Call a scriptrunner script as another user with javascript

[pradeepbhat]

I'm using a dialog with scriptrunner to give others the ability to copy projects, however while this works for one group, another group is not able to do so as they'll get the following error message,

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><status><status-code>403</status-code><message>Client must be authenticated as an administrator to access this resource.</message></status>

Is there a way for me to let them run the script under a different user via javascript?

var xhttp = new XMLHttpRequest();
xhttp.open("POST", "${getJiraBaseUrl()}/rest/scriptrunner/latest/canned/com.onresolve.scriptrunner.canned.jira.admin.CopyProject", false);
xhttp.setRequestHeader("Content-type", "application/json");
xhttp.send(JSON.stringify(payload));

[pradeepbhat · Accepted solution]

For anyone looking to do something similar,

below is the code that worked for me,

though will definitely appreciate any improvements in terms of returning errorcollection or result

import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.sal.api.user.UserManager
import com.onresolve.scriptrunner.runner.rest.common.CustomEndpointDelegate
import groovy.transform.BaseScript
import com.onresolve.scriptrunner.canned.jira.admin.CopyProject

import javax.servlet.http.HttpServletRequest
import javax.ws.rs.core.MultivaluedMap
import javax.ws.rs.core.Response
import groovy.json.JsonBuilder
import groovy.json.JsonSlurper

@BaseScript CustomEndpointDelegate delegate

createNewProjectEngineers(
 httpMethod: "POST", groups: ["****"]
) {MultivaluedMap queryParams, String body ->
 
 log.info(body)
 
 def slurper = new groovy.json.JsonSlurper()
 def data = slurper.parseText(body)
 
 log.info(data)
 
 def copyProject = new CopyProject()
 def inputs = [
 (CopyProject.FIELD_SOURCE_PROJECT) : data.FIELD_SOURCE_PROJECT,
 (CopyProject.FIELD_TARGET_PROJECT) : data.FIELD_TARGET_PROJECT,
 (CopyProject.FIELD_TARGET_PROJECT_NAME) : data.FIELD_TARGET_PROJECT_NAME,
 (CopyProject.FIELD_COPY_VERSIONS) : true,
 (CopyProject.FIELD_COPY_COMPONENTS) : true,
 (CopyProject.FIELD_COPY_ISSUES) : true,
 (CopyProject.FIELD_COPY_DASH_AND_FILTERS) : true,
 (CopyProject.FIELD_CLONE_BOARD_NAME) : data.FIELD_CLONE_BOARD_NAME
 ]
 def errorCollection = copyProject.doValidate(inputs, false)
 if(errorCollection.hasAnyErrors()) {
 log.info("Couldn't create project: $errorCollection")
 return errorCollection
 }
 else {
 def util = ComponentAccessor.getUserUtil()
 def adminsGroup = util.getGroupObject("jira-administrators")
 assert adminsGroup // must have jira-administrators group defined
 def admins = util.getAllUsersInGroups([adminsGroup])
 assert admins // must have at least one admin
 ComponentAccessor.getJiraAuthenticationContext().setLoggedInUser(util.getUserByName(admins.first().name))
 def result = copyProject.doScript(inputs)
 return Response.ok(result).build()
 }
 
}

[Nic Brough -Adaptavist-]

Only by logging in as an admin, which is a security risk.

[pradeepbhat]

Is there a way to do it from the groovy side?

I'm thinking if no way with javascript then call a different custom rest api and from there call the copyproject script

[Nic Brough -Adaptavist-]

Yes, if you're coding inside Jira, you could provide a REST end-point that could do the admin work when it is poked by an ordinary user.

[pradeepbhat]

Hi @Nic Brough -Adaptavist-

running into an issue with the end-point execution,

import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.sal.api.user.UserManager
import com.onresolve.scriptrunner.runner.rest.common.CustomEndpointDelegate
import groovy.transform.BaseScript

import javax.ws.rs.core.MultivaluedMap
import javax.ws.rs.core.Response

import groovyx.net.http.ContentType
import groovyx.net.http.HTTPBuilder
import groovyx.net.http.Method
import static groovyx.net.http.ContentType.*
import groovy.json.JsonSlurper
import net.sf.json.groovy.JsonSlurper

@BaseScript CustomEndpointDelegate delegate

static getJiraBaseUrl() {
 def baseUrl = ComponentAccessor.getApplicationProperties().getString("jira.baseurl")
 return baseUrl
}

createNewProjectEngineer(
 httpMethod: "POST", groups: ["****"]
) {MultivaluedMap queryParams, String body ->
 
 log.info(body)
 
 def restClient = new HTTPBuilder(getJiraBaseUrl())
 
 log.info("made it past httpbuilder")
 
 restClient.request(Method.POST, ContentType.JSON) { req -> 
     requestContentType = ContentType.JSON
     uri.path = "/rest/scriptrunner/latest/canned/com.onresolve.scriptrunner.canned.jira.admin.CopyProject"
     headers.'Authorization' = "Basic ${"****:****".bytes.encodeBase64().toString()}"
     body = body
     response.success = { resp, json ->
         log.info("was successfull")
         return json
     }
     response.failure = { resp, json ->
         log.info("failed")
         log.info(resp)
         return json
    }
 }
 
}

I'm getting the following errors back with the above inline script,

2018-10-17 11:08:56,746 ERROR [common.UserCustomScriptEndpoint]: Script endpoint failed on method: POST createNewProjectEngineer
java.lang.NoClassDefFoundError: groovy/lang/GroovyObject
 at com.onresolve.scriptrunner.runner.rest.common.UserCustomScriptEndpoint.doEndpoint(UserCustomScriptEndpoint.groovy:380)
 at com.onresolve.scriptrunner.runner.rest.common.UserCustomScriptEndpoint.postUserEndpoint(UserCustomScriptEndpoint.groovy:279)
Caused by: java.lang.ClassNotFoundException: groovy.lang.GroovyObject
 ... 2 more

 What am I missing here?