How to make the difference between groups and users in project roles in groovy ?

[Quentin Mahé]

Hello,

So I have a project roles set up like this :

What I want to do is get the list of all the users with a "projet-administrateur" role, and check if the user is in a group with the same role in the project. If he is, then I remove the user from the list, as he's already in a group with a "projet-administrateur" role.

At the moment I can get all the users with the role (even the ones in the group), but I want to return only the groups with the role but so far I've no idea how to do it.

Is there a way to get only the groups that have access to a project ?

Thanks !

[Radek Dostál]

I think I'd try something like this, but really and most importantly, you must test this thoroughly to avoid breaking your project role actors - verify it, try it on some simulated scale, development instance, make a backup, do take the precautions.

I believe this code should be working fine, but I cannot iterate enough - if I am wrong and it does not work the way I think it does, this could get dangerous. If anything in this you should find how to get the groups and users separately.

import com.atlassian.jira.bc.projectroles.ProjectRoleService
import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.project.Project
import com.atlassian.jira.project.ProjectManager
import com.atlassian.jira.security.groups.GroupManager
import com.atlassian.jira.security.roles.ProjectRole
import com.atlassian.jira.security.roles.ProjectRoleActor
import com.atlassian.jira.security.roles.ProjectRoleActors
import com.atlassian.jira.security.roles.ProjectRoleManager
import com.atlassian.jira.security.roles.RoleActor
import com.atlassian.jira.user.ApplicationUser
import com.atlassian.jira.user.util.UserManager
import com.atlassian.jira.util.SimpleErrorCollection

UserManager userManager = ComponentAccessor.getUserManager()
GroupManager groupManager = ComponentAccessor.getGroupManager()

ProjectManager projectManager = ComponentAccessor.getProjectManager()
Project project = projectManager.getProjectByCurrentKey("<PROJECTKEY>")
assert project != null

ProjectRoleManager projectRoleManager = ComponentAccessor.getComponent(ProjectRoleManager)
ProjectRole projetAdministrateur = projectRoleManager.getProjectRole("projet-administrateur")
assert projetAdministrateur != null

ProjectRoleService projectRoleService = ComponentAccessor.getComponent(ProjectRoleService)
SimpleErrorCollection simpleErrorCollection = new SimpleErrorCollection()

ProjectRoleActors projectRoleActors = projectRoleService.getProjectRoleActors(projetAdministrateur, project, simpleErrorCollection)
if (simpleErrorCollection.hasAnyErrors())
    throw new Exception("Can't get project role actors, Exception: " + simpleErrorCollection.getErrorMessages().toString())

Set<RoleActor> userRoleActors = projectRoleActors.getRoleActorsByType(ProjectRoleActor.USER_ROLE_ACTOR_TYPE)
Set<RoleActor> groupRoleActors = projectRoleActors.getRoleActorsByType(ProjectRoleActor.GROUP_ROLE_ACTOR_TYPE)

Set<ApplicationUser> groupMembers = new HashSet<>()
for (RoleActor roleActor : groupRoleActors) {
    String groupname = roleActor.getParameter()
    Collection<ApplicationUser> members = groupManager.getUsersInGroup(groupname)
    //groupMembers.addAll(members) //not sure if this would work in bulk, so doing the safe way
    for (ApplicationUser applicationUser : members)
        groupMembers.add(applicationUser)
}

List<ApplicationUser> usersWhoCanBeRemovedFromRole = new LinkedList<>()
List<ApplicationUser> users = new LinkedList<>()
for (RoleActor roleActor : userRoleActors)
    users.add(userManager.getUserByKey(roleActor.getParameter()))

for (ApplicationUser applicationUser : users) {
    if (groupMembers.contains(applicationUser))
        usersWhoCanBeRemovedFromRole.add(applicationUser)
}

//return the result first for manual verification
return usersWhoCanBeRemovedFromRole*.getUsername()


//remove users now
List<String> userkeys = usersWhoCanBeRemovedFromRole*.getKey()
simpleErrorCollection = new SimpleErrorCollection()
projectRoleService.removeActorsFromProjectRole(userkeys, projetAdministrateur, project, ProjectRoleActor.USER_ROLE_ACTOR_TYPE, simpleErrorCollection)

if (simpleErrorCollection.hasAnyErrors())
    log.error(simpleErrorCollection.getErrorMessages().toString())