scriptrunner getWorkflowButtons.call() permission and token problem

[jane chen]

I made a scripted workflow postfunction to send email to reviewer. inside the email, I used getWorkflowButtons.call() to display workflow buttons for reviewer to approve/reject. it works well if no special permission setup.

then in my workflow, I want to allow approve/reject only for reviewers, but not for submitters, so I add permission control in workflow condition.

the first problem is. the workflow is triggered by submitter. so the function getWorkflowButtons.call() get all the buttons as submitter's permission, but for the reviewer, so the approve/reject button doesn't show.

How can I provide workflow buttons in email that works for reviewers?

when calling getWorkflowButtons.call() can I set any project role to limit the buttons?

the second problem is, the button by default point to an URL with token inside, but when reviewer receives email and click the button, it always show token missing error "XSRF Security Token Missing". How can I get this error resolved? (although retry works, but the user experience is bad.)

Thanks!

[laurent vanhalle]

For the first problem, just change the order of this postfunction

[jane chen]

Thanks for the answer. 

May I know to which step/order should my script run?