How can I see the field level restrictions for a scriptrunner scripted field ?

[Penny Boulet]

I have taken over administering JIRA with script-runner. No one who remains knows anything about some custom fields that were set up with script-runner years ago.

Someone wants the ability to change the content of a script-runner field but I am unable to find a way to see who has permissions to do that today so I am unable to find what additional access to give to this person.

Can you provide a set by step method to see the current permissions for this script-runner field?

Thanks,

Penny

[Steven F Behnke · Accepted solution]

Script Fields allow arbitrary Groovy code to run. Since this is a security problem, only full Jira Administrators are allowed to configure the fields under the Apps -> Scriptrunner -> Script Field section. 

[Penny Boulet]

The scripted field in question is numeric and is used to rank order items so we work on them in order. Some set of people can do this and none of them are JIRA admins.

What I want to know is how I can *see who can do things with this custom field in terms of using it* NOT changing the definition of the field.  I keep reading things that imply this limitation is possible and I know some people in my org have permissions and aothers do not BUT I don't know how to see what grants them permissions.

i.e.

• Is it Project Admin for the project(s) that use that field?
• Is it group membership for a select group ?
• Is it hard-coded in middle of the scriptrunner script for the field who can access it?

I do NOT want to give out full JIRA admin permissions to anyone not qualified to be a JIRA admin. I want to set minimal permissions to "USE" the single field.

[Steven F Behnke]

Script Fields are read-only constructs. When their value is "viewed", a "script" is executed on the server and the result of that script is the "value" in the field.

When referring to the field value, it's not possible to answer who can "use" the field or who can "access" the field: It depends on the script that has been written. 

For instance, a common use-case is a calculated value. This can be something like ...

return getCustomFieldValue('Impact') * getCustomFieldValue('Severity')

In this case, someone would need to be able to edit the 'Impact' and 'Severity' fields on the issue in question to interact with the scripted field.

Sorry, I'm struggling to understand what we mean by "use" the field or to "access" the field. If you can share the script, I may be able to explain more. 

[Penny Boulet]

I am sorry for being unclear.

I was able to finally get in touch with someone who has moved on to another job to get some help.

What was done here was they added a "Schedule" permission for the project in question.
People who have this "schedule permission" can use the "drag and drop" to do backlog ordering when looking at the backlog.  When that happens, the values in this custom field are automatically computed and populated in the background.

I was confused that this was actually permissions on the custom field itself. It is the ability to re-order backlog items that is restricted and not a restriction on the custom field itself.

Thank you for your explanations - they make much more sense to me now.

[Steven F Behnke]

That's very interesting (and would be hard to pinpoint!!) Thanks for sharing the solution.