloud uses the v2 API. Server / Data Center uses the v1 REST API for the same tools.
• Every new tool returns typed output variables (success / error plus its fields).
• IDs are encoded as one path segment each.

Release Notes

• Authorization: Confluence can now be authorized with OAuth, or with Each user signs in for chat agents, where each person works in Confluence as themselves.
• 14 new tools:
  • CQL search and read pages.
  • Update pages: replace, append or prepend content, or rename.
  • Child pages, comments, labels and attachments.
• create_page:
  • Works again on Confluence Cloud (it failed with a 500).
  • Accepts Markdown and a parent page.
• Output variables: new tools return typed output variables.

Change Type

• Documentation / non-plugin change
• Non-LLM plugin (tools, extensions, datasource, etc.)
• LLM plugin

Screenshots / Videos

The README walks through the setup and the chat flow with screenshots:

• The Dify credential form.
• The agent's sign-in link.
• Atlassian's consent screen with the Confluence permissions.
• The agent creating a page as the signed-in user.

Testing

• Unit tests: 78 passed (pytest tests). The existing test_sdk_compatibility.py also passes; its create-page body assertion is updated to the v2 shape. They cover:
  • Per-user sign-in: link, callback, redeem, cache, rotating refresh, revoked refresh, encryption and per-user isolation, cancel/error pages, sign-out.
  • Site selection.
  • OAuth provider methods and validation.
  • Every new tool on Cloud and Server.
  • Cursor paging.
  • Markdown → storage and storage → text.
  • Path encoding.
  • No OAuth token sent off api.atlassian.com.
  • The original tools under OAuth and per-user.
• Real Confluence Cloud site, API token: 26 steps, all passed.
  • List spaces and pages; create a page (Markdown) and a child page.
  • Read, append, rename and re-read the page.
  • Child pages; comment add/list/delete; labels add/get/remove.
  • Attachment upload/list/download (content matches)/delete.
  • Search by label and by CQL; delete both pages.
  • This run found the create_page 500, a double-encoded search cursor, and blank lines between list items in the page text. All three are fixed.
• Self-hosted Dify (Community), Each user signs in, in an agent chat:
  • Sign in through Atlassian's consent screen.
  • Create a page with a checklist and add a label.
  • Find and read it, add a comment, attach a text file.
  • List the attachments and download the file. The download goes through api.atlassian.com and the media redirect with the per-user OAuth token.
  • The page and label were confirmed on the site.
• Not run end to end:
  • OAuth from the Dify console's Authorize button. It shares the token exchange and site lookup with the per-user path.
  • Server / Data Center (unit tests only).

Checklist

• I have read the contribution guidelines
• Version bumped: 0.1.2 → 1.0.0

[crazywoola]

Reviewed the plugin scope, manifest, documentation, and relevant source changes. Approving this revision to run the repository pre-merge plugin validation; merge is contingent on successful validation.