Restricting wrong Sprint selection

[Emil Naghiyev]

Hello,

Is it possible to restrict users from adding an issue to a Sprint of the another project?

For instance, an an issue belongs to Project A, but users add this issue to the sprint of Project B. 

[Jasmeet Kaur]

Hello @Emil Naghiyev 

Welcome to Atlassian Community 

In Jira Cloud, it is not possible to strictly restrict users from adding an issue from Project A to a sprint of Project B by default. This is because Jira allows sprints to span multiple projects if those projects are included in the same board filter. Here’s how it works and what you can do:

Why This Happens

• Sprints are board-based, not project-based: If a board’s filter includes multiple projects, any issue from those projects can be added to any sprint on that board.

• Permissions: To add an issue to a sprint, a user must have both the "Manage Sprints", "Schedule Issues" & "Edit issues" permissions in all projects included in the board filter. If they lack these permissions in a project, they cannot add issues from that project to a sprint. 

What You Can Do

1. Restrict Board Filters

• Configure board filters to only include issues from a single project. This ensures that only issues from that project can be added to sprints on that board 3.

• Example: Set the board filter to project = "Project A" for Project A’s board.

2. Tighten Permissions

• Limit "Manage Sprints" and "Schedule Issues" permissions to only those users who should manage sprints for each project. If a user does not have these permissions in Project B, they cannot add Project A’s issues to Project B’s sprints 1 2.

3.  Name Sprints Clearly

• Use clear naming conventions for sprints (e.g., "ProjectA Sprint 1") to reduce accidental cross-project assignments. 

Thank you!

[Ram Kumar Aravindakshan _Adaptavist_]

Hi @Emil Naghiyev

To answer your question, yes, this is doable using ScriptRunner for Jira DC. You will need to use 2 ScriptRunner components: the REST Endpoint and the Server-Side Behaviour for the Sprint field.

The REST Endpoint is required to obtain the details of the Sprint, and the Behaviour is required to perform the validation to check if the Project is associated with the Sprint and verify whether the issue can or cannot be added to the Sprint.

Below is the REST Endpoint code:-

import com.atlassian.jira.component.ComponentAccessor
import com.onresolve.scriptrunner.runner.rest.common.CustomEndpointDelegate
import groovy.json.JsonBuilder
import groovy.transform.BaseScript
import groovyx.net.http.HttpResponseDecorator
import groovyx.net.http.RESTClient

import javax.ws.rs.core.MultivaluedMap
import javax.ws.rs.core.Response

@BaseScript CustomEndpointDelegate delegate

getCurrentSprintDetails() { MultivaluedMap queryParams ->
 def sprintId = queryParams.getFirst('sprintId')

 def applicationProperties = ComponentAccessor.applicationProperties
 final def baseUrl = applicationProperties.getString('jira.baseurl')
 final def username = 'admin'
 final def password = 'q'
 final def headers = ['Authorization': "Basic ${"${username}:${password}".bytes.encodeBase64()}",
'X-ExperimentalApi': 'opt-in', 'Accept': 'application/json'] as Map

 def http = new RESTClient(baseUrl)
 http.setHeaders(headers)

 def resp = http.get(path: "/rest/agile/1.0/sprint/${sprintId}") as HttpResponseDecorator

 if (resp.status != 200) {
   log.warn 'Commander did not respond with 200 for retrieving project list'
 }

 def sprintJson = resp.data as Map
 Response.ok(new JsonBuilder(sprintJson['name']).toPrettyString()).build()
}

Below is a screenshot of the REST Endpoint configuration:-

Below is the Server-Side Behaviour code:-

import com.onresolve.jira.groovy.user.FieldBehaviours
import groovy.json.JsonSlurper
import groovy.transform.BaseScript

@BaseScript FieldBehaviours fieldBehaviours
def sprint = getFieldById(fieldChanged)
def sprintValue = sprint.value
def restEndpointName = 'getCurrentSprintDetails'
final def host = applicationProperties.getString('jira.baseurl')
sprint.clearError()

if (sprintValue) {
 def baseUrl = "${host}/rest/scriptrunner/latest/custom/${restEndpointName}?sprintId=${sprintValue}"
 def response = baseUrl.toURL().text
 def json = new JsonSlurper().parseText(response)

 if (!json.toString().contains(issueContext.projectObject.key)) {
 sprint.setError('Issue not allowed in this Sprint')
 }
}

 Below is a screenshot of the Server-Side Behaviour configuration:-

Please note that the sample working codes above are not 100% exact to your environment. Hence, you must make the required modifications.

For the example code above, the Behaviour calls the REST Endpoint and checks to ensure that only Issues from the Mock project can be added to the Sprint. 

Below are some test screenshots:-

1. For the first test, I try to create an issue from the Mock project and select the Sprint from the Mock project as well. As expected, the Sprint that is selected allowed for the Mock project.

2. For the second test, I try to create an issue from the Beta project and select the same Sprint selected for the Mock project. As expected the Sprint is not allowed for the Beta project and a validation error message is returned as shown in the screenshot below:-

I hope this helps to solve your question. :)

I am looking forward to your feedback.

Thank you and Kind regards,
Ram

[Marc - Devoteam]

Hi @Emil Naghiyev 

Make sure the users don't have access to the other project, or don't grant them Edit permission on the other project

It al depends on the permission scheme used on the project, based on role, group or user and if based on roles, what role the user has on a project.

Also an option is to use different permission schemes for a project.