Why does hasGlobalPermission not block access to a Forge App page in the manifest?

Forge
, ,
1

I am developing a Forge app for Jira and trying to restrict access to certain pages using hasGlobalPermission in the manifest.yml.
My goal is to limit access to specific pages only to Jira administrators or some specific groups.

Here is how my manifest.yml is configured:

modules: 
  jira:globalPage:
     - key: myKey
     .....
     sections:
        - header: myHeader
        ...
        pages:
          - title: myTitle
          ...
          displayConditions: 
             hasGlobalPermission: ADMINISTER
....

I have created a test user who does not have the ADMINISTER permissions .
However, this user can still access the page , even though hasGlobalPermission is supposed to restrict their visibility.

I also tested retrieving permissions for this test user via the Jira API:

const response = await api
                       .asUser()
                       .requestJira(route`/rest/api/3/mypermissions?permissions=ADMINISTER`, {
                  headers: { Accept: "application/json" }
}); 

const data = await response.json(); 
console.log("🔹 Permissions:", data);

And the result confirms that the user does not have the permission (havePermission: false).

Questions:

  1. Why does hasGlobalPermission not block access and visibility to the page?

  2. Is there a better waqy to achieve this restriction based on permissions or specific groups?

Thank you fo your help

2

Hey @AmineNaitLechguer,

The displayConditions property applies to the jira:globalPage module as a whole, and is not available as a property of page or section to limit the display of certain sub pages.
I think, because of the positioning in your manifest, the displayConditions are simply being ignored which is why everything is appearing for your user who does not have the global permission ‘ADMINISTER’.

It appears there is feature request for this functionality already raised FRGE-1610.

I think for now, the only way to implement this would be to maintain your own page menu, and subpages within your app, while checking your the users permissions within the app.

I hope this explains.
Mel

1 Like