Add browse permission by mentioning user in comments?

[Harshit Goyal]

Is there a way with which browse issue permission may be assigned to a user by simply tagging them in comments? Currently in our organization some users are facing issues as they want to involve multiple members into an issue at later stages is there a possibility that they may just add username in comment and the issue becomes visible to that person instead of going to edit and adding users in a custom field with browse permission?

[scott_boisvert · Accepted solution]

If you have ScruptRunner you could set up an event/listener for the comment and check if there was an @mention then execute a script to add them to the Browse permission. That would give them access to all issues in the project though. If you wanted them to only see that one issue you could do something similar with issue security, but that could get cumbersome as you would essentially have an issue security scheme for everyone in the organization or for each issue...

[scott_boisvert]

Actually the each issue security scheme might be the way to go. When the issue is resolved assign a default security scheme and delete the issue specific scheme. This would help to automatically clean up the issue security schemes..... Still would be a lot of them, but at least they would get cleaned up.

[scott_boisvert]

Here's an example of a listener I use to change the security level on production defects to make them public:

import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.issue.MutableIssue
import com.atlassian.jira.issue.security.IssueSecurityLevelManager
import com.atlassian.jira.issue.security.IssueSecuritySchemeManager
import com.atlassian.jira.event.type.EventDispatchOption
import com.atlassian.jira.issue.CustomFieldManager
import com.atlassian.jira.issue.fields.CustomField

def issue = event.issue as MutableIssue
def issueManager = ComponentAccessor.getIssueManager()
def customFieldManager = ComponentAccessor.getCustomFieldManager();
def cf = customFieldManager.getCustomFieldObjectsByName("Exists in Production?")
def existsInProdValue = issue.getCustomFieldValue(cf[0]) as String

if ((existsInProdValue == "Yes" && issue.issueType.name == "Defect") || issue.issueType.name == "Service Request")
{
def issueSecuritySchemeManager = ComponentAccessor.getComponent(IssueSecuritySchemeManager)
def issueSecurityLevelManager = ComponentAccessor.getComponent(IssueSecurityLevelManager)
def schemeFromName = issueSecuritySchemeManager.getSchemeObjects().find { it.name == "Allow Public View" }
def projectKey = issue.getProjectObject().getKey()
def schemeFromProject = issueSecuritySchemeManager.getSchemeFor(ComponentAccessor.projectManager.getProjectByCurrentKey(projectKey))
def securityLvl = issueSecurityLevelManager.getIssueSecurityLevels(schemeFromName.id).find { it ->
it.name == "Public"
}?.id

def user = ComponentAccessor.getUserManager().getUserByName("jiraadmin")

issue.setSecurityLevelId(securityLvl)
issueManager.updateIssue(user, issue, EventDispatchOption.DO_NOT_DISPATCH, false)
}

[Dirk Ronsmans]

@scott_boisvert

Not exactly. Using a security level with a a "user custom field value" should allow for 1 level that is dynamically set based on that custom field.

Just add the mentioned users to the field and you basically have issue specific permissions (for viewing)

[nina_schmidt]

Interesting question, I am sure one of the „Script nerds“ will answer. 

my question would be: why don‘t you give all users the browse Project permission in advance to keep your administrative effort as low as possible. 
How high is the percentage of users that after some time need the permission anyways compared to all users. 

[Harshit Goyal]

As per the administrative requirement issues must not be visible to all the members. Only the person involved should be able to see it also they want the flexibility to tag/comment peope to make issue visible to them.
This is the reason it is becoming complex for me. 

[nina_schmidt]

I thought this might be the answer but sometimes it’s just a „we always did that like this“. 

I‘ll try to loop one of the scripters in. 

[Harshit Goyal]

Thanks a lot for your help! :) 

[Dirk Ronsmans]

Make sure u also think of your security levels then. Providing them with the browse permissions basically gives them access to all issues (within their security level) and I don't think you'll want them to have full access by being mentioned in a single issue right?

Have u thought of giving them all the browse permission but then dynamically setting the security level as they are mentioned? (perhaps by adding them to a custom field)