Permission check when handling webhook

Jira Development Jira Cloud
#1

Is there a way to check user permission when handling /issue-updated webhook (server-side)?

It sounds like an obvious thing to do, but I’m not able to find an answer. What I looked at is:

  • Jira expressions (there is no way to use it in a webhook definition in atlassian-connect.json unfortunately)
  • Jira REST API (it only allows to check permission for the user making a request, but my app does not have “ACT_AS_USER” scope).

So, is there a way to check user permission acting as an app (server-side) with ADMIN permission?

Thanks,
Jack

1 Like
#2

@kkercz, maybe you can share your knowledge here?

Thanks,
Jack

#3

Heh, I actually started writing an answer some time ago but got distracted and never got back to it.

So unfortunately, the only way is the REST API, and all permission checking endpoints assume you want to check permissions of the currently logged-in user. I’m afraid you would need to add the ACT_AS_USER scope to your app.

If that’s not an option, I would suggest creating a feature request in ACJIRA for an endpoint that would allow you to specify a user to check permissions for.

Hope this helps.

1 Like
#4

@kkercz Thank you for the answer.

I will raise an issue as it seems to be a hole not letting ADMIN check the permission of a user.

  1. But, is there a request already to support conditions and expressions in webhooks? That could help us too.

  2. On the side note, can I use expressions as part of conditions as part of context parameters :slight_smile:?
    I tried the following (as part of a web panel URL), but it always returns “false”, even if the project is a classic one (not next-gen):

&classicProject={condition.jira_expression(expression='project.style==classic')}

I tried to put quotes in various places but it did not help.
project.style is not expanded as a context-parameter too.

Overall, I want to pass information if the project is next-gen or not.

Thanks,
Jack

#5

it seems to be a hole not letting ADMIN check the permission of a user.

Yes, I agree. I can’t see any reason why admins shouldn’t be allowed to check permissions of other users, especially that it’s already available in the UI.

can I use expressions as part of conditions as part of context parameters

It should be possible. When it comes to syntax, it should be the following in this case (the expression itself is not in any quotes, like other arguments in other inline conditions):

&classicProject={condition.jira_expression(expression=project.style=='classic')}

Let me know if that doesn’t work, I’ll investigate further.

1 Like
How do I tell if a given user is a Jira administator from app backend?
#6

This version works well. Thank you.

Raised the following requests:

1 Like