Script fragment to hide create-subtask for specific groups in projects

[Mary Mark]

Hi Atlassian Community, 

Looking to create a script fragment to hide the "Create Sub-task" button under the "More" tab in a Jira issue view. 

It works for a single project and single group but I would like to add in additional groups and projects. 

This code works:

For project ABC, I can see and create a sub-task option from the "More" menu when I am in the ABC_managing team. If I am not in the group, I will not be able to see the "create sub-task" option

import com.atlassian.jira.component.ComponentAccessor
def currentUser = ComponentAccessor.getJiraAuthenticationContext().getLoggedInUser()
def groupManager = ComponentAccessor.getGroupManager()

//When there are multiple projects
def projectKeyList = ['ABC']

!(jiraHelper.project?.key in projectKeyList) || (groupManager.isUserInGroup(currentUser,"ABC_managing team"))

However, as soon as I add in the following for additional groups and projects, the code no longer works.

import com.atlassian.jira.component.ComponentAccessor

def currentUser = ComponentAccessor.getJiraAuthenticationContext().getLoggedInUser()

def groupManager = ComponentAccessor.getGroupManager()

//def user = ComponentAccessor.jiraAuthenticationContext.loggedInUser

//def GROUP = ['accind_managing team']

//When there are multiple projects

def projectKeyList =  ['ABC, 'DEF']

!(jiraHelper.project?.key in projectKeyList) || (groupManager.isUserInGroup(currentUser,"ABC_managing team")) || (groupManager.isUserInGroup(currentUser,"DEF_managing team"))

Would appreciate if someone can review to let me know what I am doing wrong.

Thanks in advance. 

Mary

[PD Sheehan · Accepted solution]

Possibly, the only mistake is in 

def projectKeyList = ['ABC, 'DEG']

There is a missing quote after ABC.

But perhaps you can write this so it's easier to read:

import com.atlassian.jira.component.ComponentAccessor

def currentUser = ComponentAccessor.jiraAuthenticationContext.loggedInUser
def groupManager = ComponentAccessor.groupManager

def restrictedProjectList = ['ABC', 'DEF']
def allowedGroupList = ['ABC_managing team', 'DEF_managing team']

if (!restrictedProjectList.contains(jiraHelper.project?.key)) return true //for all other projects, we show the menu as usual
//if we're still running here, this is a project that should limit access to the menu by group
//if the current user is member of any of the allowedGroups, then they can see the menu, otherwise they can't
allowedGroupList.any { group -> groupManager.isUserInGroup(currentUser, group) }

But perhaps, you only want members of the ABC team to have access to the menu in the ABC project. Not the DEF project. In which case, something like this would be more appropriate:

import com.atlassian.jira.component.ComponentAccessor

def currentUser = ComponentAccessor.jiraAuthenticationContext.loggedInUser
def groupManager = ComponentAccessor.groupManager

def restrictedProjectsMap = [
   'ABC': ['ABC_managing team', 'Perhaps another Group'],
   'DEF': ['DEF_managing team']
]

if (!restrictedProjectsMap.containsKey(jiraHelper.project?.key)) return true //for all other projects, we show the menu as usual
//if we're still running here, this is a project that should limit access to the menu by groups. Let's get that list of groups.
def allowedGroupList = restrictedProjectsMap[jiraHelper.project?.key]
//if the current user is member of any of the allowedGroups, then they can see the menu, otherwise they can't
allowedGroupList.any { group -> groupManager.isUserInGroup(currentUser, group) }

[Mary Mark]

Hi Peter,

Thank you for your explanation.

I tried this:

============================================

import com.atlassian.jira.component.ComponentAccessor

def currentUser = ComponentAccessor.jiraAuthenticationContext.loggedInUser

def groupManager = ComponentAccessor.groupManager

def restrictedProjectList = ['ABC', 'DEF', 'GHI']

def allowedGroupList = ['abc_managing team', 'def_managing team', 'ghi_managing team']

if (restrictedProjectList.contains(jiraHelper.project?.key)) return true

//for all other projects, we show the menu as usual

//if we're still running here, this is a project that should limit access to the menu by group

//if the current user is member of any of the allowedGroups, then they can see the menu, otherwise they can't

allowedGroupList.any { group -> groupManager.isUserInGroup(currentUser, 'group') }

===========================================

I am part of the def_managing team only so I should be able to see "create sub-task" which I am able to. 

I am not part of abc_managing team and ghi_managing team so I should not be able to see "create sub-task" however I can still see the option.

Please advise

Thanks!

[PD Sheehan]

That script will let you view the menu item if your are a member of any of those 3 groups regardless of which project you are currently in.

If you want to have the group match the project, use the second script I suggested.

[Mary Mark]

Thanks Peter. There should be 2 projects to match but 50 other ones that should not match. Does this mean I should list out the rest that don’t match. In this case, project DEF is one of the 50 projects that should not be able to see the menu item if they are not in the allow group list.  

Thanks.

[PD Sheehan]

No see this line

if (!restrictedProjectsMap.containsKey(jiraHelper.project?.key)) return true //for all other projects, we show the menu as usual

If we encounter one of the projects that are not in the restrictedProjectsMap, the script will exit early with "true" and show the menu.

[Mary Mark]

Hi Peter!

The code that contains restrictedProjectMap works! 

Just for my understanding. I've also tried this but not sure why it doesn't work as expected? What is different between the way I wrote it versus your script? 

If I am part of the managing team then I should see the menu option for projects: ABC and DEF. I am part of the ABC_managing team but not DEF_managing team. The results when testing the code is not correct. I can see the menu item when I am not in the managing team and vice versa. 

----------------------------------------------------------------------

import com.atlassian.jira.component.ComponentAccessor
def currentUser = ComponentAccessor.getJiraAuthenticationContext().getLoggedInUser()
def groupManager = ComponentAccessor.getGroupManager()

//When there are multiple projects
def projectKeyList = ['ABC','DEF']

!(jiraHelper.project?.key in projectKeyList) && !(groupManager.isUserInGroup(currentUser,"abc_managing team") || groupManager.isUserInGroup(currentUser,"def_managing team"))

--------------------------------------------------------------------

import com.atlassian.jira.component.ComponentAccessor

def currentUser = ComponentAccessor.jiraAuthenticationContext.loggedInUser
def groupManager = ComponentAccessor.groupManager

def restrictedProjectList = ['ABC', 'DEF']
def allowedGroupList = ['ABC_managing team', 'DEF_managing team']

if (!restrictedProjectList.contains(jiraHelper.project?.key)) return true //for all other projects, we show the menu as usual
//if we're still running here, this is a project that should limit access to the menu by group
//if the current user is member of any of the allowedGroups, then they can see the menu, otherwise they can't
allowedGroupList.any { group -> groupManager.isUserInGroup(currentUser, group) }

Please advise.

Thanks,
Mary

[PD Sheehan]

If you have different projects with different security groups, you need to have a way to associate the group with the project.

The only other way would be to define the allowed group inside a code block that's controlled by a project key matching.

Your code would allow anyone from any of the groups to access the menu item in either of the project.

But generally, a complexe combination of multiple logic statements is a lot harder to read and understand and debug.

[Mary Mark]

Thanks Peter. 

So the way that I coded at the beginning wouldn't work then as it allows anyone from any of the groups: abc_managing, def_managing in projects: ABC and DEF to access the menu item AS WELL as projects and groups not explictly in the code

For example: projects GHI, JKL and groups: ghi_managing team and jkl_managing team will also be able to see the menu item.

regardless of the code.

Please confirm.

Thank you,
Mary

[PD Sheehan]

That is correct.