Is there a way to limit macro access/visibility in macro list to specific users with scriptrunner?

[Stefan Salzl]

Hi community,

We are testing a new add-on that provides macros in confluence. Unfortunately it cannot be limited to either users or spaces. So all user could use this macro. As this macro provides data from a 3rd party it should be possible to limit who could create those macros in pages/choose the macro in the macro chooser.

Is there any possibility to hide the macro buttons in the macros dialog (when I click "add macro" and show the full list) ?

thanks in advance.

Best
Stefan

[Nic Brough -Adaptavist- · Accepted solution]

Scriptrunner can't do this because there's no function in Confluence that does this.  Unless a macro app codes for "only allow in certain spaces", there's no way to do it.

[Stefan Salzl]

Thanks for your time and answer @Nic Brough -Adaptavist- 

highly appreciated. I was afraid this would not be possible but I thought: "well let´s give it a shot"

Best
Stefan

[Nic Brough -Adaptavist-]

Always worth asking!

[Radek Dostál · Accepted solution]

Not as far as I know. Why does the macro show any 3rd party data though? That sounds rather weird to me.

[Stefan Salzl]

Any (kinda) connector makro shows data from another system even if it´s only the jira-macro in confluence (which shows eg. issue data from jira).

In this case it´s really another software where the macro communicates via API. 

IMHO permisssion or at least read/edit config should be possible within the addon-config and there should not be a need for this question here =S

Thanks for your time and question anyways.

Best
Stefan

[Radek Dostál]

Well, jira issue macro (provided that it's the native one based off Application Links) will respect the user's permissions. If they can see any issues, then that means they can log in to jira and browse them. So, not really a leak.

Unauthorized user which doesn't have access to those issues won't see them.

You still haven't told us what macros / 3rd party app it is, so hard to tell.

Either way, if a macro contains hardcoded credentials in the background to authenticate to some remote app, then it's a bad macro and you should tell the vendor your use case so they can implement either restrictions, or support per-user data.

Macros are supposed to be generic, ask for parameters. No macro should just show some magical content from somewhere without respecting the user's permissions, and this is respected both within Confluence content as well as Application Links. This really sounds more like a vendor's oversight, not a Confluence one.

[Stefan Salzl]

Maybe jira was not the best example as other apps/connectors from outside of the atlassian universe use technical application users. never mind. 

Thanks for your time.

[Stefan Salzl]

Hi @Radek Dostál 

sorry, forgot to mention the addon as it is a vendor/company mainly action regional in German speaking area:
https://marketplace.atlassian.com/apps/1224860/adoit-enterprise-architect-for-confluence?hosting=cloud&tab=overview

AND: YES, I fully agree. As mentioned before an addon should absolutly respect/enable user´s permission.

Best
Stefan