Disable all transitions when a certain security level is set

[arama mihai]

Hello,

I would like to know if it is possible to hide/disable all workflow transitions when a certain security level is selected, except you are a certain user.

I thought of trying with the "Script Fragments" > Hide system or plugin UI element , but could not find the transition UI element name so that I could know what needs to be hidden.

Do you know if this is possible and how exactly to do it?

Thank you!

[Nic Brough -Adaptavist-]

You would probably do this with a Behaviour, as that could hide bits of the UI, but this is completely the wrong approach, as it's complex and incomplete (people can bypass it quite easily).

The best option is to add a condition to all the outgoing transitions that says "if security level = X, then do not allow transition".  This is an absolute, it will work everywhere and you can use the same script to do it in many places.

[arama mihai]

Hi,

Thank you for your reply. 

So I tried with a simple scripted condition, provided by scriptrunner. It works fine, and for anyone who might need it, it is:

issue.securityLevelId != 10901 && currentUser.username != 'user_id'


I was wondering though, how could a behavior be bypassed? It just seemed easier to add one single behavior than adding the same script multiple times to each transition in the workflow. 

[Nic Brough -Adaptavist-]

Behaviours are mostly javascript based and run on the browser.  So...

They can only act in certain screens where they can be injected.  If you have anything that allows you to change issues via routes that are not the screens where they exist, then they are not run.

Developer tools in your browser can easily remove chunks of js.

REST - there's nothing running the .js (and the interface doesn't send it even if you did use a REST client that could).  So Behaviours have no effect.

[Ismael Jimoh]

Hi Arama,

To knowledge, you can add a condition that restricts the transition to the specified user in your workflow.

Meaning any other user would not be able to transition the issue once it is at that status.

For the above, you may need scriptrunner as I doubt the default allows you to achieve this for just a user.

Alternatively, you can

• add the specific user to a role in the project.
• add a condition to all transitions so that only the members of the role can transition the issue. (if you want to be more specific, you can add a condition on top to check the status and the issue security if you are using the all transition)

It is odd though that non members of the security level are able to see the issue because they should not be able to see it. (Review your implementation of security levels).

Cheers

[Nic Brough -Adaptavist-]

This is not quite right.  The question was about stopping people from using transitions when an issue has a certain security level.

The roles and groups of a user are irrelevant here, you just need a script that looks at the security level.

[Ismael Jimoh]

Thanks for the clarification @Nic Brough -Adaptavist-.