CloudScript for Confluence
CloudScript for Confluence is an administrator tool that lets a Confluence Cloud administrator run JavaScript against their own Confluence instance to automate content tasks. It is aimed at bulk or repetitive jobs that would be tedious to do by hand, such as listing or filtering pages, copying a page or a space, or creating pages and comments programmatically through the Confluence REST API.
This is a power tool for administrators, and it should be understood as such before it is used. Scripts run with broad permissions (see "How it runs" and "Limitations" below), so it is best suited to people who are comfortable with JavaScript and with the Confluence REST API, and who understand the access a script is given.
What it does
The app adds a CloudScript page to your Confluence Cloud site, available to administrators, containing a script editor and a set of predefined example scripts. You write (or load an example into) the editor, run it, and the result panel shows either the script's output or the resulting error. Typical uses include listing the pages in a space, fetching a page's stored content, creating pages and child pages, copying a page, creating spaces or comments, and running CQL searches, all by calling the Confluence REST API from your script.
How it runs
When you run a script, it is sent to the app's server and executed there in a sandboxed Node.js virtual machine, with direct process access removed. The script runs as the app's plugin user, which is a system user in your Confluence site. Because the script acts as that user, content a script creates is owned by the plugin user rather than by you, and the script can do anything that user is permitted to do. An administrator can adjust the plugin user's permissions from the user-management screen.
Three objects are made available to your script: httpClient, a pre-configured HTTP client that targets your Confluence instance for any path without a host (its get, post, put, delete, head, and patch methods return promises, so they can be chained with .then()); result, a holder whose promise property the runner watches to know when the script has finished (assign it the result of your first httpClient call); and console, a replacement for the usual console that captures console.log output into the result panel (call JSON.stringify yourself if you need to log an object). Every method documented in the Confluence REST API is reachable through httpClient, and scripts are run in strict mode automatically.
The require function is restricted to a small set of bundled modules (lodash among them); arbitrary npm modules cannot be loaded.
Example: list the pages in a space
var spaceKey = 'ds';
result.promise = httpClient.get({
url: "/rest/api/content?spaceKey=" + spaceKey
});The app also ships worked examples for getting a page's content, creating a page or child page, copying a page, creating a space, creating a comment, listing blog posts, and searching with CQL.
Limitations
The app can only do what the Confluence Cloud REST API allows. Notably, the REST API does not cover space or page permissions, so a script cannot programmatically restrict the content it creates, and content created by a script belongs to the plugin (system) user. Each script run is also subject to an execution timeout (five seconds at the time of writing) and a memory limit, so it is not suited to very long-running jobs.
Security
Scripts run in an isolated virtual machine with underlying process access removed. Because the tool executes code you provide with system-user access to your Confluence site, treat the scripts you run with the same care you would treat any administrative automation: review what a script does before running it, and limit who has access to the CloudScript page.
Support
For help with this app, see the Support page.