Tempo "View Team Worklogs" option affects other teams

[Matthias Kannenberg]

If I have "View team worklogs" permissions in one team I can see the worklogs of my team members from projects and teams outside of the team's scope in tempo reports and account timesheets.

This is on Jira 8.20 Data Center.

Example:

Lets say I have the Jira projects Alpha and Beta. Both also have dedicated Tempo Teams and Tempo accounts. Lets further say I have 3 people: A, B and C.

• Project/Team Alpha
  • A is part of the Alpha team and has "View team worklogs" Tempo team permission as well as "View all worklogs" Jira project permission
  • B is part of the Alpha team but has no elevated permission (only sees their worklogs)
• Project/Team Beta
  • A, B and C are part of the Beta team and project but do not have "View team worklogs" or "View all worklogs" permissions

Expected Results:

• A can see B's worklogs from Alpha in the Tempo Team Timesheet, in reports and Alpha's account timesheet
• A can not see B's worklogs from Beta in reports and Beta's account timesheet
• A can not see any of C's worklogs in tempo reports or account timesheets

Actual Result:

• A can see B's worklogs from both Alpha and Beta in reports and Beta's account timesheet
• A can not see C's worklogs from Beta in reports or Beta's account timesheet
• In the collaborators overview on each issue in the Beta project A can see themselves and B, but not C

In my oppinion this does not seem to be intended behaviour and settings in one team should not affect anything outside of this teams scope (in this case any worklogs from projects not linked to the team).

My uneducated guess would be that Tempo allows me to see another persons work logs if I share a team with them and have "View team worklogs" permission and as soon as it find's such a connection does not check further for "View all worklogs" project level permissions.

[Susan]

In Tempo, the intended behaviour of view worklogs permissions are as the following:

"View team worklogs" - user A will see all the worklogs of the team members regardless of which projects these team members have worked on. User will not see issue details if he/she does not have correct project permissions.

"View all worklogs" - user A will see all the worklogs of the project regardless of which teams have worked on. User does not need to be in any teams to view these worklogs.

Based on these condition and apply with your case above:

User A has "view team worklogs" for Team Alpha and "View all worklogs" for project Alpha, then User A should be able to see all the worklogs of project Alpha because of "view all worklogs" project permissions, regardless if user A has "view team worklogs" of Team Alpha.

User A can only view user B's worklogs in project Beta, but not of user C, because user A has "view team worklogs" permission in Team Alpha and has no permissions in Team Beta.

I hope this clarifies the difference between team and project permissions in Tempo.