Condition in workflow to check user roles against the reporter roles with "Browse Project" permissio

Question

To execute or not a transition in a workflow, we want to verify whether the current user shares at least one role with the reporter with no more than the 'Browse project' permission.

Currently, the 'Administer Projects' permission is needed to get the list of reporter roles ('issue.reporter.getProjectRoles(project)').

Would it be possible to extend Jira's native conditions with a new one such as “Reporter role condition only” (without any parameters): Condition authorizing only users with at least one of the role of the reporter (whatever this role may be)?

Executable with 'Browse project' permission.

Similarly, why not also add: 'Only Reporter Group Condition'. Same logic, but applied to groups instead of roles

Serge Kouloundjoian · Answer

Thank you Walter for taking the time to reply.
We have done what you wrote about the role/group/authorization/people.
I think I need to detail deeper our organization to explain why we need to verify the role.
We have 2 kind of tester teams. In the first stage, team 1 checks the software development against the technical specifications. Then after, team 2 checks the software against the business requirements.
We assigned tester team 1 and 2 in two different roles, both roles having permissions to browse the project, ..., and resolve issues.
We want that only tickets created by tester team 1 to be able to be closed by themselves and not by the second tester team. And vis versa for tester team 2.
That's why I was looking for a new condition like 'Only Reporter's Role Condition'.

Walter Buggenhout · Answer

Thank you for the additional information, @Serge Kouloundjoian. I think I had understood what you are trying to do, but I still don't get why you would make things so complex.

How permissions are normally set up, is as follows:

* You define a set of project rules in Jira Settings (such as Administrator, Developer, Tester).
* In a permission scheme, you assign these roles to the right permissions, e.g. as follows:* browse project: Administrator, Developer, Tester
* administer project: Administrator
* create issues: Administrator, Developer, Tester
* edit issues: Administrator, Developer, Tester
* transition issues: Administrator, Developer, Tester
* resolve issues: Administrator, Tester
* ...

* On the People page in your project, you assign people (groups or individual users) to one or multiple roles, which grants them the permissions defined in the permission scheme for those roles.

To make sure a tester does not gets administer project permission, all you need to do is make sure he/she is not assigned to the administrator role and see that the tester role is not granted administer project permission in your permission scheme.

If you do things this way, I can't possibly imagine why you would need to lookup the user roles from the person who created a ticket to determine who can close it.

To illustrate with an example based on the case I elaborated above. If I would be a project user with only the developer role, and there was a way to dynamically determine who would be able to resolve an issue I created, it could only be closed by someone with both the developer and administrator or tester roles. That does not seem very transparent.

Apart from that, I also can't see any way to make it work the way you describe the case, even if you wanted to.

Serge Kouloundjoian · Answer

Hi Walter

Thank you for attention and your reply

Sorry for that, my post was not so clear. I was referring to the roles attached to the reporter (i.e. those returned by the method 'issue.reporter.getProjectRoles(project)').
As a condition of a transition in a workflow, I would like to check if both, the current user and the reporter, are in the same project role, whatever this role is.
Let's do this following assumption: the reporter is in the projet role 'Tester'. He created an issue and he is authorized to close this issue. I would like to authorize other users to close this issue under the condition they are in the same project role (i.e. 'Tester').
And I would like to grant the project role 'Tester' with the 'Browse project' permission. Not the 'Administer Projects' permission.

Hope this explanation is more understandable and it would be great if there is a way to solve it