RFC-25: [Superseded by RFC-29] App Access Rule - followup to New App Data Access APIs

Hi @JustinThirkell,

two points from my side:

Point 1:
I can give a +1 to pretty much all concerns raised by other app vendors. Using additional APIs/standards increases technical complexity on our (app vendor’s) side. Please only do this for good reasons.

Point 2:
I’m especially concerned about one feature of our Jira app (Connect) in regards to project/issue restrictions:

  • Our app’s feature: Standard customfield(s) can be set with user data from the issue’s assignee/reporter. (For use-cases like “Manager of Assignee”, or “Location of Reporter”.) Whenever the assignee/reporter changes, our app updates the customfield(s) accordingly, via REST-API.
  • For this to work, our app must:
    • be able to view the issue (to get issue-events)
    • be able to edit the issue (to set customfields)

That will not work for restricted projects, which is as designed by App Access rules, afaik. In consequence, those customfields will become outdated after assignee/reporter-changes, as they cannot be updated anymore by our app. We see that as a problem, because:

  • Our end-users will surely wonder why those customfields get outdated.
  • We don’t see how we can inform the end-user in a meaningful way. Restricted issues and their customfields are completely off limits to our app.

What can we do here, apart from updating our documentation, and handling the additional support requests from customers?

Cheers,
Andreas

2 Likes