For context, we have a JIRA app that was originally Connect-only.
Recently we successfully adopted Forge manifest for this app (Connect-on-Forge), and has been deployed to production in this state for a few months.
Our original Connect descriptor (atlassian-connect.json) had the following scopes:
"scopes": ["READ", "WRITE", "DELETE"]
(Note: the only thing the app writes or deletes is an issue entity property)
As part of the adoption of Forge manifest, our manifest.yml has the following equivalent scopes (and this avoided the need for a major version upgrade and admin approval):
permissions:
scopes:
- read:connect-jira
- write:connect-jira
- delete:connect-jira
We are now in the process of converting the connectModules to native Forge modules.
We have a jira:issueAction module that opens a UI Kit 2 modal to confirm deletion of an issue entity property. When the user confirms, the modal calls requestJira() to do the deletion:
const context = useProductContext();
const issueId = context?.extension.issue.id;
const url = `/rest/api/3/issue/${issueId}/properties/${entity-property-key}`;
const deleteHandler = async () => {
const response = await requestJira(url, { method: "DELETE" });
...
}
Everything seemed to be going well until the requestJira() call, at which point our app threw up an “Access required” modal with the message:
Access required
For action-title to display, you need to grant it access to Atlassian apps on your behalf.
Cancel | Allow access
Apart from the slightly odd messaging (“For X to display…” even though the action is already displayed), we assumed this meant that the delete:connect-jira scope would need to be changed to an equivalent Forge scope.
Looking through the list, we found delete:issue.property:jira which sounded like exactly what we need, and would seem to be more granular that the sweeping delete:connect-jira scope we already had.
So we were surprised then when redeploying the app to our development environment that it was treated as a major version upgrade.
Apologies if this is a basic Forge question, but this is the first of our apps to go through the migration from Connect to Forge and we’re unclear what to expect here.
So two questions:
- Is it expected that
requestJira()would ask me to “grant it access to Atlassian apps on your behalf”? (and does this mean in production every user has to explicitly grant access?) - What would be the equivalent Forge scope that doesn’t require a major upgrade / admin approval? (Do we even need a scope if we’re using
requestJira()to perform the delete directly from the UI via the REST API as the user?)
Thanks for any tips you can provide.
EDIT: After upgrading to the new major version (forge install –-upgrade), the Access Required prompt no longer appears. The questions regarding whether delete:issue.property:jira scope is necessary, and why it triggers a major version still stand.
