Draft: Use different endpoint to fetch user information for Jira Connect app
What does this MR do and why?
The user
endpoint requires the "Browse users and groups" global
permission [1], which some users disable for security reasons.
Instead we can use the myself
endpoint, which doesn't require any
special permissions [2] and should always be available for users who
have permission to manage the Jira Connect app.
[1] https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-users/#api-rest-api-3-user-get
[2] https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-myself/#api-rest-api-3-myself-get
Issue: #351442
How to set up and validate locally
The "Browse users and groups" permission can be managed on https://yourjirainstance.atlassian.net/secure/admin/GlobalPermissions!default.jspa, but I wasn't able to reproduce the problem with the user
endpoint after removing all of these groups (even after waiting 15+ minutes, in case there's a delay with permission changes):
But we really just need to make sure that the myself
endpoint works correctly too:
- Open this MR in Gitpod and make port 3000 public.
- Install the app from the Gitpod instance: https://docs.gitlab.com/ee/integration/jira/connect-app.html#install-the-application-manually
- Link a namespace as described on https://docs.gitlab.com/ee/integration/jira/connect-app.html#install-the-gitlabcom-for-jira-cloud-app, the Jira user information is fetched when clicking
Link
on a namespace. - This should succeed without errors.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #351442