Skip to content

Draft: Use different endpoint to fetch user information for Jira Connect app

Markus Koller requested to merge 351442-jira-fetch-user-info into master

What does this MR do and why?

The user endpoint requires the "Browse users and groups" global permission [1], which some users disable for security reasons.

Instead we can use the myself endpoint, which doesn't require any special permissions [2] and should always be available for users who have permission to manage the Jira Connect app.

[1] https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-users/#api-rest-api-3-user-get
[2] https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-myself/#api-rest-api-3-myself-get

Issue: #351442

How to set up and validate locally

The "Browse users and groups" permission can be managed on https://yourjirainstance.atlassian.net/secure/admin/GlobalPermissions!default.jspa, but I wasn't able to reproduce the problem with the user endpoint after removing all of these groups (even after waiting 15+ minutes, in case there's a delay with permission changes):

image

But we really just need to make sure that the myself endpoint works correctly too:

  1. Open this MR in Gitpod and make port 3000 public.
  2. Install the app from the Gitpod instance: https://docs.gitlab.com/ee/integration/jira/connect-app.html#install-the-application-manually
  3. Link a namespace as described on https://docs.gitlab.com/ee/integration/jira/connect-app.html#install-the-gitlabcom-for-jira-cloud-app, the Jira user information is fetched when clicking Link on a namespace.
  4. This should succeed without errors.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #351442

Edited by Markus Koller

Merge request reports